Infosec for Beginners: Cracking the Linguistic Fortress - by guest writer Kristine Sihto

This article first appeared in the second newsletter of the Brisbane AWSN Chapter. 

Kristine Sihto has been writing intermittently over the past three decades. Most recently, she has found joy in technical writing for Alcorn Security Group. Kristine has plans to self-publish a book of poetry in 2018

Information security can be a hard nut to crack. Infosec professionals come from a wide range of disciplines, with a wide range of backgrounds, but the stories I hear most often are of people coming into Information Security purposefully, scaffolding their pathway through closely related fields. There are people wanting to break in, but can’t find that pathway. They don’t know the right people, they don’t have the foundation skills.

I’m very new to information security. Less than eighteen months, in fact. My current role is technical writer for a security assurance firm, but I came from a background of editing and compliance within vocational training. I hadn’t really worked in depth with IT, and the compliance work I had done really only scraped the surface of data protection.

There is so much to learn in Information Security that people such as myself, who sidestep into the sector from somewhere unrelated, may find it quite impenetrable. The jargon is so pervasive that the people working with information security concepts on a daily basis may not realise that they are no longer using common English. This creates an enormous linguistic barrier to entry, especially when we start talking about ‘the cybers’.

Coming into the sector with a high level of literacy didn’t help with this barrier. Many terms mean different things outside of information technology or cyber security; terms like ‘credentials’, ‘authorisation’, ‘malicious user’, and (as a verb) ‘middling’ (which, as many cricketers will attest to, is the practice of hitting the ball with the middle of the cricket bat). Military terms like ‘attack surface’ may require a fair amount of logic and critical thinking to determine what they might pertain to, and some, such as ‘red team’, are so obscure as to require explanation.

The jargon is made even more impenetrable by the widespread use of acronyms and initialisations, which have no linguistic transparency and require prior knowledge to understand. Put a bunch of them together, and the poor idiot on the other end (e.g. me) has no idea what’s going on!

All is not lost however.

It’s possible to upskill in a reasonably short amount of time, given enough motivation to the task at hand. There are resources available that are easy to access, targeted at giving a baseline understanding of information security concepts, and most importantly, free.

Futurelearn has a brilliant series of cyber security MOOCs (Massive Open Online Courses) that I found to be especially helpful. Introduction to Cyber Security; Cyber Security: Safety at Home, Online, in Life; Cyber Security for Small and Medium Enterprises: Identifying Threats and Preventing Attacks. The entry bar for these courses is very low. The content is presented in a way that’s accessible to a range of learners, such as people with disabilities or people with lower literacy levels, and it covers all of the basics.

There are also free-to-access glossaries available online, and these may be useful not only for informing people new to Infosec, but also people who are being informed by information security, such as C-level executives. I found the Threatsaurus to be particularly useful. Glossaries such as this can assist in bringing newcomers up to the level of jargon usage that everyone else is using.

And of course, one of the best ways to feel your way into a field is to immerse yourself in it. Make connections through Twitter and LinkedIn; follow infosec blogs and podcasts (I listen to Security Weekly); engage with industry events and meetups, such as through AISA or AWSN. Listen and read on a regular basis, and there suddenly comes a point where you start to understand the words and concepts.

I believe it took me a solid six months to get to the point where I was familiar enough with terminology to feel comfortable that I wasn’t going to confuse everyone around me. I still am not at the point where I can take Google out of the equation, but in a highly technical role such as mine, I expect that my relationship with search engines will be a long-lasting one.

(c) AWSN 2018

Disclaimer: The views and opinions expressed in this article are those of the author/s and do not necessarily reflect the official policy or position of any agency, organisation or association.

Inspiring the next generation of women in IT

by Amanda Menard

There has been a lot discussion regarding the lack of women working in IT. Current figures from the Australian Computer Society and Deloitte show that women make up only 28% of the ICT workforce. One of the initiatives working to change this statistic for future generations is the Girls’ Programming Network.

The Girls' Programming Network (GPN) is an initiative of the National Computer Science School at the University of New South Wales and began in Sydney in 2008. It has since expanded its reach to include branches in Perth and Canberra with further growth planned into other states and regional centres.

The goal of the GPN is to teach girls programming and to connect them to women in industry. It achieves this goal by holding a series of day long events to teach girls the basic concepts of programming with the support of many female tutors. Events are free for girls from Years 4 to 11 to attend and are fully catered.

Tutors come from all areas of industry and academia - University students, government, telecommunications companies and other private industry organisations.

I have been involved as a tutor at some of the Canberra and Sydney GPN events. It's incredibly rewarding and also provides the opportunity to network with other women IT professionals. The events target girls with a wide range of skills - from girls who have never coded before through to girls with advanced programming skills. The ratio of tutors to students is very high - usually one tutor for 3 or 4 girls which means beginners have the chance to ask questions and gain assistance quickly when stuck or dealing with a new programming concept.

Some of the events I have participated in have involved Markov chains and Arduino Boards. The most recent event on Markov Chains by the Canberra GPN had a record number of 71 girls registering with 40% having attended a GPN event previously. This event focused on Markov Chains to generate sentences based on sample text ‘Green Eggs and Ham’ by Dr Seuss. There were also practical exercises to illustrate the concept using words on large cards and lots of string! Previous events run by Canberra GPN have focussed on cryptography and programming scissors-paper-rock.

The other event I tutored at was for Sydney GPN and focussed on teaching the girls how to program Arduino boards - essentially small microcomputers that could be programmed to perform tasks such as turning on lights, playing music and displaying text on an LCD screen. We used NICTA Boards, which were specially built to make it easy to teach students how to use Arduinos, with built in inputs and outputs such as an LCD Screen, lights, buttons, a LED Shift Register, light sensor, and many more. There were also practical exercises using homemade playdoh (which conducts

electricity), batteries and lights to help the girls understand how electronic circuits work.

The feedback from the girls and their parents is incredibly positive. Many girls attend more than one GPN event and it is inspiring to see their enthusiasm and confidence in programming increase throughout the day. We've also had students organise code camps at their school!

We would love to involve more women as tutors. Events are usually held on a Sunday with room set up and preparation taking place on Saturday. You don't have to commit to participating in all events as nominating to be a tutor at a single event is also greatly appreciated. You can also be involved behind the scenes with the creation of workbooks and reference material.

For further information about becoming a tutor, email Canberragpn.

Further details are available from the Canberra GPN website at canberragpn.github.io or the Sydney GPN website at https://sites.google.com/site/girlsprogramminenetwork/.

About the author:

Amanda Menard currently works in cyber security at the Department of Defence. Amanda has previously worked for Datacom TSS and holds a Masters in Technology from the University of Canberra. She volunteers as a tutor for the Canberra Girls' Programming Network helping to inspire young girls to pursue a career in ICT.

 This post has been created by Amanda Menard and published by A Turner on behalf of AWSN. 

(c) AWSN 2016

What Diversity Means to me - by Olga Kiconco

This post has been authored by Olga Kiconco. Olga Is active in the Brisbane branch of the Australian Information Security Association and is working with the Branch Exec of AISA Brisbane, Mandy Turner, on the AISA Brisbane branch Diversity Initiative. Olga has a Bachelor’s Degree in Telecommunications Engineering and EC Council certifications in Ethical Hacking (CEH) and Security Analysis (ECSA) and a Masters in International Business. Olga is a thought leader and strategist and is currently seeking a fulfilling career InfoSec

Olga Kiconco (Photo Credit - Olga Kiconco

What does diversity mean to you?
Over the recent years, diversity and inclusion have been a ‘hot topic’ from governments to business executives; kindergartens to higher education institutions, and through personal and professional experience, my resonance with this term has evolved. 

Right from when I was young, I have always been passionate about technology, and knew this was the industry for me when my mum set up a home computer when I was 7. Like any other curious kid, I used to muck around with different software and play computer games on that good old ‘TINY’ computer (Don’t think they exist anymore!). I later on progressed to fixing electronics around the house, as my mother was convinced I had magical hands.
However, the greater majority of women not only in my home country, Uganda, but worldwide do not have a similar tale. The gender gap in technology has impelled me to look deeper and understand why this is so. 

Boys > Girls
Back in the day (well...at least according to my mum), there were less than a handful of secondary schools that offered girls A’ Level education, moreover, most of the young women enrolled in Arts subjects. Those who stopped at O’ Levels either moved on to Teacher Training Colleges (popularly known as TTCs), Nursing school or took on Secretarial courses. I mean no disrespect to the ladies in these professions, but I just want to enlighten you about the deep-rooted societal disparity in the ratio of girls to boys taking on STEM subjects. 

There are some cultures that still have the view that the woman’s place is in the kitchen and do not bother educating their girls. Boys are given preferential treatment and are sent to school since their return on investment is higher than their female counterparts.
Fortunately, the number of secondary schools admitting girls for A’ Levels has increased since the ‘80s and some of the traditional all-girls schools have produced some of Uganda’s most prominent women in the STEAM fields. 

Breaking the status quo!
I completed my six year secondary education at one of those and developed some vital life skills that have carried me through the years such as resilience, team work and empathy for others. We were smart and driven young women who leveraged our different talents in different subjects to help and motivate each other and it was there I decided that I wanted to be an engineer as I excelled in Maths and Physics. I also broke the conventional maternal profession of banking and business. 

Being in such an environment made it appear to be the norm choosing fields perceived to be challenging and masculine, but I later found out my peers in mixed schools were initially bullied for enrolling in Science subjects.

My mother gave me the opportunity of pursuing my undergraduate education in Malaysia, as the IT industry in Asia was growing rapidly. I knew that this was a different domain altogether, and that my Engineering classes would have a smattering of fellow Africans. In the early stages, being one of the other Ugandan girls in my class as we were rather noticeable was quite unsettling. We had to learn how to step out of our comfort zone and made friends with our countrymen as well as some locals. We held group discussions and revision, and used our strengths in the various challenging subjects to help each other excel. I achieved my goal and graduated as a Telecommunications Engineer, something my mum doesn’t forget to bring up, given the opportune moment! 

There is no ‘I’ in TEAM
For postgrad, I did a Masters in International Business (I didn’t escape fate after all). The program is designed such that teams of 4-6 different nationalities and educational backgrounds tackle contemporary business challenges in management, strategy, finance, CSR, to mention but a few. Initially, this somewhat felt like the Hunger Games as it was very competitive and most of us had stereotypical perceptions of each other. As the weeks went by, we learned more about each other and used the varying team dynamics, vast experiences and skill sets to innovate feasible solutions to our assigned cases. 

These enriching experiences have shaped my view of the world and I feel that people should take advantage of the great opportunity of an increasingly globalized world to look at things from a different perspective. Diversity enriches creativity in solving problems and facilitates critical thinking, skills that are essential for one’s personal and professional development.

I believe each of us is a pixel in the bigger picture.

 “If you want to be successful, you should be able to relate to people from all walks of life.” ~ Zain Asher, CNN Correspondent

 This post has been written by Olga Kiconco and uploaded by A Turner on behalf of AWSN. 

(c) AWSN 2016

A Father's Love

This post has been written by Michelle Weatherhead 

I wrote this in memory of my loving father who I suddenly lost 16 years ago.  His death has changed me forever, but his love, encouragement and belief in my career success continues on.  

“connect, support, collaborate and inspire”

This is what it’s all about.

RIP Dad 

A few weeks ago one of my colleagues came into work excitedly telling me how his 8-year-old daughter had just been on an app coding course.

In his words…

My daughter had an absolute ball and was very excited to show me the game she made and is planning her next games. More than that she was able to bring home a good understanding of what she’d learnt and actually completed the whole course again when she got home… It’s brought out her experimental side which I love, trying new things just to see what happens.

How wonderful to see this father supporting and encouraging his daughter to programme.

This got me thinking about my career and what forces were at play around my decisions to pursue and maintain a career in “IT”.  There are many factors at play - I have worked hard, been in the right place at the right time and had wonderful managers and mentors.  But without question I point my career success to my parent influence.  My mother was a microbiologist and father an IT strategist for New Zealand Government.  Without question I was guided, and expected to study STEM at high school and university.

Laying the foundations in pointing me towards STEM studies was key, but I think more importantly my father lay the social foundations for entering a world of business in the IT sector.  Once I entered university my father encouraged me to meet with him and his work colleagues for a monthly after work “networking session”… code: “beer” at the local Wellington institution “Backbencher pub”.  It was here I learnt to interact with senior exec’s and the importance of connections and networking.  Learning to build and maintain win-win business relationships is critical to career success.

Quick detour to a diversity panel recently held by AISA and CBA in Sydney.  The inspirational key note panellist from CBA shared her story and perspectives.  In particular, a study about the impact of gender bias, marketing and in my mind – the impact parental choice has on children’s subsequent careers.  There are some fascinating statistics that demonstrate a correlation between children computer game marketing and female participation in the computer science domain.  To hear more about this please access the recording available from this link.

The impact of parental influence is something that I think about and action daily with my two beautiful children Olivia and Charlie.

Best wishes,

Michelle

 This post has been created by A Turner for Michelle Weatherhead on behalf of AWSN. 

(c) AWSN 2016