A Primer on Neurodiversity in Cybersecurity

You may have noticed a groundswell of dialogue lately around the topic of neurodiversity. If you’re wondering what, exactly, that means, and how to talk about it, we’re here to help.

On May 12, SANS will host our first-ever Neurodiversity in Cybersecurity Summit. The Summit is Live Online and is free to attend.

Working Definitions

Neurodiversity is a broad term which refers to differences in processing and cognition found in people who are on the autism spectrum, have ADHD, dyslexia, dyscalculia, and/or Tourette Syndrome, for example. This list is not exhaustive, and a neurodivergent individual may have a single form of neurodiversity, or several in combination. “ND” is often used as shorthand for “neurodiversity” or “neurodivergent.”

• Autism spectrum disorder (ASD), sometimes simply referred to as autism, is defined by the Autistic Self Advocacy Network (ASAN) as “a developmental disability that affects how we experience the world around us…Every autistic person experiences autism differently, but there are some things that many of us have in common.” Those things include struggles with executive function; strict adherence to routines; extra sensitivity to sensory input like bright lights, ambient noise, or smells; being uncomfortable with eye contact; or difficulty interpreting nonverbal conversational cues like facial expressions or body language.
• Attention-deficit/hyperactivity disorder (ADHD) is marked by an ongoing pattern of inattention and/or hyperactivity-impulsivity that interferes with functioning or development, according to the National Institute of Mental Health. People with ADHD may experience any combination of symptoms of inattention, like having difficulty being organized or staying on task; hyperactivity, like fidgeting or excessive talking; and/or impulsivity, like interrupting conversations or inability to delay gratification.
• Neurotypical (NT) refers to individuals whose brain function, sensory processing, and behavior are what is considered typical, not characterized by any neurodivergent condition.
• Dyslexia, according to the International Dyslexia Association, “Dyslexia refers to a cluster of symptoms, that results in people having difficulties with specific language skills, particularly reading.” Dyslexia can also impact oral language skills, like pronunciation of words.
• Dycalculia, as defined by the National Center for Learning Disabilities, is a learning difficulty that affects an individual’s ability to do basic arithmetic such as addition, subtraction, multiplication and division. Adults with dyscalculia often take longer when working with numbers and may be more prone to making mistakes in calculations.
• Tourette Syndrome (TS) is characterized by tics, or involuntary, repetitive movements and vocalizations. “TS is a neurodivergent identity in its own right, but also commonly co-occurs with ADHD and OCD,” points out Nancy Doyle in a June 2021 article for Forbes.

How is This a Cybersecurity Topic?

There are something like 500,000 to 700,000 vacant cybersecurity jobs, depending who’s doing the estimating. And, although estimates vary here as well, somewhere from 60% to 80% of adults with ASD are unemployed or underemployed. And, as Camille Stewart has often reminded us, cybersecurity is national security. So while employers are struggling to fill roles, there are thousands of neurodivergent professionals whose talents aren’t being tapped, just because they may not communicate, socialize, or behave in the typically expected ways. This Summit is just one small way to close the gap between ND cybersecurity practitioners and the organizations who desperately need their skills. Corporations like Microsoft and Google are devoting efforts to employ neurodivergent individuals, as are government agencies.

What Barriers Still Exist?

Pete Jarett, a UK-based educator and neurodiversity advocate who will be speaking at the Summit, wrote a great piece on neurodiversity and operating systems. We need to help employers understand the benefits of hiring people who are capable and talented, but are just using different software to get the job done. The International Dyslexia Association says, “dyslexia is a neurological condition caused by a different wiring of the brain.” Not faulty wiring, just different wiring.

But neurodivergent people are often casualties of people’s preconceived notions of what “normal” looks like. On her blog, The Real STEM Sadie, Sadie Gauthier, who is neurodivergent and has four rare chronic illnesses, posts about “not being disabled enough,” where neurotypical bosses and colleagues view ability as a binary trait, judging her on her healthy days and not understanding when she was unwell or unable to complete tasks she’d done well on other occasions. And it’s likely every autistic person has been told, at some point, “You don’t look autistic!”

It’s also important to remember that neurodiversity is just one part of someone’s identify. As ASAN points out on their website, “...autistic people are people of color. Autistic people are immigrants. Autistic people are a part of every religion, every income level, and every age group. Autistic people are women. Autistic people are queer, and autistic people are trans. Autistic people are often many of these things at once.”

In his memoir Look Me in the Eye: My Life with Asperger’s, John Elder Robison describes his challenges with conversation.

I am tongue-tied when approaching people unless they speak to me first. If I do speak up, I often say something that’s rude or surprising… My conversational difficulties highlight a problem [those with ASD] face every day. A person with an obvious disability – for example, someone in a wheelchair – is treated compassionately because his handicap is obvious. No one turns to a guy in a wheelchair and says, “Quick! Let’s run across the street!” And when he can’t run across the street, no one says, “What’s his problem?” They offer to help him across the street. With me, though, there is no external sign that I am conversationally handicapped. So folks hear some conversational misstep and say, “What an arrogant jerk!”

To hear much more from neurodivergent professionals in their own words, join us for the Summit on May 12. If you are a neurodivergent person in cybersecurity and want to expand your network, check out:

What did I miss or get wrong?  SummitSpeakers@sans.org for feedback!