Requirements for a Platform that Improves the Number of Young Women Entering Cybersecurity

The cybersecurity workforce is male-dominated, where females only make 11% of the cybersecurity workforce. There is, therefore, a need to encourage females to enter cybersecurity to promote a diverse and multiskilled workforce. The research aimed at promoting this by testing the hypothesis that increasing the visibility of female cybersecurity roles models would inspire young females to consider careers in cybersecurity, subsequently, the research also aimed to identify the requirements for a platform that will provide single-point access to the role model’s career stories and related motivational features


INTRODUCTION
From a young age, children pick up on social cues and expectations about socially appropriate behaviours concerning gender. Stereotypes such as girls play with 'feminine' toys e.g., dolls, and boys play with 'masculine' toys e.g., cars are implicitly taught to children (Boe and Woods, 2018). Gender roles and stereotypes are also present in everyday content such as TV adverts, the harmful type of adverts have only recently been challenged and banned in the UK (Lucka et al., 2021). Stereotyping promotes doubt causing young ones to second guess their suitability in careers dominated by the other sex (Matheus and Quinn, 2017). There is a need to embrace female talent and to produce a more diverse workforce which will increase creativity and productivity. Workforce diversity correlates to increasing productivity because a gender-inclusive organisation significantly outperformed a male-only organisation by 26% as women bring different abilities to the industry (Peacock and Irons, 2017). Despite these positives, a study by Kaspersky found that identified that 78% of young women have never considered a career in cybersecurity, and the lack of female role models was viewed as a key contributing factor (Cortez, 2017). Role models are individuals who are examples of potential accomplishment and success, often serving as behaviour templates (Quimby and Santis, 2006). The advantages of having females inspire others are evident as it has been found that females are more likely to be inspired by gender-matched role models than men are (Lockwood, 2006). Based on this understanding, the research was driven by the hypothesis that increasing the visibility of female cybersecurity role models would inspire young females to a career in cybersecurity. A platform where the role model's career stories and related motivational features are openly accessible would serve as the vehicle for visibility; this, in turn, motivated the research question: What are the requirements for the design of a platform that uses female cybersecurity role models to inspire girls to join the industry?

RELATED WORK
The need to motivate females into joining cybersecurity is steadily on the rise where various approaches and initiatives have been proposed from both academia and non-academic sources. Dampier et al. (2012) reports on a programme at the Mississippi State University that aims at changing girls' attitudes to cybersecurity by engaging them at three different stages of their education. Rowland et al. (2018) discusses CybHER, a five interventions model that educates, motivates, and encourages girls to cybersecurity career paths. Role models are considered in intervention 2 -the use of 30 to 40minute inspiration videos. Berríos (2019) aimed to inspire young under-represented groups of women in cybersecurity by providing talks and exercises to junior and high school girls.
The difference between these studies and initiatives to our approach is three-fold. 1: The studies are implementer-led, while we aim at independent ubiquitous access to content. 2: They are training (programme) focussed, while we purely aim to spark inspiration at an early age. 3: Other than the videos by Rowland and colleagues, role models haven't been considered nor are they the key drivers of change.

APPROACH
This section details the two data elicitation exercises that were conducted to elicit platform requirements.

Student Focus Groups
The first elicitation exercise aimed to inform the platform's design requirements. This consisted of three face-to-face focus groups with female students aged from 16 to 20 from a public school in England identified through staff acquaintances. Each focus group had four participants and took about one hour, where the first few minutes introduced the research, followed by introductory questions and finally an open discussion. Each session was recorded and later transcribed. Questions included: • Have you considered a career in cybersecurity? And why to the answer.
• What are your thoughts, feeling and associations that come to mind when you think of women in cybersecurity?
• Are you aware of any renowned women in cybersecurity?
• In your personal opinion -if you could change one thing within the cybersecurity industry what would it be?
• Are there activities available to you which motivate you into a career in cybersecurity e.g., through school?
• Based on the discussion, what form should the platform take? E.g. mobile app, website etc.
• Based on the discussion, what features/content would you like to see on the platform?

Industry leader Interviews
The second elicitation exercise aimed to contribute to the platform's initial contents (prototype). These were semi-structured interviews with female cybersecurity industry leaders identified through acquaintances and online searches. Interviews were conducted online, they were approximately an hour long and were recorded and transcribed. Interview questions were derived from the findings of the focus groups.
Interviews were with Dr Andrea Cullen, Lynn Dohm, and Chloé Messdaghi. The women are industry leaders because they have decades of experience and multiple awards. Dr Cullen has over 25 years of experience in technology and she is one of the co-founders of 'CAPSLOCK'. Lynn is the executive director of women in cybersecurity (WiCyS) and has also been named one of the Top 100 women in cybersecurity by Cyber Defence Magazine. Chloé is the co-founder of 'We Open Tech', has been awarded the Cybersecurity advocate of the year, and was honoured by Business Insider as one of the fifty cybersecurity power players.

ANALYSIS
A qualitative approach was used to analyse the data from the focus groups. The first step was to understand the students' requirements based on the sentiments (themes) expressed in the groups (Braun and Clarke, 2006), then to group similar sentiments and sort them by importance using MoSCoW requirements prioritisation. Importance was determined by 1. recurrence of the sentiment in the data corpus and 2. the sentiment's relation to platform functionality (functional requirements).

Summarising Sentiments
The students generally said they had thought of a career in cybersecurity but not to a serious extent and didn't feel it is feminine. A student commented that her family encouraged her toward careers such as beauty therapy and child care so cybersecurity was never a thought.
The students did not know renowned female cybersecurity leaders. They agreed that role models would encourage them to enter the industry. sentiments expressed included "I then have someone I can look up to and aspire to become them" and "if she can become a leader in a maledominated field so can I".
While examples such as CyberFirst were given (www.ncsc.gov.uk/cyberfirst/girls-competition), it was found that the students had not heard of schemes, programmes or tools that would encourage/help them join cybersecurity.

Summarising Requirements
The consensus was that a website was the most appropriate form the platform should take. We sorted platform requirements according to the two themes below: Career story features: role models' stories, challenges the role models overcame, advice to girls, information if the role models had an interest in cybersecurity from childhood, information on what it is like being a woman in cybersecurity in present times, academic steps the role models took and if the role models had role models.
Related motivational features: blog, messaging board/forum, an ability to ask questions, a job/apprenticeship board, paths to cybersecurity girls could take, monthly newsletters, virtual career fairs, and a calendar of different women in cyber events.

Prototype Design
To test the validity of the elicited requirements, a prototype was designed using the "Must Have" requirements based on MoSCoW prioritisation described in Section 4. The prototype was coded using HTML and CSS and the content was populated according to the responses from the three female industry leaders described in Section 3.2.
Below, we detail the Must Have requirements and how they were implemented in the prototype.
• Role models story -The role models' stories were included under their profile pages.
• What it is like being a woman in cybersecurity in present times -The responses to this question were included in the role model's stories.
• Challenges the role models' have had to overcome -This was included in the role models' stories.
• Did the role models have an interest in cybersecurity from childhood -This was included in the role models' stories.
• The academic steps the role models took -This was included in the role models' stories.
• If role models had role models -This was included in the role models' stories.
• Role models' advise students -The role models' advice to students was included under their profile pages.
• Communicate with role models -Each of the role models has their social media links included so that girls can directly communicate with them.
• Different pathways students can take -This was implemented on a dedicated page.
• Ability to ask Questions -This was implemented on a dedicated page. Previous questions were also visible to the user.
• Blog -A blog was implemented onto the website which contained basic information about the cybersecurity field.
Due to page limitations, we do not present the prototype but highlight notable feedback from the interviews with the industry leaders which was included on their profiles on the prototype.

Did you have an interest in cybersecurity when you were young? I didn't have interest when I was young, I came into the industry unintentionally -Lynn
When did your interest in cybersecurity start? I fell into cybersecurity by accident and most people who are marginalised would probably admit to that -Chloé What were your thoughts before entering the sector and what are they now? It felt like a boys club and cyber was available for tech boys. felt isolated didn't fit in. However, the more you work, the more you find groups that are supportive and diverse -Andrea

In your own opinion, what is it like being a woman in cybersecurity in present times?
I'm seeing changes around awareness of women in cyber. A lot of work to do, but change is happening -Lynn

Do you have a female role model you could look up to?
No cyber role models, but my mum always said to me at a young age that it is possible to do anything, being a woman shouldn't hold you back -Andrea

Do you have advice for young girls going into the industry?
Find mentors of the same gender as you, stand up for yourself, network, be brave -Chloé

Prototype Evaluation
Two focus group sessions were conducted to evaluate the prototype. The first was with a group of students who originally provided the requirements, and the second, a control group who were not involved in providing requirements. This group was made of six female students aged from 16 to 20.
Feedback on the effectiveness of the prototype to motivate girls into cybersecurity was generally positive. All suggestions (described below) are related to design and not the content. Aesthetically, it is worth noting that the girls preferred neutral colours.
• Implement a way girls can network with fellow students and the role models on the platform.
• Have more interactive diagrams.
• Include a page dedicated to inspirational quotes.
• Include videos instead of limiting contents to words.
• Have a single landing page for all the role models.

CONCLUSION AND FUTURE WORK
This research was motivated to reduce the low number of young women entering cybersecurity by specifying requirements for a platform that will aid in motivating girls. Related work indicates that there are many approaches and initiatives aiming to increase the number of young women entering cybersecurity, but our approach is novel based on its focus on female industrial leaders as role models, open accessibility that is not attached to a programme, and most importantly, focusing on inspiring before training.
While a prototype was designed, the main contributions of the research are in the research process and the specified requirements (career story and related motivational features). This is based on the understanding that our platform might not inspire girls from different ethnicities or communities as relatable role models are required, thus the need to adopt the requirements to develop platforms that suit respective communities.
Limitations to the work include that the students were from one school and that we only tested the validity of the requirements using a minimum viable product. Understanding whether the students were truly inspired will also require a long-term study where their educational or career choices are assessed.