EP42 Missing Diversity Hurts Your Security

Security.

Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here are myself, Timothy Peacock, the product manager for threat detection here at Google Cloud, and Anton Chuvakin, a reformed analyst and member of the cloud security team here at Google. You can find and subscribe to this podcast wherever podcasts are distributed, as well as at our website. cloud.withgoogle.com/cloudsecurity/podcast. If you're new to the show, it is a marvel that we once went many, many episodes without it, but if you listen to our old openers, you'll hear we once lacked a website. If you like our content and want it delivered to you piping hot every Monday morning, please do hit the subscribe button on your podcasting app of choice. You can follow the show and argue with your hosts on Twitter as well, twitter.com/cloudsecpodcast. Thanks for listening. Anton, our episode today is on diversity, equity, and inclusion in cloud security. Is that right?

It is indeed. And it's our second episode on this topic because we've done a Next special a few weeks ago that covered the same. So this is interesting to me.

This is a different perspective though, because we're hearing from, well, A, a different person, but we talk on actually quite a few different topics. And one of the things that I thought was particularly interesting was talking about the different kinds of threat models and suitability of programs, particularly in the AI space, that you get better outcomes when you have diverse teams.

Moreover, we covered the fact that diversity and inclusion may well be a risk reduction measure in some scenarios. And we've discussed some paths of how lack of diversity, lack of inclusion may increase your risk as an enterprise. So this to me is a good argument in favor of it.

Beyond it being the right thing to do, of course.

Exactly. Exactly.

The one final thing we'll call out is that there is an organization mentioned by our guest towards the end of the episode, which is an excellent resource if people are curious to get into the field. I know a lot of listeners have reached out and let me know that they listen to the show as a way to learn more about the field. And while we're honored and thrilled, this organization that our guest highlights offers a great set of resources for people to get interested in the world of security broadly. So with that, let's turn it over to our guest today. And with that, delighted to welcome MK Palmore, a director here at the Office of the CISO, Google Cloud. to the podcast. MK, I wanna start out with what I hope is a bit of a softball question. Could you describe the problem? Why do we see such a gap in security professionals who are women and people of color? What's going on?

The general problem, if you take a step back and look at the security industry as it has evolved over the course of the past few decades, has been that quite frankly, we do a horrible problem in security expanding the scope of folks that we are looking to bring into the industry from a talent standpoint. It's the whole chicken and egg problem where security teams are trying to identify folks with deep expertise to bring onto their team so that they can theoretically hit the ground running. When in fact, the way that we write job descriptions and things like that really leave out a large sector of society when we're looking to spin up the size of teams or bring on board new personnel. And what happens is that you essentially begin grabbing from the same pool that exists for everyone. And so we are now into this sort of circuitous loop of folks moving from one organization to the next in terms of security professionals. But the real challenge, I think, is for those of us who are already within the industry to really broaden the lens and broaden the scope for the type of talent and background that we're looking for, for individuals. And I think that begins the discussion around increasing the numbers of women and people of color in our industry.

But so to follow up on this, I wanted to kind of explore maybe how the lack of such people, women and people of color, impacts our industry, thinking about security, thinking about tech overall. Are we talking about diverse teams performing better, having better morale, happier people? Just wanna get a little bit more of an analysis of the impact that we are observing.

Why diversity? Why inclusion? Why does it matter? For lots of different reasons, I think folks bring lots of different experiences and talent to the table, but let's look at it from a couple of different lenses. From one, It's been proven time and again from the business standpoint that diverse teams actually are more productive than non-diverse teams, right? So if we look at it from the standpoint of who are we bringing to the table to help solve problems, it is both mathematically and empirically true that a more diverse team can bring about more and potentially better solutions to the problem-solving palette when we look at how it is that we're going to change things. The other issue here is that from the organizations that I've been a part of, when you give folks the space to, you know, the phrasing that we're now getting used to using, get used to bringing their whole selves to the table, their whole selves to work, they tend to be more productive for you. They tend to be more engaging and more apt to offer up their opinion on solutions for problem solving. And then I don't know about you guys, but I have always looked at the security profession as a problem-solving industry. That's essentially what we're in the business of doing. And so, we all need help. You know, security is a team sport. We need to get as many minds to the table as we possibly can so that we can begin to look at problem solving in a way that's different than we have historically. Because from my background and position, our historical approach to solving problems in security, quite frankly, has failed us, which is why all of us are now having these new conversations around how we need to be looking at security differently. And I think part of the answer is bringing different people to the table to help solve these really challenging problems.

I couldn't agree more with so much of that. I just personally feel so much happier and more myself at work being out at the office, and that's great. One of the things that's interesting to me personally is like, I got interested in security from a young age because I was keenly aware of the connection between my browsing history and physical safety. These things are personally meaningful to people. I'm curious, you know, when we think about team members from different perspectives, do we think that, you know, that helps us with threat modeling? Are there particularly good cloud examples? You know, like it's easy to think about stalkerware and how men and women experience that differently. Are there cloud areas where people of different backgrounds experience things differently?

Well, I think you touched on an area that bears deeper inspection. Anything around threat modeling, you know, you mentioned just in the course of the last minute that you were brought up having things like browsers and browser history and technologies available to you. And that's different from some of us who are maybe, you know, a generation or two older who did not have this technology, did not grow up on it, and have had to change and shift midstream. We all know that the mind is infinitely more malleable and you're able to actually teach things at a much younger age. And so the folks that are growing up now, the millennials and such, are experiencing technology and looking at it in a way that I think folks from older generations may have trouble looking at it, thinking about different vectors of attack, thinking about different ways for which your information might be exploited. And I think it's a combination of kind of that old-school mentality, maybe old-school approach, with newer vectors, newer visions of where technology has been and where it's going that will enable us to bring solutions to bear, like in threat modeling, where you're able to actually see from an adversarial standpoint, what types of things the adversary may pivot to next in order to encourage their normally successful business model. So I think that's actually a prime example.

I love it.

Indeed. And I think to me, this is also not something people consider very often explicitly. They may think about it, they may give it lip service, but to me, explicit inclusion of that is kind of important, right? Because it's easy to miss if you're not used to it. It's kind of the bias at work, right?

Look, we all have natural biases that we bring to the table. This whole issue is really about recognizing that those biases may actually be limiting you from making the best decisions that you can make, both as leaders, managers, and elsewhere within the organization. You know, regardless of where you happen to be operating from a security organization, my mantra is always lead from where you stand. This is an opportunity to not just expand the scope of the people that we're bringing in, it's an opportunity to improve our decision-making improve the results that come out of that decision-making. The data again is there. I have yet to see anything to the contrary. I would offer as a proffer as to one of the reasons why we need to drive change in an area like this is because quite frankly, from a personnel standpoint, it's impossible to scale people-wise to the solutions that we need to bring to the table from a security standpoint. And because you know you can't scale to it, you have to begin thinking, OK, well, how do I go in a much smarter fashion in terms of tackling the problems that are out there? And I think widening the scope of who we bring to the table is, again, part of that solution. It's not the whole thing, but it is part of it.

Switching gears a tiny bit to an area where we all saw this blow up spectacularly for all sorts of companies, namely the area of ML, AI systems, right? So we've seen countless examples where AI systems have had problems with laundering biases, perhaps enhancing biases, and having horrible results due to biased training data or perhaps even biased algorithms. So I think, and I have an intuition that there are security implications here. So do these types of problems extend to cloud products? And if yes, do you think there are security implications here?

Clearly security implications, I think, if you're not taking these things into account. You touched upon, I think, some really notable examples, which, you know, it's interesting. If you take a step back and you think about how solutions architects or developers think about or go about solving problems. They use what they know and what they have available to 'em. And we know at this point in the development of AI and ML systems is that those systems need to be trained. And they're trained through the lens and eye of the developers who develop those systems. And without a broader understanding of the diverse landscape, how people are perceived both by systems and other people, it impacts the ultimate solution that you come up with. And so even as we've seen historically, that impact can adversely adversely impact the results of the information that ultimately gets poured out of these systems and their approach to identifying whether it be adversarial behavior, adversarial targets, good behavior within systems. It's all impactful, and I think it's incumbent upon all of us to take that wider scope observation to make sure that we are developing the most widely scalable and acceptable products and solutions that we're capable of delivering.

So would it be too drastic to just jump to the statement that not doing diversity is a security risk? Like if you're not hiring diverse talent, you are increasing risk. And I don't mean like some kind of philosophical risk, you are really increasing risk.

You could probably certainly make a dotted line conclusion like that. When I pursued my MBA, I had a statistics professor that often said, if you torture the data enough, it will confess, right? It will ultimately yield whatever it is that you want it to yield. But I do believe inherently that decision-making is better when there are diverse teams present. And as I stated a couple of comments ago around security being a team sport and how we need different minds and people to the table, I think you can make an argument that we are inherently less secure if we are not diverse in terms of building out teams and solutions.

I really like that question, Anton, and my answer would be yes. MK, I'm glad that your answer there is informed by a statistics professor and not your years of experience in federal law enforcement. We've seen now A bunch of areas where, you know, having diversity in security makes individuals happier, makes organizations more secure, increases the talent pipeline, opens us up to thinking about threat models and building better systems. There's a lot of reasons to do it. Are there organizations out there that are helping us? Like, are there things people can get plugged into to help with this? We've made the case it's important. How do we fix it?

There are lots of organizations out on the landscape, I think, all pointed in the same direction around changing the narrative and moving the needle on this issue. I devote quite a bit of my time outside of Google in my professional setting to a group called Cyversity. They've been around for a couple of years. They were formerly the International Consortium for Minority Cybersecurity Professionals. We recently went through a name change to Cyversity, but I launched back in 2019 the Bay Area chapter of this national organization and It's been taking off like a light. Even pre-George Floyd, pre-pandemic, we were already getting lots of emphasis, important emphasis around this issue of increasing the number of women and people of color in cybersecurity and had thankfully, knock on wood, already gotten the financial support of companies like Google, CrowdStrike, Palo Alto Networks, all, you know, the who's who of security and cloud out there. So there's a lot of emphasis around this. And the reason I mentioned Cyversity is because This is where I've sort of put all of my chips on the table with this particular entity. It's a nonprofit out there in the space, but I'm also here to say that there are lots of nonprofits doing very, very good work in this space. And it's just a matter really of identifying one that aligns with what it is that you're trying to accomplish or the company that you represent is trying to accomplish. And then again, helping them achieve their objectives. And I've been lucky in the course of my affiliation with Cyversity to have launched a couple of individual scholarship programs, again through the help of global sponsors. And that's really what I'm about. It's about networking and then trying to help individuals transition into careers in cybersecurity, because there's nothing worse than seeing someone who wants to belong to this community stumble and fall continuously and not figure out how to become a part of it. I just think there's too many opportunities, too many jobs, too many areas where they can bring talent into this very large and diverse field. The misperception on the outside of our industry is that everyone needs to have a high degree of technical chops to even break into the industry. And yes, you might develop them along the way, but that's not necessarily a starting point. And we shouldn't give people the impression that you need to come to the table with all of this training and deep experience just to get into the industry.

On that note, listeners, I will note that although I'm the PM who leads threat detection at Google Cloud, My undergraduate education is a political science bachelor of arts. I certainly represent the non-CS degreed member of the community.

There's that, and that makes you doubly dangerous sometimes because you understand some of the human software issues and not just how to write code. To me, this is kind of useful.

I'll tell you what: the number of organizations where I think what the security team needs to hire a couple's therapist instead of buy another firewall, I can't even count them.

There is that, yes. And so back to our topic of therapy, possibly a question that would make. of us squirm. We work for a large tech company, right? All 3 of us, we work for Google. So clearly Google is working hard on bringing up the diversity and inclusion. I know from my experience here that we mean it. But why is it so hard? Why is it hard even for companies who mean to identify and hire diverse talent? So what is the story here? I know that some people may just want to pay lip service. Here we mean it. So why is it still hard?

So there's a couple of things at play here. And this, I guarantee you, is worth its own separate conversation. Why is it that after all of these years, especially here in Silicon Valley, tech companies, especially the big ones, seem to have trouble moving the needle on this issue? And there's a couple of different things that come to mind as it relates to this topic.

Mm-hmm.

First, you have to be intentional about change. I don't think that it's enough for large-scale companies, medium or small, to simply say this issue is important and not put into place any kind of business drivers or metrics in order to drive the organization in that direction. And what we've seen is the most successful ones have, from the CEO on down, tied these changes to business imperatives. In other words, they've made it part of the business to drive change around this issue of diversity. That helps a lot. And oh, by the way, it helps to have the CEO and others at the executive level constantly messaging this to the rest of the organization. Because at the end of the day, the reason why we all have problems with this issue is that people go to what they like and people go to what they consider normal to themselves. I happen to have attended one of the US service academies. When I meet another service academy graduate, I am automatically more inclined to believe that that person shares a number of things with me, just simply based on their collegiate experience that we share, right? That's kind of a nominal example. You know, I extend that to people who have served in the military. I served in the Marines. We do a fair job, I think, among veterans of making sure that other veterans get a leg But we come to the table predisposed to the idea that other veterans will have capabilities similar to our own. And that kind of mentality or thinking, I think, both works in our favor, but at the same time can also be crippling if you believe that anyone outside of those lanes that you adhere to can't be helpful to you or can't assist you in driving different business outcomes. And this is where we all get tripped up. Because like recognizes like. So, if I'm a product manager, if I'm a leader within a tech organization, I have to intentionally stop and think, okay, maybe I want to expand the pool of folks that I look at for this new opening and new job, because my inclination will be, frankly, without me even saying it, to go look for someone who's just like me. Because in my mind, in that biased mind, you believe that that person will do the job in a way that's familiar and similar to you and be able to drive the kinds of outcomes that you want. And the challenge for all of us is recognizing that there's many different people that you could bring to the table that not only could drive similar outcomes, but in many instances, drive better outcomes for you, depending on their background and what it is that they're bringing to the table. There's a lot there.

That makes a ton of sense. There's a ton there, and so much of it resonates with me. One thing that I think is really interesting is we look at this as kind of a pipeline problem a lot of the times. We say, oh, there's just not enough candidates out there. But we also have seen, and maybe not at Google, we've heard in the statistics and some of the feedback on our episodes, but at other companies, there are retention differences between majority groups and non-majority groups. What could companies do better when it comes to retaining diverse talent if they're in the first place able to get it?

Yeah, so I mean, it goes back to the old adage around why people leave companies, right? It's either a leadership issue, Or they don't feel like there's a path to success for them.

Mm-hmm.

Especially in a high-tempo environment like tech, people come to jobs grateful that they've been given the opportunity, I think, to engage in these positions, but they wanna show their stuff, they wanna show that they add value, but they also wanna know that there are opportunities for them to either expand their influence or expand their responsibilities. And when you don't show folks a path, for how they can grow their careers, it won't take long, probably, you know, a span of 3 to 5 years before they start asking questions around, how do I get to the next level at this place? You know, I'm showing what I can do, I'm bringing value, I've helped drive change in a positive manner, I'm ready for the next level. And if you don't show people that there's a path, you end up with a retention problem. Quite frankly, that goes to say, I think this is a problem that businesses deal with across the board. I don't think that technology is the only sector that experiences this.

Mm-hmm.

of the human experience that people, especially folks who come from experiences of leadership and things like that, they always want to sort of drive to that next level of experience and accomplishment. We have to outline a path for people, otherwise they will go find that path somewhere else.

That makes a ton of sense.

That's actually a very powerful kind of conclusion, or getting to a conclusion. So, I want to hit you with 2 questions we typically end with, namely, any recommended resources for the audience? Of course, I'm gonna put the link to Cyversity organization right there already. And the second question we usually ask is one thing the audience can do to improve this in the cybersecurity industry. So recommended resources and one thing to do.

Yeah, so I'm going to tie these 2 together because my experience has been with Cyversity that networking is a huge component that will help to drive change. At the end of the day, you need to have all of your precursor elements in place. You need to have the certs, the training, some amount of the experience, but no great opportunity is just going to get dropped in front of you. And so organizations like Cyversity, and there are others out there like, you know, WiCyS, Women in Cybersecurity, Blacks in Tech. There are lots of organizations out there paying attention to this issue. I would highly encourage folks to join one of those organizations because it's membership in these organizations that even for allies help expand everyone's understanding of the landscape and also helps to drive change. So I would encourage not only the target communities of the organizations like this, for ours it's women and underrepresented minorities, but also allies, because it's only through a combination of effort on both sides that we're going to essentially move the needle on this. The second thing I would advise people to do, especially if you are trying to break in a different aspect of tech or technology or security, I always encourage folks to just start, right? Just begin. For folks outside of the industry looking in, take that class, sign up for, you know, an entry-level certification that you can get. from one of the many training organizations out there. As you guys well know, we are internally developing some aspects of security training that we're going to be unveiling to the outside world here at some point. All of those things matter. So whatever you can do to begin the journey is also part of getting to the ultimate destination, which is full inclusion and being a part of this wonderfully expanding and developing industry. I mean, I can't imagine from a professional standpoint a better place to be than right in the middle of technology and technology development. which is going to impact the entire world and society over the course of the next several decades. So I just want to encourage people to raise their hand, look at it, dive in, see if you like it, and then continue to explore, make those connections that you need so that you can grow in this industry along with it.

Perfect. Thank you very much for this. Your last remark was definitely inspiring. So thank you very much for your participation.

Absolutely.

And now we're at time. Thank you very much for listening. And of course, for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever else you get your podcasts. Also, you can find us at our website, cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes that typically come out every Monday. You can follow us on Twitter at twitter.com/cloudsecpodcast. And of course, your hosts are also on Twitter, Anton_Chuvakin and _TimPikock. Tweet at us, email us, argue with us, and if you like or hate what we hear, we can invite you to the next episode. See you on the next Cloud Security Podcast episode.

Security.