Women In Security Magazine Issue 14

14

MAY • JUNE 2023

DIVERSITY SPAWNS INNOVATION – BUT HOW CAN YOU MEASURE IT? P10

JANE FRANKLAND - FROM FREELANCE DESIGNER TO A WELL KNOWN FIGURE HEAD IN CYBERSECURITY P16 W W W. W O M E N I N S E C U R I T Y M A G A Z I N E . C O M

SEVEN METHODS TO USE DIVERSITY AND INCLUSION TO FUEL INNOVATION P70

FOSTERING IN CYBERSECURITY THROUGH DIVERSITY AND INCLUSION

FROM THE PUBLISHER This issue’s theme is all about fostering innovation through diversity and inclusion, but I would like to address something that is ultimately stopping us from doing this.

Mean girls’ don’t disappear just because you finish high school

W

hy are we letting petty rivalries

The awards are not, and never have been, a money

compromise our work for the

making initiative – in fact, it could have ultimately

greater good? Growing up, I was

been my downfall and cost me my company. Events

bullied throughout my entire high

like this take a massive amount of time and money

school life. I wasn’t one of the

to put together, and it was only last year – after four

‘cool kids’, or one of the ‘rich kids’. I was more the

years of awards – that we just broke even. That’s why

chess buff, much too geeky, and a tough competitor

these awards cannot run without the support of the

on the hockey team – which did not put me in good

industry and sponsors.

standing with the cliques.

In the midst of all this, I have found myself in the very It took me years to overcome the backstabbing,

same position as back in high school – encountering

gossiping, and purposeful exclusion. Years to find

more bullies, backed into corners by industry ‘mean

the confidence to be able to ignore the noise, and let

girls’, and wondering why I have become a target just

everything wash over my head.

for trying to elevate and applaud the amazing women and men of our industry.

When I was young, I assumed adults would grow out of this sort of behaviour – and most do, becoming the

You will have heard the mantra that women in security

amazing and supportive women in our community

need to “see what they want to be”. These awards

who I have been lucky enough to call my friends

are meant to be a major initiative that allows the

and colleagues.

industry to motivate newcomers and veterans alike to see what they can become within this dynamic and

These women are not threatened by each other, and

amazing industry.

go above and beyond to help others succeed. They are true role models.

Incredibly, they also seem to have put a target on my back.

That’s why it is devastating to see that in many other circles, the same bullying and attack tactics are still

There are deceptive attacks, passive aggression,

in play – with saboteurs who will do anything to go

and unkindness. The bullying I receive before, during,

against everything we are trying to achieve.

and after the event would crush most people and cause them to give up. There are complaints about

This sort of behaviour crops up in the most surprising

nominees, companies, finalists, winners, sponsors,

of places – even around the Australian Women in

judging processes, awareness, transparency.

Security Awards, which I have been running for the

2

past five years as a passion project to celebrate

There are complaints about who won, and who didn’t.

people’s contributions to the industry.

There are whispers, gossip, and complaints to others

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

Abigail Swabey but nobody ever says anything to me personally – until I hear about it afterwards, then commit time to address the whisper campaigns and deal with the hurt.

There is a right way to raise concerns about process, and a wrong way. We have formal mechanisms for handling complaints, which are taken seriously and

One day, when I give

reviewed externally for resolution. Yet so many people

this all up maybe, I might

feel the best way to raise concerns is character

name and shame the bullies

assassination in the shadows.

and their advocates, whose identities would surprise you. But in the meantime,

This ‘Regina George’ mentality has been present in

I will focus on what I can control – my own

one form or another during much of my 22 years in

actions. I will:

the IT security industry – for me and so many other women who are constantly having hurdles thrown in

• Kill them with kindness

their way.

• Take the high road • Avoid engaging

We struggle enough as women trying to push into a

• Problem solve

male dominated industry; to bring one more woman

• Find real and true advocates

into the boardroom; to speak up and be heard during

• Support and uplift others

meetings; to gain confidence at conferences. We

• Try not to take it personally

fight to add more STEM education to our sons’ and

• Never stop being me

daughters’ schools, without having to deal with the ‘mean girls’ or lift ourselves up after our confidence

And I will never allow these negative,

is shattered.

toxic individuals to define me. They should not have the power to affect

And while these obstinate people comprise a small

me, or you, or anybody else.

minority of the people out there, their constant

Focus on the positivity, and

harping and interference consume a disproportionate

let the negativity of the

amount of time and energy that could be better

‘mean girls’ fall on deaf

spent elsewhere.

ears. We can achieve so much success if we just

Aren’t we all here to be better to each other, and

work together and focus on our common strengths,

to support the greater good? If so, I’m unsure why

rather than creating problems to divide us.

we continue to hurl abuse at each other when we could be using that energy to work together trying to move the needle for women, non-binary and other underrepresented minorities in the industry.

Abigail Swabey PUBLISHER, and CEO of Source2Create

The silver lining, I suppose, is that every year teaches me to become stronger, more confident, and more resilient. All of this pushes me out of my safe zone and into the unknown – where I will keep doing my damnedest to stay positive and supportive for the many

www.linkedin.com/in/abigail-swabey-95145312

aby@source2create.com.au

amazing people in this industry who do the same.

I S S U E 14

WOMEN IN SECURITY MAGAZINE

3

CONTENTS

2

CAREER PERSPECTIVES

FROM THE PUBLISHER

DIVERSITY SPAWNS INNOVATION – BUT HOW CAN YOU MEASURE IT?

10

COLUMN Criminals using social media to gain access to critical infrastructure and governmentagencies 14

The real reason for the shortage of women in security

50

Building a career in cybersecurity: strategies for newcomers and career transitioners

60

INDUSTRY PERSPECTIVES Death by a thousand cuts

66

Doing it differently

48

Seven methods to use diversity and inclusion to fuel innovation

70

Cybersecurity is not just about technology

64

Building a culture of integrity: how we can improve our industry from within

72

How Italian football can influence Australian cybersecurity strategy

74

Australian Women in Security Network 2023 Programs Overview

76

Diversity is not only an ethical essential: your bottom line depends on it

80

Different voices, different perspectives: fostering diversity and inclusion in cybersecurity for greater innovation

90

Three ships

96

Is checking your teen’s phone an invasion of privacy?

112

WHAT’S HER JOURNEY?

From different perspectives to better protection: How diversity improves cybersecurity 100

Jane Frankland

16

Be brave, be an ally and hide the vegetables

104

Christina Rose

20

Sandra Agobian

22

What stands in the way becomes the way

106

Simona Dimovski

26

A woman’s quest for equity

108

Elaine McConnell

30

Kirsten Chapman

34

Sharmaine Labrado

38

Nathalie Viuf Stender

40

Silvana Macri

44

JOB BOARD

56

How Australian cybersecurity organisations can foster innovation one role at a time 110

138 THE LEARNING HUB

MAY • JUNE 2023

52

HR IS WELL POSITIONED TO MAKE ORGANISATIONAL DIVERSITY A HABIT

82

ARE YOUNG, INNOVATIVE STARTUPS AUTOMATICALLY MORE DIVERSE?

86 114

The importance of the deep dark web in the Russia-Ukraine conflict 116 Web3: The good, bad and the unicorn

118

Abigail Swabey

ADVERTISING Abigail Swabey Charlie-Mae Baker

JOURNALISTS David Braue Stuart Corner

TECHNOLOGY PERSPECTIVES Doing it differently

FOUNDER & EDITOR

SUB-EDITOR

CYBERMINDZ: MINDING CYBER PROFESSIONALS’ MENTAL HEALTH

Stuart Corner

DESIGNER Rachel Lee

TURN IT UP 141

132 Source2Create Pty Ltd is the publisher of this magazine and its website (www.womeninsecuritymagazine.com).

AWSN is the official partner of Women in Security Magazine

OFF THE SHELF 144

STUDENT IN SECURITY SPOTLIGHT Ayesha Qureshi

122

Sassandra Rae

124

Johanna Broquet

128

SURFING THE NET 148

©Copyright 2023 Source2Create. All rights reserved.

Reproduction in whole or part in any form or medium without express written permission of Source2Create is prohibited.

ASSOCIATIONS & GROUPS SUPPORTING THE WOMEN IN SECURITY MAGAZINE 08 07 MAY • JUNE

MARCH • APRIL

WHO RUNS

IN 2022, YOU CAN NO LONGER TAKE SECURITY WORKERS FOR GRANTED P10-13 AS THE SECURITY THREAT MORPHS, DEFENSIVE TEAMS MUST CHANGE TOO P76-79

20 22WORLD IF YOU CAN’T SPEND YOUR WAY TO GOOD SECURITY THIS YEAR, TRY FOCUSING ON YOUR PEOPLE P94-97

YEAR OF THE SECURITY WORKER

W W W. W O M E N I N S E C U R IT Y M A G A Z I N E . C O M

W W W. W O M E N I N S E C U R IT Y M A G A Z I N E . C O M

the

OFFICIAL PARTNER

SUPPORTING ASSOCIATIONS

Big Picture Easy Reliable No job is too big or too small.

We look after your marketing & content needs so you can get on with what you do best.

GET CONNECTED AND TAKE CONTROL OF YOUR BUSINESS SUCCESS TODAY!

charlie@source2create.com.au

aby@source2create.com.au

Women in Security Mentoring Program AWSN is pleased to launch the 2023 Australian Women in Security Network Mentoring Program

Looking for ways to give back? We need you Learn more at awsn.org.au/initiatives/mentoring/ Sponsored by

Powered by

DIVERSITY SPAWNS INNOVATION – BUT HOW CAN YOU MEASURE IT?

by David Braue

Tracking your DEI success can help you turn diversity into business results

T

hree years into its state-wide Plan

At least, that’s what the numbers say.

for Gender Equality, there are already signs the Australian state of

Measuring the actual innovation that diversity

Western Australia’s decadal plan is

enables, however, requires much more than simply

paying dividends.

counting the number of women: diversity, after all, is a multifaceted issue and companies have historically

The project’s performance metrics have shown

faced challenges in extending its benefits across the

representation of women in key industries to be up

entire business.

across the board, including in traditionally maledominated sectors such as firefighting. And this year’s

It’s a challenge of which Roozan Zarifan, chief

addition of Certificate IV in Information Technology

information officer with the Los Angeles County

(Cyber Security) training for women will build upon

Department of Human Resources, was well aware

the success of the state’s Try a Trade program that

when the county – the most populous in the United

gives school students a taste for careers in the

States, and the single largest employer in southern

building industry.

California – undertook a major data analytics project to improve the efficiency of hiring practices, of which

By launching a wide range of initiatives to improve

ensuring diversity had long been a key goal.

gender diversity across key areas of training, service

10

delivery and career development, the state program –

Zarifan told the Data+AI Summit 2022 those practices

which will be repeated throughout the decade across

were showing signs of strain. With nearly 353,000

four different action plans – shows how effective a

job applications received for the more than 13,000

broad commitment to equality can be.

positions filled during the 2018/2019 fiscal year alone,

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

F E A T U R E

it was taking an average of 327 days for applicants to

“The business wanted to know which sourcing

secure their jobs, she said.

channel brought the best eligible candidates, and we wanted to gain insights about the candidates so

Working with Accenture, county data specialists

that we can continue to attract and retain a diverse,

began digging into applicants’ details and conducting

talented workforce.”

high-level data analysis to produce quarterly hiring‑related metrics that were fed back to the board

After two months of data modelling and a five-month

of directors.

implementation, she said, “we’re able to see how efficient we are at each step of the process, where

The project was also envisioned as a key tool

the candidates are coming from, which source yields

to track the county’s progress towards diversity

the best candidates, and where we’re actually losing

objectives by creating executive dashboards that

candidates.”

would improve understanding of the broad spectrum of demographic, gender, cultural, educational, skills

The dashboards also maintain the results of regular

and other characteristics of the more than 100,000

satisfaction surveys through which hiring managers

workers holding roles across more than 1200 job

and hired candidates can air their concerns or make

classifications within its workforce.

suggestions about the work environment, diversity issues, or anything else that concerns them.

“Hiring is a complex activity with many complicated factors,” Zarifan explained, “from the type of

“Understanding or identifying hiring trends is pivotal

examination to number of exam hurdles, to job

to developing a hiring strategy,” she said, “and we now

classifications and much more.”

have access to this wealth of information through these dashboards.”

I S S U E 14

WOMEN IN SECURITY MAGAZINE

11

STRENGTH IN NUMBERS? Quantifying people’s intrinsic attributes is always a fraught process, but as ever more progressive diversity, equity and inclusion (DEI) initiatives tie diversity to conventional business metrics it has become a necessary challenge – if only so that the progress of diversity initiatives can be correlated with other business metrics like profit and productivity and, by extension, the less tangible metrics of innovation.

Yet, in large organisations focused on keeping the wheels turning, tracking gender diversity can be extremely complex – and difficult to correlate with innovation metrics.

Efforts to normalise this process have increasingly borne fruit, with the Washington DC-based Aspen Institute’s Tech Accountability Coalition (TAC) recently launching a comprehensive framework for defining,

“It’s about making sure that businesses and organisations recognise that by not being entirely inclusive – by being representative but not necessarily inclusive – their products are going to be weaker, their bottom line will be weaker, and their leadership will be weaker as a result of it. This is just about sound business decisions."

- CIO consultant Claire Priestley

collecting and reporting on the performance of DEI initiatives.

Designed with input from over 100 tech leaders, experts and community advocates, the Institute’s new Equity Framework lays out a shared set of standards for businesses that Aspen Digital calls “a practical roadmap for industry-wide improvement [built on] common sense standards for how the industry defines terms, collects data and shares progress.”

12

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

F E A T U R E

The framework is structured to facilitate annual

The need for better metrics around gender diversity

reports with actionable recommendations. It

was a key recommendation of a recent RMIT

outlines five key actions for diversity advocates and

University-Australian Women in Security Network

business leaders to implement by July 1 – including

(AWSN) collaborative report that found just 17

establishing shared definitions, aligning equity

percent of Australia’s cybersecurity workers to

standards for data collection, sharing anonymised

be women. It suggested a range of remedies for

aggregate data for benchmarking, determining

businesses to lift women’s participation.

opportunities for collective action, and shaping the TAC’s long-term vision and structure.

Many of the report’s 40 recommendations relate to measurable performance metrics. These included:

Data to be collected will include gender identity and

conducting an internal gender pay gap audit to ensure

racial representation of job applicants, interviews,

equitable salary and benefits; collecting and analysing

hires, promotions, attrition, executive leadership,

data on gender equity, diversity and inclusion;

middle management, entry-level, and internship levels.

benchmarking the effectiveness of specific initiatives;

2022 workforce data will be used as the baseline.

including gender equity outcomes in the KPIs of executives and managers; and more.

Participating companies will also be expected to monitor the gender and racial makeup of tech, non-

Ultimately, it is hoped better monitoring of DEI

tech, retail and manufacturing roles as well as full-

initiatives will help businesses structure their

time, part-time and contingent workers.

operations to maximise innovation.

Optional additional metrics may track individuals’

Getting to this point has historically proven difficult,

traits such as disability status, sexual orientation,

but worthwhile. A recent Notre Dame University-NYU-

gender identity, caregiver status, veteran status,

Michigan State University-Northwestern University

socio-economic status and religion. Business

meta analysis of more than 6.6 million published

metrics may also be tracked. These could be: the

papers found that mixed-gender teams produce more

percentage of executives and managers with personal

novel and innovative work than single-gender teams.

DEI objectives; supplier diversity; intern candidate diversity and conversion rate; product inclusion; and

The key to realising these benefits, notes UK-based

progression data around performance evaluation,

CIO consultant Claire Priestley – former chief digital

compensation decisions, time to promotion, and

and information officer with the Royal Borough of

succession planning.

Kensington and Chelsea in London, and founder of diversity advocacy group CIO +1 – is to recognise the

In laying out a vocabulary for standardising the

importance of “intersectionality and inclusion”.

collection and reporting of demographic data, the TAC Equity Framework promises a standardised way

“To me, that’s what it’s all about,” she said during a

of tying recruitment, employment and other metrics

recent International Women’s Day event. “It’s about

to DEI initiatives – enabling companies to track the

representation. It’s about inclusion.”

actual performance of their DEI initiatives and tweak them to address lingering inequities.

“It’s about making sure that businesses and organisations recognise that by not being entirely

CREATING DRAG ON INNOVATION

inclusive – by being representative but not necessarily

By all accounts the persistence of those inequities

inclusive – their products are going to be weaker, their

continues to compromise companies’ ability to turn

bottom line will be weaker, and their leadership will

diversity into innovation, but many businesses do not

be weaker as a result of it. This is just about sound

fully understand the magnitude of their problems until

business decisions.”

they have a way to measure them.

I S S U E 14

WOMEN IN SECURITY MAGAZINE

13

AMANDA-JANE TURNER Cybercrime is big business, thanks to technical advancement and interconnectivity creating more opportunities. This regular column will explore various aspects of cybercrime in an easy-to-understand manner to help everyone become more cyber safe.

C O L U M N

Criminals using social media to gain access to critical infrastructure and government agencies Social media users beware!

When a criminal wants information or access to an organisation but cannot infiltrate employees’ or the organisation’s systems directly they will find another way in. There is a criminal campaign targeting employees of governments, critical infrastructure organisations, manufacturers and defence industry players via their employees’ personal social media accounts.

Malware nicknamed Sys01Stealer is being distributed

To stay safe from this campaign:

via social media account posts and comments such as those on YouTube, Facebook, Instagram, Twitter,

• Be cautious what you share online about your

Google adverts, and social media direct messages.

place of work, role, security clearances and

It has been active since at least November 2022 it is

associates.

still very much in use.

• Do not respond to unsolicited messages or

Sys01Stealer infected adverts, comments, posts and

• Double check any direct message that appears to

comments from people you do not know. messages are targeted to specific individuals the criminals have used open source intelligence (OSINT) to identify as being attached to, or associated with,

be from a friend to make sure they sent it.

• Do not click links or download applications from social media posts.

their targets.

• Use a reputable up to date anti-virus solution

Once on an employee’s computer the malware

• Stay vigilant.

where appropriate. exfiltrates information such as credentials, browser cookies and any sensitive information associated with the person that will help the criminals gain access to the agency they are targeting.

14

W O M E N I N S E C U R I T Y M A G A Z I N E

www.linkedin.com/in/amandajane1

www.demystifycyber.com.au

M AY • J U N E 2023

WHAT’S HER JOURNEY?

Jane Frankland Award-Winning Cybersecurity Leader

I

t would be fascinating to know exactly how Jane

selling it though was down to divine intervention.

Frankland went from being a freelance designer in

The journey I’ve had with KnewStart has been very

the UK—and a nominated Young British Designer

different though.”

who sold her designs and paintings around the world—to become the author of a bestselling book,

KnewStart is Frankland’s London-based consultancy

IN Security, and, in her words “a well-known figure in

that provides advisory, brand elevation, and women

cybersecurity, travelling the world, speaking, writing

leadership services.

and being a voice for the voiceless through the IN Security Movement.”

DIVINE INTERVENTION? As to other career influences, Frankland invokes the

16

She offers two answers: “James Bond” and divine

translation of an old Yiddish proverb, “Mann Tracht,

intervention! It was James Bond, she says, first

Un Gott Lacht.” It translates as “man plans, and

piqued her interest in cybersecurity.

God laughs.”

“I knew I wanted my own business from being a

Frankland explains, “As ‘man plans, and God laughs’

young child, but I never thought I’d end up doing what

I’ve always found I’ve been steered by God, source,

I do. Having graduated in art and design, and with a

my higher self, intuition, in the direction I’m supposed

focus on fashion, I never thought I’d end up working in

to go in and my roles have developed in ways I never

technology, specifically cybersecurity.”

would have imagined.”

Her entry in the industry was through Corsaire,

In addition to being the CEO and owner of KnewStart,

a business that started in her home in 1997

Frankland also runs The Source Platform for women

and grew into a global penetration testing and

in cyber, which she founded in 2021 to make women

cybersecurity consultancy sold to Mettlesome

in cybersecurity the standard not the exception. It

Holdings in July 2012. Starting Corsaire, she

exists to help women and businesses who value

says, was intentional. “I knew exactly what I

them and offers career development and talent

wanted to achieve and by when. Growing and

acquisition services.

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

W H A T ’ S

H E R

J O U R N E Y ?

However it is none of these entrepreneurial

And working on her work/life balance has spawned

endeavours that Frankland cites as the biggest

yet another Frankland project. “I’ve actually developed

influence on her cybersecurity career but the writing

a methodology for this,” she says. “It’s called IN Focus

of her book, IN Security, published in 2017. From that

and anyone can get it now (from my website). It helps

came her IN Security movement. “It’s where I use my

you focus amidst so much distraction and build the

leadership and influencer skills to act as a voice for

habits, rituals and behaviours you want at work and at

the voiceless, campaign for change, research and

home, so you can achieve better work-life integration,

offer scholarships,” she says. There is an IN Security

health and joy.

Tribe manifesto.

“Never in my wildest dreams would I have imagined I’d become a well-known figure in cybersecurity, travelling the world, speaking, writing and being a voice for the voiceless through the IN Security Movement. I’m humbled by the effect the book and the movement have had on so many people in the world, especially at a time when so many women have felt alone in cybersecurity.

“I love the people aspect of my role and anything that enables me to impact a person positively. That could be solving a problem for them and taking away some

“I knew I wanted my own business from being a young child, but I never thought I’d end up doing what I do. Having graduated in art and design, and with a focus on fashion, I never thought I’d end up working in technology, specifically cybersecurity.”

workplace pain. It could be inspiring someone when I’m speaking at an event, mentoring, coaching and training individuals or groups so they develop skills and advance in their career.”

“I start by looking back - daily, monthly, quarterly, bi-annually and yearly, and I document as much data

MULTIPLE ROLES

as I can so I can pull out the wisdom. By looking

In addition to her roles at IN Security, The Source and

at eleven areas of my life, it gives me a truer, more

KnewStart, Frankland’s LinkedIn profile lists no fewer

accurate, whole picture of what’s gone on and

than six roles as current. So it is hardly surprising she

what to expect going forward. Reflection is key

cites time management as a massive consideration

for setting meaningful goals and managing work

when trying to maintain a good work/life balance.

life balance.”

“Making time for daily activities outside of work like

And of course, with her many cybersecurity roles,

walking my dog, high intensity training, journaling,

staying current is yet another demand on her time.

meditating, reading, and then having monthly Reiki,

“Reading is my main way to stay up to date on the

regular catch ups with friends and family and

latest cyber threats and trends, as well as best

occasional trips to the theatre, horse riding and

practices for security solution,” she says.

swimming help me stay energised and motivated, as well as reducing stress.

“I’ll read blogs, news sources, and books. In addition to reading, I’ll watch videos on YouTube and listen to

“Planning ahead and making prioritised lists help me

podcasts and speakers when I attend conferences.

manage my workload more efficiently and set aside

I also get a lot from talking to people in my network.

time to relax. Additionally, clear communication with

By taking advantage of different content sources I

my team, family and friends makes all the difference

find I can gain a more holistic understanding of the

in striking the right balance between work and life.”

landscape and stay ahead of the curve.”

I S S U E 14

WOMEN IN SECURITY MAGAZINE

17

However, for any aspiring cybersecurity professional learning about cyber as a priority is not what Frankland advises. Rather she would tell someone to study the social sciences at university, such as anthropology, economics, geography, history, law, linguistics, politics, archaeology, psychology, and sociology.

“By diving into the complexities of these subjects, you can gain a better understanding of the world around you and how our interactions shape our individual and collective experiences. I see it as being very relevant in cybersecurity, especially in regard to the human aspect, and governance risk and compliance (GRC).

“Studying these opens a world of fascinating insights into how humans interact with each other and their environment. With an interdisciplinary approach you can explore topics such as culture, communication, cognition, behaviour, learning and development from different perspectives.”

And, in her experience, people transitioning into cyber with different backgrounds and experiences have become valuable assets for the industry. “Just like I did, they bring with them new perspectives, skills and experience which can help fill the gaps in current cyber capabilities. By bringing diversity of thought to cybersecurity they can provide fresh ideas and solutions, helping more organisations to meet the ever-evolving cyber threats they face.” www.linkedin.com/in/janefrankland

jane-frankland.com

www.instagram.com/janefrankland

twitter.com/janefrankland

www.youtube.com/janefranklandtv

18

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

Our Services Nurture Programs

Event Management

Magazines

Speaker Acquisition

Digital Marketing

Website Creation

Data Admin Services

Lead Generation

Programmatic

Podcasts

No job is too big or too small.

Get connected and take control of your business success today!

REACH OUT TODAY

charlie@source2create.com.au

aby@source2create.com.au

Christina Rose Manager — Security Operations & Advisory at Qantas Group

T

he September 11, 2001 attack on the

Program, secondly the work around retrofitting every

World Trade Centre changed the world

aircraft with sixty seats or more operating within

of aviation security operations, and the

Australian airspace with hardened cockpit doors, and

lives of many individuals. For a number

thirdly working in consultation with industry on the

of professionals those changes were

development over four years, of the Certificate ll in

very impactful in terms of career trajectory.. When

Aviation Transport Protection.”

the aircraft hit the Twin Towers Christina Rose was working as a project officer on the Sydney

She adds: “Each project contributed to the paradigm

Air Noise Amelioration Program in the Aviation

shift towards the creation of a safer, layered and

Division of the Department of Transport & Regional

more robust aviation security regime which has since

Services, and was immediately drafted into a role

prevented a number of incidents here and overseas.”

managing Australia’s response to the impact on aviation operations.

Christina says 9/11 was “the catalyst for the uplift of global aviation security measures and

20

She was made acting assistant director of a four-

cooperation” and “led me down the path of

person War Risk Indemnity Taskforce charged with

championing the requirements for enhanced

ensuring Australia’s aviation industry continued to

aviation security measures through partnering with

operate when the global aviation re-insurance industry

industry here and the International Civil Aviation

collapsed in the wake of 9/11.

Organization internationally.”

Following these immediate responses to 9/11

FROM GOVERNMENT TO QANTAS

Christina was asked to join the Aviation Security

Christina has been at the heart of aviation security

Branch in the Department of Transport & Regional

ever since, initially with the Australian Government,

Services. “I had the responsibility of leading within

then with private security company Certis (formerly

this portfolio, firstly on the Air Security Officer

SNP Security) between April 2018 and January 2022

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

W H A T ’ S

H E R

J O U R N E Y ?

as ACT Aviation Security Manager responsible for

On any day she “may be overseas working with

security outcomes at Canberra Airport and Albury

government regulators and colleagues, attending

Airport. Today, she is Manager, Security Operations &

an airport security or airline safety committee

Advisory with the Qantas Group.

somewhere in Australia or overseeing my Duty Security Controller team’s triaging of critical security

Christina says she gained a sound understanding of

incidents affecting airline staff and passengers.”

the global framework set by the International Civil Aviation Organization while working for the Australian

Her advice to anyone aspiring to a similar role would

Government regulator before moving into the private

be to work in various roles in industry and if possible,

sector where she has been able to operationalise this

study law, management, policing and/or education

knowledge to benefit the teams she has worked with.

at university with the view to “Thinking about the knowledge you will gain, the people you will meet and

The industry Christina serves has, arguably,

the places it can take you.”

conquered the tyranny of distance, but for her the opposite is true. “The most challenging aspect of

For further progress she says, “industry experience

my current role requires continual recognition of the

and relationship management and emotional

needs of key stakeholders working at our international

intelligence coupled with a working knowledge of

ports in that they deserve almost a higher degree

global and respective domestic/country-specific

of attention our people here in Australia are used to

legislative/compliance frameworks are mandatory to

given variances in the regulatory environments in

ensure an effective contribution to this sector.”

which they work.” she says.

Global travel has its benefits and Christina says the

www.linkedin.com/in/christina-rose-b5597b31

most rewarding aspect of her role today is “Meeting interesting and skilled people with the same view of excellence in this field.”

I S S U E 14

WOMEN IN SECURITY MAGAZINE

21

Sandra Agobian Cybersecurity Analyst Intern at nbn® Australia

W

e have told some remarkable

English from scratch, met many people, engaged in

stories in WSM of women’s

the community as much as possible, and learned to

personal journeys in cybersecurity,

understand the Aussie slang,” she says.

from initial roles very far removed from cybersecurity or anything

Australia gave her the opportunity to fulfil her

close to it. There was Marie Patane, teenage make-up

childhood dream: studying. She started in TAFE,

worker and aspiring police officer who is now CSO of

moved on to take a foundation course at Melbourne

Sydney Metro (WSM No5, p20), but it would be hard to

University and earned a place at Deakin University

beat the journey of Sandra Agobian, a Syrian refugee

studying for a law degree.

who abandoned her multinational antiques business, arrived in Australia in 2017 speaking no English

During her studies, she volunteered at the Red Cross

and now holds a cybersecurity analyst internship at

as an emergency responder and worked in various

nbn after gaining two highly competitive digital and

jobs, not all glamourous! while continuously searching

cybersecurity training positions.

and applying for better opportunities. Finally, she was accepted into the Victorian Government’s Digital Jobs

Agobian, a native of Syria, commenced her career

program which gave her 12 weeks of free training in

at the age of 18 as an antique dealer. Later on,

an industry-backed digital course of her choosing.

she established her own enterprise, a Handmade

She chose to study cybersecurity at CyberCx.

Crafts & Antiques Shop. This business was highly prosperous and gained a prominent position in the

“As I learned more about computer systems and

design markets of Syria, Lebanon, and Kuwait. With

networks, I became increasingly fascinated by how

a workforce of over 40 employees, the company

they could be safeguarded against cyber threats”

was regarded as a top-performing and distinctive

she says. “To deepen my understanding of the field,

establishment.

I started reading articles and attending talks on cybersecurity topics. My interest grew even further as

22

When the war began in Syria, she lost everything and

I learned about the real-world impact of cyber attacks

came to Australia on a humanitarian visa. “I learned

on individuals and organisations.”

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

W H A T ’ S

H E R

J O U R N E Y ?

GAINING A NBN INTERNSHIP

It is clear Agobian is only at the start of what is likely

Following this, and through another competitive

to be a stellar career in cybersecurity, and when

process, Agobian was selected for a 12-week

looking for a role, she says remuneration will well

internship at nbn where she was able to apply

down her priority list.

her new-found knowledge and skills in a realworld setting and contribute to the organisation’s

CAREER PRIORITIES

efforts to safeguard against cyber threats. “The

“First and foremost I would want to ensure the

interview process at nbn was unique and made

company culture and values align with my own. It’s

me feel comfortable,” she recalls. “Rather than

essential to work for a company that fosters a positive

being treated like a generic employee, I was

work environment and shares my personal values.

valued as a unique person with a history and life experience.”

“The scope of the role and opportunities for growth and development are also important considerations.

Thanks to her exemplary performance that

I would want to ensure the role offers opportunities

internship was extended for a further six months.

for me to learn new skills and take on new challenges

“This extension provided me with an opportunity

that will help me progress in my career.”

to further develop my skills and knowledge and cement my passion for the field of cybersecurity,”

More important than salary is location. “I would

she says. “I continued to gain valuable experience

consider the commute and potential relocation

in the cybersecurity field and contribute to the

because it may impact my work-life balance. It’s

organisation’s efforts to ensure the safety and

important to find a balance that works for me and

security of its systems and networks.”

allows me to maintain a healthy work-life balance.

Agobian has seen others transition into cyber from

“Lastly, while remuneration is important, it should not

quite different roles and says, in her experience, the

be the only factor to consider. I would also evaluate

key to a successful transition is a willingness to learn

the entire remuneration package, including salary,

and a passion for the field. “While technical skills and

benefits and potential bonuses to ensure it aligns with

knowledge are important, it is also essential to have a

my expectations and the overall value of the role.”

strong understanding of the cybersecurity landscape and the threats facing organisations.

CERTIFICATION PLANS With initial training and cybersecurity work experience

“Some people may choose to gain additional

under her belt, Agobian says she is looking to gain the

qualifications or certifications to help with the

Certified Ethical Hacker (CEH)

transition, but I have also seen others successfully transition through on-the-job training and

“This certification covers topics related to ethical

mentorship programs.”

hacking and cybersecurity, including footprinting and reconnaissance, network scanning, system hacking,

She finds staying up to date with the ever-evolving

malware, social engineering, denial-of-service attacks,

tactics and techniques used by cybercriminals to be

session hijacking, web application hacking, wireless

the most challenging aspect of her role. “The threat

network hacking, and evasion techniques. CEH

landscape is constantly evolving, and it requires

training is typically hands-on and includes simulations

me to stay informed about the latest trends and

to provide practical experience.

vulnerabilities. Additionally, analysing and interpreting large amounts of data and logs can be a complex

It is widely recognized in the industry and would

and time-consuming process, requiring a high level of

demonstrate my expertise and commitment to

attention to detail and analytical skills.”

the field.

I S S U E 14

WOMEN IN SECURITY MAGAZINE

23

“Additionally, I am interested in gaining specialized

me with opportunities to learn and grow in different

certifications in areas such as cloud security. These

areas of cybersecurity, and I am grateful for their

certifications would allow me to develop expertise

encouragement and guidance.

in specific areas of cybersecurity and would be particularly useful in a role where I am focused on

“Finally, the management team at nbn, particularly

specific security threats or technologies.

Ant Cohen [Head Of Security Influence And Customer Solutions] and Simon Lee-Steere - Deputy Chief

“I believe ongoing education and certifications

Security Officer - have created a culture of respect,

are essential for anyone working in the constantly

inclusivity and support in the workplace that has

evolving field of cybersecurity, and I am committed

made me feel comfortable and valued. Despite his

to pursuing additional qualifications to advance my

high position, Darren Kane, the Chief Security Officer,

knowledge and skills.”

is remarkably humble, and I know that I can always turn to my managers or colleagues for support

INSPIRATION AND SUPPORT

and guidance.”

Agobian says she has been influenced and inspired on her cybersecurity journey by both high-profile women

A SUPPORTIVE ENVIRONMENT FOR WOMEN

and colleagues, in particular Clare O’Neil, Minister

In general Agobian has found the growing number

for Home Affairs and Minister for Cyber Security

of initiatives aimed at encouraging more women to

in the Australian Government, and Parisa Tabriz,

pursue careers in cybersecurity, such as mentorship

the vice president and general manager at Google,

programs, networking events and conferences,

responsible for the Chrome Browser, and ‘Google

helping to create a more supportive and welcoming

Security Princess’.

environment for women in cybersecurity that has helped her on her journey.

“These women have not only achieved great success in their own careers, but they have also helped to pave

“Overall, I believe the growing recognition of the

the way for other women to follow in their footsteps.”

importance of diversity and inclusivity in cybersecurity is a positive development, and I hope that more

Closer to home, “Shannon Gibb’s passion for

women will be encouraged to pursue careers in this

cybersecurity has been contagious, and Johanna

exciting and rapidly evolving field.”

Williamson’s unwavering support have been invaluable. I have also learned a lot from my

Agobian wishes she had taken up cybersecurity

internship colleagues, Kate Daie, Mousumi Mitu,

earlier. She would tell her last-year-at-school self

Shahnaz Ali, Alison Huang, and how we work together

to pursue it with passion. “Start exploring the

as a team with a shared passion for cybersecurity.

field as soon as possible, take advantage of every opportunity to learn about cybersecurity, whether it be

“The support and guidance of my managers, Paul

through attending events, reading articles, or taking

Mcdonogh and Toby Nel have been instrumental in

online courses.”

my professional development. They have provided And she has not lost her passion for antiques, listing her leisure activities as “swimming, trying new foods, tasting wine, watching football and finding good deals on collecting antiques.”

www.linkedin.com/in/sandra-agobian

24

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

Contact us today to find out how you can become an industry contributor, no matter the level of experience. reach out now www.womeninsecuritymagazine.com

Simona Dimovski Head of Security and Technology at Helia Simona is a strategic thinker with a passion for what she does, leading from the front, engaging and

S

energising strategic partners and stakeholders as well as the wider business in supporting high impact, imona is a strategic leader with extensive

dynamic solutions to deliver business value.

experience in how technology enables the customer experience and facilitates

She has a passion for continuous improvement and

the growth of business value. Enabled

empowering businesses and individuals to reach their

by her 23-year career in Technology,

full potential, encouraging innovative thinking enabling

exploring all facets of technology and security,

best practice through the use of technology.

Simona has a wealth of expertise across the Information Management and Technology sector

WHERE IT ALL STARTED

and has a diverse background in both corporate and

Simona Dimovski graduated from the University

government settings. Over the last 23 years, Simona

of Technology Sydney with a Bachelor of Applied

has provided top-notch Technology and Cyber

Science in Information Studies, Information

strategies in the Banking, Insurance, Aviation, Energy

Technology and Information Science in 1999.

and State and Local Government sectors.

Today she is Head of Security and Technology at

26

She has a proven track record of driving the

Helia (until recently Genworth Mortgage Insurance

successful delivery of large-scale transformation

Australia) an ASX-listed provider of mortgage

programs. As the CIO, during the height of the

insurance to lenders. She describes her role as the

COVID pandemic, Simona achieved a 2-year digital

latest stage in a career journey that has taken her into

transformation program in six weeks.

ever more security-focussed roles.

With specialties in building and delivering Technology

“Since the start of my career, and even before that,

Strategies, Cyber Security, Portfolio Management

I have always been interested in information and

Offices, Service Management, Portfolio Delivery,

protecting our digital and physical assets. I have

Digital Operating Models and bringing Agility to

spent the last 23 years working in technology,

practice, Simona has led IT evolution across top-

working across almost all the technology functions.

tier brands within the Finance, Aviation, Energy and

Throughout all my roles, and especially as I

Government industries.

progressed my career, it became imperative for

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

W H A T ’ S

H E R

J O U R N E Y ?

me to be become more immersed and extend my

“I find it rewarding to know that my work is making

experience in cybersecurity,” she says.

a difference in protecting the organisation and the individuals I serve. I have the opportunity to develop

“I have always had a passion for technology and

and implement security strategies that can prevent

information and have had a deep understanding of

or minimise damage from cyber attacks. I lead and

the importance of protecting our digital assets and

work with some of the most exceptional people in

infrastructure from cyber threats such as hacking,

the business. It is energising and empowering to be

malware, and phishing attacks. I have found it

surrounded by people who believe in you, value your

intellectually stimulating to stay ahead of ever-

input and make you want to be a better person and a

evolving threats, or have the opportunity to work on

better leader.”

cutting-edge technology.

BEWARE OF BURNOUT “I believe technology exists to enable the business

Any cybersecurity role can make significant demands

and individuals to do their best work in the most

on the holder’s time and energy, leading to burnout,

secure way and with minimal frustration. So security

and Dimovski admits to having come close to this. A

has always been integral to my approach, and a major

few years ago she was “so obsessed with the never-

consideration and design feature in anything that I

ending to-do list, and the work that needed to be done,

have done throughout my career.”

that I almost burned myself out.

A NATURAL PROGRESSION INTO CYBER

“I am very mindful now when I see the signs. I

Dimovski describes here move into cybersecurity

recalibrate and take time to be still and check in with

as being organic. “It was facilitated by my deep

myself and what’s most important to me. Recently

understanding of the congruence between security,

I have introduced non-negotiable daily time for my

technology, processes and people. My interest

mental and physical wellbeing. Regardless of the day,

in cyber and information was present from the

I try to make time for some physical activity and quiet

beginning of my career, and it grew naturally the more

time, each day, even if it is for only 10 minutes a day.

involved I became in running technology departments.

From there the pivot was necessary, and luckily for

“Being in cyber is very demanding, because of

me cyber is something I am very passionate about.”

the ever-changing landscape of threats and vulnerabilities. It’s an area where you always must

Dimovski says her wide experience in other

be on. It’s not a job that you can leave when you

areas of technology benefits her current role in

‘clock off’. This can be somewhat of a juggle with

cybersecurity. “I have had varied career across

other priorities.”

all sections of technology, and I can add a lot of value in this space by linking my past experience in

Nor is life likely to get any easier for people in

strategy, transformation, delivery, leadership and

roles like Dimovski’s. increasingly sophisticated

technology management.

ransomware, use of AI and machine learning by attackers, increased targeting of critical infrastructure

“Cybersecurity is a challenging field that requires

are often-cited significant developments in the

creative problem-solving skills. I enjoy the opportunity

threat landscape. To this list Dimovski adds supply

to tackle new challenges and develop innovative

chain security.

solutions to protect the organisation, and to do this I constantly need to keep up to date with the latest

“As more organisations rely on third-party vendors

information and also the best methods to use when

and suppliers for critical services, the security of

needed, such as when managing complex risks, or

the supply chain becomes increasingly important.

when managing an incident.

It’s likely we will see more emphasis on supply

I S S U E 14

WOMEN IN SECURITY MAGAZINE

27

chain security in the coming years, including

passing forward my learnings so others don’t have to

greater scrutiny of vendor security practices

learn the hard way.”

and more widespread use of supply chain risk management frameworks.”

WOMEN IN TECH AND CYBER Simona is a strong advocate, ambassador and Coach

This of course will greatly broaden the scope of

for Women in Cyber and Technology. She has been

cybersecurity roles: not only will they need to ensure

spreading the message to enable more women to

the security of their own systems, they will need to

enter and remain in the Tech and Cyber roles. “We

pay attention to their own security, but to that of all

all have a part to play in levelling the playing field in

players in their supply chains.

technology and cyber. When I reflect on my career and my progression the success has come from a

VOLUNTEER ROLES

strong inner belief and the mentorship of managers

Adding to the demands of Dimovski’s day job are

who dedicated their time and effort to develop my

those stemming from volunteering in cybersecurity

strengths and provide networking opportunities to

organisations. She is a member of several

improve my connections. I am now paying it forward.

associations and committees, holding roles that

Here are my three actionable insights, the small

require her to participate, organise events, chair and

things everyone can do to start the ripple effect:

moderate panels, share her experiences and provide a positive role model for young people interested in a cybersecurity career.

• Assume responsibility for writing a brighter future. Start by being accountable for the shifts in culture we need to make. Add the gender diversity

These roles span: the Australian Information Security

conversation to your weekly meetings.

Association (AISA) where she is a member of the

• Start a diversity committee in your workplace.

NSW Committee; the NSW Government association,

And if there is one in place, get involved. Have a

Cyber NSW, where she is a Cyber Ambassador;

conversation about what you can practically do to

the Australian Women in Cyber Network (AWCN) where she is a mentor; and Mindful CIO where she is an Ambassador.

make positive changes.

• Mentor and role model behaviour and expectations. Identify successful women in leadership and use them as role models.

“I get a lot from these associations,” Dimovski says. “I have the opportunity to connect with

TO WORK WITH SIMONA

like‑minded people, to learn from their experiences,

Simona is passionate about helping businesses and

to seek support and share ideas. It’s very rewarding

individuals succeed. She shares her expertise with via

all around.

personalised coaching or business advisory services.

If you would like to know more about or to get advice

“Ninety-nine per cent of the time my involvement

in the form of a coach or mentor, you can reach

with these associations is after office hours. This

Simona via LinkedIn.

is a source of personal satisfaction and a sense of “I help organisations and individuals to achieve their goals” Simona

www.linkedin.com/in/simona-dimovski-100

28

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

Need Data Admin Services

Tell us more about your data Need Data appending services?

Need database admin cleaning Data enrichment services

Data Entry Admin services Data Verification services

LET US HELP YOU OVERCOME YOUR BUSINESS DATA CHALLENGES PARTNER WITH A QUALITATIVE FAST-WORKING TEAM Our team understand the importance of time and efficiency when it comes to data projects.

With:

aby@source2create.com.au charlie@source2create.com.au source2create.com.au

Elaine McConnell Business Information Security Officer at The Depository Trust & Clearing Corporation (DTCC) need to protect against external attacks,” she says.

“Using static analysis on my source code highlighted security vulnerabilities that made my applications

O

susceptible to attack. This piqued my interest and I wanted to educate others within my organisation n 14 May 2021 the Health Service

about shifting security left in application development,

Executive (HSE) of Ireland suffered a

saving time and money.”

major ransomware attack which caused all its IT systems nationwide to be shut

She volunteered her own internet-facing financial

down. According to Wikipedia, it was, at

application code for a proof-of-concept exercise to

the time, the most significant cybercrime attack on

introduce static application security testing (SAST)

an Irish state agency and the largest known attack

into the software development life cycle (SDLC) for

against a health service computer system.

the European subsidiaries of her employer at the time. On completion of that exercise the organisation

It was also a highly significant event in the

advertised for its first application security architect.

cybersecurity career of Elaine McConnell. Hardly

Elaine applied and was accepted, becoming the

surprising: she was at the time, and still is, the Dublin-

first female software architect in the company’s

based Manager of Security Operations, Engineering

European operations.

& Administration for Insurance company Canada Life (formerly Great West Life Europe).

“After fifteen years in application development I felt it was a good time to transition my career into the

She says the attack “made cybersecurity relevant to

cyber arena,” she says. A significant influence on this

all the people in Ireland making it easy to articulate

journey was her first cybersecurity manager and CISO

issues and impact as this attack impacted the

who “made security relevant and interesting to me.”

complete Irish health service for a period of time.”

In that initial cybersecurity role Elaine embedded Elaine came to cybersecurity after over a decade in

processes in her organisation to enable other

software development roles and it was discovering

application developers to see the benefits of

the vulnerabilities in her own code that led her,

building security into application development and

eventually, to a career in cybersecurity.

deployment. She worked with application teams across Europe embedding SAST scanning into the

30

FROM CODER TO CYBERSECURITY PROFESSIONAL

SDLC for all internet-facing applications. When that

“When I began developing internet facing applications

application security testing and penetration testing

my code was exposed externally and it highlighted the

and on to her current role.

W O M E N I N S E C U R I T Y M A G A Z I N E

had been completed she progressed to dynamic

M AY • J U N E 2023

W H A T ’ S

H E R

J O U R N E Y ?

A CHAMPION OF CODE SECURITY

my security knowledge. I then achieved my Ec-Council

“I promoted secure code development in my

Certified Ethical Hacker (CEH) certification to tie

organisation and assisted the application development

together the security and application security.

teams to achieve compliance with our organisational standards. I promoted secure code training and

“I understood the importance of bringing together the

rolled out annual suggested training to all internet

security management perspective, so I undertook my

application developers. Once the coding processes

ISACA Certified Information Security Manager (CISM).

were embedded I moved on to other security tools to

And risk and security are closely coupled so I also

protect applications: Web application firewall, etc.

achieved my ISACA Certified Risk and Information Security Control (CRISC) and my International Cyber

“Then an executive manager position became

Threat Task Force (ICTTF) Certified Cyber Risk

available to manage our central security team.

Officer (CCRO). Wherever my role takes me I will

This was to manage all the security tools in the

try to ensure that I back up my knowledge with the

organisation – not just the tools related to application

relevant qualifications.”

security. I was successful in my application, and this is the position I currently hold.”

It is hardly surprising with such a list of certifications that Elaine says she trains constantly and attends

She describes her role as being very operational,

conferences and seminars. “It is mandatory to

with responsibility for teams operating the tooling

undertake continuous professional education in

that protects the organisation’s endpoints, network

order to maintain my current security certifications.

and identities.

This gives me the motivation to complete and track keeping abreast of latest trends. I also listen to

“As a manager of these teams I rely on metrics to

webinars, podcasts, audiobooks etc on topics of

ensure the tools are operating to their best ability.

interest me: not only in cybersecurity but also in

Metrics for me are a key indicator of how my teams

leadership and in particular women leadership.”

and tools are operating efficiently, Elaine says.

“These metrics are a mixture of KPIs and KRIs and

Like all leaders in cybersecurity, Elaine faces staffing

dashboards to monitor performance and SLAs

challenges, in particular finding people with expertise

within my team. The volume of information that is

in cloud computing and risk.

propagating in my teams is not sustainable for me to be close to the detail but with relevant metrics I

“Organisations are moving to the cloud and leveraging

can focus on the areas that require most attention to

cloud solutions and finding staff with the required

delve into.”

skillset to deploy and monitor these solutions in a secure manner is proving difficult.”

MULTIPLE CERTIFICATIONS Elaine never studied cybersecurity at university,

The shortage of people with skills in risk

but since her career transition has made a point of

management, Elaine says, is exacerbated by

gaining multiple relevant certifications. She cites

regulatory and privacy legislation that has become

keeping her skills current as one of her biggest

complicated, costly and difficult to maintain

challenges, along with maintaining consistent

compliance with. “There is an increasing need for

awareness of emerging threats and the measures

cyber regulatory compliance and compliance to

needed to protect her organisation from these threats.

evolving regulations. Finding staff with the required skills in this area is proving difficult also.”

“When I embarked on my career I decided to achieve Certified Information Systems Security Professional

She says the COVID-induced increase in remote

(CISSP) from ISC². This gave me a good baseline for

working has not helped. “The ability for a lot of roles

I S S U E 14

WOMEN IN SECURITY MAGAZINE

31

to be conducted 100 percent remotely has opened

“The reliance organisations have on their supply chain

up the employee market more than ever before.

means that organisations not only need to monitor

The attrition rate in my teams in 2022 was higher

their own security they also need to ensure the

than ever before. Staff can take up roles in locations

security of the companies they do business with” she

they never have to attend. This is a benefit a lot of

says. “And we are becoming more and more reliant

organisations are offering, but does not fit with the

annually on IoT devices in our personal lives and they

hybrid model in my organisation.”

are coming part of the majority of activities in our daily lives. The connectivity of these systems directly

And she says it is also a challenge to get staff to

impacts the vulnerabilities we are exposed to.”

attend training and upskill where required, which in turn creates another challenge: better trained staff

AI, however, presents both a threat and an

become more attractive to other employers.

opportunity. “Advancements in artificial intelligence will enable it to predict new attacks and data breaches

Her message for anyone attracted by this skills

and assist in the protection of organisations,” Elaine

shortage is that cyber skills are not a prerequisite.

says. “However, it also encourages innovation in

“I personally feel you have to have an interest in

cybercrime. Attackers no longer need to be skilled

cybersecurity. Listen to podcasts, check out webinars

individuals. There are tools now available to assist

see if the topic interests you and if you have the

less skilled individuals to perform attacks.”

basics: you enjoy a challenge, you have natural problem-solving skills, you want to constantly evolve

With all her challenges and responsibilities it is hardly

your skillset, you are good at collaboration and critical

surprising Elaine struggles to maintain a good work/

thinking, make the transition just as I did. It will open

life balance.

up a world of opportunity.

“I have to constantly monitor my work life balance,” “Global cybercrime has increased significantly in

she says. “There are times when my position

recent years and continues to grow annually. If you

expects me to go the extra mile for the needs of the

are looking to secure a position on the front line

organisation. However I need to monitor my balance

protecting an organisation, then cyber is the right

constantly to make sure the scales are not tipping in

position for you. The skills shortage is increasing

the wrong direction.

salaries and the constantly evolving landscape gives you the opportunity to continually grow your

To achieve this she undertakes daily, weekly and

knowledge and progress your career.”

annual planning and measurement against set goals, and makes sure she gets ‘me time’. “I work better

MANY CHALLENGES

when I have achieved my fitness goals and allocate

There are plenty of other challenges. Elaine identifies

time for friends, family and fun things to do. This

supply chain attacks, the Internet of Things (IoT) and

results in a happier, healthier life.”

artificial intelligence as the biggest.

However, “There are always times when a curve ball is thrown in and then I need to reassess and prioritise. Plans may need to be adjusted to deal with shifting priorities.”

www.linkedin.com/in/elaine-mcconnell-cissp-cism-criscceh-86712a90

32

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

Source2Create Spotlight

Podcasts

We can GENERATE LEADS from your PODCAST

We can SCRIPT & CREATE your PODCAST

We can ADVERTISE & SOCIALISE your PODCAST

5 SERIE S PODCA ST AUD$10 ,000 Ex GST

REACH OUT TODAY

charlie@source2create.com.au

aby@source2create.com.au

Kirsten Chapman Lead engineer at Gallagher Security

K

irsten Chapman was born to be an

Her family-oriented upbringing also gave Chapman

engineer. “My parents were always telling

the chance to observe her uncle working in his job at

me how, as a child, I’d come up with

a plastics manufacturing company. “On the weekends,

out-of-the-box ideas for problems we

I’d be there when my uncle would be doing work, and

had as a family, and they’d look at me

I’d be running around watching these machines do

and go, ‘wow, I never thought of that’,” she recalls.

their thing. It probably wasn’t the safest thing, but the

Her natural curiosity made her question how the

experience inspired me.”

machines around her worked, what made them move and, eventually, how she could become the one

EARLY INTEREST IN MANUFACTURING

making them.

That early exposure sparked Chapman’s interest in manufacturing, but it was a Gallagher site tour

Today, Chapman is the lead engineer for Gallagher

that cemented her decision to pursue a career

Security, a global company providing integrated

in engineering.

access control, intruder alarms management and perimeter protection. She leads a team of engineers

“Growing up in Hamilton [New Zealand], I knew their

in the production of security hardware. Her journey

big glass building. Then, when I was 13, I signed up

from curious toddler to lead engineer was paved

for an electronics course. In one of our first classes

with hands-on experience, a lofty dream and some

my teacher told us about an upcoming Gallagher site

significant figures who encouraged her along the way.

tour and described all the facilities and how high-tech

The first of these were in her home.

it was, and I remember thinking, wouldn’t it be cool if I could work in a place like that one day? And that’s

“My dad was a fitter and turner,” she says. “As a kid,

kind of what started my journey.”

I used to follow him to work and put my fingers into

34

things that I shouldn’t and ask, what does this do?

She took her first step by enrolling in the electronic

And how do I do that?”

engineering program at the University of Waikato,

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

W H A T ’ S

H E R

J O U R N E Y ?

but her most significant step came in her second

BECOMING AN ELECTRONIC ENGINEER

year there when she unexpectedly found herself at

After graduating with a Bachelor of Electrical and

Gallagher’s glass door again.

Electronic Engineering in 2014, Chapman signed on with Gallagher as an electronic engineer. Four years

“When it came time to start applying for work

later she was promoted to senior electronic engineer

placements, one of the university’s workplace

and in May 2021 to lead engineer for the research and

coordinators said, ‘I’ve submitted your name to

development team.

Gallagher, we’ll see how it goes.’ I was shocked, because I never shared that goal with them, so when

Then the global supply chain crisis hit. The perfect

they said working there was a real possibility, I got

storm of events that included the Covid-19 pandemic,

really excited.”

droughts, factory fires, shipping complications and increased demand produced exponential increases

After an initial six-month summer placement in

in the prices of key pieces of hardware, such as

Gallagher’s engineering team, Chapman was invited

microchips and electronic components, making it

back during her third year of university as a student

difficult for Gallagher to continue operations.

electronic engineer and worked on a variety of projects that cemented her love of the work.

Chapman’s first major task in her new role was to steer her team through the massive challenge

“It was so fun,” she says. “That early engineering

of re-engineering several security products using

work opened my eyes to all these options and to the

components that could be accessed, and juggling

potential of what I could build or enable.”

priorities under intense time pressure.

I S S U E 14

WOMEN IN SECURITY MAGAZINE

35

“We went through each product and where we

One major challenge Chapman predicts will become

couldn’t source a component, we looked at what

increasingly critical in coming years is sustainability.

alternatives would be possible and what we could

“There’s a big conversation around what sustainability

actually source,” she says. This was a manageable

actually means. There are all sorts of perceptions

task for some of the minor components, but

out there, and they can be misleading. Yes, we can

for a few products, finding the key components

make sustainable plastics and be responsible in how

became impossible.

we manufacture and dispose of materials, but that’s only one aspect of a product’s lifetime. The industry

“We couldn’t get those pieces. So we shifted away

needs to invest in making products holistically

from trying to source those components and changed

more sustainable.”

our focus into redesigning products as quickly as we could with the resources we had to make sure we

She says that means designing products with

never stopped our supply.”

energy consumption in mind, reincorporating old components, using more recycled materials,

She says failure to supply some products would have

and clearly communicating those benefits to a

put lives at risk around the world. “Our products were

sceptical market.

being used in hospitals, in food production facilities, in small businesses – places where essential workers

“If we could re-educate people on what it means to be

needed the health and safety protections we supply.

sustainable over a product’s lifetime, maybe we could

Halting production and distribution wasn’t an option.”

build things in a smarter way in the future.”

SURVIVING THE SUPPLY CHAIN CRISIS

To contribute to that future, Chapman regularly visits

Under Chapman’s leadership, Gallagher was one

high schools to talk with students about the rewards

of the few security suppliers to continue shipping

of a career in engineering and, with luck, spark the

hardware products during the supply chain crisis,

next generation’s passion for electronics.

an achievement that reverberated throughout the security ecosystem.

“I find great joy in showing students what’s possible.

I particularly like to show others that, even though

“One of the biggest obstacles in engineering is trying

this is a heavily male-dominated field, women can

to predict the future and how we can make products

succeed and excel within the industry. There are no

that will be valued in the market for years to come,”

limits on what we can achieve.”

Chapman says, “It’s a fun challenge, to be sure – being responsive to unknown, future developments

www.linkedin.com/in/kirsten-chapman-79962496

and needs. I still get excited thinking about all the potential out there.”

36

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

2023 NEW ZEALAND

WOMEN IN SECURITY AWARDS 9

TH

NOVEMBER

t u O s s i Don’t M

Sharmaine Labrado Team Leader, Cyber Response Team | Section Chief, Women and Children Cybercrime Protection Section | Digital Forensic Examiner | Police Officer | Resource Speaker | Educator | Information Technologist

S

harmaine Labrado is a ‘cybercop’.

“These became my foundation courses in earning

No, she’s not a software manifestation of

my cybercop badge. Aside from these, I have gained

RoboCop, the robotic law enforcement

advanced knowledge in conducting cybercrime

officer featured in the 1987 science

investigations and digital forensic examinations both

fiction movie with that name. Labrado is a

locally and internationally. The PNP sends us abroad

real person.

for training with our foreign counterparts. With these, I was able to compare and learn the procedures

Specifically, according to her LinkedIn profile

of other countries in handling cybercrime and

(get ready for this!) she is: “Team Leader, Cyber

digital forensics.”

Response Team | Section Chief, Women and Children Cybercrime Protection Section | Digital Forensic

MANY RESPONSIBILITIES

Examiner | Police Officer | Resource Speaker |

Her responsibilities are as many and diverse as

Educator | Information Technologist.”

her lengthy job title suggests. As team leader, she monitors and supervises personnel who “conduct

She explains, to gain the title of cybercop in the

investigations and cyber patrolling.” She also leads

Philippines Police, “personnel need to finish four

a team in operations involving violation of the

foundation courses that enable us to conduct

Cybercrime Prevention Act of 2012 and, as chief of

proactive internet investigation, cybercrime

the Regional Digital Forensic Section, she supervises

investigation, identification and seizure of digital

the conduct of digital forensic examinations and

evidence and digital forensic examination.”

reviews digital forensic reports.

Labrado is a member of the Philippine National Police

She also coordinates activities designed to prevent

(PNP) – Anti Cybercrime Group (ACG). “I gained there

cybercrime, lectures to students and professionals on

my first-hand knowledge of cybercrime investigation,

cybercrime awareness and conducts lectures to other

proactive internet investigation, digital forensics and

police units on cybercrime investigation and how to

the identification and seizure of digital evidence”

deal with digital evidence at a crime scene.

she says.

38

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

W H A T ’ S

H E R

Labrado has only recently taken on her role as team leader of a provincial cyber response team and is the only female officer of rank in her region handling cybercrime and cyber-related crimes. She also functions as the chief of the regional digital forensic section.

“With these roles I have to demonstrate knowledge and expertise in the field of cybercrime investigation, cybersecurity, cyber patrolling and digital forensics

J O U R N E Y ?

“It is rewarding to know that I am able to use the knowledge I have learnt from my education to help the public and our fellow law enforcers in solving their issues and concerns in cyberspace as a cybercop.”

to lead the team in addressing the growing volume of cybercrime and cyber-related crimes, and apprehend cyber criminals in my area of responsibility with a

Labrado pursued her interest by joining the Philippine

total population of around three million,” she says.

National Police Anti-Cybercrime Group. “I realised then that technology is widely used as part of the

Labrado cites as the most challenging aspects of

everyday lives of individuals and that cybercriminals

her role “Being a female officer in a field dominated

are everywhere targeting computer systems and

by men, law enforcement … [and] being an enforcer

networks,” she recalls. “As a bearer of the cybercop

of the laws governing cybercrime and cyber-related

badge, I have been able to use my knowledge and

crimes in the Philippines.”

expertise in the field of information technology to serve law enforcement.”

She admits to being somewhat mystified as to just how she got her current role and offers a similar

As helpers on her career journey Labrado cites

answer to Jane Frankland who, elsewhere in this

her mentors, Sir Levy, “for giving me the first-hand

issue, says of her journey, “man plans, and God

knowledge in digital forensics and for his trust and

laughs.” Labrado says, “I really don’t know how I

confidence in me on different speaking engagements,”

arrived at my current role as team leader of the

and Sir Scott, “for the advanced knowledge he shared

Provincial Cyber Response Team. … As the proverbs

and for his continuous technical advice on digital

say, ‘You can make many plans, but the Lord’s

forensic concerns.”

purpose will prevail.’ – Proverbs 19:21.”

For Labrado the rewards of being a cybercop

EARLY INTEREST IN IT

come from serving the public. “I can serve anyone

However, Labrado arrived at her career destination

regardless of their status in life,” she says. “It

through an early interest in information technology,

is rewarding to know that I am able to use the

and in cybercrime. “It has always been my childhood

knowledge I have learnt from my education to help

interest to work with computers,” she explains.

the public and our fellow law enforcers in solving their issues and concerns in cyberspace as a cybercop,

“As an information technology student, I’ve seen

and that policing is not only about physical visibility

many vulnerabilities in the programming code used in

on the roads, establishments or streets but also can

creating software. As an instructor, I’ve observed the

be take place in cyberspace.”

tendency of computer enthusiasts to use technology for malicious programs. Because of this, I became an advocate for the ethical use of the internet and

www.linkedin.com/in/sjlabrado

technology in general.”

I S S U E 14

WOMEN IN SECURITY MAGAZINE

39

Nathalie Viuf Stender Privacy and Security Engineering Leader at IKEA Retail (Ingka Group)

N

athalie Viuf Stender grew up in

“As a child my idea was that I never wanted to do

Denmark in a cybersecurity-rich family

the same [as family]. So, I started studying business

environment “where Christmas plans

only to get frustrated by the lack of involvement of

could get dramatically altered if the

IT and IT security in the economic risk calculations,”

biggest Danish newspaper were

she says.

effected by a cyber attack or a code error,” she says.

A BESPOKE MASTER’S DEGREE

In 2005 the Danish newspaper Jyllands-Posten

“It felt like the academic world of business simply

published 12 cartoons depicting Muhammad

did not understand how important this area would

creating a storm of outrage and riots in some Muslim

become. I therefore chose to take my master’s at

countries. After that “both physical and online security

the IT University of Copenhagen, where I created

become a hot topic in my family,” Stender says.

my own master’s combining security, privacy and compliance in order to be able to deep dive into the

40

Her steeped-in-cybersecurity childhood is easy

topics I could see impacting our everyday lives and

to understand when she identifies her father, Per

businesses even more in the future. At this time

Palmkvist Knudsen, whose “career as CIO in a time

GDPR [the EU’s General Data Protection Regulation]

where security started emerging as a big topic was

was only on the horizon and cyber attacks where

very inspirational,” as the biggest influence on her

not broadly known, so the widespread options

cybersecurity career. According to his LinkedIn profile

for education in this area seen today were simply

he has had a long career in senior level IT roles.

not there.”

Today Stender is Privacy and Security Engineering

It was also a time when women in cyber roles were

Leader with IKEA Retail (Ingka Group) in Sweden.

less common, and less accepted. “As a woman, I was

However, cybersecurity was not her first career

a bit afraid of signing up for the security classes since

choice. Like many teenagers she chose a career path

they often primarily consisted of men,” Stender says.

contrary to that provided by family example, but the

“And I was concerned about how that would feel and

pull of IT and cyber proved irresistible.

look in a workplace.”

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

W H A T ’ S

H E R

J O U R N E Y ?

After that very deliberate move, Stender says some

to deprioritise their work to make sure our business

of her other career choices have been less directed.

is not impacted. This requires clear communication,

“I do not see my career as a planned journey from a

stakeholder management and an eye for the

to z. My philosophy is that I want to do what makes

technical details.”

me happy and what is sparking my interest. I have taken just as many horizontal moves as vertical,

BALANCING WORK AND LIFE

but in the end, they have all added something to my

Stender was also drawn to IKEA because she saw

overall profile.

the role as enabling her to balance work and personal life: she is able to work from home two or three days

“One example was my bachelor’s degree from

per week. “Having two kids and a husband, my first

Copenhagen Business School. It taught me to

thought is always how my everyday life with a family

understand business risk thinking, budgets and

would work. I have been offered positions I ended

strategy. I can use that knowledge when getting

up turning down because they would not allow me

the business buy-in on fixing vulnerability, planning

to be much with my family. This might change as

for security improvements or in prioritising this

my kids grow older, but right now my family life is

important topic.”

a priority.”

A GLOBAL ROLE WITH IKEA RETAIL (INGKA GROUP)

Meanwhile, Stender say the most rewarding aspect

Stender joined in 2022 and says she was attracted

specific security achievements. “For me it does not

to the position because it was a global role that

matter whether it is managers seeing ‘the light’ and

combined responsibility for privacy and for security.

becoming more aware of security, or a new junior

of her role at IKEA is “seeing people grow” rather than

who suddenly starts having all the right answers “In many companies privacy and security are seen

herself to the tough questions. Seeing how our cyber

as two different fields and are often placed far

organisation’s work ends up making a huge positive

from each other within the organisation. But you

effect on everyone in IKEA is really rewarding.”

cannot have privacy and comply with the technical and organisational measures without having good

Prior to joining IKEA, Stender had a role in which she

security. And you cannot have good security without

was responsible for compliance with GDPR and NIS2.

privacy. Being able to work with these two fields

She predicts compliance with regulations will be one

in combination made so much sense to me that I

of the most significant developments in cybersecurity

decided to join IKEA.”

over the next two years, and does have some concerns about the effect of focusing too much on

She says the diversity of tasks she has to undertake is

regulations but more work is needed in the area:

the most challenging aspect of her role. “I do not often work hands-on with complicated technical security

“Looking at the legislation coming, for example,

tasks but mentor, oversee, prioritise and, sometimes

from the European Union, we are going to see much

most importantly, communicate the results.

more regulation in this area which also links to more documentation. Done right, it will have a positive

“Security for organisations like IKEA a growing almost

impact on the actual security level, but documentation

exponentially in work and importance. And it does

and compliance alone do not necessarily lead to good

take time to get all processes and people on board

technical security.

with the sometimes-urgent nature of security.

“We need to be able to remember security is an “As an example, if a zero-day vulnerability has been

important culture that also drives better software and

discovered, we sometimes need hundreds of people

not only a legal requirement. In the end you cannot

I S S U E 14

WOMEN IN SECURITY MAGAZINE

41

defend companies against cyber attackers with a box

“I am a huge fan of vertical development. Even though

of paper.”

people coming from other fields might not have much cyber experience, they will still have some of the

CHALLENGES AHEAD

stakeholder skills, patience and business knowledge

And she expects attacks to grow, particularly on

people fresh out of the university are lacking.”

critical infrastructure, identifying global politics, as the most significant factor driving cybercrime. “We are

For her own skill development Stender says she

already seeing a big spike in government-supported

is finalising her CISSP certification to be able to

attacks on critical infrastructure, and these will

document her knowledge better within security, but

continue growing as long as countries globally seek

confesses to finding prioritising this to be a challenge.

conflict instead of diplomacy.”

“Last week, I had booked some study time in my calendar but then our IKEA security leaders from

Like every cybersecurity leader, Stender faces ongoing

China visited in Sweden and I could not resist learning

staffing challenges, “everything from pen-testers

more about their job and get some ideas for how we

to governance, risk and compliance.” She sees

can globally work better together.”

more people graduating from university with these skills, but “this still leaves a shortage of people with experience that can and are willing to bring juniors

www.linkedin.com/in/nathalie-viuf-stender-89037984

under their wings.”

And she finds people willing to transition from noncyber roles to be a good source of talent if they are willing to dive into technical topics and learn.

NEW ZEALAND'S WOMEN IN SECURITY AWARDS

ARE BACK! NOV

9th, 5:00-10:00PM Aotea Centre, Auckland

To nominate, purchase tickets or find out more, visit: womeninsecurityawards.co.nz

42

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

Want to sponsor an event but have no one to execute it?

Need stand out booth designs?

Merchandise & Prize giveaways Booth social media presence Booth set up and pack down Booth staffing Booth marketing

LET US HELP YOU OVERCOME YOUR EVENT MANAGEMENT CHALLENGES

We can execute anywhere in Australia, REACH OUT TODAY FOR AN INSTANT QUOTE. The team at Source2Create has all the necessary skills to get the job done for you, so your time can be reserved to focus on other things.

With:

aby@source2create.com.au charlie@source2create.com.au source2create.com.au

Silvana Macri Founder of Stay Cyber Safe

gaps they have in security knowledge and cultural dimensions.”

I

And the biggest cybersecurity challenge she sees is f anyone’s career trajectory reinforces the

the scarcity of people like herself. “I wish there were

message, frequently repeated in these pages, that

more security specialists with a psych background

skills other than those in technology loom large in

and communications and facilitation experience

cybersecurity, it is that of Silvana Macri.

who understand how to translate tech speak to user speak,” she says. “Right now we are incredibly

Asked what first piqued her interest in

overallocated and under-resourced.”

cybersecurity, Macri replies: “I was born to be a social engineer. I love people and behavioural psychology

A pivotal moment in Macri’s cybersecurity career was

intrigued me.”

her discovery of Perry Carpenter, who she describes as “the ‘father’ of security awareness as a function.”

Her first steps to pursue her interest were not studying technology, but networking, the personal

Carpenter is Chief Evangelist and Strategy Officer

kind. “I am an avid networker, so I joined as many

at KnowBe4—a security awareness training and

security-related networking groups and went to all

simulated phishing platform—and the author

their events to meet people and listen to what they

of Transformational Security Awareness: What

had to share.”

Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behavior. He formerly led

After 16 years in various IT related roles, in 2019 she

security awareness, security culture management

founded her own cybersecurity education specialist

and anti-phishing behaviour management research

business, in Perth: Stay Cyber Safe. It provides

at Gartner.

programs, tools and learning opportunities to help corporates, industry groups and SMEs reduce their cyber risk.

FORMAL QUALIFICATIONS IN SECURITY AWARENESS Now, Macri is planning to gain formal qualifications in

44

RELATIONSHIPS ARE REWARDING

the behavioural aspects of cybersecurity by sitting the

For Macri, the rewards that come from being in

Security Awareness and Culture Professional (SACP)

cybersecurity are not technical achievement but

exam, a vendor-neutral certification that recognises

relationships: “Working with people, rewarding

professionals who work and exhibit competency in

positive behaviour, and helping people fill the

the development, assessment, management and

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

W H A T ’ S

H E R

J O U R N E Y ?

maintenance of security awareness programs. “It is absolutely critical in a role like mine,” she says.

However, cybersecurity requires people with a technical focus as much as a people focus, and some are better suited to such roles. Macri’s advice to anyone aspiring to a role similar to hers is to first explore the technical side. “Do a short cyber course first as a pathway and see if it is a good fit, or alternatively if it’s the people side of cyber, study behavioural science/psychology and facilitation (delivery).”

Macri says she “couldn’t believe how the people side of security was being unaddressed,” until “I realised it was because people are grey, not on/off binary.

And tech peeps generally find people difficult to predict so they avoided the human element for years until it seriously became the biggest/most effective attack vector.”

CHALLENGES AHEAD However, human ingenuity might be about to lose its prime position. It is not people but technology, specifically artificial intelligence that Macri sees as being one of the most significant new threats. She is not alone; it has been cited by many women who have shared their cybersecurity journeys in these pages.

“The challenges AI/automation brings cannot be decoupled from the benefits, so be aware and prepared for an exponential increase in attack numbers and sophistication,” she says. “Do not underestimate nation state attacks using automation/ AI especially in critical infrastructure.”

As the biggest influence on her career, Macri cites Kevin Mitnick, a convicted hacker who now runs security firm Mitnick Security Consulting and is part owner of KnowBe4. Macri hosted him in Perth for a two-day event at Optus Stadium in 2019 and she says he is now her ‘friend’ on a number of online platforms.

www.linkedin.com/in/macrisilvana

I S S U E 14

WOMEN IN SECURITY MAGAZINE

45

A PROGRAM THAT CONNECTS, SUPPORTS AND INSPIRES FEMALE TERTIARY STUDENTS AND EARLY CAREER PROFESSIONALS EXPLORE A CAREER IN SECURITY. EXPLORERS WILL BE ABLE TO ACCESS MONTHLY WORKSHOPS, MENTORING OPPORTUNITIES AND INDUSTRY CONNECTIONS

"When women work together, they become a force to be reckoned with.

Be part of a force for good in the security industry, by joining the AWSN Explorers program today!"

- Liz B, Co-Founder

Studying or an Early Career Professional in information security?

Learn more at .awsn.org.au/initiatives/awsnexplorers/

OU Y E AR

INTEREST

E D?

Global Contributors

WANTED OUR NEXT ISSUE'S THEME:

Issue 15: Embracing the Equity Charter across Education, Employment & the Workforce

WAYS YOU CAN CONTRIBUTE: Contribute to one of our

editorial sections

What's Her Journey Career Perspectives Industry Perspectives Technology Perspectives Student in Security Spotlight

Run a listing for

any of the following

Submission Have a book?

Deadline: Have a podcast?

May 24th Have a blog?

Have free training and learning opportunities available?

REACH OUT TO ABY@SOURCE2CREATE.COM.AU TODAY

www.womeninsecuritymagazine.com

CRAIG FORD Cyber Enthusiast, Ethical Hacker, Author of A hacker I am vol1 & vol2, Male Champion of Change, Special Recognition award winner at 2021 Australian Women in Security Awards

C O L U M N

Doing it differently I have never been one to follow the easy route, the

‘choose-your-adventure’ books than cybersecurity

beaten track stretching out before me. Many people

books, and I love that about them. You can choose

like to see how things have been done previously and

the order in which you read them. You bought them,

follow the path of least resistance. That can be an

why should you not decide?

acceptable way to do things and, on occasion, I have done the same. But what happens when that beaten

I have gotten a little off track here, but my point is

track is not right? What happens if that well-worn path

that, to achieve the results we need in cybersecurity,

leads everyone who follows it to the same failures?

we need to innovate and look at the problems we face in a different light. To do that, we need to promote all

You should change paths, right?

aspects of diversity: race, gender and background.

We need to encourage different ways of looking at

Yes, you should. You should stop, look at what

things. We need to look and see if we can do things

everybody is doing and consider how you might be

better, or make them simpler to manage. Maybe we

able to do things better, or differently. Different can

need to throw away old ideas and ways of securing

sometimes be sufficient to inspire innovation and

our systems and try something completely different.

foster a new way to look at a problem.

Just because something has always been done a Following that unbeaten track will not always be easy.

certain way does not mean that way is right. Think

I know. I have the bumps and bruises of life to prove

for yourself, and be brave enough to say: “No, that’s

it. However, by going my own way I have, on occasion,

not how it should be done.” If we can do that, I think

achieved great success.

we just might have a chance of taking back control of our systems, of getting to a level of security that will

Look at my writing, for instance. I started my

allow us not only to endure an attack. We may even

writing journey about six or seven years ago. I had

be able to make attacks irrelevant or inconsequential,

never really written anything previously and no

because we have found ways to protect our systems,

writing experience when I pitched my first article

or reduce the impacts of attacks. Maybe then the

to Charlie-Mae at CSO magazine, who now works

onslaught of breaches and data pillage will end.

for Source2Create, the publisher of this amazing magazine, Women in Security. (The editor of Women

It is a dream, and a tough one for us to achieve. But

in Security, Abigail Swabey, was editor of CSO at the

nothing worthwhile is ever easily achieved. So, let’s

time.). However, I had something I needed to say, a

stop talking, let’s start doing something about it.

problem that needed to be aired and considered. That

Diversify, innovate and succeed.

decision led me to what I feel is now a reasonably successful writing career.

www.linkedin.com/in/craig-ford-cybersecurity

I have written approximately 200 articles, had three

www.amazon.com/Craig-Ford/e/B07XNMMV8R

books published, have three more to be released in 2023, and I am working on others for release in 2024.

I have not tried to follow anyone else’s style. I do my own thing, but it works. Seriously, the books in my A Hacker I Am awareness series are more like the old

48

W O M E N I N S E C U R I T Y M A G A Z I N E

www.facebook.com/AHackerIam

twitter.com/CraigFord_Cyber

M AY • J U N E 2023

CAREER PERSPECTIVES

DEIKA ELMI

THE REAL REASON FOR THE SHORTAGE OF WOMEN IN SECURITY

by Deika Elmi, Vice President Of Security Engineering at Goldman Sachs

Culture is the key reason there is a shortage of

That kind of advertising is pervasive and, according

women in security professions. Women with all the

to Chana R Schoenberger, editor-in-chief of American

necessary talents opt for other jobs – some early

Banker, it turns women away from applying. As a PhD

on, some in the middle of promising careers. Ways

dissertation, The Underrepresentation of Females

to combat the shortage include altering the way

in the United States Cybersecurity Workforce, put

security talent is recruited and emphasising the

it: “Everything is not young white guys at a black

human element. Recruiters can attract more skilled

and green screen. There are other parts that can be

women by tweaking job descriptions so they read

highlighted, such as geopolitical, social, investigative,

more about helping people and less like the script of

and the human element.”

an action movie.

Women who stay in cybersecurity often feel alienated

YOU DO NOT NEED A “WORK WARRIOR IN A FAST-PACED ENVIRONMENT”

and out of place before realising they do belong

It is no secret fewer women than men enter security

2021 University of New England degree dissertation

professions. One reason for this is an inaccurate

interviewed 16 C-suite women executives in

impression of what a role in security entails. Even

cybersecurity and found one common experience:

in the most physically challenging environment you

“The pivotal moment was the relationship of a mentor

will certainly spend more time watching and talking

or sponsor who then validated their ability to do that

to people than you spend in fistfights. However,

role, giving them the confidence to push past those

that is often not the impression you would gain

feelings of being an imposter.”

and do have the necessary skills. The author of a

from a security job description. Yet, according to

50

Winifred R Poster, a lecturer in international affairs

Those women who do enter the cybersecurity

at Washington University, in the US “job postings call

profession may not stay. A 2014 paper Women

for ‘ninjas’ and ‘cyberwarriors’.” Physically pulling a

in STEM and Cyber Security Fields, presented to

plug is the most action you can expect to see in most

the American Society for Engineering Education’s

cybersecurity professions.

Conference for Industry and Education Collaboration

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

C A R E E R

P E R S P E C T I V E S

estimated 80 percent of men stay in cybersecurity

with or helping other people). Such perceptions might

while only 60 percent of women do. Skilled mid‑career

disproportionately affect women’s career decisions,

women often love the work itself, but become

because women tend to endorse communal goals

frustrated with an ‘expectations gap’ and a poor

more than men.”

work culture. A 2008 Harvard Business Review report said 41 percent of women who entered the

Tragically, women’s very desire to help people

tech industry leave, compared to just 17 percent of

is not helping them succeed in cybersecurity.

men. A recent McKinsey report gave richer detail.

Furthermore, this is the very talent the profession

It found, in tech, 37 percent of entry-level jobs held by

needs to attract if it is to successfully combat most

women compared to 47 percent in other industries.

cybersecurity attacks.

That number dwindles with seniority. Women hold only 30 percent of managerial, 25 percent of senior

CHANGE THE CULTURE, SAVE THE WORLD

manager/director, 20 percent of VP and 15 percent of

Companies intentionally or unintentionally alienate

C-suite roles.

women during the sourcing and recruitment process.

A warrior ethos and whiz-bang technical details are

EMPHASISE THE HUMAN ELEMENT

not the heart of security work. Security professions

People skills are extremely important in security.

are about helping people and keeping them safe.

Cybersecurity experts love to talk about extremely

There are no cloaks nor daggers. Patience is needed

technical attacks like watching LEDs with a drone or

far more often than a shuriken (a Japanese concealed

decrypting RSA keys from the whir of a hard drive. Yet

weapon used a to distract or misdirect an opponent).

for every highly technical attack there are many more attacks that could have been stopped by persuading

Women are not rare in security. As of 2017, around

people to update their passwords and not click

44 percent of private detectives and investigators

suspicious attachments. Bravery and geeky brilliance

were women. Around 24 percent of the workforce in

have their place, but far more of the day-to-day work

the investigations and security services sector were

of cybersecurity is .

women. That number is growing: an extrapolation from Census data estimates 27.4 percent of workers

That conclusion may be one explanation for the STEM

in the investigations and security sector were

skills shortage. Amanda Diekman, a professor of

women in 2019. One in four is far from parity, but it is

psychology at Indiana University, led a study which :

progress that can be built upon.

“one important reason for [gender] discrepancy is that STEM careers are perceived as less likely than careers in other fields to fulfill communal goals (eg, working

I S S U E 14

www.linkedin.com/in/deikaelmi

WOMEN IN SECURITY MAGAZINE

51

HR IS WELL POSITIONED TO MAKE ORGANISATIONAL DIVERSITY A HABIT

by David Braue

Fine tuning your recruitment diversity can set the tone across the organisation

I

t is well understood that diversity in teams

CVs, screened more than 72,000 candidates and

provides a necessary spectrum of experiences,

conducted more than 2000 interviews with the

which in turn fosters innovation across the

320 people who were ultimately onboarded into

organisation – but how can companies develop

the organisation.

this diversity?

“It was really a no-brainer for us to establish a bigger

HR-driven recruitment practices can be a great

presence in Malaysia,” Clive Jardine, Kuala Lumpur-

place to start, as multinational manufacturer Kerry

based HR director for Global Business Services with

Group found when diversity played a core role in

Kerry Group told a recent SSON webinar. “But we

building a strong business case for hiring more

faced challenges around the need for really good

than 200 new staff for its Kuala Lumpur, Malaysia

skills and strong talent to support our business here.”

shared‑service operations.

Asia’s broad cultural and linguistic diversity meant

52

As the organisation went to market it became clear

talent needed to be equally diverse. Support for 16

that building diversity into its recruitment efforts

different languages was key, and employee diversity

would be crucial not only to finding enough staff, but

was critical to ensuring the new workforce could

to finding the right ones.

support the business and its customers.

Also crucial was rapidly scaling up the recruitment

Jardine said gender diversity was one key focus

effort. Over the course of a six-week recruitment

for the company, which, he said, was probably,

drive, run in conjunction with recruitment firm Page

predominantly female. However, building and

Outsourcing, Kerry Group received over 20,000

extending a multicultural workforce was just as

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

F E A T U R E

important to ensure the new business function had the right mix to support innovation for the long term.

“From a values perspective, we really do celebrate diversity,” Jardine explained. “And we’re really proud of the fact that we represent multiple ethnicities in our organisation that are representative of Malaysia; that was really a good aspect in terms of the recruitment process.”

Strong working relationships between the recruitment firm and internal HR organisation was crucial,

“As a leader, if you see people behaving in a manner that is inconsistent with the very values that the company has stated, and that’s tolerated, then what credibility would go into the values?”

- Delta Airlines senior vice president Tim Mapes

with Page and Kerry Group teams using “honest, transparent and fluid” communication to work through the process in lockstep, said Page Outsourcing Hong

In running the recruitment drive during the chaos

Kong associate director Andrew Barnes – who noted

of the COVID-19 pandemic and the ensuing shift to

that Kerry Group’s strong sense of values ensured

remote access, for example, the EVP rapidly skewed

diversity remained integral to the process.

towards “things that weren’t necessarily important to people before,” Barnes said.

Kerry Group “were able to supply us with a plethora of information that helped us gain a detailed

Kerry’s workplace culture, personal development and

understanding of them as an organisation, the

work/life balance became points of differentiation

way they work, their company culture, and the way

as the Page team worked to sell Kerry’s culture to

they were going to be replicating that,” Barnes said,

prospective employees – with diversity initiatives

noting this had helped the two organisations refine

such as traditional dress and food days meaning they

the employee value proposition (EVP) Kerry used to

could “really allow people to be their authentic selves

attract the right mix of candidates.

within the workplace.”

I S S U E 14

WOMEN IN SECURITY MAGAZINE

53

A recent Gartner survey of more than 800 HR leaders found them facing increasing competition for talent.

Thirty six percent of respondents said their sourcing strategies were “insufficient” to help them find the skills they need – and 44 percent admitted their organisations lacked “compelling career paths” to attract and retain the employees they need.

“HR leaders face a historic amount of disruption, and “The fact that Kerry lives and breathes this culture

their timeline from planning to action keeps shrinking

and ethos,” Barnes said, “helped us to identify suitable

while the imperatives increase,” Gartner said, noting

talent that aligned with the values they’re looking for.”

the simultaneous challenges HR leaders face in needing to juggle people and technology investments,

“We are super proud of the people that we’ve

cultivate a positive culture and employee experience,

been able to attract to our organisation through

and transform HR to be “more automated and digital.”

this process,” Jardine said, calling the program a “remarkable success… we’ve got candidates selected

Central to these changes is the creation of an

on the basis of what will really work, and fit with our

equitable internal labour market, according to Gartner.

organisational values.”

It advises HR leaders to shape their strategies this year around boosting leadership development,

54

SEIZING THE OPPORTUNITY FOR CHANGE

organisational design and change management,

Mass recruitment drives – often linked to significant

employee experience, recruiting, and overhauling

new investments in technology or business

workforce planning that is often “disconnected from

capabilities – present a significant opportunity to

reality and… ineffective at combating the disruptive

remedy lingering inequality in the company culture.

landscape.”

Yet it’s important to avoid allowing pro-diversity

VALUE INNOVATION? THEN VALUE DIVERSITY

practices to fade once the project is finished; rather,

Doubling down on a company’s values and brand

diversity, equity and inclusion (DEI) values should be

can provide a significant foundation for subsequent

embedded deep within the HR function – and that of

growth and innovation, says Delta Airlines senior vice

strategic recruitment partners – to ensure hiring and

president Tim Mapes. He told a recent CES 2023

staff retention practices seed the diversity crucial to

session that “at the end of the day, a brand has got to

fostering innovation.

be true to itself.”

Such policies speak directly to a company’s ability to

“As a leader, if you see people behaving in a manner

deliver a hospitable, compelling employee experience,

that is inconsistent with the very values that the

and many businesses admit their HR practices are

company has stated, and that’s tolerated, then what

still falling short in this respect.

credibility would go into the values?” he continued.

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

F E A T U R E

“Every one of us has potential bias, and it’s about how to find strategies to counter that. It’s so powerful when leaders start to recognise this themselves, then do things to actively change that.”

- RMIT University School of Management associate professor Dr Lena Wang

Simply having senior executives pushing the barrow of equality is not enough to change an organisation on its own, she warned: “you may have this amazing, visionary CEO who truly gets it, but somehow when that communication falls down to your frontline managers, it goes missing – and they don’t get the point as to why we need more women on the team.”

Such attitudes can prevent many women from speaking up to express their concerns about potential blockers for innovation – an issue that proactivity

by HR executives can counter. “It’s very important to create psychological safety for all employees to give feedback,” Wang said.

“When you make decisions, and behaviours are consistent with those values, your brand comes to be

Even in companies that have good policies in areas

known in the hearts and minds of your employees and

such as flexible work arrangements, she said, “a lot

customers as representing those things.”

of the time it is those day-to-day experiences that make women feel excluded… when you are creating

As the internal managers of human capital and

workplaces that are not truly supportive of women

culture, HR staff have considerable strength in setting

employees.”

the tone of that decision-making to ensure it supports the culture necessary to foster sustainable innovation.

It’s a practice that should also be extended to strategic partnerships, says Kate Wendt,

RMIT University School of Management associate

vice president of strategy, transformation and

professor Dr Lena Wang told a recent AWSN

sustainability with Seattle-based outdoors retailer REI

International Women’s Day event that shaping culture

Co-Op. She identified three core steps the company

also requires a degree of introspection to evaluate the

takes when developing new partnerships.

effect unconscious bias may have on hiring practices – and to detect when unconscious bias skews hiring

These include doing due diligence on partners’ values

practices. She said recognition of unconscious bias

and alignment, looking at what each party brings to

could have flow-on effects in unexpected places.

the table, and how the company can learn by being more open.

“Every one of us has potential bias, and it’s about how to find strategies to counter that,” Wang explained.

“We tend to be highly discerning about partners,” she

“It’s so powerful when leaders start to recognise this

explained. “The biggest learning is how we can be

themselves, then do things to actively change that.”

more open and listening and learning.”

I S S U E 14

WOMEN IN SECURITY MAGAZINE

55

J O B B OA R D SECURITY ANALYST (WATCHER) | THE MISSING LINK FULL TIME

MID-SENIOR LEVEL

NEW SOUTH WALES

DESIRABLES • You are naturally curious and a self-starter. Tell us about how you build Cyber Ranges in your own time, or your latest research project.

• You have experience with Internal Investigations and/ or Insider Threat Management.

• You have worked with custom applications and log formats in a TDIR context.

• You listen to and follow podcasts and bloggers like Darknet Diaries, Recorded Future, @IT_SecGuru or @TheHackerNews. Tell us what r/ threads you’re currently tracking.

• You have exposure to Vulnerability Assessments or Penetration Testing professionally or through your own personal research. If you’ve started a CEH or OSCP certification, even better!

• Show us how you automate using PowerShell and Python.

AUSTRALIA

• You have COMPLETED, not started, certifications such as CompTIA Network+ and Security+ as well as core networking such as Cisco CCNA or CCNP.” ESSENTIAL • 3+ years of experience working with systems, networking and security technologies, with at least 2 years working as a Security Analyst or equivalent role • Hands-on security knowledge of Windows/Linux/Unix platforms • Hands-on experience with one or more SIEM/EDR/VM systems and can demonstrate end to end knowledge of the TDIR Methodology • In-depth knowledge of the MITRE ATT&CK Framework • A demonstrated knowledge of IT security controls, OSI Model and TCP IP Stack

APPLY HERE

INFOSEC ANALYST | SAGO UNITED STATES

REMOTE

FULL TIME

ASSOCIATE

ABOUT THE ROLE • Establish relationships with new and existing third parties (e.g., contractors, vendors, service providers).

• Relay current Information Security requirements to third parties and inform internal stakeholders when requirements are not met.

• Manage and update Information Security questionnaires.

• Maintain list of approved contractors, vendors, or service providers.

• Modify and retain relevant legal, financial, and security documents (e.g. NDA, Security Questionnaires, Invoices, Purchase Orders).

• Regularly audit third party security risk.

• Where possible, negotiate contracts with third parties for optimal pricing.

• Periodically assess performance of vendors and make recommendations to stakeholders when organizational needs are not met.

• Manage third party onboarding and work with internal stakeholders to make relevant updates when necessary.

• Route supplies to appropriate locations, departments, or users.

56

W O M E N I N S E C U R I T Y M A G A Z I N E

• Manage third party payments and billing.

• Assist team members in implementing best security practices across the organization as needed.

• Perform Information Security document reviews.

• Aid in the monitoring and testing security mechanisms as needed.

• Proficient in Word, Office, MS experience, Windows Operating Experience.

REQUIREMENTS • Bachelor’s degree in Business Management, Business Administration, Supply Chain Management or equivalent.

• Excellent oral and written communication skills.

• Ability to organize, multitask and manage time effectively.

• Strong research, analysis and negotiation skills.

• Good communication and interpersonal skills.

• Ability to effectively manage multiple projects at once.

APPLY HERE

M AY • J U N E 2023

IT AUDIT MANAGER | TROOCOO FULL TIME

MID-SENIOR LEVEL

NEW SOUTH WALES

ABOUT THIS ROLE As the IT Audit Manager you will work as the 2ic to the Head of IT Audit. This is a new role created due to investment within the Risk function and the need to add an SME in Cyber and Technology Risk. This role will work across multiple projects across Cyber, Digital, Cloud transformation and technology uplift programmes.

You will play a key role in the design and operations of Technology Audits, taking ownership for the end to end delivery of audits working with multiple business and risk stakeholders.

You will take ownership for IT Audits, manage the strategy and delivery of said audits whilst working closely with the business to ensure all risk is highlighted and mitigated accordingly. You will also plan and manage resources to ensure deadlines are met.

QUALIFICATIONS/WORK EXPERIENCE

AUSTRALIA

• Minimum three years’ experience working across IT Audit, Risk or Compliance programmes • Three years’ experience within the financial services domain, preferably banking.

• Work across a range of regulatory requirements, hands on knowledge of security management is highly desirable, specifically CPS234 • Proven experience in risk and control identification, assessment, tracking and remediation • Strong background in risk management and prioritisation within Risk and Control Taxonomy • Good knowledge of IT control implementations and ability to control and mitigate risk • Proven ability in risk and control identification, tracking and remediation • Certifications across would be highly beneficial CISSP, CISM, CISA, CRISC • IT governance framework knowledge such as ISO27k, NIST CSF, CIS, ITIL v3 and COBIT

• Five years’ experience across the IT audit, It Governance, Assurance and technology risk domain

APPLY HERE

SYSTEMS ENGINEER | L EIDOS AUSTRALIA FULL TIME

MID-SENIOR LEVEL

CANBERRA

ABOUT THE ROLE Leidos Australia have opportunities for System Engineers to join our team based in Canberra and provide support to a large Federal Government program. As part of our team you will be responsible for all system engineering aspects of the product baseline and structures for multiple delivered subsystems and assist in the smooth transition of new capability into service.

The ideal person will have an in-depth understanding of the systems engineering lifecycle applied to complex mechanical/electrical systems, an understanding of configuration management and the ability to troubleshoot, identify faults and rectify.

QUALIFICATIONS/WORK EXPERIENCE

AUSTRALIA

• Demonstrated experience developing engineering artefacts (Application for Deviation, Engineering Change Proposals (ECPs) and engineering investigation reports); • Strong interpersonal, communication and technical writing skills • 2-3 years’ experience in one or more of the following; • Windows (Windows Server 2008, 2012 & 2016, Exchange 2010 & 2016, Active Directory, DNS, DHCP & DFS, Enterprise level backup products) • Networking (NSX, Cisco, Palo Alto) • VMWare, or vROPS, vShpere, Horizon, vRealize • Linux (Red Hat Satellite Tower, Ubuntu)

APPLY HERE

• Understanding of the ITIL framework • Involvement in detailed design and equipment acquisition of complex systems

I S S U E 14

WOMEN IN SECURITY MAGAZINE

57

J O B B OA R D INFO SECURITY CONSULTANT - CYBERSECURITY AWARENESS & EDUCATION | KEYBANK UNITED STATES

REMOTE

FULL TIME

MID-SENIOR LEVEL

ABOUT THIS ROLE The Info Security Consultant - Cybersecurity Awareness and Education manages the execution of Key’s Security Awareness and Education Program. The overall goal of the security awareness and education program is to reduce information security risk by ensuring that all employees and contractors understand Key’s security policies and apply information security practices with respect to institutional data and information technology systems.

In collaboration with other members of the Enterprise Security Services, this position will manage a broad set of activities, including drafting publications, creating and managing website content, facilitating marketing campaigns, scheduling meetings, hosting/presenting virtual training sessions, creating timelines and infographics; and helping to plan outreach, awareness, and educational events for KeyBank clients and employees.

REQUIRED QUALIFICATIONS • Experience working across multiple lines of business to design and implement training plans and track organizational progress, development, and metrics.

• Strong verbal and written communication skills with experience briefing corporate professionals,

executives, and clients.

• Ability to periodically travel to conduct training.

• Proven ability to identify and implement process improvement opportunities.

• Results oriented, self-starter with ability to work with general direction.

• Ability to manage competing priorities.

• Basic understanding of security threats and knowledge of financial industry.

• Strong organizational skills and ability to multitask.

Experience coordinating, organizing, and implementing events.

• Demonstrated experience executing multifunctional projects.

• Strong analytical and conceptual skills; ability to see the “big picture,” proactively think/plan and provide ideas.

• Effective teamwork and interpersonal skills and ability to communicate with all levels in the organization.

• Experience with Microsoft Excel, Word, PowerPoint, and SharePoint.

APPLY HERE

INFORMATION SECURITY SPECIALIST - GRC | PEOPLEBANK FULL TIME

ENTRY LEVEL

NEW SOUTH WALES

AUSTRALIA

RESPONSIBILITIES

REQUIREMENTS

• The effective governance of organizational websites and mobile applications activities.

• Driving the Vendor Security Governance program • Supporting Cyber Security compliance activities within the team.

• Strong knowledge across Information Security and Cyber Risks.

• Deep knowledge of cybersecurity practices, risk assessments and compliance activities.

• In-depth knowledge of risks assessment process.

APPLY HERE

58

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

CYBER SAFETY AWARENESS CONSULTANT | QBE INSURANCE NEW YORK

FULL TIME

MID-SENIOR LEVEL

ABOUT THE ROLE

PREFERRED COMPETENCIES/SKILLS

• Develop and execute regional cyber safety strategy and ensure alignment with global strategy • Support Divisional Information Security Officer through engagement and influence of technology and business stakeholders and provide training to highrisk employee groups • Partner with Communications, Learning and Development, Risk & Compliance and Technology teams to deliver engaging cyber safety awareness resources for the QBE workforce, partners and customers • Develop awareness of and participate in projects and other change initiatives where cyber safety awareness inputs are required to achieve defined outcomes and ensure safety risks are proactively managed • Build and manage strong and effective relationships with business stakeholders and project teams to deliver services that meet stakeholder expectations • Maintain high standards of service delivery to enable continuous improvement and effective response to stakeholder feedback

• Communication – strong verbal and written communications. Ability to communicate clearly and concisely to a broad audience; translating technical information into business-relevant language • Influence – ability to develop and leverage relationships to achieve the right outcome for QBE. Represents Group Cyber Security team in a range of internal and external forums • Customer service – sound customer service focus, able to provide advice and recommendations to address customer needs or strategic business issues; supporting the implementation of any agreed actions • Self management – ability to apply excellent attention to detail, have strong organizational skills and manage and deliver conflicting priorities • Analytical and problem solving skills • Actively undertake personal development to ensure up to date knowledge and skills • Experience at managing and influencing relationships at senior level.

APPLY HERE

DO YOU WANT YOUR COMPANY'S JOB LISTED IN THE NEXT ISSUE? Contact us today to find out how we can boost your job listing and help you find the top talent in the security industry.

REACH OUT

aby@source2create.com.au

I S S U E 14

WOMEN IN SECURITY MAGAZINE

59

BUILDING A CAREER IN CYBERSECURITY: STRATEGIES FOR NEWCOMERS AND CAREER TRANSITIONERS

by Jay Hira, Director of Cyber Transformation at EY Kavika Singhal, Cyber Security Consultant at EY Michelle Gatsi, Cyber Security Consultant at EY

INTRODUCTION

challenge for those who want to start a career in

Jay Hira

cyber and those who want to navigate a career transition into cyber is how to put their best foot

As practitioners in the cybersecurity industry we are

forward for an industry opportunity and demonstrate

constantly solving a complex puzzle. This puzzle has

curiosity, conviction and persistence through actions

many moving parts, and no one person has all the

beyond words. As a result, we decided to share our

answers. If we bring together a team of people with

experiences and provide specific advice for those

similar educations, experiences and viewpoints, they

looking to start a career in cybersecurity as students,

are likely to have similar biases and, therefore, similar

and for those looking to navigate a career transition

blind spots in the way they solve a problem. This is an

into cybersecurity.

issue we encounter constantly in many cybersecurity diverse as the problems themselves. When we bring

STARTING A CAREER AS A STUDENT IN CYBERSECURITY

together a diverse group of individuals with different

Kavika Singhal

environments. The teams solving puzzles must be as

ethnicities, academic backgrounds, ages and life experiences, we get a more comprehensive and

As someone who has been a cybersecurity student

innovative approach to problem-solving.

I understand the struggles of navigating a field without a clear-cut career path. However, this industry

60

Recently, we participated in an “Ask an Expert”

values the diversity of skills and experiences that

session at the AISA Cyber Conference in Canberra

each individual brings to the table. Whether you

where we observed a high degree of interest in

come from a technical or non-technical background,

pursuing careers in cybersecurity. The most common

cybersecurity has a place for you. To help newcomers

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

C A R E E R

P E R S P E C T I V E S

in the industry, I would like to share some tips based on my personal experience.

NAVIGATING A CAREER TRANSITION TO CYBERSECURITY Michelle Gatsi

Embrace opportunities. Starting without prior experience or knowledge can be intimidating,

My journey into cybersecurity was slightly

but it also means you have a clean slate and the

non‑traditional. Here are a few pointers to what

malleability to mould yourself into any form. Do not be

worked for me as someone with a background in

afraid to say “Yes!” to opportunities, even if you do not

criminology and a history of work experience in

have the necessary skills. Believe in yourself and say,

the legal sector. These could be helpful for anyone

“I don’t know, but I can figure it out.” By learning and

looking to transition into a career in cyber.

gaining new skills, you can give any opportunity that comes your way your best shot.

Build meaningful relationships. This does not mean increasing your LinkedIn connections to increase the

Make learning a priority. Learning in cybersecurity

number of connections you have. Building involves

never stops, because the industry evolves constantly.

a lot of time and effort. Before I started working in

As a student, I volunteered for student accelerator

the industry I met with many experienced cyber and

programmes and learned alongside my peers to

information security professionals. I was genuinely

deliver job-enhancing workshops. Participating in

interested in knowing more about them, what they

capture-the-flag events, hack rooms, certifications,

did for fun, their day-to-day work, and why they chose

podcasts, news articles and networking events can

cybersecurity as a career. I even found myself some

also help you upgrade your skills and knowledge.

career mentors who are now my very dear friends:

Such activities are critical to getting your first job in

Phillimon Zongo and Jay Hira.

cybersecurity.

It was a very busy time for me, juggling my then legal Network and engage. Building industry connections

support officer role by day and my cybersecurity

helped me understand the various roles and

career pursuit by night. I am still in contact with many

responsibilities within cybersecurity. Attending

of the professionals I connected with earlier in my

networking events and conferences enabled me to

career, and I now work with some of them. You will

seek more opportunities for growth and learning. By

never know where your connections can lead you, but

meeting new people I better understood the impact

it is important to approach this step with complete

I could make in the industry, which became a driving

authenticity: be yourself and be real. This leads me to

factor in my studies.

my next point.

Showcase your work. It is important to share

Leverage personal branding platforms. I found

your contributions with others. LinkedIn is a major

LinkedIn to be a handy tool for promoting my personal

networking platform used by many cybersecurity

brand and connecting with industry professionals

professionals, and an excellent way to engage,

from all over the world. I was always very shy; the

connect and be inspired. Talk about your key

thought of sharing my written articles or promoting

learnings from networking events, tag individuals

my achievements with other professionals was

you connected with, and discuss how completing a

terrifying. However, I learned very quickly that

course or certification has added to your skill set and

sometimes you have to step outside your comfort

will benefit your career. This practice creates a pattern

zone to get where you want to go. This means

of accountability and reflection crucial to building

becoming comfortable with the discomfort and

your brand.

pushing through it. I wrote and published my first-

I S S U E 14

WOMEN IN SECURITY MAGAZINE

61

ever blog on my LinkedIn page just under two years

SUMMARY

ago, based solely on my desire to pursue a career

Jay Hira

in cybersecurity. This blog caught the attention of a

Strong teams are diverse in perspectives, life

number of industry professionals who were interested

experiences and leadership. The wider the variety of

to know more about my journey and offered a

people and experiences we recruit to defend against

helping hand. These interactions added fuel to my

adversaries, the better our chances of success.

enthusiasm to learn more about the industry.

Individuals looking at transitioning into a career in cybersecurity should focus on building meaningful

Be open to ongoing learning. As technology

relationships, leveraging personal branding platforms,

advances relentlessly, so do cyber criminals and

upskilling and reskilling through relevant certifications,

their techniques. Cybersecurity is like a big house

and gaining experience through volunteering and

with many rooms (in fact, picture a castle with

internship programmes to build a solid foundation for

each room representing a different domain – from

a successful career in the dynamic and exciting field

data protection and privacy to identity and access

of cybersecurity.

management and beyond). It is easy to feel lost and overwhelmed by how much there is to learn. But I believe the key is to keep the mind active through continued learning. Our industry involves constant change; therefore, we must be willing and open to acquiring new knowledge and upskilling. We can do this through tertiary study, certifications, boot camps,

www.linkedin.com/in/jayhira

www.linkedin.com/in/kavika-singhal

www.linkedin.com/in/michellegatsi

articles, podcasts and networking.

I started with foundational knowledge through an online cybersecurity risk management course provided by Harvard University. I am now studying for my Security+ certification provided by CompTIA whilst building my work experience in technology consulting at EY. I consider it a privilege to be working beside incredibly intelligent cyber professionals every day. Prior to this, I spent a lot of time building relationships with a wide range of information security professionals and learning from their experiences. I would have done myself a great disservice had I chosen not to absorb the wisdom of the people around me. So do not be afraid to reach out to people – do so authentically and be willing and ready to learn.

Document your journey, and do not give up! The beauty of documenting your journey is that you can look back and see how far you have come. One day you will likely use your story to encourage the next wave of people wanting to start or transition into a career in cyber, and seeking an industry mentor just like you. This final tip is a bonus.

62

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

Want to get matched with Lead Gen experts but dont know where to start?

Our solution experts can help you find the right supplier, Looking to streamline your B2B lead generation process?

Want to use multiple suppliers but dont have time to coordinate?

Need a consistent stream of leads coming into the sales team?

Looking to tap into new markets?

Need end-to-end lead nurture programs?

LET US HELP YOU OVERCOME YOUR LEAD GEN CHALLENGES REACH OUT TODAY FOR AN INSTANT QUOTE. The team at Source2Create has all the necessary skills to get the job done for you, so your time can be reserved to focus on other things.

With:

aby@source2create.com.au charlie@source2create.com.au source2create.com.au

KAREN STEPHENS Karen is CEO and co-founder of BCyber, an agile, innovative group that works with SMEs to protect and grow their businesses by demystifying the technical and helping them to identify and address cybersecurity and governance risks. In 2021 Karen graduated from the Tech Ready Woman Academy’s Accelerator and the Cyber Leadership Institute’s CLP programs.

C O L U M N

Cybersecurity is not just about technology Cybersecurity is much more than a technology problem with only technology as its solution. We need to look at cybersecurity through a broader lens

• Each department had its own internal

without getting bogged down in the technical aspects

cybersecurity champion, creating a two-way

and ignoring the, critical, people component.

information sharing opportunity. If the non-IT rep can understand and communicate what IT is trying

Taking a human-centred approach to cybersecurity

to implement, they would be able to spread cyber

means emphasising the importance of all staff and

resilience throughout the business. As a bonus

their roles in ensuring cyber threats are mitigated.

you may even attract staff who would never have

As someone (relatively) new to the cybersecurity

thought of cybersecurity as a career but whose life

industry, it is my view EVERYONE in the business

skills can round out your IT team beautifully. Tech

plays a part in hardening cyber resilience.

skills can be taught, life skills not so much!

• Tech project teams included non-tech

A strong human line of cyber defence is a crucial

stakeholders as a business-as-usual activity. This

element of a successful cybersecurity strategy, and

is particularly helpful if you need to present to and

one which can often be overlooked. In this human line

get signoff from your executive leadership team

of defence, diversity is Queen (or King). Imagine how

and/or board. The addition of these stakeholders

much stronger your cyber resilience programs would

will help you understand business drivers and

be if:

values, allow you to deliver a plain English version of what may well be a highly technical project

• Your cyber awareness education program was regular, relevant and practical across the entire

presentation, and increase the likelihood of your business case getting approved.

business, with everyone from the boardroom to the mailroom taking an active part. Think of this

Using diversity of knowledge and experiences within a

as building a reinforced brick wall to secure your

business to harden cyber resilience. That is priceless.

entire business from external cyber threats. This would be a far better approach than having only some areas secure, which is what you get when you have an ad hoc, poorly-delivered program (i.e., a brick wall with holes).

• Cybersecurity was baked into every project from the ‘get-go’. For example, if HR wants to implement a new system, you make sure the steering committee has someone involved who understands cybersecurity and can provide a cybersecurity viewpoint.

64

W O M E N I N S E C U R I T Y M A G A Z I N E

www.linkedin.com/in/karen-stephens-bcyber

www.bcyber.com.au

karen@bcyber.com.au

twitter.com/bcyber2

youtube.bcyber.com.au/2mux

M AY • J U N E 2023

INDUSTRY PERSPECTIVES

SAI HONIG

DEATH BY A THOUSAND CUTS

by Sai Honig, Engagement Security Consultant at Amazon Web Services

I was having a discussion with a mixed group of

During my three-year term I served on almost every

people when someone brought up the topic of “death

committee. But after three years I had had enough.

by a thousand cuts.” They were referring not to “a

When my term ended, I felt like former New Zealand

form of torture and execution originating in Imperial

PM Jacinda Ardern. I had “no more left in the tank.”

China” or a Taylor Swift song about a breakup, but to

I did not seek re-election to serve another three years.

something that can, and has been, the cause of many women leaving high positions. It describes something

Of course, people were surprised, including the other

many women and minorities face in workplaces.

board members. What they did not see was the “death by a thousand cuts.” What they did not see were my

In this discussion I described my experience of

capabilities. What they did see was my endurance

being appointed to an international board, and

and commitment to do the work. However, I could

appointment I knew had created a special opportunity

no longer endure another three years of slights and

to showcase myself.

indifferences.

However, from the moment I arrived I could tell I

I did not get any appreciation from my fellow board

would have to prove I belonged. So, I quietly endured

members. I got not responses from them to a heart-

every sleight and ignored every mispronunciation of

felt email send prior to the end of my tenure. In the

my name (If you can say Daenrys Targaryan, you can

years since only one board member has reached out

learn to say my name!). Every time I was talked over

to me to ask me for something related to her work.

or not recognised, I stayed quiet. When I did reach out to ask politely to talk with individual board members, I

I share this experience because I know many women

was ignored. I even had one board member mock my

and minorities often “put up and shut up” to stay in

‘Americanness’ because I spoke multiple languages

a position that, over time, depletes them. In the end,

and lived outside the US. Each and every time, it felt

many of us have chosen the path of ‘silent quitting’

like a cut.

- doing the minimum requirements of the job and putting in no more time, effort or enthusiasm than is

Why did I stay silent? I wanted to show I belonged,

absolutely necessary.

that I had earned my seat at this table, that I was a ‘team player’.

66

W O M E N I N S E C U R I T Y M A G A Z I N E

This ‘silent quitting’ may mark women and minorities

M AY • J U N E 2023

I N D U S T R Y

P E R S P E C T I V E S

people of colour have been disproportionately

2. W OMEN LEADERS ARE OVERWORKED AND UNDER‑RECOGNISED.

affected by the recent wave of layoffs. It is estimated

• Women leaders are twice as likely as men leaders

for layoffs. Research suggests that women and

45 percent of those who lost their jobs in the recent wave of layoffs were women. Keep in mind, when the workforce is not split evenly between women and men, losing 45 percent of the women is a huge cut.

to spend substantial time on DEI work.

• Forty percent of women leaders say their DEI work is not acknowledged at all in performance reviews.

• Forty three percent of women leaders are burnt out, compared to only 31 percent of men at

It is even more challenging for women in high

their level.

positions. In its 2022 Women in the Workplace leaving their companies,” giving three key reasons for

3. W OMEN LEADERS WANT A BETTER WORK CULTURE.

these departures.

• Forty nine percent of women leaders say

report, Leanin.org stated “More women leaders are

flexibility is one of the top three things they

1. W OMEN LEADERS WANT TO ADVANCE, BUT FACE STRONGER HEADWINDS THAN MEN. • Women leaders are twice as likely as men leaders to be mistaken for someone more junior.

consider when deciding whether to join or stay with a company, compared to 34 percent of men leaders.

• Women leaders are more than 1.5 times as likely

• Thirty seven percent of women leaders have had a

as men at their level to have left a previous job

co-worker get credit for their idea, compared to 27

because they wanted to work for a company that

percent of men leaders.

was more committed to DEI.

I S S U E 14

WOMEN IN SECURITY MAGAZINE

67

It is even more difficult for women from minorities.

Diversity, equity and inclusion (DEI) goals are often

The same report found Black women leaders were

undermined by what is referred to as the ‘leaky

“more likely to be undermined at work.” They faced

bucket’ of retention: an organisation works hard

having someone imply they were not qualified (20

to attract and hire women and minorities but fails

percent) or being mistaken assessed as holding a

to keep them. Hiring a diverse workforce does not

lower level role (38 percent)). Even worse, was having

necessarily create an inclusive workplace.

their judgement questioned (55 percent)! These are listed as microaggressions. Each microaggression is

Most organisations are built from the top down.

a little cut. Cumulatively they can drive many women

However, creating an inclusive workplace requires

to simply leave – whether they be in high positions

a rethinking of the organisation from the inside

or low.

out. There are retention techniques (see table 1).

Implementing them will take work and time. With

I was asked recently to consider applying for a high-

resources stretched, companies are cutting back their

sounding position. I say high-sounding because the

efforts in this area.

position was not high in the organisation’s structure and its holder would have no say or control over

However, lessening these efforts, even during trying

budget, staffing or tooling. I was also asked if there

times, is not the best approach. Here are five reasons

were other women who might consider it. I said no,

not to cut DEI efforts, even in a recession:

and gave those reasons. It is not sufficient to have a high-sounding title. There needs to be significant

1.

DEI can strengthen a company’s ability to weather a declining economy.

support behind it.

2.

DEI is integral to core values and brands.

Many of these ‘thousand cuts’ are small and almost

3.

DEI initiatives are built over time.

invisible. That is the problem. When women raise

4.

Other cost-cutting options are more effective.

issues with their leaders, how are they treated? Most

5.

Even in a recession, investing in people and

often, they are brushed aside with comments such as

workplace culture is essential.

“you are too sensitive/emotional” or “it’s not really that big a deal.” So, they start suffering in silence.

Finally, I would like to say the responsibility for creating an inclusive workplace should not be put

I had one such position where my manager would

solely on the shoulders of women and minorities. Yes,

brush off my concerns. So I suffered in silence as

we should be asked about how our workplace can be

the microaggressions grew. I did the bare minimum

made better. Yes, we can be involved in these efforts.

required of me, all the while looking for another

When we are, we should also be acknowledged for it.

position. When I left, I had an exit interview with

This is not something we should be expected to do “in

HR. The HR rep listened to me and then asked why

our spare time.”

I did not share my issues with my manager. I told the HR rep I had done so and provided details of the

So, when you ask a woman or a member of a

responses from that manager. I also pointed out that

minority to consider a high-level role, ask whether

other women had left the group following similar

the organisation will be able to appropriately support

experiences. Eventually, that manager was removed

that person. Because at the end of the day you do

but the damage had already been done.

not want that person to walk away and warn others against applying for a role at your company.

So, what are the options? Many women find solace in external networks. These can be places to vent the pain and the anger. But this does not solve the

www.linkedin.com/in/saihonig

organisation’s problem.

68

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

Connecting - Supporting - Inspiring

AS A FORMAL NETWORK MEMBER, YOUR CONTRIBUTION ENABLES US TO BUILD A STRONGER FUTURE

With an affordable annual fee, AWSN members will have access to discounts on programs and industry events, the membership Slack space, post or share job opportunities, and receive our monthly and any special edition newsletters.

Memberships are now a 12-month cycle Corporate packages available Learn more at www.awsn.org.au/members/join/

VANNESSA MCCAMLEY

SEVEN METHODS TO USE DIVERSITY AND INCLUSION TO FUEL INNOVATION

by Vannessa McCamley, Leadership and Performance Consultant, Coach, Facilitator, Author and Keynote Speaker

In my experience of collaboration within many

experienced colleagues working together with a

organisations, diversity of all types produces

common purpose or desired outcome identified.

improved solutions to the most complex problems.

The most pressing issues are solved in inclusive

2.

Hold regular “think tank sessions” to promote

settings with a diversity of viewpoints where team

proactive teamwork and create opportunities

members can participate based on their preferences

for connections to be forged between various

as to where they do their best thinking.

business, IT and IT security teams that will produce better cross-pollination of perspectives

When confronted with challenges and problems

and more expansive ideas. These sessions could

we need to support the emergence of ideas and

be online brainstorming sessions lasting 60-90

innovative solutions by fostering an inclusive culture

minutes with a variety of co-workers to identify

that promotes diversity of thought.

issues and solution options that may need further exploration in a separate session.

Here are seven strategies to foster an inclusive environment where innovation can flourish.

3.

Provide a diverse range of innovation events for your team in which they can explore new ideas,

1.

Encourage teamwork - sometimes it is more

connections and technology, keep abreast of

difficult to present a proposal on your own, and

what is happening and identify options for now

less senior colleagues might be discouraged

and the future.

from doing so if they do not have the backing of a team. Safety for the mind is important, and comes from having a mix of newer and more

70

W O M E N I N S E C U R I T Y M A G A Z I N E

4.

Permit the submission of ideas anonymously.

Anonymity can also remove any barriers of

M AY • J U N E 2023

I N D U S T R Y

P E R S P E C T I V E S

judgement and any concern submitters might otherwise have of appearing stupid. Anonymity also encourages submissions with a broader range of ideas.

5.

Leverage external coaches and/or facilitators who can assist teams to express their ideas.

Writing or presenting an idea is not everyone’s day job, and it can be particularly difficult for early career employees and non-native English speakers. Colleagues can learn from a coach how to create a well-formed idea proposal and the best way to communicate it.

6.

Seek a diverse group of reviewers to assess ideas against success criteria. This makes sure the advantages and disadvantages of each idea are considered from multiple angles. off. Their increased engagement increases the

7.

Provide time for people to think about a topic

range of strategic options and produces better

or issue and the desired outcome. Provide a

business solutions.

detailed brief on the context of what you want to achieve and the background to the problem, including the history of where it came from.

ABOUT VANNESSA MCCAMLEY

Provide at least 72 hours’ notice to give team

Vannessa McCamley is a leadership and

members the opportunity to think at the time

performance expert specialising in neuroscience

and in the place they do their best thinking: AM,

practices that help individuals, teams and

PM, evening or whilst doing something such as

businesses grow in meaningful ways whilst

walking the dog, exercising, hanging the washing

delivering measurable results in healthy ways.

or having a shower. Research shows some of

She has a passion for helping people and

the most innovative ideas emerge outside of

businesses to overcome obstacles and enabling

work hours.

them to reach their strategic goals. She brings a strong background in IT security and more than

There are other ways in which team members

20 years of business experience to collaborating

can participate even if producing innovative ideas

with individuals at all levels and from several

is not their core strength. One is by voting on the

industries. She is the author of Rewire for

suggestions made by other people. Voting gives team

Success, an easy guide to using neuroscience to

members a say in which ideas the business pursues,

improve choices for work, life and wellbeing.

and encourages team engagement and involvement.

By voting on multiple ideas, team members can express views based on their experiences and their requirements. The outcomes can be unexpected,

linksuccess.com.au/rewire-for-success

insightful and powerful.

www.linkedin.com/in/vannessa-mccamley

Making sure all team members feel welcome

linksuccess.com.au/contact-us

to contribute their ideas for innovation pays

I S S U E 14

WOMEN IN SECURITY MAGAZINE

71

MATT TETT

BUILDING A CULTURE OF INTEGRITY: HOW WE CAN IMPROVE OUR INDUSTRY FROM WITHIN

by Matt Tett, Founder of Day of the Month club

Warning: This article discusses a difficult subject.

Many of our professional certifications and industry

It seeks to start a dialogue that will foster positive

bodies mandate adherence to codes of conduct.

change in our industry, address bad behaviour and

However, there are still individuals and organisations

build a better future.

that fail to maintain good standing, either deliberately or inadvertently. Their actions continue unabated,

I had the honour of attending a breakfast gathering

seemingly swept under the carpet as if they are taboo

at Melbourne Zoo hosted by Source2Create to celebrate International Women’s Day. The panel included women close to our industry, but not from our industry, who echoed sentiments we have heard over the years. During the Q&A I felt compelled to raise a question that has troubled me and many of my colleagues for years, a question that seems unanswerable but needs to be addressed: how, without fear of retaliation, can we hold individuals and organisations accountable for maintaining good standing in our industry?

72

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

I N D U S T R Y

P E R S P E C T I V E S

and cannot be discussed. We need to collectively address this issue to improve our industry’s overall reputation.

Calling out bad behaviour can be counterproductive, and often provokes retaliation. Those speaking out against employers, seniors or leaders can suffer employment termination, contract cancellation or other retaliatory action. We have all heard the term “career-limiting move.” Many suffer in silence, and the longer a problem persists, the more frustrated they become, especially when multiple sources independently confirm repeat behaviour by certain

dotm.com.au/

individuals or organisations.

It is possible some workplaces and individuals may

Join Today for FREE

be unaware of their culture or actions, and in such cases we can proactively take steps to address the problem. But how can we raise issues, make individuals and organisations aware of their actions and achieve positive change without creating conflict?

To NETWORK with other like-minded people

We can do so by seeking a better understanding of their position and perspective and fostering a positive and collaborative culture for the betterment of our industry.

In conclusion, for our industry to grow and mature,

To MEET prospective candidates for graduate programs

we need to learn how to hold individuals and organisations accountable for actions detrimental to their good standing in our industry, without fearing retaliation. We must proactively address toxic cultures and seek positive change without creating conflict while being sensitive to those who may not be aware

To MEET prospective employers of graduate programs

of their culture or actions. It is time to work together and create a better industry for everyone. www.linkedin.com/in/mtett

www.dotm.com.au

I S S U E 14

The club is for security professionals (present, future and past)

WOMEN IN SECURITY MAGAZINE

73

SIMON CARABETTA

HOW ITALIAN FOOTBALL CAN INFLUENCE AUSTRALIAN CYBERSECURITY STRATEGY

by Simon Carabetta, Project Coordinator at ES2 Catenaccio, which means ‘door-bolt’ in Italian, is also

approach across our state agencies, but not so

the name for a highly coordinated defensive style of

comforting for those having to quickly identify their

Association Football (soccer to some of you) made

security gaps and then implement a wide range of

famous by the successful Italian national team from

controls that will impact hundreds, and in some cases

the 1950s onwards. For those unfamiliar with the

thousands, of staff.

game and this style of play, Catenaccio focuses on denying opponents any opportunities for goal-

There is another way Association Football, and many

scoring and any clear chances to even take a kick

other sports played at an international level, can

at goal. Catenaccio is lambasted by many for its

inform how we as a country can strategize better

lack of entertainment appeal and seemingly boring

when it comes to cybersecurity: by establishing a

style of play. However, played right and against the

unified national approach.

right team, it is extremely effective, particularly if the team employing these tactics exploits counterattack

For football, netball, rugby and many other sports

opportunities. Catenaccio is also what you want for

played around the world, there is a national body

your organisation’s cybersecurity strategy.

which usually establishes a uniform approach to how the sport is managed at a grassroots level: the

74

A NATIONAL APPROACH

standards and regulations for play and, of course,

Comforting news for many in Western Australia is

the style in which national teams are coached and

that there are current mandates from our Office of

how they play. Take Rugby Union for example. Most

Digital Government stipulating that all departments

European and Northern Hemisphere squads play a

must have a minimum of Level One maturity across

style that allows for more kicking and drop goals,

the Australian Cyber Security Centre’s Essential Eight

whereas the Southern Hemisphere national teams

controls to mitigate cyber attacks. This is comforting

place emphasis on hard running and carrying the ball

for those of us in desperate need of a coordinated

for a try.

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

I N D U S T R Y

P E R S P E C T I V E S

Of course, this is an oversimplification. However,

Soccer Magazine (although I know we are all getting

it is useful to explain how a national approach to

fairly hyped up for the Matildas and the upcoming

cybersecurity is the one way we can unify the way

World Cup!

in which all commonwealth, state and territory, and even local, governments build their cybersecurity

FULL TIME

strategies. The Essential Eight is a good start, but

Unfortunately, we in the industry will never hear the

we do need to go further. Take information security

full-time whistle on cyber attacks. In fact, we are not

for instance. There is crossover with cybersecurity

even approaching half-time. The pitch is muddy, it is

in some areas, but not in others. We should aim for

raining and we are down 4-0. However, the good news

a national approach that will, to some extent, unify

is that Australia is heading in the right direction. We

information security practices across all government

are on the way to achieving some kind of national,

tiers in Australia. This is also why Australia’s new

unified approach and cybersecurity strategy. I hope

Cyber Security Coordinator needs to have the

the following can be included:

authority to advise on information security standards, not just cybersecurity.

• Funding to implement the full 37 controls of the Essential Eight across all tiers of government.

While many people are still talking about the devastating data breaches at Optus, Medibank, and now Latitude, the cynics in the room suddenly become World Championship Wrestling wrestler, Bill Goldberg and boldly ask, “Who’s next?” Australia needs a coordinated and unified national approach to

• A uniform approach to how cyber incidents are communicated.

• Standards and regulations around reporting cyber incidents, particularly in industries providing critical infrastructure.

• Standards and regulations

both cyber and information security, and it needs that

specifying how

approach to be Catenaccio.

cybersecurity awareness training is deployed.

THE NITTY GRITTY

• Nation-wide curriculum

Let’s now look at the various players on the football

integration of cyber and

field and assign each of them a place in cybersecurity

information security skills

control. What makes Catenaccio so effective is the

across learning areas (not

extra layer of defence it creates, even though it keeps

stand-alone cybersecurity

more players in their half of the pitch during attack.

education: our teachers are

This means a team playing Catenaccio style has more

already exhausted).

players in its half of the pitch when the other team is attacking, providing an extra layer of defence –

This is the wish list. While I do hope all organisations,

multifactor authentication, if you will. Then there are the

government and non-government, can employ

wing backs: versatile, fast, excellent ball-handlers. These

the style of Catenaccio I also believe it will not be

are players who can be deployed at various spots on the

sufficient without the above wish list. I could discuss

pitch, changing the player configuration. They are the

each item in detail, but I will leave that for another

user application hardeners – changing configurations

article at another time. Until then, think of your own

to block malicious executables on devices.

organisation’s cybersecurity strategy and where Catenaccio and the great (well, in this writer’s eyes,

Anyway, I think you get the picture here. I could go on

anyway) Italian Football team can inform you of

and list all 11 players in a team, but then this article

where that strategy should be headed. Until then, ciao.

would become football coaching 101, and although I had two seasons (un)successfully coaching the Belmont Under 16s (one win in 20 games) I feel I

www.linkedin.com/in/simoncarabetta

would be underqualified. Also, this is not Women in

I S S U E 14

WOMEN IN SECURITY MAGAZINE

75

MEGAN KOUFOS

AUSTRALIAN WOMEN IN SECURITY NETWORK 2023 PROGRAMS OVERVIEW

by Megan Koufos, AWSN Head of Programs

The Australian Women in Security Network (AWSN)

The network recognised that we must focus on

was founded in 2014 as an open network of people

initiatives to help retain and support women working

aiming to grow the number of women in the security

in this industry, and we remain committed to the

community in Australia.

goal of retention and advancing women in security across Australia.

Since its humble beginnings as a private LinkedIn group the network has expanded and has continued

We continue to learn, improve and grow. We now

to inspire, support and connect women in the

know that according to the Gender Dimensions of

industry. The network supports those looking to

the Australian Cyber Security Sector Report, where

enter the field by giving them the tools, knowledge,

analysis of 2021 Census data indicated that women

networks and platforms needed to upskill and by

only represented 17 per cent of the cyber security. Our

connecting them with peer support groups having

future plan is to establish new programs dedicated

similar interests.

to increasing the pipeline of women in security. We will focus on students and professionals interested in

The introduction of our formal programs in 2021 was

learning or upskilling as well as supporting emerging

the brainchild of AWSN founder and executive director

and established leaders advancing their careers.

Jacqui Loustau. The Security Pathways Program

76

was initially designed to help address the predicted*

WHAT MAKES OUR PROGRAMS DIFFERENT?

18,000 shortage of staff in the cybersecurity sector

In addition to small cohorts and high touch programs,

by attracting, retaining and developing women. The

our programs differ from others in the peer support

focus was to support women entering security and

and network connections our participants and

those already in the industry.

members receive through:

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

I N D U S T R Y

P E R S P E C T I V E S

THE WOMEN IN SECURITY MENTORING PROGRAM

from Security Pathways participants to Women in

AWSN, in partnership with the Australian Signals

feedback over the past year.

Leadership program participants after receiving

Directorate and Australian start-up OK RDY, has developed Australia’s first mentoring program with an

2023 PROGRAMS OVERVIEW

associated app-based platform for women in security.

With sponsorship from the Australian Signals

The program offers training resources, networking

Directorate we are introducing a wider range of

and ongoing support for the mentoring journey.

programs to support the community this year. Based on continual feedback from our community we have

The app uses AI technology to foster deeper, more

made a few changes.

successful mentoring connections by suggesting mentors and matching these with mentees based on

Our Security Pathways stream is separated into

their values, interests and experience.

foundational courses and those which dive deeper into our popular specialised areas.

Since its official launch in October 2022 the program has grown to have 250 mentors and mentees

Likewise our Women in Leadership programs are now

interacting daily. 2023 will see the introduction of

grouped into programs for emerging leaders with two

further enhancements to support the user experience

to three years’ experience in security and programs

and provide exclusive access to new mentoring

for established leaders with more than five years

videos designed to support the mentoring journey.

in security.

These self-paced learning videos will cover topics such as: • Reciprocity • Building Trust

SECURITY PATHWAYS PROGRAMS Security Pathways

• Meaningful Mentoring • Getting Started • Building Confidence, and more!

CHAPTER EVENTS

Introduction to Cyber Security Essentials

OSINT Foundation

Cyber Security Toolkit

CompTIA Security+

Regular events organised and run by our team of chapter leads provide opportunities for members to connect with and learn from peers and other members of the AWSN community.

SLACK GROUP Each program cohort has its own dedicated private group to enable its members to communicate before, during and after program completion to share ideas

We have created a security career ‘sandbox’ where

and wins and to receive support.

women can learn and practice their skills in an inclusive space. This helps them find their areas of

CV & CAREER SESSIONS

interest and build on their current knowledge of the

Participants receive career advice and CV guidance

different areas of security. This helps ensure their

from industry experts through group sessions to

future security training investments are directed to

assist them with job readiness and support leadership

the areas of security that most interest them and to

aspirations, with the option of additional one-on-

which they are best suited.

one guidance. We have expanded this offering

I S S U E 14

WOMEN IN SECURITY MAGAZINE

77

Introduction to Cybersecurity Essentials - We are

Emerging Leaders (2+ years)

continuing with our most popular security pathways

Women in Leadership Programs

program and will admit two cohorts to the program this year. It provides insight into the different areas of security in a comfortable environment where participants can learn, ask questions and practice their skills.

Emerging Leaders Program

Powerful Presenter Program

Business Communications

CISM

OSINT Foundations Course - This course shows how to investigate people, places and things in the online environment. Participants learn key concepts and skills in open-source intelligence (OSINT) including efficient searching, data reduction and verification.

Creating Your Cyber Security Toolkit^ - We have received much feedback from our community members indicating their wish to be able to set

Emerging Leaders Program – We have made

up a security lab at home for their own learning

some changes to this program for 2023 based on

and experience. This hands-on training supports

participant feedback. These include spreading out the

participants to set up their own virtual machines

sessions to fortnightly, adding an additional one-on-

and gives them a basic understanding of Linux and

one coaching session and four learning lab sessions

PowerShell commands and the functionality of a

and integrating the learnings from the program. The

number of useful cybersecurity tools.

first cohort is already undertaking the program and we are now accepting applications for the second cohort.

CompTIA Security+ Training^ - This is an intensive, instructor-led program designed to prepare

Powerful Presenter Program – Our program to help

participants for the CompTIA Security+ exam. We

participants learn the art of impactful presenting is

wanted to make some certification training available

back for 2023. Because of limited trainer availability

at a subsidised price for our members.

we can cater for only one cohort this year. We will be offering the program to additional cohorts in the early

SPECIALISED INCIDENT RESPONSE PROGRAMS

part of 2024.

Based on the popularity and feedback of the 2022

Business Communications 1^ - This is one of our

training, we are bringing the Incident Response

new programs for 2023 for emerging leaders. It helps

training exercise to Hobart, Brisbane, Sydney and

a broad range of cybersecurity professionals break

Newcastle for 2023. We will also be running the

existing habits and enables them to produce more

Incident Response Competition in the second half of

impactful written business communications. There is

the year.

a big difference between writing reports for university courses and for corporate audiences. This program

WOMEN IN LEADERSHIP PROGRAMS

equips participants with the skills to produce effective

We are offering the following programs this year for

email communications and high-quality, informative

emerging leaders with two to three years’ experience

reports and business communications. These are

in security.

critical skills needed to persuade a board that it needs to invest in stronger controls to mitigate key risks, or to inform major stakeholders on the impact of recent incidents. This program is a prerequisite to part two, which will be offered in 2024.

78

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

I N D U S T R Y

P E R S P E C T I V E S

CISM Training^ - This is an intensive, instructor-led

we want to support founders in our community. This

program designed to prepare professionals for the

bootcamp provides the starting point for anyone

Certified Information Security Manager (CISM) exam.

curious about exploring their start-up idea. This first

The ISACA CISM is an industry recognised certification

training will be held in Melbourne. EoIs for other

which will help participants learn better methods to

states are being accepted.

manage large security programs and teams.

All Women in Leadership participants receive access These are the programs we are providing this year

to the Leadership Forums. These forums are held

for established leaders with more than five years’

three times per year. They provide a platform and

experience in security.

inclusive space for all women in the program to come together and discuss common issues, support each

Established Leader (5+ years)

other, share ideas and learnings, ask questions, be

Women in Leadership Programs

inspired and share stories. This year we will also be inviting past participants to present at the forums to support participants as they advance in their

Aspiring CISO Masterclass

Cyber Resilience for Executives

leadership roles.

PROJECT FRIEDMAN Project Friedman will run again this year as a partnership between WomenSpeakCyber and AWSN.

Secure Your Board Leadership Masterclass

Bootcamp for Aspiring Cyber Founders

It supports women wanting to speak publicly at events and conferences.

WANT TO BE A PART OF THE ACTION? Although most of these programs are already oversubscribed, please complete an EoI so we can assess the level of interest in future training programs.

Aspiring CISO Masterclass – This is returning for another year We have added an addition session

In addition to these subsidised programs we are

to further support participants and we will run

planning to offer further programs to our members.

the program for two cohorts this year to keep the

As an AWSN member you will have access to these

numbers small and allow for more interaction

subsidised programs and access to a diverse,

between participants and our coach. This masterclass

Australia-wide network of professionals in all areas of

helps participants understand what skills and

security and at different stages of their careers.

knowledge are required to be a CISO so they can work towards this goal.

All program details including subsidised costs, dates, times and training partner details are available on our

Secure Your Board Leadership Masterclass^

website here.

- Board Communication has been added to our programs this year based on feedback from many

If you are yet to become a member of AWSN –

members desiring to move into higher leadership

you can join here.

and C-suite positions. This program teaches how to effectively communicate with a board. It will be

*AustCyber Sector Competitiveness Plan 2020

offered twice in 2023.

^New Program for 2023

Bootcamp for Aspiring Cyber Founders^- Being a founder is a role very different from any other and

I S S U E 14

www.linkedin.com/in/megankoufos

WOMEN IN SECURITY MAGAZINE

79

GINGER SPITZER

DIVERSITY IS NOT ONLY AN ETHICAL ESSENTIAL: YOUR BOTTOM LINE DEPENDS ON IT

by Ginger Spitzer, Executive Director, ISACA One In Tech Inclusive workplace cultures foster a more diverse workforce It is increasingly apparent a global cybersecurity

ENABLING CAREER PIVOTS

skills shortage persists, and we do not have

Empowering and resourcing individuals to move

sufficient talent to fill the rapidly increasing number

into cyber careers requires a collective effort that,

of available positions. ISACA’s survey report, State

fortunately, is becoming more common. Necessity

of Cybersecurity 2022: Global Update on Workforce

has, thankfully, allowed organisations to ‘look

Efforts, Resources and Cyberoperations, showed 63

outside the box’ for talent, and a wonderful aspect

percent of organisations having unfilled cybersecurity

of cybersecurity is that individuals with certain

positions, an increase on the previous year.

attributes, regardless of the sector they currently work

Furthermore, 82 percent of respondents predicted

in, may be suited to a career in cybersecurity.

demand for technical cybersecurity roles, and for cybersecurity management roles in particular, would

We have seen many excellent cybersecurity

increase in 2023.

professionals pivot from other sectors including health, law enforcement, military, other IT-adjacent fields, or

While the skills shortage is a significant challenge that

studying seemingly unrelated subject in the humanities

places organisations in vulnerable security positions,

such as World Language, Literature, or History.

we must also see the hiring blitz as an opportunity to increase diversity in the sector. A more diverse

Over the past few years there has been an increase

workforce is more innovative and more productive,

in partnerships between non-profits, professional

and these attributes have a positive effect on an

organisations, academic institutes, corporations,

organisation’s bottom line.

foundations and governments to address the skills shortage and build the cybersecurity workforce.

80

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

I N D U S T R Y

P E R S P E C T I V E S

This is a positive step, because it will take a collective

also be prioritised because the two go hand-in-hand.

of partners to train and resource untapped talent

Organisations can find retaining a diverse workforce

and to ensure individuals have strong pathways and

challenging if inclusion is not part of the culture or

placement opportunities.

DNA of the company.

Interestingly, ISACA’s State of Cybersecurity 2022

One in Tech is successfully removing barriers to

report indicated the greatest skills shortage in

ensure all individuals receive equitable access to

cybersecurity (54 percent) to be in soft skills:

begin and advance their careers in cybersecurity.

communication, flexibility and leadership.

SUPPORTING THE CHANGE-MAKERS Specifically, ISACA highlighted the top five soft

Employers are the key to increased diversity. While

skills needed as being communication-listening and

mentoring, training programs, resources and all types

speaking skills (57 percent); critical thinking (56

of support offered to under-represented populations

percent); problem-solving (49 percent); teamwork-

are valuable, focusing on those who are excluded puts

collaboration and cooperation (44 percent); attention

the onus on them to change the status. However, the

to detail (38 percent).

only way to truly change is to ensure corporations understand the critical need for diversity not only as an

Many women naturally bring these attributes to the

ethical issue but as a business case. Diverse employee

table and find the transition to cybersecurity more

teams are far more innovative and productive, and

seamless than often anticipated, because they are

company profits increase with increased diversity.

capable in these life skills.

As Esanju Maseka, an audit professional who

BUILDING DIVERSITY

assesses governance over cybersecurity controls, and

Years of individuals being excluded because of bias

a member of the ISACA Emerging Trends Working

and other factors have created a tech workforce with

Group based in Melbourne, says: “Cyber teams have

very little diversity, and the exclusion of various cohorts

a broader perspective of vulnerability scenarios to

negatively affects technology development, because

consider as they plan defence tactics or strategies.

it is necessary to have multiple perspectives (gender,

Diversity allows for different skillsets to be brought

cultural, ability, age, etc.) driving technology innovation

to the table. It prevents omission errors in detection

to ensure the outcomes are applicable to all users.

or protection software because attributes of a larger pool of individuals can be included.”

There are many non-profits and other organisations dedicated to building diversity as well as inclusion in

The ISACA State of Cybersecurity survey also found

the cybersecurity workforce. This includes well-known

30 percent of security professionals surveyed leaving

organisations such as Women in Cybersecurity (WiCyS),

their job because of poor workplace culture and

the International Consortium of Minority Cybersecurity

environment, and eight percent leaving because of a

Professionals (now Cyversity), the International

lack of workplace diversity.

Organization of Black Security Executives; Women in Security and Privacy; Minorities in Cybersecurity; and

These are significant numbers that must be

many other country-specific organisations including

addressed by company-wide decision-making and a

the Australian Women in Security Network.

change in culture.

ISACA Foundation One In Tech was launched three years ago to promote diversity through scholarships, programs, events and community. While many corporations provide resources to build diversity

www.linkedin.com/in/vspitzer

www.linkedin.com/in/esanju-maseka-2b022852

internally, which is a positive step, inclusion must

I S S U E 14

WOMEN IN SECURITY MAGAZINE

81

ARE YOUNG, INNOVATIVE STARTUPS AUTOMATICALLY MORE DIVERSE?

by David Braue

Not necessarily – because culture must be deliberate no matter how small you are

I

nnovation is the lifeblood of startup businesses,

“It’s very hard for females to get into,” she told the

whose ambitious and often young founders grew

recent VFF FinTech Forum. “One of the important

up in a climate that prioritises diversity much more

things is to give [opportunities to] new VCs or young

than in the past. But does that mean startups’

VCs with less of a track record. Waiting for the VCs

progressive culture of innovation automatically

themselves to embrace diversity is going to take a

translates into diverse, innovative workplaces?

long time.”

Not necessarily. People are people, after all, and

Statistics confirm that the startup community,

cultural issues can be as difficult to overcome

for all its potential to rebalance gender diversity,

for growth-focused startup founders – who must

still has a ways to go on diversity measures: two-

navigate a range of corporate cultures as they try to

thirds of startups have fewer than 20 per cent

win over early-stage investors – as they are in more

women in leadership roles, according to InnoVen

established organisations.

Capital’s recent Startup Outlook Report 2023, which found the remainder have fewer than 10 per cent

“The system is basically stacked against you,”

women leadership.

says Inez Murray, New York City-based CEO of the

82

Financial Alliance for Women, a fierce advocate for

Whether they’re operating in finance, cybersecurity, IT

diversity who has watched women fight to establish

or other domains, the culture established during those

themselves in the early-stage investor “boys’ club”.

early days will set the tone for startups in the long

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

F E A T U R E

run – so if women are already struggling to normalise diversity at the get-go, how can they possibly hope to carry diversity into their operational space?

One of the most important aspects to normalising an innovative, diverse startup culture is in setting the terms of that culture early on, notes Myrtle Dawes, a board member of the Scotland-based Technology Leadership Board and solution centre director with Scottish envirotech firm Net Zero Technology Centre.

“The issue really is around expectations,” she notes.

“You can’t have a situation where society is quite unfair, and then you walk into the workplace and all of a sudden everything is different. That isn’t realistic – and I think the reason some of these [initiatives] get lip service is because we expect companies to look different from the general society.”

That can pose issues in large companies where diversity,

Entrepreneurship – who notes growing demand

equity and inclusion (DEI)

for diversity training has rapidly expanded the

programs often get dropped

organisation’s scope across all manner of other

onto the desk of employees

industry sectors.

who treat them less as a personal mission and more as

“People in technology, and people that are

just another KPI they have to

entrepreneurs and marketers, have very, very unique

meet.

diversity in terms of people,” Nguyen explains. “We are training them so that they can quickly and efficiently

“We have to address the

join this new world of finance and tech startups…

societal issues, and not just

we’re upskilling pretty much everyone.”

put it on a few people who actually have hardly any

OVERCOMING STRUCTURAL OBSTACLES

overlap with us,” Dawes said.

By introducing diverse training and operational

“All companies should have

modes early on, startups can set clear expectations

these expectations about the

around expected behaviours and cultural perceptions

composition and inclusion of

of diversity.

their teams. Diversity really does breed diversity.”

Yet many companies continue to align their internal structure in ways that work counter to the goals of

I S S U E 14

The benefits of a diverse

diversity, points out Janelle Santa Maria, CEO of

culture can be amplified within

Benevity, who told a recent IWD panel that many

small organisations, notes

companies implement diversity, equity and inclusion

Tram Anh Nguyen, co-founder

(DEI) initiatives as an HR function while corporate

of the UK-based Centre for

social responsibility (CSR) ends up as a corporate

Finance, Technology and

communications or marketing issue.

WOMEN IN SECURITY MAGAZINE

83

important in companies of any size, she

NURTURING INNOVATION THROUGH DIVERSITY

said, because they address employees’

Working in a startup or small business

desire to work at a company that shares

often feeds a sense of community and

their personal values.

common purpose that can be harder to find

Co-ordinating the activities of the two is

in larger companies – and with employees “Employees want to know that the

happier and more innovative, it’s a good

company they work for lives and aligns to

idea for startup founders to put extra effort

their purpose, values, lives, and passions,”

into that part of their company culture.

Santa Maria explained, citing company involvement in areas such as community

“What’s really been most inspiring, from

groups, employee giving as a great

what we’ve seen so far, is the community

example of the way these various goals

that has been built between the founders

can be brought together.

themselves,” Kate Wendt, vice president of strategy, transformation, and sustainability

“Working for a company, and being part of

with REI Group, which in 2021 established

an employee resource group that allows

a Path Ahead Ventures Fund and hopes to

[employees] to give back to the community

support 300 founders of colour by 2030.

from a CSR standpoint is a great brand story for any company,” she explained.

“They go through as a cohort together,” she said during a recent CES 2023 panel

It can also be particularly beneficial for

discussion, “and I think they’re getting

startups, whose relatively limited resources

as much inspiration and guidance and

may see them struggling to match larger

support from each other, and how that can

competitors on a perk-by-perk basis – but

amplify their efforts, as they are from our

who can compensate by normalising

supporting them in the program.”

innovative staff attraction and retention benefits like flexible work, generous parental leave, and so on.

Many women are put off by perceptions that startups aren’t welcome spaces for them, according to recent research

“There doesn’t have to be that tension or fighting for

that found “women, but not men, are sensitive to

budget,” Santa Maria said. “They really can serve to

information about organizational gender composition,

complement one another, and to drive the goals that

especially for startups signaling diversity debt” – and

each of those particular areas or teams has, in a very

warned that startups which don’t hire women in their

strategic way.”

early days typically struggle to attract them later on.

“It doesn’t need to be as blatant as having a formal

If innovation and community aren’t maintained, it’s

DEI program; just think of inclusion and what it

easy for companies to feel isolated, noted Jacqui

means in terms of your policies, procedures, and

Loustau, founder and CEO of the Australian Women in

practices – and how you are casting as wide a net as

Security Network (AWSN) during an IWD fireside chat

possible to involve all of your employees and to really

with RMIT University leadership academic Dr Lena

be inclusive.”

Wang, who is co-director of that institution’s Centre for People, Organisation, and Work.

84

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

F E A T U R E

“That’s one thing that has been really great as an organic kind of community that we’ve really tried to build,” said Loustau, who has worked with her team “to make sure that everyone is on the same philosophy of trying to help others and to be inclusive of all types of people.”

The organisation recently overhauled its Cadet program, renaming it as the Explorer Program in recognition of its stronger focus on inclusion as a harbinger of more effective innovation.

“We wanted to provide a space where they could ask questions without feeling like they were being judged,” Loustau said. “It is so powerful when leaders start to recognise [unconscious bias] and then actively do things to change that.”

“We all have a responsibility in this for this whole new generation of cybersecurity and security professionals. From government to leaders to industry associations, to educational institutions – all of us can play a part in this to really change things.”

Wang agreed: “we don’t expect leaders to get every single policy right,” she said, “but if we actually take the collective wisdom of our employees, it just allows them the opportunity to voice if something isn’t working for them.”

Whether in large businesses or small, innovative startups, “we can collectively create a culture where people feel safe to say ‘I need to go pick up my kids’.” Wang continued.

“Just simply asking and being supportive as a leader, is often the most powerful thing.”

I S S U E 14

WOMEN IN SECURITY MAGAZINE

85

CYBERMINDZ: MINDING CYBER PROFESSIONALS’ MENTAL HEALTH

by Stuart Corner

Peter Coroneos, founder of Cybermindz, a charity dedicated to the mental health of cybersecurity professionals, has been fascinated by the human brain since childhood. He was only 10 years old when a neuroscientist uncle took Coroneos into a laboratory and showed him pickled brains in jars.

T

hat interest has been channelled into a

in particular, the ability to maintain a sense of

life-long focus on his own mental health

equilibrium, even in very trying circumstances.

— he has been practicing meditation for 45 years — and he turned his attention to

“These are skills I’ve applied in my own professional

the mental health of others in 2013 when

career, but under the radar. When I left the IIA, I

he founded Serenityworks, a couple of years after

realised this was something I could share. The game

stepping down after a 13 year stint as CEO of the

changer was really research around neuroplasticity,

Australian Internet Industry Association (IIA).

which started coming around about 2007 when the first papers were being published.”

“I was thinking about what I might do,” he told Women in Security Magazine. “And I started to see some

Serenityworks offers a range of mentoring, stress

scientific reports come out around the neurological

reduction and meditation programs to individuals

changes that occur in long term meditators: improved

and teams in any industry, and from that came

immunity, better emotional balance — things

Cybermindz, founded in 2022.

that I knew, subjectively, were true for me, — and,

86

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

F E A T U R E

“I was doing some work in cyber through

its operations. “That’s a big one and the counterpoint

Serenityworks. But I felt there would be benefit

is the high visibility of a single failure. You can have

in setting up a not-for-profit specifically for

10,000 successes and no one will notice, but if you

cybersecurity, because I wanted to give recognition to

have one failure, it can make front page headlines.”

the criticality of those roles. And I felt that Cybermindz could give the issues much more focus than coming

iREST PROTOCOL IS THE FOUNDATION

out of a more generic offering,” Coroneos tells WSM.

At the heart of Cybermindz services is the iRest Protocol, described as “a contemporary form of

“When I started Serenityworks cybersecurity was

meditative self-inquiry that has been adapted

there in the background, bubbling away. But in recent

from the ancient practice of Yoga Nidra into a 10

years, it’s got more prevalent and more serious in

step framework which is simple to learn and easy

its effects. So I wanted to really bring home the

to practice.”

message to all of society that this is something that affects everybody, directly or indirectly. By being a

It is managed and promoted globally by the US based

not-for-profit, we’re hoping to get some federal grant

iRest Institute. It has been endorsed, and is widely

funding or state grant funding. That’s easier if you’re a

used, by the US military, in programs for veterans in

not‑for‑profit.”

more than 50 military hospitals and bases across the US. The Australian military has also been using it

The cybersecurity industry, Coroneos argues, is

since 2016.

unique in the mental health stresses it imposes on participants. “We’ve identified at least 15 factors that

The iRest Protocol was developed by Dr Richard

come to bear on cybersecurity professionals. I don’t

Miller, “a spiritual teacher, author, yogic scholar,

see any other profession, having all those 15 factors

researcher and clinical psychologist, who combined

bearing on them.”

traditional yogic practice with Western psychology and neuroscience,” according to the iRest Institute.

One of the most significant factors, he says, is that success is invisible: cybersecurity is successful when

“The US army surgeon general’s office has endorsed

an organisation experiences no attacks that impact

the iRest program because they’ve shown it can start

I S S U E 14

WOMEN IN SECURITY MAGAZINE

87

to reverse PTSD in a month, and PTSD is something that can hang around for decades,” Coroneos says. “it’s a process of really deep relaxation and resetting. But it’s also a process of selfenquiry, where you start to enquire into your beliefs and the narrative that you’re running in your own head, around what you’re doing in life. That can be personal as well as professional.

But it only works if you’re in a hyper-relaxed state. … It’s not an intellectual exercise. It’s actually somatic. It’s grounded in the physical sensation because you’re holding it almost energetically. … By going into this hyper-relaxed state you are able to observe them with a degree of detachment and dispassion, then you can start to inquire, ‘is this still true?’”

IRest facilitators are trained and accredited by the iRest Institute and iRest training has been offered in Australia since 2013 by the iRest Institute Australasia.

Coroneos says there are 400 iRest facilitators in Australia, and 7000 worldwide.

“I’ve created an induction course for iRest facilitators Cybermindz has partnered with the iRest Institute and

who want to deliver iRest training on our behalf. It

this partnership is the foundation of the Cybermindz

brings them into the frame of cybersecurity, maybe

offering. Coroneos says he saw strong parallels

for the first time,” Coroneos says. “We’re planning on

between the issues faced by military veterans and

using people who have worked with the military or

those impacting cybersecurity professionals.

corporates. So they already understand the corporate world, or the military world, but don’t have the

“They are both defensive type roles. Arguably,

specific understanding of what a day in the life of a

cybersecurity is even more challenging because there

cybersecurity professional is like.”

is off duty time in the military. You get leave. I’ve talked to many CISOs. They tell me, even if they take a

AN EIGHT-WEEK COURSE

holiday, they’re still vigilant.”

The initial training for clients comprises one hour per week over eight weeks. “Every week, there’s a different

88

Cybermindz will provide iRest training to cybersecurity

theme tackling a different aspect of cyber stress,”

professionals using accredited iRest facilitators who

he says. “It might be the inability to switch off, or the

have been given additional training to understand

fear they are carrying about letting the team down, or

cybersecurity, the language of cybersecurity

a sense that they are not doing a good enough job.

and the issues and challenges cybersecurity

These are all themes that have emerged through our

professionals face.

consultations with the industry.

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

F E A T U R E

“We’ve cemented those into a standard format of

MENTAL HEALTH DRIVEN EXODUS

eight weeks. An individual would be invited to attend

In October 2022 Cybermindz launched a study into

every session. We can do it in person, or we can do

the mental health of cybersecurity professionals. It

it online. They become part of a hybrid group where

is being conducted by its director of organisational

they’re with people from other organisations. We also

and behavioural research, Dr Andrew Reeves. The

give them practice recordings. So as we’re delivering

results will be published later in 2023 but Coroneos

the iRest Protocol, we’re recording it for that week.

told WSM initial results suggested stress levels

And then they are asked to go home and use the

among cybersecurity professionals were already

same recording every day until the next session.”

very high and likely to lead to significant numbers of people leaving a profession already labouring under

Coroneos says Cybermindz has a number of pilot

staff shortages.

programs under way with major clients to validate its approach. “We’re running three pilots with the

“What we are measuring is burnout. There are three

New South Wales Government this month. We’ve got

attributes of burnout: emotional depletion, cynicism,

another one with the Department of Defense coming

or depersonalisation, and professional efficacy. In

up. So we’re now ready to implement.”

addition, we’re looking at sleep quality. And we’re looking at a quality of life index, which takes in four

EYING THE “FIVE EYES”

other factors. So, effectively, we’re looking at eight

He is also planning to launch Cybermindz in the

factors. We’ve already got a statistically significant

US in April, and in the UK later this year. “Our plan

number. … It’s showing that the professional efficacy

is to go through the Five Eyes [Australia, Canada,

metric — which is the third aspect of burnout, ‘how

New Zealand, UK, US] because we’ve got iRest

well do you feel that you’re doing in your job?’ —

facilitators worldwide.

is running lower for cybersecurity professionals than for frontline healthcare workers. Of the three

“We will have management teams in each country

metrics within burnout, that’s the one that predicts

doing the groundwork. But the real power is the

resignation intent.

facilitator network and the uniformity we bring to our delivery. In theory, it shouldn’t matter who you have

“So the takeaway from the research so far is that

as a facilitator from one week to the next, because

we are looking at a potential exodus of people from

we will have approved them as being competent to

cybersecurity in the next one or two years, because

deliver iRest to cybersecurity.”

they don’t believe they’re being effective in their work.

They’re not getting any professional satisfaction from

Cybermindz has an exclusive agreement with the

what they’re doing.

iRest Institute to deliver iRest training to cybersecurity professionals, but Coroneos says the Institute

“Then you add in the other factors that come to bear

has recognised the potential to apply the model

around emotional exhaustion: the fact that they

Cybermindz has created to other industries.

can never switch off, the fact that they’re not being recognised externally for their work. Any rational

“They got very excited when I came to them with

person is going to start to do a calculation and think,

our model, because they could see how readily the

‘Why am I doing this?’ That’s what we’re trying to turn

concept could be transplanted into other domains. So

around with the iRest Protocol, and we know you can

they are now actively investigating training facilitators

do that.”

who have specific expertise, particularly in the health profession. I think that and the education sector would be the two other areas they would move into first.”

I S S U E 14

cybermindz.org

WOMEN IN SECURITY MAGAZINE

89

LISA VENTURA

DIFFERENT VOICES, DIFFERENT PERSPECTIVES: FOSTERING DIVERSITY AND INCLUSION IN CYBERSECURITY FOR GREATER INNOVATION

by Lisa Ventura, Founder, Cyber Security Unity

Today many companies embrace diversity and

Such a workplace culture improves the work

inclusion in their businesses. Organisations around

experience of employees. However, the benefits of a

the globe put diversity initiatives at the top of their

diverse and inclusive workplace run much deeper.

‘must-do’ lists. And while it is widely accepted as the right thing to do, the benefits of ensuring

In this article, we explore the benefits of diversifying

diversity and inclusion in the workplace can be

the cybersecurity industry, the challenges faced and

far reaching.

the practical steps that companies can take to create a more diverse and inclusive workforce.

As it turns out, creating a culture of diversity and inclusion is good for your business in more ways

WHAT DO DIVERSITY AND INCLUSION MEAN?

than you might imagine. Inclusion is a way of building

Although the terms appear together, diversity and

on diversity and creating a feeling of belonging for

inclusion mean slightly different things.

everyone within an organisation. It means creating a workplace culture in which employees feel

90

• Diversity refers to the specific makeup of an

valued, respected and accepted. They feel welcomed,

organization or group. For example, how many

able to be themselves and able to share their ideas in

different cultures, races, sexual orientations ages

a friendly environment.

its members.

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

I N D U S T R Y

P E R S P E C T I V E S

• Inclusion refers to how well an organisation

fascinating links between inclusion and innovation.

represents and enables diversity within itself.

Diverse employees bring a wide-ranging set of life experiences and backgrounds to the table, meaning

When thinking about inclusion, organisations should

they often look at life through different lenses. Those

focus on ensuring the thoughts, feelings and opinions

different perspectives can open new ways to solve

of diverse employees are valued and respected.

challenges or address problems.

WHAT ARE THE BENEFITS OF DIVERSITY IN CYBERSECURITY?

When different viewpoints mesh they have the

According to Forbes, organisations that rank high

competition, or as the Harvard Business Review

in gender diversity outperform their competition by

explains, “Diversity unlocks innovation by creating an

15 percent. The results get even better for those

environment where ‘outside the box’ ideas are heard.”

practicing ethnic diversity: they do better than their

The results? Organisations that exhibit diversity are

competitors by 35 percent.

70 percent more likely to capture a new market than

potential to enable companies to out-innovate their

those that do not.

In addition, workplace diversity is an important profitability. The most racially diverse companies

DIVERSITY MAKES IT EASIER TO RECRUIT TOP TALENT

bring in, on average, 15 times more sales revenue

At a time when unemployment is low, recruiting

than those with lower levels of racial diversity. Let’s

talented, dedicated workers can be a challenge. They

look at some of the less well-known benefits of

are looking for more than compensation, perks and

nurturing diversity and inclusion.

packages. There are programs available to educate

predictor of a company’s sales revenue and

employees on how to be an ally in the workplace

DIVERSITY LEADS TO GREATER INNOVATION

so that every employee can feel empowered to

In the study, Fostering Innovation Through a Diverse

bring their best selves to work. More than ever, this

Workforce, researchers for Forbes found some

is a critical component of hiring and retaining top

I S S U E 14

WOMEN IN SECURITY MAGAZINE

91

talent. In addition, a study by Glassdoor found that

employee base could communicate better with

diversity can significantly increase the attractiveness

different types of customers, better understand their

of an organisation for potential employees.

needs, and better meet those needs.

Researchers found 67 percent of jobseekers

DIVERSITY CAN HELP IMPROVE BRAND IMAGE

considered a diverse workforce an important

As Intuit CEO, Sasan Goodarzi puts it, “We must have

factors when choosing where to work. That was true

a diverse and inclusive environment to be able to hear

regardless of whether or not the survey respondents

all voices. If we want to know what’s important to

were members of a minority. These findings show

[our customers], we actually have to be diverse like

workers are not open only to the idea of a diverse

our customers.”

workplace, but are beginning to expect one. The more an organisation responds to this expectation, the

The consulting firm DeEtta Jones reports brands that

better its chances of hiring and retaining top talent.

value diversity enjoy better brand perception. One reason could be that customers perceive such brands

CUSTOMERS RESPOND TO DIVERSITY

as being more in touch with their customers and more

Diversity is not only about changing the composition

forward-thinking. Potential customers may perceive

of workplaces across the country; it is also about

brands that do not practice diversity as being behind

increasing the diversity of its customers. When a

the times.

business exhibits a culture that fosters diversity it is more likely to be perceived as understanding the

DIVERSITY AND INCLUSION BOOST EMPLOYEE ENGAGEMENT

needs of a diverse customer base.

Many studies indicate that positive work

Researcher Stephen B Knouse,

environments lead to greater business success.

from the University of Louisiana

Happier employees are more engaged and

becomes more attractive to minority customers and

at Lafayette,

productive, and when employers take the time to have

found a

employees describe their experience of the benefits

diverse

of diversity and inclusion, a happier, more relaxed work environment emerges. Employees feel valued and respected, which leads to greater collaboration and creativity.

According to Dr Shirley Davis Sheppard, vice president of diversity and inclusion and workplace flexibility at the Society for Human Resource Management (SHRM), inclusive workplaces have higher levels of engaged workers and there is direct correlation between engagement levels and better job performance. Disengaged employees cost organisations an estimated $450 billion to $550 billion yearly through lost productivity, according to Gallop.

They also undermine the performance of a company: greater employee engagement can boost profits by an average of $2,400 per employee per year. And companies with employees that are more engaged enjoy 2.5 times more revenue growth.

92

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

I N D U S T R Y

P E R S P E C T I V E S

INCREASED CYBER ATTACK FREQUENCY AND DEMAND FOR CYBERSECURITY PROFESSIONALS The frequency of cyber attacks has increased in recent years, creating a higher demand for cybersecurity professionals. By 2025 it is estimated there will be more than 3.5 million unfilled jobs in cybersecurity. Businesses are facing talent shortages,

these qualities if it has a diverse workforce. However,

creating another reason to factor diversity and

diversifying the cybersecurity industry is easier said

inclusion (D&I) into recruitment efforts. Diversifying

than done.

the cybersecurity workforce can ensure businesses have access to a bigger pool of talent.

THE CHALLENGES OF DIVERSIFYING THE CYBERSECURITY INDUSTRY

DIFFERENT PERSPECTIVES AND CRITICAL THINKING

There are some challenges to diversifying the cybersecurity industry, which include:

Diversity in the cybersecurity industry means there will be a range of perspectives and different

ACCESS TO A LIMITED TALENT POOL

approaches to critical thinking and problem-solving.

The cybersecurity industry’s talent pool is very

Diversity opens doors to new insights and innovation.

limited. Women make up just 11 percent and

In a workplace lacking diversity, people tend to turn

minority representation stands at 26 percent. This is

away when they cannot find someone or something

unsatisfactory. To diversify the industry, businesses

they are able to relate to. Prospective clients will

need to expand their reach and identify candidates

often consider partnering with providers who offer

outside the traditional hiring channels.

more versatile services that better fit their needs.

The likelihood of being able to onboard talent also

THE PROBLEM OF UNCONSCIOUS BIAS

decreases in less diverse workplaces, because work

A significant challenge businesses face when

culture significantly influences people choosing to

diversifying their workforce is implicit bias. This refers

apply for a role in a company. Respecting the unique

to the unconscious attitudes or beliefs in stereotypes

needs of every job candidate and employee gives

that can affect decisions and actions. For example,

businesses a competitive advantage.

hiring managers may overlook qualified candidates from underrepresented groups as a result of implicit

THE IMPORTANCE OF PRIORITISING DIVERSITY, EQUITY AND INCLUSION IN CYBERSECURITY

bias. Businesses need to ensure their recruitment

The importance of prioritising diversity, equity and

underrepresented groups.

processes are free from implicit bias that may filter out potential candidates, especially those from

inclusion in the workplace cannot be overstated.

This is especially important in the cybersecurity

INVESTMENT IN STAFF RETENTION

industry which is constantly evolving in response

After onboarding talent, businesses need to maximise

to the emergence of new threats. Just like the

retention efforts. With the demand for cybersecurity

COVID-19 virus variants, phishing and ransomware

professionals increasing, maintaining employee

attacks reach new levels of sophistication every

morale is critical to ensuring employers do not

month. Businesses that strive to provide effective

lose workers, especially those with valuable skills.

cybersecurity need to be agile, adaptive and open to

Companies can achieve this through more inclusive

multiple modes of critical thinking.

policies, hosting in-office events in support of different cultures and providing educational training

A cybersecurity provider is more likely to exhibit

I S S U E 14

and workshops for current and prospective staff.

WOMEN IN SECURITY MAGAZINE

93

Dismantling unconscious biases in the workplace is the core to promoting a more diverse and inclusive environment.

WAYS TO INCREASE DIVERSITY IN SECURITY TEAMS TO FOSTER GREATER INNOVATION In many security organisations conversations around the pressing issue of diversity in the industry tend to be overlooked. The people at the top in the world of cybersecurity form a homogenous group and the lack of diversity in the industry creates hurdles, making the provision of security to clients much harder than it need be.

So, how do you increase diversity within your security teams to help foster greater innovation?

RETENTION OF DIVERSE STAFF IS AS IMPORTANT AS THEIR RECRUITMENT Much of the conversation around diversity in cybersecurity focuses on hiring staff. However, to create more diverse security teams, it is necessary

appearance that he was not very bright. Appearances

to also focus on retaining diverse staff. While it is

can be very deceptive.

important to increase significantly the number of non-binary individuals, women and people of colour, it

We often do not realise we have fallen victim to

is just as important to improve internal processes to

unconscious bias. We must understand that our

help retain them.

biases may not be explicit or intentional. We must learn to recognise they exist, listen to what people

Studies show that up to 52 percent of women leave

say, evaluate the work they produce and observe how

security careers, as do those from non-traditional

they collaborate with others: these are all indicators of

backgrounds. This figure is almost double that for

the value they bring to an organisation.

men leaving cybersecurity careers. Some say this is because women do not enjoy their careers in security,

Also, those who have been conditioned to believe

but more than 80 percent of women in the industry

security to not be a valid career path for them,

say they love their work. These figures suggest many

or those who are neurodiverse, may not exhibit

from diverse backgrounds leave the industry because

confidence in their work. This does not mean they

of cultural differences.

cannot do their jobs, it simply means they may need a little more encouragement in their working lives.

94

DON’T LET CONSCIOUS OR UNCONSCIOUS BIAS AFFECT YOUR PICTURE OF SOMEONE

NURTURE THOSE WHO THINK UNIQUELY

Too often we have a mental picture of what a security

Security organisations often want people to shake

person is supposed to look like: one that does not

things up by thinking ‘outside the box’, but in reality

reflect reality. The famous picture of Einstein shows

many are uncomfortable with being challenged and

him with tongue out and hair all over the place. If

presented with new ways of doing things. When

you did not know him have been one of the world’s

original thinkers are not valued, they are more likely to

greatest intellectuals, you might assume from his

move elsewhere.

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

I N D U S T R Y

P E R S P E C T I V E S

In security organisations, building a culture of

supports and accepts differences of all kinds. They

inclusion in which everyone has a chance to share

must not let unconscious bias about gender, the

their ideas can help to increase diversity. Not every

hours someone works, the location where they work

idea will be great, but all ideas and opinions should be

or their appearance get in the way of nurturing all the

shared and listened to.

great security talent available.

INSTIL A CULTURE OF REMOTE AND FLEXIBLE WORKING WHERE POSSIBLE

Organisations need to focus on creating cybersecurity

In March 2020 when the COVID-19 global pandemic

workforce. Only then do they stand a chance of

hit, steps were taken across all industries to get staff

warding off the growing cyber threat and fostering

working from home. Many organisations realised

greater innovation in the industry.

teams that mirror the make-up of their wider

their employees could be just as productive working from home as working in an office. In addition, those who are neurodiverse often get stressed when a

ABOUT LISA VENTURA

deadline is approaching and undertake their work as

Lisa Ventura is an award-winning cybersecurity

far as possible in advance, while others find they need

awareness specialist, writer and speaker. She

the adrenaline rush that comes when waiting until

is the founder of Cyber Security Unity, a global

(almost) the last minute to deliver a project.

community organisation dedicated to bringing together individuals and organisations working in

Supporting flexible working hours, a flexible working

cybersecurity to help combat the growing cyber

location, job sharing or three weeks on and one week

threat. She is also a mindset and mental health

off enables people to set their own hours and choose

coach and offers help and support to those

the locations where they feel most productive while

workers in cybersecurity and Infosec affected by

still delivering on deadlines and projects. However, a

stress, burnout and mental health issues.

flexible work environment requires trust in people to be productive even if they are not working in the same way or at the same time as others.

www.linkedin.com/in/lisasventura

FINAL THOUGHTS

twitter.com/cybergeekgirl

To build a strong and diverse security team, organisations need to build an environment that

www.csu.org.uk

10

TICKETS

We have loved seeing all the amazing nominations coming in and thought we'd give something back.

We are giving away 10 tickets to attend the Women in Security Awards!

To Enter: - Make sure you are following us @Source2Create - Nominate for the awards between 26th April and 26th May To nominate for the awards, visit: https://womeninsecurityawards.awardsplatform.com/

I S S U E 14

WOMEN IN SECURITY MAGAZINE

95

NICOLE STEPHENSEN

THREE SHIPS

by Nicole Stephensen, Partner at IIS Partners

The cyber and privacy professions are growing. Both

I was fortunate to be offered one-on-one mentoring

are seen as critical to ensuring the safety and security

just when I needed it, and that is something I

of individuals, organisations and governments – with

reflect on with much gratitude (I am aware group

the privacy profession also focused on preserving the

mentoring and online mentoring can offer privacy

rights of individuals in respect of the collection and

and cyber professionals great support too). The

handling of their personal information. The building

benefits of mentorship are different for everyone,

blocks of mentorship, leadership and allyship are key

and can include:

to the progression and vitality of these fields and to the success of the professionals within them.

1.

Knowledge transfer - mentors share their knowledge and experience with mentees,

ON MENTORSHIP…

helping them learn new skills and gain a deeper

Just over twenty years ago I had the great fortune to meet a person who would become my career-

understanding of their profession.

2.

Career advancement - mentors provide guidance

long mentor, friend and (fast forward to today) my

and advice on how mentees can advance in

business partner. In addition to benefitting from

their profession, including how to gain new

his deep knowledge of privacy law and practice in Australia and abroad, I learned about the long-

certifications and develop new skills.

3.

Personal growth - mentors help mentees

game: that it would take patience, determination and

develop their personal and professional skills,

planning to deliver myself to the so-called ‘top’ of

including communication, leadership and

my career.

problem-solving.

4.

Networking - mentors introduce mentees to

A mentor is often described as someone who

other professionals, helping them build their

provides guidance, support and advice to an individual

network and connect with potential employers.

who is new to the field or looking to advance their

96

career. However, my experience is that mentorship is

Living the career long game my mentor described

more nuanced than this, for both mentor and mentee.

(this, I suppose, is the discovery part), I have found

It is less an activity and more a process of discovery,

that the ‘top’ is not, after all, a destination. It is

particularly where the connection is lasting.

more of a viewing platform, a chance to reflect on

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

I N D U S T R Y

P E R S P E C T I V E S

the career path travelled before considering what

principles ahead of invoicing – and to be clear, I do

comes next.

not do this. Instead, I listen and pitch in. In corporate speak, I comfortably ‘deleverage’ myself as partner

In my own role as a mentor to privacy and cyber

and support the people who need supporting (ie,

professionals, I too encourage an ongoing

actually help with the work). I also believe my role is

association. To my mentees I offer my own pearls of

to create a workplace and structures that empower

wisdom, including the need for professional resilience.

people to be successful, and to complete their

The hard work, the learning, the successes and

projects on time and with excellence. This, of course

hiccups are all, in their way, fortifying. And strength

produces happy clients who are happy to receive

(particularly of character) is measured as much by

a bill for services rendered. However, the personal

how people respond to losses, disappointments and

and professional growth of team members and the

stumbles as by their response to any of the public

creation of a positive and supportive environment

high notes.

where everyone can thrive and succeed matter deeply to me.

ON LEADERSHIP… Leadership takes many forms: organisational

The benefits of strong leadership in privacy and cyber

leadership, team leadership, project leadership and,

are numerous. They include:

increasingly in my experience, servant leadership.

Servant leadership emphasises the importance

1.

Vision - leaders provide a clear vision for the

of serving others first before leading them. It is a

future of the organisation or project and help

leadership approach that focuses on the needs and

guide the team toward success.

wellbeing of the people being led, rather than the

2.

leader’s own interests or goals.

Motivation - leaders motivate the team to work toward a common goal, inspiring them to do their best work.

For me, the notion of being a servant leader grew

3.

from experiences earlier in my career, when I was ‘being led’ and when my views about success and career sustainability were still forming.

Accountability - leaders hold themselves and their team accountable for their actions.

4.

Innovation - leaders encourage innovation and creativity and help their team develop new ideas and solutions to complex problems.

It is not easy to visualise a leader in a privacy and cyber consultancy actually putting humility, empathy

That said, and returning to mentorship for a moment,

and a strong commitment to ethical and moral

I believe leadership (in its various forms) is not the

I S S U E 14

WOMEN IN SECURITY MAGAZINE

97

exclusive domain of the boss or the one in charge. It

experiences of those who are oppressed or

is not a trait limited to a select few individuals. Anyone

marginalised. However, by demonstrating allyship, my

can be a leader, regardless of their background,

colleague became the subject of criticism and vitriol

education or experience. Leadership is about having

on social media.

a vision, setting goals and inspiring others to work toward achieving those goals. It is about being able

In the privacy and cyber professions, the benefits of

to communicate effectively, listen to others and make

allyship are obvious.

decisions that benefit the group.

1.

Diversity and inclusion - allyship helps to

Being a leader also requires a willingness to take

create a more diverse and inclusive workplace,

risks, learn from mistakes and adapt to changing

which can lead to better problem-solving and

circumstances. With dedication, hard work, a commitment to personal growth and that of society,

innovation.

2.

Support - allyship supports and encourages

anyone can develop the skills and qualities needed to

individuals who may feel isolated or marginalised

become an effective leader. A quality I much admire in

in the workplace.

leaders is allyship.

3.

Education - allyship educates individuals on the experiences and perspectives of those from different backgrounds, leading to greater

“I also believe my role is to create a workplace and structures that empower people to be successful, and to complete their projects on time and with excellence. This, of course produces happy clients who are happy to receive a bill for services rendered.”

understanding and empathy.

4.

Challenging bias - allyship challenges biases and stereotypes in the workplace, creating a more equitable environment for all.

Taken together these three ‘ships’ increase staff cohesion in cybersecurity and privacy and help nurture successful professionals. Mentorship supports the transfer of knowledge, advancement of careers and development of personal and professional skills. Leadership can be supportive, motivational for teams, hold individuals accountable and encourage innovation. Allyship creates a more diverse and inclusive workplace, provides support and education and challenges biases and stereotypes.

ON ALLYSHIP…

A trifecta!

I saw a great example of allyship (and leadership!) recently. A colleague who had been asked to speak on a cybersecurity panel suggested the organiser should

www.linkedin.com/in/nicole-stephensen-privacymaven

revise the all-male (albeit racially diverse) panel to include women. It seems a small thing, but supporting inclusion most certainly is not.

For the uninitiated, allyship is the act of supporting and advocating for a marginalised group of which one is not a member. It involves recognising and acknowledging one’s own privilege (or advantageous position) and using it to amplify the voices and

98

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

Source2Create Spotlight

Content Content allows you to establish, share, and strengthen your brand. It helps build relationships which is why we are shining the light on our content service.

Content strategies don’t just define the goals your content is intended to achieve, but also the procedure, processes and governance required to get there. We can show you how to manage your content effectively.

We can then use that content to attract, acquire and engage your customer and new prospects, deepening your relationships.

What are you waiting for?

REACH OUT TODAY

charlie@source2create.com.au

aby@source2create.com.au

SASENKA ABEYSOORIYA

MERRELL MILANO

FROM DIFFERENT PERSPECTIVES TO BETTER PROTECTION: HOW DIVERSITY IMPROVES CYBERSECURITY

by Sasenka Abeysooriya, Program Director & Senior Strategic Adviser at The University of Queensland, and Merrell Milano, Deputy Vice-President, Advancement Services at The University of Queensland

Rapidly advancing technology and evolving

In other words, the supply of qualified talent

cybersecurity threats require cybersecurity

simply cannot keep up with demand, leading to a

professionals to continually think differently to protect

significant skills gap in the industry and increasing

against potential breaches and attacks. The complex

the vulnerability of organisations already at risk.

and sophisticated nature of these threats requires

To address this challenge, Dr Bongiovanni and his

cybersecurity experts to stay informed and prepared

colleagues urge organisations to invest in innovative

to face the challenges of today and the future.

approaches to education and training, as well as in initiatives to promote diversity and inclusivity in the

Dr Ivano Bongiovanni from the University of

cybersecurity workforce.

Queensland led a study on the barriers that women

100

face in cybersecurity. It found: “…given the growing

A focus on expanding existing staff perspectives

complexity associated with cyber threats and the

through professional development initiatives—such as

multiplicity of skills required to address them, the

upskilling current employees, investing in education

demand for cybersecurity professionals continues to

and training programs, and leveraging emerging

increase rapidly.”

technologies—can help alleviate the cybersecurity

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

I N D U S T R Y

P E R S P E C T I V E S

talent shortage. However, to meaningfully and

gender, sexual orientation, age, socioeconomic

strategically foster innovation in cybersecurity,

status or other attributes. By seeking out a pool of

organisations must recognise the value a pool of

diverse candidates, organisations can tap into a

skilled and diverse professionals can bring, and must

broader range of skills and experiences and infuse

focus on attracting and retaining such people.

standard positions and responsibilities with new, unique perspectives. Such a workforce is likely to

True transformation often arises from creative

produce solutions more innovative than those from a

problem-solving and resourcefulness, and a diverse

homogeneous team.

team will bring a wider range of ideas and solutions to combating the growing sophistication and creativity

Initiatives to foster diversity in cybersecurity include

of future cybersecurity challenges. To achieve

a shift in conventional recruitment strategies and

this transformation, organisations must create

going beyond the usual channels to seek talent in

an environment that encourages and embraces

unexpected places. It is important to acknowledge

people with diverse backgrounds, experiences

what people have overcome in their lives rather

and perspectives.

than focusing on their qualifications and recent experience. By recognising, valuing and celebrating

DIVERSITY

the achievements of individuals who have overcome

In talent acquisition, diversity is achieved by

obstacles and have demonstrated resilience and

actively seeking out and recruiting candidates with

problem-solving skills, organisations can create a

a wide range of backgrounds, experiences and

workplace culture that values and acknowledges the

perspectives. They could be diverse in ethnicity,

strengths of all team members.

I S S U E 14

WOMEN IN SECURITY MAGAZINE

101

INCLUSION

and adapt to rapidly evolving situations and contexts

When the cybersecurity community is more inclusive

while proactively developing new strategies to prevent

it has a better chance of identifying and addressing

future attacks.

the many and diverse threats and vulnerabilities it faces. An inclusive environment is crucial to

Critical thinking is essential for success in

ensuring all team members can contribute to

cybersecurity. Cybersecurity professionals must

their full potential. This requires the leadership to

analyse data and recognise patterns to identify

remove participation barriers and promote a thriving

security risks, evaluate the effectiveness of different

environment where team members can share their

security measures and develop responses that are

challenges and experiences without fear of judgment

effective and efficient. Additionally, they must be

or reprisal. Leaders must identify and address

able to evaluate new and existing technologies and

participation barriers to create an environment in

products to determine whether they are secure and

which all can contribute and grow.

compatible with existing systems.

Infusing planning and strategy with different

Soft skills are essential for success in cybersecurity,

perspectives and open ideas can help establish a

albeit currently under-valued. Effective

more inclusive team environment. When leaders

communication skills, including active listening and

intentionally seek out diverse perspectives they

clear expression of ideas, are critical to ensuring

can identify and address potential blind spots and

cybersecurity professionals work collaboratively

generate innovative solutions to complex problems. In

with their teams and effectively communicate with

doing so, they create opportunities for team members

stakeholders. Soft skills become increasingly critical

to learn from each other and grow together.

during incident response, particularly in managing dynamic stakeholder relations and ensuring clear

Leadership that recognises and celebrates both

communication on actions and timelines. A lack of

personal and professional achievement will contribute

clarity and team cohesion can jeopardise security in a

to an inclusive team culture. Acknowledging and

high-risk environment.

appreciating the unique challenges colleagues may have faced, and celebrating their achievements will

It is vital to select candidates based on these

establish an environment that values and recognises

essential core traits if a strong and effective

the strengths and experiences of all team members.

cybersecurity team is to be built. By prioritising these core traits in recruitment, organisations will build a

CORE TRAITS NEEDED FOR SUCCESS

diverse and innovative workforce capable of handling

If recruitment processes are to achieve diversity

the ever-evolving cybersecurity landscape.

and inclusion they must select candidates based on essential core traits: professionals able to continually

CONCLUSION

adapt and show traits for success such as problem-

Fostering innovation in cybersecurity requires a

solving ability, critical thinking and soft skills.

concerted effort to create a diverse and inclusive team environment. By recruiting from a wide range

102

Problem-solving ability is one of the most crucial

of backgrounds and providing an inclusive workplace

traits for cybersecurity professionals. Cyber threats

culture, organisations will tap into the wellspring of

are continually evolving and becoming more

creativity and innovation that comes with diversity.

sophisticated, requiring cybersecurity professionals

By embracing new and varied perspectives and

to think outside the box and solve complex problems

experiences, organisations will create a more

creatively. Individuals must be able to quickly identify

innovative and effective workforce that is better

and address security vulnerabilities and incidents

positioned to rise to the challenges of the digital age.

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

I N D U S T R Y

P E R S P E C T I V E S

ABOUT SASENKA ABEYSOORIYA

ABOUT MERRELL MILANO

Sasenka Abeysooriya is an accomplished and

Merrell Milano is an accomplished executive with

dynamic strategist, innovative thinker and strong

extensive experience in advancing fundraising

communicator with over a decade of experience

and engagement programs. She is Deputy

in IT. He is Program Director for The Queensland

Vice-President, Advancement Services at The

Commitment at The University of Queensland

University of Queensland where she oversees a

and is well-versed in a diverse range of activities,

portfolio of information management, insights

including strategy, enterprise architecture,

and operations teams. Her expertise spans a

program management, data governance,

range that includes business analysis, process

security and risk transformation. His extensive

development, change management and project

career has spanned a variety of industries

management, as well as aligning technology and

including ICT, healthcare, travel, marketing,

tools with the unique needs and best practices

advertising, government, higher education and

of institutions.. Prior to joining The University

not-for-profit. Sasenka holds degrees in IT and

of Queensland, Merrell spent a decade as an

International Relations.

Associate Vice President at US-based fundraising consulting and services company BWF where she specialised in fundraising operations and

www.linkedin.com/in/sasenkaabeysooriya

systems, helping universities, colleges, healthcare organisations and other non-profits design and implement data-driven operations and effective technology tools to achieve fundraising success.

Merrell is a graduate of New York University with a Bachelor of Arts degree.

www.linkedin.com/in/merrell-milano

2 Ticket giveaway for the Australian and New Zealand 2023 Women in Security Awards *winner will be determined on the number of individual nominations submitted

ENTER TODAY

I S S U E 14

WOMEN IN SECURITY MAGAZINE

103

NATALIE PEREZ

BE BRAVE, BE AN ALLY AND HIDE THE VEGETABLES

by Natalie Perez, SheLeadsTech Coordinator of the ISACA Melbourne Chapter Natalie Hingco Perez is the SheLeadsTech Coordinator in the ISACA Melbourne Chapter. She led a committee of volunteers from SheLeadsTech Melbourne, ISACA Melbourne Chapter, ISACA Sydney Chapter, EY Women In Tech and AWSN that organised a day-long hybrid event to celebrate International Women’s Day 2023.

In this article, Natalie identifies the top three things she learnt from organising the event, and shares her views as a participant.

I am fortunate to be a volunteer on committees such

inclusion. I am one of many who have felt fear and

as SheLeadsTech Melbourne which recently held an

concern about the metaverse and AI. My concerns

International Women’s Day event in collaboration with

extend to my children, because these will be the

the Australian Women in Security Network (AWSN),

technologies they will encounter as young adults. I

ISACA Melbourne Chapter, ISACA Sydney Chapter

need to understand these technologies, what they can

and EY Women In Tech. The event, with the theme

do and how to embrace them.

Cracking the Code to Embrace Equity, was virtual and on-premises with participants in EY offices in Sydney

The risks of both technologies must be managed

and Melbourne and comprised four presentation

The big corporates with the capabilities to develop,

sessions and two panel sessions. Here are the top

enhance and extend the metaverse and AI must

three lessons I learnt as a participant.

take responsibility and be held accountable. This responsibility entails making ethical investments and

104

BE BRAVE BY BEING RESPONSIBLE

ensuring the data and codes behind the metaverse

Firstly, I was able to gain a better understanding of

and AI exclude any form of aggression. The Internet

the metaverse, of how artificial intelligence works, of

has already demonstrated that suppressing

the opportunities and challenges they will create for

inappropriate content is a huge task and a huge

the industry, and how these will impact diversity and

responsibility.

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

I N D U S T R Y

P E R S P E C T I V E S

The users of artificial intelligence must also take responsibility to train it well. Chatbots powered by AI are continually enhanced by input from users ranking and rating the responses they receive. Such feedback is important but must be validated by those responsible for an AI system before it is accepted.

Samantha Lengyel of decoded.AI told the audience ChatGPT could be useful if it provides its users with relevant information. For example, ChatGPT might be able to generate a seven-day pescatarian menu for me that has a low glycaemic index and is high in protein.

HIDE THE VEGETABLES! Gail Bray from the Wyndham Tech(nology) School

BE AN ALLY

(WTS) in the western suburbs of Melbourne described

According to one speaker, inclusive workplaces

her program to spark students’ interest in STEM. WTS

advocate and author Karen Catlin, there are seven

and its partners have run programs featuring STEM

types of allies: sponsor, champion, advocate, amplifier,

problems and case studies. Bray has adopted an

scholar, upstander and confidant.

approach she calls “hiding the vegetables” to make learning and developing skills in STEM enjoyable for

Another speaker, Angela Anthony of Dulux Group,

students. It entails packaging the STEM content in

described a conversation with one of the female

something more appealing to students.

managers at Dulux interested in applying for a higher role in the company but hesitant because

As a result of having STEM in the curricula of Years

she was pregnant. Anthony’s response carried a

7 and 8 the ratio of female to male students has

powerful message.

improved from 5:95 in 2020 to 52:48. Imagine how many girls would consider a career in STEM if STEM

“Firstly, congratulations to you and your hubby on

were included in the high school curriculum until

your pregnancy. You should celebrate that. Secondly

Year 12.

why not apply for that role if you want it? Is it because you are pregnant? If you are accepted, that is more

I am grateful to have been given the opportunity to

great news to celebrate. And if you go on parental

meet virtually and in person with the volunteers who

leave, it is the hiring manager’s responsibility to find

helped organise our International Women’s Day event.

someone to do the job whilst you are away.”

The resource persons on such events are passionate about being able to increase the representation of

With companies now adopting the term ‘parental

women in technology and support them to thrive and

leave’ instead of ‘maternity leave’, fathers of newborns

be successful in their endeavours. I learnt much from

can take paid leave to participate in of the care of

the event, especially: Be Brave, Be an Ally and Hide

their children, some until the newborn is two years

the Vegetables.

old. This enables them to support mothers returning to the workforce from their maternity leave, and build relationships with their children.

I S S U E 14

www.linkedin.com/in/natalie-hingco-perez-74298436

WOMEN IN SECURITY MAGAZINE

105

MARISE ALPHONSO

WHAT STANDS IN THE WAY BECOMES THE WAY

by Marise Alphonso, Information Security Professional I have heard innovation defined as “fresh ideas that

Cybersecurity training and exams. This

add value.” In cybersecurity, ideas that add value are

training provides a technical foundation in key

necessary because we need innovative, automated

cybersecurity domains such as access control,

and sometimes out-of-the-box ways to improve

incident response and security operations.

cybersecurity practices; as individuals, organisations and governments. ISO/IEC27001, the international

• SANS New to the Cyber Field Manual. This

information security standard, even has a clause

excellent guide is jam-packed with useful

titled ‘improvement’ that outlines the requirement to

resources and tips for those looking to start or

constantly enhance security practices.

transition to a career in cybersecurity. It includes details of useful webcasts, books and approaches

The cybersecurity profession is diverse and dynamic

to getting started in cybersecurity.

in the skills, knowledge areas and personal attributes of the individuals who work in it, and is ever-changing

• OneInTech. This is an ISACA Foundation with

because of the nature of cyber threats, technology

the vision of creating a diverse and inclusive

and societal needs. Diversity is indeed required

global community of cybersecurity and IT

if we are to ensure our information is secure, our

audit professionals. It provides scholarship

business operations run as we expect and if we are

opportunities. Its SheLeadsTech program

to understand how changes in technology can impact

focusses on building a gender diverse and

regulations with which we must comply.

inclusive cybersecurity workforce. ISACA stages global events and offers a supportive community,

The diversity of individuals working in cybersecurity

making ISACA membership a worthwhile

could be increased by lowering the barrier to entry

investment that provides access to professional

into the profession. Some worthy initiatives that help

development, networking opportunities and

do so are listed below, in no particular order.

thought leadership resources.

• ISC2’s One Million Certified in Cybersecurity Program. ISC2 is offering free Certified in

106

W O M E N I N S E C U R I T Y M A G A Z I N E

• Cyber Leadership Institute. With training programs and the Cyber Leadership Hub the

M AY • J U N E 2023

I N D U S T R Y

P E R S P E C T I V E S

Cyber Leadership Institute is on a mission to develop visionary cyber leaders and assist cybersecurity professionals to attain leadership positions. Cybersecurity leaders require a range of skills beyond technical skills if they are to have an impact, and the programs offered aim to equip cyber leaders to succeed in executive level positions.

• Australian Women in Security Network (AWSN) mentoring. Mentoring is a powerful mechanism to encourage individuals into the cybersecurity field. There is tremendous value in having conversations on career growth and development, and in learning from the experiences of others.

AWSN’s mentoring program provides a fantastic opportunity for mentees to ask questions and build relationships with mentors in the cybersecurity industry.

No single method represents the best way to encourage participation in cybersecurity. A combination of technical, leadership, networking and relationship-building opportunities provides a multi-dimensional approach to increasing skills and setting the foundations for diversity in the profession.

The initiatives listed above make a difference by encouraging individuals to enter, transition into or grow in cyber careers. The cybersecurity industry must continue to work to advance and sustain the cyber profession, and heed the warning from Marcus Aurelius: “What stands in the way becomes the way.”

www.linkedin.com/in/marisealphonso

I S S U E 14

WOMEN IN SECURITY MAGAZINE

107

MEL MIGRIÑO

A WOMAN’S QUEST FOR EQUITY

by Mel Migriño, Chairman and President, Women in Security Alliance Philippines

March was International Women’s Month, it

produce greater creativity, and innovation is key to

celebrated the contributions of women in technology,

creating a progressive, digitised economy.

science and other industries. However, a continuing effort is needed to inspire both men and women who

2. SUPPORT WOMEN STARTUP BUSINESSES.

have doubts about pursuing a career in technology,

Companies with female owner(s) and female

science or engineering.

executives prioritise the hiring of women. This is important to help equalise disparate salary

According to the National American University, in

rates. Also, the inclusion of women brings more

2022 only 24 percent of computing jobs were held by

perspectives to the design of new products, services

women and only 19 percent of university graduates

or solutions. It increases opportunities for growth

majoring in STEM subjects were women. This

through business partnerships and collaboration.

underrepresentation could be the result of differing their gender, should have equal opportunities to start

3. G ROW THE SUPPORT ENVIRONMENT FOR WOMEN.

a technical career or pursue a course in STEM.

Women often have second thoughts when

social norms and expectations. All people, whatever

contemplating a job in technology, or a career Here are some key imperatives for advancing gender equity.

1. G IVE OPPORTUNITIES FOR WOMEN TO LEAD, AND RECOGNISE MEN AS ALLIES IN THEIR STRIVINGS FOR SUCCESS. A study published by the Harvard Business Review said diverse teams produced more innovative ideas. When people of different genders and with different backgrounds work together they bring different perspectives that

108

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

I N D U S T R Y

P E R S P E C T I V E S

shift. It is crucial they have a sense of belonging.

disadvantaged. They should be given opportunities to

Organisations should aim to promote women’s

lead, to take on key projects in their organisations and

empowerment and develop women leaders who

allowed to balance work and family priorities.

can work hand-in-hand with male leaders in their respective organisations, and so boost their

Projects succeed not only because of processes and

confidence to do work in which men have long played

technology but because of people’s attitudes and

leading roles.

abilities, and women’s abilities and attitudes stem from their family roles.

4. I NSPIRE AND PROGRESSIVELY SUPPORT STUDENTS TO TAKE UP STEM COURSES.

The journey to gender equity is long and far from

Increasing the number of women enrolling in

complete. We need to view and respect people

STEM courses would help bridge the skills gap

without bias and discrimination, regardless of their

for technology and cybersecurity. Male and

gender. Equity gives people of every gender the

female STEM students who embrace diversity

opportunity to move up the career ladder unimpeded

and equity could encourage others to take up

by biases.

STEM studies.

5. G IVE EQUAL RIGHTS AND RECOGNITION TO WOMEN UNDERGOING HEALTH OR MATERNITY BREAKS.

www.linkedin.com/in/mel-migriño-b5464151

We have seen women who have experienced career

www.linkedin.com/company/wisap-women-in-securityalliance-philippines

setbacks after getting married because their priorities have been divided between career and family.

Women who prioritise family matters should not be

Reach out to Aby today to find out how your company can help support the Women in Security Magazine.

ABY@SOURCE2CREATE.COM.AU

I S S U E 14

WOMEN IN SECURITY MAGAZINE

109

GABRIELLA ESPENSEN

HOW AUSTRALIAN CYBERSECURITY ORGANISATIONS CAN FOSTER INNOVATION ONE ROLE AT A TIME

by Gabriella Espensen, Head of Customer Success/Experience at Devicie

There are big benefits for cybersecurity businesses

who have transferable skills to make up the skills

prepared to widen the recruitment net and invest

shortfall and secure the talent they need to service

in training promising candidates who have the

their customers.

right attributes.

Many individuals working in the broader ICT sector It is no secret cybersecurity skills are in short supply

are well-equipped to make the switch and hence

in Australia. There has been a lack of job-ready

have been prime targets for cyber firms seeking to

candidates for several years. AustCyber’s 2019

maintain or increase their headcounts.

Australia’s Cyber Security Sector Competitiveness Plan noted the need for an additional 17,000

SAME, SAME: NOT DIFFERENT

cybersecurity workers by 2026, and demand

It is all too easy for cyber organisations to keep hiring

for their services has intensified post-Covid as

more of the same: individuals with roughly similar

businesses and organisations have scrambled to

backgrounds and skillsets to the people already in

protect themselves from an ever-growing array

their teams, but there is a downside.

of threats.

With a modicum of training and mentoring the new

110

The skills shortage is impacting both the supply

hires may be able to perform their duties capably,

and demand side of the cybersecurity industry.

but this hiring approach does not necessarily create

Cybersecurity vendors and service providers are

a workforce comprised of individuals with a broad

drawing heavily on workers from other industries

range of perspectives.

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

I N D U S T R Y

P E R S P E C T I V E S

There is no shortage of evidence to show that teams high in diversity—of culture, gender, sexual orientation and life experience—are more innovative and better performing than more homogeneous versions.

For example, a series of reports by McKinsey over recent years has revealed that public companies with the greatest ethnic and racial diversity at the top are more likely to report financial returns above the industry average.

BUILDING RATHER THAN BUYING SKILLS Increased diversity is a big part of the reason I would like to see more cyber companies have a change

Quick, motivated learners can add value everywhere

in mindset and open themselves to the possibility

from marketing to customer success once they are au

of building teams and skillsets from the ground

fait with the industry and its workings.

up. In practice this would mean training promising candidates to fill vacant roles rather than buying in the

Getting rookie recruits up to speed may require more

bulk of the expertise they require.

upfront investment than hiring individuals who can hit the ground running, but it can be money well spent, at

Doing things this way would kill three high-tech

least for organisations looking at the big picture.

birds with one stone. It would go a long way towards alleviating the skills shortages impeding cyber

BEING PART OF THE CHANGE

organisations’ ability to grow. It would create more

I am grateful my employer, Devicie, is one of them.

opportunities for individuals from non-traditional

With the support of its leadership team I segued

backgrounds to forge challenging and rewarding

successfully from the defence sector into a customer

careers for themselves in an industry that is really

success role a few months ago, and a handful of my

hitting its straps. And it would allow organisations

colleagues have made similar shifts.

giving those individuals a start in the sector a better shot at building committed, high-performing,

We are excited to be part of a diverse, high performing

diverse teams.

team that is transforming a home-grown cyber startup into an international success story with a

MAKING THE INVESTMENT

corporate customer base spanning three continents,

So, where should cyber businesses that would like

and growing.

to walk the walk begin when it comes to diversity, inclusion and innovation? Hiring for attributes rather

How good would it be to see other cyber businesses

than experience would make a great start.

solve their staffing challenges and reap the same diversity-driven innovation dividend Devicie is

Attributes like curiosity, initiative, lateral thinking

now enjoying?

and tenacity, for example, are all traits that can be harnessed to excellent effect in the cybersecurity industry in roles such as penetration testing, social

www.linkedin.com/in/gabriellaespensen

engineering and analysis.

I S S U E 14

WOMEN IN SECURITY MAGAZINE

111

NICOLLE EMBRA Cyber Safety Expert, The Cyber Safety Tech Mum

C O L U M N

Is checking your teen’s phone an invasion of privacy?

The issue of whether parents checking their teen’s phone is an invasion of privacy is contentious. On the one hand, parents argue it is their responsibility to monitor their child’s behaviour and ensure the child’s safety. On the other hand, teens argue it is an invasion of their privacy and undermines their trust.

Parents who support monitoring believe they have a responsibility to make sure their child is not engaging in dangerous or inappropriate behaviour, such as sexting or cyberbullying. They also argue that

In the end, the decision to monitor a teen’s

monitoring their child’s phone can help prevent the

phone should be based on the family’s individual

child being targeted by online predators.

circumstances. If there are concerns about a teen’s behaviour or safety, it may be necessary for parents

However, teens who oppose phone monitoring

to monitor the teen’s phone. However, if a teen is

believe their parents should trust them to make

generally responsible and trustworthy, it may be more

good decisions and respect their right to privacy.

appropriate to respect their privacy and trust them to

They also argue that phone monitoring can be

make good decisions.

counterproductive because it can lead them to being more secretive and hiding their behaviour from

The issue of parents monitoring their teen’s phone is

their parents.

a complex one with valid arguments on both sides.

Ultimately, the decision should be based on the best

I believe there is a middle ground. As parents get

interests of the child, the parents’ parenting beliefs

involved in their teen’s online activities and show

and morals, and the family.

interest in the apps and websites the teen uses, they begin to develop a rapport with their child around technology and can educate themselves on the features available to their child through these apps.

This opens the door to discussing with the child the importance of keeping safe online and teaching them how to safely use technology, with a view to them managing it themselves in the future. Checking the phone with your child enables them to have input and enables you to take advantage of moments that present opportunities for teaching.

112

W O M E N I N S E C U R I T Y M A G A Z I N E

www.linkedin.com/in/nicolle-embra-804259122

www.linkedin.com/company/the-cyber-safety-tech-mum

www.thetechmum.com

www.facebook.com/TheTechMum

www.pinterest.com.au/thetechmum

M AY • J U N E 2023

TECHNOLOGY PERSPECTIVES

SAI HONIG

DOING IT DIFFERENTLY

by Sai Honig, Engagement Security Consultant at Amazon Web Services

Recently, I received my car insurance renewal

contributed to, by or in any way connected to a cyber

documents. Normally I do not really read the policy

act or cyber incident. However, we will not apply this

document. I just make a note of the amount and the

exclusion for any of the following:

renewal date. However, the email I received had a statement that caught my eye.

• an event otherwise covered by this policy that causes a cyber incident.

“Your policy document now explains what happens

• loss resulting from an event otherwise covered

if there is a cyber act or incident. We’ve updated the

by this policy that has been caused by a cyber

‘What you are not covered for’ section of your policy

incident or cyber act.

to include new information about ‘cyber events’.

This update explains that there are some losses and

I did ask for clarification of what this really means.

costs arising from a cyber act or incident that may

This is what came back from my insurance provider.

not be covered by your policy.”

“Some loss and damage we intend to exclude under

114

The policy (available publicly online) states:

our motor products are:

“Cyber events

1.

A vehicle that can connect to the internet is

This policy does not cover loss, cost or liability,

having issues with a new software update that

directly or indirectly caused by, arising from,

has been downloaded to it by the manufacturer.

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

T E C H N O L O G Y

P E R S P E C T I V E S

This means the vehicle needs to be looked at by a repairer to remedy the issue. The cost for the repair in this case will not be covered under the policy.

2.

A computer virus has caused a vehicle system to malfunction. There is no physical damage to the vehicle, but the key to access the vehicle no longer works. The cost of a repairer to resolve this issue will not be covered under the policy.”

I certainly did not expect to see my car insurance discuss cyber events. So why is this disclaimer in the policy? As we have seen, our cars are becoming more like our laptops and mobile phones. In many vehicles, Bluetooth and Internet connectivity are becoming standard features. Because of this, insurers are putting in disclaimers such as the above.

This needs to be understood. Software in many automotive systems may have vulnerabilities that could allow vehicles to be hacked, customer data to be stolen or even enable complete vehicle takeovers.

Because the software rather than the hardware is affected, these are considered ‘cyber events’ and may not be covered by the insurer.

Even Tesla’s ‘self-driving’ capabilities come with flaws.

A senior engineer at Tesla is reported to have said that, when Tesla tried to show the Model X could park itself with no driver, it crashed into a fence in Tesla’s parking lot. The US Department of Justice launched a probe following more than a dozen crashes, some of them fatal, involving Tesla’s driver assistance system, Autopilot, which was activated during the accidents.

I think we can agree that the “more than a dozen crashes” of Tesla’s Autopilot could have been caused by cyber incidents. I think we can also agree that complete vehicle takeovers can be caused by cyber attacks.

However, with all the software currently in vehicles (and more to come), can we ignore these cyber events? If our car insurance policies do not cover cyber events, what recourse do we motorists have?

www.linkedin.com/in/saihonig

I S S U E 14

WOMEN IN SECURITY MAGAZINE

115

DEIKA ELMI

THE IMPORTANCE OF THE DEEP DARK WEB IN THE RUSSIA-UKRAINE CONFLICT

by Deika Elmi, Vice President Of Security Engineering at Goldman Sachs

The Russia-Ukraine conflict has been described as

Much online activity in Russia has moved to the deep

the world’s first hybrid war. In addition to traditional,

dark web as a result of sanctions, voluntary actions

kinetic warfare involving deadly weapons and boots

and self-imposed restrictions, taking Russia away

on the ground, there is also a cyber war taking

from popular Western platforms.

place online. Cyberattacks, coordinated with the aid of the deep dark web, may be less lethal than

A pro-Russian hacker group, charmingly named

bombs and firearms, but the risk they pose to

Killnet, is one such cyber army using the deep

financial institutions and critical infrastructure is

web to attack Ukraine and its allies. This criminal

substantial, and actors from both sides have been

collective has committed a number of distributed

fighting in cyberspace with the same fervour as

denial of service (DDoS) attacks against government

conventional forces.

organisations in Romania, Moldova, Czechia (the Czech Republic) and Italy, temporarily shutting down

The deep dark web can be as scary as it sounds. It

websites and making them unavailable to users.

is a version of the internet with significantly fewer

116

oversights where hackers and cyber criminals sell

DDoS attacks are akin to multiple people crowding

identities, weapons and illegal drugs, launder money

a brick-and-mortar store’s doorway, preventing

and traffic human beings. This alternate network

legitimate customers from entering. To accomplish

is not indexed by search engines and cannot be

a DDoS attack a large number of machines from

accessed by standard web browsers. Special

different sources are needed, all infected with novel

tools like the Tor browser are needed to access it,

malware (undetectable by standard cybersecurity

and it is here that hackers use dedicated forums

software) that hands over control to hackers. Phishing

and chat services like Telegram for recruitment

scams, where a person is tricked into clicking on

and coordination.

a fraudulent link, are a popular way to install said

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

T E C H N O L O G Y

P E R S P E C T I V E S

malware. These scams can also be used to gain the

Follow these best practices to protect your data and

credentials needed to access sensitive information,

digital assets:

which is then leaked on the dark web.

• Keep your operating system, applications and But this is not a one-sided battle. Fire is being fought with fire. Groups like the hacktivist collective, Anonymous, have declared war on Russia and Killnet, pledging to leak details of Russian troop movements and other military information.

firmware up to-date.

• Enforce multifactor authentication (MFA), and secure remote desk protocol (RDP) and other risk mitigation services.

• Implement network segmentation.

• Maintain backups of your systems in

Using search patterns and other means to identify anomalous behaviour, pro-Ukraine actors are setting up malware lures to entrap cyber criminals before they can strike. These groups are also doxing and exposing the hidden assets of pro-Putin Russian

geographically dispersed locations.

• Know your exposure, and have a prepared incident response plan in place.

• Improve the cybersecurity awareness of your end‑users with training.

oligarchs and companies that either owned by

• Use geo-blocking and positive rules for apps.

Russians or are doing business with Russia.

• Monitor traffic for suspicious activity.

In May, Killnet’s planned DDoS attack against the Eurovision Song Contest was foiled and Ukraine’s

www.linkedin.com/in/deikaelmi

entrant declared the winner.

The cyber war between Russia and Ukraine has shown no signs of slowing down.

I S S U E 14

WOMEN IN SECURITY MAGAZINE

117

PRIYA GNANASEKARAN

WEB3: THE GOOD, BAD AND THE UNICORN

by Priya Gnanasekaran, Security Engineer at LAB3

In recent years the term Web3 has become

Finally, Web3 is designed to be open and accessible

a buzzword in the tech world. It refers to the

to everyone. Unlike the current internet, which is

decentralised web which promises to transform the

dominated by a few tech giants, Web3 is a level playing

way we interact with the internet. However, with every

field. Anyone can create an application or service and

new technology comes new challenges, and Web3 is

anyone can use it. This has the potential to democratise

no exception. In this article, we’ll explore the good, the

the internet and give power back to the people.

bad and the unicorn of Web3.

THE BAD THE GOOD

Now for the bad news. Web3 is not without its

Let’s start with the good news. Web3 is all about

challenges. The first challenge is scalability. Currently,

decentralisation, which means data and applications

most Web3 applications run on the Ethereum

are spread out across a network of computers

blockchain, which can only process a limited number

rather than being stored in a central location. This

of transactions per second. This means that, as more

approach has several advantages. First, it eliminates

people use Web3, the network will become slower

the need for intermediaries like banks or social media

and more expensive. To overcome this developers are

platforms, which can be slow, expensive and prone to

working on new blockchains and scaling solutions

censorship. Instead, users can interact directly with

that can handle more transactions.

each other, making transactions faster and cheaper.

The second challenge is user experience. Web3

118

Second, Web3 is built on blockchain technology,

applications can be complex and confusing for non-

which provides a high level of security and

technical users. For example, to use a decentralised

transparency. Blockchain is a decentralised ledger

exchange like Uniswap you need to connect a wallet

that records every transaction in a public database.

like Metamask to your browser, which involves several

Once a transaction is recorded it cannot be changed

steps and can be intimidating for beginners. To make

or deleted, making it tamper-proof. This makes Web3

Web3 more user-friendly developers are working on

ideal for applications like voting where trust and

new interfaces and tools that hide the complexity and

transparency are essential.

make it easier to use.

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

T E C H N O L O G Y

P E R S P E C T I V E S

The third challenge is security. While blockchain

and provide more opportunities for innovation and

technology provides a high level of security, Web3

entrepreneurship. DeFi is a financial system built

applications can still be vulnerable to hacks and

on blockchain technology. It allows peer-to-peer

attacks. For example, in 2020, the decentralised

transactions without the need for intermediaries such

finance (DeFi) platform, bZx, was hacked, resulting in

as banks. This gives users greater control over their

a loss of $350,000. To address this, developers are

finances and reduces the potential for fraud.

working on new security protocols and best practices to make Web3 more secure.

In conclusion, Web3 is a significant step forward for cybersecurity and data privacy. Its focus on

THE UNICORN

security and privacy combined with its potential to

Finally, the unicorn. Web3 has the potential to

disrupt industries and create a more democratic and

create a new internet that is more open, transparent

transparent online ecosystem make it a technology

and secure. It could revolutionise industries like

worth exploring.

finance, healthcare and social media, creating new opportunities and disrupting old business

However, as with any new technology, Web3 comes

models. However, to realise this potential we need

with its own set of challenges, including its lack of

to overcome the challenges and build a robust and

standardisation, scalability issues and regulatory

scalable infrastructure that can support the growth

uncertainty. It is essential to approach Web3

of Web3.

with caution and take steps to mitigate potential cybersecurity risks.

So, what does the unicorn look like? Imagine a world where you can vote in elections from your

As the world of Web3 continues to evolve it will be

smartphone knowing that your vote is secure and

critical to keep cybersecurity and data privacy at

tamper-proof. Imagine a world where you can invest

the forefront of our minds. By doing so we can fully

in startups from anywhere in the world without having

realise the potential benefits of this ground-breaking

to go through intermediaries like venture capitalists.

technology while minimising potential risks.

Imagine a world where you own your data and can decide who has access to it.

www.linkedin.com/in/priyacyber

Decentralised finance (DeFi) is just one example of how Web3 could shake up the finance industry

I S S U E 14

WOMEN IN SECURITY MAGAZINE

119

Need Event Speaker Services

Tell us more about what YOU need....

Need an MC or host?

Looking for a keynote speaker?

Want to get matched with industry expert speakers?

Need speaker inspiration/ideas?

Looking for presenters or analysts?

Need your events speaker lineup managed end-to-end?

REACH OUT TODAY FOR AN INSTANT QUOTE. The team at Source2Create has all the necessary skills to get the job done for you, so your time can be reserved to focus on other things.

With:

aby@source2create.com.au charlie@source2create.com.au source2create.com.au

STUDENT IN SECURITY SPOTLIGHT

Ayesha Qureshi grew up in Karachi, Pakistan and now lives in Sydney where she is undertaking self-paced cybersecurity courses delivered by TAFE NSW’s Institute of Applied Technology in preparation for gaining the ISC2 Certified Cyber Security certification. At present she is studying Networking, Introduction to Artificial Intelligence, Cloud Computing, Data Analytics and Security Incident Response. She is presently unemployed but looking for a fulltime position.

AYESHA QURESHI Cybersecurity Student at Institute of Applied Technology, TAFE NSW

How does the reality of cybersecurity as you experience it today fit with your understanding when you first thought about studying it?

In addition to your studies, what employment experience do you have in cybersecurity?

When I knew nothing about cybersecurity, I never

a cadetship and got an opportunity to work in

thought it important. To me, security was just

cybersecurity that accelerated my learning. I gained

locking the front door or setting up a passcode. By

exposure in cybersecurity frameworks, cloud

studying the depths and vastness of cybersecurity,

computing architecture, risk management, identity

I understand it to be about human security, data

and access management.

During my vocational training I was able to secure

security, endpoint security, network security,

What cybersecurity role would most like to be hired into when you graduate, and why?

The cybersecurity industry abounds with certifications from multiple organisations.

Have you gained, or do you plan to gain any of these, if so which ones, and why?

I am interested in cyber intelligence roles, and I want

Yes, I love the idea of certifications. Because

to work for prestigious organisations to make a

I switched careers and have a non-technical

bigger impact and provide services on a larger scale

background, certifications have been a great way of

to serve humanity.

learning and upskilling. Currently, I am completing

infrastructure security, you name it!

nationally recognised certifications and on the

What was the reaction from parents, peers or career advisors to your decision to get into cyber? Did you face any opposition, if so, how did you feel about this?

side I am preparing for the CompTIA Security+

This is an interesting question because I switched to cybersecurity in middle age after working in

What aspect of your studies excites you the most?

creative industries. My family supported me in my

I really enjoy studying networking because it has a lot

decision and became really interested when I started

of practical work. I am also keen to learn and work in

telling them about setting strict security measures

ethical hacking. Since ChatGPT gained recognition,

on personal devices, not connecting to free Wi-Fi

I have added an artificial intelligence module to my

networks, etc. They are really keen to see me progress

learning program.

and ISC2 cybersecurity certifications, which are internationally recognised.

in this field.

Who, or what would you say has had the biggest influence on your cybersecurity career journey to date, and why?

Is there any aspect of your studies you find particularly difficult or challenging, if so what, and why?

It may sound unusual, but coding and programming

The Australian Women in Security Network (AWSN)

were very challenging for me. I struggled initially to

has shown me how a woman can thrive in this

learn Python but with time and consistency I got

industry. I came from the Middle East where I had

through the course.

seen only men working in communications and technology. When I moved to Australia and decided to switch careers, women in IT industries were my first go-to role models and sources of inspiration.

122

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

S T U D E N T

I N

S E C U R I T Y

S P O T L I G H T

Do you see the need for, or plan to undertake, additional training in non-cyber skills to better equip you for a future role, eg interpersonal communications or management?

I would love to get trained in communication skills, project management, business strategy development, business intelligence and many other skills.

Are you involved in the wider cybersecurity community, eg AWSN, if so, how and what has been your experience?

I am a member of AWSN. It is an amazing network and I love attending events and meeting the amazing women working in this industry. I am also a part of WYWM Academy. This platform has contributed immensely to my self-paced learning. Cyber Risk Academy is another great institution. I attend ISSA Live webinars weekly. I am also a member of ICTTF and WiCyS and I enjoy being part of these communities.

www.linkedin.com/in/ayesha-qureshi-802123116

I S S U E 14

WOMEN IN SECURITY MAGAZINE

123

Sassandra Rae grew up in Mauritius, Malaysia and Australia and now lives in Melbourne where she is in her third year of study for a Bachelor of Science and IT degree at Monash University.

SASSANDRA RAE Bachelor of Science and IT Student at Monash University

How does the reality of cybersecurity as you experience it today fit with your understanding when you first thought about studying it?

and peers have given me significant motivation

Having no experience in technology when I first began

support network I have around me.

as I pursue my studies and begin my career in cybersecurity. I am incredibly grateful for the strong

my course, I thought roles in security were coding-

security is a constantly evolving field that requires

Who, or what, would you say has had the biggest influence on your cybersecurity career journey to date, and why?

a wide range of skills beyond coding. While coding

The biggest influence on my cybersecurity career

skills are helpful, problem-solving, critical thinking

journey to date has been my stepfather. As an

and communication skills are also essential in the

enterprise architect he initially encouraged me to

field.I have learned that cybersecurity is not just about

pursue a degree in IT even though it was not my

recovering from an attack, but also about being able

primary interest at the time. Throughout my course

to put yourself in the shoes of the attackers and

he has provided unwavering support and guidance,

develop strategies to mitigate the impact of an attack.

helping me navigate all the ups and downs of my

centric with limited communication required. As I have progressed through my course I have realised

tech journey. Following my decision to specialise The field is also constantly changing to adapt to

in cybersecurity he has been a constant source of

new threats and vulnerabilities, so it is important

encouragement and motivation, regularly sharing

to stay up to date with the latest trends and

interesting security-related articles as well as providing

technologies. My understanding of cybersecurity

me with endless opportunities to further my career.

has transitioned from a narrow focus on coding to a importance of communication, problem-solving and

What aspect of your studies excites you the most?

ongoing learning.

Network security is the area of cybersecurity I find

much broader view of the field that emphasises the

most interesting because I enjoy the problem-solving:

What was the reaction from parents, peers or career advisors to your decision to get into cyber? Did you face any opposition, if so, how did you feel about this?

monitoring and analysing network traffic to identify

I was lucky to receive a large amount of support and

piqued my interest in cybersecurity.

potential threats and vulnerabilities. The opportunity to study network protocols and the transmission of data across networks during my coursework initially

encouragement from my family when I decided to pursue a career in cybersecurity.

Recently, I participated in a virtual internship program with ANZ where I was exposed to real-world network

124

Both my parents work in the IT sector so have a

analysis situations and got hands-on experience

solid understanding of what cybersecurity entails

with tools such as Wireshark. This experience

and are aware of the increasing demand for skilled

reinforced my interest in network security and helped

professionals in the field, particularly in light of the

me develop my skills in investigating and finding

recent rise in cyber attacks on major organisations.

abnormalities in packets sent across the network.

They have been extremely supportive of my decision,

However, I am also aware there are other areas of

very often sending me links to various cyber-related

cybersecurity that may interest me as I continue to

workshops and programs to further my skills. The

learn and grow in the field and I am excited at the

help and support I have received from my family

prospect of exploring these.

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

S T U D E N T

I N

S E C U R I T Y

S P O T L I G H T

Is there any aspect of your studies you find particularly difficult or challenging, if so what, and why?

Are you involved in the wider cybersecurity community, eg AWSN, if so, how and what has been your experience?

As someone who went into her degree with no

I have recently become a member of both the

previous experience in IT, I found learning how

Australian Women in Security Network (AWSN), the

to code to be the most challenging aspect of my

Australian Information Security Association (AISA)

studies. I initially struggled to keep up with the rapid

and Grad Girls. My experience so far has been

pace of learning required, and because many in my

overwhelmingly positive. Through my involvement,

cohort had some level of coding knowledge, I was

I have come to realise the incredible support and

discouraged to see how far I was behind my peers.

the scale of opportunities available for women in the security industry. I have had the opportunity to

What made coding especially difficult for me was

connect with welcoming and inspiring women who

the fact it required a learning approach different

are eager to share their expertise and offer advice.

from that for other subjects. Unlike topics where memorisation was key, coding was more about

One of the benefits of being part of these

problem-solving and logic. This was a new way

organisations has been exposure to the industry.

of thinking for me that I struggled to wrap my

I have gained valuable insights into emerging

head around. I found I had to work harder just to

trends, best practices and potential career paths.

understand the simplest of concepts.

Additionally, both AWSN and AISA provide a sense of community and support, which is especially

However, after a lot of extra work and support

important as a woman in a male-dominated field.

from the people around me, I am now able to code effectively and, most importantly, to enjoy it.

Being part of these communities has also given me access to many personal and professional growth

Do you see the need for, or plan to undertake, additional training in non-cyber skills to better equip you for a future role, eg interpersonal communications or management?

opportunities. From mentoring programs to training and certification courses, there is a wealth of resources available that can help me further develop my skills.

While technical skills are crucial in the field of cybersecurity, non-technical skills are equally important in tackling ever evolving and increasingly complex cyber threats.

Have you ever felt disadvantaged or discriminated against by being a woman in cyber, if so, please provide details?

No. In my university classes, it is common for me

I believe training in effective communication is

to be one of very few women, but this has never

necessary in security because it enables us to

made me feel disadvantaged. In fact, it has allowed

clearly communicate the potential risks and threats

me to build stronger connections with the women

to all levels of personnel and educate them about

in my classes and to be part of an incredibly

cyber risks and threats. It is important to be able

supportive network. There are also many programs

to explain complex technical concepts to non-

and opportunities available for women starting out

technical stakeholders.

in a career in cyber, which has been so inspiring.

I feel empowered to pursue my passion in cyber, regardless of my gender.

I S S U E 14

WOMEN IN SECURITY MAGAZINE

125

With the benefit of hindsight would you change your career trajectory to date, and if so now?

Looking back, I would not change a thing.

Before landing on cybersecurity I explored several different areas and started university with a biology career in mind. However, through exploring various IT subjects I discovered a particular interest in cybersecurity. My earlier experiences taught me a range of soft skills such as adaptability and teamwork, which have been invaluable to my studies in security.

While my career trajectory may not have been a direct path to cybersecurity, I am grateful for the various experiences that have shaped my journey thus far.

These have helped me tremendously in navigating my way through the course.

www.linkedin.com/in/sassandra-rae

126

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

Need a professional marketing, strategy and implementation agency that is dedicated, responsive, professional, dedicated, creative, innovative, hardworking, and really cares about your business outcomes?

Then let us help YOU. REACH OUT TODAY FOR AN INSTANT QUOTE. The team at Source2Create has all the necessary skills to get the job done for you, so your time can be reserved to focus on other things.

With:

aby@source2create.com.au charlie@source2create.com.au source2create.com.au

Johanna Broquet grew up in Bernin, France and is now back there, living with her family and looking for a job after much travelling pursuing her studies.

She graduated in November 2022 with two master’s degrees: an Erasmus Mundus joint degree in International Security, Intelligence and Strategic Studies (IMSISS) and a master’s degree in Political Sciences awarded by the French public-school Sciences Po Grenoble.The IMSISS is awarded by only three universities: Glasgow University (UK), Università di Trento (Italy) and Charles University (Czech Republic).

JOHANNA BROQUET Graduate Student

Suppose you met an old friend from your last year at school who, knowing nothing about cybersecurity or what you do, asks you what you are doing. How do you answer them to ‘sell’ them on the idea of a career in cybersecurity?

lawyers, law enforcement agents and local, national

I would tell them that cybersecurity is a very broad

in cybersecurity: various profiles are needed to

field which requires people with a variety of profiles

define and give effect to the protection we need

working on various aspects and at various levels.

for cyberspace.

Protecting against cyber threats must be undertaken

Finally, there is increasingly a need for global

on various levels of society: each entity, no matter its

cooperation to make the internet safer in the future

size, should be ready for cyber challenges to come.

and to tackle new challenges as they arise. This is

That includes the use of the internet individuals,

why cybersecurity is so interesting!

and global authorities who must all work together to regulate and protect cyberspace.

Because of the prominence of digital technologies in society, there is work for people of all kinds

societies and companies, public infrastructure

of a cyber attack that cut its electricity supply, details

How does the reality of cybersecurity as you experience it today differ from your understanding when you first thought about studying it?

of a company’s finances could be digitally stolen,

When I began to study cybersecurity I had very

confidential information on a country’s intelligence

basic knowledge and preconceived images of what

agency could be exposed.

it really meant. I based my perceptions on common

organisations, states and international organisations.

For example, you could have your data stolen and used against you, a public hospital could be the target

representations such as in TV shows (Mr Robot for Basically, everyone and everything using the internet

example) and movies, which depict the cyberworld

should be concerned about cybersecurity, because

and its activities only through hackers and secret

if everyone can gain something from the internet,

organisations such as Anonymous.

they also have something to lose to it.Thus, because the internet is something that encompasses so

I believe my vision today is more realistic and my

many different actors, it widens needs and makes

knowledge of the actors involved on the different

cybersecurity a broad activity.

levels working for the protection and design of cyberspace to be more comprehensive (see my

The common perception of cybersecurity threats as

previous answer).

emanating from hackers behind a computer is false.

Now that the internet has crucial importance in our

I think a more precise idea of the people involved

daily lives, it can become a political tool. This is why

in cybersecurity also comes from better knowing

it is important not only to protect the cyber space, but

the different cyber threats and the future cyber

also to regulate it, to be able to define what is lawful

challenges. For example, because am I particularly

and what is forbidden.

interested in international crimes, my studies have enabled me to learn about the different types of cyber

128

Cybersecurity encompasses computer and data

crimes that can be carried out by criminals. I find it

scientists and engineers, but must also include

particularly interesting that criminals increasingly use

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

S T U D E N T

I N

S E C U R I T Y

S P O T L I G H T

digital platforms to be more efficient and discreet in

Ostbayerische Technische Hochschule Amberg-

their illicit activities, representing a new challenge for

Weiden (OTH) university. The course introduced

the law enforcement agencies trying to detect and

the PMESII-PT/ASCOPE matrix as a tool to better

arrest them.

organise OSINT research.

What cybersecurity role would most like to be hired into when you graduate, and why?

I also would like to bring up the fact that you do

Because I have not received an education in

to train yourself in cybersecurity. There exist many

engineering or computer sciences I do not know

platforms through which you can train individually,

how to tackle a cyber intrusion or how to protect

for example, the website CyberSoc – Cyber Detective

data. Therefore I do not believe I will find a role in the

CTF is a great tool for those who want to learn to

technical side of cybersecurity.

carry out OSINT in an entertaining way. It gives you

not need certifications from official organisations

links to social media of profiles on which you have to But I have learnt to do web-based research on the

uncover precise information for each challenge (such

internet, and especially with open-source intelligence

as the political party of someone), sometimes using

(OSINT). With these skills I could be hired in an

digital tools to break a code (to decrypt a password

operational setting such as an investigator position

for example). This is a great exercise not only to

that seeks to identify criminals by the hints and

enhance OSINT skills but also to gain awareness

tracks they leave online, just as Europol and

of how information we sometimes reveal about our

Interpol do.

daily life on the web (and especially on social media) can be used against us, and teach us to be more

Moreover, I believe studying cybersecurity through

careful about what we reveal.

social sciences opens many doors: I could see myself in one of the many international organisations

I also believe cybersecurity to be a field in which it is

working to regulate cyberspace (the UN and the EU

easy to find many tools that can be used to improve

for example). Such organisations employ people

skills autonomously.

with many different profiles (lawyers, diplomats,

interdependences and make the cyberworld safer

We hear all the time that the world of cybersecurity is changing rapidly, particularly with the rate of threat evolution. Do you feel your course is doing a good job of being current?

for all.

Yes and no. I would say no because, in most of our

mediators, civil society representants, government representatives, etc) to reach cooperative agreements and set international guidelines designed to better organise the internet and its

theoretical classes, the studies were based on ‘old

The cybersecurity industry abounds with certifications from multiple organisations.

Have you gained, or do you plan to gain, any of these, if so which ones, and why?

cases’. In my cybersecurity class, for example, we

I followed a course named Comprehensive Analysis

evolve, the means and strategies used from one year

Lab: Assessment of the Civil Environment through

to another can change completely. However, I also

Structured Analytic Techniques, offered by the

understand that these events constituted a turning

I S S U E 14

studied WikiLeaks (2006) and the Stuxnet attack (2010). These events happened not so long ago, but given how fast the cyberworld and cyber threats

WOMEN IN SECURITY MAGAZINE

129

JOHANNA BROQUET

point because of the impact they had on society and

that, despite the fact we try our best to be prepared

the importance technology started to have on many

for what is to come, there are always some aspects

aspects of our lives. I also understand that distance

that will be unpredictable, and will require all of our

in time is needed for objective academic study of a

adaptability and skills to find solutions for.

topic to enable a broader view of its dynamics and

it difficult for teachers to design courses based on

Is there any aspect of cybersecurity that you think should be given greater focus in your course, or any aspect you think should be given less focus?

recent events and to cover the latest technology

I feel talking about cybersecurity without actually

breakthroughs and threats.

experiencing the technical or operational side of

consequences. This is more difficult when the event is ongoing. Moreover, I understand the speed with which cybersecurity and cyber attacks evolve make

it can be a bit confusing. To better understand However, I would still say my course was very current

what comprises the daily activity of cybersecurity

because it gave space for students to interact,

I might have added more practical classes

debate and comment, and it was mostly during these

instead of theoretical classes. I would have given

moments that the most recent cases were brought

students deeper insights into to the use of OSINT

up. We would exchange views on the events we were

technologies, coding software, or the use of

witnessing in our daily lives, which gave currency to

specific techniques to use the internet safely. They

the class. For example, we talked about the Pegasus

would have been relevant, because most of my

Project (2021) and Russian virtual interferences in

master’s cohort will probably be required to work

the US presidency campaign (2020).

with sensitive or confidential data from national or international agencies.

What aspect of your studies excites you the most?

I think it is the fact that my study topics are very current and destined to gain increased importance in the future.

Do you see the need for, or plan to undertake, additional training in non-cyber skills to better equip you for a future role, eg interpersonal communications or management?

Developing non-cyber skills is a must for me. I

The dynamics of cybersecurity are evolving

believe the more cyberspace experiences threats,

everyday as society evolves, and are having direct

the more we need to be efficient in face-to-

consequences on it. If I can have an impact on these

face communications.

dynamics, I can have an impact on the society we live in.

This is why developing intercultural and interpersonal communications and management skills seems

130

This is what I really like about my field of activity: to

crucial to me. We have all experienced one of our

feel I have some kind of power to shape the future

virtual messages being misunderstood when it would

world, and to feel included in something bigger than

probably have been better interpreted if delivered in

myself. I also really like the strategic planning side,

person. I believe face-to-face communication will

trying to anticipate what is to come in future years, and

always be more efficient and better received than

the threats we will have to overcome. I am comfortable

online communication, because it involves feelings

with uncertainty, and I find it very exciting to know

and emotions that virtual space cannot transmit.

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

S T U D E N T

I N

S E C U R I T Y

This is why I was very happy to have courses focusing on developing intercultural and interpersonal communication competencies, and I believe everyone should follow some such course.

This is particularly important for those working directly in cybersecurity because it is a field where crises are very likely. I think effective communication is necessary for every person involved in crisis management to enable them to quickly understand,

S P O T L I G H T

CONTACT US TODAY, TO LEARN HOW YOU CAN DO THIS.

give and act upon instructions.

This is true in the case of a cyber attack, for example, where teamwork must be very efficient to block intrusions that can have huge consequences.

If agents have learned in advance, how to communicate well outside the digital world they are more likely to be able to build a common strategy to tackle challenges.

www.linkedin.com/in/johanna-broquet-61b10a1b8

Contact Us Now www.womeninsecuritymagazine.com

I S S U E 14

WOMEN IN SECURITY MAGAZINE

131

LISA ROTHFIELD-KIRSCHNER Author of How We Got Cyber Smart | Amazon Bestseller

Olivia’s and Jack’s learnings about social media Olivia and Jack’s school has organised a program for all the grade 5 and grade 6 students to learn about social media and how to use it safely. Their school said it was important to learn how to use social media safely before secondary school, because that is when most children start using it to connect with each other. Olivia and Jack think social media is cool because they can connect with people all over the world, so they are really excited about the program. Most of their friends have been talking about it at lunch time. Some of their friends already have social media accounts, but Olivia and Jack are still not allowed to use social media because their parents’ rule is that they have no access until the recommended age, which is generally 13+.

The following week Olivia and Jack started the program. They were told it used a simulated social media platform that was not online but connected only to pupils in their school year. They quickly created their profiles and started sharing pictures and messages. Olivia was invited to join a group with some of the other girls from her basketball team, but got upset because not all the girls were invited. Olivia sent a message to the group and asked why some of the girls had not been invited and this caused some drama. The girl who had set up the group sent Olivia an unkind message saying it was her group, she would decide who was in it, and telling Olivia to butt out! Olivia was quite upset about this and decided not to take part in the group’s chat. The teacher saw the chatter in the group and explained to all the girls that this was one of the drawbacks of social media. “Some kids will feel excluded, and we should be mindful of how others will feel when we exclude them,” she said.

Meanwhile, Jack ended up in a group chat with some of the grade 6 boys who were sending silly photos of themselves. The teacher saw this and said “be careful about the photos you post and share on the internet.

If you don’t want anyone else to see your photos, you should not post them. Once your photo is online on the real internet it is impossible to remove, and you never know where it will end up.”

Olivia and Jack went home that day feeling rather sad. Their mother noticed they were a bit mopey and sat down with them to talk about what had happened at school in the social media class. She spoke to them about the importance of being safe on social media and echoed what the teacher had said. She told them

132

W O M E N I N S E C U R I T Y M A G A Z I N E

to never share personal information with strangers and to be careful about what they posted. She also reminded them they would not always be included in group chats and that ‘likes’ and followers were no measure of self‑worth.

Olivia’s and Jack’s learnings about social media • Only accept friend requests from people you know and think carefully about what you post.

• Never share personal information or any images/ photos that are inappropriate because you never know where they might end up.

• It is not nice to intentionally exclude friends from chat groups.

Olivia and Jack felt that when they were old enough to start using social media they would have some knowledge about how to use it safely, and knew they would use it for good. They were looking forward to following accounts that shared interesting information about topics they were interested in like basketball, science and chess. They wanted to connect with friends who inspired them and shared similar interests.

Their teacher was impressed by how Olivia and Jack had used the social media program at school and reminded them that, while social media has its risks, it also has the power to bring people together and make a positive impact. Olivia and Jack learned that social media could be both fun and safe if used responsibly.

Message to parents Check the recommended age for social media platforms and help your children navigate them so they use social media in a safe and responsible manner. Talk to them about the risks associated with social media and what to do if something goes wrong. If something does go wrong, do not blame your child. Help them deal with the issue and get professional help, or get law enforcement involved if there is a situation that requires this. Start the conversation early. www.linkedin.com/company/how-we-got-cyber-smart

facebook.com/howwegotcybersmart

twitter.com/howwegotcybers1

M AY • J U N E 2023

Recom mend ed

by F amily zone

How We Got Cyber Smart addresses cyber safety, cyber bullying and online safety for elementary school-aged children.

READ NOW

WOMEN IN SECURITY MAGAZINE CONTRIBUTORS 01

02

1. AMANDA-JANE TURNER

Author of the Demystifying Cybercrime series and Women in Tech books. Conference Speaker and Cybercrime specialist

2. JANE FRANKLAND

Award-Winning Cybersecurity Leader

03

04

3. CHRISTINA ROSE

Manager — Security Operations & Advisory at Qantas Group

4. SANDRA AGOBIAN

Cybersecurity Analyst Intern at nbn® Australia

05

06

5. SIMONA DIMOVSKI

Head of Security and Technology at Helia

6. ELAINE MCCONNELL

Business Information Security Officer at The Depository Trust & Clearing Corporation (DTCC)

07

08

7. KIRSTEN CHAPMAN

Lead engineer at Gallagher Security

8. SHARMAINE LABRADO

Team Leader, Cyber Response Team | Section Chief, Women and Children Cybercrime Protection Section | Digital Forensic Examiner | Police Officer | Resource Speaker | Educator | Information Technologist

09

10

9. NATHALIE VIUF STENDER

Privacy and Security Engineering Leader at IKEA Retail (Ingka Group)

10. SILVANA MACRI

Founder of Stay Cyber Safe

134

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

11

12

11. CRAIG FORD

Cyber Enthusiast, Ethical Hacker, Author of A Hacker I Am vol1 & vol2, Male Champion of Change Special Recognition award winner at 2021 Australian Women in Security Awards

12. DEIKA ELMI

13

14

Vice President Of Security Engineering at Goldman Sachs

13. JAY HIRA

Director of Cyber Transformation at EY

14. KAVIKA SINGHAL

Cyber Security Consultant at EY

15

16

15. MICHELLE GATSI

Cyber Security Consultant at EY

16. KAREN STEPHENS

CEO and co-founder of BCyber

17. SAI HONIG

17

18

Engagement Security Consultant at Amazon Web Services

18. VANNESSA MCCAMLEY

Leadership and Performance Consultant, Coach, Facilitator, Author and Keynote Speaker

19. MATT TETT

19

20

Founder of Day of the Month club

20. SIMON CARABETTA

Project Coordinator at ES2

I S S U E 14

WOMEN IN SECURITY MAGAZINE

135

WOMEN IN SECURITY MAGAZINE CONTRIBUTORS 21

22

21. MEGAN KOUFOS

AWSN Head of Programs

22. GINGER SPITZER

Executive Director, ISACA One In Tech

23. LISA VENTURA

23

24

Founder, Cyber Security Unity

24. NICOLE STEPHENSEN

Partner at IIS Partners

25. SASENKA ABEYSOORIYA

Program Director & Senior Strategic Adviser at The University of Queensland

25

26 26. MERRELL MILANO

Deputy Vice-President, Advancement Services at The University of Queensland

27. NATALIE PEREZ

SheLeadsTech Coordinator of the ISACA Melbourne Chapter

27

28 28. MARISE ALPHONSO

Information Security Professional

29. MEL MIGRIÑO

Chairman and President, Women in Security Alliance Philippines

29

30

30. GABRIELLA ESPENSEN

Head of Customer Success/Experience at Devicie

136

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

31

32

31. NICOLLE EMBRA

Cyber Safety Expert, The Cyber Safety Tech Mum

32. PRIYA GNANASEKARAN

Security Engineer at LAB3

33. AYESHA QURESHI

33

34

Cybersecurity Student at Institute of Applied Technology, TAFE NSW

34. SASSANDRA RAE

Bachelor of Science and IT Student at Monash University

35. JOHANNA BROQUET

35

36

Graduate Student

36. LISA ROTHFIELD-KIRSCHNER

Author of How We Got Cyber Smart | Amazon Bestseller

I S S U E 14

WOMEN IN SECURITY MAGAZINE

137

THE LEARNING HUB

CYBER SECURITY PRACTICES LEVEL 3

CERTIFICATE IV IN CYBER SECURITY

Are you looking to increase your knowledge and skills relating to cyber security practices? Are you looking to seek employment in the field of cyber security? Do you want to have a certificate to add to your CV?

If you are looking to develop a career in the IT industry, love new technology and are seeking employment in Cyber Security – this is the course for you.

VISIT HERE

This qualification is designed to provide learners with knowledge and skills relating to cyber security practices. It will provide the learner with a chance to develop knowledge and learn practical skills which can be used to seek employment or proceed into study at a higher level.

CERTIFICATE IV IN INFORMATION TECHNOLOGY (NETWORKING) The ICT40120 Certificate IV in Information Technology (Networking) is the minimum standard for network administrators in Australia. This job role requires excellent communication skills so a supporting qualification in customer service or business administration will certainly improve your job prospects. Some organisations require their employees to have a National Police Check.

VISIT HERE

This qualification aims to: • f ocus on the study of the practices within cyber security • offer breadth and depth of study, incorporating a key core of knowledge •p rovide opportunities to acquire a number of practical skills.

The objective of this qualification is to: •p rovide the learner with an opportunity to develop knowledge and skills relating to cyber security practices.

VISIT HERE

138

W O M E N I N S E C U R I T Y M A G A Z I N E

NIST CYBERSECURITY FRAMEWORK PRACTITIONER ® The NIST Cybersecurity Framework was released in 2014 and is gaining widespread use by organisations across the globe.

The continuous improvement lifecycle assists organisations to use a tiered, risk-based approach when safeguarding their most critical assets, before, during and after a potentially disruptive cybersecurity incident.

Break into the world of cyber security with this Cyber Security Professional Online Bootcamp Program delivered by Simplilearn.

VISIT HERE

VISIT HERE

CYBER SECURITY PROFESSIONAL

M AY • J U N E 2023

FEATURING FREE SECURITY TRAINING RESOURCES THAT ARE AIMED AT INCREASING SECURITY AWARENESS AND HELPING PEOPLE BUILD AND UPSKILL THEIR SECURITY SKILLS.

CYBER SECURITY RISK AND STRATEGY

CERTIFIED CLOUD SECURITY PROFESSIONAL

The course will provide you with a foundation in cyber security.

You’ll learn how to formulate a strategy so that organisations are able to respond to incidents in an orderly and efficient manner and limit the damage of attacks and recover information from the damages caused.​

Gain core knowledge and experience to successfully secure the cloud and prepare for the Certified Cloud Security Professional (CCSP®) certification.

VISIT HERE

VISIT HERE

MICROSOFT CLOUD COLLECTION

NETWORKING CAREER STARTER COLLECTION

Microsoft Azure, commonly referred to as Azure, is a cloud computing service created by Microsoft for building, testing, deploying, and managing applications and services through Microsoft-managed data centers.

VISIT HERE

I S S U E 14

The Networking Career Starter collection is designed to equip you with the skills needed to launch your networking career.

The collection covers the basics of networking, security, routing and switching.

VISIT HERE

CYBER SECURITY PROGRAM The cyber security program is delivered in a 24 week part time and 12 week full time format and is designed for career-driven professionals to transition into the cyber security industry.

VISIT HERE

DIPLOMA OF INFORMATION TECHNOLOGY (ADVANCED NETWORKING) Gain practical skills and experience through a workplace program with a local company.

VISIT HERE

WOMEN IN SECURITY MAGAZINE

139

THE LEARNING HUB

CYBER SECURITY MICRO SKILLS

NETWORK ENGINEERING

PRINCIPLES OF CYBER SECURITY

Courses have been designed by industry experts, in conjunction with NSW Cyber Security Innovation Node, to ensure that course content is modern, ultra-relevant, and teaches current skills using real-world examples. Courses can be completed in a matter of hours and combine to enhance industry experience, improve security expertise and protect networks that may be at risk of cyber attack. By completing each course, participants will receive a certificate of completion, as well as a digital badge to promote their newly acquired skills.

The Diploma of Network Engineering will prepare you for entry-level network engineering roles by providing the skills and knowledge required to design, operate and maintain networks that play a crucial role in the infrastructure of industry and government organisations. Your coursework will cover key areas of network engineering, including data networks and their implementation.

You will combine academic studies with practical experience allowing you to further develop your skill set and provide you with the opportunity to stand out from the crowd in a competitive industry.

You can also use this qualification to move into our other degree programs such as the Bachelor of Information Technology or Bachelor of Software Engineering Honours.

“Are you looking to gain a greater understanding or build upon existing knowledge of Cyber Security issues? Are you seeking employment in a Cyber Security related role and want to have a certificate to add to your CV?

VISIT HERE We have loved seeing all the amazing nominations coming in and thought we'd give something back.

We are giving away 10 tickets to attend the Women in Security Awards!

The purpose of the Level 2 Certificate in Cyber Security is to provide learners with sector awareness. It will do this by introducing the knowledge and understanding in roles and issues relating to Cyber Security. The secondary purpose is to act as a steppingstone that will lead learners into studying Cyber Security at a higher level.”

VISIT HERE

VISIT HERE

10

TICKETS

To Enter: - Make sure you are following us @Source2Create - Nominate for the awards between 26th April and 26th May To nominate for the awards, visit: https://womeninsecurityawards.awardsplatform.com/

140

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

TURN IT UP

TECHNOLOGY IN EDUCATION With Mickey Revenaugh Technology changes the way we learn and engage with content.

Throughout her career, Mickey Revenaugh has worked on bringing technological advancements to education. Mickey is currently Vice President of Business Development in Global Online Learning at Pearson.

CLICK TO LISTEN

PIONEERING THROUGH TECH WITH CONFIDENCE With Roz Ho In this episode of Women in Tech with Ariana, Ariana interviews Roz Ho. Roz is the Vice President and Global Head of Software at HP (Hewlett Packard). Subscribe to our Women in Tech email list: www.wallwaytech.com/podcastlinks and watch this episode on the Women in Tech with Ariana Youtube Channel.

CLICK TO LISTEN I S S U E 14

TECH AND THE CITY With Billie Quinlan “Billie Quinlan is the co-founder and CEO of Ferly, a female-focussed sexual wellness app. She tells AnneMarie how technology is helping women discover their sexuality, and change the way people think about sex. They also talk about her journey from aspiring actress to head of her own start-up, including having to learn new skills.

CLICK TO LISTEN

LEADING WOMEN IN TECH PODCAST With Toni Collis “On this podcast, we explore the techniques, tips and strategies you can use to become a standout leader. To give you the time and credibility to focus on what you love doing instead of justifying yourself every moment along the way. I’ll be sharing with you my best insights designed to make success not just simple, but inevitable.”

CLICK TO LISTEN

THE BURN BAG

TECH4EVIL

With Andrea Ochoa

With Manal al-Sharif and Reinhardt Sosin

The *hottest* national security and foreign policy podcast featuring conversations with leading policy practitioners, thinkers, and leaders.

In each episode, we open up a ‘burn bag’ to breakdown some of the most pressing security challenges of today’s world with the people who have worked and lived them.

CLICK TO LISTEN

From artificial intelligence and data mining to social media and dating apps, tech has touched our lives on every level. In Tech for Evil (Tech4Evil.com) podcast, we talk about the impact of Big Tech on our minds, planet and liberties. We also expose what Big Tech doesn’t want you to know and what you can do about it.

CLICK TO LISTEN WOMEN IN SECURITY MAGAZINE

141

TURN IT UP

WOMEN IN SECURITY PODCAST With Lifen Tan Of information & cyber security and the great women who make it turn.

In each episode, I sit down with a guest speaker to discuss their experiences and touch on some of the lesser known aspects of the industry. We’ll shed light on the routes to the various technical and non-technical roles in this space, as well as exploring the skillsets required to be successful.

CLICK TO LISTEN

WOMEN IN NATIONAL SECURITY With Abigail Bradshaw In this episode, Head of the Australian Cyber Security Centre (ACSC) and Deputy Director-General of the Australian Signals Directorate (ASD) Abigail Bradshaw explains the steps the ACSC has taken to achieve gender balance in their workforce and how they support working families. They also discuss her love of leadership and approach to helping others become amazing leaders themselves.

CLICK TO LISTEN 142

W O M E N I N S E C U R I T Y M A G A Z I N E

HERHAX PODCAST With HerHax HerHax Podcast was founded by a group of women who are passionate about the field of cybersecurity and want to spread the word about everything cyber!

From the history of women in cryptography to modern day workplace tips, how to stay safe online or how to pwn your way to the top of the CTF scoreboard, come listen to our podcast and join our Discord Channel!

2 CYBER CHICKS PODCAST With Erika McDuffie and Jax Scott 2 Cyber Chicks is an inclusive cybersecurity podcast designed to educate and break the stereotypes of cybersecurity professionals.

We will be discussing the “tough” topics that come along with being a woman in this field while providing life hacks on how to handle burnout, networking, and goal-setting.

CLICK TO LISTEN

CLICK TO LISTEN

CYBER WARRIOR

THERE ARE NO GIRLS ON THE INTERNET

With Nigel LeBlanc In this episode, Amanda Lee Keammerer, Founder and CEO of Javilud LLC, comes up with a deep conversation about gender inequality in cybersecurity with five unique and super talented women with different backgrounds, experiences, and journeys into the industry. Participating with us today is Annalise Buonya, a leader in cyber security who placed top 25 last year in the Cyber Wraith Tournament.

CLICK TO LISTEN

With Bridget Todd Marginalized voices have always been at the forefront of the internet, yet our stories often go overlooked. Bridget Todd chronicles our experiences online, and the ways marginalized voices have shaped the internet from the very beginning. We need monuments to all of the identities that make being online what it is.

So let’s build them.

CLICK TO LISTEN M AY • J U N E 2023

VISION & VOICE With Naomi Buckwalter On June 30th, SafeGuard Cyber hosted a leadership panel called, ”Vision & Voice: Removing Barriers for Women in Cybersecurity.”

It was so well attended, that we wanted to make it available to a wider audience. This conversation featured insights from women cyber leaders Naomi Buckwalter, Amy De Salvatore, and Evelyn de Souza.

CLICK TO LISTEN

SMART WOMEN, SMART POWER PODCAST With Cera Baker This biweekly podcast features powerful, in-depth conversations with women leaders from around the globe who are experts in foreign policy, national security, international business, and international development. It ranks among the top non-profit and government podcasts.

CLICK TO LISTEN I S S U E 14

CREATING CONNECTIONS: EMBRACING OPPORTUNITY With Gloria Steinem We know that our industry is full of change and with that change comes opportunity whether it is for a new role, a new company, or a completely different path. I am here to tell you to go for it! Take that step, work toward your dreams and embrace the opportunity in front of you.

CLICK TO LISTEN

WOMEN IN SOFTWARE AND CYBERSECURITY With Grace Lewis In her work at the SEI, Grace Lewis focuses on securely pushing cloud resources to the edge and integrating IoT devices into systems. In this SEI Podcast, Lewis discusses her career journey, which led to her leading Tactical Edge Computing at the SEI.

CLICK TO LISTEN

NATIONAL SECURITY PODCAST

STORYTELLING IN TECH

With Nina Davidson, Catherine Burn and Abigail Bradshaw

With Miri Rodriguez

To celebrate the final episode of the Women in National Security mini-series, the ANU National Security College hosted a networking event and live podcast recording with more than 250 women at the National Gallery of Australia.

CLICK TO LISTEN

Marketing and storytelling are important components of product development because they allow companies to reach their audience and share their message.

Miri Rodriguez explained what storytelling is and its role in brand development. Miri is the author of the book Brand storytelling: Put Customers at the Heart of Your Brand Story.

CLICK TO LISTEN WOMEN IN SECURITY MAGAZINE

143

OFF THE SHELF

BUILDING THE BRIDGES TO SECURITY

ORGANIZATIONAL INTELLIGENCE: CYBERSECURITY AS A PERFORMANCE OPTIMIZER

Author // Miriam Fernandez Over the years, I have solely resided in IT (Information Technology) organizations, until now, where I work in a more evolutionary function.

My achievements have directly supported the businesses that depend on IT to run. Core competencies include engineering and administration of the network backbone, plus UNIX servers supporting the IT Infrastructure.

These directly connect the IT environment to the business groups and functions.

Author // Rhonda Farrell Recent cybersecurity innovations in both technology and standards, set a new tone for organizations, allowing for cyber-intelligence to be capitalized on by focusing on continuous collection, analysis, policy enforcement, and remediation at multiple enterprise levels. Vast improvements in governance, risk, and compliance management follow.

BUY THE BOOK

HIDDEN DANGERS OF INTERNET OF THINGS Author // Martha Daniel Computer security has evolved over the past 25 years as innovative technologies embrace wireless telecommunication integrating information and data and connecting the world globally.

I can remember in the early 1990s the announcement that the “Super Highway” was coming with the prediction that it was going to significantly change the way we do business, the way we live, and the way we work.

BUY THE BOOK

BUY THE BOOK

COLIN CALLS THE HELP DESK Author // Elwood Scott Colin Calls the Help Desk is a hilarious and relatable take on the absurdities of office life.

Follow Colin the Koala as he dives into a series of mandatory workshops to identify why people think there’s too many meetings, conflicting “work smarter” initiatives, and an IT Help(?) Desk who keep emailing him the login details to access his computer.

Q. I notice there’s a koala on the cover. Is this a book for kids?

A. Not if you ever want them to get a job. Colin Calls the Help Desk is a satirical look at the corporate life Our hero just happens to be a positive and perhaps slightly naïve koala.

Q. But aren’t koalas generally naked, drunk or spending their time sleeping or catching Chlamydia?

BUY THE BOOK

144

A. No, you’re thinking of Bryan from Accounting. Colin wears a suit, is sober, and excited to lean-in, add value and grab the low hanging fruit.

W O M E N I N S E C U R I T Y M A G A Z I N E

M AY • J U N E 2023

ALPHA GIRLS: THE WOMEN UPSTARTS WHO TOOK ON SILICON VALLEY’S MALE CULTURE AND MADE THE DEALS OF A LIFETIME Author // Julian Guthrie “In Alpha Girls, award-winning journalist Julian Guthrie takes readers behind the closed doors of venture capital, an industry that transforms economies and shapes how we live. We follow the lives and careers of four women who were largely written out of history - until now.

Magdalena Yesil, who arrived in America from Turkey with $43 to her name, would go on to receive her electrical engineering degree from Stanford, found some of the first companies to commercialize internet access, and help Marc Benioff build Salesforce. Mary Jane Elmore went from the corn fields of Indiana to Stanford and on to the storied venture capital firm IVP - where she was one of the first women in the U.S. to make partner - only to be pulled back from the glass ceiling by expectations at home.

Theresia Gouw, an overachieving first-generation Asian American from a working-class town, dominated the foosball tables at Brown (she would later reluctantly let Sergey Brin win to help Accel Partners court Google), before she helped land and build companies including Facebook, Trulia, Imperva, and ForeScout.

Sonja Hoel, a Southerner who became the first woman investing partner at white-glove Menlo Ventures, invested in McAfee, Hotmail, Acme Packet, and F5 Networks. As her star was still rising at Menlo, a personal crisis would turn her into an activist overnight, inspiring her to found an all-women’s investment group and a national nonprofit for girls.

These women, juggling work and family, shaped the tech landscape we know today while overcoming unequal pay, actual punches, betrayals, and the sexist attitudes prevalent in Silicon Valley and in male-dominated industries everywhere.

QUIETLY VISIBLE: LEADING WITH INFLUENCE AND IMPACT AS AN INTROVERTED WOMAN Author // Carol Stewart “You don’t look like an introvert” was a statement made to the author whilst at a networking event, and she thought to herself, what on earth is an introvert supposed to look like...

Many misconceptions exist about what introversion is, and this was just one of them.

These misconceptions can lead to people having an unfavourable, unconscious bias towards those who identify as introverts when it comes to developing talent in the workplace. The challenges women face getting to senior leadership roles is well documented, and for the introverted woman who, dealing with those challenges, along with the challenges many face as introverts, can make the leadership journey even more difficult.

However, just because someone is not loud and gregarious, it does not mean that they are not great, effective leaders. This book addresses many of the challenges that introverted women face as leaders and shows how these challenges can be overcome. Some of the challenges are due to the self limiting beliefs they hold about themselves, or they may be as a result of unfavourable bias and misconceptions about what introversion is, or they may be a combination of both.

Quietly Visible is written from the perspective of the lived experience of the author (herself an introvert), her clients, her research, and the many, many introverted women across the globe who regularly share their experiences and challenges with her.”

Despite the setbacks, they would rise again to rewrite the rules for an industry they love. In Alpha Girls, Guthrie reveals their untold stories.”

BUY THE BOOK I S S U E 14

BUY THE BOOK WOMEN IN SECURITY MAGAZINE

145

OFF THE SHELF

THE INNER HISTORY OF DEVICES Editor // Sherry Turkle “For more than two decades, in such landmark studies as The Second Self and Life on the Screen, Sherry Turkle has challenged our collective imagination with her insights about how technology enters our private worlds.

In The Inner History of Devices, she describes her process, an approach that reveals how what we make is woven into our ways of seeing ourselves. She brings together three traditions of listening--that of the memoirist, the clinician, and the ethnographer. Each informs the others to compose an inner history of devices.

We read about objects ranging from cell phones and video poker to prosthetic eyes, from Web sites and television to dialysis machines. In an introductory essay, Turkle makes the case for an “intimate ethnography” that challenges conventional wisdom.

One personal computer owner tells Turkle: “This computer means everything to me. It’s where I put my hope.” Turkle explains that she began that conversation thinking she would learn how people put computers to work. By its end, her question has changed: “What was there about personal computers that offered such deep connection?

What did a computer have that offered hope?”

BUY THE BOOK 146

W O M E N I N S E C U R I T Y M A G A Z I N E

ALONE TOGETHER: WHY WE EXPECT MORE FROM TECHNOLOGY AND LESS FROM EACH OTHER

IN SECURITY: WHY A FAILURE TO ATTRACT AND RETAIN WOMEN IN CYBERSECURITY IS MAKING US ALL LESS SAFE

Author // Sherry Turkle

Author // Jane Frankland

“A groundbreaking book by one of the most important thinkers of our time shows how technology is warping our social lives and our inner ones.

Women are fundamentally different to men and, when it comes to cybersecurity, one thing is certain. . .IF YOU’RE SHORT ON WOMEN YOU’RE LESS SAFE.

Technology has become the architect of our intimacies.

Online, we fall prey to the illusion of companionship, gathering thousands of Twitter and Facebook friends, and confusing tweets and wall posts with authentic communication. But this relentless connection leads to a deep solitude.

Women matter in cybersecurity because of the way they view and deal with risk. Typically, women are more risk averse, compliant with rules, and embracing of organisational controls and technology than men. They’re also extremely intuitive and score highly when it comes to emotional and social intelligence, which enables them to remain calm during times of turbulence – a trait that’s required when major security breaches and incidents occur. As cybercrime, terrorism and warfare is increasing, and the number of women in cybersecurity is declining, now is the time to take action.

MIT professor Sherry Turkle argues that as technology ramps up, our emotional lives ramp down.

Based on hundreds of interviews and with a new introduction taking us to the present day, Alone Together describes changing, unsettling relationships between friends, lovers, and families.”

BUY THE BOOK

By combining stories, interviews and data with practical advice, the golden rules and checklists, IN Security provides the means to turn things around. When you read this book you’ll understand why the numbers of women have fallen, along with strategies for attracting, identifying, and retaining more women in cybersecurity.

BUY THE BOOK M AY • J U N E 2023

THE RISE OF THE CYBER WOMEN: VOLUME ONE: INSPIRATIONAL STORIES FROM WOMEN WHO ARE TAKING THE CYBER SECURITY INDUSTRY

BY STORM Compiled by // Lisa Ventura “The Rise of the Cyber Women” is a compilation of inspiring stories from women in the cyber security industry from all over the world who are pioneers and leading the way in helping to protect the world from the growing cyber threat.

Those who are included and featured in this book shared not only their stories but also their hints, tips and advice to women who are looking to pursue a career in cyber security or change their career path into cyber security.

Their tenacity and commitment to their careers in the cyber security industry is very impressive indeed.

If you are a woman who is looking to make the move into the cyber security industry, you need to read this book.

If you feel that you are not good enough for a career in cyber security, you need to read this book. If you suffer from “impostor syndrome” which is holding you back from a career in cyber security, you need to read this book.

BUY THE BOOK I S S U E 14

SECRETS OF SIXFIGURE WOMEN: SURPRISING STRATEGIES TO UP YOUR EARNINGS AND CHANGE YOUR LIFE

HOW WOMEN RISE: BREAK THE 12 HABITS HOLDING YOU BACK FROM YOUR NEXT RAISE, PROMOTION, OR JOB

Author // Barbara Stanny

Author // Sally Helgesen and Marshall Goldsmith

“Quietly and steadily, the number of women making six figures or more is increasing and continues to rise at a rate faster than for men. From entrepreneurs to corporate executives, from whitecollar professionals to freelancers and part-timers, women are forging careers with considerable financial success.

In Secrets of Six-Figure Women, Barbara Stanny, journalist, motivational speaker, and financial educator, identifies the seven key strategies of female highearners: A Profit Motive, Audacity, Resilience, Encouragement, Self-Awareness, Non-attachment, and Financial Know-How.

Leadership expert Sally Helgesen and bestselling leadership coach Marshall Goldsmith have trained thousands of high achievers -men and women -- to reach even greater heights.

Again and again, they see that women face specific and different roadblocks from men as they advance in the workplace. In fact, the very habits that helped women early in their careers can hinder them as they move up. Simply put, what got you here won’t get you there . . . and you might not even realize your blind spots until it’s too late.

Based on extensive research and hundreds of interviews, including more than 150 women whose annual earnings range from $100,000 to $7 million, Barbara Stanny turns each of the six-figure traits into a specific strategy for upping earnings. By rigorously finetuning them, readers can, step-bystep, climb the income ladder.”

BUY THE BOOK

BUY THE BOOK WOMEN IN SECURITY MAGAZINE

147

SURFING THE NET

EMPOWERING WOMEN IN CYBERSECURITY

By Joanne Fisher Every woman in cybersecurity should be empowered.

Cybersecurity innovation thrives on diversity of thought and background. And the cyber community needs more of both.

We recognize every woman who continues to pave the way for change.

READ BLOG

MULTILATERAL CYBER NEGOTIATIONS AND GENDER MAINSTREAMING: A COMPLICATED RELATIONSHIP

By Liliya Khasanova The protests in Iran in the name of Mahsa Amini are one of many examples of how the advancement of technology enables us to speak up, spread the word, and learn about human rights violations.

Online anonymity and, therefore, reduced accountability for gender-based violence affects the vulnerability of individuals. There is no doubt now that the internet has become the most consequential communication technology of the human rights era.

READ BLOG 148

W O M E N I N S E C U R I T Y M A G A Z I N E

FEMGINEER

By Poornima Vijayashanker “Poornima Vijayashanker started Femgineer in 2007 as a creative platform for sharing her experiences working as the founding engineer with Mint. com. Thirteen years later, the organisation has developed into an education company for tech professionals wanting to build software products and companies.

The blog is built around the concept of sharing learnings to innovate and inspire, and covers topics such as hiring tech professionals and the benefits of putting the customer at the centre of product creation.

ALWAYS SIA STRIKE

By Sia

Their website also has a range of online courses covering technical skills improvement as well as soft skills such as communication.”

Sia’s data analytics engineering and growth online hub. I’m a senior data analytics professional with experience as a data ops and pipeline management lead; including data cleaning, wrangling, analysis, visualization, and storytelling. With extensive teaching experience and a love of learning, sharing, and writing, I’m interested in working on and finding solutions to challenging data.

READ BLOG

READ BLOG M AY • J U N E 2023

POINTERS GONE WILD

BLACK GIRL BYTES

By Maxime Chevalier-Boisvert

By Rizel

“We don’t always think of it this way, but on modern machines, memory and pointers are an abstraction. Today’s machines have virtual memory, divided in blocks called “pages”, such that the addresses represented by pointers don’t necessarily map to the same address in physical RAM. In fact, mmap even makes it possible to map files to memory, so some of these addresses aren’t even mapped to RAM addresses at all.

“In this tutorial, we will build a rock, paper, scissors game with GitHub Copilot. We will also explore GitHub Copilot, a cloud-based AI tool that assists users of various editors in suggesting lines of code and whole functions instantly.

We will discuss how Copilot has redefined productivity for millions of developers, and the benefits it provides. This tutorial includes the use of CodeTour, a VS Code extension, that allows developers to create and follow a guided walkthrough of a codebase. Let’s get started!

Two weeks ago, I wrote about UVM, the small virtual machine I’ve been building in my spare time. This VM has a relatively low-level design where it has untyped instructions and pointers for instance. Generally speaking, I’ve done my best to design the VM to be fairly “conventional”, in the sense that most design elements are aligned with common practice and unsurprising. In my opinion, this is important because it keeps the design approachable to newcomers. Having a design that’s unsurprising means that new users don’t need to read a 100-page manual and familiarize themselves with new terminology to get something done.”

READ BLOG

I S S U E 14

What is GitHub Copilot?

GitHub Copilot has helped redefine productivity for millions of developers by introducing them to the magic of AI assistance. GitHub Copilot is a cloud-based artificial intelligence tool developed by GitHub and OpenAI to assist users of Visual Studio, Visual Studio Code, Neovim, and JetBrains by suggesting lines of code and whole functions instantly. With Copilot, you can write a regular expression or interact with an API for the first time without leaving your editor.”

READ BLOG

FOREGROUNDING MARGINALISED VOICES ON PEACE AND SECURITY IN AUSTRALIA

By Dr Lisa Carson “In this blog, WPS Coalition member Dr Lisa Carson makes the case for an intersectional and intergenerational approach to building peace.

The theme of this year’s International Day of Peace was ‘End racism. Build peace’. The day is observed by the UN General Assembly and is devoted to strengthening the ideals of peace with calls for a 24 hour ceasefire globally. As the UN highlight, ‘achieving true peace entails much more than laying down arms. It requires the building of societies where all members feel that they can flourish. It involves creating a world in which people are treated equally, regardless of their race’.

READ BLOG

WOMEN IN SECURITY MAGAZINE

149

SURFING THE NET

DEEPFAKES AS A SECURITY ISSUE: WHY GENDER MATTERS

By Agnes E. Venema In some ways, deepfakes are to video what photoshopping is to images. Just like photoshopped images, some are created better than others. It involves the manipulation of videos in such a way that, when well-made, it is impossible to distinguish from an original video. Deepfakes can be created in roughly two different ways: image creation and morphing. Image creation is a process by which a neural network looks at faces and creates their own image based on the samples it has been given. An example of image creation is the website ThisPersonDoesNotExist.

Deepfakes created through morphing merge one face with another, or superimpose expressions of one face onto another, creating video. Combined with voice cloning or using voice actors, morphing can lead to incredibly realistic videos that are entirely fictitious, such as the deepfake of President Nixon delivering the speech that was prepared in case of a moon landing disaster. A distinction must be made between deepfakes and “cheapfakes.” The latter is the manipulation of existing footage by slowing down or speeding up certain sections to exaggerate part of the video or by selectively editing content. Both U.S. Speaker of the House Nancy Pelosi and U.S. journalist Jim Acosta became the target of cheapfake”

READ BLOG 150

W O M E N I N S E C U R I T Y M A G A Z I N E

REFLECTING ON ONE VERY, VERY STRANGE YEAR AT UBER

By Susan Fowler “As most of you know, I left Uber in December and joined Stripe in January. I’ve gotten a lot of questions over the past couple of months about why I left and what my time at Uber was like. It’s a strange, fascinating, and slightly horrifying story that deserves to be told while it is still fresh in my mind, so here we go.

I joined Uber as a site reliability engineer (SRE) back in November 2015, and it was a great time to join as an engineer. They were still wrangling microservices out of their monolithic API, and things were just chaotic enough that there was exciting reliability work to be done.

The SRE team was still pretty new when I joined, and I had the rare opportunity to choose whichever team was working on something that I wanted to be part of.

BECAUSE I’M A GIRL

By Katie Burke “I was promoted a few weeks ago, which was great. I got a lot of nice notes from friends, family, customers, partners, and random strangers, which was exciting.

But it wasn’t long until a note came in saying “everyone knows you got the position because you’re a girl.” And in spite of having a great week at a great company with great people I love, that still stung, because it’s not the first time I’ve heard it.

You see, every woman who works in tech (heck, likely every woman on earth) hears “because you’re a girl” dozens if not thousands of times in her life.”

READ BLOG

After the first couple of weeks of training, I chose to join the team that worked on my area of expertise, and this is where things started getting weird. On my first official day rotating on the team, my new manager sent me a string of messages over company chat. He was in an open relationship, he said, and his girlfriend was having an easy time finding new partners but he wasn’t. He was trying to stay out of trouble at work, he said, but he couldn’t help getting in trouble, because he was looking for women to have sex with. It was clear that he was trying to get me to have sex with him, and it was so clearly out of line that I immediately took screenshots of these chat messages and reported him to HR.”

READ BLOG M AY • J U N E 2023

THE

2023 WOMEN IN SECURITY AWARDS

Don’t miss the largest security awards of the year!

12

NEW ZEALAND WOMEN IN SECURITY AWARDS

9

OCTOBER

NOVEMBER

womeninsecurityawards.com.au

womeninsecurityawards.co.nz

WANT TO BE PART OF IT? Register your interest today by contacting aby@source2create.com.au