Episode 9 · · 9 min
Kyle Kennedy Stories, not resumes: Breaking educational and other barriers in cybersecurity
President of BrainBabe.org and social cybersecurity expert (article author)
Episode summary
Today's episode is a reading of an amazing written by Kyle Kennedy, president of brainbabe.org. The reading is performed by Allison, an IBM Watson personality. I also go through some recent resources discovered to help you on your journey to a Career in Infosec.
BIO:
Kyle F. Kennedy is a social cybersecurity expert and president of brainbabe.org. His organization provides foundational soft-skills training for a small fee (supported by corporation donations) and plans to launch soft-skill Masterclasses in 2019. They helped organize an event called Day of Shecurity for women of diverse backgrounds to have one day of learning: tech/ hard skills, soft skills. They had opportunities for mentorship and guidance. Day of Shecurity was FREE to attendees!
Before infosec: Sociology graduate who taught himself to code and led an engineering department
Chapters
- 0:12
Intro: an article as the guest
Ayman explains this experimental episode and introduces Kyle Kennedy of BrainBabe.org.
- 0:53
Meet Allison, the IBM Watson voice
Ayman describes testing AI voices and hands over to Allison to read the article.
- 1:29
The hoodie stereotype and the talent shortage
The article begins with the stock cybersecurity image and the 1.5 million job gap.
- 2:22
Doing the same thing and expecting different results
Kennedy argues for diverse education, ethnicity and geography and gives a biology major example.
- 3:11
Soft skills across every industry
He says cybersecurity touches all sectors and communication skills keep policy from stalling the business.
- 4:11
Why attackers are more inclusive
Kennedy notes hackers are mostly self-taught and defenders must acknowledge unconscious bias.
- 5:02
Grassroots events and the ISC2 Associate
He describes community events for women and the ISC2 associate certification for people without experience.
- 5:57
Kennedy's own barrier: a sociology degree
About a hundred interviews failed because he lacked a computer science degree, before he led an engineering department.
- 6:59
Empathy and the Starbucks analogy
He explains why men must be part of the solution and uses a coffee order analogy to push for change.
- 8:35
Three questions that matter
Do you have the brain, are you passionate, and can you learn.
- 8:50
Thanks to Allison and closing plug
Ayman thanks the AI reader and plugs the community he is building.
Key takeaways
- Non-technical backgrounds such as sociology, biology, drama or communication bring skills cybersecurity teams need.
- Soft skills matter because risks must be explained in business language so policies enable rather than inhibit the business.
- Employers should ask only whether a candidate has the brain, the passion and the ability to learn, instead of requiring a particular degree.
- The ISC2 Associate certification lets people take the exam without work experience and show employers they are committed.
- Join grassroots and regional community events, which are more accessible than big conferences for people with limited travel budgets or childcare constraints.
- Business leaders need to recognize their unconscious bias to widen the hiring pool.
Notable quotes
It's kind of like insanity, really, doing the same thing over and over and expecting different results.
If cybersecurity becomes more inclusive instead of exclusive, then we will be all the more superior to the attackers.
Do you have the brain? Are you passionate? Can you learn?
Questions answered in this episode
- Do you need a computer science degree to work in cybersecurity?
- Not according to Kyle Kennedy. He argues that requiring a computer science degree helped create the talent shortage, and that backgrounds such as biology, drama, communication and liberal arts add useful perspectives. He himself has a sociology degree and spent about 25 years in security.
- Who is Kyle Kennedy and what is BrainBabe.org?
- Kyle Kennedy is a social cybersecurity expert and president of BrainBabe.org, an organization that advocates for inclusion in cybersecurity, especially for women, and runs grassroots events and training. His article is the subject of this episode.
- Why is this episode read by an AI voice?
- Ayman wanted to give Kennedy's written article its own episode and experimented with IBM Watson's expressive text-to-speech voice, named Allison, to read it aloud. Ayman introduces and closes the episode himself.
Show notes and links
Show the original episode notes
Today's episode is a reading of an amazing written by Kyle Kennedy, president of brainbabe.org. The reading is performed by Allison, an IBM Watson personality. I also go through some recent resources discovered to help you on your journey to a Career in Infosec.
BIO:
Kyle F. Kennedy is a social cybersecurity expert and president of brainbabe.org. His organization provides foundational soft-skills training for a small fee (supported by corporation donations) and plans to launch soft-skill Masterclasses in 2019. They helped organize an event called Day of Shecurity for women of diverse backgrounds to have one day of learning: tech/ hard skills, soft skills. They had opportunities for mentorship and guidance. Day of Shecurity was FREE to attendees!
Links:
- Article: Stories, not resumes: Breaking educational and other barriers in cybersecurity
- Google Image Search for "cybersecurity"
- Associate of (ISC)²
- Adrian Kaylor's talk "Sales Engineering and getting into infosec"
- https://www.joesecurity.org/
- Flaws2
- City College of SF Cybersecurity Program
- CCSF Information Security (Cybersecurity) Analyst Apprenticeship
- Sam Bowne's Classes
- Article in IBM Watson's Expressive SSML used on the show
- Intro/Outro Music: Cascadia by Trash80
Full Text of Article:
When you search for images under the key word “cybersecurity,” a familiar shot always turns up: a guy wearing a hoodie, operating in a dark room, fingers on a keyboard.
I’d like to replace that image with…anything. To be a cybersecurity professional, you can be anything. And anyone.
We’ve heard the statistics. There is currently a human capital crisis, with 1.5 million cybersecurity jobs available and no takers. The number is projected to balloon to 3.2 million by 2021.
But who exactly are these cybersecurity professionals we are looking for?
For so long, we have had our own definition of who can fit that talent. A good cybersecurity professional has to have a computer science degree. They must have solid professional background. They have to be male. This pattern of defining success has led us to the shortage we are experiencing today. It’s kind of like insanity, really: Doing the same thing over and over and expecting different results.
What really makes up a good professional? Every human being brings a different experience. You need critical thinking and creative thinking, both. A variety of educational, ethnic, geographical, backgrounds.
For example, cybersecurity is not the obvious career path for someone with a biology degree; however, a biology major might help throw a new perspective on cybersecurity given that advancements of technology will eventually interface with the human body organically creating a scary threat landscape.
Often too we talk about cybersecurity in the context of oil and gas, or transport, or finance. Cybersecurity today and going forward, is a horizontal across every industry, as opposed to just being by itself.
Every industry needs cybersecurity professionals. People from other disciplines could provide their own perspectives and add value to how the job is done. For example, some of the best cybersecurity communicators otherwise known as “Social Engineers”, I know are drama majors, communication majors and liberal arts majors.
Why are soft skills critical? The risks here are complex. If these risks are not articulated in a business language, such that executives are not able to grasp their importance, then what you will have as a result are cyber policies, created from the ivory tower, which everyone must follow, and which would inhibit the business instead of enabling it.
If cybersecurity becomes more inclusive instead of exclusive, then we will be all the more superior to the attackers. As it is, it’s the enemy who are inclusive. They don’t have any requirement that hackers should have this or that degree or should have attended an Ivy League school. Most hackers are self-taught, and when something sparks their interest, they go online. They read. Nobody tells them they could not do it because they are not a good fit.
Initial strides
Foremost, before anything can be done, there must be an acknowledgment of the current situation and the need to be more welcoming. Business leaders and decision-makers must recognize the unconscious bias that they have. They have to understand that creating positive disruption and changing patterns are a business differentiator.
My organization is active in our advocacy for inclusion in cybersecurity, specifically for women. We have been speaking to organizations on positive disruption. A good way to create action is through regional events and grassroots involvement. We bring the community together, and it is these communities that conduct classes and organize meet-ups and training courses.
We did this in reaction to the more established cybersecurity conferences that present numerous barriers to entry, and which are more for senior professionals. Women may not have the luxury of being able to spring for the travel, or leave their homes for days at a time, and perhaps find childcare for the time they are away.
ISC2 also now has an associate certification, where an individual can take the certification examination without the work experience; providing an opportunity for employers to recognize & support candidates entering or transitioning to the cybersecurity industry.
Personal reasons
My passion for diversity in cybersecurity is driven by several things.
First, given my degree in sociology, I must have had a hundred interviews before landing on a job in technology, even though I knew a lot about it – it had been a hobby for years — and it was clear I was keenly interested and willing to learn. They said I was not the right fit because I did not have a technology degree; specifically, a computer science degree. Didn’t matter that I could code in Assembler, BASIC, C, Cobol, Comal, Forth, Fortran, Logo, Pascal, PL/1 or Algol.
And I thought, if this could happen to me, a white male, think of all the others who could not break the barriers!
I ended up leading the engineering department of the first company that hired me.
And then I met my wife, who herself had to break barriers in IT because she was a woman. For example, during meetings, she was seen as more of an assistant rather than a peer, even though she was very technical.
My male colleagues initially said I was just on the bandwagon with my advocacy for women in cybersecurity. I said no. Men have to recognize that we have to be part of the solution, since many of the positions of senior leadership are occupied by men.
‘This is not my coffee’
I have a good analogy for all this. Suppose you went to a Starbucks, and when your coffee is given to you, you see that it was not what you asked for.
For a moment you might think you might as well take it, because the barista probably knows what is good for you, more than you do.
But no – you renegotiate. The barista does not know any better. You then look for the manager to explain the mistake and to get the drink you want.
Empathy is what can truly enable us to understand that we need to change the status quo. Yes, I am male, I am white, but I know that my background is a lot different from that of my peers. Because of this, I am very empathetic in that I know there are institutionalized barriers. I should know – I have spent the past 25 years in security.
What should really matter is that there are many talented individuals capable of both critical and creative thinking. They may not come in the shape and size we have traditionally expected them to be, but they are interested. They are intelligent.
In the end, only three questions should matter to organizations when they decide on investing in somebody for a cybersecurity role: Do you have the brain? Are you passionate? Can you learn?
Kyle F. Kennedy is a social cybersecurity expert and president of brainbabe.org. His organization provides foundational soft-skills training for a small fee (supported by corporation donations) and plans to launch soft-skill Masterclasses in 2019.They helped organize an event called Day of Shecurity, for women of diverse backgrounds to have one day of learning: tech/ hard skills, soft skills. They had opportunities for mentorship and guidance. Day of Shecurity was FREE to attendees!
See omnystudio.com/listener for privacy information.
Mentioned in this episode:
Full transcript
Transcribed from the episode audio. Spoof ads (Ayman's parody commercials poking fun at the industry) are marked.Download .txt
Hey, welcome to another episode of Getting Into Infosec. I'm your host, Eamon Alsua.
Today's episode is an interesting one. It's a little experimental. I like to run experiments. My guest today is actually an article.
It's kind of like insanity, really.
Yes, the article is written by Kyle Kennedy. He's the current president of BrainBabe.org. When I first read this article, it just simply blew me away. That's the reason why I wanted to give the article itself its own episode. I think it's worthy and everything that's said in there is just amazing. The article is going to be read by Allison, who is an IBM Watson voice profile.
Hello, Eamon. I'm excited to be here.
Hi, Allison. Thanks for doing this. So I had a lot of fun. I don't know if you saw some of my tweets, researching and trying to find different AI voice profiles. Allison did a great job. The profile is like expressive. So it lets you use different tonalities. And even by default, it worked really well out of the box. So I'll post some of the quote unquote source code, you know, the expressions that I use in the article online and also the full text of the article and the link to the original article as well. And now on to the article by Kyle Kennedy, read by Allison.
When you search for images under the keyword cybersecurity, a familiar shot always turns up. A guy wearing a hoodie, operating in a dark room, fingers on a keyboard. I'd like to replace that image with anything. To be a cybersecurity professional, you can be anything. And anyone? We've heard the statistics. There is currently a human capital crisis, with 1.5 million cybersecurity jobs available and no takers. The number is projected to balloon to 3.2 million by 2021. But who exactly are these cybersecurity professionals we are looking for? For so long, we have had our own definition of who can fit the talent. A good cybersecurity professional has to have a computer science degree. They must have solid professional background.
They have to be male. This pattern of defining success has led us to the shortage we are experiencing today. It's kind of like insanity, really, doing the same thing over and over and expecting different results. What really makes up a good professional? Every human being brings a different experience. You need critical thinking and creative thinking, both. A variety of educational, ethnic, and geographical backgrounds. For example, cybersecurity is not the obvious career path for someone with a biology degree. However, a biology major might help throw a new perspective on cybersecurity given that advancements of technology will eventually interface with the human body organically creating a scary threat landscape.
Often too we talk about cybersecurity in the context of oil and gas, or transport, or finance. Cybersecurity today and going forward is a horizontal across every industry as opposed to just being by itself. Every industry needs cybersecurity professionals. People from other disciplines could provide their own perspectives and add value to how the job is done. For example, some of the best cybersecurity communicators otherwise known as social engineers I know are drama majors, communication majors and liberal arts majors. Why are soft skills critical? The risks here are complex. If these risks are not articulated in a business language, such that executives are not able to grasp their importance, then what you will have as a result are cyber policies, created from the ivory tower, which everyone must follow, and which would inhibit the business instead of enabling it.
If cybersecurity becomes more inclusive instead of exclusive, then we will be all the more superior to the attackers. As it is, it's the enemy who are inclusive. They don't have any requirement that hackers should have this or that degree, or should have attended an Ivy League school. Most hackers are self-taught, and when something sparks their interest, they go online. They read. Nobody tells them they could not do it because they are not a good fit. Foremost, before anything can be done, there must be an acknowledgement of the current situation and the need to be more welcoming. Business leaders and decision makers must recognize the unconscious bias that they have. They have to understand that creating positive disruption and changing patterns are a business differentiator.
My organization is active in our advocacy for inclusion in cybersecurity, specifically for women. We have been speaking to organizations on positive disruption. A good way to create action is through regional events and grassroots involvement. We bring the community together, and it is these communities that conduct classes and organize meetups and training courses. We did this in reaction to the more established cyber security conferences that present numerous barriers to entry and which are more for senior professionals. Women may not have the luxury of being able to spring for the travel or leave their homes for days at a time and perhaps find childcare for the time they are away. ISC2 also now has an associate certification where an individual can take the certification examination without the work experience
Providing an opportunity for employers to recognize and support candidates entering or transitioning to the cybersecurity industry. My passion for diversity in cybersecurity is driven by several things. First, given my degree in sociology, I must have had a hundred interviews before landing on a job in technology. Even though I knew a lot about it, it had been a hobby for years, and it was clear I was keenly interested and willing to learn. They said I was not the right fit, because I did not have a technology degree, specifically, a computer science degree. Didn't matter that I could code in Assembler, Basic, C, COBOL, Comal, 4th. Fortran logo pascal pl one or algol and i thought if this could happen to me a white male think of all the others who could not break the barriers i ended up leading the engineering department of the first company that hired me
And then I met my wife, who herself had to break barriers in it, because she was a woman. For example, during meetings, she was seen as more of an assistant, rather than a peer, even though she was very technical. My male colleagues initially said I was just on the bandwagon with my advocacy for women in cybersecurity. I said no. Men have to recognize that we have to be part of the solution since many of the positions of senior leadership are occupied by men. I have a good analogy for all this. Suppose you went to a Starbucks and when your coffee is given to you, you see that it was not what you asked for. For a moment you might think you might as well take it because the barista probably knows what is good for you more than you do.
But no, you renegotiate. The barista does not know any better. You then look for the manager to explain the mistake and to get the drink you want. Empathy is what can truly enable us to understand that we need to change the status quo. Yes, I am male, I am white, but I know that my background is a lot different from that of my peers. Because of this, I am very empathetic in that I know there are institutionalized barriers. I should know, I have spent the past 25 years in security. What should really matter is that there are many talented individuals capable of both critical and creative thinking. They may not come in the shape and size we have traditionally expected them to be, but they are interested.
They are intelligent. In the end, only three questions should matter to organizations when they decide on investing in somebody for a cybersecurity role. Do you have the brain? Are you passionate? Can you learn?
Great. Thank you, Allison, for reading that article. It was a pleasure having you on the show.
Thank you for having me, Eamon.
All right. Hey, thanks for listening. So I built a lot of things and I'm building something new. I'm working on a new community. I want to bring everyone together with all the things that I've done into just one space. So I'm really excited about it and would love to stay in touch and get some early adopters or feedback. So check out the link below in the show notes and send me a hello. And that's about it. I hope you're having a wonderful day. Thanks. Talk to you soon.
