Join us for State of Cybercrime, where experts discuss the latest trends and developments in the world of cybercrime and provide insights into how organizations can protect themselves from potential threats.
Sponsored by Varonis
php/*
Join us for State of Cybercrime, where experts discuss the latest trends and developments in the world of cybercrime and provide insights into how organizations can protect themselves from potential threats.
Sponsored by Varonis
While some of our colleagues geeked out at Blackhat, some of us vicariously experienced it online by following #BHUSA.
The keynote was electric. They’re great ideas and we’ve seen them implemented in certain spaces. However, the reality is, we have a lot more work to do.
There was also a serious talk about burn out, stress, and coping with alcohol as a form of escape. We learned that mental health is growing concern in the security space. As more organizations rely on technology, security pros are called on at all hours of the day to remediate and prevent disasters.
Other articles and tweets discussed:
Want to join us live? Save a seat here: https://www.varonis.com/state-of-cybercrime
More from Varonis ⬇️
Visit our website: https://www.varonis.com
LinkedIn: https://www.linkedin.com/company/varonis
X/Twitter: https://twitter.com/varonis
Instagram: https://www.instagram.com/varonislife/
Over the past six years, Colleen Rafter has been educating Varonis customers on the latest and greatest data security best practices. Share or NTFS permissions? She has an answer for that.
Aware that security pros need to meet the latest GDPR requirements, she has been responsibly reading up on the latest requirements and developing course material for a future class.
In our podcast, Colleen advises new Varonis customers what to do once they have our solutions and which classes to take and in what order.
Want to join us live? Save a seat here: https://www.varonis.com/state-of-cybercrime
More from Varonis ⬇️
Visit our website: https://www.varonis.com
LinkedIn: https://www.linkedin.com/company/varonis
X/Twitter: https://twitter.com/varonis
Instagram: https://www.instagram.com/varonislife/
This week’s podcast was inspired by chief information security officer Wendy Nather’s article, The Security Povery Line and Junk Food. It’s 2018 and we’re still struggling to get a proper security budget. Is it a mindset? Is that why when we hire pen testers to identify vulnerabilities, they’re usually able to gain admin access? On the bright side, a company with a bigger budget, Google recently declared victory with a USB key that prevented phishing for an entire year.
Other articles discussed:
Want to join us live? Save a seat here: https://www.varonis.com/state-of-cybercrime
More from Varonis ⬇️
Visit our website: https://www.varonis.com
LinkedIn: https://www.linkedin.com/company/varonis
X/Twitter: https://twitter.com/varonis
Instagram: https://www.instagram.com/varonislife/
Dr. Gemma Galdon-Clavell is a leading expert on the legal, social, and ethical impact of data and data technologies. As founding partner of Eticas Research & Consulting, she traverses in this world every day, working with innovators, businesses, and governments who are are considering the ethical and societal ramifications of implementing new technology in our world.
We continue our discussion with Gemma. In this segment, she points out the significant contribution Volvo made when they opened their seat belt patent. Their aim was to build trust and security with drivers and passengers.
Gemma also points out that we should be mindful of the long-term drawbacks if you ever encounter a data breach or a trust issue - unfortunately, you’re going to lose credibility as well.
Cindy Ng: Welcome, Gemma. When companies come to you with a new product or service, they understand that going to market and dominating the entire space is almost everything. There's a huge tension between the organization as well as regulatory pull, making sure that you meet the legal requirements. Companies are trying to bring products to market as fast as possible. That's an industry problem.
Gemma Galdon-Clavell: Well, that tension exists and it will continue to exist. I think that we are currently working with pioneers and we're very aware of that. We don't hope to work with everyone tomorrow. We need to work with the ones that are gonna change the rules and that's what we find fascinating about our work. We don't wanna mass produce ethical impact assessments. We wanna help the world come up with better technological solutions to its problem. So, of course, we experience that tension. We are contacted sometimes by some people that don't really believe in what we do. So, they have been told by somebody else who does see their problem that they should work with us, but then maybe that person was higher up and then the person who contacted us is legal management. And they're very skeptical about our work.
I think that in all of our projects in the end, they do realize that there's value in what we bring in. But again, we are working with the ones that wanna shape the future and not do things that we're not interested in. Just, I mean, think about Volvo, for instance, and cars. I usually use the analogy of cars because cars were not conceived with seat belts, for instance, or speed limits. These are things that, as a society, we agreed over time that these were the necessary precautions that we wanted to make the most of cars and vehicles, while at the same time protecting society. And when society start thinking about what the limits your cars be, seat belts were not immediately on the table.
And then there was a company, Volvo, that came up with this innovation and thought, "Well, if we offer seat belts in our cars, then we can create more trust and provide more security to our customers." And what they did was they released the patent. They did not just put seat belts in their cars, but they said, "We actually want the industry to adopt this. We want this to be the standard." And they gave it away for free. Today, all cars have seat belts. No one would dream of buying a car without a seat belt and Volvo is still seen as a company that sells security. So, these are the people we wanna work with. We wanna work with people that are willing to be disruptive in their industries, not the people that just wanna do same old, same old.
Gemma Galdon-Clavell: I think they've tried. I wouldn't be able to tell you whether they were right. We have seen some clients be very clear in saying that they realize how much they've lost. That they have lost a lot of money by not doing things well. And not just money in terms of what I said before, you know, you're coming up with a pilot that doesn't sell is hugely costly. It might not be as visible as a data breach, but if you produce something that in the end no one wants because you didn't take into account people's stress or acceptability, then you're gonna lose a lot of money. And if there’s a data breach or a trust issue, then you're going to lose credibility as well. So, you're gonna have reputational problem. So, I think it is about dollars and cents, but it's also about the long-term effect.
So, I think that the companies that we work with are increasingly incorporating privacy and data ethics as part of their risk assessment. And that's what we would like to see. We'd like to see privacy and ethics being mainstreamed in the usual processes of any large corporation that deals with technology.
Cindy Ng: And alternatively, have your researchers been able to quantify how much they would potentially save when they work with you and seeking out your counsel?
Gemma Galdon-Clavell: It really depends on the project. What we have often done is when we were ask to contribute to developing a specific piece of new technology with the company, what we do is state their economic forecasts, and tell them what it is went wrong, what did you spend all this money in creating and developing this new product. And then you couldn't tell us. So, our estimates of savings are based on their estimates of potential profit. That's how we do it and sometimes we have told them, "Well, imagine if you were not able to sell it," that's one scenario like, there's an acceptability issue and so, you just sell a few hundreds. And so, it doesn't become a viable market alternative. But there's another scenario, when there's a data breach or a trust issue. And then it's not only about the money that you’ve spent, but also the money you need to spend in the future to resolve or to redress that problem that you've had with your existing or potential clients.
So, there's these different scenarios depending on when things go wrong. But it's very likely that if you're not careful with your data processes at some point or other, you will run into problems with the regulator, with your own clients, or with society as well since you're gonna end up making the headlines for that bad data practices.
Cindy Ng: The Guardian published an article the other day about the Australian government, how they released anonymized data sets, lots of medical records including prescriptions, surgeries for millions of people. And researchers, they've been able to re-identify those people. And I'm wondering if they would come to you after the media announcement, is that when you take on a client?
Gemma Galdon-Clavell: We usually take them earlier. Once they have such a huge issue, we work with neighboring countries, but not with Australia. But in this case, it's clearly a case of not having as specific procedure to do open data. I mean, clearly, the government's gonna have all this information and clearly, the government needs to have all this information because you do wanna make sure that your doctor is aware the procedures you had before and your condition. You should also have a right to access your medical records. So, that data has to exist and it needs be somewhere.
But then you need accurate based encryption, you need to make sure that that information can only be accessed by the right people. And if you do open data because you want that data to be aggregated and you want universities and private partners to make the most of that data, then you need to go through the appropriate safeguards. And we have specific methodologies to do open data like how to anonymize in a way you still can derive a value from that data, but the data does not include all those small pieces of private information that you don't wanna see really.
So, clearly, the Australian government did not have an open data policy or the appropriate profiles of people in place to make sure that that was done responsibly. And it's really terrible that, in 2018, you have major governments not being aware of these issues and they don't have procedures before data goes out there to make sure that this doesn't happen.
I think that this is changing to a large extent in Europe. We are working a lot with Latin America as well and I think that governments there realize that if they wanna make the most of the data revolution, they need to do it responsibly because otherwise, the trust and liability issues are too great. But unfortunately, it doesn't seem like the government in Australia was aware of that or have the procedures. We've seen that in other countries as well, but I think that there's more and more of an awareness of the need to undertake these things before disaster strikes.
Gemma Galdon-Clavell: This is one of our greatest concerns. There's a lot of people...well, not a lot, but there's some people who use privacy just as a PR thing. And they don't really change their practices. And that is clearly a matter of concern. And that's why we need standard because otherwise, it's gonna become a PR thing. And your technical standards and your privacy safeguards should not be a PR thing. It should be part of your core business and your core specifications.
So, one of the things we try and do is...and we're trying to develop a certificate, a way of certifying those companies that say what they do and do what they say, so to speak, to provide consumers and their customers with more assurances as to what it is that they're actually being offered. And making sure that it's not just cosmetic things, or a PR strategy that has no relationship with actual data practices. So, we think that certification is the way to go and we're gonna be very active in the coming months precisely in providing certification for the companies that wanna sell privacy or that they say that they use privacy and responsible data processes in their products.
Cindy Ng: And finally, I know you work with a lot of pioneers. So, I don't know how open you can be about your projects, but I'd love to hear a successful project that you've been able to deploy.
Gemma Galdon-Clavell: Our contributions are usually part of larger projects. So, for instance, in Europe in the development of the...what I called ABC gates(Automated Border Control) I guess, everyone is familiar with them by now, the kiosks that look at your passport when you go through an airport. You may have seen that sometimes there's no...you don't have a border mark anymore. But there's a machine that checks your passport and your biometric data, and decides whether you can enter a country or not. When the European Commission initially started developing that, they realized that it was important to incorporate ethics and responsible data processes in that. And so, we've been helping the industry for the last five years in making sure that the way that your biometrics are taken and that the identification happens is responsible. And that the data processes that are in place are responsible and accountable. So, I think that's one of the success, for instance, that we have.
We've also been working with a lot of public administration in improving their procurement practices. Buying technology is a crucial part of doing technology responsibly, making sure that when you buy technology, you buy the best technology out there, and that you buy technologies that incorporate data ethics and cyber security, and privacy concerns, how to improve the procurement processes to protect public administration. But also buy better technologies that are gonna be better integrated in your existing data processes. So, that's... I think that we have several success cases there and we think there are several administrations that are currently buying better technology and doing it better, and having a more informed team of staff that is more aware of the risks of incorporating new technologies there in their processes.
We’re also currently...and these are ongoing things, so, we don't really have results yet, but we are working with several international organizations that fund technology development in making sure that ethics and responsible data processes are part of the things that they assess when they provide funding for innovation. So, anyone that would come to those international organizations would need to prove that they're aware of the social impact of the technology they're trying develop and that they are building the necessary safeguards to make sure that that technology is responsible.
There's quite a lot of examples out there of things that can be done in practice to improve the way that we do technology and the way that technology impact on society and we're very proud to have been part of that. And we hope to continue to be part of that story for a long time.
Cindy Ng: Thank you so much. I'm so inspired by what you do. So, I wish you much success.
Gemma Galdon-Clavell: Thank you so much.
Want to join us live? Save a seat here: https://www.varonis.com/state-of-cybercrime
More from Varonis ⬇️
Visit our website: https://www.varonis.com
LinkedIn: https://www.linkedin.com/company/varonis
X/Twitter: https://twitter.com/varonis
Instagram: https://www.instagram.com/varonislife/
I wanted to better understand how to manage our moral and business dilemmas, so I enlisted data & ethics expert Dr. Gemma Galdon-Clavell to speak about her leadership in this space. As founding partner of Eticas Research & Consulting, she traverses in this world every day, working with innovators, businesses, and governments who are are considering the ethical and societal ramifications of implementing new technology in our world.
In the first part of our interview, Gemma explains why we get ethics fatigue. Unfortunately, those who want to improve our world are consistently told that they're not doing enough. She also gives us great tips on creating products that have desirability, social acceptability, ethics, and good data management practices.
Cindy Ng: Welcome, Gemma. What caught my eye was a quote you said that if we keep talking about our moral obligations and ethical concerns in technology not offering solutions, people are gonna zone out. We want security and privacy. We want economic prosperity and sustainability. We want safety, but not willing to sacrifice some freedoms. Can you talk a little bit about ethics fatigue and some might also call it moral overload?
Gemma Galdon-Clavell: Working in this field, we've been saying what's wrong for a long, long time. But you don't see that many voices out there that are offering solutions. And it seems like any effort you make is never good enough. And that is really frustrating. That can be really frustrating for someone who has really good intentions and their willingness to improve their practices. So, I think that when you're maybe doing academia or just commenting on things, it's easy to take that position. I think it's really good to have people that say what is going wrong, but it's also important that we have ways of defining what it means to do it well, and spaces, organizations, individual that help you do it better. And hopefully over time, as a society, we will agree on what kind of compromises we want to make or whether we wanna make those compromises.
But I think that there has to be some ability to improve and not just always be subject to criticism. When you speak out and you're willing to recognize that you have vulnerabilities, if everyone comes down on you, then you will not be motivated to improve your practices. And I think that's what ethics fatigue will be. So when people are like, "Listen, you had my ear for some time. I was willing to do things better, but if all you have is just more criticism and say that if there's no way to improve this, then people are just gonna shut off." And I think that's the worst outcome we could hope for. So, I'm hoping that through presenting actual practices in ways of doing things better and in doing things well, we can avoid that scenario.
Gemma Galdon-Clavell: Sure. I think we're very lucky that at the very beginning of my work, I was asked by actual people with real problems to see how my knowledge and the things that I have experienced on could help them improve understandings and practices. And so, that forced me to become very practical from day one. And initially when I started working with those actors, I thought, you know, "I'm sure there's gonna be some methodology out there in some book, or people that know a lot more than me that have this before." And what I found was that there was no methodology that was adequate to assess data and privacy risk. There was not enough there that was structured that would fit these things. There was a lot on the impact of technology, on environmental impact assessment, as well as things that were loosely related, and things that I could learn from, but not something that I could readily implement in my work.
So, I basically have to design my own methodology, listening to these private and public actors, but also reading a lot of the literature and talking to a lot of people. So, I think that in the end, what we have is a robust way of addressing social, ethical and privacy risks when developing any data process or data policy as well. And that's been the outcome of a lot of work by a lot of people and a lot of getting the best of great minds together. And I think that's what makes our work different from a lot of what you find out there. We actually get done with the actual problems. But there are shortcomings in what we do. I often say that ideally, you would wanna think about the desirability of what you're doing before you actually start conceiving a new project. And in the real world when people come to you, someone out there has already decided that that new product or new policy is desirable. And so, you cannot really impact in that part of the process, but then we can look at their data management practices, and their ethics, and their legal compliance, and the desirability issues, and we can incorporate the stakeholders.
So, even if we are contacted later on or after a privacy disaster, there's still a lot that we can do. But of course, in the future, what we would like is for no agency or actor to get into developing anything without having some safeguards in place. If you're developing new chemical materials, you would never think of selling something before it runs through with the appropriate safeguards. If you're developing a new drug, you would not dream of putting it in the market and selling it before you've proved that you've gone through the precautionary principle, and you've gone through the development agencies to be validated to your initiative. How come in engineering, that is not the case? How come all these things are making it to the market without no way for society or the regulator to see what the social or legal impact of those new devices or initiatives for data processes would be? That, we're trying to solve.
So, even if we're contacted later on, there's still a lot that we can do. But also, we hope that over time, we'll convince our clients that they need to come to us right at the beginning of developing their new ideas.
Gemma Galdon-Clavell: Sure. I mean these are the four steps that we think are necessary for you to, not only to assess the risks of your product, but also to accompany the process of developing it. So, this is from the very conception of the project or initiative until the very end in the implementation. And the first step is to consider the desirability, like does society need this? We think that in technology, there's a lot of people that come up with new technologies and then look for problems in their new technology. And that should not be the case. You should develop technology because you have a problem that you wanna solve. That is the productive, innovative way of doing thing.
There's something you wanna solve like the quality of life of older people, or the quality of life of people with disabilities, or address discrimination in a sector or industry. So, you have a problem and then you look for a solution that maybe technology calls. That's the train of thought you wanna follow, but in technology, that's not always followed. So, we wanna make sure that that is the case.
But we also wanna make sure that you go beyond having a great idea. I always say that having a great idea is just the beginning. It's only the starting point. You need to plan all the way through implementation. We see so many technologies that are great ideas, but once they're out there, no one plans for, for instance, training the people that are gonna be using that technology, if you're offering that technology to third-parties, for instance. So, if you don't take that into account, the people that are mediating your relationship with the client have no idea what they're doing. And so, of course, the way that the client is gonna see that technology is not gonna be as good. I think the person in the middle knew about what they were talking about and the possibilities of that technology. So, are you planning for implementation and not just having the great idea.
So, ideally, in desirability, you would go through all these, making sure you have a thorough plan that actually solves the problem. So, that's the first pillar.
The second pillar is social acceptability. I think we've all learned with design thinking and service design that clients and stakeholders and people are just really important. You don't wanna develop technologies that then no one really use. I mean, think Google Glass. You this great idea in the lab, but then actually no one thinks that that's useful. You wanna avoid spending all that money in a pilot that in the end, no one's gonna use. And you do that by talking to people. And there's methodologies and ways of making sure that you understand your potential client and you're building trust in your system. You may even go as far as having mechanisms for them to intervene even after the technology has been in the market. So, you see what their feedback is. So, it's some techniques from marketing, but adapted to these understanding of the social impact of technology.
Then we also wanna look at legal compliance, of course. You would need to comply with the law, and here, there are so many industries that have suffered for not doing this. Think about the drone industry, for instance. A few years ago, everyone thought that drones are gonna be this next thing that you were gonna have your home deliveries come to you by drones and they have to invest a lot of money in this new technology because everyone was gonna be using drones. That didn't happen because we didn't have a legal framework. If you have come to us five years ago, we could have told you the most likely thing is that drones are used in some rural areas and for crisis management. But they're not gonna be an everyday thing in the next 10 years. And then you would have saved a lot of money and you would have invested maybe in another technology that was more promising. So, fulfilling the law is really, really important.
But there's also things that are not part of the law that inform our laws, like social cohesion or trust. So, we also look at how those things are impacted by your technology. What is the impact of your technology or the data process on social cohesion and trust between actors. Because these are not things...there's no laws about trust, but it's such an important part of how our society are. And it's important to have a specific emphasis put on that. So, that is the legal pillar of our assessment.
And then finally, data management. I always say that data management is the source of all problems, but also the source of all solutions. So, what we do here is we map the data life cycle, any piece of data that get into your system, we look at their vulnerabilities and their moments of vulnerabilities. So, there is five moments of vulnerability in every data that gets into your system: the moment of collection, the moment of storage, the moment of sharing, the moment of analysis, and the moment of deletion. In those five moments, things can go wrong. And so, what we do is...what we've learned in the other pillars, we build specific mitigation measures in your system to make sure that you have encryption mechanisms in place, that you anonymize if that is needed, that you minimize the data that you use in your system, that you have relevant contract with the processors to protect your liability in case there's a data breach. So, in the end, we'll make your system more robust through following these four main pillars of emphasis.
Want to join us live? Save a seat here: https://www.varonis.com/state-of-cybercrime
More from Varonis ⬇️
Visit our website: https://www.varonis.com
LinkedIn: https://www.linkedin.com/company/varonis
X/Twitter: https://twitter.com/varonis
Instagram: https://www.instagram.com/varonislife/
When we create new technologies, we want security and privacy, economic prosperity and sustainability, accountability but insist on confidentiality. The reality is that it is difficult to embed all of these values in one pass. As technologies get built, it also elucidates some values we hold to a higher regard than others.
To cope with moral overload, some have suggested that we start designing security and privacy controls as a gradient. Or perhaps certain controls get a toggle on/off switch.
We’re also seeing this moral dilemma in AI – is the technology too volatile or perhaps proper data governance is the answer?
Other articles discussed:
Want to join us live? Save a seat here: https://www.varonis.com/state-of-cybercrime
More from Varonis ⬇️
Visit our website: https://www.varonis.com
LinkedIn: https://www.linkedin.com/company/varonis
X/Twitter: https://twitter.com/varonis
Instagram: https://www.instagram.com/varonislife/
For years, technologists wondered why the law can’t keep pace with technology. Instead of waiting for the government to pass a regulation, should we enlist private companies to regulate?
However, in a recent interview with privacy and cybersecurity attorney Camille Stewart, she said that laws are built in the same way a lot of technologies are built: in the form of a framework. That way, it leaves room and flexibility so that technology can continue to evolve.
While technologists and attorneys continue that debate, the US Federal Trade Commission is hard at work. They recently announced, “If a company chooses to implement some or all of GDPR across their entire operations, and makes promises to U.S. consumers about their specific practices,” they must live up to those commitments, otherwise the FTC could initiate an enforcement action if the company does not comply with” the EU data protection promises for U.S. customers.
Other articles discussed:
Panelists: Cindy Ng, Mike Buckbee, Forrest Temple, Kris Keyser
Want to join us live? Save a seat here: https://www.varonis.com/state-of-cybercrime
More from Varonis ⬇️
Visit our website: https://www.varonis.com
LinkedIn: https://www.linkedin.com/company/varonis
X/Twitter: https://twitter.com/varonis
Instagram: https://www.instagram.com/varonislife/
There are many advantages to being first, especially in the business world. Securing a first place finish usually rewards the winner with monopoly-like status and securing the largest and most dominant market share. A byproduct, however, of the winner takes all mentality is sacrificing security. That’s what Thomas Dullien, Google Project Zero presenter suggested in his latest presentation on the relationship between complexity and failure of security. He is onto something because we’re seeing strange incidents occur that we would have never imagined. A Melbourne man got shot because his image in Google’s database is associated with criminals. A contractor’s access passes were revoked because his direct manager didn’t perform his entitlement reviews. What’s going on?
Other articles discussed:
Want to join us live? Save a seat here: https://www.varonis.com/state-of-cybercrime
More from Varonis ⬇️
Visit our website: https://www.varonis.com
LinkedIn: https://www.linkedin.com/company/varonis
X/Twitter: https://twitter.com/varonis
Instagram: https://www.instagram.com/varonislife/
In part two of my interview with Allison F. Avery, a Senior Diversity & Inclusion Specialist at NYU Langone Medical Center, she clarified common misconceptions about Diversity & Inclusion (D&I) and offered a framework and methodology to implement D&I. She reminded me, “You should not be doing diversity for diversity sake.”
Allison Avery: I'm going to challenge your question a little bit, because I think that people dichotomize those two things as, you know, do you either want diversity, or do you want "quality"? And I think that those two things get pitted against each other as though they're one mutually exclusive or in competition with each other, and that you have to choose. And I think that even looking at it that way puts people into a mind pretzel, and makes diversity seem antithetical to being a top talent place, and being a top talent institution. And I think it gives diversity a bad name, but it also kind of feeds in this kind of mythology that somehow diversity is lowering standards, or diversity is compromised. And I think that whenever we get into this bind of doing things differently, our brains get into this idea that somehow, whenever we go against the grain, that all of a sudden we're compromising our standards.
But all we're doing is one, either changing our standards for something that we have prioritized for a different reason or rationale. One, we need to fully understand what that rationale is, and if we don't that's when we tend to dichotomize, because we don't really understand the value of diversity, and what the sort of actual benefits of having a socially diverse workforce is, and you know the fact of the matter is it does lead to greater creativity, greater financial gains, and greater innovation, and greater research. I mean, that has been substantiated in multiple research, pervasive throughout different industries and in multiple different ways from innovation creativity to financial gains. That's just kind of time and time again.
There is a big financial case for diversity, and how it does literally make you smarter, more creative and more conscious. Julie Peeler who's the foundation director of the International Information Systems Security Certification Consortium, you know, was sort of citing in March how there's...you know, there's about 30,000 open positions in U.S. information security, and how the gap is growing wider and wider. It's actually easier and we've noticed this actually in medical school as well. It's easier at times to train people in skill development, than it is in human skill development, and what we've noticed that is that certain areas of aspects of diversity, and what should be needed for tech in the 21st century, and tech for the next coming 50 plus years are the communication and analytical skills, and participation decision making. Women in leadership positions tend to be more engaged in being able to do that.
They tend to be able to be more collaborative. We've also noticed that in medical school, that it's easier to teach somebody some of the hard "skills" and it's harder to teach somebody some of the soft skills. Harder to teach somebody some of the needs of a diverse community, but it's easier to teach them some of the hard skills that they're going to need. So if they have somewhat of an orientation, if they have potential, if they have capacity, if they have the ability to learn, and those are things that you can test for if you look at some psychometrics testing, if you look at some actual like organizational development testing.
You can utilize that or leverage that within your hiring system. So looking at a person's aptitude for learning, as opposed to just being a hard and fast person on a skill acquisition. So the potential for a person to be able to learn a new skill, or to be able to acquire a new skill, you can test for that through some psychometric testing. You get somebody who's good at like organizational development, or organizational psych, and you input that within your structural system in your hiring manager, and you can test for that and that might increase aspects of your diverse workforce, as opposed to being hard and fast about you need to know this still today. As opposed to we can teach you this skill, but you're coming in with some of these other desired skills, and be more competency based.
So we've noticed that when we switched to a more competency-based...so this person has the ability to deal with ambiguity. This person has better communication skills, this person has the capacity for critical thinking, so when we switch to what kind of culture do we want, what type of learner do we want, what type of capacities do we want and competencies do we want, then that changes the methodology and changes are hard and fast orientation to you need to know this, this, this, this and this skill. It's like we can teach you this skill, but we need you to have these levels of competency, because that's a culture we're trying to build. That's the community that we're trying to cultivate, and that's the innovation that we're trying to have within our organization to get to where we want to be.
A person who is not able to engage in lifelong learning, period, and lifelong professional skill development generally is not the kind of person that you want in your organization anyway. And so it's...I think when you juxtapose diversity and or skill, that's not even the right model or methodology for any industry really.
For the 21st century, our talent innovation does say that employees at companies with diversity and management, are 45% more likely to report growing market share for their companies, and they're 70% likelier to report that their companies captured a new market.
Cindy Ng: Can you give us some context to this stat? In the infosec space, 58% of females who hold leadership positions have advanced degrees versus the 47% of males.
Allison Avery: This is something that we see in a lot of different industries. And I wish I had a better name for it, but what tends to happen is that there's a luxury to convention. I would think of it this way, when a person looks the part, you assume a lot of things about them. You assume their competence, you assume their quality, you assume their...you're not surprised. And so there's a luxury to their average- ness, and there's a luxury to them being good enough, correct?
I think that there generally when you do not look the part necessarily, you have to fill in things a little bit more, because they don't just assume that you're qualified, in the same way. And so it's not as luxurious to just be good enough. You have to be above average in order to be considered equal, you know, there's an adage in especially in the black community, there is this adage that you need to be twice as good to be considered just as qualified. You're starting from a different assumption, and a different framework and then going from there.
A lot of times women, they don't assume a level of competence, you're proving it and then you go from there to the other man, or whatever because he looks the part, because he's assumed to be the part. You're assuming a level of competence and jumping out from that point. The level of work that they need to do, the level of accomplishments that they need do, and the level of performance doesn't have to be quite the same because you're already assuming competence. And the other person, i.e. and I think this actually harkens back to the initial question to of, do you choose diversity or skills? And that goes back to so many questions when people say things about, you know, they look around the room, let's say you know we've seen this on TV.
We hear this about, you know, certain social campaigns, about like, "Oh, did you get into Harvard because you were black, or because you deserved it?" Those two things...they're assumed to be diametrically opposed as opposed to thinking that the person...as opposed to assuming competence, and assuming quality and qualification.
Cindy Ng: How can we build a good D&I program? Or maybe a better question is what do we need to have on our radar so we can have the best possible outcome?
Allison Avery: The biggest kind of hairy fault lines that I think happen to organizations, is that they try to go too fast too soon, when it comes to D&I, or they try to go from 0 to 1,000. I think that that's very dangerous, it can be very detrimental to D&I efforts. And so I think you want to be really, really clear on why you're doing it, because it's not just doing diversity for diversity's sake. That's a really important piece, because if you can't explain the rationale for why you're doing diversity, it ends up in that dichotomous form of, well, we're doing it because we have to do it because it's a good thing. And so I am choosing diversity over skill set, and it stays in that kind of lazy mentality, where you only do a first pass.
And that actually I think is much more harmful than having nothing. People don't understand why you're doing it. That's even worse than doing it, in my opinion. And so really having a firm understanding of the actual benefits and the actual rationale is very, very helpful, and starting very, very small and clear. And then having it on multiple different registers, like I was saying. So it's not just enough to have recruitment. So this is where people get tripped up is they think, "Okay, well, we need, you know, we need more minorities, so what are we going to do? We're going to go recruit."
Well, if you bring people in, that's only one iota of what is happening. Because that's just about diversity, that's not inclusion. Inclusion is about okay, so if you are recruiting a diverse workforce so then you have to look at engagement, you have to look at climate, you have to look at talent management, you have to look at success in planning, you have to look at the composition along the echelon of your institution, you have to look at compensation, you have to look at, you know, who's in upper management, who's in middle management, who's in below management? You have to look at, you know, all of these different arenas.
And so I think a very comprehensive strategic plan along...that's multi-yeared, with different goals and objectives of held accountable by a nested board, that is a not just staffed, nor is it just comprised of under-represented minorities, period. That is the most dangerous thing, too. It cannot just be minorities invested for themselves and of themselves. So if you're going to have any type of board, if you're going to have any kind of competition, it has to be led by an executive and CEO. It has to be invested by upper management and upper leadership. It has to be really, really supported because otherwise it won't be successful, and pairing people along different ethnic domains, you know, having different relationships forms, like mentoring programs and talent management programs, and people from outside of their...even outside of their area of expertise, social identity categories, even gender identity categories.
You know, so that there is more relationship building, going back to this point of white Americans having 91 times as many white friends black friends, to try to break down those types of prohibitive barriers that can be compensated for, if an intentional structural design is put in place within the institution, or within the organization.
Cindy Ng: Okay, we need get everyone's buy-in, we need to build partnerships, there needs to be a multi-year long term vision. It sounds so complicated.
Allison Avery: It's very complicated. It's not just for one segment of the population, that's a transformative in a sort of transcendent piece, you know, like that's the whole idea, is that if you understand it appropriately and you really know the actual benefits to social diversity within your industry, of why does it make sense to have more social diversity within your organization, i.e., better financial gains, better product development, niche markets that can be developed, more engagement of a workforce, you know, greater capacity, enhanced creativity, better innovation.
I mean, if you really truly know that and then you see that, it betters everyone's game and everyone's performance in the organization. Albeit it makes things a little more challenging, because you know the more diverse...the more challenging things are, people have to work a little bit harder. But it should pay dividends, that's the piece. It should make your company more lucrative, and then people should benefit from that who work there. So it should make your lives better, our lives better. So there really should be marketable, as well as tangible payoffs that aren't this sort of esoteric made up social justice circumscribed idea of like its good diversity for diversity sake. It's not as I think ambivalent or opaque as people sort of feel it is.
Want to join us live? Save a seat here: https://www.varonis.com/state-of-cybercrime
More from Varonis ⬇️
Visit our website: https://www.varonis.com
LinkedIn: https://www.linkedin.com/company/varonis
X/Twitter: https://twitter.com/varonis
Instagram: https://www.instagram.com/varonislife/
We continue our conversation with cyber and tech attorney Camille Stewart on discerning one's appetite for risk. In other words, how much information are you willing to share online in exchange for something free?
It's a loaded question and Camille takes us through the lines of questioning one would take when taking a fun quiz or survey online. As always, there are no easy answers or shortcuts to achieving the state of privacy savvy nirvana.
What's also risky is that we shouldn't connect laws made in the physical world to cyberspace. Camille warns: if we start making comparisons because at face value, the connection appears to be similar, but in reality isn't, we may set up ourselves up to truly stifle innovation.
And if anybody remembers Henrietta Lacks, her data was used to create all of these things that are very wonderful but she never got any compensation for it. Not knowing how your information is used takes away all of your control, right? And a world where your data is commoditized and it has a value, you should be in control of the value of your data. And whether it's as simple as we're giving away our right to choose how and when we disburse our information and/or privacy that leads us to security implications, those things are important.
For example, you don't care that there's information pooled and aggregated from a number of different places about you because you've posted it freely or because you traded it for a service that's very convenient until the moment when you realize that because you took the quiz and let this information out or because you didn't care that your address was posted on like a Spokeo site or something else, you didn't realize that all of the questions to your banking security information are now all easily searched on the internet and probably being aggregated by some random organization. So somebody could easily take and say, "Oh, what's your mother's maiden name? Okay. And what city do you live in? Okay. And what high school did you go to? Okay."
And those are three pieces of information that maybe you didn't post in the same place but you posted and didn't care because you traded it for something or you posted it and you didn't think it through and now they can aggregate it because you use those two things for everything and now someone has access to your bank account, they've got access to your email, they've got access to all of these things that are really important to you and your privacy has now translated into your security.
So we all, just like organizations, just have to press it, have to make this vision become their appetite for risk. We as individuals have to do the same. And so if you are willing to risk because you think either, "They won't look for me," or, "I'm willing to take the hits because my bank will reimburse me," or whatever the decision which you are making, I want you to be informed.
I'm not telling you what your risk calculus is but I wanna encourage people to understand how information can be used, understand what they're putting out there and make decisions accordingly. So your answer to that might be like "Look, I don't wanna give up taking Facebook for this or sharing information in a community that I trust on some social site but what I will do is have a set of answers that I don't share with anyone to those normal questions that they use for password reset that are wrong but only I know the fake answers that I'm using for them."
So instead of your actual mother's maiden name, you're using something else and you've decided that that's one of the ways that you will protect yourself because you really wanna still use these other tools and that might be the way you protect yourself. So I challenge people not to give up the things that they love, like I mean, I would assess whether or not certain things are worth the risk, right?
Like a quiz on Facebook that makes you provide data to an external third party that you're not really sure of how they're using it, not likely worth it. But the quizzes where you can just kinda take them, that might be worth it. I mean, the answers you provide for those questions still are revealing about you but maybe not in a way that's super impactful. Maybe in a way that's likely just for marketing and if you're okay with that, then take that or you go resilient the other way.
Versus if there is human input, we would decide that that is something that they can then own the production of, right, because they contributed to the making of whatever the end product is. It's hard to speculate but there will have to be a line drawn and it's likely somewhere in there, right? The sense that there is enough human interjection, whether that is from the input from whatever creative process is happening by the machine or in the creation of the process or program or software that is being used and then spit out some creation on the end, there will have to be a law or I guess at least case law that kinda dictates where that line is drawn.
But those will be the things that's fun, right? Tiffany, and other lawyers like myself, I think those are the things that we enjoy most about the space is that stuff is unclear. And as these things roll out you get to make connections with the monkey case and AI and with other things that have already happened and new processes, new tech, new innovations and try to help draw those lines.
And so it's dangerous to make those comparisons without some level of assessment. And so I would tell people to challenge those assessments when you hear them and try to poke holes in them, because bad facts make for bad law. And if we take the easy route and just start making comparisons because on their face they seem similar, we may set up ourselves up to truly stifle innovation, which is exactly what we're trying to prevent.
That is not the same as cyber-based. And to liken the two in the way that you use rules is not smart, right? It's your first inclination to wanna try to stop data flow at the edge of a country, at the edge of some imaginary border, but it is not realistic because the internet by its very nature is global and interconnected and, you know, traverses the world freely and you can't really stop things on that line, which is why things like GDPR are important for organizations across the world because as a company that has a global reach because you're on the internet, you will be affected by how laws are created in different localities.
So that's a very big example but it happens in very discreet ways too when it comes to technology, cyberspace, and physical laws. Or the physical space and laws that are operated in that way and so I would challenge people that when you hear people make a one for one connection very easily without some level of assessment to try to question that to make sure it really is the best way to adapt some things to the given situation.
The reason for example, Tiffany's likening of AI to this monkey case, it's an easy connection to make because in your head you think, "Well, the monkey is not human, they made a thing, and if they can't own the thing then when you do that online and a machine makes a thing, they can't own a thing." But it very well may not be the same analysis that needs to be made in setting, right? The lines may become very different because none of us could create a monkey. So if I can't create a monkey, then it's harder to control the output of that monkey. But I could very well create a machine that could then create an output and shouldn't I be the owner of that output if I created the machine that then created the output?
Want to join us live? Save a seat here: https://www.varonis.com/state-of-cybercrime
More from Varonis ⬇️
Visit our website: https://www.varonis.com
LinkedIn: https://www.linkedin.com/company/varonis
X/Twitter: https://twitter.com/varonis
Instagram: https://www.instagram.com/varonislife/