Now the vice president of customer advocacy at anti-virus firm Cylance, Beckloff said being a woman in cybersecurity can often mean finding yourself in difficult situations.

Today, women make up 11 percent of the global cybersecurity industry, according to a 2017 international survey of cybersecurity workers by The Center for Cyber Safety and Education and the Executive Women’s Forum on Information Security, Risk Management & Privacy. Of those women, 1 percent of female cybersecurity workers are in C-suite leadership positions. This glass ceiling is even higher for women of color.

The gender gap means a smaller pool of potential workers in an industry looking to face 3.5 million unfilled positions by 2021, according to research by Cybersecurity Ventures. But women who are already part of the industry contend it represents a strategic disadvantage for cyber companies. While women hold some of the top cyber leadership positions at the Department of Homeland Security and throughout the Department of Defense, for cyber departments within military branches and defense contractors, this gap could represent an unaddressed tactical disadvantage, they said.

Jennifer Sunshine Steffens, CEO of IOActive said without women on a cybersecurity team “you lose out on a lot of diverse perspectives. Especially in security, we’re trying to fight against ever-changing threat aspects. You want all perspectives … to make sure we can stay up to speed and [to be] as ahead of things as possible.”

The challenges for women in cybersecurity range from meager recruitment of women into cyber-focused college majors to a lack of female advocates and mentors who often make promotion decisions, said May Mitchell, vice president of marketing at Cylance.

It’s “much easier for men to build their support network and get promotions and assigned the cooler projects. The recognition and promotions individuals received were not always based on skills; it was about getting the right sponsors and champions,” Mitchell said.

This creates a disadvantage for cybersecurity companies in subtle but profound ways, experts said. Attackers come from diverse backgrounds and ideas on how to defeat them are often ignored when the decisionmakers are only men. Those teams with ample diversity are more productive and more profitable, said Keenan Skelly, vice president of global partnerships and security evangelist at cybersecurity training company Circadence, citing MIT research.

“Diversity is so crucial right now as we are developing more complex technologies, such as machine learning and artificial intelligence. All the biases we hold as human beings are being transferred to those technologies,” Skelly said. “Without diversity, we cannot create truly diverse technology.”

Beckloff said it’s common for male leaders in the cybersecurity space to rely on an aggressive and fast-paced strategy, sometimes to the detriment of their goals or products.

“Overall, women provide a more well-rounded view of the issues at hand. In defense, we often times need more than an ‘attack first, ask later’ mentality,” she said.

Joanna Hu, principal data scientist at security information and event management firm Exabeam, said in her experience, men in the technology industry tend to focus more on short-term impacts, whereas women look at the long run.

“There’s a trend, like most of the males felt ‘now is the time; we can’t risk more time’ or ‘we can’t spend more money on that,’” even when a product or research topic wasn’t fully vetted and holes were clearly visible, she said. “I also see this pattern in many places [in cyber].”

Women have an easier time developing relationships and building healthy teams, Hu said, and that emotional intelligence can be invaluable in tight spots when protocol alone won’t get the job done.

As an example, she pointed to a time when her team was on a tight deadline to put out a machine learning feature but found some bugs at the last minute. The engineers who would’ve been able to fix the problems lived in Ukraine, but they were off work on a national holiday. It would have taken days to get the bug fix assignment through the normal pipeline, missing the critical deadline.

Hu had spent significant time developing relationships with that team, so she called the engineers and asked if they could do her a favor. Had it been anyone else, perhaps it would have been asking too much. “I’d cultivated such a positive relationship with them,” she said. “They said ‘sure,’ and worked for me using their off time … with their prompt reply and help, we were able to deliver the feature on time.”

Securing old-school infrastructure against cyber attacks is critical now that they rely on digital interfacing for day-to-day operations, experts and government officials say. Power plants, drinking water facilities and even oil pipelines rely on strong cybersecurity to prevent service outages. While experts say the U.S. has never had a significant incident as a result of a cyber breach at one of these facilities, the repercussions of a successful attack could range from merely inconvenient to deadly.

“Protecting infrastructure like dams, nuclear or water from cyber attack is as serious a national security problem as protecting classified databases,” said Sergio Caltagirone, director of threat intelligence and analytics at Dragos, an industrial threat detection and response company. “Unlike many other digital assets, our critical physical infrastructure involves risk to lives and civil society.”

Jason Denno, director of the cyber operations program at the University of Arizona South, said the public generally doesn’t realize the nation’s critical infrastructure is tied into digital systems until something goes wrong.

Cybersecurity personnel are working behind the scenes to keep those assets safe, but Denno cautioned that more focus needs to be placed on critical infrastructure because some relies on decades-old computer systems and not all infrastructure is being maintenanced with up-to-date best practices.

“There is a significant amount of infrastructure out there that still runs on [MS] DOS,” he said, referring to the computer operating system first released in 1981. “Some old systems are obviously vulnerable because they have no protection, as well.”

Setting the standards

Christine Pommerening, cyber security policy professor at George Mason University, said critical infrastructure cybersecurity follows Process Control System guidelines set by security industry working groups. Peter Soeth, spokesman for the U.S. Bureau of Reclamation that manages several federal dams including the Hoover Dam, added that federal cybersecurity standards are set by the National Institute of Standards and Technology.

Pommerening said critical infrastructure — everything from hospitals to highway signs to drinking water plants — are being probed “all the time,” but often those efforts aren’t malicious. But sometimes, they’re scouting missions for later attacks.

Experts say cyber security staff at the local, state and federal level should implement best practices such as allowing monitored internet access for the business side of the office but keeping operational support on a closed-network intranet. Denno said additional safeguards are often put into place, such as keeping various parts of the operation isolated in their own intranets.

“If there’s no legitimate business purpose for two computers to be talking to one another, we deny access for them to do that,” he said.

But cyber attacks on international infrastructure still occur, such as when the 2017 WannaCry attack disrupted hospital services in the U.K.

A 2013 cyber attack on a New York dam raised questions about the security of U.S. infrastructure. The hackers targeting Bowman Avenue Dam didn’t get operational control of the floodgates, Newsweek reported in 2016.

What an attack on the Hoover Dam would mean

Speaking of dams, Soeth said there has never been a successful attack against Hoover Dam. That’s important, Pommerening said, because dams have no backup if they fail. Unlike power grids, where another substation can pick up part of the load to avoid a blackout, there’s rarely a second dam downstream.

If Hoover Dam stopped allowing water through — or worse, if a deluge flooded the towns downstream — there could be immediate and long-term consequences. The water that flows through the dam powers hydroelectric turbines that provides electricity to about 1.3 million people three states and prevents annual floods in Arizona and Nevada by taming the tumultuous Colorado River.

But more than that, the dam acts as a reservoir via Lake Mead, the 247-square-mile lake behind Hoover Dam. Twenty-five million people in three states across the Southwest rely on Lake Mead for a sizable portion of their supply of potable water, and some states will stash away extra water during wetter years to prepare for inevitable droughts in these desert environments.

The Southwest is currently in the midst of a 19-year-long drought, and the ever-shrinking water supply stored in Lake Mead is critically important for drinking water, crop irrigation and for city and suburban expansion. A successful cyber attack could halt growth and plunge the Southwest into an even deeper, more dangerous drought — potentially causing a regional economic slowdown, food insecurity and a public health crisis.

Caltagirone said cybersecurity within critical infrastructure sites needs to be prioritized nationally.

Modular data centers, also called containerized data centers, are a system of IT infrastructure such as server racks, cooling systems and power supplies that can be transported by helicopter or truck at a moment’s notice.

Some in the private sector use modular data centers as emergency backup centers or to expand their already crowded data centers, but some security experts argue the centers have far more potential than just as a “plan B” option.

IT executives, such as Walter O’Brien, CEO of Scorpion Computer Services, say the federal government should consider adopting containerized data centers in a broad fashion to bolster security.

Already, the federal government has “crown jewels” of information that they keep secure in data centers, which he colloquially calls “LAN in a can.” However, he argued the most sensitive pieces of data — such as employees’ social security numbers, addresses of service members and nuclear launch codes — should be contained in modular data centers that are operated by artificial intelligence systems for an additional layer of protection.

Some agencies have turned to a few containerized data centers because their small size makes them easy to move and to keep cool. These units also can be used to operate a remote – but private – cloud service for a larger network.

The Department of Defense uses two data centers that cool their servers by submerging them in oil. The data centers are in an undisclosed location, and the systems were purchased from Texas-based company Green Revolution, Data System Dynamics reported.

In some cases, containerized data centers are physically sealed and no one can enter the container until its lifespan expires. At the end of that time frame, the container is retired and the servers are “sanitized,” according to the U.S. Customs and Border Protection. (CBP does not use mobile data centers.)

Modular data centers can also be used to run complex simulations on site, even in remote areas where a data center is thousands of miles away. Dell developed their Tactical Mobile Data Center to provide secure computing resources for service members in theater. The data center uses a camouflaged shipping container, server racks and fire suppression and can be delivered via helicopter as needed.

“Tactical mobile data centers and rugged servers bring mission-critical data closer to troops for faster transmission and improved security, making it possible to use intelligence, surveillance and reconnaissance (ISR) data in theater with active cyber protection,” the company said in a statement to Fifth Domain. “It’s important to turn ISR data into information that can be used to make decisions faster and with safer outcomes. Tactical edge computing makes this a reality on the battlefield or other extreme military situations.”

Part of Dell’s mobile data centers are “rugged servers,” which are compact and built to work in environments ranging from sub-zero temperatures to sandstorms. The company stated the servers are built to withstand mortar explosions.

“With reliable access to high-power servers even in these conditions, troops can better utilize data to enhance both physical and cyber security,” Dell Federal stated. “While rugged servers can be transported in the back of a humvee, tactical mobile data centers provide similar rugged qualities and can be dropped into undisclosed locations to offer compute power closer to troops or other remote operations. These can be set up quickly and run from a variety of power sources, offering a containerized cloud solution for intelligence information.”

O’Brien said one of the most significant benefits to using mobile data centers is they can be upgraded separately from a department’s internal data system. The long item-procurement cycle in the federal government can often means today’s technology is already outdated, but containerized systems could be ordered with the newest technology and updated easier than built-in tech, he said.

He said modular data centers can help close some cyber security holes by offering consistency. If the type of technology used inside today’s departments aren’t consistent across the federal government, “there’s always going to be a back door from someone who’s lagging behind.”

Quantum computers are fundamentally different from traditional computers. The processors they use rely on quantum physics to solve specific problems that regular computing processors could never solve. Companies such as IBM, Intel, Google and D-Wave Systems are developing quantum computers, and some companies are on track to release quantum computing processors that reach “quantum supremacy,” the 50-qubit academic benchmark at which a quantum processor outpaces traditional supercomputers.

That improvement is a double-edged sword. While today’s impossible computing problems include analysis of complex chemical reactions and organization of multi-variable logistics (think self-driving cars or automated package delivery), they also include the code that keeps classified government information safe.

“This is definitely a very real threat,” said Dustin Moody, a mathematician with the National Institute of Standards and Technology (NIST). “We’re putting a good number of resources on this project.”

A 2016 report from NIST, which handles cybersecurity for non-classified government information, warned that if large-scale quantum computers are ever built, they will be able to break many of the public-key cryptosystems currently in use. That in turn would seriously compromise the confidentiality and integrity of digital communications on the Internet and elsewhere.

Granted, it could be decades before quantum computers are used for nefarious means. But federal cybersecurity experts are preparing now for what’s to come, with NIST currently working on quantum-safe algorithms and new federal guidelines that would better harden systems from future vulnerabilities, NIST mathematician Dustin Moody said.

Such strategies are driven by an ever-closing window of time. Put in place protections now that in theory promise to be effective for two decades, Moody said, and government won’t find itself vulnerable when a more capable quantum computer is created in 10 years.

The National Security Agency actually began taking proactive steps a few years ago, announcing in 2015 it was planning a move to quantum-safe algorithms. The agency is also working on removing vulnerable public-key algorithms.

Next-generation technologies also hold some promise. The NSA told Fifth Domain in a statement that it is exploring a variety of means to protect sensitive data from future quantum computers, including artificial intelligence and quantum infrastructure.

“NSA concurs with experts who say that quantum computing has the potential to become a national security threat one day if quantum resistant algorithms are not implemented,” the statement read.

Despite the security risk, sidelining quantum computing is not the answer, said Scott Crowder, IBM vice president and CTO for quantum computing. He testified in front of a subcommittee of the U.S. House Committee on Science, Space, and Technology last year, saying quantum computing applications will bring powerful tools to the United States if the nation makes enough investment to keep the country competitive in this field.

“Quantum computing is not just another emerging technology. It is a radically different computing paradigm that could launch a new age of human discovery,” Crowder said. “The technology will one day help us to solve problems that are unsolvable today with classical computer systems. You are right to focus on U.S. quantum leadership given its critical importance to our national competitiveness and security.”

Quantum computers are known to be able to break public-key cryptography, which is a common system of protecting data that uses one “key” to encrypt the data and another “key” to decrypt it. Some potential methods to counter such a threat could be symmetric-key algorithms, which use one secret key to encrypt and decrypt information, provided they’re at least 512 bits long, Moody said. Other options are lattice-based cryptography, where the structure of an algorithm is built upon an abstract mathematical grid of two-dimensional points, and multivariate cryptography, which relies on algorithms that solve nonlinear equations.

NIST recently held a call for entries for a competition for innovative post-quantum cryptography ideas that use these or other methods. NIST will review and test the proposed ideas over the next three to five years. It’s also developing new standards for the federal government’s cyber policies so it will be ready for the day when quantum computers spread across the world.