The Search for Women Who Want Cybersecurity Careers

By Deborah Gage

Wall Street Journal, May 29, 2018 —

Nonprofits and tech companies are trying to get younger girls interested in fighting cybercrime

There is a shortage of workers in cybersecurity and a shortage of women in tech jobs. New efforts to get girls interested in cybersecurity are aimed at tackling both of those problems.

Boston University, the SANS Institute and nonprofits such as TechGirlz are among the organizations sponsoring camps and contests to teach girls about coding and how to solve cybersecurity problems. Technology firms are getting into the act, too: Palo Alto Networks Inc. PANW has helped develop a cybersecurity curriculum for the Girl Scouts, which will start awarding cybersecurity badges in September, while Symantic Corp. SYMC has given a grant to the American Association of University Women to develop a cybersecurity class for middle-school girls.

The goal is to inspire more girls to pursue careers as information-security analysts, a field the Bureau of Labor Statistics predicts will grow 28% from 2016 to 2026. Women today fill just 11% of cybersecurity jobs globally, according to a 2017 report from the Center for Cyber Safety and Education and the Executive Women’s Forum on Information Security, Risk Management and Privacy. And the women who do work in cybersecurity hold fewer positions of authority and are paid less, on average, compared with men in the field despite having higher levels of education, the report found.

Michele Guel, a distinguished engineer at Cisco Systems Inc., battled the Morris Worm, considered to be one of the first pieces of malware, at NASA Ames in 1988. She says some girls have the wrong idea about cybersecurity, which could explain at least some of the gender gap.

“They think that you wear hoodies, work in the dark, drink soda and eat Twinkies all day,” she says. “What we need is a new perception.”

Sarah Larbi, a recent graduate of Boston University, discovered cybersecurity in college and has a job lined up at Liberty Mutual Insurance, where she aims to work on cybersecurity issues. She will be teaching for the second time this summer at a cybersecurity camp sponsored by the university for high-school freshman and sophomore girls.

One exercise the girls will be asked to perform: Using an add-on to the Firefox browser, find the websites with the most third-party trackers, which seek to keep tabs on the websites people visit, often to provide relevant ads. “It’s an inspiring thing to see girls not feel like they [have] to be quiet, that it [is] OK to be curious and learning,” says the 22-year-old Ms. Larbi.

In February, the SANS Institute ran Girls Go CyberStart, a contest that offered high-school girls and their schools prizes for solving cybersecurity problems relating to cryptography, web attacks, forensics, programming and Linux, the operating system that supports commonly used security tools. The contest was held in 16 states plus American Samoa, and prizes included a trip to the Women in Cybersecurity Conference in Chicago in March.

Hannah Mannering and Miranda Evans, a junior and sophomore at Padua Academy in Wilmington, Del., were part of the Cyber Sisters, the team that won the Delaware contest. The girls said they worked nights and weekends, in one case figuring out how to spot an error in code written in Assembly language.

“I never learned programming, [and] I had no idea I’d be able to do that,” Ms. Mannering says. “I had a blast.”

CyberStart was adapted from a multilevel game created by SANS EMEA, which was under contract to an intelligence agency in the United Arab Emirates. It was used first in the U.A.E. and then in the United Kingdom, which was looking for young people with cybersecurity talent for intelligence agencies, the military, critical infrastructure companies and all internet-connected organizations. It was piloted in seven U.S. states in 2017 for both male and female students age 16 and over, but out of the 3,500 students who enrolled, only 7% were girls.

“I thought the country was stupid if we didn’t get women involved,” says Alan Paller, the director of research at SANS, explaining why Girls Go CyberStart was created. “How would we ever defend ourselves if we use half or less than half of the smart people in the country?”

John Cusimano, the director of industrial cybersecurity at aeSolutions who also teaches cybersecurity workshops to middle-school girls at TechGirlz, says there is no technical reason for the gender gap, which is “right in my face at every conference.”

One of the big challenges for girls is to help them develop the self-confidence to persist through male-dominated classes in high school and college and a male-dominated workforce.

Girls don’t participate in an activity if they feel the environment is unfriendly or if the spotlight is on them too much, says Mandy Galante, a cybersecurity teacher at Red Bank Regional High School in Little Silver, N.J., who helped adapt the CyberStart game for girls.

Many girls like to do things together, she says. At a certain age “they’re like puppies, all over each other,” so the game was designed to allow them to work alone or in groups of up to four.

Participants in the game aren’t penalized for lacking prior knowledge. Each girl receives a field manual where they can check for tips in areas that may be unfamiliar to them. A lower-level problem might require them to decrypt a simple cipher by figuring out how to shift the alphabet a few spaces to the left or right. At a higher level, contestants might have to look at the source code for an electrical panel that runs a factory and figure out what hackers did to disable it.

SANS wants to make CyberStart available to every teacher in the U.S., and directly to students when teachers aren’t interested. “When I first started teaching cyber, it was cool and you could get a good job, but now we need to consider the future of the country,” Ms. Galante says. “If you’re good at this, we need you.”