They say “a rising tide lifts all boats”. On the surface you might think the Infosec tide is already pretty high. There are more open jobs than experienced people to fill them, making it a candidate’s market, and each day brings us new and interesting problems to work on so we’re never bored. Not all is well in the Infosec harbor though.
Our industry’s life-blood communication platforms are often filled with gatekeeping and toxic negativity. Security can be a very unwelcoming or even hostile field for some of us, and this is a problem for all of us. Not only do we have a moral obligation to treat others as we ourselves would like to be treated, but attacking and excluding those with different backgrounds and experiences discourages innovation and makes it harder to fill important positions. Keeping our networks safe is hard enough without driving out the very people who want to help.
So how can we reshape our professional community to create a more diverse, inclusive space where we can all bring our best ideas, find help and inspiration when we need it, and encourage professional growth for ourselves and for those around us? Ignoring the problem and hoping it will go away is not an option. Solving this problem is going to, at a minimum, require us not only to be good humans but to be actively good humans. We need to take positive steps to counter the negative forces within our community. It may sound like a tall order, but there are three simple things we can all start doing today that will raise the tide for everyone in security.
Bring Positivity
First, we need to look for ways to bring positivity with us into our professional lives to combat all the negativity already out there. There are many ways to approach this, but one of the easiest is just to make a habit of saying “thank you”.
We all have people who have helped us on our security journey. They could be a professor, a co-worker, a mentor, an open-source tool developer, or just someone who’s work you appreciate. Whoever they are and whatever they did for you, we need to encourage those who spend their time lifting people up. An email, a Tweet, or a quick word in person is all it takes to let them know what they meant to you. A little gratitude and encouragement go a long way.
Lend Your Voice to the Conversation
Being an actively good human, of course, means that you have to be active. Put yourself out there and participate in the community! Just like that mentor, coworker, or professor before you, you need to pay it forward and contribute.
That may sound like a tall order, but the good news is there’s no one “right” way to do it. Use your knowledge, your experience, and your talents to contribute in any way that feels right for you. It’s sometimes hard to think of ways to contribute, especially if you are new to it, so here are a couple of ideas to use as a starting point:
- Engage with people in the community on Twitter. Share your opinion and observations, respectfully of course. Ask and answer questions to encourage productive and positive conversation.
- If you learn a new skill or come up with a cool new technique, share it. It can be as simple as a blog post explaining it or as exciting as sharing it onstage at a conference. No matter who you are or where you are in your security journey, you have skills and experiences that the community could benefit from.
By sharing what you’re good at with others, you’re not only helping everyone grow, you’re helping to drown out those negative voices. You’re also giving others the chance to be influenced by you. The experiences and innovations you share will fuel others’ innovations, which will fuel even more innovations. You may think that what you have to say is too small or too unoriginal to share, but it could be the start of something much larger down the line!
Turn Towards the Problems
In his 2016 commencement address at MIT, Matt Damon quoted some advice he was given by former president Bill Clinton: “turn toward the problems.” It’s not enough to just recognize that there are significant roadblocks for people trying to get their first job in our field. It’s not enough to silently condemn the pervasive hostility and discrimination that some face every day based on their gender, or the color of their skin, or whatever other arbitrary outgroup classification is imposed on them. It’s not enough to just point out that problems exist. We have to actually take steps to remove roadblocks, to counter toxicity, to boost visibility, and to provide equal opportunities for people affected the most by the darker aspects of our professional community.
Again, how you do this is up to you and what you’re comfortable with, but here are a few ideas:
- Mentor someone. Help a recent graduate get started in the industry, offer advice and guidance to a new coworker, or just share your expertise through your social and professional channels.
- Present! Assist a colleague with their conference presentation or do a joint presentation with them.
- Reach out. Lend a hand or a word of encouragement to those who have been targets of gatekeeping or toxic negativity, either in person or online.
Conclusion
By no means will following these simple steps solve all of our toxicity and exclusion problems, but they’re a good start. Think of them as a set of tools we can use to build the other tools we’ll need to actually solve the problems. First, we must generate more positivity in our professional discourse to counter the negativity that’s already out there. Next, we need to find ways to pay it forward and enable ourselves to be positive influences on others. Finally, once we’ve identified a problem, we need to take action to fix it or nothing will ever change. Ask yourself what you can do to make things better, even just a little better, and do it.
It’s not enough that we individually believe that our industry needs to be more diverse and inclusive; if we want to change things for the better we must also demonstrate this belief whenever we can. Every little action adds up to normalize these beliefs in the community. If we all do what we can to make things better, together we’ll be able to raise the tide.
This blog was inspired by David’s Keynote at the Threat Hunting and Incident Response Summit 2020. Listen to the presentation here:
