Issues surrounding security tools for software developers

For software programmers, security tools are analytic software that can scan or run their code to expose vulnerabilities long before the software goes to market. But these tools can have shortcomings, and programmers don't always use them. New research from National Science Foundation-funded computer science researcher Emerson Murphy-Hill and his colleagues tackles three different aspects of the issue.

"Our work is focused on understanding the developers who are trying to identify security vulnerabilities in their code, and how they use (or don't use) tools that can help them find those vulnerabilities," says Murphy-Hill, an associate professor of computer science at NC State University. "The one thing that ties all of our work together is that we want to help give programmers the best possible tools and help them use those tools effectively."

In the first of three related papers being presented next week at the Symposium on the Foundations of Software Engineering, a team of computer science and psychology researchers from NC State and Microsoft Research surveyed more than 250 developers on their experiences with security tools. The goal was to determine what influences a developer's use of these tools -- and the findings were somewhat surprising.

For one thing, developers who said they worked on products in which security was important were not much more likely to use security tools than other programmers.

Instead, "the two things that were most strongly associated with using security tools were peer influence and corporate culture," Murphy-Hill says. Specifically, people who said they had seen what others do with security tools, and people whose bosses expected them to use security tools, were most likely to take advantage of the tools.

"This research gives software development companies and managers information they can use to effectively influence the adoption of security tools by developers," Murphy-Hill says.

But these tools aren't completely accurate. For example, they can tell programmers there's a problem where no problem actually exists. And the tools aren't always user-friendly. In short, the characteristics of the tools themselves can affect whether programmers choose to use them.

To shed light on how security tools support developers in diagnosing potential vulnerabilities, Murphy-Hill's team and collaborators from the University of North Carolina at Charlotte devised a separate study, effectively asking: do tools give developers the information they need to determine if there's a real problem and how to fix it?

In this study, the researchers gave 10 developers of varying backgrounds a specific security tool and a substantial chunk of open-source code to examine. The code contained known security vulnerabilities, which were identified by the security tool. Each of the study participants was asked to use the tool, inspect the source code, and say whether each security notification from the tool was real and how they would address the vulnerabilities.

"In many cases, the tool presented multiple possible fixes for a problem, but didn't give programmers much information about the relevant advantages and disadvantages of each fix," Murphy-Hill says. "We found that this made it difficult for programmers to select the best course of action."

The tool would also give developers multiple notifications that seemed to be related to each other -- but the notifications didn't give developers information on exactly how the problems related to each other.

"This can be confusing for programmers, and lead to problems if developers don't fully understand how various problems are related to each other or how potential fixes might affect the overall code," Murphy-Hill says.

"More research is needed to really flesh these findings out -- we need to expand this study to incorporate more programmers and more security tools," Murphy-Hill says. "But overall, we're hoping that this and related work can help programmers create more effective tools for use by the software development community."

One concept that Murphy-Hill and colleagues from NC State propose in a third paper is the idea of "bespoke" tools. The basic idea is to create tools that developers use -- including security tools -- that are capable of evolving over time as they are used, adapting to each programmer's particular areas of expertise.

"For example, programmers with expertise in addressing security vulnerabilities won't need a security tool that offers extensive information on all of the potential fixes for a given vulnerability -- wading through that might slow them down," Murphy-Hill says. "So a bespoke tool might learn to offer only basic information about potential fixes for them. But the tool could also recognize that it needs to leave in that additional information for less security-savvy programmers, who may need it to make informed decisions."

These bespoke tools could learn about a programmer's strengths through both the programmer's interactions with the tool and by analyzing the programmer's code itself, Murphy-Hill says.

The Symposium on the Foundations of Software Engineering is being held Aug. 30 to Sept. 4 in Bergamo, Italy. Lead author of "Quantifying Developers' Adoption of Security Tools" is Jim Witschey, a former computer science graduate student at NC State. The paper was co-authored by Olga Zielinska, Allaire Welk, Murphy-Hill, and Chris Mayhorn of NC State and Thomas Zimmerman of Microsoft Research. Lead author of "Questions Developers Ask While Diagnosing Potential Security Vulnerabilities with Static Analysis," is Justin Smith, a Ph.D. student at NC State. The paper was co-authored by Brittany Johnson and Murphy-Hill of NC State and Bill Chu and Heather Richter Lipford of UNC-Charlotte. Johnson is also lead author of "Bespoke Tools: Adapted to the Concepts Developers Know." Co-authors are Rahul Pandita, Murphy-Hill and Sarah Heckman of NC State.

The research was supported by NSF under grants 1318323, DGE-0946818 and 1217700.

Source: North Carolina State University

Social security and social safety

Security and safety could be improved if researchers from very disparate disciplines -- humanities, computer science and politics -- were to work together, according to research described in the International Journal of Emergency Management. Moreover, such coordinated efforts online would improve crisis management during natural disasters, terrorist attack or cyber warfare.

Jean-Luc Wybo and colleagues explain how social media and online social networking technologies have emerged as powerful tools to exchange information among a large variety of players, including the public, authorities, companies and journalists. They suggest that both security and safety involve detection of problems, and the employment of efficient procedures and plans to reduce or remove threats and to protect people and assets at risk.

The team has reviewed examples of how online social networking is used during emergencies and crises and investigated how relevant and useful information is extracted in an effort to support the response. They suggest that the security forces, the emergency services and those fighting cybercrime could all benefit more from the integration of social media into their organisations. In their paper, the researchers also reveal the technical limitations of social media and how it can be abused.

Whether earthquake, tsunami, rail disaster or suicide bombing. From Haiti to Mumbai, from the Brooklyn River to Boston, through the Arab Spring and most recently the Erawan Shrine in Bangkok, social media sites such as Twitter and Facebook have revealed the first images and video footage of events. They can offer a way for people to communicate when conventional channels are blocked either deliberately or through infrastructure collapse. The researchers describe how the use of social media during emergencies and disasters can be classified broadly into two categories: a passive use for the dissemination of information and to receive feedback from users and a systematic usage through which emergency communications can be carried out, warnings issued, activity monitored and damage assessed.

With more than 3.2 billion people estimated to now have internet access, around 1.5 billion active Facebook users and more than 300 million Twitter users, there is great potential for improving communications and responses during crises. "Providing threatened populations with early warnings is a government's mission for which social media should provide a strong support," the team reports. Social media can act as both the monitoring tools and the alert system during crises. The skills and techniques of computer, social, and political science, should now be brought together to policymakers, governments, emergency responders and the public improved knowledge of how these tools might best be used for all our benefit.

Source: International Journal of Emergency Management, 2015; 11 (2): 105 DOI: 10.1504/IJEM.2015.071045 

Modern parenting may hinder brain development

Social practices and cultural beliefs of modern life are preventing healthy brain and emotional development in children, according to an interdisciplinary body of research presented recently at a symposium at the University of Notre Dame.

"Life outcomes for American youth are worsening, especially in comparison to 50 years ago," says Darcia Narvaez, Notre Dame professor of psychology who specializes in moral development in children and how early life experiences can influence brain development.

"Ill-advised practices and beliefs have become commonplace in our culture, such as the use of infant formula, the isolation of infants in their own rooms or the belief that responding too quickly to a fussing baby will 'spoil' it," Narvaez says.

This new research links certain early, nurturing parenting practices -- the kind common in foraging hunter-gatherer societies -- to specific, healthy emotional outcomes in adulthood, and has many experts rethinking some of our modern, cultural child-rearing "norms."

"Breast-feeding infants, responsiveness to crying, almost constant touch and having multiple adult caregivers are some of the nurturing ancestral parenting practices that are shown to positively impact the developing brain, which not only shapes personality, but also helps physical health and moral development," says Narvaez.

Studies show that responding to a baby's needs (not letting a baby "cry it out") has been shown to influence the development of conscience; positive touch affects stress reactivity, impulse control and empathy; free play in nature influences social capacities and aggression; and a set of supportive caregivers (beyond the mother alone) predicts IQ and ego resilience as well as empathy.

The United States has been on a downward trajectory on all of these care characteristics, according to Narvaez. Instead of being held, infants spend much more time in carriers, car seats and strollers than they did in the past. Only about 15 percent of mothers are breast-feeding at all by 12 months, extended families are broken up and free play allowed by parents has decreased dramatically since 1970.

Whether the corollary to these modern practices or the result of other forces, an epidemic of anxiety and depression among all age groups, including young children; rising rates of aggressive behavior and delinquency in young children; and decreasing empathy, the backbone of compassionate, moral behavior, among college students, are shown in research.

According to Narvaez, however, other relatives and teachers also can have a beneficial impact when a child feels safe in their presence. Also, early deficits can be made up later, she says.

"The right brain, which governs much of our self-regulation, creativity and empathy, can grow throughout life. The right brain grows though full-body experience like rough-and-tumble play, dancing or freelance artistic creation. So at any point, a parent can take up a creative activity with a child and they can grow together."

Source:  University of Notre Dame

Become A Next Einstein Forum Ambassador

The Next Einstein Forum (NEF) is working to build a targeted team of 54 young Ambassadors, one from each African country, to participate in the Global Gathering, champion African science, technology, engineering and mathematics globally and become part of the growing NEF community. Are you under 42, resident of an African country and interested in promoting science and technology in Africa?

Please visit  https://www.nef.org

Self-directed, iterative learning dramatically improves critical thinking in STEM classes

A self-directed, iterative learning framework used in a first-year physics lab dramatically improved students' critical thinking skills, according to new University of British Columbia (UBC) research.

The framework asks students to compare their experimental data to other students' data or to simplified models, think critically, and then rework the science--on their own.

"In a traditional lab, a student conducts an experiment as instructed and writes it up, often chalking up discrepancies or issues to human error or lousy equipment--then they move on to the next concept," says researcher Natasha Holmes, who oversaw the revamped lab at UBC and is lead author of a Proceedings of the National Academy of Sciences study measuring its impact.

"Our framework designs the class more like a research program where scientists have to make decisions about data and uncertainty. It's more about ingraining the iterative scientific process than any single result."

According to the PNAS study, students (N 130) using the iterative approach to experimentation were 12 times more likely to propose or carry out improvements to their data or methods than a control-group in a traditional version of the lab.

They were four times more likely to identify and explain a limitation of an underlying scientific model using their data.

"The exciting thing is that giving the students the guided autonomy to decide how to follow up on a result ingrains critical thinking long term," says UBC physicist Doug Bonn, author on the PNAS paper.

"The improvements persisted when the students were no longer prompted to take the iterative approach, and even as they moved into a more traditional lab course the following year."

The pilot studies testing the impact of this structure, funded by UBC's Carl Wieman Science Education Initiative, were conducted from 2012 to 2014 and further improvements are being tested this September. In January 2016, UBC will roll out the new lab formally to a much larger group of students in a new course, Physics 119.

The pendulum example

As they worked through simple physics experiments, 130 first-year students in the new lab course were asked to do more than 'write up' their results.

They were given explicit instructions to compare data from their experiment to existing models, or to a fellow student's results, and then decide how to act on the comparisons.

For example, when comparing the period of a pendulum swing at various angles, students are given the autonomy and time to conduct more measurements to improve the quality of their data.

Eventually, the higher quality data exposes the limitations and assumptions of an established formula--often surprising the student. This builds confidence in their ability to then explore why the simple model failed.

Source: University of British Columbia

Some Business Lessons: Classroom vs Real Life Experiences

Connections. Community. Mentorship. Immersion in management theory, market strategy and financial forecasting. A big, fat résumé boost. 

The benefits of getting a business degree are multifold. But as many MBAs and their undergrad counterparts can attest, so are the falsehoods imparted.  

Some business lessons simply can’t be taught within the confines of the classroom; case studies, theories and formulas don’t always translate to real-world wins. And possibly the most valuable education entrepreneurs can receive comes from failing spectacularly, dusting themselves off and applying what they’ve learned to the next project. 

But don’t take our word for it. We asked emerging and successful entrepreneurs to share what they consider to be the biggest lies perpetuated by business programs. Here’s what a handful of them had to say. 

1. Outline it all first

Business schools like to emphasize planning (and planning and planning). But once you’re in the thick of running a company, even the slightest industry change can send the best-laid business plans out the window. 

“In academics, there’s a clear and straightforward way to win,” says Kristin Smith, CEO of Code Fellows, a Seattle-based software programming school. “But entrepreneurship isn’t linear.” Instead, it’s messy and unpredictable, marked by trial, error and pivots. 

Of course, a business degree will equip you with many of the essential tools you’ll need to run a company. “But there are so many levels on which you’re constantly adjusting,” says Smith, who earned her MBA in 2003 from MIT Sloan School of Management. “You’re probably using a hammer in a way that it was never meant to be used.”

All the more reason to avoid overthinking and over-engineering your idea, she says. Time may stand still in the classroom, but it doesn’t in the marketplace.

2. You can analyze your way into a good idea

At business school, data is king. But many graduates have learned that you can’t use a spreadsheet to shoehorn your way into a winning product or service. 

Katherine Long, a University of Pennsylvania Wharton School alum, started a seven-figure business, Illustria Designs, in 2013, right after she graduated. Sure, all those A/B testing exercises in the classroom were instructive. But when pursuing a business idea, she seized on a pressing need for herself and her classmates: high-quality yet affordable designs for logos, websites, web and mobile apps and other marketing materials. 

“That’s typically how it happens for most entrepreneurs,” Long says. “You experience a problem, and you figure out how to solve it. You have to be in touch with your intuition and creativity, because it’s often not something you can reason your way into with data.”

Smith concurs. “So many smart folks who go into entrepreneurial ventures forget to get out of their heads and into the world,” she says. “It’s not formulaic. It’s about real-world research and being willing to listen and learn.” 

3.You need to pay your dues

Despite what business professors may say, you don’t have to work in a corporate environment before starting a company. “There’s pressure to talk to corporate recruiters,” says Long, whose instructors and advisors placed a strong emphasis on landing a job with a high-profile employer. 

Unlike many of her peers, Long skipped diving headfirst into the traditional Wall Street gig after graduation. Rather than a sexy pedigree, she believes, “persistence and grit” are what it takes to succeed as a founder—and she should know. Bethesda, Md.-based Illustria Designs, which has 20 employees, has raked in more than $1 million in revenue.

Abby Falik, a Harvard Business School grad, also chose to forgo a corporate job and go it alone. “I’ve been struck by how many of my classmates, now five-plus years into corporate jobs, are seriously questioning the paths they were encouraged to take coming out of business school,” says Falik, who is still running the company she started after earning her MBA.

4. You need to make money before you can indulge your passion

This was the message Falik received in grad school: Earn big first; focus on the career of your dreams later. 

Falik, whose résumé includes educational and international development work, ignored this advice. In 2008, on the heels of finishing business school, she founded Global Citizen Year, an Oakland, Calif.-based nonprofit that selects and trains high school grads to spend a “bridge year” in developing countries. Yes, money was tight initially, especially with student loans in the mix. But to get her nonprofit off the ground, Falik moved in with her parents, tapped her savings account and secured a handful of grants. “There was no reason to postpone something I was passionate about,” she says.

It was the right call: Global Citizen Year is thriving—it has raised $8.5 million in grants and donations, and $5.5 million in tuition and program fees—and Falik loves the work. More important, the organization has sent nearly 500 high school grads on bridge years in Latin America and Africa; plans are underway to add programs in India, the Middle East and China.

5. You need to raise institutional funds

Business schools place too much emphasis on raising sizable chunks of capital from angel investors and venture capitalists, says Bob Gillespie, a serial entrepreneur who received his MBA in 2011 from the University of Chicago Booth School of Business. “Getting institutional money is difficult and time-consuming,” says Gillespie, CEO of Conference Software Solutions. Better to bootstrap and tap friends and family right out of the gate. 

Sure, institutional funding has its place later in the business life cycle. But when you’re in the early stages of building a company, your focus should be on understanding your market, learning what customers want (and how much they’ll pay), differentiating yourself from competitors and proving your concept. 

“All those things are more important than saying, ‘I got $5 million,’” says Gillespie, who teaches emerging entrepreneurs at 1871, a co-working space in Chicago. Besides, he says, investors want to fund proven concepts that have a clear path to revenue and large market potential, not untested ideas.

 

6. Hard work is the biggest key to success

Actually it’s just one of many ingredients. As an undergrad at Texas Christian University’s Neeley School of Business, Tanner Agar heard his fair share about the entrepreneurial rewards he’d reap if he put in long hours and gave his venture his all. 

“It’s great from an aspirational perspective,” says the founder and CEO of The Chef Shelf, a Fort Worth, Texas-based food e-tailer that sources gourmet products from leading chefs and restaurants. “But I don’t think that prepares you for what you’re actually going to face.” 

Pressure, self-doubt and even depression are among the emotional pitfalls many new founders experience. Unfortunately, Agar says, having investors and employees in the mix—not to mention relatives who’d preferred you’d gotten “a real job”—can exacerbate the problem. While business schools tout the benefits of single-mindedness and dedication, wellness experts emphasize the importance of entrepreneurs maintaining outlets for relaxation and stress relief.

For Agar, moving into the offices of a tech incubator filled with other young ’treps helped combat the isolation and stress of long hours on the job. “It’s nice to have the camaraderie,” he says. “Without them, it would have been so much harder.”

Title: Author

Source: Entrepreneur.com

Calling all writers – do you want to be published? HarperCollins wants to hear from you!

HarperCollins is inviting unsolicited manuscripts from aspiring authors in Australia, New Zealand and around the world. Whether or not you’ve been previously published, this is the perfect opportunity to submit your work and have a chance to be published by an award-winning, international publishing house.

Our online submissions scheme, The Wednesday Post, is ready to uncover the best voices writing today. All entries will be considered for both print and ebook publication as well as digital-only publication.

Every Wednesday, we will accept submissions through the website. Submissions must be sent through the portal and should meet all the guidelines outlined below. Please note that submissions sent by post or email will NOT be considered for publication.

If we are interested in seeing more of your work, we will contact you within four weeks. Unfortunately we do not have the capacity to provide feedback for unsuccessful submissions.

We are currently looking for: Adult fiction, particularly commercial women’s fiction, erotica, romance and young adult fiction. Non Fiction including memoirs, biographies, narrative histories and illustrated non-fiction.

We are not currently accepting: plays, poetry, short stories, essays, mind body spirit, religious titles, health and fitness, children’s books and educational texts.

When you submit to The Wednesday Post, we will ask you to supply.

• • a synopsis of your work
• • the first 50 pages or first three chapters of your manuscript
• • a short note about yourself

Culled from www.wednesdaypost.com.au

If You Think Women In Tech Is Just a Pipeline Problem, You Haven’t Been Paying Attention

According to the Harvard Business Review, 41% of women working in tech eventually end up leaving the field (compared to just 17% of men), and I can understand why.I first learned to code at age 16, and am now in my 30s. I have a math PhD from Duke. I still remember my pride in a “knight’s tour” algorithm that I wrote in C++ in high school; the awesome mind warp of an interpreter that can interpret itself (a Scheme course my first semester of college); my fascination with numerous types of matrix factorizations in C in grad school; and my excitement about relational databases and web scrapers in my first real job.

Over a decade after I first learned to program, I still loved algorithms, but felt alienated and depressed by tech culture. While at a company that was a particularly poor culture fit, I was so unhappy that I hired a career counselor to discuss alternative career paths. Leaving tech would have been devastating, but staying was tough.I’m not the stereotypical male programmer in his early 20s looking to “work hard, play hard”. I do work hard, but I’d rather wake up early than stay up late, and I was already thinking ahead to when my husband and I would need to coordinate our schedules with daycare drop-offs and pick-ups. Kegerators and ping pong tables don’t appeal to me. I’m not aggressive enough to thrive in a combative work environment. Talking to other female friends working in tech, I know that I’m not alone in my frustrations.

When researcher Kieran Snyder interviewed 716 women who left tech after an average tenure of 7 years, almost all of them said they liked the work itself, but cited discriminatory environments as their main reason for leaving. In NSF-funded research,Nadya Fouad surveyed 5,300 women who had earned engineering degrees (of all types) over the last 50 years, and only 38% of them are still working as engineers. Fouad summarized her findings on why they leave with “It’s the climate, stupid!”

This is a huge, unnecessary, and expensive loss of talent in a field facing a supposed talent shortage. Given that tech is currently one of the major drivers of the US economy, this impacts everyone. Any tech company struggling to hire and retain as many employees as they need should particularly care about addressing this problem.

---

Your company is NOT a meritocracy and you are NOT “gender-blind”

Nobody wants to think of themselves as being sexist. However, a number of studies have shown that identical job applications or resumes are evaluated differently based on whether they are labeled with a male or female name. When men and women read identical scripts containing entrepreneurial pitches or salary negotiations, they are evaluated differently. Both men and women have been shown to have these biases. These biases occur unconsciously and without intention or malice.

Here is a sampling of just a few of the studies on unconscious gender bias:

• Investors preferred entrepreneurial ventures pitched by a man than an identical pitch from a woman by a rate of 68% to 32% in a study conducted jointly by HBS, Wharton, and MIT Sloan. “Male-narrated pitches were rated as more persuasive, logical and fact-based than were the same pitches narrated by a female voice.”
• In a randomized, double-blind study by Yale researchers, science faculty at 6 major institutions evaluated applications for a lab manager position. Applications randomly assigned a male name were rated as significantly more competent and hirable and offered a higher starting salary and more career mentoring, compared to identical applications assigned female names.
• When men and women negotiated a job offer by reading identical scripts for a Harvard and CMU study, women who asked for a higher salary were rated as being more difficult to work with and less nice, but men were not perceived negatively for negotiating.
• Psychology faculty were sent CVs for an applicant (randomly assigned male or female name), and both men and women were significantly more likely to hire a male applicant than a female applicant with an identical record.
• In 248 performance reviews of high-performers in tech, negative personality criticism (such as abrasive, strident, or irrational) showed up in 85% of reviews for women and just 2% of reviews for men. It is ridiculous to assume that 85% of women have personality problems and that only 2% of men do.

Most concerningly, a study from Yale researchers shows that perceiving yourself as objective is actually correlated with showing even more bias. The mere desire to not be biased is not enough to overcome decades of cultural conditioning and can even lend more credence to post-hoc justifications.Acknowledging that you have biases that conflict with your values does not make you a bad person. It’s a natural result of our culture. The important thing is to find ways to eliminate them. Blindly believing your company is ameritocracy not only does not make it so, but will actually make it even harder to address implicit bias.

Bias is typically justified post-hoc. Our initial subconscious impression of the female applicant is negative, and then we find logical reasons to justify it. For instance, in the above study by Yale researchers if the male applicant for police chief had more street smarts and the female applicant had more formal education, evaluators decided that street smarts were the most important trait, and if the names were reversed, evaluators decided that formal education was the most important trait.

---

Good News and Bad News

The Bad News…

Because of the high attrition rate for women working in tech, teaching more girls and women to code is not enough to solve this problem. Because of the above well-documented differences in how men and women are perceived, training women to negotiate better and be more assertive is also not enough to solve this problem.Female voices are perceived as less logical and less persuasive than male voices.Women are perceived negatively for being too assertive. If tech culture is going to change, everyone needs to change, especially men and most especially leaders.

The professional and emotional costs to women for speaking out about discrimination can be large (in terms of retaliation, being perceived as less employable or difficult to work with, or companies then seeking to portray them as poor performers). I know a number of female software engineers who will privately share stories of sexism with trusted friends that we are not willing to share publicly because of the risk. This is why it is important to proactively address this issue. There is more than enough published research and personal stories from those who have chosen to publicly share to confirm that this is a widespread issue in the tech industry.

…and the Good News

Change is possible. Although these are schools and not tech companies, Harvey Mudd and Harvard Business School provide inspiring case studies. Strong leaders at both schools enacted sweeping changes to address previously male-centric cultures.Harvey Mudd has raised the percentage of computer science majors that are women to 40%(the national average is 18%). The top 5% of Harvard Business School graduates rose from being approximately 20% women to closer to 40% and the GPA gap between men and women closed, all within one year of making a number of comprehensive, structural changes.

---

So What Can We Do About It?

These recommendations on what companies could do to improve their cultures are based on a mix of research and personal experience. My goal is to have a positive focus, and I would love it if you walked away with at least one concrete goal for making constructive change at your company.

Train managers

It is very common at tech start-ups to promote talented engineers to management without providing them with any management training or oversight, particularly at rapidly growing companies where existing leadership is stretched thin. These new managers are often not aware of any of the research on motivation, human psychology, or bias. Untrained, unsupervised managers cause more harm to women than men, although regardless, all employees would benefit from new managers receiving training, mentorship, and supervision.

Formalize hiring and promotion criteria

In the Yale study mentioned above regarding applicants for police chief, getting participants to formalize their hiring criteria before they looked at applications (i.e. deciding if formal education or street smarts was more important) reduced bias. I was once on a team where the hiring criteria were amorphous and where the manager frequently overrode majority votes by the team because of “gut feeling”. It seemed like unconscious bias played a large role in decisions, but because of our haphazard approach to hiring, there was no way of truly knowing.

Leaders, speak up and act in concrete ways

Leadership sets the values and culture for a company, so the onus is on them to make it clear that they value diversity. Younger engineers and managers will follow their perceptions of what executives value. In the cases of positive change at Harvey Mudd and Harvard Business School, leadership at the top was spearheading these initiatives. Intel is going to begin tying executives’ compensation to whether they achieve diversity goals on their teams. As Kelly Shuster, director for the Denver chapter of Women Who Code has pointed out, leaders have to get rid of employees who engage in sexist or racist behavior. Otherwise, the company is at risk of losing talented employees, and is sending a message to all employees that discrimination is okay.

Don’t rely on self-nominations or self-evaluations

There is a well-documented confidence gap between men and women. Don’t rely on people nominating themselves for promotions or to get the most interesting projects, since women are less likely to put themselves forward. Google relies on employees nominating themselves for promotions and data revealed that women were much less likely to do so (and thus much less likely to receive promotions). When senior women began hosting workshops encouraging women to nominate themselves, the number of women at Google receiving promotions increased. Groups are more likely to pick male leaders because of their over-confidence, compared to more qualified women who are less confident. Don’t rely heavily on self-evaluations in performance scoring. Women perceive their abilities as being worse than they are, whereas men have an inflated sense of their abilities.

Formally audit employee data

Confirm that men and women with the same qualifications are earning the same amount and that they are receiving promotions and raises at similar rates (and if not, explore why). Make sure that gendered criticism (such as calling a woman strident or abrasive) is not used in performance reviews. The trend of tech companies releasing their diversity statistics is a good one, but given the high industry attrition rate for women, they should also start releasing their retention rates broken down by gender. I would like to see companies release statistics on the rates at which women are given promotions or raises compared to men, and how performance evaluation scores compare between men and women. By publicly sharing data, companies can hold themselves accountable and can track changes over time.

Don’t emphasize face time

A culture that rewards facetime and encourages people to regularly stay late or eat dinner at the office puts employees with families at a disadvantage (particularly mothers), and research shows that working excess hours does not actually improve productivity in the long-term since workers begin to experience burn out after just a few weeks. Furthermore, when employees burn out and quit, the cost of recruiting and hiring a new employee is typically 20% of the annual salary for that position.

Create a collaborative environment

Stanford research studies document that women are more likely to dislike competitive environments compared to men and are more likely to select out of them, regardless of their ability. Given that women are perceived negatively for being too assertive, it is tougher for women to succeed in a highly aggressive environment as well. Men who speak up more than their peers are rewarded with 10% higher ratings, whereas women who speak up more are punished with 14% lower ratings. Creating a competitive culture where people must fight for their ideas makes it much tougher for women to succeed.

Offer maternity leave

Over 10% of the 716 women who left tech in Kieran Snyder’s research left because of inadequate maternity leave. Several were pressured to return from leave early or to be on call while on leave. These women did not want to be stay-at-home-parents, they just wanted to recover after giving birth.Just as you would not pressure someone to return to work without recovery time after a major surgery, women need time to physically heal after delivering a baby. When Google increased paid maternity leave from 12 weeks to 18 weeks, the number of new moms who quit Google dropped by 50%.

---

Some final thoughts…

A note on racial bias

There is a huge amount of research on unconscious racial bias, and tech companies need to address this issue. As Nichole Sanchez, VP of Social Impact at GitHub, describes, calls for diversity are often solely about adding more white women, which is deeply problematic. Racial bias adds another intersectional dimension to the discrimination that women of color experience. In interviews with 60 women of color who work in STEM research, 100% of them had experienced discrimination, and the particular negative stereotypes they faced differed depending on their race. A resume with a traditionally African-American sounding name is less likely to be called for an interview than the same resume with a traditionally white sounding name. I do not have the personal experience to speak about this topic and instead encourage you to read these blog posts and articles by and about tech workers of color on the challenges they’ve faced: Erica Baker(Slack engineer, former Google engineer), Justin Edmund(designer, Pinterest’s 7th employee), Aston Motes (Engineer, Dropbox’s 1st employee), and Angelica Coleman (developer advocate at Zendesk, formerly at Dropbox).

About the Author

Rachel Thomas is currently teaching software development at all-women Hackbright Academy, a job that she loves. She wants all women to have the opportunity (and I mean truly have the opportunity, without implicit or explicit discrimination) to learn how to program — knowing software development provides so many career and financial possibilities; it’s intellectually rewarding and fun; and being a creator is deeply satisfying. Although many women have frustrating experiences of sexism, she also knows women who have found companies where they’re happily thriving. 

Article by Rachel Thomas (An Instructor/Software Engineer/Data Scientist)