“We’ve each learned to be delighted with what we are. The Vulcans learned that centuries before we did.”
“It is basic to the Vulcan philosophy, sir. The combination of a number of things to make existence worthwhile.”
-Kirk and Spock in Star Trek’s “The Savage Curtain” on the subject of Infinite Diversity In Infinite Combination (aka IDIC)
I am not a medical professional and don’t pretend to be, but I was asked a question recently by SC Magazine’s Kate O’Flaherty who then did an excellent piece on neurodiversity. I love that she addressed this topic, and I think it’s important to continue to drive the conversation and advance the discussion around it. Let’s start with a simple definition before diving into why this matters for cybersecurity (and potentially others).
Humanity can be categorized, classified and analyzed using many taxonomies, including gender identity, age, nationality, ethnicity, religious beliefs, political perspectives and much more. Neurodiversity is where neurological differences are perceived and respected as another spectrum of diversity and not as a handicap or weakness. This includes something as simple as how we think differently from one another as for example with visual versus numeric or auditory learners; but also and more controversially to radically different cognitive models that are traditionally labeled “disorders” like Autism, ADHD or Tourette’s Syndrome.
Temple Grandin has most famously been an advocate for neurodiversity speaking as someone on the autism spectrum speaking about autism. One of her talks focuses on the strengths those with autism often bring to some tasks requiring focus on attention to detail and concern for minutiae and even her concern that there aren’t enough people who think this way in critical jobs.
Let’s make this real for cybersecurity though, and I invite criticism here and discussion. How does this potentially affect or even help cyber?
As with any industry, cybersecurity should reflect the society around it. We want a level playing field and opportunities with as few unfair biases as possible for everyone. If we are truly encouraging a new generation of cyber professionals with an even hand, if we are fair in our hiring practices and if we are neutral with respect to bias, it should be reflected in statistically similar demographics inside and out. Getting this wrong is not a sin because there are many factors, but hitting this goal is still ideal.
Selfishly, however, diversity makes us stronger. In cybersecurity, we work at machine speeds on data to save people and systems from disaster. A brave few people stare at screens and venture into investigations based on intuition while under a tidal wave of data. The discipline demands two clear things. First, we have to understand the opponents, who have no bias or constraint on diversity. We need to have people who can think like the opponent to understand and get ahead of them. Attackers will hire the most talented, regardless of where they fall on neurodiversity spectra, and it behooves us to bring into our operations centers and security practices people who think in the same manner as the enemy. How will we understand those who employ neurodiversity if we don’t have experience with it and live with it ourselves?
Second, we need people that look for patterns, study and intuit in as many ways as possible. We have such a mountain of data to go through that we can’t all look for patterns in the same way. Finding the needle in a mountain of needles demands every approach we can find and then refine. Neurodiversity brings us this variance in Human cognition and maximizes the way we find things and hypothesize. We have to get really good at processing massive quantities of data, right now, in real-time because we are in a competitive race. Having different, concurrent approaches to problems and some of the unique abilities to spot patterns can make the difference between winning and losing.
In other words, neurodiversity isn’t just political correctness; neurodiversity is a competitive advantage.
The biggest issues are cultural here. Much as Michael Lewis demonstrated in Moneyball, we have a habit of looking at others like ourselves in all industries. We think we know what good looks like, and it biases us. For example, people with Tourette’s Syndrome don’t fit either the classic professional mould or the traditional Mr. Robot hacker perception of the general public. Even when we have diverse teams, there are real problems with working as a team and having to find new ways to manage people, new ways to collaborate and new ways to motivate. People with ADHD aren’t motivated the same way as those without.
The myths are many, both about neurodiversity as a whole and about specific neurological variations, from emotional issues and not being able to operate under stress to incompetency and fear about contagion. The vast majority of these are more about ignorance, prejudice and generalization on the part of the mainstream rather than about those with variance labeled disorders. The medical connotations, perhaps, are what make people think there is something wrong with the neurodiverse. As a habit of thought, consider replacing any statement about them with another Human variance label. We have learned to see those with different gender identities, different colored skin, different languages, different religious headgear as valuable and enriching of our cultures. At some point in history, these too suffered the same labels we put on the neurodiverse; and likewise we need to overcome them even though they don’t meet our eyes directly when they talk to us or they might change topics mid-conversation or even might jump around tasks: they can perform, they can excel and they can make a difference.
I have friends and family on various neurodiverse spectra (and there are many), and they uniformly enrich my life at work and at home. So what can we do about it? Start doing it. Hire them. Integrate them. Spend the time to understand them and to work with them, and beware of the biases personally and organizationally that are stacked against them. Familiarity makes the differences fade.
Lean into this one folks.