and technology can both be an accelerant as well as an ability to fix some of these larger systemic issues that we're facing. So assuming that everything that we're working on we're all trying to build the safest version of that for our communities, I posit that the absence of diversity

or the homogeneity in thought is in fact an attack factor that has not been sufficiently mitigated in our ecosystem. So first things first, is diversity in cybersecurity really a problem? In a survey of 9,500 US cybersecurity professionals, it was found to be that minorities represented 26%,

which is slightly higher than the US national average, which is 21%. That same survey found that the ethnic and racial minorities are actually consistently not holding top managerial positions. And that pay inequity, especially for minority women continues to be a real challenge.

Now, diversity comes in many forms of course, it's not just race, gender, sexual orientation, but if we believe that talent is equally distributed across a population, any under-representation by one of these groups in our field means that we have less talent in our group

than there is in the total workforce. And we deal with some really hard challenges in cybersecurity. We need that talent to actually build solutions. So maybe the first question we can ask ourselves, how do we broaden those that are attracted to cybersecurity? One of the interesting things about cybersecurity

is that it's often perceived as this very technical field but at the end of the day, it's about people interacting with technology and information, but that isn't always obvious to people looking at the field from the outside. This common misperception of a purely technical discipline means that an even more people facing roles,

we tend to have people with technical backgrounds. That seems like a missed opportunity to include more people in our ecosystem. Calls for diversity are frequently met with the argument that raising one group above others gives them an unfair advantage in society.

So how can we actually make meaningful change? We need to focus on more than recruitment, even though that is absolutely important and critical. We need to think about how do we encourage a broader group of people to even consider coming to work into cybersecurity. That requires thinking about the different ways into security, the training that we offer people

coming into the field and are we building tools that make it an accessible place for them to work and be successful. We need to find pathways into security where anyone who wants to be involved is able to get involved. Hiring for skill and passion and not just the right certification or college degree.

Salesforce and Google have recently shared technical training and it's free and available to all. It seems like an advanced step to try to change some of the systemic issues about access to technical education. And it also seems like an effort to change our definition of what is qualified.

It takes effort to understand different backgrounds, different education, different experiences. But the unconscious bias that we're potentially placing on qualifications can be something that we aren't aware of because we just don't know what's a problem. It's built into our culture,

but we need to expose these moments of unconscious bias and find new ways to think about it. The formal paths that we follow for recruitment have historically not always created diverse teams. So we need to think outside. One way is to partner with organizations that are intentionally targeting diverse populations

that are trying to get into the field, like the International Consortium of Minority Cybersecurity Professionals. And if the oversubscribed women only cybersecurity conferences are any indicator, there are plenty of women that are trying to get into the field. So with all this discussion about attracting diverse talent,

it would be remiss of me to not discuss retaining this talent. How do we keep teams from burning out and protect them from the stress that comes with cybersecurity? A significant number of security professionals seek to leave this field every year.

Security can be so demanding that one survey found that 50% of security professionals think about taking a lower paid job because it's so stressful. Or two thirds of people have considered leaving the field entirely because the demand is too high. This means we need to change how we support each other,

not just managing and mentoring each other so that we are continually growing and careers are progressing. But we need to think about giving our people meaningful training so that they can understand how to be resilient and deal with the fact that they are on the front lines of trying to defend an organization.

So taking a page from threat modeling, how can we think about diversity or homogeneity of thought as a potential attack factor that we need to consider? Every gap in a process where data moves from one team to the next, every assumption a developer or a defender makes

about how a system will work or how a user will interact with that system, those are the cracks that an attacker can try to exploit. And if everyone in the security team thinks the same way, has the same way of working, these attack vectors will continue to crop up.

Getting a wider range of people into cybersecurity is not just equitable. It's truly our best chance at doing something meaningful with security. And we've seen how security can have a big impact on society. In the 2016 US presidential elections, the campaign trail brought to mainstream society,

something that this community has long preached. Securing unstructured data such as email is critical. The 2016 election further saw Russian disinformation that intentionally targeted black communities using fake accounts on every social media platform to share racially charged posts.

Whether such efforts had a significant effect on the election or not is hard to determine and not the intention of this talk. Instead, it seems like an opportunity to reflect and think, how did the authentication model fail on these social media platforms? What aspect of spoofing was not considered?

Or perhaps it was never a use case that would be thought of that charged racially political ideas would be shared on these platforms. Unfortunately, we haven't seen it stop with these elections either, but it's continued in the targeting of BLM activists by cyber criminals.

This spring, we've seen DDoSers attack BLM groups. Cloud Fair reported that those groups that identified as advocacy focused saw a 1,120 times increase in attacks on their organizations just from May to April. And that's in comparison to the broader ecosystem.

Racism breeds distrust in systems and institutions. We saw how technology furthered this problem in the implementation of the US facial recognition protocol at borders. NIST found examples of age, gender, and race bias in several widely implemented systems

to the extent that all except the top performing ones had a 10 to 100 times higher likelihood of misidentifying African American, Alaskan Indian, Pacific Islander, and Asian American faces in comparison to their Caucasian counterparts. Technology and policy mitigations need to be implemented

where society, systems, and technology have weaknesses. While the BLM movement has resulted in highlighting the need to dismantle systemic racism, technology is the accelerant that can take this from a city by city initiative and instead build anti-racism

into our collective ecosystem. The people in this community are at an exciting time in healthcare. Everything is getting connected. Insightful data is being gathered. We're on the cusp of actually having true personalized medicine because of the treasure trove of data that we're getting. But as you work to develop these systems

and these amazing interventions, we also need to ask ourselves what can we do to ensure that cybersecurity alleviates the systemic bias that exists today? So true in threat modeling and true in thinking about diversity, here are 10 things to think about that might stop you from thinking about diversity,

but they really shouldn't. Number one, don't be afraid to ask questions. Try to build this community and an ecosystem where it's safe to ask questions and get engaged in a dialogue and to be wrong. Number two, you're never going to be done. This is an ongoing process that will consistently change

as technology evolves and as our community changes. Number three, there is no one way to pursue this. It's a complicated issue that has evolved over a long period of time and will require a complicated solution in all likelihood. Number four, this takes more than just one skillset.

Just like effective security, it requires a wide variety of skillsets to be successful. This too will require variance in capabilities. Number five, this isn't going to be easy. It's going to take time and it's going to take effort. Number six, this isn't just for the experts to solve.

We all have a role to play and can contribute in a meaningful way. Number seven, accept that you're probably gonna focus on the wrong thing at some point. And that's okay, that's part of learning. Number eight, find an ally to help guide you. There are many in this community and outside of it

that are willing to share and help us as we grow and change. Number nine, don't dismiss the interplay of societal change and how it impacts cybersecurity. And number 10, there's no right time to start this, but this certainly feels like a great inflection point. So thank you for your time.

I'd love to open up the conversation if that's something that we're able to do. Take care.