Megan Roddie -- Neurodiversity in Security

0:00Chris RomeoHey folks, season 3, episode 17 of the AppSec Podcast. On this episode, Robert interviews Megan Roddy at the Source Conference in Boston on the topic of neurodiversity and security. I think there's a lot of things that we can all learn and take away from this topic, so we hope you enjoy and pay close attention. The Application Security Podcast. Here we go. Hello folks, this is Robert and I'm at the Boston Source Conference in Boston, continuing this week and meeting with people here that are speaking on various topics. It's been a great conference, it's one of my favorites, and one of the reasons I like it so much is I get to meet new people, typically in security, that are coming in and talking about various topics, very interesting topics. And in particular today, I'm speaking with Megan Roddy. She is coming in to talk to us about some interesting things. So Megan, welcome.

1:28Megan RoddieThank you.

1:29Thank you.

1:29Megan RoddieThank you for having me.

1:30Chris RomeoGood to meet you. So, tell me a little bit about yourself, first of all. What brought you here to speak today?

1:37Megan RoddieSo, I'm a security analyst. Right now I'm working for a small MSSP doing consulting and stuff. And I am doing a talk that I try to give at as many conferences as I can. I speak on neurodiversity as it applies to information security, and specifically including individuals with high-functioning autism. and other disorders in the cybersecurity industry as employees because of the skills that they bring that are unique to those individuals.

2:08Chris RomeoOkay, great, great. To get started, and we'll dive into that a little bit more about your talk and what it's about, but what I wanted to do is also just understand one of the things we first ask people is, you know, how did you get into security? Mind telling us your story on that?

2:25Megan RoddieYeah, I kind of fell into it. I did my undergraduate degree in mathematics. I started my graduate degree in digital forensics wanting to do, you know, the CSI stuff and break into bad guys' computers and find the evidence. And that's still all really cool to me, but I needed something to do one summer. I got an email from a teacher about an internship in Austin, which wasn't too far from where I lived. And it was for cybersecurity, but I was like, cyber, digital, it's all the same. I need something to do. So, and it was a paid internship, so that was sounding pretty good.

3:00Chris RomeoOkay.

3:02Megan RoddieSo I went ahead, applied. I got the internship. It was work and things I'd never done, never learned before, but immediately fell in love with doing it. Incident response, cybersecurity, defensive stuff, and blue teaming. And then summer ended and they had an employee leaving, which means they needed a new one. And I already had one foot in the door and I was lucky enough to get a position there full-time. And so then I ended up in cyber.

3:29Chris RomeoOkay, great. And so, again, just to go back to what you were talking about here at this conference, titled Strengthen Your SecOps Team by Leveraging Neurodiversity. So, tell me about that. You mentioned in particular focusing on those who have high-functioning autistic, or I guess labeled that way or described that way.

3:54Megan RoddieYeah.

3:54Chris RomeoMaybe it's a better way to say it. Tell me about that, first of all. What does that mean?

3:58Megan RoddieYeah, so I have Asperger's syndrome, which is kind of a form of high-functioning autism, and I noticed that there's not— there's a large number of individuals with Asperger's or autism or even— the reason I say neurodiversity is because the overarching theme of my talk, though I focus due to personal experience on autism, this really applies to anyone who thinks differently and acts differently. who has anxiety, bipolar, depression, like, they have their weaknesses and that's typically what they're labeled with, but the benefits that they can provide to a security team are too large to ignore just because you don't wanna deal with some hardships. And so, I decided to speak from my experience and kind of, I also provide evidence of other companies who have said, like, this works, like, this isn't, we don't mind dealing with what would be seen as problems to get the benefits.

4:55Chris RomeoYeah.

4:58Megan RoddieSo, since a lot of people with autism and anxiety don't want to public speak, can't public speak, it's just not a situation they're comfortable in, I kind of like doing it. So, I figured, you know, I can at least give my thoughts and at least have one voice out there talking about it.

5:14Chris RomeoOkay, great. So, in terms of— you mentioned some characteristics or things that they can bring, I guess value, if you will, to the table that maybe others can't. What are some of those things in particular? Yeah.

5:29Megan RoddieProbably one of my strengths, so quick learning is a really big one. I can learn pretty much anything I'm told to learn and I can do it quickly. So wherever I am lacking skills, it's not hard for me to pick those skills up. And then high productivity, I have some statistics in my talk that they've actually measured this at companies that have autism at work programs, but I and others with high-functioning autism can be like 3 times more productive than the average employee just in terms of work output. So, I tend to complete more work than can be produced. So, it gets to the point where people aren't drowning in work, they're drowning in the task of giving me something to work on. And then the passion I see is pretty amazing too. Like, it's not just me, I've seen it across all the individuals I've spoken to with autism in IT who just love it, love to learn. Like, we do this out outside of work. It's not something where it's a job and we have to go. And that's present in a large amount of the InfoSec community, but I see it heavily in the neurodiverse community.

6:43Chris RomeoYeah, well, I can attest to that as well in my own experience. And my own drive and passion and desire to learn, I found that to be beneficial. I can see that as well for someone who may be described as HFA is having that focus, having that drive, having that passion, I think would be a really good benefit. What are some of the counter things that people say, well, maybe I have concerns about this in terms of hiring this person?

7:13Have you seen?

7:14Megan RoddieSo just like there's— because the word disability is attached to it, like especially from a hiring standpoint, like all the things you have to think about, about like all the stigmas of it's a disability, and we have to deal with all this stuff and compliance and adjustments and all these things that just really is not that big a deal. All of it more comes down to less about actual, like, financial adjustments needed or workplace adjustments needed and more to more like understanding is really where it comes from. It's like we behave differently, we think differently, and you need to adjust to that. It's not really that there's this huge adjustment, physical adjustment needing to be made, so.

7:58Chris RomeoOkay, makes sense, makes sense. And I actually have some personal investment in this. I mentioned to you a moment ago before we started that I have family members. I have a son who has slight autism. He was diagnosed many years ago. And I know he's gone through some challenges over the years. I have another stepson that had Asperger's. He was diagnosed and he had some challenges as well and continues, you know, in his adult life now. So I've seen it. You know, I've seen, you know, some of the things that they've gone through as well. But I'm curious about in terms of, and maybe even our listeners might have family members or friends or coworkers who maybe have these kinds of things that they're trying to understand, how do they relate to those people? What are some recommendations in terms of working with people and identifying how can I help, how can I be open to?

8:54Megan RoddieYeah, it's really about just understanding there's a different way of thinking and not being easily offended because I'll say a a lot of things that would offend people and you have to understand, like, what I'm saying isn't meant to offend you. It may be that I'm just blunt and I'm saying what I think and, you know, a lot of people who don't have the social deficits I do, they don't say what they think. They say what's appropriate to say in a situation. So, kind of that understanding, like, that I interpret social situations and interpersonal relationships differently than other people do. So, it's a lot lot of patience and understanding and working it with the individuals. And as this talk discusses, like focusing on their benefits and not focusing on their disabilities. So, that's really the whole theme of it is don't focus on the weaknesses because if you focus on the benefits, you'll see it outweighs everything else.

9:54Chris RomeoGreat recommendation. Yeah, and that's what I've done as well with my own sons and focusing on their strengths and things that they do and so forth. So, that's great advice for anybody really, just to relate. And so, in terms of managers who are maybe, how do I, what do I do in terms of maybe looking for those that would be interested in the kinds of jobs, security jobs, application security or other related information security? What should they be doing in terms of reaching out?

10:30Megan RoddieSo, the first thing, I say is that as a whole, like, not even just to attract neurodiverse individuals, but this is a key point of it, is the information security industry needs to do a better job at writing job postings. We epically fail. Like, you're asking for people who have 10 years experience in Windows 10.

10:54Chris RomeoRight.

10:55Megan RoddieLike, there's literally job postings that are impossible, but even Like, a lot of these individuals struggle. Like, I did well in school, but you'll also find a lot of individuals with autism or anxiety or depression or bipolar that couldn't go to college, just didn't have the social skills or, you know, the skills to sit in a classroom for 8 hours a day for 4 years. So, the fact that, like, we have so many— and it's getting better, I've seen it get better, but right now, like, we're still in that mindset of you have to have a 4-year degree plus 10 years experience to get entry-level position.

11:29Like—

11:29Megan RoddieYeah. the job postings, I talk about in my talk, like, when I look at those things and when other autistic individuals look at those things, we take words very literally, and while some people may be able to look at a job posting and they're like, well, it says a 4-year degree, but, you know, I have a 2-year degree and I've got all this extra experience they're not requesting, so they may consider that equal, like, I don't look at that. I see a job listing as a checklist, and the checklists in the industry right now are not feasible.

12:01Chris RomeoLike, there's—

12:03Megan Roddieespecially with this kind of community. You're not gonna find people who have tons of experience plus a huge educational background. It's making it so difficult for individuals, especially high-functioning autistics, a lot of the ones I talk to, trying to get into cybersecurity. They're self-learners and they're really, really sharp individuals and they have the passion and they have the drive and they're willing to learn everything. They have learned a ton. but their resume doesn't show that they've been in the industry, it doesn't show they've been studying, but if you put them in front of a keyboard, they could prove themselves. So, it's kind of like getting in that mindset of a checklist job posting isn't what's going to bring you a team of individuals that are diverse and can really build a strong team.

12:50Chris RomeoSo, the checklist where it's very precise actually can be a deterrent, right?

12:54Yeah.

12:54Chris RomeoBecause you may read it as, Well, it says 10 years. I don't have 10 years. I'm not going to apply for it.

13:00Megan RoddieYeah, as an autistic individual, I see the word requirement. Requirement means has to have. And so it says a year experience. Well, I've only got 9 months, so that doesn't matter. Right.

13:11Chris RomeoYeah.

13:12Megan RoddieOr like, I'll take every word literally. And so it's like, oh, well, this background in system administration. Well, I was technically never in a job role that had the title system administrator, so I don't have that experience. Whereas Other people may look at it and be like, well, I wasn't in a sysadmin role, but through my other job in the help desk, I did some jobs that involved sysadmin. So, like, I don't make those leaps. I read the word for word, and that's what individuals with autism do. They take it a lot more literally. So, you have to kind of think about your phrasing and how to make job posts appeal to the right type of people that you're trying to get, not the checklist perfect resume write-up.

13:53Chris RomeoOkay, makes sense. And then once on board, Any suggestions, recommendations for managers in working with staff that might be HFA?

14:03Megan RoddieYeah, I think my slide basically says forget how you manage your neurotypical employees. You need to pretty much start from the base up, learn about your employees. I encourage a lot of bidirectional communication. Communication is hard for autistic individuals, but they don't like— I don't know what I don't know, so if I'm doing something that you're offended by, I may not know you're being offended, 'cause to me, I'm just behaving the way that I think is normal. What I think is normal may be inappropriate to you, so you just getting frustrated and punishing me, especially when I don't know what it is, isn't gonna do me any good. So there's a lot of communication there, where even though it may be difficult to communicate, it's better for you to tell me, like, hey, you cannot do this, like, stop that, than, than just, like, getting mad and punishing me or stuff like that. So, So, I'm willing to learn and adjust because, you know, I want to get fired as much as you want to fire me. Like, I don't want that to happen. So, if you tell me I'm doing something wrong, then I'm going to fix it. Just like if another neurotypical employee did something wrong, they may know it's wrong, and, you know, but if they're told to stop, they'll stop. So, it's just making sure that keeping that communication open, but then autistic individuals who are who are not great at communicating need to practice those skills of going to their manager, and if they're struggling in a situation, we also need to stop sucking it up and saying, oh well, I'll deal with it, because I've done that myself, and that's part of the reason I talk about this. I'm learning that I can't do that. I can't just sit in a corner and be like, well, I don't— I can't do it this way, but they're making me, so I'll just be upset and frustrated and be miserable. Instead, we need to learn, like, our managers are there, like, Ideally, obviously there's bad company culture, but ideally our managers are there to support us and be leaders. And so we need to learn that we need to be able to go to them and say, hey, like, you— I've been in this situation. It's not ideal for me due to my autism. Like, I can't think that way. I can't operate in that situation. How can we resolve this? So I've been encouraging communication in both directions a lot.

16:18Okay.

16:18Chris RomeoI was going to say, communication. It's what it sounds like, a lot of good communication, more precise in some cases, not taking things for granted, not assuming. So those are great recommendations and suggestions. Well, this is great, Megan. I really appreciate the time to speak to you. Do you have any last thoughts or comments you'd like to give to our listeners?

16:39Megan RoddieNo, I don't think so. I've been really overwhelmed since I started speaking the positive feedback. I kind of do this I mean, I do it for others, but also, you know, I'm here because I want to be here, and if people don't like my talk, I don't really care too much. But the fact that I see people and they'll be like, oh, I saw your talk online, and I'm like, oh, great. When I originally started, I kind of hoped it'd be a flop and that I'd never do it again and it'd be dumb, but it went well, and so now I do it again. So just kind of a general thank you to the community for supporting this. I'll be at BSides San Antonio in June. And then hopefully I'll be in Vegas at either DEF CON or Black Hat in August. So hopefully I'll see people there. Okay, great.

17:25Chris RomeoHopefully some people will come by and say hello.

17:27Yep.

17:27Chris RomeoOkay.

17:28Megan RoddieSure.

17:28Chris RomeoWell, thanks again, Megan, and enjoy the rest of your conference.

17:31Megan RoddieYes, thank you.

17:32Thanks for listening to the Application Security Podcast. If you enjoy the podcast, please do us a favor and visit the iTunes Store and give us a 5-star rating. Our intro music is 8-Bit Kung Fu by Born and TJ, and the outro is Southern Delight by Stefan Cartenberg. You can find us on Twitter @AppSecPodcast or on the web at www.appsecpodcast.org.