Women continue to be underrepresented in the cybersecurity workforce, which leads to missed opportunities for today’s organisations to acquire the best information security talents. But what is holding the security industry back from attracting more women in the field?
Hoda Al Khzaimi was always keen to pursue a career in a technical subject.
She describes herself as having had “a passion” for engineering when she was young, as being someone who “wanted to know the proof of an algorithm” and to work out the meaning of equations that she saw.
Unlike in many nations, as a woman in the UAE interested in these fields, she did not stand out.
“When I decided to focus on technical studies, we had more ladies in engineering and information security classes: we had 70 to 80 in our class; in the male class we had 50 students. Women here are being encouraged in these fields,” she said.
Her enthusiasm has translated into a highly rewarding career in cryptology, the science of codes. She earned a PhD in Denmark and is now a research assistant professor in engineering at New York University Abu Dhabi, and director of the institute’s Centre of Cyber Security.
Women are well-represented in science, technology, engineering and mathematics (STEM subjects) in many other parts of the Middle East too. For example, half of science degrees in Saudi Arabia are awarded to women.
In Al Khzaimi’s field of cybersecurity, a very different picture emerges globally, however. According to the International Information Security Certification Consortium or (ISC)², only about 10 percent of the cybersecurity workforce worldwide is female. In computing as a whole, women occupy fractionally more than one quarter of positions.
Dr Maria Bada, research fellow in The Global Cybersecurity Capacity Centre at the University of Oxford’s Oxford Martin School, has experienced cybersecurity’s gender imbalance first hand.
“I go in different meetings, whether it’s with technical experts or governmental representatives or policymakers, it doesn’t make a difference: the gender imbalance is the same,” said Bada, who is originally from Greece.
“I could be in a meeting with government representatives, and everyone is male. In many [situations] I will be the only female.”
Bada does not feel unwelcome because of her gender; if anything, the opposite is true: she has had “a very positive experience”. But she is clear that the gender imbalance has consequences.
“There’s a lack of experise in the field in general and people say this is because of women not joining cybersecurity. If women … went to study and work in this area, that lack of expertise, that lack of people and skills, would be erased,” she said.
This skills gap has caused much concern. For example, 2017 research by the Enterprise Strategy Group (ESG) suggested that it was causing difficulties to 45 percent of organisations.
So why has cybersecurity globally not attracted more talented women like Al Khzaimi and Bada?
Many researchers feel that wider preconceptions of gender roles influence decisions linked to careers.
“From a very early age people are shaped into particular gender stereotypes: technical professions are more suited to males; caring professions are more suited to females. That’s related to other social attitudes,” said Professor Silke Machold, a specialist in women’s status in the workplace at the University of Wolverhampton in the United Kingdom.
“If the industry is very male dominated, there might not be many women to look up to, to find role models who make them want to choose a profession. Then the phenomenon keeps perpetuating itself,” she said.
In cybersecurity, Bada suggested that terminology that could be perceived as aggressive may put off women.
“As a field, it’s not very attractive to women because usually the language used is, for example, ‘This position would require you to combat cyber threats or build resilience,’” she said.
One highly contentious suggestion to explain a lack of gender balance is that men and women, on average, have different capabilities.
The subject’s controversial nature was illustrated by last year’s sacking by Google of a male engineer who suggested that men were typically more suited to technical roles and that efforts to increase female representation might not, as a result, make business sense.
Some psychologists do suggest that there are average differences in the nature of men’s and women’s brains. Simon Baron-Cohen, professor of developmental psychopathology at the University of Cambridge, has spoken of the “female brain” (which is more common in, but not restricted to, women) as being stronger at empathising than systemising, with the opposite pattern seen in the “male brain”. He has described autism as representing the extreme male brain.
Others, such as Gina Rippon, professor of cognitive neuroimaging at Aston University in the United Kingdom, reject this idea.
While tests may indicate that there are gender differences in aptitudes (as examples, men tend to perform better on spatial tasks, women at multitasking), Rippon said that the brain is “very responsive to experiences.” So the capabilities of people will vary if their experiences have been different, even if the starting point was the same. Rippon cites the example of London taxi drivers, whose “visuospatial parts of the brain increase in size”.
“So the idea is that women aren’t in science because their brains aren’t organised appropriately, but you can show that that’s a function of experience, not the fact they’re female,” she said.
Another issue that has caused discussion is why there is a less equal gender balance in STEM subjects in countries often perceived to have higher levels of gender equality.
One idea is that, in less equal societies, women choose STEM subjects because they offer the chance of a career, rather than marrying young and having children. By contrast, in nations where gender equality is seen as being higher, specialising in science may not be seen as necessary by women intent on establishing a career.
Another hypothesis is that boys are falling behind educationally in Middle Eastern countries, especially in sciences, because the disparity in quality between girls’ and boys’ schools is greater in the region than elsewhere. Further ideas to explain the “gender equality paradox” exist.
“The other explanation is that [in certain countries women] have the luxury not to go into an environment that’s not welcoming,” Rippon said.
Al Khzaimi, who experienced a more male-dominated environment in science in Denmark than she did in the UAE, thinks the family support structure in the Emirates makes it easier for women to choose scientific careers. Without this, she says science would be a less realistic option because of the long hours of laboratory work.
She is concerned that this support structure may weaken as women migrate, say, from other emirates to the capital for work. This could restrict career options.
“Your family is three hours away now. Most of the local workforce in Abu Dhabi, they come from Ras Al Khaimah or Fujairah or Dubai, or the same thing in Dubai,” she said.
“I’ve been interviewing a couple of candidates and their major concern is, ‘We don’t have enough support to leave our kids at home and be in the experimental lab.’
This highlights for Al Khzaimi the importance of robust maternity leave and childcare provision, as these enable women to follow their passion for technical subjects – such as cybersecurity.
“That should be a requirement of all the institutions in the UAE, to make sure you can leave your kids,” said Al Khzaimi.
