Magazine menu Close Magazine menu

Women and diversity

Latest stories

neurodiversity interview nicola whiting

How cybersecurity businesses are welcoming neurodiverse talent

  • min read
    • Neurodiversity's importance in organizations is gaining steam, with many large, tech-rich enterprises like Ford, IBM and Microsoft reforming their HR processes to ensure they recruit and retain neurodiverse talent. Neurodivergent people have conditions that mean they think differently than others, for example, autism, attention deficit hyperactivity disorder (ADHD) and dyslexia. I asked Nicola Whiting MBE, co-owner of Titania Group and NeuroCyber board member,  why neurodiversity matters in cybersecurity and how businesses can be more inclusive and supportive of neurodivergent employees. Gemma: Why is neurodiversity important? Nicola: Neurodiversity – where you have many different thinking styles and perspectives – increases the range of ideas in a business, which means competitive advantage in innovation and resilience. It's the opposite of groupthink – when everyone has similar ideas, so businesses stagnate and make poor decisions. More personally, being autistic, I'm saddened by how many brilliant neurodivergent people struggle to get jobs in our industry, despite the known skills gap. JPMorgan Chase reported in 2021 that neurodivergent employees in certain tech roles may be up to 140 percent more productive than neurotypical colleagues. However, businesses still struggle to build inclusive practices that let all neurotypes thrive. I want to help change that. You're on NeuroCyber's advisory board. What are its aims? NeuroCyber's founder and CEO, Mike Spain, has a neurodivergent son. He saw too few opportunities for neurodivergent people in cybersecurity and wanted to change that. NeuroCyber believes in inclusion at every level – over half the board are neurodivergent. We're driven to improve career outcomes for neurodivergent colleagues, enriching the sector and reducing the UK's cyber skills gap. Why does the cybersecurity industry especially benefit from neurodiversity? In cybersecurity, everything we do is either innovation – creating new things – or resilience against attack and business threat. Neurodiversity is essential for both. For example, if you follow the principle 'to defeat an attacker, you must be able to think like an attacker,' you need a variety of neurotypes because attackers are similarly varied. What about in leadership? Should boards and C-suites consider neurodiversity? Absolutely. Boards should be especially wary of groupthink. Many innovative, well-known entrepreneurs are neurodivergent, like Richard Branson, who is dyslexic, and Elon Musk, who is autistic. There are also many neurodivergent industry leaders who don't disclose the fact because they fear stigma. Which cyber organizations are 'doing it right' with neurodiversity? One organization I admire is Genius Within, founded by Dr. Nancy Doyle. They believe in creating inclusive workplaces, allowing neurodivergent people to thrive and maximize their talents and strengths. What's your advice for companies that want to become more diverse and inclusive of neurodiversity? Follow the principle of 'nothing about us without us' (NAUWU.) Teams that can drive their processes and practices are more engaged and have better outcomes. You should also acknowledge that people have unconscious bias that draws them to prefer working with people that look and think like themselves. You can see it in the questions we prioritize in recruitment like, "Will this person fit with the team?" rather than, "What new skills and talents will they bring, and how will we support them?" There's plenty of fantastic advice on reducing bias in hiring and retaining team members, much of which is free. Companies needn't look far to learn how to improve their processes, practices and culture for greater diversity and inclusion. What will organizations gain if they take action on neurodiversity? Taking action on neurodiversity can mean benefits in terms of growth, innovation and resilience to risk. You'll also gain the personal benefits of inclusive, welcoming work environments. It always pays to diversify. Opinions reflect those of the expert. Interview has been edited for clarity.
returnship programs

How return-to-work programs boost retention for women in tech

  • min read
    • Mothers returning to work after a career break to raise children face many challenges, from closed doors to employers penalizing resumé gaps to being expected to take a backward step for a more family-friendly role. Research by the Association of British Insurers in 2018 found having children leads to women earning 20 percent less than men long-term. UK charity Pregnant then Screwed's data shows around 62 percent of women returners work fewer hours, change jobs or stop working because of high childcare costs. Support in returning to work How can companies support women to thrive in the workforce while closing the gender pay gap? Harvard Business Review names "returnships," or return-to-work programs, as one of the top five ways. PWC research shows better supporting returners could raise UK women's earnings 1.1 billion British pounds (around 1.5 billion US dollars) while boosting the UK economy 1.7 billion British pounds ($2.3 billion US dollars.) Meta, formerly Facebook, launched its returnships program. People who've been away from work for two years or more and want to re-enter full time are eligible for the 16-week, immersive, paid program. If you show ability to succeed after training and mentorship, you're considered for a full-time position. Returning without starting from scratch With a nearly four-year resumé gap after having two children, IT professional Zandra Otubamowo anticipated picking up her career where she'd left it. But after a string of rejections, she had to consider starting from scratch. She says, "I had many mixed feelings, but the one that stands out was the frustration of trying to get something you know you want, but it's not coming, and you don't know what else to do." Otubamowo continues, "In that gap, it's not like I was sitting at home, just taking care of my family. I was still learning about the technical world, doing training and connecting with people. So what didn't I have? I felt like the gap was the reason." A friend told Otubamowo about Meta's Return to Work program. She applied immediately and started her role as Technical Program Manager in September 2020. Meta hopes its Return-to-Work initiative will help double female employees globally by 2026 – women are currently around 37 percent of their workforce. "The support in the program was like being put into a bubble to protect us, which you don't get when you just come in normally," Otubamowo says. "From my manager to my mentor and my buddy, there were so many people put in place for me to make sure I succeed. You're coming into a space where things are moving so quickly, but in the program, people help you move at your pace. I don't think I could have survived otherwise." "We need more women to feel comfortable coming back into the workforce and not feel like they have to take a paycut or fall behind – that you are going to be given what you deserve," says Otubamowo. Bridging the gender gap Financial services group Nomura launched its Returners Program in 2019 as part of a plan to increase numbers of women in the business. The program gives 12 weeks' induction, training and coaching to anyone who's had a career break of 18 months or more, after which candidates can apply for positions at the company. Most succeed. Nomura is aiming for 33 percent female employees and has so far reached 31 percent. They want 19 percent working at senior level and have reached 14 percent. After a seven-year career break to care for two young daughters, Rachael Grieve recalls jumping back into the job market in 2019 and finding nothing but despair. The yawning gap in her resumé left her with few opportunities that suited her experience and ideal schedule. After a failed interview for an office manager position, "I went home and burst into tears, thinking, "That's it – I'm done." It felt like all these doors were closed. I still remember that desperation and fear, especially after interviews destroy your confidence. You find yourself stuck as to where to go." Soon after, a chance conversation with a friend who still worked at her previous employer, Nomura, led to Grieve returning and setting up the company's Returners Program. Shereen Peeroo Finney, a cybersecurity architect, joined Nomura in 2019 through the program after taking two years away to reassess her career direction and retrain. "We had resumé advice, practice interviews, external mentoring and a 90-day plan. The program helps you regain confidence a lot faster," Peeroo Finney says. Securing the right support and partners for success Tackling gender inequality isn't easy, admits Grieve, now Nomura's global head of learning and development for technology. She feels strongly about leading this program, so it becomes a standard part of Nomura's diversity, equality and inclusion strategy. "Our Chief Information Officer from day one was 100 percent supportive," Grieve says. "It made a massive difference to be given the platform and sponsorship. I also made sure all senior managers understood the caliber of candidates we were getting through it." Specialist firm Inclusivity Partners helps run Nomura's returnship program and similar programs for Shell and Virgin Money. Inclusivity Partners founder Stephanie Dillon says, "If you want to make the difference for women, they need a job. They need pension contributions. They need financial independence. With return programs, you're providing a job opportunity. Now [when the candidate is] back in the market, other companies think, "that's a good candidate," rather than fixating on the career break."

Report: Three steps to superior cybersecurity

  • min read
    • The threat of cybersecurity weighs heavily on enterprises now more than ever. Technology researchers Gartner say new ransomware models alone are the biggest emerging risk organizations face today — bigger than the pandemic and supply chain disruption. But new research from Kaspersky in association with Longitude, a Financial Times company, shows enterprises are not prepared. Less than one in 10 are very well prepared to deal with cyberattacks by professional cybercriminals (9  percent,) lone hackers (7 percent) and nation states (6 percent.) The research surveyed 750 leaders at enterprises around the world about their approach to cybersecurity. Respondents, representing companies from many regions and industries of at least 1,000 employees, were those who knew their organization's cybersecurity strategy. Enterprises unprepared for cyberattacks "Most people are completely unprepared," says Shawnee Delaney, CEO of US-based insider threat specialist Vaillance Group. "Every day, something changes: There's a newer, better virus, a new technique, a new modus operandi. It's impossible to keep up with everything, and that's frightening for everyone." Delaney is more prepared than most, with her company's security credentials and her background at the Defense Intelligence Agency conducting clandestine intelligence operations around the world. According to Kaspersky's research, the main reason companies are not prepared is reliance on legacy technology vulnerable to today's threats. They also lack financial resources to recruit or consult skilled security professionals. The risk is real, and companies are not prepared. What can they do? Kaspersky's research shows three things they can change for better security outcomes. Step 1: Make cybersecurity teams more diverse Diversity and inclusion is high on the business agenda, thanks partly to movements like #MeToo and Black Lives Matter. There's also a strong business case for it. Research by management consultancy McKinsey & Company shows companies in the top quartile for gender diversity on executive teams were 25 percent more likely to have above-average profitability than those in the bottom quartile. Businesses expect cybersecurity to benefit from diversity too. In Kaspersky's research, most enterprises (62 percent) believe creating a more diverse and inclusive cybersecurity team will be important in the next two years. They're right to focus on this because there's a long way to go. Figures from the UK National Cyber Security Centre show 85 percent of professionals working in cybersecurity are white and 66 percent are male. Kaspersky's research finds cybersecurity teams benefit from being more diverse and inclusive. A fifth (20 percent) of respondents strongly believe they're actively improving diversity and inclusion in their cybersecurity teams. The data shows this small group, which Kaspersky calls the Diversity Leaders, is much better prepared to deal with a range of cybersecurity attacks. Kaspersky's Diversity Leaders have also been quicker to learn from the pandemic. They are more likely than others to be planning for a major crisis through real-world cyberincident training (68 percent of Diversity Leaders versus 54 percent of the rest.) There are more than three million unfilled positions in cybersecurity globally, according to cybersecurity professional organization (ISC)². Darren Argyle, group chief information security risk officer at international bank Standard Chartered, believes improving diversity on teams can help fill vacant spots. In 2021 Standard Chartered launched its Cyber Acceleration Programme (CAP.) About 50 women have participated so far. A 'skill-up and scale-up' program, CAP provides junior and mid-level women with self-paced modules on cybersecurity and leadership. On top of the learning modules, groups of up to ten women are assigned to senior cybersecurity leaders and undergo a 12-week mentoring program. "We're creating a leadership framework that women can engage with," says Argyle. "They work with role models in the bank, who are predominantly women, on areas they might want to develop." Step 2: Closely integrate the C-suite with cybersecurity teams C-suite (senior management) leaders have broad and high-level remits, while cybersecurity professionals focus on the details of cyberthreats. They are not obvious partners. But Kaspersky's research shows that when enterprises build strong links between the two, they experience better security outcomes. A quarter (26 percent) of respondents believe strong integration between the C-suite and cybersecurity teams will be very important in the next two years. The data shows this small group, which Kaspersky calls the Integration Leaders, is better prepared to deal with cyberattacks. UK IT giant Softcat closely aligns its C-suite and cybersecurity teams. Responsibility for risk — including cybersecurity — ultimately rests with its CEO, Graeme Watt. "I am the key stakeholder for security within the board. I have a Chief Information Officer (CIO) who reports directly to me, and the information security team sits under them," he says. "I am the person the board looks to on cyber risks, but I don't do all the reporting myself. I bring the CIO into the board meeting when we're talking about cybersecurity risk." The company faces scrutiny of its cyber risk status from many sources. As a public company, it is subject to external audit. It has its own internal audits. As an IT company that offers security products and services, its reputation among customers depends on its own security standards. Watt works closely with its cybersecurity team to ensure standards are met, but elsewhere in the Softcat C-suite other leaders also have responsibility for cybersecurity. Indian manufacturer Shriram Pistons and Rings takes a similar approach and keeps its security expertise close to the C-suite. 'Shop floor' digitization is a priority for the company, and it plans to use the internet of things (IoT) extensively across its facilities. Its chief digital officer Prashant Khairnar, hired to drive digitization from 'shop floor to top floor,' explains that the leadership team takes security seriously. "When we do risk assessments, cybersecurity is always the top concern," he says. "Of course, I am not a cybersecurity expert, but the person who handles this area is, and he reports directly to me. I take a more strategic view, and he focuses on day-to-day security and the technical issues." Cybercrime is increasing rapidly. Data from technology market analysts Canalys shows 30 billion data records were stolen globally in 2020 – more than the previous 15 years combined. Evgeniya Naumova, executive vice president of corporate business at Kaspersky, says the rise in cybercrime has made the C-suite wake up to the threat. "I think the importance of information security was highlighted to the C-suite and top management during the Covid-19 pandemic," she says, suggesting the increased security risks of remote working captured leaders' attention. "There was a switch — a really obvious switch — in their minds. They understood that it's not just something to observe from afar — it needs to be top of their minds." Step 3: Invest in high-quality cybersecurity training It's no secret that a skilled cybersecurity team is essential to fighting cybercrime. But with four million unfilled vacancies in cybersecurity globally, there is a major skills shortage. A third (34 percent) of companies in Kaspersky's research believe the shortage will get worse in the next two years. Skills and training programs help fill this gap. But to stay relevant, these schemes must be kept up to date. The Kaspersky research identifies a very small group of companies, eight percent, that strongly believe their cybersecurity training programs can keep pace with the evolving threat landscape. The data shows this group, which Kaspersky calls the Skills Leaders, has better security outcomes. Continuously updating skills and training programs eventually helps to make security part of the company's culture. This is essential, according to Vaillance's Delaney. And she thinks continuous training on basic cybersecurity principles is a good place to start. She continues, "Employees need to keep their software up to date, understand what the VPN is and how to use it and not use public Wi-Fi, for example. These are general cyber hygiene best practices critical to maintaining security." Kaspersky's Skills Leaders are more likely to innovate around their training. Two-thirds of Skills Leaders (67 percent) believe it will be very important to carry out immersive cybersecurity training in the next two years, compared with just 49 percent of the rest. The Skills Leaders are also more likely to embed cybersecurity awareness into their recruitment and onboarding process. Another innovative way to fill the skills gap in cybersecurity teams is to recruit from competitors, according to Standard Chartered's Argyle. But to do this, companies must adapt how they work. "If you look at the skills we want to try to attract into organizations around cybersecurity and technology, a lot of those skills don't necessarily sit in another bank," he says. "They sit in fintechs, technology organizations and cloud companies. So we need to be able to offer the same working environment as a large technology company like Google, Amazon or a fintech. And that's a very different way of working." Kaspersky's Naumova says security is every employee's responsibility. "We offer educational courses on how to change the behavior of everyone in the company," she says. "It's not just something the information security team should care about. It's the responsibility of everyone." She adds that companies must take a top-to-bottom approach to security, so everyone learns. "Some companies have an information security director or similar on their board," she says. "They promote them there because they understand they can lose business in a single day if security isn't done properly." The three steps create a virtuous cybersecurity circle Kaspersky's research shows enterprises are better prepared against cyberattacks if they increase diversity in cybersecurity teams, improve collaboration between the C-suite and cybersecurity teams, and invest in quality skills programs. But developing these in isolation is not the answer. The research shows each factor complements one another. For example, Kaspersky's Skills Leaders are more likely to create diverse and inclusive cybersecurity teams and integrate their C-suites and cybersecurity teams more closely. It's a virtuous circle that increases cybersecurity preparedness. The threat landscape is evolving quickly, and cybercriminals are becoming increasingly sophisticated. Businesses have no choice but to match sophistication with extreme preparedness.
engaging women

Infographic: Why women leave tech careers, and what to do about it

  • min read
    • In tech, there's much talk of what we can do to recruit more women. But we rarely talk about that even bigger problem: Once we recruit women into tech roles, they're more likely to leave the career than men. The good news is, leaders can do a lot to change that. How leaders can help more women (and men) stay engaged at work When it comes to retaining more women, the changes you make will likely benefit all staff. Work on these six areas to help keep everyone in your team engaged. 1.    Get better at onboarding Karen Holtzblatt of WITOps says, "50 percent of women are not clear about what to do to be successful. All new hires need to develop strong connections and knowledge and skill to succeed. Use our Team Onboarding Checklist to onboard right." 2.    Encourage valuing and belonging "Women need to feel belonging and value in their team," says Karen Holtzblatt. WITOps have engaging, practical activities to foster more supportive workplace behaviors. 3.    Use tools to reduce bias "Map the full employee experience and identify where bias influences career paths. Use tools and processes that mitigate human and automated biases," says Dr. Patricia Gestoso, BIOVIA's Head of Scientific Customer Support in Kaspersky's Women in Tech report 2021. 4.    Be all about mentoring Mentoring helps more women rise through the ranks, says global tech leader Margaret Dawson. Leaders should take opportunities to mentor and encourage team members to get a mentor. 5.   Take breaks and switch off 'Always on' work culture is bad for productivity and health, and affects women more because they're more likely to have care responsibilities. Lead by example: Take regular breaks, switch off after hours and encourage all in your team to do the same. 6.    Identify and challenge ways your business centers men Are employee benefits male-coded, like tickets to sporting events? Is competitiveness overly encouraged? Do after-work drinks loom large? Review benefits and offer what more women need, like flexible work and good parental leave. Infographic references 1 Accenture Resetting Tech Culture report 2021 2 Accenture Resetting Tech Culture report 2021 3 Pew Research 4 New study reveals key to the gender gap in C-suite 5 Karen Holtzblatt, WITOps 6 Kaspersky Women in Tech report 2020-21 7 WITOps onboarding research 8 WITOps onboarding checklist 9 Fostering more supportive behaviors 10 Kaspersky Women in Tech report 2020-21 11 Mentoring is hard but rewarding, and it's everyone's job 12 ACCA Global: The always-on culture is bad for productivity and health
financial times report diversity

Two great ways to build a more diverse cybersecurity team

  • min read
    • "A diverse team gives you different life experiences and strengths," says Shawnee Delaney, CEO of US-based insider threat specialist Vaillance Group. Diversity in your cybersecurity team is also a competitive advantage, according to new research. In partnership with Longitude, a Financial Times company, Kaspersky surveyed 750 leaders at enterprises around the world about their approach to cybersecurity. The research finds organizations that actively improve diversity and inclusion in their cybersecurity teams – named the Diversity Leaders for this reason – are better prepared to deal with a range of cyberattacks. For example, they are twice as likely (77 percent) to be prepared for 'black swan events' – sudden events with widespread impact, like a pandemic – than others in the sample (37 percent.) Organizations recognize the benefits of a diverse team. Six in 10 say creating a more diverse and inclusive cybersecurity team will be important in the next two years. They have work to do. Figures show 85 percent of cyber security professionals in the UK are white and 66 percent are male. And only 10 percent of women in IT work in a majority female team, another recent Kaspersky survey found. Two ways to rebalance your cybersecurity team 1. Recruit from different sectors "One of my engineers has no IT security background — he started as a musician," says Ricardo Lafosse, Chief Information Security Officer at multi-national food company Kraft Heinz. "He sees problems differently from me and that provides a whole new dynamic for how to solve an issue." Broadening the talent pool by hiring from unexpected places gives businesses a bigger picture when threatened. Diverse viewpoints make it possible to consider all the ways an invader could attack. "A diverse team gives you different life experiences and strengths," says Vaillance Group's Delaney. "A well-rounded team approaches challenges more creatively." 2. Build an inclusive culture Recruitment strategies are just the beginning. Companies must create an inclusive workplace culture so recruits feel welcome, nurtured and excited to build a career. The National Cyber Security Centre recently found that one in five UK cybersecurity professionals felt they couldn't be themselves at work. Meanwhile, research by Accenture and non-profit Girls Who Code revealed company culture is the top reason women leave a tech career. And a recent international Kaspersky survey found 44 percent of women in tech think men progress faster. "Teams are living organisms, and like all living organisms, they can be healthy and flourish — or not," says Evgeniya Naumova, Executive Vice President of Corporate Business at Kaspersky. Regional variation in valuing diversity in cybersecurity Cyber threats are global, but the research shows regions prioritize diversity and inclusion differently. For example, 84 percent of Australian leaders in the research said they were actively improving diversity and inclusion in their cybersecurity teams. In contrast, only 56 percent of those in Canada agreed with the statement. In Hong Kong and Italy, 72 percent agreed that creating a more diverse and inclusive cybersecurity team would be important in the next two years, but only 52 percent in the UK. This means multi-national organizations must ensure recruitment strategy and culture improvements happen across operations worldwide. Cyber threats are growing in number and severity, and businesses must do everything they can to protect themselves. Diversity might not always be a top-of-mind strategy, but the data shows it should be. As well as the powerful benefits of diversity and inclusion, a global strategy needs more senior leadership (C-suite) involvement. The research found companies with closely linked cybersecurity teams and C-suite are better prepared to manage attacks. If there is strong integration with senior leadership, cybersecurity is likely higher on the business agenda, and the team likely feels more valued, leading to better staff retention. "As cybersecurity leaders, we must push for diversity and ingrain these viewpoints into the fabric of our program," says Kraft Heinz's Lafosse. "The threat actors out there don't care about race or gender. If they find a good hacker, they're going to be part of their team. We need to be able to think that way."

How your air conditioning could start a cyberattack

  • min read
    • Many big businesses know they could be cybercrime targets and invest in defenses like software and training. That's why cybercriminals are increasingly attacking through smaller suppliers who don't have the same knowledge and resources. It's called a supply chain attack. In Tomorrow Unlocked's second episode in the hacker:HUNTER Behind the Screens series, Eliza-May Austin, CEO and co-founder of th4ts3cur1ty.company (That Security Company,) explains how US retail giant Target was attacked through a most unexpected device – the air conditioning. We ask Austin how businesses can prepare for supply chain attacks and how she thinks things are going for women in cybersecurity careers. In Tomorrow Unlocked's Hacker: HUNTER Behind the Screens video, you talk about the supply chain attack on Target in 2013. Why is this attack so important? Businesses must work with other businesses, which makes us all susceptible to a certain degree of risk. Take an airplane, for example. To go from concept to in the air involves hundreds of businesses, contractors and applications. It takes just one breach to compromise that trusted ecosystem. It's something we should all take seriously. Your business th4ts3cur1ty.company (That Security Company) helps companies large and small harden their supply chains. How do you do that? There are many things businesses can do to defend against supply chain attacks. For example, we run penetration testing, consult on governance, risk and compliance and importantly, logging, monitoring and vulnerability management. Are businesses becoming more aware of supply chain attacks and responding appropriately? I can't confidently say yes, which is why I'm vocal on the issue. I recently asked a small-to-medium company (SMB) that supplies services to the medical sector if they'd considered how an attack would impact their clients' security. I was met with such bemusement you'd think I'd asked for a sandwich. What's the most common problem making businesses vulnerable to supply chain attacks? Not knowing how prevalent it is. But also, some businesses that do understand the issue's scale get overwhelmed by it. These attacks aren't always sophisticated – simple measures can go a long way. How did you get into cybersecurity? I moved from a degree in forensic science to a degree in digital forensics, did some internships and the rest is history. You don't need a degree to be in cybersecurity. Is the industry giving women equal opportunities to enter and succeed yet? I think this industry, like any, is what you make of it. Cybersecurity is a fantastic career choice for women and should be promoted as such. What could employers do today to attract and retain more women? I get asked this a lot, so I wrote 15 ways to attract more women to your technical cybersecurity team. I've included simple, practical things like considering the physical environment. For example, if employees have to crawl around on the floor to plug in a laptop, that may feel degrading when wearing a skirt. I also recommend being more open-minded about what kind of people you need: What is Ladies Hacking Society (LHS) and why did you found it? LHS is an awesome community of women who come together to learn from one another and teach each other hacking. I wanted to create a technical option for women because I found mixed events were not really mixed (mainly men) whereas women's events revolved around governance or high-level theory. It's a lot of fun and a great bunch of people. Which is the most important lesson from your 11 leadership lessons from terrible managers, and why? Lesson 3: A sense of humor matters. People tend to take themselves too seriously. Encouraging people to laugh and joke does wonders for team morale and gets people through stressful times. Let's all calm down and have a giggle.  
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries