Starbucks CISO Andy Kirkland on stage at RSA Conference. Photo courtesy of RSA Conference, copyright RSA Conference.

SAN FRANCISCO – The Cybersecurity industry has a diversity problem, noted many of the keynotes and panelists at the 2022 RSA Conference.

With only 24% of the global cybersecurity workforce being women and only 20% of that workforce being people of color, attackers have been able to exploit those biases, according to Vasu Jakkal, Microsoft’s Corporate Vice President for Security, Compliance, and Identity, who delivered a keynote address at the event. Diversity and a positive work culture is key to ensuring data is being collected and used in an ethical manner, she said.

However, it also conveys that the cybersecurity industry needs to “put more effort into attracting and retaining workforces representative of people and groups that have historically been on the outside looking in,” reported by SDxCentral’s Dan Meyer in an article about Jakkal's keynote.

In addition to Jakkal, Starbucks CISO Andy Kirkland, also spoke passionately about the challenge of diversity and inclusion in cybersecurity on day three of the event. In a keynote address, he spoke about how words and actions can affect leadership and work productivity in both a positive and negative way.

To explain his point, Kirkland reflected back to a meeting that was held on the sixth floor of the Starbucks headquarters in Seattle, Wash.

The meeting room was full of vice presidents, directors, and support staff. A leader — whose name was not released — said, “Stop being a bunch of Sallys and make a decision.”

Kirkland emphasized how once the comment was made, everyone felt the room grow uncomfortable. He said he was “frozen in fear."

Comments like the one Kirkland heard, unfortunately, are more common in the workplace than many people realize. In fact, Deloitte recently conducted a survey called Women @ Work 2022, and it showed that 59% of women have experienced harassment and/or microaggressions at work. In 2021, Deloitte reported a rate of 52%, which means the statistic has increased over the past year.

However, sexist comments are not the only thing uncomfortably floating around in the workplace.

Just three years ago, in 2019, Glassdoor — one of the world’s largest job and recruiting sites —conducted a diversity and inclusion study. The study surveyed over 5,000 employees in the U.S., U.K., France, and Germany. Of the 1,113 U.S. workers surveyed, 42% agreed with the statement, “I have experienced or witnessed racism in the workplace,” which was the highest percentage of any of the countries surveyed.

Numerous psychology studies have shown that comments like the one Kirkland experienced during his meeting can significantly decrease morale and work efficiency.

Kirkland told the RSAC audience that the meeting became a catalyst for changing the culture around him to be more supportive, communicative, inclusive, and diverse.

His first efforts to change the work environment was holding himself accountable. He wrote a preamble, or letter, and read it to his staff. In the preamble, he encouraged his staff to confront him if he does or says anything that offends the staff or makes them feel uncomfortable. By creating a more open dialogue, Kirkland was able to learn more about his staff and their needs, adjust his leadership style, and create a more productive workforce.

His second effort was creating a list of technical terms that needed to be changed. For instance, he changed whitelist and blacklist to allowlist and computing.

Along with adjusting technical terms, he also encouraged other leaders and executives to reflect on their work environment, and ask themselves if it truly is inclusive and diverse for all types of people, including non-binary, queer, Blacks, Asians, and other ethnicities.

An inclusive and diverse workplace is an important mission for the cybersecurity industry because, “Hell, hackers are more diverse than we are,” said Trellix CEO Bryan Palma during his keynote at RSAC. “They even understand the importance of a bigger tent.”

Kirkland signed off his speech urging employees to stand up for themselves and be the spark of change at their organization. He also asked attendees to remain cognizant and aware of their words and actions because they will always have larger impact on people than they expect.