Getting Into Infosec, Episode 9: Virtual Kyle Kennedy - Stories, not resumes: Breaking educational and other barriers in cybersecurity
Published December 11, 2018 · 9 minutes
Episode page: https://www.gettingintoinfosec.com/episodes/kyle/

[0:12] Ayman Elsawah: Hey, welcome to another episode of Getting Into Infosec. I'm your host, Eamon Alsua.

[0:19] Ayman Elsawah: Today's episode is an interesting one. It's a little experimental. I like to run experiments. My guest today is actually an article.

[0:27] Kyle Kennedy: It's kind of like insanity, really.

[0:30] Ayman Elsawah: Yes, the article is written by Kyle Kennedy. He's the current president of BrainBabe.org. When I first read this article, it just simply blew me away. That's the reason why I wanted to give the article itself its own episode. I think it's worthy and everything that's said in there is just amazing. The article is going to be read by Allison, who is an IBM Watson voice profile.

[0:53] Kyle Kennedy: Hello, Eamon. I'm excited to be here.

[0:56] Ayman Elsawah: Hi, Allison. Thanks for doing this. So I had a lot of fun. I don't know if you saw some of my tweets, researching and trying to find different AI voice profiles. Allison did a great job. The profile is like expressive. So it lets you use different tonalities. And even by default, it worked really well out of the box. So I'll post some of the quote unquote source code, you know, the expressions that I use in the article online and also the full text of the article and the link to the original article as well. And now on to the article by Kyle Kennedy, read by Allison.

[1:29] Kyle Kennedy: When you search for images under the keyword cybersecurity, a familiar shot always turns up. A guy wearing a hoodie, operating in a dark room, fingers on a keyboard. I'd like to replace that image with anything. To be a cybersecurity professional, you can be anything. And anyone? We've heard the statistics. There is currently a human capital crisis, with 1.5 million cybersecurity jobs available and no takers. The number is projected to balloon to 3.2 million by 2021. But who exactly are these cybersecurity professionals we are looking for? For so long, we have had our own definition of who can fit the talent. A good cybersecurity professional has to have a computer science degree. They must have solid professional background.

[2:22] Kyle Kennedy: They have to be male. This pattern of defining success has led us to the shortage we are experiencing today. It's kind of like insanity, really, doing the same thing over and over and expecting different results. What really makes up a good professional? Every human being brings a different experience. You need critical thinking and creative thinking, both. A variety of educational, ethnic, and geographical backgrounds. For example, cybersecurity is not the obvious career path for someone with a biology degree. However, a biology major might help throw a new perspective on cybersecurity given that advancements of technology will eventually interface with the human body organically creating a scary threat landscape.

[3:11] Kyle Kennedy: Often too we talk about cybersecurity in the context of oil and gas, or transport, or finance. Cybersecurity today and going forward is a horizontal across every industry as opposed to just being by itself. Every industry needs cybersecurity professionals. People from other disciplines could provide their own perspectives and add value to how the job is done. For example, some of the best cybersecurity communicators otherwise known as social engineers I know are drama majors, communication majors and liberal arts majors. Why are soft skills critical? The risks here are complex. If these risks are not articulated in a business language, such that executives are not able to grasp their importance, then what you will have as a result are cyber policies, created from the ivory tower, which everyone must follow, and which would inhibit the business instead of enabling it.

[4:11] Kyle Kennedy: If cybersecurity becomes more inclusive instead of exclusive, then we will be all the more superior to the attackers. As it is, it's the enemy who are inclusive. They don't have any requirement that hackers should have this or that degree, or should have attended an Ivy League school. Most hackers are self-taught, and when something sparks their interest, they go online. They read. Nobody tells them they could not do it because they are not a good fit. Foremost, before anything can be done, there must be an acknowledgement of the current situation and the need to be more welcoming. Business leaders and decision makers must recognize the unconscious bias that they have. They have to understand that creating positive disruption and changing patterns are a business differentiator.

[5:02] Kyle Kennedy: My organization is active in our advocacy for inclusion in cybersecurity, specifically for women. We have been speaking to organizations on positive disruption. A good way to create action is through regional events and grassroots involvement. We bring the community together, and it is these communities that conduct classes and organize meetups and training courses. We did this in reaction to the more established cyber security conferences that present numerous barriers to entry and which are more for senior professionals. Women may not have the luxury of being able to spring for the travel or leave their homes for days at a time and perhaps find childcare for the time they are away. ISC2 also now has an associate certification where an individual can take the certification examination without the work experience

[5:57] Kyle Kennedy: Providing an opportunity for employers to recognize and support candidates entering or transitioning to the cybersecurity industry. My passion for diversity in cybersecurity is driven by several things. First, given my degree in sociology, I must have had a hundred interviews before landing on a job in technology. Even though I knew a lot about it, it had been a hobby for years, and it was clear I was keenly interested and willing to learn. They said I was not the right fit, because I did not have a technology degree, specifically, a computer science degree. Didn't matter that I could code in Assembler, Basic, C, COBOL, Comal, 4th. Fortran logo pascal pl one or algol and i thought if this could happen to me a white male think of all the others who could not break the barriers i ended up leading the engineering department of the first company that hired me

[6:59] Kyle Kennedy: And then I met my wife, who herself had to break barriers in it, because she was a woman. For example, during meetings, she was seen as more of an assistant, rather than a peer, even though she was very technical. My male colleagues initially said I was just on the bandwagon with my advocacy for women in cybersecurity. I said no. Men have to recognize that we have to be part of the solution since many of the positions of senior leadership are occupied by men. I have a good analogy for all this. Suppose you went to a Starbucks and when your coffee is given to you, you see that it was not what you asked for. For a moment you might think you might as well take it because the barista probably knows what is good for you more than you do.

[7:48] Kyle Kennedy: But no, you renegotiate. The barista does not know any better. You then look for the manager to explain the mistake and to get the drink you want. Empathy is what can truly enable us to understand that we need to change the status quo. Yes, I am male, I am white, but I know that my background is a lot different from that of my peers. Because of this, I am very empathetic in that I know there are institutionalized barriers. I should know, I have spent the past 25 years in security. What should really matter is that there are many talented individuals capable of both critical and creative thinking. They may not come in the shape and size we have traditionally expected them to be, but they are interested.

[8:35] Kyle Kennedy: They are intelligent. In the end, only three questions should matter to organizations when they decide on investing in somebody for a cybersecurity role. Do you have the brain? Are you passionate? Can you learn?

[8:50] Ayman Elsawah: Great. Thank you, Allison, for reading that article. It was a pleasure having you on the show.

[8:55] Kyle Kennedy: Thank you for having me, Eamon.

[8:56] Ayman Elsawah: All right. Hey, thanks for listening. So I built a lot of things and I'm building something new. I'm working on a new community. I want to bring everyone together with all the things that I've done into just one space. So I'm really excited about it and would love to stay in touch and get some early adopters or feedback. So check out the link below in the show notes and send me a hello. And that's about it. I hope you're having a wonderful day. Thanks. Talk to you soon.