Leadership Moment: DEI is in dire straits
Bill Ackman called out Harvard lackadaisical approach to antisemitism (again), and a notably component is his assertion that “Harvard’s Office of Equity, Diversity, Inclusion and Belonging is an important contributing factor to the problem.” I doubt this surprises anyone who isn’t in an identity group that DEI offices target for support. A list of all the ways DEI went wrong could take volumes. Instead, here’s a quick handbook for doing DEI “right.”
First, recognize that “Diversity” and “Equity” are secondary markers. If you don’t have enough members from group X or folks from group X aren’t compensated/promoted at comparable rates, those are indicators that you have problems. But any approach which is “do things to just fix that metric” is problematic in two ways. Just papering over an existing problem – by hiding the bad outcomes – doesn’t make the problem go away, it just hides it from you (but not from the members of group X, who will totally still notice the underlying problem). And if you’re just fixing the metric, you’re likely to do unfair things to put a finger on the scale for group X – which everyone will notice.
Second, recognize that Inclusion activities need to be both broader and more specific. Everyone should feel included; this isn’t a zero-sum game. Being more inclusive to group X doesn’t require you to be less inclusive to group Y. But it isn’t enough to say “hey, we’re inclusive!” You need to identify specific ways that your practices might be pushing away groups of people, and modify them.
One Minute Pro Tip: Fix Your Pipeline
A common dispute around adverse impacts in hiring is whether it’s a pipeline problem (“I can’t hire an X if there are no qualified X applicants”) or a discrimination problem (“You can’t hire an X because you’re discriminating against X”). The answer is … yes. Embrace the power of AND. “Pipeline” isn’t some magical environmental thing you can’t affect. While it does include societal effects, for most organizations, your choices around hiring have more impact.
Instrument your pipeline. When you post a job, what does the applicant set look like? If you’re hiring technical staff, look at the graduation demographics of the relevant degree program at a nearby university. If it’s been graduating X at a rate higher than X candidate even apply to your position, then your marketing is a problem: look at the wording of your job descriptions, the overly broad requirements, and where it’s posted. You might find a lot to improve just there.
Appearances
Recent Appearances
Oct 27: SANS Cyber Solutions Fest, How to Size up Your Cloud Security Program
Nov 1: The Future of AppSec: From Chaos to Maturity
Future appearances
Nov 9: It’s All About Scale: Designing SOC and IR capabilities for the long term, SecOps Vision
Nov 10-12: Frankfurt, Germany
Nov 14: Defense vs Resilience: A Secops Dilemma, Hunters Con
Nov 15: How to Build and Measure a Corporate Security Program, CERIAS Seminar Series
Dec 8: Cyber Security Headlines in Review
Dec 11-13: CyberMarketingCon (Two talks: Stop Destroying Value, and 9 Answers Your CISO Prospect Needs)