00:00:07:20 - 00:00:42:10
Anthony Pacilio
Welcome, everybody, to today's webinar Strengthening Cybersecurity with Neurodiverse Talent. My name is Anthony Pacilio I'm the Vice President of CAI Neurodiverse Solutions. Briefly, here’s a little about me. My responsibilities here are to help organizations build neurodiversity programs, but to also lead our global expansion efforts of CAI Neurodiverse Solutions. My expertise lies in managing neurodiversity recruiting efforts, developing connecting pipelines, and ensuring best practices for onboarding, support, training, and organizational success.
00:00:43:11 - 00:01:02:14
Anthony
I'd like to take a moment to go over some housekeeping items. If you have any questions to submit during the discussion, we ask that you use the handy Q&A feature found at the bottom bar of your Zoom app. There's going to be some time at the end of the discussion that will address as many questions as we can.
00:01:03:02 - 00:01:24:01
Anthony
In addition, you're going to find more information on the event in the chat box, so be sure to follow along with that as well. And lastly, I want to let you know that we're recording this session today for future viewing. Joining me today in talking about cyber and neurodiversity is my good friend of over five years, Michael Fieldhouse.
[Sharing agenda slide with 4 points: Introduction, Discussion, Audience Q&A, and Wrap up.]
00:01:24:28 - 00:01:56:21
Anthony
Michael and I share the same passion for neurodiversity. His passion for ensuring people who think differently and having the opportunity to find employment, is second to none. We've presented at numerous conferences and in hotels and had a beverage and pondered how we grow the inclusion of our neurodivergent population. Today, if you take one thing away from our chat know this, you will not find a more strategic, forward thinking, inclusive human being than Michael Fieldhouse.
00:01:56:23 - 00:02:19:05
Anthony
Let me give you some brief background on Michael. He is the Social Impact Practice Leader and Director of Cybersecurity for DXC technology and the Executive Director for the Dandelion Program. Michael holds a Bachelor of Applied Science in Computer Technology, Master of Business Administration and is a graduate of the Advance Management Program at Harvard Business School.
00:02:19:14 - 00:02:59:24
Anthony
La Trobe University has also appointed Michael as the adjunct professor in Cybersecurity and he is an advisor to Dow Jones and Wall Street Journal Pro. Michael established the Dandelion Program with the Australian Federal Government, which is focused on building IT (Information Technology) careers for people on the autism spectrum. The program has been running for over 7 years with more than 120 autistic people in the program with partners such Australian Department of Defense, Department of Home Affairs, Department of Human Services, Department of Social Services, NAB and ANZ Bank in areas of cybersecurity, software testing and data analytics.
00:03:00:09 - 00:03:32:12
Anthony
The program has been downloaded by 600+ organizations across 91 countries via our good friends at Cornell University. He also has helped establish the Neurodiversity hub (which I am proud to say CAI Neurodiverse Solutions is a part of) and Genius Armoury to attract neurodiverse talent into the cybersecurity industry. So, Michael, my friend, welcome. Just a quick note. Michael and I will go through some pointed questions during the webinar.
00:03:33:04 - 00:04:01:09
Anthony
As we touched upon earlier, there's going to be an opportunity at the end for the audience to ask questions as well. Let’s go to the very first question. You and I have talked about cyber and neurodiversity for four years, but it's probably going on five at this point, understanding that Neurodiverse individuals were opting out of the field due to a plethora of reasons.
[Screen switches to show Anthony and Michael's discussion]
00:04:02:06 - 00:04:13:12
Anthony
Can we talk about or expand on the reasons and how do we change the narrative and bringing these talented folks into the cyber field?
00:04:13:13 - 00:04:41:10
Michael Fieldhouse
Thanks, Antony, and thanks for the very kind introduction. It's very interesting for cybersecurity at the moment as we realize the growth in attacks, the growth of electronic systems in our lives.
00:04:41:10 - 00:05:05:27
Michael
Attacks have almost doubled and tripled over the last five years. If you look at how many devices we have in our houses and our cars are now a lot more technology orientated. I think there's a couple of compounding effects here about people leaving the industry. One is people just generally leaving the industry.
00:05:05:27 - 00:05:28:16
Michael
It's a very high paced industry. You are never “off” if that makes sense because it's 24 by seven. Attacks come from around the globe. Sometimes they follow the sun so they know they start at one point, they try attacks out in one part of the globe and hoping that they were successful.
00:05:28:17 - 00:05:53:25
Michael
They then attack another part of the globe. So cybersecutrity is actually shift work. I think that's a hard thing for anyone. Everyone leaves eventually shift work. It's one of the most difficult things to kind of manage with what we call eyes on glass and standing up teams. I never thought of myself being on call 24 by seven and, you get calls at 2:00 in the morning when somebody is trying to attack a cargo system.
00:05:53:25 - 00:06:16:12
Michael
You spend all day on the attack and that impacts your family life and your quality of life. An unhidden one is really about mental health. And that's really some of the environmental factors that go along with that.
00:06:16:12 - 00:06:44:14
Michael
Obviously, the pace of work because of the constant never-ending backlog of stuff to do. From spending lots of time “eyes on glass”, to spending lots of time, just “in environment” where they there aren’t windows, cyber workers don't have the same interaction we have.
00:06:44:14 - 00:07:12:18
Michael
It’s very hard to “unplug” as they say. We’ve only started realizing working in virtual environments, and the needs of support in virtual is very different. If you go to a building site, (inaudible) you need hard hats or you need working boots. You need to need somebody, we call them in Australia, a lollipop man who actually moves.
00:07:12:18 - 00:07:37:25
Michael
The construction person is “always-on” and can't come and go. (inaudible) And if you think about it, we don't really have that in virtual environments yet. That's probably another thing where organizations that are starting have to work out what are the guardrails we need to put in or what extra support needs to go around those environments, which are a lot sometimes, you know, a lot more stressful.
00:07:37:25 - 00:08:06:01
Michael
There’s a difference in doing 9 to 5 programing to somebody who's working a shift at 1:00 in the morning. It's going to be very, very different in that kind of environment. How do you actually engineer that, especially in a virtual environment? You could do that from home, but you will probably be waking up, doing a call in the middle of the night and up the whole family at the same time.
00:08:06:18 - 00:08:24:22
Michael
Even though we do have virtual options, that actually allows us to do the work, but it does have other downstream impacts. This is also not just about neurodiverse individuals. How do you actually get more safety around this broad issue?
00:08:25:14 - 00:08:56:21
Anthony
So and I know a long time ago we touched on this but let’s discuss the age gap. You’ve got your teens to mid-twenties and then then mid-twenties and on. Are we seeing more young neurodivergent people opt in for cyber or are we getting there, or are we not moving the needle enough?
00:08:56:23 - 00:09:00:26
Anthony
What are some things that we might be able to do?
00:09:01:23 - 00:09:23:03
Michael
It's a couple of things. You just need to get more people into the pond. People with cyber, they’re talented enough to work across the broad industry of IT. The challenge is they're not just an application developer.
00:09:23:03 - 00:09:46:09
Michael
They actually understand networking. They understand operating systems, they understand the breadth of IT and that makes them quite valuable. So they understand when somebody is talking about networking and they can understand that and then I can understand the application layer of the operating system, but they understand what I call more the stack. But also I think another big part of it is that it's just not those types of roles we're interested in.
00:09:46:09 - 00:10:09:23
Michael
We've unfortunately created the stereotype of cybersecurity as the guy in the black hoodie, that sits there and everyone needs to be a hacker. There are over 52 different roles in cybersecurity via the NICE framework, (the National Initiative for Cybersecurity Education (NICE) Workforce Framework for Cybersecurity)and it’s great. Sphere is actually putting out a framework as we understand it.
00:10:09:23 - 00:10:55:06
Michael
So there are lots of different roles from just going from compliance to looking at roles in, you know, people who are doing actually “eyes on glass” or even activities to find the bad guys or be an ethical hacker. There are a number of actually people in that. I think that they’re really in demand. This is a good thing because it’s attracting more people broadly into the actual area then the stereotype of the hacker and that's probably the thing the Cybersecurity industry hasn't done enough of and also providing pathways from high school or even community college or even at a university too.
00:10:55:07 - 00:11:21:27
Michael
If some people do have the ability to show that they have some Cybersecurity skills, that is actually giving them a pathway. It usually comes down to the teacher or the lecturer or that they might have a little bit of interest in cyber. The teacher could actually steer a student down that pathway to pick up some extra study rather than just looking at them as just being a programmer.
00:11:21:27 - 00:11:50:11
Michael
There is also another compounding factor as well. We are in a very early stage of getting more people into the STEM subject area. As we become more technology driven in this world, more countries are going to need IT workers in some shape or form. (inaudible) They all have to be in IT.
00:11:50:11 - 00:12:14:11
Michael
If you think about it from the biomedical industry, that’s IT workers. (inaudible) IT people that have typically worked in industries that have technology are now automated. For example, the automobile industry. An auto mechanic that is maintaining electric cars. How much stuff's in IT around that?
00:12:14:11 - 00:12:19:27
Michael
There is such a very broad need for workers.
00:12:20:20 - 00:12:41:12
Anthony
So the worker population has been typically dominated by males in the industry. Is there a shift in that or are we still going down that same road?
00:12:42:13 - 00:12:59:23
Michael
I think what's quite interesting is we've picked up through our new recruitment and even the Genius Armoury here, which is the platform we've sort of built to help, which is free, people can use it and that helps with people kind of understanding if they're kind of right for the industry.
00:12:59:23 - 00:13:25:12
Michael
We see about 30% females come through that as inquiries. People are getting a lot more interested from a broader range. I didn't expect that 30% of females would actually access the platform. And I think that's just kind of if you can provide things are out there. (inaudible)
00:13:25:12 - 00:13:39:25
Michael
(inaudible)
00:13:39:25 - 00:14:21:04
Michael
There are a number of really good case studies where, people may have been a cook in the bow of a ship and he's now one of the best cyber people. What was his passion during that time? He used to love doing puzzles, you know? Anthony: Really? Michael: Just doing crossword puzzles and other puzzles. If you look at, how the government found codebreakers during the Second World War in the UK, it was actually through crossword puzzles and the games people did. Something a lot of people don’t know about that time was that a lot of the codebreakers were actually female, because the males were actually out on the front lines in the Second World War.
00:14:21:04 - 00:14:45:24
Michael
The bottom line is you have to work with the population you've got. And I think that's about how do you actually create inclusivity in an already inclusive environment, with an inclusive process? The answer is to attract everyone to the corner or have a have an opportunity to participate.
00:14:46:09 - 00:15:23:13
Anthony
So this brings me to a follow up question on that. We talked about the jobs in cyber. Let's say that there's 50 plus. Are there any of those roles that would fit better with someone who thinks differently or is it just a holistic approach and one size fits all?
00:15:23:22 - 00:15:59:26
Michael
I think if your being neurodiverse you can fit in all roles. I don’t think you stovepipe people down one set of roles. But the part of is doing the right assessment up front or giving some opportunity to try most roles like try the basic families. (inaudible) If you are skilled with data analytics, your competency aligns yourself to a family of roles. So if your skills do align, you want do what you are good at and you want to get better.
00:15:59:26 - 00:16:25:20
Michael
We all come with strengths. So the key is identifying those strengths. There are a variety of roles such as compliance, governance, coding roles and more. (inaudible) We often miss the mark on roles that need to be team players.
00:16:25:20 - 00:16:49:19
Michael
(inaudible) Everyone thinks about cybersecurity as a lone wolf role. But actually that’s a small part of the industry. Where a lot of the industry is actually about working in teams to actually solve the problems and to bring the kind of the idea of neurodiversity to table is important part, which isn't playing as a team.
00:16:49:19 - 00:17:10:03
Michael
Another part of the assessment process is actually working towards what people want to do. Do they like working in teams or how much they want to work in teams? You have to understand that and also give them skills. We had one individual, for example, that is about being inclusive in teams.
00:17:10:03 - 00:17:48:13
Michael
We've been trying to solve a problem for six months. And interesting enough, a new member of the team came along and had a quick look at the problem. (Unintelligible.) He actually solved it in an hour. We've been trying to solve it for six months. That’s the diversity of thought and diversity of inclusive teams. We should have actually almost done a bit of a hackathon around it or brought more people into the team rather than just dividing the team.
00:17:48:13 - 00:18:08:23
Michael
The team is the broader organization. I think we have to get better at more inclusivity within the organization or even within the actual departments and divisions. Somebody might have a great idea like this example. The solution was very simple and quite elegant, but no one really thought about it that way.
00:18:09:08 - 00:18:33:29
Anthony
For the neurodivergent workforce, are one or two things from an assessment perspective that are key to finding that talent? Or does it have to be all of the assessment to make that determination.
00:18:35:07 - 00:18:55:20
Michael
I think you've got to do a prescreening approach. That’s the thing we've been very much focused on and how do you screen people for motivation and natural skill. You need to give people the opportunity to try out cyber work by learning what it is and sharing with them the different roles.
00:18:55:20 - 00:19:22:05
Michael
We've been very big at doing that and it gives us an opportunity not to close the door quickly. Which typically happens in most recruitment process because it will (unintelligible)give the opportunity for the candidate to say, I really do like to like cyber, but I think I'll be better at doing compliance, or I really do like manipulating data.
00:19:22:12 - 00:19:42:03
Michael
Then we will let them look at data. If you open the door wide enough it gives people the opportunity to see what else is there. And I think I'm a big advocate for trying to get more people into the actual kind of industry rather than trying to close it down quickly because it's growing.
00:19:42:05 - 00:20:14:03
Michael
During COVID, for example, United Nations said the cyber attacks went up by about 50%. So imagine the volume you are dealing with and I think that's the challenge we're going to live with. And we're living in a kind of a Cold War era where cyber is the way of actually inflicting economic damage or another kind of damage from afar.
00:20:14:28 - 00:20:39:19
Anthony
So we just talked about having more folks opt in to cyber. Are universities and colleges preparing the students for this field? Are they preparing them appropriately or are there other avenues that they can take to see if cyber is the right space for them?
00:20:40:14 - 00:20:58:19
Michael
I don't think they do enough of the front end of it. I think that you're 17 or 18 trying to make a decision about if you are going to be a cyber person, you really don’t know.
00:20:58:19 - 00:21:27:27
Michael
And I think it's having courses that are too specific too quickly can limit people rather than actually opening up. I would like to see people doing more minors in cybersecurity or a minor in cybersecurity and business administration. If you think about it from a compliance perspective that a chief risk officer needs to know cyber.
00:21:28:04 - 00:22:00:27
Michael
It's a major risk. So why isn’t that part of an MBA, or some kind of business degree? Doing minors in cyber is saying it’s everyone's role to be protect the organization. It's not just the role of a few. Most high tech hacks actually occur via us by human error or not doing things from clicking on the wrong email to dealing with a phishing attack.
00:22:00:27 - 00:22:31:22
Michael
Or dealing with social engineering where people take after people, or people not patching systems. We’ve got to get better at, broadening the aspect of cyber into more roles. I'm a big advocate for that in business. Why aren’t people doing cyber in biotech? You’re creating a medical device and you need to know how to protect it.
00:22:31:27 - 00:22:49:11
Michael
How about cyber in cars? (inaudible) It’s like having a door to a house. You don't build a house and then not have a door and not have a lock on it.
00:22:49:26 - 00:23:06:06
Michael
(inaudible)We’ve got to get better at doing that. And everyone knows that when you build a house, you need to have a door. Where do you put the alarm system and how do you want to do security? That’s how you protect yourself.
00:23:06:06 - 00:23:30:00
Anthony
Let's shift gears here. I know you're well-versed in mental health, neurodiversity and cyber. I know you've done quite a bit of research in these particular areas. I’d love to hear your take on what you've seen over the past 5 to 10 years.
00:23:30:21 - 00:23:52:03
Michael
I think people are starting to understand that the cyber environment is quite stressful. So that's number one. (inaudible) The amount of people leaving organizations or leaving groups and they switch to different careers.
00:23:52:03 - 00:24:16:07
Michael
Within IT, people are starting to realize that these are stressful environments. That’s a good thing for everyone to start to realize. There is more discussion around it. I think the date needle hasn't moved from an HR perspective of what tools and operational policies can put in place to help that mix.
00:24:16:12 - 00:24:42:18
Michael
We haven’t gotten to that part where you're changing policies, we have to find policies for those areas. I’ll use construction as an example because it's very physical and everyone can see it. You have great policies around moving asbestos. But you don't these policies for people working in virtual IT work.
00:24:42:18 - 00:25:16:06
Michael
(inaudible) Following that will have to be better defined EAP services or Employee Assistance Programs. And then what we have been doing is a lot of mental health training both for the individuals and for managers. The question is, how you have better mechanisms for mental health, like mindfulness training, how to take a break, how to know you’ve got stress, and when do you have anxiety?
00:25:16:06 - 00:25:55:04
Michael
So is actually getting to know some of these factors and then having mechanisms in there to allow you to go for a walk, to talk to a friend, and getting better mindfulness. Some organizations I’ve seen will teach yoga (inaudible). We've used tools like mobile phones or other desk-based tools, where they actually could reach out to somebody if they are feeling stressed.
00:25:56:12 - 00:26:17:18
Michael
There’s still more work that needs to be done on how managers and leaders regulate more leave and rotation in groups? And that's always hard because everyone likes the work they are doing in cyber or just the rotation of people to ensure that they're coming back for relief.
00:26:17:25 - 00:26:26:26
Michael
The rotation is there to ensure they are not always doing “eyes on glass” at 1:00 in the morning. They're doing other stuff. (inaudible)
00:26:27:19 - 00:26:52:10
Anthony
With cyber being a hot button for most firms, (inaudible) is there a lifespan in the cyber field? Are we doing a better job of expanding that lifespan from a position perspective? I mean, obviously, you know, our neurodiverse community is getting into the workforce.
00:26:52:10 - 00:27:23:27
Anthony
We're finding meaningful careers for folks who think differently. We want them to be there for as long as humanly possible. We don't want them to get burnt out. Are we doing enough as companies in society to make sure that the road ahead, may be not as bumpy as it was ten years ago because we didn't have the tools in place to make sure that they had the mental health keys available to them?
00:27:25:06 - 00:27:44:24
Michael
(inaudible) I don't think we've got the tools in place to help people from a policy perspective. That’s where we're lagging behind. We are still seeing a lot more burn and people just leaving. (inaudible) They go and basically become a programmer.
00:27:44:24 - 00:28:11:03
Michael
They’ll do some coding and that’s all they will do. (inaudible) We've got tools coming in, for example we have a lot more automation, but the volume is always going up. The problem is the volume. There's a lot more automated attacks. The attacks get more sophisticated and it's sometimes bots against bots, but there's actually a person behind designing that bot.
00:28:11:03 - 00:28:41:08
Michael
It’s the volume that actually comes through. How do you deal with the volume? For example, our supply chains a lot more integrated. So we now have to manage the risk within a supply chain with somebody doing a cyber attack. (inaudible) Our electronic systems are so integrated from somebody might be making a piece of the car and that gets integrated into the into the chassis of the car.
00:28:42:08 - 00:29:04:19
Michael
So that's a supplier example and it’s a third party risk. And you know, and this is the challenge of these systems running from things. (inaudible) One of the attack I’ve seen was focused on agriculture in a fish farm. We were talking about food security there.
00:29:05:09 - 00:29:22:28
Michael
This is the broad range of attacks actually. We need to get better at those policies. We need to look at these environments differently in a virtual sense. “It’s all working in IT.” We just give them a broad brush, “it’s IT work,” but it's not really IT work.
00:29:22:28 - 00:29:45:24
Michael
Cyber is a very stressful environment and watching some of those indicators like absenteeism, people obviously leaving the environment. I know those are actually lagging indicators, but start to document those, and then you can really start to say, “how do we do something differently?”
00:29:46:00 - 00:30:13:29
Michael
I do recommend things like mindfulness training upfront. Getting people who are working in teams to share problems doesn't happen enough. So I think so you actually can share a team in general. Also teamwork. How do you get good teamwork to happen in software environments? Lastly, how do you manage the volume.
00:30:14:24 - 00:30:28:10
Michael
It’s a pendulum on that and you have to make the business aware that it is, speed versus risk. So you have to slow down the business a bit.
00:30:29:01 - 00:30:57:20
Anthony
As neurodiversity in the workplace kind of evolves or continues to evolve, changing the culture inside organizations, are companies now understanding both the return on investment in the cyber space by hiring these talented individuals, or do we have a ways to go in educating decision makers that they're missing out?
00:30:57:20 - 00:31:15:21
Michael
I think it's the latter. People are still dealing with the volume and the cost of the environment. When you’ve got the volume and the costs, (inaudible) you've got to start factoring that into the business.
00:31:15:21 - 00:31:37:08
Michael
You have to ask a some questions from the start. How do you get bit more inclusive? How do get more people into the area? How do you manage that talent, that neurodiverse talent in the workplace? You also need to consider tools and platforms.
00:31:37:08 - 00:31:58:24
Michael
We use a series of tools and platforms to do it. Then make sure you have policy settings. There’s no one silver bullet. All of this is happening at the same time.
00:31:58:27 - 00:32:30:25
Michael
You have to make sure that you can attract people into it and make sure you can support the talent. You have to be able to support neurodiversity on the ground with that talent. How do you have the right environment to ensure that people are able to succeed and be supported? You have to make sure that there is an assessment upfront to ensure that they fit the right roles. This is especially true in early careers particularly when people don't really know much about the environment.
00:32:30:25 - 00:32:33:18
Michael
You've got to have a very good early career program.
00:32:34:22 - 00:33:15:18
Anthony
(inaudible) With pattern recognition skills and jobs we talked about, is there data to support this or is it too new? Is using neurodiverse folks more productive or finding threats or looking at incident response policies? What are we what are we seeing in that space based upon what we're getting back?
00:33:15:18 - 00:33:40:28
Michael
We've seen studies and we've done studies ourselves about productivity in the environment. We’ve seen about roughly 30% improvement in productivity. But also, another angle is saying to somebody who's of an ethnic background, “are you going to be 30% more productive?” I think that's a wrong kind of measure.
00:33:40:28 - 00:34:03:21
Michael
I think the question is: how do you staff the environment with diverse talent that gives you a competitive advantage? (inaudible)
00:34:03:21 - 00:34:25:27
Michael
If you don't build up a classic way of bringing in talent, you're going to lose to organizations. And I've been consulting to the US and I've seen teams leave in a day. They get the job day then just pick up and go to another competitor because their skill sets are needed.
00:34:25:29 - 00:34:55:02
Michael
How many things are now online for example imagine the Disney Channel and people from Netflix move over to Disney. THer are a lot of people creating ways to communicate to their market or their audience. And a lot of it's now online. Ten years ago, and even before that, you never had Facebook and all these other big things.
00:34:55:02 - 00:34:57:22
Michael
Now they consume a huge amount of cyber talent.
00:34:59:05 - 00:35:24:06
Anthony
I don't know if you can expand about upon retention. We know in our (neurodiverse) community that typically retention is pretty high. Does it still hold true in the cyber space? I'm assuming it does, even though the world is opening up doors left and right. What are your thoughts?
00:35:25:07 - 00:35:54:09
Michael
Yes, I think it still holds true about retention. But again it's how you manage the burn out and in itself I think that's the key. I think retention rates are high in regards to loyalty to the organization. But the other risks, unfortunately, especially with Neurodiverse with Neurodiverse talent, is the mental health or the purportancy with mental health issues.
00:35:54:12 - 00:35:58:15
Michael
But that's kind of ensuring that you do have those supports in place.
00:35:59:15 - 00:36:19:05
Anthony
Okay. So looking kind of the probably the final question before we get to some Q&A here, looking at the best we can, what does the future look like from, a hiring perspective for neurodivergent individuals in the cyber space?
00:36:20:04 - 00:36:41:27
Michael
Yeah, I think it's two things. I'm hoping that there are broader and early on-ramps for early careers that actually have neurodiverse talent and can support neurodiverse talent. I think that's something we don't do enough of. So I think this has to be early on-ramps and supported processes for neurodiverse talent in there.
00:36:41:27 - 00:37:05:09
Michael
I think the early careers part of the program has to be re-engineered a little bit to ensure that. So you can go through an open door, which is quite a wide door, but then have a stream of support, especially from onboarding into workforce integration. So that is number one.
00:37:05:24 - 00:37:25:22
Michael
I hope the future is that we get better at doing that and of course we need to do it from the cyber industry anyway to bring more people in. (inaudible) I hope there are the processes and support structures in place for cyber environments for individuals.
00:37:26:00 - 00:37:51:01
Michael
So we need to get better at doing that and that's important. (inaudible) Then the other part is people thinking past the iconic stereotype of the cyber hacker and think about cyber more broadly as there are a lot more roles and careers that people can do in cybersecurity.
00:37:51:26 - 00:38:04:09
Michael
More people need to be thinking innately. You need a “gunner program” to become a data analytics person to go into cyber.
00:38:04:25 - 00:38:32:21
Anthony
We’ve talked about a breadth of things during this first 40 minutes. We’re going to turn to some of the questions that we have here. (inaudible) Michael, are there statistics on mental health, cyber and neurodiversity in the workplace?
00:38:33:00 - 00:38:43:23
Anthony
Also, do you know if they are being captured? What is being done to combat it?
00:38:44:14 - 00:39:06:19
Michael
This is actually a growing discussion around mental health and cyber. There’s a little bit of stats coming through. (inaudible) The Wall Street Journal did one around mental health. (inaudible)
00:39:06:19 - 00:39:30:09
Michael
I don't think we're doing enough empirical research around it. (inaudible) Conversely, there is now a more identified environment with regards to neurodiversity and mental health. About 80% of people that are autistic will have a mental health challenge as well.
00:39:31:02 - 00:39:40:06
Michael
Those mental health challenges might be anxiety and might be dealing with depression. That’s a well-known stat.
00:39:41:18 - 00:40:01:15
Anthony
We do have a question from the audience here. There are a number of successful people who are neurodiverse but would likely never disclose it out of concern for the impacts of their career. Do you think we're at a point in society where these individuals can finally open up?
00:40:02:25 - 00:40:32:07
Michael
I think we're slowly getting there. (inaudible) In environments where I work, (inaudible) people understand they can disclose they are dyslexic, or autistic. It’s very open now.
00:40:32:07 - 00:41:02:29
Michael
I think it will depend on the organization. But we are slowly moving there. (inaudible) I've been involved over eight years now in the area with neurodiversity and cyber, we're only just starting see people are very happy in role to say now I'm autistic or I’m dyslexic. They see accommodations and also the manager training is starting as well.
00:41:02:29 - 00:41:22:29
Michael
It's not just about the individual, it's also about the environment and the training. The policies need to be there to help support people disclosing and also allowing them to get the appropriate support. I still think there's a bit of a way to go on employee assistance programs.
00:41:23:09 - 00:41:36:25
Michael
They are still too general, and need to be a lot more specific. The support systems and the policies are still lagging behind.
00:41:38:05 - 00:42:00:23
Anthony
With regards to training and managers, what tips do you have for your hiring managers to screen when these candidates may not come across communication wise, the same as other candidates?
00:42:00:23 - 00:42:25:22
Michael
I'm actually not a big proponent of an interview process, so we don't use interviewing as a mechanism. I think there are a number of biases and flaws in interviewing. There are ways more interesting like games and people actually doing activities. So you actually get to see how they perform. And I think that's the CAPA [or Corrective And Preventive Action is a methodological strategy for mitigating risks and improving processes, identifying the sources of actual or potential issues and their root causes, planning solutions for those problems, and documenting the solution so that similar issues don’t occur in the future.]
00:42:25:22 - 00:42:44:20
Michael
The added part in cyber are the added pressures of trying to fix things quickly or because of the attacks that occur, it's how people handle pressure. But that really depends on the environment and the leader as well.
00:42:44:20 - 00:43:12:19
Michael
I think the other thing is regarding stressful situations and (inaudibe)to allow the manager to understand how to manage the person in a stressful situation. (inaudible) I think having more activities, and working at it very early could help. I like activities that have options for working in teams and working alone.
00:43:12:19 - 00:43:35:16
Michael
Get a good understanding about where they would fit. It’s very hard to fit a lone wolf into a team environment. For example, I've done that to screen out more people, quite a few people actually, as lone wolves, not to come into cyber teams. It's a team environment.
00:43:35:16 - 00:44:09:08
Michael
You end up burning out the team. (inaudible) It's a team effort and it seems like it's counter to the stereotype. (inaudible) It’s about take talking about things as capability rather than talking it as how the individual fits into the role.
00:44:09:27 - 00:44:34:16
Anthony
You said something else that I want to kind of go back to. So gamification, right? It’s a big thing for assessment processes in this neurodiverse community as well. How do you utilize gamification in the cyber space to get candidates in that pipeline? What kind of games or activities are you doing?
00:44:35:22 - 00:45:00:01
Michael
There are a couple of things we do. One is education first. We give people an understanding of what a day in the life looks like very early. For example, we built this for Genius Armoury, as a mass online open course. We're trying to give people a picture very early of what cyber looks and what does a career potentially look like?
00:45:00:01 - 00:45:17:10
Michael
What is a day in life look like? But also trying to expand the number of roles I might think of in cyber. It’s going to take still a long while yet. If you think about some of the well-known career or practices outside of IT. In medicine, there is a surgeon, there is an anesthetist.
00:45:17:10 - 00:45:38:20
Michael
There is somebody who is a cardiologist. We all know those things. We're not very good at knowing what the cyber industry is. (inaudible) We still have a lot more to mature as an industry. Cyber is growing and obviously it's accelerated, but we haven't done enough to educate people.
00:45:38:20 - 00:45:58:20
Michael
(inaudible) So I think that's kind of making sure we have a broad aspect of education at the front and then actually sharing what kind of roles. And I would actually try and do more to attract talent in having little videos about what was my role is like in the organization and include it on YouTube.
00:45:59:04 - 00:46:17:14
Michael
It doesn't have to be high production. It just has to say if you are interested I’ll send you a link to a video. For example, this is us working in a hunt team, (inaudible) and actually explaining it.
00:46:17:16 - 00:46:42:09
Michael
That’s what we've been doing with trying to get people interested. And then once you get people interested, then you can actually expand their thinking about what's available and then you get people to play games and games associated with the skills of the competencies you actually need in those roles. And I think that's some of the identification of what skills and competencies you do need for the roles and having games associated with that.
00:46:43:02 - 00:47:22:06
Anthony
As you build these assessments, it's an evergreen process, right? You're refining, you’re planning new things that maybe should help in the education and training or finding out where that talent is going to come from or who that talent is going to be. Are there a couple of things over the last year that you've noticed with neurodiversity in cyber that you've had to modify to make the process either more fluid or flowing or whatever it may be?
00:47:23:07 - 00:47:49:18
Michael
Yeah, it's good point. We’ve focused on work performance management. We've built a tool around work performance management that's specifically for early careers or neurodiverse talent. So we built a tool around. So that helps with a good performance management discussion. And this is where we're trying to understand at an early stage some of the risk going on.
00:47:50:10 - 00:48:11:16
Michael
What I mean by that is actually some of the stresses in the actual environment. We’re trying to understand from a performance space and also start to understand what things are blocking performance as well. So we've built a very unique tool. Most of the performance management tools are very behavioral based and it takes the assumption that you need to self-advocate.
00:48:12:10 - 00:48:36:01
Michael
(inaudible) We’ve got a lot of people that are neurodiverse that don't self-advocate well and they end up being underemployed in the environment. We've been very focused on building tools around that. Other tools are coaching platforms that allow mentoring. We have also very focused on building
00:48:37:08 - 00:49:00:14
Michael
technical career paths that are based on some of the frameworks. And what we mean by that is when you're building an individual development plan in the environment, you could easily build a technical career plan. So we actually trying to get better actually at upskilling our people in the organization.
00:49:00:14 - 00:49:21:09
Michael
So the goal is that we don't have people underemployed, or people getting bored, but they also know where they're going and trying to get very good at with those pathways. We’ve been focused on sustaining talent and sustaining capability and what tools need to be in place to do that. (inaudible)
00:49:21:09 - 00:49:34:14
Michael
(inaudible) We want more people in the front end. So we've built a Genius Armoury to do that. The real question is how do you sustain talent and sustained capability?
00:49:35:00 - 00:50:09:11
Anthony
So as you spoke about advocacy, there's two things advocacy in cyber and career mobility in cyber. Are we seeing more young folks (not excluding any age class here,) advocate for themselves in this space to get these jobs? Are we still kind of turning the wheels (inaudible) with the advocacy piece?
00:50:10:02 - 00:50:29:08
Michael
Especially in the early careers area, I think most people still need a bit of pushing in that skill set. They need to build skills about how to advocate and self-determination. (inaudible) Also mindfulness, we’ve been trying to build more mindfulness in.
00:50:30:06 - 00:50:51:14
Michael
It’s important to recognize when you are actually stressed or when you might need some assistance and building those pillars. I think not about one area, it’s about how do you self-advocate? You've also got to have self-determination about really where your skill sets are at and discover what needs to improve.
00:50:51:14 - 00:51:17:23
Michael
(inaudible) A great way to help managers is to build tools and processes to support these. There’s a bit of work that needs to happen with organizations to make sure those tools are available for talent coming through.
00:51:17:23 - 00:51:42:28
Michael
(inaudible) One of the things we do is focus on building a resume builder so that their projects added automatically to all the work they complete.
00:51:43:06 - 00:52:06:23
Michael
So at the end of it, the manager can see what types of work has been completed because it’s hard to remember sometimes what had been accomplished. This way it's built into a system so people know, they can do that skill or project. This also helps with the job crafting for the next role and in a way it's teaching people job crafting skills.
00:52:07:07 - 00:52:25:15
Anthony
We have another question for you. Is it possible to hear an example of the kind of game or activity that you might provide if you're hiring someone who needs a coding and team collaboration skills?
00:52:26:17 - 00:52:58:15
Michael
Yeah, I think there are two parts. For the team skill, we use kind escape rooms. Given that everything is now online, we've been using virtual escape rooms. You can see how people act as a team. It's been quite new for us over the last two years during COVID, using escape rooms and virtual mechanisms to work on team bank exercise.
00:52:58:15 - 00:53:22:12
Michael
(inaudible) Also we use a more motivational questioning on the front end. (inaudible) As we know, motivation is important to job satisfaction. It’s getting not just about getting a job, but actually getting satisfaction in the job.
00:53:22:12 - 00:53:45:21
Michael
It's actually making sure that they've got the right motivation for the job. And then for coding exercises, you might give them some scenarios to write some scripts around. So you give them an exercise to look at some logs and they can write scripts around them, and that might be Python (inaudible) or some coding stuff.
00:53:45:21 - 00:54:10:05
Michael
(inaudible) Another example for data analysis, we have them look at someone who logs in, and they then write some SQL or some kind of query-based code to look at different logs and work out who tried to log in at 1:30 in the morning.
00:54:11:13 - 00:54:36:11
Michael
(inaudible) We've built a with a colleague, find the hidden mole in the organization. (inaudible) That's for high school kids. We’re looking at an adult version of find the mole in the organization.
00:54:36:11 - 00:54:45:28
Anthony
How did you how did you come up with the escape room piece?
00:54:45:28 - 00:55:09:17
Michael
Our team based exercise ideas were originally based in a physical environment and working on a project together. Most of the work previously was working around robotics in regards to big robots. We found things like Lego Mindstorms.
00:55:10:17 - 00:55:37:03
Michael
But if you have anxiety, your motor skills go down. So you had people who couldn't put the Lego together. So we found that the Legos weren’t very good. We’ve also used a lot of large-scale robots and then you can use Python, you can use a whole bunch of different kinds of (inaudible) and everyone builds around it. So you can have a project manager, you can actually have a different roles around that robotic build.
00:55:38:00 - 00:55:49:12
Michael
So the idea just came about during COVID because you have to think a bit more laterally during the lockdown, so what do you do? And it was an escape room.
00:55:49:15 - 00:56:09:28
Anthony
So I have one more question. Let's talk about remote versus onsite in the cyber space. Are we going to back to the office? Are we going to stay fully remote?
00:56:11:03 - 00:56:32:14
Michael
It depends on the environment, because some environments are always going to be secure. So they'll have to come into a secure operation center or SCIF (Sensitive Compartmented Information Facility). (inaudible) Some roles are going to always be physical (or onsite) because of the security levels because of the way those operations work.
00:56:32:14 - 00:56:49:04
Michael
The other thing is that some of the work can be done at home. And I think this is where we're still learning how to do that. We're currently in more of a hybrid environment. The hybrid form creates a lot more flexibility if you're managing it right for the individuals.
00:56:49:04 - 00:57:17:06
Michael
But again, it gets down to having the tools in place to ensure that they are able to work as a team if their role is to work in teams. We've got to work at how you create more collaboration. And it could be simple things we've done, for example: having morning coffee meetings, or people using Slack, or some people using chat sessions.
00:57:17:16 - 00:57:43:24
Michael
I know another example is that every couple of hours everyone gets on Zoom and they code. And I just have this idea that somebody can be in the office next to them. You’ve got to use multiple things to stay connected and you can create an the environment where you can make it spontaneous.
00:57:44:04 - 00:58:03:03
Michael
I think that's what physical environments are. They are very spontaneous. People bump into people, there's noise, there's always something different going on. Using any of those mechanisms for now could be an open Microsoft Teams or a Slack channel or two. You could also have virtual coffee or a time when everyone has lunch together.
00:58:03:13 - 00:58:08:17
Michael
I think it's making sure you have those activities going on to have that connectedness.
00:58:08:28 - 00:58:37:00
Anthony
I appreciate you spending the last hour with me. Unfortunately, our time is over, but I'd like to thank you, my friend, Michael Fieldhouse for joining us today from across the world. It's always a pleasure seeing and hearing from you. So thank you once again. I would also like to thank our audience for your attention and participation. Later, we're going to be sending everyone that attended a recording of this webinar to share with your colleagues or peers.
00:58:37:00 - 00:58:59:00
Anthony
In the meantime, if you’re interested in learning more about CAI Neurodiverse Solutions, or know someone that is, contact us through the link on the screen. After our session ends today, you’ll see the CAI Neurodiverse Solutions contact form pop up on your browser so feel free to include your contact information if you would like one of our team members to reach out to you directly! [Screen shows the CAI Neurodiverse Solutions logo in the top left corner, the title of the webinar, Strengthening Cybersecurity with Neurodiverse Talent, is below the logo. Under the title the slide says "Thank you for attending! To learn more, visit www.cai.io/neurodiverse-solutions and To connect with our team, visit [https://www.cai.io/neurodiverse-solutions-contact]
00:58:59:13 - 00:59:05:16
Anthony
Thank you and have a great rest of your day!
[{"asset_name":"www.cai.io","asset_url":"https:\/\/www.cai.io","asset_type_code":"site"},{"asset_name":"Resources","asset_url":"https:\/\/www.cai.io\/resources","asset_type_code":"page_redirect"},{"asset_name":"Events and Webinars","asset_url":"https:\/\/www.cai.io\/resources\/events-and-webinars","asset_type_code":"page_standard"},{"asset_name":"Strengthening cybersecurity with neurodiverse talent","asset_url":"https:\/\/www.cai.io\/resources\/events-and-webinars\/strengthening-cybersecurity-with-neurodiverse-talent","asset_type_code":"calendar_event_single"}]
While the chronic shortage of talent in cyber remains and cyber-attacks are on the rise, individuals with a natural ability to fill these roles remain unemployed. That is why it is important for organizations to think differently to develop alternative pathways to recruit, develop, and embrace neurodiverse talent to strengthen their cybersecurity and mitigate risks. Watch the webinar replay.
If your company is interested in working with CAI Neurodiverse Solutions, please visit this page to provide us your contact information to connect with you directly.
