International Women's Day: A plea to the infosec community

For decades, Women's Day (IWD) has been a celebration of women, empowerment, and the ever-long quest for . This year's IWD theme is to " Bold for Change." In being bold, IWD has asked men and women alike to commit to of the following pledges:

• Challenge bias and inequality
• Campaign against violence
• women's advancement
• Celebrate women's achievement
• women's

On the other hand, on this day we also have A Day Without a Woman, a movement from the Women's March on . This cause, described as a one-day demonstration of economic solidarity, asks that supporters do the following:

• Women take the day off, from paid and unpaid labor
• Avoid shopping -- excepting small, women- and minority-owned businesses
• Wear the color red in "solidarity"

There's a stark contrast between the two movements and the requests made of its supporters -- A Day Without a Woman even provides templates for supporters to use to notify employers they will not be coming to work, and out-of-office messages, inclusive of "For anything urgent, please contact [Insert name of male colleague covering your work, if applicable]."

While both movements are well-intended, the aforementioned contrast represents the significant, and often concerning, dichotomy when it comes to for women's equality. I want to challenge bias and inequality and forge women's advancement, but can I do that if I am refusing to come to work? And with the pay equality issue, is encouraging women to skip a day of pay or put their jobs in jeopardy going to achieve the change we, allegedly, want to in the world?

My focus today is how this dichotomy is represented in the information security community. It's a hot topic in a male-dominated industry that also has a lot of loud female voices. With the sexual harassment and career stifling law suits and public disclosures at Uber and other organizations ramping up in the last few weeks, it's creating even more heated discussion.

Also: Women's share of Microsoft jobs falls again, so it's tying top pay to diversity | Women in the workplace: A $12 trillion opportunity | Navigating the visa minefield and the lack of women | Women in Tech: Mind the gender gap

I've been privy to many conversations about women. As many of my serve on boards, write about feminist movements, or have started equality and diversity organizations, I often feel torn. In some conversations, I'm told that I am an example because I've held executive positions in many high-profile or high-growth security companies. In other conversations, I'm told that my opinion is moot because, while I deal with a lot of the same issues, I am not a technical contributor to the industry so my example does not count.

No. The issues are the same, regardless of the roles that we are in: inappropriate comments from colleagues or other industry members; blatant sexual harassment that threatens your job or career; inequality in pay; and the seeming growing problem of surreptitious behavior from threatened male peers and leaders who strive to damage job status, career, or even reputation.

But this leads to another problem -- gender inequality is not always a male vs. female dynamic. Women are notoriously awful to each other, as shown over and over again in research and culture references alike. It's a slippery slope in the workplace, and in many cases, some women find it harder to work for a woman than for a man, because the oppression is not as overt or easily qualifiable.

OK, here's my plea for the information security community today, and all days, in how to address and consider women's equality issues. While this article, and this day, focuses on women, some of these considerations are just as relevant when dealing with different types of equality challenges. And, truly, these apply not only to information security, but to all industries

• Regardless of gender, if you see something then say something, whether it be to the person you see mistreated or a superior who can help escalate. And, regardless of gender, use caution in escalating without all of the facts, to ensure a situation is not made worse.


• Absolutely support women, their education, their advancement -- but do not do it blindly. Meritocracy is the name of the game. To promote a woman, or hire a woman, because she is a woman does everyone a disservice, especially the woman who may not be qualified for the role she is being put in, causing other issues. Hire, mentor, nurture, and promote the most qualified person for the role, regardless of, well, anything but talent and sheer determination to do an job.


• This is a sensitive one, but why stop now? Truly consider if what you, or your peer, is dealing with is gender bias or discrimination. I've personally seen and read many stories where a person complains about gender bias because someone has a personality quirk, is difficult to work with, may not be good at his/her job, or didn't get a promotion. Sometimes, people are equal opportunity difficult colleagues, and sometimes, you or your peer very well might not be ready for that promotion. And just because a man gets it, doesn't mean that a woman should have.


• Be prudent in your behavior. It's a struggle, especially in small companies when the are encouraged to be more social, or the senior leadership goes out to bars with underlings. Remember that even if you do not intend to be harassing, you never want to inadvertently make someone uncomfortable. And, protect yourself so that innocent behavior cannot be used against you later by a weaker, threatened contributor.


• Remember, being different has its advantages. Being a woman has its advantages, because oftentimes we possess emotional intelligence, or EQ, and can more easily apply that to and collaboration. Don't compare yourself apples to apples with your male peers. We all work, push, and cope differently.


• Similarly, it's up to each of us to fight for what we want and ask for what we deserve. Yes, there are so many situations that are unfair and sexism reigns, but it's not all situations. I often tell a story from years ago about the day I told my C-level male that I deserved to be a vice president. I was strong and bold, but then went home and cried with chocolate and a glass of wine, because that's what I do when I cope with stress. It didn't stop me from fighting for what I wanted -- and I . But I had to be bold.


• Regardless of gender, someone strong and assertive is not always mean, difficult to work with, or an oft-used term, "b**chy." This thought process just needs to stop. I've gone as far as saying that I am easy to work with as long as someone is doing his or her job, and if I have to push hard because the person is not, why does it become my personality flaw?


• This is off topic, but I have to say it: Some of the hardest working, smartest, most driven future leaders I know are millennials. As a Generation Xer who was told she was lazy and entitled due to my generation, I know from experience that you can zoom past those wanting to put you down.If someone on my team takes my job because I didn't work hard enough, or they were just that good, then all is right in the world. Stop being afraid of millennials, and millennials, don't internalize the dissent. We got you.

This is my plea to all members of the information security industry in how they deal with each other in the workplace. On IWD, or even if your thing is A Day Without a Woman, remember that we should up for each other -- regardless of the day, regardless of our role, regardless of what makes us diverse. It's time for us to evolve, set aside the "booth babe" debate and look at the real issues that cause those outcomes, and have tough discussions about what we as individuals, and as leaders, regardless of gender, are responsible for doing to support ourselves and others.