Special: Sharing The Mic In Cyber with STMIC Hosts Lauren and Christina: Representation, Psychological Safety, Security

Security.

Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here, as ever, are myself, Tim Peacock, the Senior Product Manager for Threat Detection here at Google Cloud, and Anton Chuvakin, a reformed analyst and senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website, cloud.withgoogle.com/cloudsecurity/podcast. If you enjoy our content and want it delivered to you piping hot every Monday, or when we have special episodes like this one, please do hit that subscribe button. You can follow the show and argue with your hosts on Twitter as well, twitter.com/cloudsecpodcast. Anton, I am delighted by today's special episode because we are finally getting to share the mic in cyber with the originators of share the mic in cyber. How cool is that?

Indeed, indeed. I mean, it was something we've been wanting to do, but we were like, didn't dare approach them, I guess. At least I didn't, right? So it's going to be really fun.

No, I didn't feel cool enough to do that yet.

Oh, we didn't feel cool enough. That's right.

I feel like we finally arrived and are useful to the community and have something to give back. And so it's so great and it's such a great movement. And this episode has a lot of great content in it. So maybe without further ado, let's welcome today's guests. Listeners, I'm delighted to introduce today's guests. We are joined today by 2 guests. First, Lauren Zabrick, Acting Executive Director of the Belfer Center at the Harvard Kennedy School, and Christina Murillo, Principal Security Consultant at Trendmark Security.

Hi, Tim.

Oh, hi. We're so excited to have you here today, uh, talking about your awesome project, Share the Mic in Cyber. And I love that we're sharing our mics with you today. Could you introduce yourselves and tell us about what Share the Mic in Cyber is all about?

Sure. Hi everyone, this is Lauren. I'm one of the co-founders of Share the Mic in Cyber. And what it is at its core is this online movement, which has actually evolved in various ways, but it's a social media movement in which we elevate the voices of Black cyber professionals and really highlight them as experts in the field because for so long, you know, they haven't really been given their due, right? You know, so many people are here working very hard and not getting that recognition. And so we really sought to change that and really to try to catalyze change in the field. And so at this point it's been, gosh, over 2 years. And my co-founder Camille Stewart, she has now returned to government. But yeah, over the years we've had all these different people participate. So when they do, they share their platform and, you know, an ally will share their platform with the practitioner. You know, we've had people participate like CISA Director Jen Easterly, NSA Cyber Director Rob Joyce, for For instance, you know, at one point we had over 100 million Twitter impressions.

So— Wow.

Yeah, a lot of great activity, I guess you can say, in this space. And Christina participated several times in the movement, and then we've sort of asked her to come on and help out with it. So Christina, I'd love to kick it over to you.

Yeah, that was such a great intro. I feel like, yeah, that's a wrap, we're done, let's go home now, right?

No, we've got so much more to say.

I know, right? And so Christina Murillo, it's a pleasure to be here. As Lauren mentioned, I recently joined the team at Share the Mic in Cyber. I like to say that I'm keeping Camille's seat warm while she makes the world a better place in DC. And yeah, super happy to be here. By day, I'm actually a principal security consultant at a cybersecurity boutique firm called Trimarc Security. And by night, I do all sorts of things. You— I would need like 5 hours to go through all the stuff that I do. So I keep—

But a podcast.

But you have a podcast as well.

Wait, wait, wait. That's important.

I did have a podcast. I did. I don't have it anymore. But it's something that I would love to maybe revisit because I had so much fun when I did it. So yeah, happy to talk about that later on as well.

So I want to touch on an area that's especially important to me personally. I want to talk about representation. I came out as a bisexual man a couple years ago. And when I came out, I didn't know another bi guy on my teams. And I felt very lonely. Representation is so important in so many areas. What's the connection between representation and cyber? And share the mic.

So for us, when we really started this, we looked out at the industry and I had just sort of come into this role at the Cyber Project at the Belfer Center. And with everything going on with the murders of George Floyd, Ahmaud Arbery, Breonna Taylor, and far, far, far too many people, I realized that I had not only a platform but also a responsibility. I had always looked at security, representation in security, because I was in the intelligence community before and in the military as a civilian, et cetera. I'd always looked at it more as a gender issue just because that was my lived experience. But over the last couple of years, I really started to understand, like, the curtain, right, was starting to really get pulled out of the way for me. My understanding of the world really had started to change. And I knew that I had this responsibility. I knew I had a platform. To try to make change in the industry. And you're right, representation matters because we want to be able to see ourselves in these roles so that we can actually step into those roles. Because, you know, otherwise it's just going to be sort of the same demographic and we're going to be looking at the threats, especially as they evolve, in the same sort of way. And we wanna be able to keep up with that. We want to be able to pull in people and keep them here.

And we So, to follow up on the theme that you just brought up, I feel like the aspect of psychological safety comes up in some of these discussions, and it matters for us in cybersecurity because sort of we are supposed to have others feel secure, and if we feel insecure ourselves, that's a bit of a problem. So, can you share a definition of what that is and why it's important for our domain?

Christina, I'd love to kick this over to you too, because I know you've been speaking a lot about this. And I will say that this is actually part of the theme of this year's Share the Mic in Cyber. It's really, it's on belonging. And then as part of that, it is psychological safety and really the ability to show up and to be able to share and speak up when it comes to being in a team and having that comfort and having that trust with people. And so there's a lot of, I think, contours to that. But yeah, Christina, I'd love to get your thoughts on this because you have been speaking about this a lot.

Absolutely. So for me, I think we need to touch a little bit on the Representation issue, right? Because I believe that it goes hand in hand. And as far as representation, it's super important not only because it makes teams better, like you know within cyber and outside of cyber, but specifically in cyber. I think that you know we work on very tough problems day in and day out. And if you only have one certain type of person, whether it's white male, whether it's just male, you're only going to see a certain set of problems. I think that what diversity does and just that representation, it allows. us to build teams that encapsulate a bigger dataset of issues, right? Like maybe a perspective that you have, Tim, or that Anton has because of your lived experiences, I may have a little bit different perspective because of my lived experiences, right? So, my threat models may be a little bit different that, you know, and you may or may not have considered those because your lived experience was completely different. And then, in terms of psychological safety, to me, I see that as A huge part of it is belonging, yes. But I think it's more about feeling comfortable with showing up at work, at school, as you are, right? So if you are a bisexual man, if you are, you know, if you are in the LGBT crowd, if you are a Black woman in tech, a Black man in tech, whatever the case may be, that you're still able to show up as you are and do your best work, right? Without any of those things being a barrier. For you, right? And so that's important for me of representation and psychological safety. I think also it showcases when we're not able to show up as our best selves and as our authentic selves, we withhold a lot of our brilliance because of that, right? So you're not going to get 100% Christina if I don't feel safe in your presence, if I don't feel safe in the presence of a specific team. You'll likely get my good work, but you're probably not going to get my best work because I don't feel comfortable being myself.

I think that is such an incredible way of putting that, Christina. And I also want to build on top of that. You know, I think, you know, we've been talking about diversity and how important it is, why we need diversity on these teams for, I think, you know, hopefully more than a few years, but essentially a few years now. And then I recently read this article in the Harvard Business Review sometime last year that essentially said these 2 things go hand in hand. To truly ensure that diverse teams are working, you need to have this element of psychological safety. You can't just put a team together and say, okay, I have all the elements here to make a diverse team, now go, right?

That's not how it works. That's not all it takes.

Yeah, right? You need to have that, you know, the conditions set for that. And so, that's what we're trying to do. with this year's Share the Mic in Cyber to really explore those conditions so that we can operate at our most optimal level so that then we don't have this constantly, you know, the cycle going around saying, well, you know, diversity, it just didn't work for us, you know, but, and not really understanding why, not setting those conditions.

So then I'm really curious, and Christina, what you said really resonated with me about good work versus great work. Cyber is so important and so hard to get right that we really need people's greatest work, not just their okay work. Lauren, to that point, and to your point, Christina, what are some of the tactical things that we're learning from this year's Share the Mic that we should talk about to make teams be safe to be effective?

Yeah, I think, you know, that's something we were recently discussing, right, Lauren? Like some tactical takeaways. And I won't spoil any of the surprises that we have in store for the day of action. But what I will say is, I think in my perspective, one of the most important things is the ability to listen without— I call it listening at scale. And what that means to me is listen without wanting to respond all of the time, right? Because sometimes I may tell you something that, you know, as a woman of color, that maybe as a white male, you may not like to hear. It may make you a little bit uncomfortable, right? And I can try my best to make it land softly. But if I talk about racism and discrimination, that may be uncomfortable for you to hear. And so I think that it's super important for folks who consider themselves ally to be okay with listening to like a little bit of uncomfortable truths. I think that goes a long way. Right. But, you know, I'll let Lauren talk about some of the other things that we've discovered. I, I don't think you should spoil it, Lauren, but so people can tune in. But if you want to sprinkle some little, you know, sparkles here and there. Oh yeah.

To your point, I think the listening aspect is really crucial, but also I think Sort of flipping that around, that curiosity, right? And asking questions of each other. And even if you don't know where to start, the article that I mentioned from the Harvard Business Review even gave a framework. What are your hopes and goals? What do you want to accomplish? What do you bring to the table as far as your resources and your skills? What are your concerns and your obstacles? What are you up against? And that really, I think, creates conversation. And then, Christina, Not to get a little too personal, but you've talked about, and I think we've all felt this, right, in different aspects, but being a part of a team, like this sense of belonging.

Yes.

We all have these responsibilities, whether it's a manager or a leader or even a team member. Everyone has a responsibility to create this sense of belonging and make sure that diversity works. It's not just on The person who, you know, may be new to the team. It's not just HR, for instance, it's literally on everyone. And that's something that we really want to explore is like, what, what are the roles that we all play in this?

I think that's such an interesting set of answers there. I love the answer about listening. You know, it's funny, I think a lot of people might imagine when you're starting a podcast, it's about talking. But one of the things that Anton and I have learned is that it's definitely actually about listening and being curious. Not about talking. So that's an awesome answer. And that's true outside of podcasting especially. So I love that.

Absolutely. I definitely agree with that. I think that it's, believe it or not, not many people listen to listen, right? I think most people listen to respond. And so I think, you know, that's super important, just kind of like building that rapport. But yeah, to Lauren's point, I think it's something that I— this is a very near and dear topic to me because I've been in the industry for a very long time, you know, more than 2 decades, and this is like part of my life story, right? Like, I experience this day in and day out. It's very difficult for me to feel a part of a specific team because I'm typically the only, right? The only woman, the only person of color, the only this. And I'm, I'm not really one of the guys, right? And so, I— it's taken me a long time to figure out that, hey, listen, you can be amazing and not be one of the guys. However, it does feel isolating. So it's just, we're complicated. Humans are complicated.

Yeah.

Where, you know, we can be emotional sometimes, but—

Sometimes.

Yeah, sometimes. All of the time.

Yeah.

Most of the time.

Yeah.

Most of the time. That's got to be really tough. And to keep doing that for 20 years, that's amazing.

It's very tough. But, you know, discipline and persistence and perseverance are like the name of the game. But, you know, I think there are a lot of folks of color and a lot of others in cybersecurity and in technology. And a lot of times we don't necessarily get a fair opportunity. We don't typically get promoted into leadership positions. There's so many things that, that kind of we have to face and deal with, not taking away from any other issues, right, that are equally important. But I think that that's why this is a very important conversation, right? Because we you know, with Share the Mic in Cyber, we're showcasing that, you know, we do exist. We're here. We're amazing. We're doing amazing work. You need to hire us. We need to work together. We need to collaborate. We're great collaborators and kind of like elevating that population of folks.

I love that answer. So, this really feels like kind of the core mission of the Share the Mic in Cyber effort is exactly this. So, as you look back on the project and as it's grown, are there a couple of fun lessons or surprises that have come out of it? And what are you looking forward to with the future of the project?

For me, it's been sort of a journey, I guess you could say. And I'm someone who likes to be kind of behind the scenes to push change. I don't necessarily have to be in the spotlight. And so, I remember there was this one experience I had where I was like, I don't need to be out there. And we started to sort of win some awards, and I started to get a little bit uncomfortable about that because I'm like, well, I'm just trying to push this change. I'm not trying to be out here and get all these accolades, right? Then someone in the Share the Mic in Cyber community told me, you know, we need people like you actually talking about these issues, right? It's not about you sort of getting all the shine. It's like, no, you need to be out in front talking about it. And that really changed my perspective on that. So now I'm like, if this is going to move, you know, the needle on this, then heck yeah, I am happy to be out there to be in the spotlight talking about it.

I think for me, it's been like, as kind of a— as an observer the past few years and now being part of the team, I think what I'm really excited about is kind of seeing folks come together. I think that a lot of great relationships have been born from this initiative, and I'm super excited to see, like, what happens, right? Like, I know that there are folks from Google that have met folks from, like, the White House and, like, just these really cool initiatives where folks get to talk to Jenn Easton. So just other— just really cool people, whether or not they're like visible. I think that's super important. I think that seeing that is what has excited me, like looking at these opportunities for folks to just be elevated, folks that are typically underestimated. So I'm super duper excited about that. I don't necessarily care about the accolades. I'm also behind the scenes, even though that sounds a little bit oxymoronic. But I enjoy being behind the scenes, even if the project I'm working on is visible or the work I'm doing is visible. I think it's more the feel-good that I like, you know, feeling like I'm helping others and contributing to others' success. That's like what gets me up in the morning.

I have to say, Christina, to hear you say that, to sort of understand the impact of the things that the whole community has been able to do, That feels awesome to hear that those things have resonated and helped. And you're right, there have been so many different things that have come out of it, right? There in the first campaign, there was a scholarship that was created by an ally and practitioner pairing, and now it's a scholarship that anyone in the community can say, hey, I need this amount of money to get this certification or take this class or whatever. It's like that money is there for people to use.

That's so great.

Yeah, the Making Space Initiative, Cyber Base, which is a resource for people to say, hey, I'm here for media or for events or speaking. So there's really no excuse anymore when you're like, I'm trying to put together a panel and I want to make sure that it's not just a white man. All right, you have resources there. And then of course this year, the Mike and Cyber Fellowship at New America. So many different things have come out of this. organically. I always, always, always love hearing about the stories of connection and opportunity that have come out of it. Indeed.

Perfect. So we're coming to our famous— well, I guess maybe not so famous, but favorite closing questions. In this case, I think we would ask, how can listeners help? And where can they learn more? I think we're gonna put the links to social media campaigns and other stuff in our resources. But we'd love to hear you speak about what What's— what are your top 1 or top 3? How can our audience help with Share the Mic?

First, you can follow Share the Mic in Cyber on social media. You can follow Lauren and myself, of course, but definitely follow the Share in Cyber handle. Follow the Share the Mic in Cyber hashtag as well. You can sign up to be an ally or a practitioner for— I believe it's August 21st. And that's our day of action. So you get to be paired up with, if you're an ally, with a practitioner, if you're a practitioner, with an ally, and hopefully start a very fruitful relationship for the both of you. There's, you know, ways to donate. I'm super excited about the fellowship. I just want to say that. So you can follow that and hopefully, you know, if you're interested, sign up for the next cohort, which is going to be super fun. So there's so many ways to help and yeah, super excited. And you can always reach out, you know, for any type of like custom help, or if your organization wants to help, you can always reach out to Lauren and myself and also Kaitlyn too. And we can, you know, kind of talk about it and work something out as well.

Yeah. So as Christina mentioned, our day of action is going to be Friday, October 21st. But throughout the month, we really tried to generate buzz and excitement and, you know, do different events and things like that just to, you know, start to get the word out and start to get people excited. Obviously, as the pandemic, I think, starts to slowly fade, I think there are going to be less events online and hopefully more in person. But right, Friday, October 21st is when allies and practitioners will be on social media, both on Twitter and LinkedIn. And really one of the biggest things that people can help us do is just to amplify. We want to be able to get the message out. We want more eyes on that We want more eyes on these relationships to hear the stories from people, or I guess read the stories from people, and learning about the elements of psychological safety and the elements of belonging and how we can apply those to our own teams and organizations to really move the needle on diversity. So, stay tuned for that. There'll be some— Pieces coming out and obviously this podcast and hopefully other events. So we're really excited.

Well, Lauren, Christina, thank you so much for, for joining us today. This episode is going to air on that day of action. We're really excited to do the coordinated release on that. We're really excited about this project and just so grateful that you were able to take the time to join us today.

Thank you so much for having us.

Yeah, thank you, Tim. Thank you, Anton. I just want to say too, you know, Google overall has been such a great supporter. So we really do appreciate it.

We're really happy to support.

All right. Thank you.

And now we are at time. Thank you very much for listening, and of course, for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever else you get your podcasts. Also, you can find us at our website, cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter, twitter.com/cloudsecpodcast. Your hosts are also on Twitter, @anton_chuvakin and @tina Tweet at us, email us, argue with us, and if you like or hate what we hear, we can invite you to the next episode. See you on the next Cloud Security Podcast episode.

Thank you, everybody.