Empowering Inclusion in Cyber Defense

Discover how cybersecurity is being reshaped to be more inclusive and accessible for everyone, especially those with disabilities. Join us as we host an enlightening conversation with Lauren Iglehart, CISA's Chief of the Office of Equity, Diversity, Inclusion, and Accessibility, and Bob Nadeau, the Partnerships Branch Chief within Strategic Relations at the Cybersecurity and Infrastructure Security Agency. While Neil Milliken enjoys a break in Thailand, our guests share the United States government's groundbreaking initiatives aimed at making cybersecurity resources available to all. Learn about the Secure Our World campaign, designed to mitigate cyber risks while fostering digital equality, and hear how these efforts are making a global impact on infrastructure protection.

We also explore the importance of diversity within CISA's workforce, including the Neurodiverse Federal Workforce Initiative, which focuses on recruiting individuals with autism and other targeted disabilities. Gain insights into how diverse perspectives enhance innovation and problem-solving in the face of evolving cybersecurity threats. Our discussion highlights the challenges and opportunities presented by AI and underscores the need for comprehensive cybersecurity education. Additionally, we touch on the complexities of managing a multigenerational workforce and the importance of leadership in adapting to a rapidly changing security landscape. Listen in for a deeper understanding of how CISA is leading the charge toward a more secure and inclusive digital future.

Chapters

• 0:00 Cybersecurity and Accessibility Partnership
• 15:37 The Importance of Diversity in Cybersecurity

Transcript

Debra Ruh: 0:00

Hi everyone, welcome to Access Chat.

Debra Ruh: 0:02

I'm here today with Antonio, and Neil Milliken is off in Thailand for the holidays, so we wish him and his wife and their families a very happy holiday, and we'll see Neil in 2025, if not sooner.

Debra Ruh: 0:17

And so today I'm really excited to talk about some things that are happening here in the United States very positively, with our government really making sure that we are certainly addressing cybersecurity, but we're making sure that everybody can be secure, and I'm very proud of these leaders that we're featuring today, because not only are they doing it here in the United States and supporting our community the community of people with disabilities, but actually everyone, because we all need to be secure but they also are sharing what they're doing with the rest of the world, and that makes me proud as an American. So I'm going to let them introduce themselves, but I'm going to start with the beautiful Lauren Iglehart and then she's going to turn it over to Bob Nadeau, who I hope I didn't mispronounce his last name, but he was the person I first started talking to and I, just as an American, I'm very proud of what they're doing and I hope y'all get behind me to support what they're doing and share it and really applaud what they're doing as well. So, lauren, welcome to the program.

Lauren Iglehart: 1:17

Thank you. Thank you very much for the invitation. I am Lauren Iglehart and I have the pleasure of serving as CISA's Chief of the Office of Equity, diversity, inclusion and Accessibility. We provide agency-wide leadership and advice on equal employment opportunity, reasonable accommodation, complaints processing, diversity, inclusion, language access and internal civil rights to the workforce, employees and applicants.

Bob Nadeau: 1:46

Thank you. Hello everybody, my name is Bob Nadeau and you were pretty close, deborah, so thank you very much for inviting us here today. Global Impact's been a tremendous partner for us and we really thank you for all your support of the efforts we have been working on. I'm the Partnerships Branch Chief within Strategic Relations in the Stakeholder Engagement Division at CISA, which, for those on the call, is the Cybersecurity and Infrastructure Security Agency, but we'll go with CISA for the rest of the session, and our team works closely with state, local, tribal, territorial, private sector and non-governmental and nonprofit partners to ensure that they have an understanding of the resources we have available at the agency and how those resources can help reduce their cyber and physical infrastructure security risks. So that's how we came to know Roo, and we're very glad to be working with you on this chat today.

Debra Ruh: 2:43

To know Ruh, and we're very glad to be working with you on this chat today and I will just say that I was delighted because actually you reached out to me and you said listen, we really want to make sure the community of people with disabilities understand what we're doing, not just from an American point of view, but a global point of view, and I know that you've worked with other American organizations the World Institute on Disabilities, which I have been a board member for years and I just actually rolled off this month. So, but Marcy Roth and that team, they're just, they're amazing people.

Debra Ruh: 3:13

And I know but I know you're also reaching out to other groups, and so that, first of all, impressed me. We we talk about cybersecurity all the time on this show because you can't. You know we often talk about you need to have security, you need to have privacy, but you also need to have accessibility and inclusion. I mean, all of our technology needs to have all of this stuff all wrapped in together, and I really do applaud the efforts that are being made throughout the United States government and in agencies that, even if they're big agencies that get a lot of funding, very rarely is the work that you are doing, I think, properly funded, just as a citizen, and so I really, really applaud that. But I also I was so impressed with what y'all were doing, and so, bob, do you and Lauren mind just talking a little bit about what y'all are actually doing and why you reached out? For example, why are you reaching out to communities like the community of people with disabilities?

Bob Nadeau: 4:16

Sure, I'd love to do that, and Lauren and her team have been a tremendous partner for our partnerships team in making sure that we are properly working with both their team and the disability community and in the tools that we provide and the resources that we provide, to make sure that we're making those as accessible as possible. So really thank her and her team for the work they've done with us. You know we're a very connected society today and in CISA's role as being the cyber defense agency for the nation and helping to protect our critical infrastructure, that also includes protection of and building an understanding of, the cyber threats and risks that we all face every day. And being such a connected society of phones and tablets and work, emails and communication shopping, it's really encouraging to see all the emerging technology that's coming out and how it's important to our getting around daily and accessing services daily. We came to realize that those services are really critical for the disability community. To realize that those services are really critical for the disability community.

Bob Nadeau: 5:28

Some people really rely on being connected in order to access just simple services that many of us take for granted every day. So it was important for us in our partnerships team and as part of the stakeholder engagement division, to make sure that the tools and resources that we're providing are accessible to everybody, and I can get into Secure Our World a little later, but that's part of what led to the Secure Our World initiative and making sure that we are all able to take action every day to reduce our cyber risk online because of all these emerging technologies that are out there and the challenges that they pose. So, again, thank you to Lauren and her team, because they've been a huge partner in our rollout of this initiative and couldn't thank her enough. And, of course, deborah, you being a partner with us has been really influential to us as individuals, but also to the team as a whole, and understanding the kind of things that we need to consider and take into consideration as we build out our tools and resources.

Debra Ruh: 6:25

It's exciting, Lauren. You want to come in and talk a little bit about this.

Lauren Iglehart: 6:29

Yes, I want to definitely say that we understand at CISA that really our greatest asset is our people and the people who are doing all of the work to ensure that we secure our world. Our mission is to really lead the national effort to understand, manage and reduce risk to our cyber and physical infrastructure and it's our people who do that. Individual differences, our diversity in terms of our perspectives and thoughts we understand, are our defining strength and we're committed at CISA to supporting the full inclusion and equal opportunity for persons with disabilities in all of our programs and activities here at CISA.

Debra Ruh: 7:13

I agree. Just a quick comment then hand it over to Antonio. But as you were talking about that, laura, and I was thinking also all those efforts you are doing to make sure the people's voices and the diverse voices are being heard in this really important topic. It seems like that's going to help us with the unconscious and maybe conscious bias in the AI and the programming and all of that. It just seems like those things really nicely tie together.

Antonio Vieira Santos: 7:38

They definitely do. Yeah, they definitely do.

Debra Ruh: 7:41

Yeah, yeah, antonio, over to you.

Antonio Vieira Santos: 7:45

But this is such an important topic because sometimes in this space of cybersecurity, as we've seen occasions where cybersecurity was used as a way to justify something not becoming accessible, because the tools become a kind of a risk. I would like to have your input. How can we evangelize and educate that cybersecurity and accessibility can go hand in?

Bob Nadeau: 8:12

hand. Yeah, antonio, you hit the nail on the head and we rolled out Secure Our World last September, september 26, 2023. And that was a recognition of all the emerging technology out there, all the new challenges and threats. I think I read recently 65% of people think that AI is really going to be a challenge, use IT and continue to use our connected devices. It raised the concern about basic cyber hygiene. What is it that we're doing every day to make sure that we're reducing risk when we're online and using those connected devices? So the director said, hey, I want to do an awareness program about this. I want to get the word out that we can all take action to reduce our risk online. And so we rolled out Secure Our World and it offers four basic steps to being safe online and reports scams and phishing attempts and making sure you're updating your software and enabling automatic update on all your devices so that, whether you're on the computer or whether you're on your phone or whether you're a tablet, that you're taking steps just like you would as getting in a car and buckling your seatbelt. You're getting on your online devices and you're making sure you're safe and making sure you're accessing accounts and accessing services and such online and you're safe. You're being safe about that. So, but getting to your point, antonio, we came to realize that secure our world has to be everybody being able to take those actions. We can't just assume that everybody has the same level of knowledge on how to create a strong password, how to enable multi-factor authentication.

Bob Nadeau: 10:15

So we went to Lauren's team and said, hey, we want to make sure that the tip sheets we're putting out, the animated videos we're putting out, the PSAs that we've been rolling out as part of Secure Our World, and all those great resources are also accessible and understandable and reachable to as many people as possible, that they resonate across the country, but also that they're accessible to everyone across the country. So we've been working with her and working with Deborah at Roo and working with Marcy at World Institute of Disabilities to get that feedback. Hey, here's a product that we have. Can you tell us, does this resonate? Is there anything we should change? Is this something that the disability community can relate to and is it useful to them? And thanks to all of them. It's been really, really helpful in having us develop a number of resources that can be accessed by the disability community, and I hope you don't mind if I just share for one minute a short video that we can talk over, and I hope it shows up here.

Bob Nadeau: 11:20

So I haven't tried this shared option before. Let's see here. Okay, here we go, no-transcript. So, whether it be social media, whether it be the tip sheets, whether it be website accessibility, our PSAs, we're taking steps to make sure that, regardless of the skills that you have in cybersecurity, or any limitations or any, or even just a basic understanding of the information that this is, this is accessible to, to you and and to the people that, uh, that you know and love, because we do want people to talk about this. So it's uh, you know, it's, it's you know, go home and see your family and friends that on the holidays and talk about the importance of cybersecurity and the steps we can all take, and so we're really proud of the work that we've been doing. Still more to do. Still need to have new resources. In fact, this new tip sheet that I just showed right there, that's going to be launching any day now. That's going to be launching any day now.

Debra Ruh: 12:55

And I think that will be a great resource for the disability community on things they can do with their devices to help make themselves safer. And I know that when I was, when you were first, we first started talking. Bob, I want to turn the mic over to Lauren, but I just remember that we could. We could run our websites through it and we could run our websites through it. So I ran Rue Global Impact through and I also was doing Billion Strong, because that's something, as a business owner, I'm always worried about. I'm always worried about it. But I also think and I just want to throw this in until we get this, as I give it over to Lauren, because I think she might find this story interesting Once again, I told you all well, I told you right before story interesting.

Debra Ruh: 13:29

But we, once again, I told y'all well, I told you, you came right before you came on the air. But we're moving into our year at Access Check. Every single week we do an amazing show of leaders like y'all that are making a difference, and years ago we had another guest on and it was a gentleman. That is I'm going to use the words wrong, I'm going to use American words a police officer detective in the United Kingdom I know I'm saying it wrong, but in the and what they did this detective, he was involved with cybersecurity. I think I introduced you to him, bob, if I didn't remind me to.

Debra Ruh: 14:03

Anyway, so he came on and he was talking to us about what they were doing in the United Kingdom to work with people with all people, but also people with disabilities that were hackers, and it become hackers sometimes by very unfortunate ways. And he had used an example. It was this wonderful example, lauren, that somebody had put a game out there and the game was you could go in and you can break into a fake savings and loan and you can go in and move money around in transactions. There's this cool game. And so this young man, he did it and he went right in and he did the game and he beat the game.

Debra Ruh: 14:41

Well, unfortunately, it was real and it was a real savings and loan. And so this police department came and realized what had happened, that this young man with autism had been tricked, and then they started putting him in a program to teach them to be a hacker for good. And I just thought and that reminds me of the work you are doing, so I just wanted to throw that. And, bob, I know you want to comment too, but I just think the potential of what you're doing to protect us all but to include us in ways that we haven't been included I find very exciting.

Lauren Iglehart: 15:14

So, lorna, I don't know if you want to address it and then turn it over to Bob maintain a workforce of really analysts, leaders, threat hunters who can utilize their unique perspectives and backgrounds to really hunt these threats with precision. At CISA we truly understand that that diversity of all backgrounds, the individual uniqueness, is what helps us with our innovation, what helps us with problem solving. At CISA we're the second federal agency to establish a neurodiverse federal workforce initiative and of course that includes that was focusing on individuals with autism. We want to create a playbook here of how to outreach here, retain, develop, promote, you know, individuals from different intellectual like backgrounds.

Lauren Iglehart: 16:16

So we have a workforce of over 19 percent who are individuals with disabilities within our workforce. 15 of them are individuals with non-targeted disabilities. 3.5 are individuals with actually targeted disabilities, such as deaf, hard of hearing, blindness, serious vision impairment, limbs difference, traumatic brain injury, autism spectrum disorder. Those are individuals with targeted disabilities. Our program has been successful. We've already hired two individuals from our Neurodiverse Federal Workforce Initiative. We had three of our major divisions to bring in those participants as part of that Neurodiverse Federal Workforce Initiative and it's proven very successful. As you mentioned, an individual who broke into the savings and loans of an autistic background. We want all of those skills and talent within your workforce to defeat those threat actors. It's securing the nation.

Debra Ruh: 17:27

for all of us, that's 19% is impressive. Bob, I know Antonio has a question, but do you want to come in real quick before we turn it over to Antonio?

Bob Nadeau: 17:37

I was just going to say that diversity in our workplace has really helped us as we develop a lot of these tools and resources. As you said, debra, there's so many risks out there. Your financial information could be hacked. Your financial information could be hacked, your personal information can be stolen. There's hackers accessing our devices and such.

Bob Nadeau: 17:55

We just saw the report this week on the PRC China accessing the major telecom companies. With all that being said, our role here is not to scare people, but really to empower people to raise that basic level of cyber hygiene. I think I read in the National Cybersecurity Alliance OBE report this year only 53% of people felt that online safety is even possible. That can be pretty depressing, but it also can show us that, hey, we have a big gap that we have to help close. We have to help show people that online safety is possible. There's some simple steps that you can really take to increase your safety online and bottom line common denominator there. We have to make those opportunities available to everybody, and that's why it's so important for our team to work with Lauren's team and to work with you and the other organizations to make the management of these individuals more effective and to make sure that they are appropriately managed in the world.

Lauren Iglehart: 19:17

We definitely understand it's important to train all of our workforce, whether it's the colleagues that the individual works with directly or the supervisor or management official. On diversity within the workforce we have special emphasis programs. We have the National Disability Employment Awareness Month program. We have employee association groups. We understand that equity, diversity, inclusion, accessibility is something that we should offer 365 days a week. That's our year. I'm sorry, that's our focus. We ensure that there's agency-wide training that is actual, virtual, so we are getting the full workforce.

Lauren Iglehart: 20:01

Strengthening the strength of neurodiversity, for instance, was a major training to all of the workforce. In our Unity Day we look at the brain and inclusion. We've had several lunch and learns on neurodiversity. We have trained managers on the Schedule, a non-competitive hiring process for bringing in individuals who may have an intellectual, a physical or even psychiatric disability. To bring them in non-competitively on a two-year probationary period. So they get to know us and we get to know them to ensure that all of our employees are able to meet the essential functions of the job. We hire in qualified individuals with disability, understanding that disability does not mean inability in any way, shape or form To come into the workforce at TASISA to be a qualified individual with a disability. You have the knowledge, skills, abilities, talents, education background that's needed to do the critical job of securing our nation and supporting maybe as a mission-enabling office, supporting the overall goal of securing our cyber and infrastructure security.

Bob Nadeau: 21:21

And I'd say too that Lauren has the full support of Director Easterly. She has been straight out front leading on this and it's great to see, because Lauren's team can just take the ball and run with it because she has that support at the leadership levels.

Lauren Iglehart: 21:36

Truly.

Debra Ruh: 21:37

I just think In the very top down yes, yeah, and as an American, especially at a time when American politics is very confusing around the world, it just makes me feel so good to see the progress that y'all have made. I just am very proud of you and I just really appreciate all of the leadership that Lauren, you're showing and everybody's showing the director and everybody and Bob. I know we probably have only about eight to six minutes left, but I just wanted to talk about this one more angle because and it really is two more angles, but they complement each other and I was reading, I was watching something and they were talking about AI and they were talking about how much and I'm a big fan of AI, I am, I'm a big fan but they talked about how much the security threats had increased since AI had really come on board and I was shocked at the numbers. I was just shocked at the numbers because they rose so fast, because now of course, we're battling you know, I don't want to say battling AI and make it all about, you know, the robots, but it's just, your jobs are getting harder, not easier, I believe. And then I also think in this way I'm so glad both of you came on to talk about these things, because we also have a significantly aging society and we have multiple generations. What five generations in the workforce now Every once in a while shifts into six or but, and of course, a lot of times as a person ages and I'm an elderly person now. So you know, we, we don't think as well, we don't think as fast, we my multitask.

Debra Ruh: 23:17

So I see it, I see myself shifting and being more deliberate. I want to take the easy button, for example, and just use the same password I've used. And I also want to say to you both Also my information has been stolen so many times in cybersecurity attacks that it makes me numb and I think, well, why even bother? Everybody knows the name of my first dog is the name of my first dog when I write. So I was just curious if y'all could, with the last time we have and I'll make sure I'll do it right now and to thank Amazon, thank you for supporting us, and to thank my clear techs for being with us from the beginning. We love you guys for supporting us. But I imagine, bob and Lauren, a lot of people watching this might feel like I do. It just feels like can we even win this battle? But I understand how important it is. So, bob, I'll start with you and then turn it over to the beautiful Lauren.

Bob Nadeau: 24:15

I think that, well, the good news is that the older Americans tend to be less trusting on the online things that they see Not to say that, including my mom, not to say that they have not been hacked and tried to take advantage of. But I think that that gets to what we're trying to do and ensuring that people know that. Yes, it can be difficult at times, but there are simple things that we can all do to at least start to protect ourselves and increase our basic level of safety online. The good thing on AI is that, yes, certainly brings new challenges, brings a lot of potential opportunities, and Director Easterly recognized that. The president recognized that with the issuance of the AI executive order. The president recognized that with the issuance of the AI executive order and we appointed a chief AI officer here at CISA. That has led the development and implementation of an AI roadmap to provide guidance to our critical infrastructure partners and organizations on the steps that you should take to make sure that you're implementing AI processes safely, that you're recognizing the potential challenges that come with AI and potential uses by bad actors. I think that some of the things that we should just keep in mind, regardless of AI's influence, is just to think about as we receive emails and texts and things like that that just don't seem right, that we weren't expecting. Think before we click on these things, because if it's something that just comes out of the blue and we weren't expecting and it doesn't seem like it's something that you should click on, then you probably shouldn't click on. That's getting much harder with deep fakes, technology, things like that. But the important thing that I would say is that there's never a reason to be embarrassed about asking somebody for help, Whether you clicked on something by mistake or you think you might've gotten hacked or what have you. Please talk to a trusted person and they can help rectify the issue.

Bob Nadeau: 26:25

Many times these situations can be fixed and we all make mistakes. We all click on things that we shouldn't. We all maybe answer, provide some information that we shouldn't, and we just want to make that occurrence happen less and less frequently. So the more we talk about this, we have our PSAs out there, we have our messaging and social media out there just trying to encourage people. Hey, you can do this, you can make yourself safer. Just think about the things that are occurring.

Bob Nadeau: 26:53

Hey, holiday season, lots of attempts by spammers and scammers to get you to click on a link to buy a certain product or go to this website or buy this gift card, and no legitimate organization or government is going to ask you for personal information or money over the phone or by text or by email. So you can stop right there and say I know this is a scam report. It delete it and don't fall for it. And I think that these are the simple messages that we're trying to get out to people so that they can protect themselves, and I think that I know we can do it. We're a great nation, got a lot of smart people out there. There's always a little bit of distrust we have to have with information we receive, but that's a healthy distrust and I think it makes us safer in the end.

Debra Ruh: 27:40

I agree, I agree, I agree, lauren, you want to come in and I know Antonia wanted to make a comment after you do.

Lauren Iglehart: 27:46

Yes, so excellent information from Bob regarding protective measures for the public. I can speak on AI usage in terms of employment, and that's what I'll speak on. The use of artificial intelligence, like machine learning and other algorithmic technologies, and employment decisions really must comply with federal EEO laws. In the employee-employer relationship, the employer really retains the responsibility to ensure that the AI and other emerging technologies they use are really free from both unlawful disparate treatment and adverse impact. So we look at some examples that may pose some adverse impact, like resume screening software, algorithmic hiring assessments, promotional algorithms, interview assessment software, and we examine reasonable accommodations. So all of those things are areas that we look at in terms of AI in employment usage.

Debra Ruh: 28:47

Impressive, antonio.

Antonio Vieira Santos: 28:51

I'm interested to see how an agency I'm sure it has so much information but what is happening out there in you know in terms of cyber and some threats how can you somehow also influence education in terms of what you call digital programs? How can we make sure that education programs, how can we lobby to make sure that cyber is at the heart of when we go into programs that teach people about digital technology?

Bob Nadeau: 29:19

Well, I know on our side in the stakeholder engagement division we have a fantastic academic engagement branch led by Tony Benson, and their team is out there working with the academic community to understand their cybersecurity programs, help build cybersecurity curriculum, work with the K-12 community to start building in cybersecurity related academic courses and encouragement of our youth to get involved in IT and get involved in cybersecurity because that's hey, it's the future right and there's plenty of work to be done in the cybersecurity space. So we want to get people interested in that, especially at a young age. So we also there's a Cyber Skills to Work program where we provide funding to some of the universities to help educate individuals from vulnerable backgrounds in cybersecurity and get them employed in that cybersecurity space. We have a number of universities we work with HBCUs that we work with again to try to build the cybersecurity curriculum and partner with those organizations to really put cybersecurity out there as a great opportunity for a career and also Lauren works on this side too is that career change, that mid-level encouraging staff to take cybersecurity courses and branch out into new opportunities?

Bob Nadeau: 30:44

So I think all that information is available at CISAgov and we'd be glad to provide more information for any of the individuals that are interested. I would just make a plug to the regional. There's regional CISA offices around the country that have a wealth of information and experts that'd be more than willing to work with disability organizations at the regional, state, local level to provide more information on what we're doing in the education space, what we're doing in the cybersecurity protection space. We'd love to have as many organizations as possible sign up for our cyber hygiene services that provide an opportunity for us to monitor from the outside the web space to make sure that nobody can get into those organizations, websites and such, and it's a great tool. It's free, free, free. So no need to go out and pay for those vulnerability scanning services when we can provide those for free. So reach out to the regional offices and CESA would be glad to provide you with that information.

Debra Ruh: 31:51

And I think that's a good place to stop. I know we went over, but you are doing amazing things and I just am very proud of you as an American. So I know a lot of times when we're talking about politics, we think that it has to do with our entire government. That's ridiculous. Our entire government represents people like you that are really making a difference. So, lauren, thank you so much, and Bob, and once again, thank you to Amazon and MyClearText and what we're going to do. We're going to make sure you have all the links. So we're going to make sure you have the links to check out all the different tools that Bob and Lauren mentioned, and we're looking forward to the chat too. So join us on the chat that day as well. Thanks, everybody, thank you.

Lauren Iglehart: 32:34

Thank you.