NEXT Special - Cloud Security and DEI: Being an Ally!

Security.

Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here are myself, Timothy Peacock, the product manager for threat detection here in Google Cloud, and Anton Chuvakin, a reformed analyst and esteemed member of the cloud security team here at Google. This is a special Next 2021 episode coming to you live about the topic of diversity, equity, and inclusion. You can find and subscribe to this podcast wherever podcasts are sold and distributed, as well as at our website, clouddetwithgoogle.com/cloudsecurity/podcast. If you like our content and want it delivered piping hot every Monday afternoon, except this week where we've got special bonus episodes, please do hit that subscribe button on your podcasting app of choice. You can follow the show and argue with your hosts on Twitter as well, twitter.com/cloudsecpodcast. Anton, we're talking about allyship today. That's pretty fun.

Indeed, indeed. And funny enough, I've only learned this word well at Google, so I had to look it up and kind of study, read up on that before I kind of figured I can be, you know, talking about the topic. So yes, it took some research for me.

It's pretty rare that this show causes you to have to do research. I usually think you just know all of this stuff.

That's what I thought, but in this area, I'm a little more nervous, and I kind of had to look up some stuff because a lot of this may have to do with my kind of childhood abroad, and I wasn't really brought up in America, so I couldn't follow some of the cultural trends. It was harder for me.

Well, it's a topic near and dear to my heart as an openly and proudly bisexual man. It's nice to be able to, you know, be a voice of support for everybody out there. There's a couple of points I want to clarify before we get into the content. For one, listeners, you'll hear us use some words that, you know, in the moment of recording an episode, we maybe want to change how we spoke about things. You'll hear us use the word marginalized. We really mean underrepresented. You'll hear me make a question about Retention rates and leaky buckets. I'm not making a statement about Google's ability to retain or not retain diverse talent. Our numbers are published in an annual diversity report, and I'm speaking about general industry problems. And finally, I wanna make clear that the word intersectionality, as poorly as I defined it, was much better defined by Dr. Kimberlé Crenshaw some time ago, and the credit for both the term and the concept belong to her. So with that, let's get into our content today on allyship. And with that, delighted to introduce today's guests, Aditi Joshi, a member of the cloud security team, here at Google. Aditi, a topic near and dear to my heart today for a variety of reasons. Let's start off with a relative softball. What is allyship, and how do we define it?

So thanks so much, first of all, Tim and Anton, for having me here today. I have the privilege of working with this awesome cloud security team at Google Cloud. And the fact that I get to work with amazing product managers and software engineers like yourself who really care about making a difference in the space, it's like a treat for me. And then to answer your question about allyship, I think allyship is really a lifelong process, and the focus here is just building relationships. And our objective at Google Cloud Security is really focusing on learning how to use the power and the position and the privilege that we have to advocate for a more inclusive and fair representation in the workplace, and not just at Google Cloud and Cloud Security in particular, but really externally and for the world and for others. And then at Cloud Security, for us, our participation is completely optional. But if you were to kind of really think about what is allyship, it's, again, focused on building those relationships based on trust and accountability with marginalized individuals, right? People who may not be recognized, and you're kind of seeking to be an ally with them. And it's really like a strategic mechanism that we believe that Googlers can use to become collaborators and really be focused on promoting equity in the workplace, And you want to be able to really foster those personal relationships.

I actually wanted to kind of ask a side question to this question. I kind of get the general concept, but who does it help? Like, the primary gist of the effort is kind of to help certain types of people, correct? And what does help really mean here?

Absolutely. I think by helping marginalized Googlers feel included and feeling recognized and really feeling valued, allyship can really focus on improving engagement and productivity overall. So that's really, like, what's in it for us as a whole, as a society. And there's a lot of research and there's Gallup research polls as well and research studies that show that teams that are highly engaged are always going to be more productive overall than teams with low engagement. So it makes sense for us just from a corporate performance level to really focus on this concept of allyship.

Okay. But so that means that help doesn't mean, you know, add to their efforts, but it's kind of engage with them and make them feel like they are not disadvantaged. Like, sorry for asking somewhat dumb questions, but again, I just want to confirm like how it's defined So I can participate in that?

No, thank you so much for asking the question. Now, here's the thing. We believe that it's really focusing in on courage over the fear, right? And you want to empower Googlers to be change agents. That's what we're going for. And we want them to be change agents. And the way we want to do that is by giving them practical tools, which is kind of like the question that you're really asking me, right? What are the practical tools to be able to facilitate that self-reflection that's required to start those meaningful conversations, right, and the guidance to be able to interrupt the OK, that actually makes sense to me.

So to kind of go from there to our context in Google Cloud, so why is this important for us in cloud security in particular? Of course, cloud security and security in general is kind of a very interesting area where you don't have to look very far to see biases. But what's the main value of allyship in Google Cloud Security in particular?

I think there's a lot of research studies that are, again, showing that if your employees are feeling included, if they feel like they're being recognized for the hard work that they're doing, that they're putting in and they feel valued, it actually improves that employee engagement and team productivity overall. So that's really what's in it for cloud security. It's creating that inclusive environment gives us more productive teams so that we can make a big dent in the space.

One of the things that I think is interesting about allyship and cloud security in particular is threat models are different for different groups. Is that one of the things we're looking at as well? Are we looking at bringing in diverse viewpoints and making sure that we have every threat model considered when we have people in a room?

Yeah, so when you're thinking about allyship as a whole, what the Cloud Security team has a core working group where we meet to kind of go over the curriculum. We talk about learning sessions. So we have periodic learning sessions with various Googlers and within the Cloud Security team. And there, the goal is really focused on learning, first of all, because I think that that's important. Educating yourself is going to be the key because you want to be able to approach this with humility and a learning mindset. And that's kind of like what we're focused on first, and asking those open-ended questions. And asking those questions, not because you're responding, but you're just listening and you're soaking everything in and really understanding the story behind where they come from, why they believe what they believe, how their experiences have been completely different.

That makes a ton of sense. One of the other things that I think is so interesting about security is the reasons we get into it all end up being pretty different. And I know personally, some of my motivation here was like personal experience with layer 1 threats related to computer activity. So, it's great to see that we're taking steps to make sure that cloud security is home for everybody.

Yeah, and having the continuous feedback loop mechanism in place so that we're all accepting feedback, we're owning our privilege, understanding how that experience of various team members around us will make our path a little bit different. And we're deliberately seeking that feedback from those marginalized groups, right? Because we're recognizing there's power dynamics at play and we want to be able to change that. and bring diversity to the table.

Presumably, that also improves the effectiveness of us as a larger team, right? Because I keep thinking sometimes, and again, in my grad school years, when people kind of presented this as kind of just something that helped them, but it actually helps everybody. It helps all of us, right? It helps the BU. It helps Google. It helps the planet, maybe pushing it, but ultimately, it helps us as a society, right?

Exactly.

From this type of more conceptual, I want to switch to practical. and kind of ask a question about what specifically has Google Cloud Security, to use a technical term, deployed and operationalized around Allyship in this area. OK, maybe I'm not going to ask Allyship as code, right?

Anton, you know that Allyship is not like firewalls. We don't need to go rack and stack this stuff.

I was just about to ask about Allyship as code, but you beat me to it. So what are we doing in terms of shovel-ready projects? Fine. I know it's not about digging either. So I stuck with metaphors today.

So let me just zoom out a little bit, right? From a cloud security perspective, we have 4 pillars in place. First is just the pillar of hygiene. We want to be able to reach or exceed parity to reflect the available talent pool that's out there in the workplace today. That's the first pillar. The second pillar is just really focused on growth, right? Google Cloud Security, we want that to be one of the most attractive organizations for underrepresented groups to join, really making sure that we're growing them and having them be leaders. And there really is no disparity in retention or progression rates across gender or ethnicity. Then the third pillar is really focused in on belonging and inclusion. We want to make sure that everybody feels like they belong, right, and that they're included in all the conversations. And then the fourth pillar is the one that we're focused on, which is learning, right? Now, we want to make sure that CloudSec as a whole is an engaged organization, and we're building that DEI, the diversity, equity, and inclusion knowledge, and some of the very specific skills that are required to act. Mm-hmm. So what do I mean by that? By that, I mean, number one, the focus is going to be always educate yourself. Ask those questions. Be curious about the experiences of different people because everyone grows up with a different mindset and a different context and background. And so listen to their stories. The second is really making sure you're focused on owning your privilege, right? Be accountable for it. And the third is accepting feedback. Deliberately seek that feedback. For marginalized groups and realize that you have the power to be able to make a difference, that you can be a change agent. And another tip is become a confidante, right? It shows that oftentimes when women have progressed at law firms and there's a particular research study just around law firms, it's because they had a trusting relationship with certain white male partners who took a genuine interest in their career. And then another tip would be bring diversity to the table. Insist on diverse candidates when you're interviewing. If you do have low retention or people are leaving your group, then find out why, right? Seek those answers. So, those are some very tactical steps that we're trying to focus on here at Cloud Security to be able to implement this concept of allyship.

I really like the comment around figure out why people are leaving. We so often just want to say, oh, it's a pipeline problem, there's just not enough people interested, but that ignores the reality of it's a very leaky bucket.

That's exactly right.

On a personal level then, what's effective allyship? What does this look like on the really tactical level?

Are you asking what can we do, like Tim and Anton kind of thing? Because I feel like in my experience with these things, limited though it may be, sometimes it's like talking to a specific person is better than getting the organizational agenda. So what can I do? What can Tim do? What can our listeners do who are Googlers? Maybe phrase it like that.

I think the most important thing, the first step, is always educating yourself and realizing that you have the power to be a change agent. There's a ton of courses that we're starting to offer, not just through CloudSec, but really across Google. This is not just at a very high level what allyship But we're also doing deep dives and allyship courses, like really focusing in on disability. There's another course called Engaging Men: A Call to Action for Gender Allyship. There's also one around Jewish allyship or Muslims at Google. So there's different ways that you can get involved and really understand and create that awareness and realize that there's a lot of learning opportunities at Google. And we're just trying to bring it all together so that it's very easily digestible so you can come up with your own approach. Personalized action plan for what works for you, right? You've got the power to be that change agent.

So that's really tactical, good advice for anybody who's got a google.com Gaia account who can log into Grow.

No, no, wait, wait, wait. It's really not though, right? I want something that's beyond just taking classes.

Right.

I feel like I want something even more tactical than—

Right.

Something on almost like a micro level, not just take a class, be smarter, do things.

That's where I was going with that.

What can I do tomorrow? Oh, sorry. Yes.

No, no, that's okay. I mean, we had exactly the same mind thought though, which is that's good advice if you can take classes at Google. What can you do if you're a listener outside of Google who doesn't have access to all the growth resources we have here?

Yeah, so it's not just about educating yourself through classes, it's just really about listening, right? So sometimes the first thing you want to do is really start by requesting the permission of the person that you want to listen to their story. And if they do grant that permission, then approach it with a sense of humility. And a learning mindset. So some of the good open-ended questions to ask is just asking questions like, I'm curious about the things that, let's say, women or women of color in the organization find most challenging day to day, things that you might not notice. And then you might want to ask a question like, would you feel comfortable sharing some of what you've encountered? So that's another open-ended question that really opens it up to a story that helps you to understand their experiences and where they come from. The whole concept of empathy comes into play. Right. And then you can start relating, really figuring out what do we do now that this reality exists for them. And another question you might wanna say is, you know, if there's anything I could do to stop doing every day, what do you think that should be? Hmm.

Okay. Good point. What's to stop doing? We didn't really have this question, but I wanna ask this question now that you ask it yourself. So what should we stop doing? Stop judging, stop assuming. Tell us.

What do we stop doing? That's a great question.

I think the most important thing is to listen and listen just because you're just absorbing and not because you're trying to respond to something. And just that very act of open, just listening, not worried about how you're going to respond to that person, I think that'll be the first step.

I really like that advice.

I'm going to drill down even more because I know that I suck at that. I'm just not that good with this. I tend to go and start processing things and I start applying them to similar things in my life or in the people I know, and that ruins the process. I'm aware of that. And I don't mean to turn it into my Anton therapy session, but I feel like maybe there are other people who are like that, who would start thinking about Oh, he can't possibly mean that, or, well, I've seen this other experience. So how to listen without judgment?

There you go. That's, that's exactly right. And then the other key part is recognize that members of underrepresented groups don't always have the same experiences, right? Especially if they're from different cohorts. So the experience of a white woman might be very different from a woman of color. And you kind of have to really talk to as many people as possible and be attuned to their unique experiences and their intersectional identities. I think that's another really good tip to kind of absorb and kind of a practical way to kind of approach this.

Could you tell our listeners what intersectional means in 30 seconds?

That can be a whole other podcast.

So, no, no, no.

Yeah, it's a really hard question. So let's just save that for the next one.

If I were to leave our listeners not hanging in suspense what intersectional means, I would try to define it myself as considering the multiple intersecting planes of identity Includedness and excludedness when evaluating somebody's experience.

Shockingly, that makes sense to me because you may be sort of a majority by one dimension, but you're an extreme minority possibly under another, right?

That's right.

Huh.

Okay.

That's useful.

What do you think, Aditi? Is that a decent definition?

That's a really good definition. I like it.

Thank you.

So maybe as a last question, we want to ask how it fits in the bigger Google DEI efforts because I think Google, at least when I joined, I didn't realize how much of the work is going in this area. And to me, this blew my mind. Where does this fit in the bigger Google projects and efforts and priorities?

Absolutely critical. It's part of our OKRs. And those 4 pillars that I kind of alluded to earlier of hiring, growth, focusing on belonging and inclusion, and the 4th pillar of learning, that really kind of expands out to the wider Google org. But again, I can only speak to what we're doing here at Cloud Security. You can kind of take that and kind of zoom out, and it's the same principles that are being applied across the board.

That makes a ton of sense. So, I guess I want to wrap this up by saying this has been an interesting and wide-ranging conversation for me. A very philosophical, what is allyship, all the way down to advice to Anton of not having to think of a response when listening to people. Are there closing advice you would give or follow-up reading? We hate to leave our listeners empty-handed, and one of the things we love to do is have a recommended reading for people to go check out. So is there something you would encourage our listeners to go read up if they wanted to learn inside or outside of Google, preferably suitable for both outsides? On how to be more effective allies.

Absolutely. So stay tuned for our series of blog posts that are coming up, where we'll kind of outline resources that anyone can really utilize. And remember, the goal is really to create that space for learning and sharing and understanding each other's humanity. That's the ultimate goal. And we're doing that through just curating and lifting up people and making sure that everyone's voices are being heard. And that's just going to make for not just a better Google, but a better world.

Awesome. So closing advice to lift up everybody's voices and make different points of view universally accessible and useful. Aditi, thank you so much for joining us today.

Thanks so much for having me. Thank you.

And now we are at time. Thank you very much for listening and of course for subscribing. We hope to see you at our podcast and of course at our next conference, cloud.withgoogle.com/next. The event's going to be running for a few more days this week, so watch for more podcast episodes from us. during the next conference. Of course, also watch for blogs from Google Cloud and Allyship. These are coming in a few weeks. You can find this podcast at Google Podcasts. We would probably love you more if you join at Google Podcasts, but we would love you if you join through Apple Podcasts, Spotify, or wherever else you got your podcasts. Also, you can find us at our website, cloud.withgoogle.com/cloudsecurity/podcast. At this point, I do remember the URL, and hopefully you do too. Please subscribe so that you don't miss episodes. You can follow us on Twitter @CloudSecPodcast, and of course, your hosts are also on Twitter @Anton_Chuvakin And @TimPico. Tweet at us, email us, argue with us. And if you like or hate what you hear, we can invite you to the next episode. See you on the next Cloud Security Podcast episode. And of course, see you at the next show.

Security.