Si Biles: Friends and enemies. Welcome to the Forensic Focus podcast. Today we have three guests and no Desi. Now this is going to be a wonderful bun fight for conversation, but I will start off by introducing everyone.
We have with the Sophie Powell, one of the co-founders of Cyberwomen Group, Community Interest Company, and we will talk about that in a bit, what that actually means, because I hadn’t heard of it until they set one up, so that’s novel. She was former president and founder of the Cyberwomen at Warwick Group. She’s cyber student of the year of 2023 and she’s in the Tech Women 100, which and I quote, “Showcases remarkable women within the technology sector.”
She was also a finalist for the Diversity Champion Security series on some Heroes Award. And if you weren’t already feeling inadequate, she did all of this while getting a degree in cybersecurity. And the first, I hasten to add, and entering the Cyber 9/12 Strategy Challenge, which we are here to talk about today as part of the team Wicked Cyber in such a persistent way that she’s now part of the management team because I guess that they thought if they couldn’t beat her, they’d better join her.
Next up we have Professor Sarah Morris, no less illustrious background. Professor of Digital Forensics and director of enterprise at the University of Southampton. And as well as being a professor and obviously holding a doctorate in digital forensics, she also has teaching awards from both Southampton and Cranfield University that include best pastoral support, outstanding teaching. I counted three of these. I think there might be another one on the way from Southampton, I may be speaking ahead of it. Technology enhanced learning and also a sensational Supervisor award.
There are at least two baking awards in both suite and savory categories that I found. And you’ve been nominated for every woman in technology in the academic category and Women in Defense. That’s the military kind, not the courtroom kind for those listeners that usually hear me talk about defense in a different way, outstanding contribution. She’s also a TV star having been featured on Killer at the Crime Scene in no less than three episodes that are airing this year, or have aired this year, discussing the implications of digital forensics in various crimes.
Now Rob, I went and did my background research on you as well. So last but not least, we are joined by Rob Black. Rob, I pinched some of this from the Cyber 9/12 site, is Director of the Cyber 9/12 Strategy Challenge. He’s also a lecturer in information activities at Cranfield University at the UK Defense Academy. He teaches on the UK Ministry of Defense’s Cyberspace Operations MSC, and supports the UK’s Defense Cyber, I should have put this in the bigger font, Defense Cyber school, educating senior MOD leaders about warfare and the information age. Now that was next verbatim.
I also went in his LinkedIn profile and found out that he was awarded the gel medal from King’s College London for the most distinguished student, not only for academic proficiency but also in social and athletic activities. We’ll be talking to Rob about his athletic background in detail later on. Also in the slightly interesting twist of fate, I discovered that you were at Lansing College at the same time as I was at my boarding school, and we used to compete, and we shot against Lansing in competition and we beat them, so there.
Rob Black: I’ve still got the scars to be honest, the [inaudible 00:03:28] on my back.
Si Biles: Obviously there was no way on God’s earth I was going to remember any of that if I hadn’t written it all down.
Rob Black: Sorry, can I just also add, I’ve got my a hundred meters swimming, I feel like I need to add an award against these two other illustrious candidates to be honest.
Si Biles: So full Red Dwarf, BSC, Bronze swimming certificate.
Rob Black: Exactly, exactly. I feel like I need to honor that award as well to be honest.
Si Biles: That’s very, very fair. Today, what we’re essentially here to talk about is the Cyber 9/12 strategy challenge. Primarily that was the main thing. Also yes, the creation of, and the association with Cyber 9/12 of the Cyberwomen Group overarching body of Cyberwomen. That made no sense whatsoever, but I’ll carry on anyway.
What we have here is, Rob Black who is an organizer of Cyber 9/12. Sophie, who has been both a seasoned competitor and is now part of the organization team. And Sarah and I have both coached teams. I coached Sarah’s… Coached Sarah’s, I coached Sophie’s. I coached Sarah’s a little bit while they were there. It’s been a long day. So what we’re going to do is we’re going to talk about Cyber 9/12 and we’re going to look at it from all of these perspectives and see why we feel that it adds value, and how it is a wonderful place for multidisciplinary and disparate students to come together and to tackle problems that exist in cyber. Now I will start off and I’ll hand over to Rob, because he’s the cyber 9/12 organizer and he can tell us all about what it is.
Rob Black: Well thanks Si, and thanks for hosting us. I think before I even start on that, I think one of the highlights for me is the fact that we’ve organized this podcast, or you’ve organized this podcast because you’ve all been associated with Cyber 9/12 and you still remain associated with Cyber 9/12.
I think that’s the biggest vote of success and recognition of the value and the impact we’re trying to achieve. Just because we have people who participate either as student, and as coaches, and then they come back and they come back in whatever guys they can, repeat as competitors, come back as coaches again, if they move into academia, or come back as part of the management team and get involved and stuck in to create the competition, make it even bigger and better than the year before.
So what better sign of success for me. It’s an honor to have such a network of people who are willing to support and drive this initiative forward because they see the value in it. I’ll put that up there front because I think that’s really important, because this is why we’re here really.
But the competition itself is a great initiative. Coming from someone who hasn’t necessarily had a background in cyber, I did a law degree, got a bit confused, ended up in the civil service working as a policy analyst, still got a bit more confused, did a range of different things and then discovered the internet and that I could get paid for playing on internet at some point in my career, and that worked out really well.
But I’ve spent some 10, 15 years in cyberspace or working in cyber and I feel like a little bit of an imposter because I’m not necessarily that technically competent. I can’t fix a computer, code doesn’t really make sense to me, in fact, I struggle to understand any of it. Sarah’s testament to that, she can message me code and I have no idea what she’s saying.
But realistically I feel like I’ve made a valuable contribution in whatever role I’ve played and in whatever responsibilities I’ve taken in the jobs I’ve had. That is mainly because we look at cyber geo-strategic or grand strategic or organizational strategic perspective, and think about the, so what’s, of the technological impacts of cyber, rather than just necessarily the technical aspects of the attack.
The competition is basically an opportunity for students to experience in a safe environment, competition environment, dealing with and advising senior government decision makers at the time of a cyber crisis that’s affecting the UK. Here we get them to role play the roles of advisors and they have to give a briefing to seniors in government, who we use as volunteers from industry and government, to give them that advice and guidance as if the attack were happening for real.
It’s a real opportunity for the students to experience what it’s like when the rubber hits the road. They might be studying cyber, they might be studying other degrees, but they’ve come along, they’ve analyzed the scenario and now they’re having to give a briefing on it based on their recommendations and their proposed courses of action.
That’s quite a unique opportunity for the students, they don’t often get to test it at the university courses. But it’s great for the lecturers and I hope as coaches you’ll agree with me, to really add some reality and bring to life some of the topics you’ve been touching on and thinking about in the classroom. You’re now allowing the students to pick it up and play with it in a slightly more competitive environment against other students. That peer enabled learning experience and a safe experimental learning capacity is a really good way for them to test, develop their human-centric skills.
All those complimentary skills that we hear are so missing in cyber, the only thing that’s missing more is the technical skills, but just shortly behind that are these complimentary skills. But too often most of the initiatives in cyberspace, I would argue, are focused solely on the technological aspects, understanding the technical issues. Rather than necessarily thinking about how do you understand technical data, how do you comprehend the so what’s, how do you think about the implications?
What are the key stakeholders need to be involved and engaged? What happens if you take this technical solution and apply it? That might be the solution for the technical attack, but it could lead to the collapse of society or the collapse of certain aspects of the population. So you might not want to implement that even though that’s the ideal technical solution.
The students have to think through, be creative and think around these issues. Then they get experience of briefing these in a short concise way to decision makers, and they get to have that experience of what it’s like to face tough questionings, what it’s like to try and explain complex information in a short space of time. That was in essence the competition aspect of the Cyber 9/12.
Then alongside that, we spend the two days in the finals allowing students to network with, meet with, be inspired by, and be mentored by people who’ve walked the walk in cyber and in a variety of different ways. What we want to do is allow these students the opportunity to connect with, learn from, even ask those silly questions that they’re frightened to ask anyone else because they’ve not had that experience, they’ve not had that opportunity.
But here they are for two days sitting with amongst some great people, some great experiences and they can find out what a career looks like in cyber. They can meet with organizations who are interested in recruiting you. And before you know it, you’ve built that first connection, you’ve built that first ladder onto the early career path. It’s great to see mentors in industry and in government connecting with students, helping them think about their career, seeing them change their career direction, moving into cyber roles or moving into different types of cyber roles as a result of this competition. That for me is the real reward to [inaudible 00:10:12]. I’ll shut up there, because I’ve been talking for way too long already.
Si Biles: Don’t worry. I’m every bit as guilty of that. I’m going to let Sarah and Sophie talk in a minute, but I think that, there’s a wonderful quote that says, “In theory, theory and practice are the same, in practice they really aren’t.” And that’s the wonderful thing about letting people loose on real scenarios, is that everything that we spend years and years teaching, we then drop them in the and let them try and figure it out for themselves. I’m going to say one thing you didn’t mention, it is a very pressured environment. It’s hard to simulate what an incident response is like unless you’re keeping somebody up 24 hours a day. Cyber 9/12 does that in a slightly health and safety questionable way-
Rob Black: Yeah, health and safety compliant, not in a way that we’ve been encouraging anything to date like that, just to make sure.
Si Biles: But there’s a lot that needs to be done in a short period of time and that is a very realistic representation of it. Sophie, you’ve done it three years-
Sophie Powell: I did.
Si Biles: … and then you graduated and now you’re in the real world doing it. Is it a good representation of what you have come to find?
Sophie Powell: I think definitely, yes Si. Especially when you’re in university, they’re never going to ever set you an assignment that’s respond to an incident in that scenario, use your skills to test, put your skills to test. And in a team situation as well, you’ve got to work with people with different strengths, different skills, different ideas, collaborate all of that into something you are happy with and present it. It really pulls in a lot of your different university disciplines and puts them on show very quickly as to your strengths and weaknesses.
Generally I always say it’s one of the best experiences in my university time, because I feel I came out with it learning a lot and every year I went into it I learned more about myself as a person and myself professionally as well and where my strengths were, maybe where I needed to work on for the year. So definitely yes.
Si Biles: No, that’s fantastic. Sarah, you’ve mentored… Actually, how many times have you done it now?
Sarah Morris: Just the once.
Si Biles: It was just the ones. Your team last year was a multidisciplinary team, wasn’t it? So you had some computer science students and you had some-
Sarah Morris: No, they were all techy.
Si Biles: No. They were all computer science?
Sarah Morris: Yeah.
Si Biles: They were all computer science.
Rob Black: We didn’t judge them. Don’t worry about that, Si. We didn’t judge them. We still let them play.
Sarah Morris: Yeah.
Si Biles: No, I think it’s fascinating actually. The way that it came around was that, Wicked cyber and yes, we were brilliant and unquestionably the best team.
Sophie Powell: No doubt.
Si Biles: Mr. Biteside came in a close second. Sarah will disagree and to be fair, they got further than we did in last year, so I really can’t say too much. But we were very dedicated computer science, cyber security people. But some of the other teams that were turning up were very, very disparate skill sets. I remember there was somebody who was doing an anthropology degree in there somewhere. Sarah, did you feel that we were perhaps a little on the back foot by having only computer science or only cyber students?
Sarah Morris: Last year the Mr. Biteside Team, they were fabulous and I love them to bits. But yeah, I think there were parts of it that were definitely a little bit more challenging for them coming from that background. That’s why this year we’ve opened it up and we’ve done a lot more talking with the other departments. This year we’re hoping for two teams and they’re going to be a bit more mixed up, which should be interesting.
Rob Black: Sorry, can I just jump in? Sorry. I guess, separate for the competitive element of the competition, we’ve got two real goals as I see them. One is to work with providing opportunities for those students who are doing cybersecurity degrees, to allow them to see that if they lift their heads up to the strategic issues and the policy issues, they can do other things in cyber governance risk, et cetera.
And we’ve had some great feedback from students who hadn’t really thought about that aspect of a cybersecurity career, because they were deep in technology degrees and then they’ve been enlightened for want of a better word, and chosen a career path that way. That is a real win for us. It’s not that we’re trying to dissuade technical students to do technical career paths at all, it’s just to show them the breadth.
But that’s the other area that I think is really interesting. We try and illuminate the potential exciting opportunities that you can have in cyber even if you don’t come from a cyber degree. We’ve had again, a breadth of students from politics, geography, philosophy, arts, law, who’ve come in, experienced the challenge of the competition and gone, “You know what? This cyber’s really interesting.
This is a career path I could do. I can see me having an interesting career. I can use the critical thinking skills that I’m doing in my degree in history and I comply it here, processing large amounts of data, triaging that, understanding what’s going on, reporting that back to others. That’s as equally valuable in my history degree as it is in a technical degree.” So for us to illuminate other disciplines that they could have a career in cyber or an opportunity in cyber and they can enjoy it, that’s our other goal as well to really enable those opportunities that they don’t otherwise see.
Because when you’re in geography or history, you don’t naturally think there’s a cyber competition, because too often you see it as a capture the flag or a hack the box competition or something like that. You get frightened by the technology, so we try and have a healthy balance. We do find that most of the teams who are very successful are those multidisciplinary teams that can walk the walk technically, but can walk the walk strategically as well. That is designing the cybersecurity leader of the future. That’s what organizations are going to need, people who can communicate at board level with non-technical specialists, but also people who can work with the technical specialists and deliver the objectives they need for the business or the organization.
Sophie Powell: I think there’s an answer for that really as a student as well. I don’t know how you feel about it Si, watching us over the three years. But in our first year we sat there and we saw the scenario and we were like, “The only thing that’s going to fix this is tanks on the streets. We need to get all the military-“
Si Biles: I was wondering if we were going to get that in.
Sophie Powell: Of course. I couldn’t not. “We need to put tanks on the street and we need to pull out all that…” We presented it and the judges were like, “Wow, that’s intense.” We were like, “Yeah, we’ve got to fix this, we’ve got to sort it.” Actually in year three, despite the fact we did get through to the final round, I will still stand there and say the piece that we put together was competently a lot better.
It was more strategic. It took a lot more different views inside. We had a very technical cyber answer, don’t get me wrong, in there somewhere to show our strengths. But at the same time… I hope you agree, you weren’t just sat there going, “Yeah, good guys.” But I feel like we came a long way. We were implementing things that we never really thought about. Laws and history I think we even spoke to in the end or something along those lines. It was a good learning curve for those that are cyber students as well as being multidisciplinary.
Si Biles: There’s a lot of advantage in teaching people to relate to other people. Sarah, you deal with… So you’re on the BFEG, the biometrics, forensics, ethics group. There we go, he says, getting it wrong. Which is largely non-technical as far as I understand the conversations we’ve had about it, sorry to the BFEG that may be listening, or at least they’re largely non-technical in cyber.
There are some forensic experts, but they’re meet space forensics rather than digital space forensics. How do you feel that these communication skills are being… You feel that the communication skills are being enhanced for computer science students to actually deal with this? And is it a realistic scenario for them in your personal experience of dealing with people at that level?
Sarah Morris: We are always going to have the hardcore techies who have absolutely no interest in this kind of thing. And I think this year in particular opening it up, we’ve seen a lot more interest in the broader university than we have in the computer science department. But having said that, those that are interested in the computer science department, like Rob said, there is a need for that skillset, and I think it’s a good skillset to develop and not one that necessarily CyBoK, the Cyber Cody of Knowledge really takes on board in that way in terms of how degrees are presented. It’s nice to give them that opportunity I think.
Si Biles: Yeah. Sophie, there were some… Risk management course was technically not hardcore cyber, but you didn’t have a huge amount of-
Sophie Powell: No, we were highly technical. Everything you gave to us really, if you gave us a cyber issue, we could give you a technical response as to exactly how you should deal with that. But we had no idea if we were presenting to Cobra, who we would need to be talking to alongside almost the role of how it would generally go. We never really got… Because first of all, if you put students in front of an incident response plan like that in real life and say go ahead, it would be a disaster catastrophe. But we would never be in that scenario anyway if it wasn’t for this challenge. And I think it’s somewhere the universities are lacking where this practical element is invaluable really. We learn loads here.
Rob Black: Yeah, and you learn by having fun.
Sophie Powell: Yes. Well, fun.
Rob Black: Of course fun.
Sophie Powell: It’s a brave one rather. No, I joke we had the best time ever.
Si Biles: I was going to say it was-
Rob Black: Putting the tears to one side. We had a lot of fun other than that, didn’t we?
Sophie Powell: I don’t know what you mean.
Si Biles: The final, going to say we did it three years running and obviously Covid got in the way quite a lot being the big C. But last year the finals are held in… They are in BT tower again this year, one of the most iconic landmarks, well it’s certainly one of the most iconic landmarks in London because you can see it from quite some distance. But also probably one of the most iconic-
Rob Black: Even though it was secret for so long.
Si Biles: Even though it was secret. Yes. I’m going to say, we’ll digress briefly on this. For those of you who aren’t British or perhaps haven’t been to London recently, there is this Sodding great tower in the middle of London that you can see from probably about 30 miles away. Partially because it has a large rotating neon sign going round it, at one point he had a rotating restaurant at the top of it.
But because it’s a telecommunications tower, it was actually marked as secret, which meant that although you could see this large tower in the center of London, it didn’t actually appear on any maps. Anyway, this BT tower is the location of the finals. It’s a fantastic facility, both in terms of feeling slightly nauseous as it rotates around and you’ve had too many drinks at the end of the day.
Rob Black: I decided the room wasn’t spinning when we were there, so it was just you I’m afraid.
Si Biles: It was just as bad. Yeah, I found as long as I looked straight out, it was fine. It was just if you looked at the tangent, it kind of got me, especially after three or four glasses of red wine. But it is a wonderful environment where all the students come together and it is that fantastic fun thing. Some of the demos that were there, I went and did lock picking with some of the physical intrusion detection guys and there were plenty of other ongoing workshops and stuff. It is a brilliant learning experience for those that get to go there. And also-
Rob Black: Sorry, can I just jump in and apologies for derailing where you might be going with this, but-
Si Biles: Oh, I don’t know where I’m going with it. Feel free. Carry on.
Rob Black: I mean we talked about the BT Tower as a unique venue, it’s a strategic spot, it’s brilliant. But it also allows a good blend of students and volunteers from industry and government and it would be remiss of me not to mention and thank our sponsors at the moment.
So obviously BT are our strategic partner allowing us to host the event there. But we’ve had some brilliant supporters across the industry from VA systems our platinum sponsors, Beasley, our gold sponsors, I can run down the list Rapid Seven. We’ve got a range of people who’ve been involved, KPMG, over the years we’ve had Standard Chartered, the list goes on and we’ve got some great new sponsors this year.
The reason that’s important is not only do they help enable the competition to take place, but it just shows the breadth of people who are coming in to talk to the students about different types of careers and making things like that happen. Bringing in teams to showcase interesting work. The physical intrusion detection teams or the pen testers. Bring in people who come and talk about open source intelligence with Thomson Reuters Special Services last year for example.
I can’t not highlight that the real magic of the competition is through all of the support of people across industry and government and universities, champions such as yourselves as coaches, who bring the best out the students by enabling this fantastic mix of people to turn up, participate, have fun, and enjoy the competition.
Si Biles: So while we’re on the partners, we’ll take this as an opportunity for a slight shameless plug for two of us at least. Forensic Focus is a partner of the Cyber 9/12 competition, I’ve just checked because it is on the website. Also, I’ve lost the link, Cyberwomen Groups, CIC is also now a strategic partner this year or a partner this year. Sorry, I don’t know what strategic is.
Sophie Powell: Partner this year.
Si Biles: Partner. There aren’t these strategic… Are there strategic? Oh yeah, BT’s a strategic partner. So anyway, Cyberwomen is a partner this year. Sophie, this is a very new venture for you.
Sophie Powell: It is.
Si Biles: Do you want to talk about it because it’s brilliant.
Sophie Powell: Of course. I would love to. Cyber 9/12 are actually our first partner and what a fitting person it would be because I think Jenny and I dedicated half of our university lives the Cyber 9/12 challenge emotionally [inaudible 00:24:36]-
Si Biles: Willingly and with full consent in a positive way. Just clarifying, sounding like home homework now.
Sophie Powell: No, we loved it. Cyberwomen Groups is a very new venture for us. Essentially what we discovered within university is there is a lot of groups out there for women in cyber when you hit the industry, and there’s a lot going on within primary secondary school education, but actually that university part where you are going through probably the biggest stages of your life and the biggest decisions of your life, there was a severe lack of anything that we could join, we could be a part of that really united women feeling the exact same, probably outnumbered on their course by men.
Feeling a bit out of their depth and thinking what’s on earth am I about to do with my career? So along our journey, Jenny and I met so many amazing women, including the ones in Mr. Biteside who were absolutely brilliant and we had great chats, great conversations. There was so many good things going on in the background that just weren’t getting the recognition they deserved.
There was so much happening and so many little things that were communities that were being created, but they had nowhere to be online, they had no brand, no support and no guidance really. So 21 years of age Jenny and I co-founded a Cyberwomen Group, CIC. It is a Community Interest Company, because for anyone who knows anything about a charity, they’re very difficult to set up, especially at 21 and especially with not the manpower.
Essentially what this means, it gives us the way to run a business, to be official, but all our profits have to go to a community-based interest. So every time we have money going out at any point the government can say, “And how is that benefiting the community? Why have you sent it there?” All of our profits, we’re essentially a nonprofit, they all go through all of our branches. And we have set up through, so we have Warwick as our initial founding branch and we also have Coventry and UE currently active and as of tomorrow, but noon and I’m assuming so, I’m not going to edit this and send it out before then.
Si Biles: No chance of it going out before noon. You can say this and this will be old news by the time this eventually goes out. But I’m fascinated, you trailed this at your conference not long ago.
Sophie Powell: Yes.
Si Biles: I’ve been dying to know. So the fact that I get to know before everybody else does actually make my day.
Sophie Powell: Yeah, It’s University of Portsmouth-
Si Biles: Oh, brilliant.
Sophie Powell: Who are coming on board with us.
Rob Black: I feel that’s particularly pertinent in this conversation with some representatives from Southampton sitting here as well. So get your act together Southampton is what I’m going to say.
Si Biles: Yeah. I’m sure it will come around in the near future.
Sophie Powell: Running after them.
Si Biles: Sarah has definitely championed… I know that Sarah has been involved in a number of women in tech things at Southampton already, and therefore I think it’s possibly a reasonably foregone conclusion that sooner or later this will turn up. Sarah, you’ve done a computer science degree, you’ve taught it, you’ve done a PhD. Obviously you didn’t have a Cyberwomen Group to work with.
Sarah Morris: I did not. No.
Si Biles: Is this something that you… I know the answer to this question already so I’m going to ask it anyway, but is this something that you would’ve liked to have had at your disposal?
Sarah Morris: Definitely. For most of my degree was I the only woman in the room and as Sophie said, that that gets lonely. That can be hard. It can add additional pressure and confusion and lead to you be missed out. I think it’s a great idea.
At Southampton, we’ve gone a slightly different route at the moment in preparation for joining up with Sophie. We’ve done a more cyber across the university group for staff and students as a starting point, but more to bring together everyone in all the different schools regardless of ranks that’s interested in cyber as a starting point, and only because it’s a lot of paperwork for us to form a student group. That’s kind of for the next academic year, something that we will be looking to talk to Sophie about getting on board with.
Sophie Powell: That’s great news for me. It feels a bit known that I’m a bit worried.
Si Biles: What you’re seeing at Southampton, and again by extension, so am I, is that actually interdisciplinary is actually really popular-
Rob Black: The future.
Si Biles: We are currently working with medical devices, I know. We’ve certainly work obviously within our own department to a certain degree within… Dennis is who I’m thinking of-
Sarah Morris: Electronics and computing. Yeah, Dennis is a legend.
Si Biles: Electronics… Yeah, Dennis is a legend. Certainly you are reaching out and everybody is very keen to be part of stuff. And Southampton being a enterprise university of which you are a director means that these things aren’t actually only restricted to academic type people within, but actually it’s the idea is to generate real world products. Which again, this is what a lot of academia is missing out on, is we have these wonderful theoretical things, but are we actually necessarily adding real value to the real world? The idea to produce much value as possible from a university is definitely an exciting thing.
Sophie Powell: I think every university coming up, especially the ones we work with now, they’re very individual and they’re very got different aims. All our branches are completely different in what they want to achieve with their time. We’ve got Warwick who are very based on education, getting into schools.
We’ve got Coventry who are completely on the side of CTF, they’re setting up and running their own CTF and they’re like, “Can we do that?” I was like, “Yeah, if you can.” And I think within the space of two weeks they had it set up going. I’m like, “Can we advertise now?” I was like, “Oh, okay. That was fast.”
And I mean Portsmouth and Youi as well are still very much in the process of getting used to us, but there’s so many different people doing so many cool individual things. It is just great to see across all the different universities no matter who you are part of, whether that be us … What Southampton are doing. It’s just great to see generally in the community what great things going on.
Si Biles: Now I’m going to be… No, I’m going to cut you off, so shut up. I’m going to be a slightly controversial interviewer for a change. One of the things you said earlier was that you felt that there was enough, or it’s not that there was enough, but that there was cyber for women in secondary education and then it was the community groups afterwards. But you’re saying that you are going and doing a lot of outreach stuff and I know Sarah’s doing a lot of outreach stuff. Do you think that there is enough outreach stuff for women in-
Sophie Powell: No. Absolutely not.
Rob Black: I think you just got calf to be honest.
Si Biles: No, that’s fine.
Sophie Powell: No. When I say in terms of there stuff going on for secondary schools, there’s not enough outreach. I think that’s a very prominent thing that simply, there are schools still not getting cyber awareness training that I know of.
They’re not covering any element of cyber within their curriculum and they’re watching GCSE computer science numbers drop and they’re wondering why. It’s because they’re not part of things like CyberFirst have to offer, or not part of the schemes and not taking on STEM ambassadors who are offering their time out there. It’s something that really needs to be worked on. We are partnering with STEM ambassadors to make a change there hopefully in the coming future.
But I think I meant more of the fact that they have STEM ambassadors as a company that they can use if you like, but they’re possibly maybe not interacting with them as much as they should.
Universities are more likely to take on people in industry than maybe volunteers on that side. We felt there was a community missing in the university that was a little bit more adult-like, a little bit more career driven, getting together, chatting. That’s the kind of more thing I meant if you know what I mean.
Si Biles: Yeah. No, that’s fair enough.
Sophie Powell: Perfect.
Si Biles: Sarah, the outreach that Southampton, you’ve done in the past and you’re looking at, how do you feel that that’s being taken by… Actually, I was desperately trying to remember some quotes I’ve heard from you or where I read them. But I know that you have gone into schools and that girls have definitely been inspired. I’m going to read a quote actually in a minute for Sophie, which she’s already seen, but I’m going to read it for her again.
But you have inspired girls and they actually do do definitely feel better for seeing genuine role models being able to come and talk to them. I seem to recall something about capes relatively recently, unless I’m very much mistaken. You say it, because I can’t remember the exact quote and I don’t want to get it wrong.
Sarah Morris: I was doing outreach last month in London with a half-term group for disadvantaged kids and some of the students asked if I was a superhero. It was all to do with the brightly colored hair and other bits and it made me cry. It was a group of three girls and it was just so lovely that they were saying they’d never even considered they could do this kind of work, they could catch bad guys, they could do all this stuff. And just 30 minutes, new outlook, it’s amazing. But there just aren’t enough. I am so overbooked with outreach, it’s ridiculous, because there just aren’t enough people going and doing it.
Sophie Powell: Sorry, I’d love to bolster Sarah a bit here because Sarah was possibly one of the women on LinkedIn and online when I first started my cyber career that I found and followed. The fact I’m sitting on a podcast with you now, if you told me this eight years ago, I probably would’ve laughed. There would’ve been no way. But I remember you being one of the pioneer people. I was like, “Well that’s cool. I really like that.” And also doing your talk at the Cyberwomen conference, the amount of feedback we got that was like, “That was so brilliant.”
Sarah Morris: Oh, that was so terrifying and it was completely your fault.
Sophie Powell: You know what, it was one of the best talks we’ve ever held by a mile because it was so royal, it was so true. So from the Cyberwomen community as well, you are absolutely still being a role model in our generation, let alone the younger ones too.
Sarah Morris: Thank you.
Rob Black: I feel like we need a group hug, although I don’t feel like [inaudible 00:35:53].
Si Biles: Absolutely, absolutely. I’m going to throw it for Sarah as well.
Rob Black: I love you too, Si. If that helps.
Si Biles: I love you as well, Rob. But Sarah is hugely inspirational. I mean she’s absolutely brilliant at what she does. Actually, Rob was saying this before you were on, how you are actually a world leading expert in things and this is something that you are absolutely incredible for. But I’m going to just say on the interdisciplinary front. I took my daughter to the last conference.
Sophie met her, but she’s grown up with cyber all around her because she can’t avoid it and she wants to keep eating, so she’s not allowed to say anything negative about it. But I have singularly failed to bring up any children who will follow in my footsteps. I have a lawyer, I have a town planner and my youngest wants to do something far more social and anthropological type stuff.
But I brought her along and she actually wrote this up on Forensic Focus and we’ll put a link in. She wrote up the whole conference. She’s doing English A level, she writes better than I do so. But the final paragraph of this was that she wrote, “The conference was intimate and informative and I fully recommend attending the next one.
Having grown up as a girl interested in STEM, I participated in competitions with predominantly male competitors and judges, as well as talks and workshops that were almost exclusively run by older males. It was quite emotional to see a female heavy conference run and organized by young women in an industry with a balanced audience. It was truly inspiring and I’m so glad that there are organizations like this that exist who are organizing events like this.” Well done, round of applause.
Sophie Powell: Thank you.
Si Biles: But actually Rob, what’s the breakdown for Cyber 9/12? What’s your…
Rob Black: I guess it’s very difficult to being a slightly gray haired, middle-aged at best-
Si Biles: I’ve done my…
Rob Black: In this conversation.
Si Biles: We’re in the same boat.
Sarah Morris: You forgot the beige trousers.
Rob Black: They’re actually orange today. Does that count?
Si Biles: I’m not sure that’s better, Rob. I’ll be honest with you.
Rob Black: I’m in a difficult position, because I’m exactly that person that your daughter wrote about and it’s a bit challenging because I know I’m the problem and that doesn’t feel good. But as an ally and as an enabler, I think there is so much we can do. I’m not criticizing your daughter’s comments. The challenge for us is how do we recognize that and empower? One of the reasons we selected Cyberwomen as one of our partners is because they provide a platform to engage people who wouldn’t otherwise been engaged with us.
We can encourage and inspire by doing what we’re doing. We are very conscious of our accessibility and our diversity efforts and we’re not perfect. I’m not claiming to be perfect at all. But what we do try and ensure is that there are people and individuals from across the spectrum, participating to be role models and mentors. I think that is a huge first step. Then if we add in the activities to engage with our partners such as Cyberwomen pushing the message out to those communities that are wanting to be enabled and those minority groups who could be empowered if the door was unlocked to them, then actually it’s amazing the changes that you see.
I’m really proud of the fact that for Cyber 9/12, we have organically had over the years 50/50 gender split in our competitions. In fact, we’ve had two years where we’ve had all female winning teams. That is unheard of in a cybersecurity competition. But what that is about isn’t about positive discrimination in a negative way. What is about reaching out and inspiring and encouraging people who have that spark, but they just didn’t know there was an opportunity for them.
We reach out to the universities, we don’t just stick to the STEM subjects. Sophie, one of the roles Sophie’s been doing with me in the competition has been communicating to different groups and societies in the universities so we don’t just tread the same path. Because that’s what’s so frustrating, we moan about the lack of diversity in the industry and there are some fantastic trailblazers, and I’ve got two of them in this podcast with us here. But the problem is if we’re fishing from the same pond, we can’t be surprised we’re still catching the same type of fish and the same kinds of thinking.
If we open the door to different communities and bring them to these experiences so they can see the value that they can have and they can bring themselves, they get excited by it, they participate, they share the news, they engage again, and they push the message out. And we get a whole new diverse set of people who by default work into interdisciplinary intergroup, bringing those diverse perspectives, diverse opinions, that critical thinking by default, which is what we need. For me, I would cast myself as an ally. I also realize that I’m part of the problem, because I am a white male in the room pushing these things forward. But actually the more we can enable, the more we can empower.
It should get to the point where we’re having a conversation on a podcast like this that we don’t even need to be conscious about the spread of gender in the podcast or the spread of ethnic background and so on. That’s the utopian goal that we’ve got to get to. I’m not going to stop until we get there. We’ve tried to enable that through gender diversity, ethnic diversity, neurodiversity in the competition.
And now actually, one of the areas we’ve really pushed this year and last year is an access fund for those students. We don’t want any student not to be able to participate because of cost alone. And with the cost of living crisis, traveling to London can be quite expensive. Some of our university competitors have got great support from their universities and that’s down to people like yourself, Simon and Sarah, camping it inside the university to get the university to support them with their costs.
But it isn’t always possible. And if we can help them remove that barrier to entry, no matter what their background, then that means we can enable more people to participate. For me, I really don’t care what the community is that I should be engaging with, ought to be engaging with, I want to make sure we’re engaging with every community to give them the chance to choose to engage. If we can inspire and engage and then we have individuals come back and participate more and more and that’s a win for everyone. So sorry, a bit passionate in terms of I recognize I’m part of the problem, but at the same time I’m hoping to be part of the solution.
Si Biles: That’s it-
Sophie Powell: I think thinking forward, something like Cyber 9/12, which has pretty much being a competitor there, I can vouch for you a 50/50 gender split creating opportunities like you are. I certainly wouldn’t say you are a problem, if anything. So that’s certainly something I would like to address there.
Rob Black: I guess by default I’m a problem because there’s an opportunity cost. Because if I’m standing on the stage introducing the competition, and if I’m standing on the stage, then I’m not allowing an opportunity for other communities to be inspired by a role model that they can associate with more. That’s the balance we’ve got to get to. All the time we are conscious about the fact that there’s a limited number of individuals from that community on the stage in roles and that, that’s what we’ve got to work towards. Ideally if we can get to a diversity blindness in a positive way, that’s the goal to be honest.
Si Biles: Yeah.
Sophie Powell: I’m going to remind you of this when I send you 700 Sophies and Cyberwomen Groups this year, and they’re all going to come at you on social media with all the memes.
Rob Black: I couldn’t keep up with one Sophie on social media, let alone 700 to be honest.
Si Biles: Oh, be prepared.
Rob Black: I need the AI capability, you guys must know someone technically an AI I can use to handle this.
Si Biles: Yes, I’m going to announce our team now, because again, I know this will go out in a few days. But we’re putting together, the Cyberwomen at Warwick Group is putting together a team, name is decided, but I’m not going to announce it yet. I’m going to let them do that on social media. But yes, you are getting four more Sophies coming your way without a shadow of a doubt.
Rob Black: Brilliant. Generally brilliant, because the energy that people like Sophie give off, the enthusiasm is infectious and contagious in a positive way. The psychological trauma is there in some capacity, but we’re accepting that. But yeah, that’s what we want.
One of the things that I wish I could bottle and share with our initiatives is when you come to the BT Tower and you participate in the competition, the energy that the students give off, because they’re interacting, having fun, engaging with the industry, sponsors, governments, champions as well, and the energy across the room. People volunteer because they love participating.
They can step out of their day job. They have a lot of fun talking to enthusiastic people. They then use that as a SIF criteria for their graduate recruitment, because they want proactive can-do, enthusiastic, willing… Who wouldn’t employ students like Sophie? That’s a great coup to get access to them without having to do any churning across CVs.
Si Biles: I’m going to say, Sarah, I hope you’ll back me up on this one, but I think the truth of this competition for all participants, whether it’s coaches, mentors, the sponsors or the competitors, is actually you get out of it as much as you put in. I’ve seen… Sarah is a… You are a very, very engaged coach, you were a very engaged mentor.
I know you’ve had meetings with your team already. I saw you last year with your team and there’s some lovely photos of you all and you obviously clearly a very close-knit community and it is absolutely wonderful. But there were some other mentors who were not as engaged with their team and not giving as much, and they, I feel, lost out. Would you agree?
Sarah Morris: Yeah, I think it’s completely, if you’re going there, you’re there to support the students. I do it because I love the students, and they were wonderful. Even at two o’clock in the morning when they were very stressed and I was just bringing in bags of snacks. But yeah, lovely guys.
Si Biles: Yeah, Sophie, again, you saw other teams, there were one or two that perhaps didn’t put their all all into it. Do you feel that they didn’t get as much out of it as you did? I mean you put everything into it. I mean everything into it.
Rob Black: Yeah.
Sophie Powell: Yeah. I think it’s one of those types of competitions that you can’t go in and think, “Yeah, I’ll do this for half a day and I’ll enter and I’ll kind of think about starting it the day before.” It’s an opportunity. If you don’t grab it, you don’t get as much out of it.
Generally Wicked cyber, we were friends anyway. Si, I think we found you in first year when we were just little freshers and you came with us the whole way. So by year three we were a very connected team, we knew each other well. You could see the teams that maybe, not even didn’t know each other well, just maybe wasn’t for them, maybe hadn’t quite realized the extent of the competition. It’s a shame because it offers so much and there is so much to be learned there and experienced there. And you have your soul ripped out there. No, I’m joking.
Rob Black: That’s a T-shirt we need, Cyber 9/12, ripping your soul out every day.
Si Biles: Ripping your soul out. In which case we are… I can talk to you guys forever, I genuinely could its absolutely wonderful. But we generally can’t have a podcast at about an hour.
Rob Black: We can’t leave it on that last quote, otherwise I’m in trouble.
Si Biles: No, I’ll save you Rob. By the time this goes out, it will be unlikely that competitors will be able to participate this year if they’ve not heard of it before.
Rob Black: December the 15th is the deadline, so that’s where we’ve got student teams to apply. I don’t know what timescales, we might be releasing this, but that’s not putting you on printed, just clarifying for students.
Si Biles: I’m just going to say, I can’t release it until after midday tomorrow minimum, because Sophie needs to get her announcement out first. We’ll try and get it out in enough time that there’ll be two weeks left. It will be tight for you, but you should be able to do something with about two weeks.
Rob Black: The application process isn’t that arduous. Actually, there’s a few questions we ask you to fill in 500 word answers. The key thing for me would be, think about who your team should be. You have to have a coach from a university. Work with your lecturer community to find out who would be willing to take that role.
As Si and Sarah have highlighted, being a coach, you can have engaged coaches, you can have slightly less engaged coaches, people are busy, understand that, but work with your coach in the way to work out the relationship you want as well. Then you can start it being a learning opportunity from the moment you form as a team rather than just when you arrive at the finals [inaudible 00:48:37].
Si Biles: Sophie, what’s your advice for teams wanting to get and do this? What would your starting recommendation be?
Sophie Powell: Absolutely do it. Without a shadow of a doubt. I think jokes aside, I will always stand and say it was easily one of the best things that I ever did in university. Hence, I’ve come back for more this year. Mainly one of the pieces of advice I would give is, choose your team wisely, choose your coach wisely and if you’re going to do it, give it your all.
Because you can walk out of there and brimming with opportunities, new career paths even, things to think about. And act on those two because the Cyber 9/12 team stay active throughout the year, so if you’ve made a connection, reach out to them, we’ll still be here to chat and foster those connections throughout the year too. So do it.
Si Biles: Sarah, what do you wish I’d told you last year before you started this?
Sarah Morris: I guess ask for money from the uni pretty early on, because that process takes forever, and book a hotel in London pretty quick.
Si Biles: I had my room. Last year my room was confirmed by the university… What was it? It was about an hour before I got off the train.
Sarah Morris: It was the hour before you actually got-
Si Biles: Not got on the train, got off the train in London.
Sophie Powell: I was fighting for about three days straight on email to get you that room.
Si Biles: Yeah. So yes, get your money sorted out up front.
Rob Black: But isn’t that interesting? I know we talked about the access fund and I’m not trying to derail this. I know we’re going to wrap up soon. Isn’t that interesting? Yeah, we’ve talked about diversity, we’ve talked about championing, inspiring that, the biggest headache we’ve all talked about is the admin process to allow this to happen. Once people have said yes, let’s make this happen. That’s where we’ve got to be better at. To be honest.
That’s why the access fund for me is really important. I don’t care if it’s males, females, white, British, Asian people, I don’t care. If you need to access this competition and you are struggling, that’s what we can enable with and that’s what we should be enabling. Because that’s the worst statistic I think out of anything, is that we’ve got people who are willing and interested to do it and computer says no, or system says no or process says no. That’s what we need to remove.
Si Biles: Yeah, absolutely. Couldn’t agree more. Well thank you so much for coming on. Is there any… Rob, you are going to say, if you want to say something, I know this without a shadow doubt. So let’s open the floor to Rob, give him a chance and then we’ll go to everybody else to wrap up.
Rob Black: I was just going to say it’s great to have some fantastic co speakers on this podcast. The reason I say that is because I think we are highlighting the value of the competition in a variety of different ways that we can participate and engage, and I really do hope people just take the opportunity and give it a go.
I’m really proud of what the team have developed over here and the competition, but I’m actually really proud of the participants and the people who give up their time to support that, whether they be in industry, government, or in universities as lecturers to make it as successful and as enjoyable for all. It’s a really good thing to be involved in and I hope that people who do participate and get involved, have the same experience that people like Sophie have. That’s what our goal is.
Si Biles: Brilliant. Sarah, your wrap up comments for the day?
Sarah Morris: Just that it’s about more than the competition itself, the workshops, the networking, the whole experience is amazing. So if you get the chance, go for it.
Si Biles: Brilliant, Sophie?
Sophie Powell: I think my wrap up, I’ve drained all about how much I love Cyber 9/12, but also it makes you learn a lot about yourself in the process. You learn a lot about yourself professionally, personally, your strengths, your weaknesses, but it also brings you to appreciate the smaller things in life such as lecturers as Si, who would dedicate three years of his life to lecturing people like us. And putting us through Cyber 9/12 challenges and still coming out exactly the same person.
Rob Black: No, that needs an award.
Sophie Powell: Exactly. Actually, that type of thing for a student is really under appreciated. That lecturers’ dedication to this makes such a big deal and Wicked cyber would not have been able to have done it without you. So thank you.
Rob Black: My pleasure.
Sophie Powell: Appreciate your lecturers and go and do it and have fun, because it is a brilliant experience.
Si Biles: Wonderful. Thank you very much, it’s very kind. So listeners, I told you at the beginning of this that I would not have a wrap up planned or written. But you can find this podcast on all good podcasts sources like Spotify and the Apple thing and wherever else you might. We also are on YouTube and also on the Forensic Focus website. Do come over.
There’s plenty of good interviews that we’ve done previously. Sarah is an alumni. We have a fantastic interview, actually, one of very, very popular, it’s gone very well interview with her and I honestly hope that we will have both Rob and Sophie back on various topics in future. Sophie, again, like you Rob, I don’t think Sophie will let me get away without getting women in cyber publicity going at every available opportunity.
Sophie Powell: I’m so glad we established that now.
Si Biles: So for everybody who’s listening, thank very much for coming along and joining us today. I hope you’ve enjoyed it as much as I have, because genuinely I’ve had a laugh. Take care of yourselves. Until next time. I will stop the recording now and we will talk to you all later. Bye
