When the SANS Institute, the cooperative research and education organization that trains security professionals around the world, piloted CyberStart in seven states last summer, the overall response was striking.
Officials had hoped to attract around 1,000 participants for the free online cybersecurity training exercise, but had to cap registration at more than 3,500, SANS Director of Research Alan Paller said.
The only problem: Only around 5 percent of the players were women.
This summer, the organization intends to take CyberStart out of pilot and debut it nationwide — which will require backing from either governments or parents. But before it does, it’s running Girls Go CyberStart, a free online pilot that’s dramatically similar to CyberStart but geared toward female high school students.
Registration is open Jan. 29-Feb. 16, after which participants will have a chance to solve online challenges for prizes. The prizes, which like the training are funded by SANS, include cash grants to top schools, computers and other prizes.
The first-place contestant in each state will win a paid trip with a parent to the Women in Cybersecurity conference in Chicago March 23-24.
Elayne Starkey, chief security officer at the Delaware Department of Technology and Information, said her state is “just over the top” that the collaboration between SANS and governments is doing more to educate young women.
“It’s an effort on SANS’ part and our part and … lots of other people who care about this to support programs like this and energize our young and encourage the next generation of young girls,” Starkey said, recalling a time when information technology (IT) professionals weren’t necessarily regarded as having particularly good people skills.
“That’s not really an appealing profile for young women or other people who want to have a career,” she added.
In a statement, Anne T. Hogan, chief executive officer of Girl Scouts of the Chesapeake Bay, said the program “will allow girls to learn by doing, develop important problem solving and leadership skills, and take the lead on their futures.”
“Girls are natural-born scientists, which is why we introduce Girl Scouts of every age to science, technology, engineering and math (STEM) to help them see how they can improve the world,” Hogan added.
Paller divided the cybersecurity field into technical and policy areas; and characterized the gender disparity as being 90 percent concentrated on the technical side, which includes work in forensics, reverse engineering and intrusion detection. The issue, he said, isn’t so pronounced on the policy side.
Starkey said she’s noticed a lack of female participation across cybersecurity and noted the Women's Society of Cyberjutsu, a 501(c)(3) nonprofit that supports women in cybersecurity, estimates women constitute only 11 percent of the information security workforce.
“When we run our summer camp here for the U.S. Cyber Challenge, I could go around the room and count on the fingers of one hand the number of females who are there,” she said. “What the test scores don’t show is that peer pressure, that age when peer pressure is incredibly important."
But already, Paller said, SANS is seeing heightened interest in Girls Go CyberStart, which has 10,000 spots, and is greatly encouraged by the response. One day in, on the morning of Jan. 30, 641 girls had registered — a marked improvement on CyberStart, which needed nearly five days to reach 600 participants.
The course curriculum — with emphases on networking, Linux, cryptography and Python — is updated but largely unchanged. But the Institute, Paller said, learned an important lesson from CyberStart and is doing its best to engage young women on a different level.
“We presented it as a competition. And that did not draw a lot of young women. In this one, we’re saying ‘Discover your talent, see how high you can soar,’ and that seems to be doing much better,” Paller explained.
Or, as the Girls Go CyberStart website explains: “You could have a hidden talent for cybersecurity but how would you know? There needs to be a way for girls to ‘try out’ cybersecurity to see what it's all about.”
CyberStart testimonials sent by contestants to their respective states praised the earlier pilot highly. Aria Gupta, then a senior at John Champe High School in Maryland, thanked former Gov. Terry McAuliffe for letting her “try a new field of work” in a time when she was still deciding her major.
“This definitely helped me get on the right track,” Gupta said.
Paller said he’s doubtful men and women will ever be equally represented in cybersecurity — due to “social pressures on young women that we don’t have any control over” — but is “comfortable” saying the situation will improve as more young women discover it.
“The reason is, we’re finding that the fraction of people who are good at this is small, but they’re everywhere. By reaching out to rural America and girls and minorities and schools that have never had IT programs, we think we’re going to actually be able to radically increase the pipeline,” he said.
