State of Cybercrime by Varonis, Matt Radolec, David Gibson

June 15, 2018 How Infosec Can Implement Diversity & Inclusion Programs to Address Workforce Shortage and Make More Money Too

Data breaches keep on happening, information security professionals are in demand more than ever. Did you know that there is currently a shortage of one million infosec pros worldwide? But the solution to this “man-power” shortage may be right in front of and around us. Many believe we can find more qualified workers by investing in Diversity & Inclusion programs.

According to Angela Knox, Engineering Director at Cloudmark, "We're missing out on 50% of the population if we don't let them [women] know about the job."

For skeptics: creating a more diverse workplace isn't about window dressing. It makes your company more profitable, notes Ed Lazowska, a Professor of Computer Science and Engineering at the University of Washington-Seattle. "Engineering (particularly of software) is a hugely creative endeavor. Greater diversity — more points of view — yields a better result."

According to research from Center of Talent Innovation, companies with a diverse management and workforce are 45 percent more likely to report growing market share, and 70 percent likelier to report that their companies captured a new market.

I wanted to learn more about the benefits of a D&I program, and especially how to create a successful one. So I called Allison F. Avery, Senior Organizational Development & Diversity Excellence Specialist at NYU Langone Medical Center, to get the details from a pro.

She is responsible for providing organizational development consultation regarding issues such as diversity and inclusion, performance improvement, workforce engagement, leadership development, and conflict resolution.

In part one of our interview, Ms. Avery sets the foundation for us by describing what a successful diversity & inclusion program looks like, explaining unconscious bias and her thoughts on hiring based on one's social network.

Transcript

Cindy Ng: Allison Avery is a senior organizational development and diversity specialist at NYU's medical center. She is responsible for providing organizational development, consultation regarding issues such as diversity and inclusion, workforce engagement, leadership development and conflict resolution. In our interview, Allison demystifies common misperceptions about diversity and inclusion, offers a successful framework and methodology to implement D&I and, yes, confirms that diverse organizations do make more money.

Can you define for us what diversity and inclusion means?

Allison Avery: The way that I like to define, or the way that I'm going to talk about diversity, is really referring to the richness of human differences. And so, that can mean anything from socio-economic status, race, ethnicity, language, nationality, sexual orientation, religion, all the way to learning styles and life experiences. I know, for the context of this conversation. We're really going to target specifically on a lot with regard to race, and ethnicity and gender because that's really who's primarily underrepresented in the tech field. We're going to talk a lot about that, but diversity in and of itself primarily just means, really, difference, and it's sort of a naturally-occurring phenomenon.

And then, inclusion is the way in which we engage that diversity. So, it refers to active, intentional and ongoing engagement with that diversity. It's the way that we foster belonging, that we value and encourage engagement and that we really connect individuals throughout. Whether it's an organization or institution, to leverage their excellence, leverage their skills, leverage their skill sets and promote them to grow into the climate and the culture that we're trying to cultivate within an organization, within an institution and even within an industry. So, it's the way that we intentionally, and ongoingly and actively engage the diversity at hand.

Cindy Ng: Describe for us the kinds of diversity and inclusion programs you've implemented and what has been successful.

Allison Avery: There are a couple of different arenas that I think diversity and inclusion programming gets parsed into. One is primarily along the lines of recruitment and retention. Now, in medical school, we tend to not have any general issue with retention, but that tends to be in the domain of professional development. And that's pervasive throughout any industry, and I see that within a lot of the articles I was reading in the tech industry. There are some initiatives going on through Google and Twitter of trying to recruit individuals from different industries to companies, and that's just a pervasive element. So, we do a lot of recruiting here at the medical school for students from the educational pipeline. So, we go to undergraduate institutions, we have summer programs for students that are rising juniors and seniors to come and spend the summer to do basic science research, primarily targeted for Blacks and Latinos because those targeted minority groups are underrepresented in medicine. Only about 6% of medical school matriculants are Black-identified and about 4% are Hispanic-identified in the country. About 56% are white-identified matriculants in medical school in 2014.

So, there's a huge underrepresentation and, as we see the shifting demographics of the country over time, minorities will become the majority by 2050. That's kind of the projected...and even before, that's kind of of the projected year. So, we see a kind of need for greater representation in a medical school, so we do a lot of recruitment effort. NYU just matriculated its highest composition of diversity this past year or so. The entering class of 2014 was the most diverse ever, and so our efforts were quite rewarded in having a cultivated class of compositional diversity. That was a very successful effort and that is from going schools to having a very diverse group of individuals on the screening committee, on the interview committee. We have multiple mini interviews, so we have, where individuals do not review the full record. When students come into interviews, we try to eliminate aspects of bias. So, there's trainings on unconscious bias for all the interviewers, trainings on unconscious bias for all the screeners. That's another effort that we do. So, recruitment is a really big, targeted effort with regard to any industry for trying to attract and recruit underrepresented minorities.

Another area is educational enrichment. And so, there's a lot of efforts to look at how do we ameliorate and reduce health and health care disparities. That's basically looking at cultural competency training for all physicians, because healthcare is something, and rendering appropriate healthcare and rendering it across different cultural lines, is something that every physician needs to have the capacity for, especially when we're looking at the diversity in the pluralistic community of the patient population that all physicians are needing to have the capacity to serve. And so, I think that that's also generalizable to the tech industry when you look at the shifting demographics of the country of users. So, there is a huge pluralistic nation that we have, and people have different needs and there are very different markets that can be targeted and marketed toward. Having different educational initiatives, looking at how do we reduce health and health care disparities, and training students has been a very big initiative within the curriculum.

So, how do we basically educate our entire population of students to be able to render care for a huge and diverse patient population? They need to know about things like health disparities, they need to know about things like social determinants of health. They need to know about how bias might impact their decision-making on treating different types of patients of certain races, of certain genders, of certain sexual orientations. And they need to know how, generally, socially disadvantaged groups tend to receive worse quality healthcare.

Cindy Ng: Earlier you mentioned unconscious bias. Can you define that term for us?

Allison Avery: Unconscious is pretty much anything that's outside of our conscious awareness, which is primarily the main way that we operate, it’s likened that about 90% of our mental processes and the way that we operate is outside of consciousness. So, the unconscious is pretty much any mental process that is inaccessible to consciousness, but it influences our judgments, our feelings and our behavior. It's pretty pervasive.

And then, bias is really neutral term. It gets a kind of negative rap and it's something that we cannot do without, nor would we want to. But bias is pretty much, it's just a tendency or an inclination, but it's one that prevents an unprejudiced consideration of a question. So, it has this sort of stigma to it but bias is really, it's just a neutral thing. But the way that we understand unconscious bias and the way that we're talking about it, is in this arena of prejudice, social stereotypes and attitudes that we form about certain groups of people without our intention or our conscious awareness. And that's what we really mean when we're talking specifically about unconscious bias as it relates to certain groups of people and how that influences the way that we engage with people.

That's how I'm sort of using the term as it relates to D&I work in our workspace and how it might prevent the hiring of a person, how it might impede diversity and inclusion efforts, and that's been noted as one of a main and contributing barrier to compositional diversity effort. Hiring practices in the recruitment phase, in the interview phase, in trying to really, really have a very, very diverse workplace, unconscious bias has been kinda targeted and denoted as one of a huge area or an impediment to having the diversity that we would like to consciously see. And I think it's really important to make the distinction. It's the distinction between the way that we consciously believe, and we might have these very consciously-held egalitarian views, which I believe that we do if you look at social attitudes in this country over the past 40 years and the evolution of which they've grown, and they've changed and they've evolved very, very drastically. It's more stigmatized now to be a racist in this country than probably almost anything else. It's very, very stigmatized. However, when you look at some of our unconscious attitude and what some of the outcomes, a lot of our actual practices, i.e. some of the health outcomes, some of our housing outcomes, some of the actual behaviors and outcomes have remained unchanged.

So, like you were saying, in the tech industry, there have been a lot of things that have remained unchanged for the past 15 years or, you know, two years or 10 years. It's that spectrum or that dichotomy between the way that we consciously believe and, sometimes, the way that our unconscious behaviors and the manifestation of which gets played out. And bridging those two is the space of bias, and trying to bring those two things a little bit more in alignment and a little bit more closer together. So, we have there pretty egalitarian conscious attitudes, but the outcome of which doesn't really reflect that when you look at some of our composition in the workspace, some of our health outcomes and the way that we hope to think of ourselves. You know, look at the composition of our prison system, look at the composition of women in the tech field.

Cindy Ng: It's popular in the tech field to hire based on one's social network. What's your opinion on that?

Allison Avery: I think on face value and on first flush, that seems like a good idea but I don't think we've tracked the full ramifications of what that means. And I think that there's a way that, on first pass, that seems like a very respectable way to go about doing business, and I think on one level it is. But we need to do a little bit of a deeper dive on what do we mean by things like, how do we define culture fit? How do we define somebody who is aligned with our organization and the diversity that we want? And what are the actual ramifications of just pulling from our social networks? So, when we look at how people's social networks get created and cultivated, they tend to be, like you said, people tend to migrate toward people that are like them. And that tends to also fall within similar social identity categories, socio-economic lines and class status, correct?

So, on one level, it seems like a very good...on first pass, if you don't dig any deeper, it seems like a very good idea. Okay. Somebody suggests a friend and that person comes into the organization, and they probably do fit in very well, and they probably get along very well and then you kind of go forward without thinking much further. But then, when you look at the compositional diversity of who, then, you attract, everybody sort of seems to either come from similar schools so you're not getting a diversity of educational experiences, come from similar classes and, potentially, demographics. So, you might have similar social identity categories of composition. When you look at the composition...I was just reading this article called, "What it's actually like to be a black employee in a tech company," and they cited some really, really interesting statistics and I think it's very worthwhile to go over those because the Public Religion Research Institute has some statistics related to people's social networks. And you know, white Americans have 91 times as many white friends as black friends. I think that's really important because three-quarters of whites have entirely white social networks without any minority presence. So, if that's where you're pulling from, what are the odds that you're going to have a huge minority presence if that's the pool that you're pulling from? Clearly, just from a statistical representation, very, very small, correct?

But unless you know that and unless you're thinking in those terms, it just seems like a very good idea from first pass. That's why a deeper dive is so much more necessary, and that's why I think that there isn't this intentionally evilness to people who are anti-diversity. It's just that they don't tend to know, nor do they tend to dig, and there's this naiveté of, "Well, invite individuals from their social networks and things should just be fine." But people think that other social networks are much more diverse than they actually are, and that's just not true. And so, once you know that, once you know that, "Okay, if this is our structure, employees are actively encouraged to suggest friends or former colleagues," well, if you also know that your company is comprised of 57% of this, and then you know that those individuals are going to be 91 more times likely to, "Blah, blah, blah," well, then you're going to rethink your methodology. But generally, people don't have that type of statistical awareness or insight into how these social networks are formed or structured, and so they don't understand all the nuance related to recruitment and why it's so difficult to have elements of compositional diversity.

Cindy Ng: How would you reshape hiring practices?

Allison Avery: So, a couple of different things. One, I would have pervasive unconscious bias training for all hiring managers completely required. I mean, that's just a given and an automatic.

Number two, there are some things right at the outset that take people out of the running right away, like affiliate universities. There's pooling from similar universities that have a lower representation of underrepresented minorities.

So, you make partnerships with schools that are serving very high, either women or very high minority-serving institutions, and those tend to actually not be the Berkeleys and the Stanfords of the world. So, you can look at the compositional diversity of different institutions. So, I know at NYU we tend to partner with certain very specific institutions that have either very strong STEM programs, so they're doing a lot of work with very high-quality students and doing a lot of rigorous scientific work, and we make very strong partnerships with them so that we also know the quality and the caliber of the student. And so, you can be a hiring manager and you make partnerships with, whether it's a nonprofit or whether it's an undergraduate institution that's a high serving minority, but that you also are vetting with regard to the quality or you're investing in the quality. So, you can help mentor them in the creation or co-creation of their program and have some sort of influence. That's another way. So, you develop these kind of pipeline programs, that's another one, and then you reward those elements.

Having internship, that's another element. Not just pooling people from your social network. Also, the more diverse your hiring system is...so, we know that whatever kind of interview process you have, if you put five people in a room and that's the interview team, they are going to replicate themselves in who they hire. So, whomever you want hired is how you comprise your hiring team. So, if you would like a very diverse team hired, then you need to have a very diverse hiring team. The worst thing that you want to do is just have one hiring manager because you're most likely going to have that person replicated in whomever they hire. So, you want as many people to weigh in as possible and you want that team that gets weighed in as diverse as possible. So, that's another recommendation that we do.

So, those would be just the first pass of things that I would recommend, very quickly. And taking out words in the job description of what you're looking for. So, we know that there's a lot of gender priming in the job description, like things like, "Strong leader," and "Aggressive manager," and those are very, very gender-oriented. Or when people assume at the very outset, sometimes, a lot of things about people, relocation, if they're interested relocating or not, or inappropriate questions that they wouldn't ask, you know, a man versus a woman, and things like that and really being conscientious that is not present within any part of the on-boarding. So, that's also looking at the job descriptions and really making sure that those aren't either gender or sort of racially-leaning.

And making sure that these things are advertised and reaching individuals in different pockets, so utilizing and leveraging people in-house too, utilizing any type of people in-house. So, you know, in kind of reading some of these articles, there's a lot of informal or even formal professional networks within an organization or institution. So, we have the Black and Latino Student Association and they belong to a professional association called the Student National Medical Association. Well, that's primarily for black medical students. Then there's the NHMA, which is National Hispanic Medical Association and that serves Hispanic medical affiliates. And so, there's a lot of affiliate, there's formal and there's informal. I know there was one in one of the articles that I was reading of Twitter, called each other the Blackbird, Twitter's internal group for black employees leveraging the internal group that is serving or is in the interest group of certain underrepresented or underserved minorities that is your target. And being really intentional about saying that this is a priority, and this is why and this is why we're valuing a certain demographic that's extraordinarily underrepresented in this organization.

Also, when we look at paid differentials, so something that is very pervasive. So, when you look at how people are staffed, when you look at upper-level management and the composition, and how the color changes as you go along the rungs. And we know that the American Institute for Economic Research has done a lot of noting that, you know, employees of color as statistically paid less by a considerable margin. And that's substantiated by a lot of economic research looking at how pay is a differential and trying to reconcile that, looking at how people are promoted and looking where they're staffed. Are the majority of black employees on the janitorial and security contractor level, or are they, you know, in middle management? And how are people being staffed throughout the organization, and where, and what does that look like? And you can be more intentional about that, and it's important.

Want to join us live? Save a seat here: https://www.varonis.com/state-of-cybercrime