Society has long progressed on elevating women’s rights. In education, suffrage, and fields of work, women have been rightfully included after having been restricted to the confines of homes. At present, women are able to take on leadership and decision-making roles and are valued for their perspectives, contributions, and merit. Women are also put at the helm of organizations that are critical to nation-building and development. But the path towards empowerment and equality continues because challenges still exist. Women are still considered a minority in some workplaces, and the struggle to advance in the hierarchy is ever present. This manifests in various fields, particularly in cybersecurity.
A 2017 study conducted by (ISC)2 revealed that women comprise 24% of the global cybersecurity workforce. While this is a positive development from 2011 when only 11% of the study respondents are women, this shows the continuing underrepresentation of women in the field.[1] It is imperative to explore this challenge and discuss the factors that affect it. In this regard, this policy brief will argue that gender-balanced representation in the cybersecurity workforce presents advantages and opportunities in the country’s pursuit of cybersecurity. This policy brief seeks to answer the following research questions:
- Why are women underrepresented in the cybersecurity workforce?
- What is the significance of having gender-balanced representation in the cybersecurity workforce?
- How can the Philippines encourage more women in cybersecurity? How can the Department of National Defense (DND) support this initiative?
The Philippine government, particularly the DND, has the opportunity to strengthen both its cybersecurity commitment and gender and development (GAD) agenda. To explore the role of the defense establishment[2] on women in cybersecurity and identify opportunities therein, the author conducted an interview with Dir Christine June P Cariño, MNSA, Chief of the Office for Cyber and Information System Management of the DND. The expertise, perspectives, and experiences of Dir Cariño contributed to the direction of this policy brief.
Gender-Balanced Representation in the Cybersecurity Workforce: Advantages and Challenges
The global cyber threat landscape has intensified in recent years such that actors, mechanisms, and platforms have evolved towards both advantageous and adverse effects. States, even the most capable, struggle to constantly adapt and innovate while addressing a multitude of cyber threats. One of the key areas that requires more attention in order to combat cyber threats is the cybersecurity workforce.
| Gender-balanced representation contributes to the success of institutions. |
The current state of the global cybersecurity workforce is two-pronged. First, the (ISC)2 Cybersecurity Workforce Study 2022 noted that there are currently 4.7 million cybersecurity professionals in the world, an 11.1% increase compared to that in 2021. This meant that 464,000 jobs were created in a year, with the Asia-Pacific region occupying the largest growth at 15.6%.[i] This growth is a result of the increasing demand for the development of the cybersecurity workforce, while the demand stems from the prevalence of cyber threats in the security environment. Second, while the cybersecurity workforce expanded, the cybersecurity workforce gap has also grown tremendously. According to the same study, there is a 26.2% ‘year-over-year increase’ in the global cybersecurity workforce gap.[ii] This widening gap also stemmed from the demand for skills in relation to the low supply of talent. In this situation, susceptibility to cyber attacks will remain high among states, thereby necessitating the need for more people in the cybersecurity field. Indeed, “The future of cybersecurity is defined by professionals evolving and persisting through the volatility of today’s threat landscape.”[iii]
The question arises as to how the cybersecurity workforce gap can be addressed. In this context, the role of women in cybersecurity emerges. Several studies have noted that women’s involvement in cybersecurity can address the cybersecurity skills gap and, at the same time, contribute to women empowerment in male-dominated workplaces. The following points argue that women’s involvement in cybersecurity is beneficial to achieve gender-balanced representation or the equal representation of women and men in various fields.[iv]
Gender-balanced representation is promoted not only to pursue GAD but also to contribute to the success of institutions. A research study by Fortinet noted that gender-diverse teams have a higher chance of making better decisions compared to all-male teams.[v] Indeed, diversity in the workplace generates more comprehensive solutions to institutional challenges. As cyber threat actors also have diverse backgrounds and skills, women’s perspectives, experiences, and abilities encompass a wide range of areas that are advantageous in a complex field such as cybersecurity.[vi]
| Women possess greater soft skills such as leadership, interpersonal or communications, analytical, and personal which are all essential in cybersecurity. |
In relation, women are noted to possess greater soft skills such as leadership, interpersonal or communications, analytical, and personal which are all essential in cybersecurity.[i] The biggest misconception in cybersecurity is that it is only a technical field. On the contrary, it requires a variety of skill sets. For instance, women fare better in education with 52% having advanced degrees in cybersecurity compared to 44% of men.[ii] This, together with soft skills, further establishes women’s invaluable role in cybersecurity.
Gender-balanced representation in cybersecurity can also hold precedent to other male-dominated fields. Although this seems extensive to pursue, it may create a ripple effect towards gender diversity and inclusion in the society.
| Having gender-balanced representation in cybersecurity may create a ripple effect towards gender diversity and inclusion in the society. |
Notwithstanding these advantages, there are two main causes why women are underrepresented in cybersecurity. On the one hand, women experience challenges in the field. First, gender discrimination is present. According to a 2017 study, 51% of women reported discrimination in the workplace, 87% of which are unconscious discrimination.[i] This raises concerns because unconscious discrimination may mean that the unjust treatment of women has become common practice and has been embedded in everyday life. Next is sexual harassment. While this happens in all industries, sexual harassment cases in cybersecurity are not often discussed or reported. However, this does not mean its absence. In the United Kingdom, one initiative sparked a movement among women in cybersecurity to share their stories of having experienced groping and inappropriate behavior. Just like other sexual harassment cases, there are no accurate statistics to reflect the reality of such situations in cybersecurity, as women are often afraid to speak up. If they do, they are subjected to ridicule and criticism.[ii]
| Women in cybersecurity are underrepresented because of both societal challenges and personal choice. |
These challenges lead to the second reason which is personal choice. Cybersecurity does not attract women as much because of perceiv ed notions of the field. For instance, it is viewed that cybersecurity is solely a technical field and technical skills are solely for men. Also, aside from the fact that it is a male-dominated field, there are pay gaps between women and men in that women are paid less for the same job as their male counterparts.[i] In addition, women feel that they have to exert greater effort and achieve far more before gaining recognition or even getting equal treatment.[ii] All these discourage women from entering cybersecurity or staying within the field.
Challenges on gender-balanced representation are also observed in the defense establishment. If these challenges are put alongside the challenges to pursuing cyber defense, the role of the DND becomes more vital. The implications of this situation merits further discussion.
Perspectives in the Defense Establishment
Gender is a complicated issue in the context of defense. Although times have advanced, there are still visible challenges for women in male-dominated fields such as the military. The Department of National Defense or DND, however, does not only comprise the military as represented by the Armed Forces of the Philippines (AFP) but also four other important bureaus such as the Office for Civil Defense (OCD), the National Defense College of the Philippines (NDCP), the Government Arsenal (GA), and the Philippine Veterans Affairs Office (PVAO). The DND, therefore, plays a multitude of roles underlying its function to ensure national security and to defend the country from a range of threats.[iii] Included in the Department’s roles are building the country’s cyber defense capability and promoting GAD. As a formidable cyber defense is necessary in today’s ever-evolving security environment, the Department has a valuable role in shaping the country’s cybersecurity, particularly the cybersecurity workforce. Meanwhile, the Department is also committed to its GAD agenda. This interplay of relationships is where gender-balanced representation and the role of women in the cybersecurity workforce will be contextualized. In this regard, it is important to establish the reality of women in the defense establishment.
| While the current composition of the defense leadership stems from a given reality, the Department is encouraging of women leaders and decision-makers. Women’s voices are fairly considered and valued. |
First, the underrepresentation of women in defense is reflective of larger societal challenges. Likewise, what happens in Philippine society is the microcosm of a global situation. It is important to note that women were only accepted to military schools in the Philippines starting 1993, a year after the Women in Development and Nation-Building Act was passed. Subsequently, it was only in 1997 when the first batch of female cadets from the Philippine Military Academy (PMA) graduated.[i] Since men have always formed the military and women have only been granted their rights to join almost three decades ago, women’s underrepresentation in the defense establishment reflects a given reality for now.
Second, the DND is led by male senior officers such as the Secretary, Undersecretaries, and Assistant Secretaries. To note, the appointments in these positions are done based on trust and experiences. Given that men have established themselves first in the military, it figures that the current composition of the defense leadership are retired male senior military officers, as most female military officers have not yet retired or are still active in the service. Nevertheless, while the time of female military officers is yet to come, the Department is encouraging of women leaders and decision-makers. In fact, the Department consists of female Directors who are empowered and authoritative in their respective offices. Therefore, women’s voices are fairly considered and valued.
This reality, when situated in cybersecurity, provides opportunities for the DND. As stated in the National Cybersecurity Plan 2022, the DND is tasked to develop the country’s cyber defense capability. Part of the challenges in building this capability is the dearth of cybersecurity professionals in the country. In all, perspectives in the DND figure prominently in support of the Department of Information and Communications Technology (DICT) and in elevating the role of the defense establishment on women in cybersecurity.
POLICY RECOMMENDATIONS
Building on the advantages and challenges of women in cybersecurity and the reality in the defense establishment, opportunities for the DND emerge. The following are policy recommendations that can potentially impact the way the DND perceives its role on women in cybersecurity.
| There is a need to highlight both the quantitative and qualitative aspects of gender-balanced representation in the cybersecurity workforce. |
First, there is a need to highlight both the quantitative and qualitative aspects of gender-balanced representation in the cybersecurity workforce. On the surface, the quantitative aspect or the number of women in cybersecurity seems to matter more. It can also be observed that data on women in cybersecurity reflects only those with technical skills. While numbers are certainly important, qualitative gender-balanced representation is key especially in the defense establishment where women are still underrepresented because of the given reality. By highlighting the contribution of women in cybersecurity and their invaluable roles in policy-making and leadership, the low number may be remedied in the short-term while other initiatives are being pursued to encourage more women to enter the field.
| The gap in the cybersecurity workforce presents an opportunity to upskill female military officers on cybersecurity and cyber defense. |
Second, the gap in the cybersecurity workforce presents an opportunity to upskill female military officers on cybersecurity and cyber defense. While some female military officers are deployed near the frontlines during battles, most of them are assigned in office work. This becomes a concern as most offices in the military are already being filled up. In this regard, the defense establishment may consider upskilling female military officers on cybersecurity and cyber defense. This will benefit the DND because: first, it considers cyberspace as the fourth domain of warfare;[i] and second, this can prepare the country for the future of warfare, which may include battles fought not with guns but with computers. Meanwhile, increasing the number of plantilla positions on cybersecurity in the defense establishment will open opportunities for civilian women to enter the field. Related to this is the establishment of dedicated cyber units and offices which will be instrumental for the defense establishment’s cyber defense priority.
Third, the DND may collaborate with the Department of Education (DepEd) and the DICT in encouraging more women to become interested in cybersecurity and cyber defense. This initiative can start in schools, particularly by including a cybersecurity track in senior high school which can be lodged under the STEM (Science, Technology, Engineering, Mathematics) track. Further, female students can be encouraged to become military officers in the future with specializations on cybersecurity or cyber defense. In all, education is key for the future of cybersecurity in the country. In addition, the DICT’s recently launched DIWA or the Digital Innovation for Women Advancement will empower women and raise awareness among the public on cybersecurity issues.
Fourth, the DND may also collaborate with the private sector through the AFP affiliated reserve units. According to the Armed Forces of the Philippines Reservist Act, “certain private and government entities, corporations, establishments and organizations at the national, provincial and municipal levels”…“shall be organized as affiliated units of the Reserve Force.”[ii] This entails that in times of crises such as war and emergency, certain private institutions providing essential services will be tapped to aid the armed forces. In a similar manner on cybersecurity, cybersecurity companies may be recruited as reserve units to support the government in its cybersecurity and cyber defense efforts especially in terms of technical expertise. Relatedly, the government can also learn from the private sector in training information and communications technology (ICT) graduates with the security of employment thereafter.
| In pursuit of cyber defense, the Department may consider collaborating with other government institutions on education, with private organizations through the AFP affiliated reserve units, and with foreign counterparts on programs and trainings. |
Fifth and final, the DND may encourage mentoring and may strengthen its partnerships with foreign counterparts not only to get more women involved in cybersecurity but also to ensure that they stay in the field. In mentoring, role models and senior encouragement were noted to spark women’s interest in the field. If there are more mentors, more young women will be encouraged to enter cybersecurity and prosper within the field.[i] [ii] At present, the number of successful women in cybersecurity are increasing which shows a positive development.[iii] Also, strengthening partnerships with foreign counterparts is vital for the DND in training more women on cybersecurity and cyber defense issues. For instance, the country’s robust partnerships with the United States and Australia on empowering women in cybersecurity through workshops, training, and programs can only be enhanced hereon. Indeed, this will enable career progress for women in cybersecurity and create talent retention other than talent generation.
| As the dearth of cybersecurity talent is a barrier in the development of cybersecurity in the country, there is great potential in encouraging more women to enter, stay, and thrive in the field. |
CONCLUSION
In this policy brief, gender-balanced representation in cybersecurity was noted as a way to address the cybersecurity workforce gap which hinders the achievement of a secure and resilient cyberspace. Further, it is strongly recommended to foster success in organizations because of the diverse and cohesive decision-making through women’s increased participation. In all, gender-balanced representation presents many advantages and opportunities for women and cybersecurity.
The Department of National Defense, as the primary institution responsible for cyber defense, is concerned with the challenges in the country’s cybersecurity workforce. In this situation, the Department faces opportunities to strengthen its role in defending the state and its people from cyber threats. This includes highlighting the quantitative and qualitative aspects of gender-balanced representation, upskilling women in the military on cybersecurity and cyber defense, and collaborating with government institutions, private organizations, and other countries in pursuit of a strong and sufficient cybersecurity workforce.
As the dearth of cybersecurity talent is a barrier in the development of cybersecurity in the country, there is great potential in encouraging more women to enter, stay, and thrive in the field. However, it is important to note that this policy brief does not present women as mere gap-fillers of the aforementioned cybersecurity challenge. Rather, this policy brief has highlighted that women have a propitious future in cybersecurity and in turn, cybersecurity has a progressive future with women’s increased participation. The challenges being experienced by women in cybersecurity may be hindrances, but they can also be viewed as leverage for women’s advancement.
| Christine Lisette M Castillo, MIS is a Defense Research Officer II at the Research and Special Studies Division (RSSD) of the National Defense College of the Philippines. For engagements, please email christine.castillo@ndcp.edu.ph. |
Please scan the QR code to access our Feedback Form for your comments, opinions, and suggestions. Thank you very much and we look forward to hear from you.
[i] David Panhans et al., “Empowering Women to Work in Cybersecurity Is a Win-Win,” Boston Consulting Group, September 7, 2022, https://www.bcg.com/publications/2022/empowering-women-to-work-in-cybersecurity-is-a-win-win.
[ii] (ISC)2 Women in Cybersecurity, 13.
[iii] “A guide for women in cybersecurity,” https://cybersecurityguide.org/resources/women-in-cybersecurity/.
[i] Department of National Defense, National Defense Strategy 2018-2022, 17, https://www.dnd.gov.ph/Files/ShowFile?url=/FilesUploaded/Ck editor/file/NDS_7_August_2019.pdf.
[ii] Official Gazette, Citizen Armed Force or Armed Forces of the Philippines Reservist Act, June 27, 1991, https://www.officialgazette.gov.ph/1991/06/27/republic-act-no-7077/.
[i] Ramon J Farolan, “Women of the PMA,” Philippine Star Global, May 15, 2022, https://www.philstar.com/opinion/2022/05/15/2181133/women-pma#:~:text=In%201992%2C%20legislation%20widely%20known,required%20for%20men%2C%20except%20for.
[i] (ISC)2 Women in Cybersecurity, 5.
[ii] Cybersecurity Guide, “A guide for women in cybersecurity,” Last updated October 5, 2022, https://cybersecurityguide.org/resources/women-in-cybersecurity/.
[iii] “The Department,” About Us, Department of National Defense, https://www.dnd.gov.ph/PageContents/Title/The%20Department?type=Page.
[i] (ISC)2 Women in Cybersecurity, 13.
[ii] Kate O-Flaherty, “Sexual Harassment In The Cybersecurity Industry – How One Woman Is Fighting Back,” Forbes, August 15, 2018, https://www.forbes.com/sites/kateoflahertyuk/2018/08/15/sexual-harassment-in-the-cyber-security-industry-how-one-woman-is-fighting-back/?sh=4d783f55576e.
[i] Edlen Vanezza Bayaton-Obispo, “Exploring the Benefits of Gender Diversity in Cybersecurity,” Money Sense, April 29, 2019, https://www.moneysense.com.ph/exploring-the-benefits-of-gender-diversity-in-cybersecurity/.
[ii] (ISC)2, “(ISC)2 Research Finds Women Comprise 24% of Global Cybersecurity Workforce,” April 2, 2019, https://www.isc2.org/News-and-Events/Press-Room/Posts/2019/04/02/ISC2-Research-Finds-Women-Comprise-24-percent-of-Global-Cybersecurity-Workforce.
[i] International Information System Security Certification Consortium, Inc., (ISC)2 Cybersecurity Workforce Study 2022, 6, https://www.isc2.org//-/media/ISC2/Research/2022-WorkForce-Study/ISC2-Cybersecurity-Workforce-Study.ashx. Hereafter referred to as “(ISC)2 Cybersecurity Workforce”.
[ii] (ISC)2 Cybersecurity Workforce, 7.
[iii] (ISC)2 Cybersecurity Workforce, 3.
[iv] ‘Equal’ as used in this statement does not only refer to the quantitative but also to the qualitative, in that women receive the same opportunities, recognition, and benefits as men.
[v] Fortinet, “Exploring the Benefits of Gender Diversity in Cybersecurity,” October 4, 2019, https://www.fortinet.com/blog/business-and-technology/exploring-benefits-gender-diversity-cybersecurity.
[vi] University of North Dakota, “Paving the Road for More Women in Cyber Security Jobs,” https://onlinedegrees.und.edu/blog/more-women-in-cyber-security/.
[1] International Information System Security Certification Consortium, Inc., (ISC)2 Women in Cybersecurity Report, 3, https://www.isc2.org/-/media/ISC2/Research/ISC2-Women-in-Cybersecurity-Report.ashx?la=en&hash=4C3B33AABFBEAFDDA211856CB274EBDDF9DBEB38. Hereafter referred to as “(ISC)2 Women in Cybersecurity”.
[2] ‘Defense establishment’ as used in this policy brief refers to the Department of National Defense.