Conference PaperPDF Available

What Brings Women to Cybersecurity?: A Qualitative Study of Women's Pathways to Cybersecurity in Norway

Conference Paper

What Brings Women to Cybersecurity?: A Qualitative Study of Women's Pathways to Cybersecurity in Norway

Abstract

The proportion of women in information technology (IT) work is low, however, the growing field of cybersecurity attracts even fewer women. This paper reports from a study exploring what motivates women to enter IT in general and cybersecurity in particular, with the aim of developing strategies to recruit women to these fields. The analysis builds on in-depth interviews with 24 female students and researchers at universities, 12 in cybersecurity and 12 in other IT disciplines. There are some similarities between the two groups, like the lack of knowledge about any IT disciplines, leaving gender stereotypes to lead their images of IT. There are also differences: a wider set of interests and disciplines motivate women to choose cybersecurity. The women find it easier to identify with cybersecurity, seeing it as a field concerning "everybody", different from core fields of IT. IT is still an important gateway and gender stereotypes about IT are a challenge for recruiting women to IT as well as cybersecurity.
What Brings Women to Cybersecurity?





ABSTRACT

        


      
        
       

   
        
         
        
      
        
         
        

CCS CONCEPTS
  
KEYWORDS

ACM Reference format:


     

1 Introduction
While the proportion of women in IT education and IT work
is low in Norway similar to most western countries [1]even
fewer women find their way to fields of cybersecurity [2]. This
study aims to identify factors that affect women's entry to IT
disciplines in general and cybersecurity in particular, to build
knowledge for future strategies to recruit more women to these
fields. The study includes structured in-depth interviews with
female students and researchers, 12 in various IT disciplines
and 12 in cybersecurity at universities in Norway [3]. The
research question in this paper is: what makes women decide
to enter fields of cybersecurity?
Notable challenges for increasing women's participation in
fields of IT have been identified within institutional cultures
and structures [4] and gendered stereotypes [5] that makes IT
appear as a field for men [6]. A major challenge is youth's lack
of knowledge about IT disciplines, recognized to have a more
negative effect on girls than boys [7, 8]. A strong association of
IT with gaming and programming also makes it more attractive
for boys than for girls [8, 9]. This has given rise to stereotypes
associating IT competence more with men than with women
[10], making it challenging for women to identify female role
models as well as identifying themselves with fields of IT [8,
11]. Previous studies have found similarities in women's
experiences in cybersecurity and other IT fields, but also
differences [12]: Cybersecurity is recognized with an even
stronger association with "men's jobs" [13], reflecting its
military roots [12, 14]. Cybersecurity requires a wider set of
expertise including non-technical and creative disciplines [8,
15], suggesting it could attract a varied group, including
women. This first study of women in cybersecurity in a
Norwegian context adds to this literature by analyzing how
women find ways of identifying themselves with this field.
2 Theoretical and Methodological Framework
The study relies on insights from feminist technology
studies emphasizing gender and technology as socially
constructed and co-constructed [16]. Images of IT experts; who
they are and what they do [10], often involve perceptions of
gender that have more negative effects for women. The study
also relies on the "individual difference theory" [17]
acknowledging that women are not a uniform group.
        
        
      

         
Permission to make digital or hard copies of part or all of this work for personal
or classroom use is granted without fee provided that copies are not made or
distributed for profit or commercial advantage and that copies bear this notice
and the full citation on the first page. Copyrights for third-party components of
this work must be honored. For all other uses, contact the owner/author(s).
EICC 2020, November 18, 2020, Rennes, France
© 2020 Copyright held by the owner/author(s).
ACM ISBN 978-1-4503-7599-3/20/11.
https://doi.org/10.1145/3424954.3424965. $15.00
EICC 2020, November, 2020, Rennes, France
H. G. Corneliussen
       
   structured interview guide was used,
including questions about what had brought them to their
chosen IT discipline. The analysis is based on the Grounded
Theory Method (GTM) inspired by Charmaz [18]. She describes
GTM as a strategy for seeking data, describing events, and while
exploring the data, answering the question: "What is going on
here?" The     he study is
approved by the Norwegian Centre for Research Data.
3 Findings
The analysis confirms that women in cybersecurity do
indeed have many things in common with women in other IT
disciplines. The most challenging is their lack of knowledge
about IT when they are in the transition phase from high school
to higher education. Nearly all the women described their
expectations of IT at university as dominated by men in
stereotypical images of "geeks" and "hooded gamers" who had
started programming early. They did not see themselves fit: "I
had never programmed before in my life". IT is an important
gateway to cybersecurity and the association of IT with
masculine stereotypes is still a major barrier for women.
Another common trait between the two groups was the
women's tendency to avoid competing with the male figures of
"geeks" and "gamers" by emphasizing their own interests as
different from these images. Rather than an interest in IT, their
narratives included other perspectives. The women in
cybersecurity emphasized "controlling the technology" to
"limit its effects"; to take part in decisions defining
"boundaries" for technologies' impact on society.
The women in cybersecurity stood out by identifying this
field as open for a varied set of competences. Thus, the women
recognized their own strengths and expertise from other
disciplines, for instance in arts and social sciences, as relevant.
This was an important door opener for many of them, as they
could define their belonging in cybersecurity based on a "safe
and familiar" platform within disciplines that involved less
masculine stereotyping.
Another difference was the women's ability to understand
and associate themselves with the field of cybersecurity. While
even their own IT discipline could be difficult for some of the
female students to define, cybersecurity was not only easier to
describe but the women also saw cybersecurity as a field
concerning "everybody" and everyday life. Thus, different from
how many of the women distanced themselves from core fields
of IT competence that they associated with a stereotypical male
image of IT, they described cybersecurity not only as relevant
for women, but also in need of women.
5 Conclusion
Comparing the two groups has revealed differences that
can be valuable for future recruitment strategies. The study
shows an unused potential for recruiting women to
cybersecurity by acknowledging a wider set of interests and
competences that motivate women. The study also found IT to
be an important gateway to cybersecurity, suggesting
develop more inclusive images of IT as well as cybersecurity to
increase women's participation in either field.
This study is based on a relatively small number of women
with the aim of exploring perceptions and experiences that
shape women's entries to IT and cybersecurity. The study
cannot be generalized to all women and it would be of great
value to test the findings on a larger group, including men.
ACKNOWLEDGMENTS
The study was funded by Norwegian Center for Science
Recruitment. This publication was developed for Nordwit
funded by Nordforsk.
REFERENCES
[1] EUROSTAT. ICT specialists in employment - Statistics Explained.
https://ec.europa.eu/eurostat/statistics-
explained/index.php/ICT_specialists_in_employment(2019).
[2] SO. The Norwegian Universities and Colleges Admission Service
(Samordna opptak). https://www.samordnaopptak.no/info/om/sokertall/; 2020.
[3] Corneliussen HG. "Dette har jeg aldri gjort før, så dette er jeg sikkert
skikkelig flink på" Rapport om kvinner i IKT og IKT-sikkerhet: VF-rapport
8/2020 (2020).
[4] Frieze C, Quesenberry JL. Cracking the Digital Ceiling: Women in
Computing around the World: Cambridge University Press (2019).
[5] Master A, Cheryan S, Meltzoff AN. Computing whether she belongs:
Stereotypes undermine girls’ interest and sense of belonging in computer
science. Journal of Educational Psychology;108(3):424 2016.
[6] Faulkner W. Doing gender in engineering workplace cultures. II. Gender
in/authenticity and the in/visibility paradox. Engineering Studies;1(3):169-89
2009.
[7] Grover S, Pea R, Cooper S, editors. Remedying misperceptions of
computer science among middle school students. Proceedings of the 45th
ACM technical symposium on Computer science education; 2014: ACM.
[8] Jethwani MM, Memon N, Seo W, Richer A. “I Can Actually Be a Super
Sleuth”: Promising Practices for Engaging Adolescent Girls in Cybersecurity
Education. Journal of Educational Computing Research;55(1):3-25 2016
2017/03/01.
[9] Denning P, McGettrick A. Re-centering Computer Science - Position Paper
for ICER06 2006.
[10] Cheryan S, Master A, Meltzoff AN. Cultural stereotypes as gatekeepers:
increasing girls’ interest in computer science and engineering by diversifying
stereotypes. Frontiers in psychology;6 2015.
[11] Corneliussen HG, Seddighi G, Dralega CA. Women's Experience of Role
Models in IT: Landmark women, substitutes, and supporters. In: Helgesen Ø,
Nesset E, Mustafa G, Rice P, Glavee-Geo R, editors. Modeller:
Fjordantologien 2019: Universitetsforlaget (2019).
[12] D'Hondt K. Women in Cybersecurity: Harvard University (2016).
[13] Peacock D, Irons A. Gender inequality in cybersecurity: Exploring the
gender gap in opportunities and progression. International Journal of Gender,
Science and Technology;9(1):25-44 2017.
[14] Reed J, Zhong Y, Terwoerds L, Brocaglia J. The 2017 Global Information
Security Workforce Study: Women in Cybersecurity. Frost & Sullivan, Santa
Clara 2017.
[15] Shumba R, Ferguson-Boucher K, Sweedyk E, Taylor C, Franklin G, Turner
C, et al., editors. Cybersecurity, women and minorities: findings and
recommendations from a preliminary investigation. Proceedings of the ITiCSE
working group reports conference on Innovation and technology in computer
science education-working group reports; 2013: ACM.
[16] Cockburn C. The circuit of technology: gender, identity and power. In:
Silverstone R, Hirsch E, editors. Consuming Technologies: Media and
Information in Domestic Spaces. pp. 32-47. London: Routledge (1992).
[17] Trauth EA, Quesenberry JL. Gender and the information technology
workforce: issues of theory and practice. Managing IT professionals in the
Internet age. pp. 18-36: IGI Global (2007).
[18] Charmaz K. Constructing grounded theory: A practical guide through
qualitative research. London: Sage Publications Ltd (2006).
Chapter
Full-text available
Where do women working in IT find role models? This is the question we ask in this chapter, which presents a study of women in IT careers. Within a framework of feminist technology studies and gender seen as social practices, we explore the women's experiences with role models through qualitative interviews. A lack of female role models is central in the women's narratives, and we develop a model illustrating the various responses to this lack.
Article
Full-text available
Despite having made significant inroads into many traditionally male-dominated fields (e.g., biology, chemistry), women continue to be underrepresented in computer science and engineering. We propose that students' stereotypes about the culture of these fields-including the kind of people, the work involved, and the values of the field-steer girls away from choosing to enter them. Computer science and engineering are stereotyped in modern American culture as male-oriented fields that involve social isolation, an intense focus on machinery, and inborn brilliance. These stereotypes are compatible with qualities that are typically more valued in men than women in American culture. As a result, when computer science and engineering stereotypes are salient, girls report less interest in these fields than their male peers. However, altering these stereotypes-by broadening the representation of the people who do this work, the work itself, and the environments in which it occurs-significantly increases girls' sense of belonging and interest in the field. Academic stereotypes thus serve as gatekeepers, driving girls away from certain fields and constraining their learning opportunities and career aspirations.
Conference Paper
Full-text available
Past research extensively points to gross misperceptions of the discipline of Computer Science among students in middle and high school. As efforts to introduce computing education in K-12 gains traction in tandem with initiatives that address issues of interest and attitudes towards CS, misperceptions of computing as a discipline must also be addressed as early as middle school, which is known to be a key time for identity building. This paper shares the results of a curricular intervention that aims to show CS to students in a new light - in real world contexts and as a creative and problem-solving discipline; as something bigger and broader than the "computer-centric" view that students are known to harbor.
Article
Utilizing qualitative data gleaned from focus groups with adolescent girls participating in a cybersecurity summer program (N = 38, mean age = 16.3), this study examines the following research questions: (a) How do adolescent girls perceive the cybersecurity field? (b) What are the promising practices that engage girls in cybersecurity education? Guided by ecological and social role theories, findings reveal that single-sex collaborative settings with encouraging and supportive teachers and female mentors are practices that contribute to girls’ increased interest in the field of cybersecurity. Findings also suggest that an emphasis on creative and collaborative problem-solving processes and the real-world application inherent to cybersecurity are likely to increase girls’ engagement in the field. Results have implications for educators, researchers, and policy makers aiming to close gender gaps in the field of computer science and build interest in cybersecurity, an area of critical national need.
Article
Computer science has one of the largest gender disparities in science, technology, engineering, and mathematics. An important reason for this disparity is that girls are less likely than boys to enroll in necessary "pipeline courses," such as introductory computer science. Two experiments investigated whether high-school girls' lower interest than boys in enrolling in computer science courses is influenced by stereotypes of the field. We further tested whether these stereotypes can be communicated by the physical classroom environment, and whether changing this environment alters girls' interest. In 2 experiments (N = 269), a computer science classroom that did not project current computer science stereotypes caused girls, but not boys, to express more interest in taking computer science than a classroom that made these stereotypes salient. The gender difference was mediated by girls' lower sense of belonging in the course, even beyond the effects of negative stereotype concerns, expectations of success, and utility value. Girls' lower sense of belonging could be traced to lower feelings of fit with computer science stereotypes. Individual differences in fit with stereotypes predicted girls' belonging and interest in a stereotypical, but not a nonstereotypical, classroom. Adolescence is a critical time for career aspirations. Girls may avoid computer science courses because current prevailing stereotypes of the field signal to them that they do not belong. However, providing them with an educational environment that does not fit current computer science stereotypes increases their interest in computer science courses and could provide grounds for interventions to help reduce gender disparities in computer science enrollment. (PsycINFO Database Record
Article
Part I of this paper (in Volume 1, Issue 1) presented fieldwork observations about everyday interactions in engineering workplace cultures, which tend to make it easier for men than for women to build working relationships and to ‘belong’ in engineering. This second part extends the analysis, by examining the ‘in/visibility paradox’ whereby women engineers are simultaneously highly visible as women yet invisible as engineers. This paradox is a key to understanding how women engineers experience engineering workplace cultures, and a major factor underlying the poor retention and progression of women in engineering. Women engineers' invisibility as engineers is evident in the greater effort required of them to be taken seriously as ‘real engineers’ and the undermining of confidence which can ensue. Their visibility as women brings contradictory pressures – to be ‘one of the lads’ but at the same time ‘not lose their femininity’. These in/visibility dynamics have a significant cumulative effect, not least because they are subtle and taken for granted. To understand why they occur, the study proposes a related concept – gender in/authenticity – to capture the apparent congruence or non-congruence of gender and engineering identities for men and women engineers. This concept gives us a wider perspective on why gender norms are slow to change in engineering, and on how gender change might be achieved in engineering workplaces.
Article
Despite increases of women in the labor force, females are largely under- represented in the American IT workforce. Among the challenges that managers face in addressing the under representation of women in the IT workforce is the identification of an appropriate theory as a basis for understanding data about gender and IT in order to reverse the gender imbalance. Hence, the purpose of this chapter is to demonstrate the managerial implications of theory choice when addressing the under representation of women in the IT workforce. We provide an overview of the three main theoretical perspectives, the essentialist theory, the social construction theory, and the individual differences theory of gender and IT,