Introduction
Cybersecurity remains one of the most critical risks we face as a nation today with cyber-attacks on the rise and the lack of qualified resources widening. The field remains challenged in sourcing talent, particularly among underrepresented groups (URGs). Women make up less than 20% of the cyber workforce and people of color even less. The need for inclusion and diversity is critical to a better workforce and to better problem solving which is critical in cybersecurity.
Although studies and articles discuss the critical need for diversifying the cybersecurity workforce, there is very little documentation or comprehensive playbooks that outline critical actions and success factors. In addition, over the last several years, industry has made increasing diversity a key priority, yet there has been little traction and improvement.
Therefore, we set out to identify the issues and barriers that prohibit progress and introduce a set of recommendations that could be implemented by educational institutions and industries that would lay the groundwork for a measurable increase in diversity in cybersecurity.
To accomplish our overall objective, we:
1) Analyzed literature on barriers and enablers to diversity in cybersecurity
2) Delivered a speaker series with respected scholars and industry leaders
3) Created questionnaires and surveys to measure progress and milestone achievement
4) Conducted three focus groups to analyze and discuss results
Focus Group Dialogue
Late January 2021, a Pitt team led a focus group dialogue discussion, about actions to diversify cybersecurity, which was published in the Cybersecurity Skills Journal (CSJ) Diversifying the Cybersecurity Workforce Special Issue. The group included educators and working professionals. During the discussion, participants highlighted numerous barriers and challenges in attracting individuals to cybersecurity, particularly those from underrepresented groups. For example: lack of resources, lack of awareness about the field, the inherited list of prerequisites before learning about cybersecurity, certification requirements, a clearance requirement (if working for the government), and lack of representation. Some participants indicated that mentorship was a significant factor, for individuals from URGs, to be able to navigate the cybersecurity professional environment. When asked about "one thing that should be done" to provide a pool of diverse talent, the majority agreed it would be cybersecurity career awareness at the secondary education level.
Survey Findings
We developed a survey focused on identifying, understanding and assessing variables affecting the participation of URGs in cybersecurity education and professional practice. The survey questions look the audience through the following:
- Demographics (age, gender, race, …etc)
- How important do you think each of the following experiences are needed in order to work in cybersecurity?
- How big of a barrier do you think each of the following pose to individuals interested in studying cybersecurity?
- To what degree do you think that each of the following enable an individual interested in studying cybersecurity?
- To what extent do you agree or disagree with each of the following statements?
- If there is only one thing you could change to make the cybersecurity field more diverse, what would it be?
The survey analysis (n=285) showed that the most significant barriers in diversifying the cybersecurity workforce are (in order):
- The existence of a non-inclusive environment for underrepresented groups in cybersecurity
- Absence of mentoring
- The need for post collegiate training
- Career option uncertainty
- Lack of clear educational pathways
- Absence of peer support networks
- Necessity to be highly technical
- Most Significant Barriers Graph - An Overall View
-
- Most Significant Barriers Graphs - by Gender
-
- Most Significant Barriers Graphs - by Race
-
The survey results analysis (n=285) showed that the most significant enablers in diversifying the cybersecurity workforce are (in order):
- Mentorship opportunities
- Collegiate cybersecurity programs
- Existing cybersecurity related industrial relationships
- Clear effort and commitment to expand diversity in cybersecurity
- Extracurricular cybersecurity activities
- Inclusive environment
- Seeing role models who look like me
- Opportunities to join outreach efforts in cybersecurity
- Diverse student body
- Most Significant Enablers Graph - An Overall View
-
- Most Significant Enablers Graphs - by Gender
-
- Most Significant Enablers Graphs - by Race
-
After grouping survey responses for the "only one thing you could change" question into core themes, the top 4 themes were:
- Expose high school students to the field of cybersecurity
- Avail more support specifically for underrepresented groups
- Create incentives for people to learn about cybersecurity
- Get rid of the gatekeeping male dominated, red team dominated, rockstar mentality
Reflections
Across each of the activities outlined above, several common themes emerged from participants and respondents, pointing to critical areas for intervention. For example, Cybersecurity is thought of as an exclusive club that is difficult to gain entry to, with lack of mentoring and support to help newcomers break through and be successful. In general, the study findings suggest that technical ability is not the most significant barrier – concerns about culture, mentoring, and support were more prominent. The #1 barrier is lack of inclusive environment and the #1 enabler is mentorship opportunities.
Barriers of entry reach across different aspects of education, workforce development, and hiring practices. Barriers can manifest as early as K-12 -- a lack of awareness of career options, access to resources and mentors, and traditional stereotypes such as the field being only for “geeks” – can be significant and prevent individuals from pursuing a career in cybersecurity.
Criteria for both higher education program admissions and entry-level jobs are additional barriers. Admissions criteria for a program can bar potential students who would do well in cybersecurity because they do not have the education and/or qualifications that typically fall under the imagined cybersecurity pathway. Similarly with entry-level job descriptions, the experience and educational expectations named in the description can dissuade diverse candidates from applying or being considered.
Often, companies want new hires to arrive already having the needed education and qualifications instead of building the talent. Large organizations have the resources to put actions in place to field talent through programs like apprenticeships, while small and medium-sized businesses often do not have the funds, time, and other resources to allocate to building employee skills.
There is no one barrier for individuals from underrepresented groups to enter cybersecurity, and there is no one potential solution to the lack of diversity in the field. Because barriers exist at different educational and occupational levels, there is a need for concrete, sustainable and measurable actions across K-12, higher education, and industry.
Recommended Action Items
As a result of what the team explored through this study, we recommend the following action items for higher-ed institutions (interested in diversifying the cybersecurity workforce) to implements and maintain:
- Host summer camps, programs, and experiences to build cybersecurity awareness at an early age
- Add more educational opportunities for cybersecurity either as a certificate, minor, or full degree
- Create mentoring opportunities and various systems of support for mentors/mentees
- Provide and grow access to cybersecurity internships and apprenticeships for underrepresented groups
- Track student enrollment (collecting demographic information) in cybersecurity programs (or courses) to measure the impact of any implemented change
In addition, take every opportunity with industry partners to
- make entry-level positions actually entry-level positions, and
- promote awareness about the importance of hiring senior-level diversity leadership in the workplace and enforcing current diversity policies.