We’re Out of Balance

Page Content

Share:

I’ve had several items cross my social media feeds, along with email, in the last few days that prompt me to write this. It’s gotten a bit longer than I intended, but there’s a lot to say on an important topic. As a first post to this blog in 2014, I think it is a good topic to address. It has to do with imbalance and bad behavior in the overall field of cybersecurity: the low percentage of women, and how they are sometimes treated.

Computing, as a field in the USA, has had a low and almost constantly decreasing percentage of women going into the field and staying. (The US is the primary focus of this blog entry; I believe the problem is similar in Canada, the UK, Australia, and others, but don’t have the data. Also, there is a corresponding problem with other traditional minorities, but that’s not what prompted this post and I hope to visit it later.). There are many reasons posited for this, many of which are likely somewhat to blame; there is no single, dominant reason, apparently. Many studies and reports have been conducted, experiments tried, and programs put into place, but few have made any measurable, long-term change. The problem is almost undoubtedly rooted in social behaviors and expectations because there are other cultures where the ratio of women to men is about 1:1, or even has women in larger percentages.

Cybersecurity is little different, and may be worse. I regularly speak at conferences, companies, and agencies where the room will have 30 men and one (or no) women. At events where there are speakers or panels, all the speakers and panelists are men. The few women attending often are simply the ones there processing registrations. And there are a nontrivial number of reports of women being groped and harassed at professional meetings (see, for instance, this). Also bad, women are frequently abused online as well as offline, and not only in security and computing. Many are reluctant to publish email addresses or contact info online because of unwanted, inappropriate content sent to them — no matter whether they’re 8 or 80.

(Right now, if you are thinking to yourself that there isn’t a real problem, that things are fine, and it is all a problem of some women who can’t take a joke, then you are part of the problem, and you need to shape up. Worse, if you think that women shouldn’t be upset about this status quo, instead they should get back to the kitchen, then you are so out of touch that I don’t know where to start. In either case, try telling that same thing to women doctors, pilots, police, firefighters, or better yet, to our many women in the military — especially when your safety is in their care. Then come back when you’ve healed up. If nothing else, at least keep in mind that there are legal reasons to treat people equally and with respect.)

Assuming you are actually living in the 21st century, let me assure you that the overall situation is a HUGE problem for us. As a field, and as a society this is bad because we have a shortage of talent that is getting worse with time. We also have some rather skewed and limited ideas of how to approach problems that might benefit from a more inclusive pool of designers and practitioners. And as human beings we should be concerned — especially those of us who are sons, brothers, fathers, and husbands — people who could be (and sometimes are) our mothers, sisters, daughters, and wives are being mistreated and demeaned. That simply isn’t right. Neither is it right that we are limiting the opportunities for individuals to learn, grow, and achieve.

Computing, security, privacy, creativity — those are all traits of the mind. Minds exist in all kinds of bodies, including those with other colors, more or fewer curves, different masses and volumes, varied ages, and some have less physical abilities than others. But that doesn’t change what is possible in their minds! We should applaud ability, dedication, and imagination wherever we find it. Discouraging women (or anyone with ability) from pursuing a career in computing, abusing them online, and groping them at conferences are all counterproductive to our own futures — as if rude and wrong wasn't enough. Cybersecurity and privacy are key areas where we need more insight and creativity — we should enhance it rather than diminish it.

No field is populated only with superstars and wild talents. That is especially true in IT. We hear about people with great accomplishments, and we like to think we’re special in our way, but the truth is that the field is too large for any individuals to master it. Success comes from teams, and the most successful teams are those that integrate many different viewpoints, backgrounds, and skill sets, and who respect their differences yet work with common goals. That includes bringing in people from different genders, ethnicities, ages, and more. Success is enhanced by diversity.

I’m not going to go through a longer litany of problems here, or try to analyze the situation further. I’ve been working with various women’s groups for over 20 years and I still don’t pretend to be able to understand all of what is happening. It is complex. However, I see the problem continuously when I look at our student body, when I visit professional meetings, and when I read reports. I know it is real.

What I can do, is offer some advice to those who care.

For Men

Here are some general tips that should be common sense.

  1. Simple: be aware. Help others be aware. Don’t limit your involvement to this alone, but everything else flows from here.
  2. If you have children, encourage them and their friends to consider computing in school. Be supportive of anyone trying an IT profession. Be positive and not condescending.
  3. If you are a teacher/professor, don’t let the male students bully or harass the females. You are there to create a learning environment for everyone. Generally speaking, many women are less quick to respond to questions as they think about how to frame the answers, and they tend to let others speak without interruption; males generally are the opposite. Don’t let anyone be interrupted when speaking, and ensure that everyone gets a chance.
  4. At a conference or professional meeting? Don’t assume that the women are less important than then men there -- especially if they look young! Address everyone equally. No one should be invisible. Would you want people to ignore you or trivialize what you had to say if you looked different than you do? Address the person, not the appearance.
  5. Don’t ever touch a woman, without her clear uncoerced permission, in any manner that you would not touch a male authority figure. That is, would you touch your boss/professor/policeman in the same manner — without getting slugged/fired/arrested? Thus, shaking hands, fine. Catching someone if they stumble, fine. A greeting hug? Let her initiate it. Grabbing their butts? Definitely no. Use the same rule of thumb for language. Would you proposition a male policeman you just met?
  6. As for language, think carefully about your adjectives. If you would be “firm” and “decisive” in what you do, don’t describe a woman colleague as “bitchy” if she acts similarly! If you are "aggressive" she is not “pushy.” Banish “overly emotional” and “moody” from the list, too.
  7. Don’t set perceptions based on age. Women report that young male colleagues are often given opportunities to “prove themselves” or “learn the ropes” but they are not given the same opportunities because they are too young. Don’t either give or limit opportunities based on age or whether you think someone is attractive — either way, you are limiting what you could get and what they can do, and that is your loss.
  8. Be polite to everyone. Manners matter, even if it doesn’t seem that way some times. Don’t treat any group differently than any other. This includes not making jokes about people to others, staring openly, etc. That’s maybe the norm in 3rd grade, but not in a professional context.
  9. If you see someone else being gropy, rude, or otherwise inappropriate, speak up. (And “Attaway, bro!” is not the thing to say.) No, of course you are not defending someone weaker — you are chastising someone acting unprofessionally. That is because you should also do the same for anyone being rude to someone in a wheelchair, wearing a turban, with brown skin, with a missing limb, speaking with a lisp, or simply standing there. Being different is never an invitation to be abusive or rude. Report it to event organizers or management, too.
  10. If you are invited to speak or appear on a panel at an event, ask who else has been invited. If they don’t seem to have invited (m)any women, suggest some and don’t agree to speak until they filled out the roster a little more. I have heard one good rule of thumb (which I try to follow) is not appear on a panel unless at least one woman is also on the panel. Help give other voices a chance to be heard.
     
    Can’t think of any? Then either you aren’t paying attention or you are willfully ignoring the situation. Here’s a partial list of some of the better known women in the field of cybersecurity/privacy, all of whom I hold in great regard (and my apologies as there are many more I could list — these are off the top of my imperfect memory): Anita Jones, Dorothy Denning, Mary Ann Davidson, Window Snyder, Jean Camp, Elisa Bertino, Rhonda MacLean, Deborah Frincke, Melissa Hathaway, Chenxi Wang, Terry Benzel, Cristina Nita-Rotaru, Jeannette Wing, Cynthia Irvine, Lorrie Cranor, Dawn Song, Helen Wang, Cathy Meadows, Harriet Pearson, Diana Burley, Rebecca Herold, Shari Pfleeger, Shafi Goldwasser, Barbara Simons, Erin Jacobs, Becky Bace, Radia Perlman, Nuala O'Connor Kelly, Wendy Nather, Linda Northrup, Angela Sasse, Melissa, Dark, Susan Landau, Mischel Kwon, Phyllis Schneck, Carrie Gates, Katie Moussouris, Ronda Henning…. There are literally thousands more who are less senior but are likely to have interesting things to say. Simply look around. And if you’re organizing the event, consider this.
  11. If you are a VC or senior executive, don’t automatically hire someone from the “good ol boys.” That you only think of men to fill senior positions may be a case of tunnel vision, as in the previous item. Look around. And don’t let implicit assumptions about age or gender drive your decision-making: leaders come in all shapes, sizes, and ages.
  12. Besides giving opportunities to women to speak or lead, give them opportunities to fail without blanket condemnation. Everybody has limits and make mistakes. If you asked a young male employee to do something and he didn’t succeed, would you think to yourself “I never should have assigned that to a man”? Unless the task is peeing his name in a snowbank, gender doesn’t have anything to do with it (and if that is the tasking you give employees you have other serious problems to resolve).
  13. In a professional setting, don’t exclude the women because you think they’ll be “offended” or that they’re “too sensitive.” They aren’t china dolls that are easily broken! Include them as part of your team and make them feel like part of it. We look at the world in different ways. If you’re concerned that jokes or activities might be offensive, then maybe those aren’t the right kind of team-building experiences you should be having. (For example, you don’t need to go out for beers to the strip bar on Friday to build team presence; going out to a nearby Irish pub or a restaurant will accomplish the same thing if what you are after is a social experience.) Do the same with students if that is your context.
  14. Similarly, think about mentoring — be a positive mentor for colleagues and those junior to yourself, men as well as women. Offer it, but don’t force it (that’s what a mentor is: a voluntary guide).

The basic idea here is really embodied in #8. Be thoughtful and don't treat anyone as substantially different Instead, relate to every person as a professional. But most of all, speak up if you see someone getting picked on or treated badly, or if they aren’t getting encouragement they should. It’s like security and privacy itself — an attack on any link is an attack on the whole, and if a link falls we are all diminished.

For Women

As a general tip similar to the list above, don’t ever think you are the only one experiencing some of the things that happen. Don’t blame yourself, or wonder what it is you are doing wrong — that is sometimes a natural reaction when you are in the minority and everyone seems to react to you in a manner you don’t expect. Do push back on rude behavior, don’t be afraid to make it clear when limits are reached (or exceeded), and do consider reporting persistent or very rude misbehavior to event organizers or supervisors. Yes, it can sometimes have unexpected consequences, but without that negative feedback the behavior is likely to continue against you and others; evaluate your own tolerance for risk vs. harassment.

There is debate within many minority communities of whether aligning with self-interest groups is helpful. On the plus side, the mentoring, the support resources, and the sense of community can all be a big help. However, that also runs the risk of not sufficiently engaging in the mixed environment where one has to work, of developing unrealistic expectations based on anecdotal stories, and failing to help educate the majority in how to help. There seems to be enough positive “buzz” about some groups and their activities to warrant recommending them. Not all are likely to fit your own particular needs and interests, so check them out. If you know of some I have missed, please let me know so I can add them here.

  1. ACM-W is generally for women in computing, world-wide, and provides community and resources. See their web page for more info. They have a mailing list to which you can subscribe, even if you have not (yet) joined ACM; computing professionals should consider joining the ACM.
  2. There is a long list of organizations for computing, in general, at the Ada Project that I won’t try to duplicate — I suggest you look at it. (I will also note that I have heard some criticism of the Ada Project itself, so I am only recommending the list.)
  3. The Anita Borg Institute. The ABI sponsors the annual Grace Hopper Celebration conference, which is worth attending, plus they do a lot more in events and activities, one of which is the Systers List.
  4. The National Center for Women & Information Technology (NCWIT) has quite a few resources and activities.
  5. The Computing Research Association’s CRA-W is directed to enhancing the careers of women in computing research
  6. The ISSA has a SIG with multiple blogs, meetings, and resources. You must be an ISSA member to access them. They also have a private LinkedIn group. (Security professionals should give thought to joining ISSA)
  7. I am told that ISACA is another organization in the security space to check out for their support and activities.
  8. The Women’s Society of Cyberjutsu is a security-focused organization for women that seems to have a fair bit of momentum.

The (ISC)2 is organizing a women’s special interest group. I have spoken with organizers , but am unsure of the status of it at this time.

The Women in Cyber Security conference will be held in April in Nashville. I know nothing about it other than what is on their web page, but it looks like it could be a great experience.

ACSA has a scholarship program for women in computing; multiple scholarships are available. The (ISC)2 Foundation also has scholarships available.

Of course, please keep in mind that not all men are the same! Many want to do the right things but aren’t always sure what is appropriate. Help train a few. grin

Parting Thoughts

From a professional point of view, being a member of ACM and ISSA is good idea for anyone in the field, based simply on the value of the organizations. Both promote professionalism, community, and personal growth, and there are a variety of other benefits to membership. Both have steep discounts for student members. I am a long-standing member of both, and can recommend them.

Our society has a lot of problems with cybersecurity and privacy. New flaws show up, and old flaws don’t really get fixed. Parties ranging from individual criminals to nation-state organizations are all seeking ways to penetrate our systems and mess with our information. We need every good person we can get on board and working together if we hope to make progress. We should make every effort to enable that partnership.

Or think of it in these terms: if we can’t be trusted to protect and empower those within our own community, why should anyone trust us to protect anything else?


Updated 1/7: Added a few list items about mentoring and language, listed ISACA, small grammatical corrections.

Updated 1/8: Corrected several typos

Updated 1/10: Added ISSA group link. Added comment from Anita Jones; this is the memo she mentions in that comment.

Updated 1/14: Small grammatical corrections.

Updated 1/22: Added ACM-W page link

Updated 1/24: Added the Systers link

Updated 2/16: Added link to subscribe to the ACM-W list. Minor grammatical cleanup.

Updated 3/2: Added links to ACSA and (ISC)2 scholarship information.

If you have any additions or corrections to the above lists, please send me private email. Also note that, as usual, anonymous, spammy, or abusive feedback to the blog may not be published as is, if at all.

Comments

This is a long-standing professional and personal interest of mine, now amplified by having two college-age daughters, one studying biology and the other planning on computer science.

I’m not sure how much of this problem is women being rejected by this field, culture, etc., versus women choosing other fields of greater interest to them.

Other science/engineering fields appear to have the same problem; I remember my nuclear engineering graduate program from the 1980’s, which had about 100 students total, more than half from other countries, and I believe only 3 of the total were women.

Current participation in cyber security competitions show the same trends as this article, the participation of women is almost nonexistent.  However, I don’t think this is the case for the high school competitions.

Perhaps we need a serious survey effort by IEEE/National Academies/NSF focused on separating out major versus not so major elements of this problem, and also look at generational dynamics.  Or does some of this data exist already?
===========
Spaf sez: There is a lot of data on this, and many studies over decades.  Women tend to drop out of math and computing programs starting as early as junior high.  The attrition continues through undergrad studies.  It isn’t STEM, per se.

High school events in robotics and some competitions do tend to draw in young women, but some of the more intense competitions actually help to drive them out as it is not the kind of environment they want to have as a career.

There is an image that is portrayed in media that people who work in computing are socially isolated, working in a cubicle, and all co-workers are (at best) eccentric and unattractive.  That is also not welcoming.

Every little thing that sends a negative signal is part of the problem.  Once the signal has enough gain, the recipient moves on to something else.

Posted by Scott Tousley on Tuesday, January 7, 2014 at 08:47 AM

Spaf,

I glad you wrote this; it needs to be seen widely and acted on.

your recommendations are clear and actionable—well done!

Posted by Brian Snow on Tuesday, January 7, 2014 at 04:08 PM

Certainly I’m against sexual harassment, but if there were a list of the reasons women don’t go into computer science and specifically computer security, my guess is that hacker conference sexual harassment would not make the top 10.

I have about 80 undergraduate cryptography and information security students this semester, and 10 of them are women.  Maybe one of them has ever even heard of Defcon.  So, that’s not keeping them away in droves.

I concur that most girls consider computing to be a geeky activity with a lot of screen time in front of a computer and not much interaction with other humans.  Of course, as we know, nothing could be further from the truth.  Developing software is a highly social and collaborative effort.  We need to bring this point home continually from a young age as part of an overall STEM focus for girls.

Also, I note as a judge for the county and state science fairs, that there are myriad entries in biology but scant few in computer science (and typically none from girls).  That tells me that there is inadequate teaching at the elementary, intermediate, and high school ages to impel students forward in computing.  It’s not till they go to college or pick it up on their own that they figure out what computing is all about.

===========
Spaf sea:  Right about DefCon, but I’ve heard similar complains about many other events.  It is a total issue — not simply one thing.  It is an accumulation of noise that eventually drowns out the signal.  We need to address as much as we can to drive the noise away.

Posted by Jeremy Rasmussen on Tuesday, January 7, 2014 at 04:10 PM

D’accord.  Well written, concise.  Practical.

I do remember when I started at the DoD Computer Security Center being surprised at the relative parity between junior employees, male and female.  Now, 30 years later that seems a remote atypical experience.  My wife is frequently the only technical cybersecurity professional in meetings of 10-30 folks.  And there are only a handful of technical females (not all cybersecurity) in her whole program office.  I wonder about the change, but I don’t know what’s caused it. 

It is a sad development.

Posted by David Bell on Wednesday, January 8, 2014 at 08:21 AM

In my area of the cyber field, I find either men don’t think I can do the job at the same level they can or they are scared of my smile. Either way it’s almost impossible to get help, training, or to be taken serious. They rather have a man on the team.
I’ve been not allowed to brief information I worked on because the PM was scared no one would listen or I would not deliver the message well even though it was my work.
I’ve about given up in this field. I love computers and wearing a white hat… But does my hat need to be black to be noticed?????
If I go to conferences I get hit on and not included in any real conversation. What’s the point of going?

=============
Spaf sea: This is the kind of situation I was writing about.  Have you tried telling your boss this message, directly?  Maybe pass him a pointer to my post?

I will say that not every environment is this oblivious.  You might explore a new employer.  It would be a shame to lose you from the field!

And do check out some of the groups and resources I listed.  You may get some support and other ideas from them to help make your situation better.

Good luck.

Posted by x__x on Wednesday, January 8, 2014 at 09:20 AM

Spaf sea

It was my boss that was doing this. I left that job.

I really think for females to get anywhere they have to always talk tech. If for one min you slip and talk about work in a non tech form, you obviously don’t know what you are talking about….

And why is it when I make a c++ joke I get snotty come backs like “learn c++”.

Obviously, function stop() {//hammer time} was a joke…grrrrr

But the guys can write a code the outputs that someone in our office isn’t liked and that’s funny.

Posted by x__x on Wednesday, January 8, 2014 at 10:36 AM

While certainly not true for everyone, in general I find that the social behavior between men and women, vs between women and women or men and men is part of the problem.

Men, when among men, have a very “play hard, but leave it on the field” attitude that is unusual among women. They’ll say exactly what they mean, without further context, and take little to no offense. They could follow a tense business meeting with a few drinks at a bar with the same people, and have a great time.

Women, long trained by our culture to be sensitive and nurturing to others, will stop to consider how others might react to her statement. This is why an assertive woman is a “bitch” - as a culture, we tend to expect women to be more nurturing.

Women, as you noted, are much more likely to take longer to consider what they’re about to say - as well as how they are going to say it - before making a statement. Since women in a technical field are more likely to be unfairly considered incompetent, she spends more time making sure what she says will not increase this idea. Sometimes it seems safer to say nothing, especially is the woman is normally quiet or shy.

Women, among other women, take a much greater offense more easily to statements that in a man-to-man context would be shrugged off. That’s because among women, these thoughts are less likely to be off the cuff and more likely to be heartfelt.

When these two sets combine, it causes friction. We have an entirely different set of behavior when we’re interacting with groups composed of both genders. Moreover, if the group skews heavily one direction, that gender’s social rules are given more weight. In a room of many men and a few females, the men will tend towards more displays of machismo. In a room of more woman than men, the women will be more in control and confident as the men speak less.

As a group becomes more heavily skewed, the gender in the minority will continue to shrink. Women, in general, do not feel comfortable in a room dominated by men, any more than a man enjoys being in a room dominated by women.

Moreover, I think that as a society we’ve become so entrenched in the idea that everyone is equal that we forget the long history of inequality among the genders that still pervades our culture and subconscious minds.

Posted by Kate on Wednesday, January 8, 2014 at 03:16 PM

Spaf,
  I read your essay with great interest.  And I am pleased to be cited.

  You might find the attached memo that I wrote for my faculty some years ago of interest.  What is startling is that women and men alike discriminate, not from nasty intent, but based on our social conditioning and norms.

  You can use this memo [[See the link in the “Updated 1/10” comment in the blog entry.]]—e.g. circulate it to your faculty, even post it on your blog.  It is a summary of some compelling data about discrimination, and gives some suggestions of how to avoid it.

Best,
  Anita

Posted by Dr. Anita K. Jones on Thursday, January 9, 2014 at 03:28 AM

BRAVO!! What a wonderful article!  I’ve been in the computer field for years (although not in cyber security) and have felt rather isolated as one of the few females that seems to be active in the the field.  Over the years I have applied with companies for jobs for which I was obviously qualified, but was treated with doubt and cynicism.  It wasn’t until I started my own company that the attitudes changed.  Isn’t it interesting that people outside of the computer and IT world don’t view women as out-of-place?  In fact, most of the business owners that I speak with appreciate both my knowledge and my approach.  I have NEVER had my skills called into question.  But I think the problem has many roots in everything from bullying to mob mentality with the men and lack of knowledge in women on how to deal with bullies.  Obviously there’s even more going on that this - for instance, the anonymity with an IT environment is very similar to the rise in online-bullying because there is so little face-to-face interaction if not complete anonymity.  People are far bolder when they don’t risk being called to the mat for their bad behavior.  It’s pitiful really.  In this day and age we shouldn’t have to even have this conversation.  I’m in development and marketing… I can’t imagine being in cyber security but certainly applaud the women who ARE there.  I also appreciate the groups that you list in the article.  They are well worth a look, for their support if nothing else.

Posted by Mart on Monday, January 13, 2014 at 10:23 AM

It’s good to see you took initiative against this and wrote this wonderful articles with advises. But those women who works at cyber security, hats off to them for working in such situations out there. I hope more and more people read your article and start implementing it. Thanks for sharing it!

Posted by Mtubuzz on Monday, January 20, 2014 at 06:06 AM

Another great resource for women in technology is Systers an listserv run by the Anita Borg folks. It is heavily monitor and the topics are always about women and technology. You can find them at www.systers.org

Posted by Sydney Liles on Friday, January 24, 2014 at 04:57 PM

I glad you wrote this; it needs to be seen widely and acted on.

i hope many people can see and understand all of this…its really helpful

Posted by horison sunset road on Tuesday, January 28, 2014 at 08:55 PM

This blog is making a dfference… wink

Posted by schele metalice on Monday, February 10, 2014 at 06:56 AM

Excellent read! Thanks!

Posted by Ben Holmes on Sunday, February 23, 2014 at 11:55 PM

i hope many people can see and understand all of this…its really helpful
thank you.

Posted by seo company india on Saturday, March 1, 2014 at 05:47 AM

Thanks for the interesting read - appreciated.

Posted by inlandrailway.com on Friday, March 28, 2014 at 11:12 PM

nice info, Isn’t it interesting that people outside of the computer and IT world don’t view women as out-of-place?

Posted by cintamela.com on Monday, April 7, 2014 at 12:17 AM

Thank you very much for this very nice informative article it will give you knowledge of women’s situation in the workplace, I hope that policymakers will consider how to control sexual assault and bullying at the workplace.

Posted by Winston Collins on Friday, April 11, 2014 at 06:29 PM

I have been surfing online more than 3 hours today, yet I never found any interesting article like yours. It is pretty worth enough for me. In my view, if all web owners and bloggers made good content as you did, the net will be much more useful than ever before.

Posted by Cipto Junaedy on Sunday, April 13, 2014 at 05:13 PM

Leave a comment

Name:

Email:

Location:

Remember this information for next time.

Send me follow-up comments?

Submit the word you see below: