Presenters:
Transcript:
Hello. I'd like to welcome to the stage Myra Foose and Maggie Torres. Myra is a trust analyst at Lionel Bessel and Maggie is a manager. Vinyl Bessel. And they are going to be talking about enhancing cybersecurity awareness through educational outreach. Take it away. Thank you.
So as you all may be aware, cybersecurity is facing a talent shortage with hundreds to thousands of open vacancies just in the Houston area alone. So it's not only just bad for our company, but for everybody in this room because it puts our data and our networks at risk daily. So what is something that we can do? How do we find a solution and build a more skilled and diverse workforce?
We must first begin with early education and engagement right next door. Yesterday we had a pool of potential talent. A room full of students who were interested in these types of careers. But how can we get an even larger audience? How do we get more students engaged and wanting to start a career in cybersecurity? So hi, my name is Meyer Foose and this is Maggie Torres.
And today we are going to explore a dynamic, student centered approach to sparking interest in cybersecurity.
In order to find a solution to our problem, we must first begin to understand why is there that we have a problem to begin with? What we've learned throughout the years is that schools are not offering cybersecurity programs, and even then, the schools that do offer cybersecurity programs, even the schools that do offer cybersecurity programs, girls are at an even more disadvantage.
A recent poll done by the Gallup, stated that male Gen Z students are exposed to more Stem concepts in schools. Only a third of Gen Z right in the middle got it. Only a third of Gen Z high school students reported learning core Stem related topics like 3D design and cybersecurity, and research also found that Stem career days can build an early interest in Stem fields, which could help meet the demand for trained professionals and diversify our field.
So we know that middle school is a pivotal time for students to, get interested and perhaps start thinking about what their future could look like. And it is up to us, everyone in this room, to learn more students into the cyber cybersecurity realm. And in order to do so, we must change the cultural conversations and break down those barriers of entry.
And that is why we at Libe focus our efforts on exposing students to cybersecurity careers at an early age. So how exactly do we do this? We like to build relationships. We build relationships with schools, elementary, middle school and high school, colleges and universities, and also local organizations. We first begin by developing a talent in schools. So the ages from grades six through 12.
We like to do this by doing career presentations, exposing them to a cybersecurity challenge that we create. And then we like to nurture a sustainable pipeline with colleges and universities where we, offer internship opportunities, scholarships and potentially project for credit. And last, we like to empower community organizations with the tools and resources that they need to continue their efforts.
So whatever it is that their mission is, we like to help them. So now Maggie is going to talk to you about a little bit about herself and how her career path led to the creation of our outreach program.
Hello, I'm Maggie Torres. I am currently a manager, on the trust team in cybersecurity at LyondellBasell. I actually started in a support role supporting our vice president of global cybersecurity, and had the opportunity to accompany him on a career talk, at a smaller university in downtown, University of Houston downtown. So that was the first connection that we made.
That was in 2018. And at the same time, he was brought a statistic that said only about 8% of girls are offered a career in cybersecurity by their guidance counselor. And that really bothered him. So at this point, we sit down together and we say, how do we make this bigger? How do we connect with more underrepresented students, girls included?
You know, first generation college students. The demographic that's around a lot of our sites that could potentially, that we could introduce cybersecurity to that, to them as a career. So in 2019, I then transitioned to a role, supporting our security awareness efforts or human risk management. So I was doing user education, by myself.
I was the first person to do that, focused solely on that for LyondellBasell. We have 26,000 users, so that was a pretty big job. So at that point, we decided that we would hire somebody to support me in those efforts. But little did we know, hiring someone like Myra in 2021, who was a former educator was going to really help us with our outreach program.
She has been essential around, teaching us about scheduling and things like that, or just getting messages to these educational institutions.
So it was an excellent.
Point that we.
Hope we're doing something wrong.
Okay. So let her tell you a little bit about her background and how it's helped us. So I am a former educator. I come from an education background. I taught middle school and high school mathematics, and then opportunity presented itself to join the team at LyondellBasell. And I took it. And at first, like Maggie said, it started doing security awareness.
And then slowly, as the years went by, I transitioned more into doing outreach. And what we've learned throughout the time is that the education world and the business world are two totally, completely different. We're running on different times, different schedules, just the way the organization is run. It's and communication is very different. And I was able to come and give a little bit more insight from my experience and how, hey, these teachers are actually kind of busy right now.
Don't call them. They're going to completely ignore you. And then there's a time in the season where it's like, these kids have nothing to do. Let's call them. They want us to come in. And, just throughout the time, that was able to be beneficial. So Maggie is going to talk to you a little bit more about the lessons that we've learned along the way and how we were able to push our our organization forward.
Next slide. If you can advance it.
So when I started, my brain just automatically went to let me do a bunch of research. I'm going to reach out to every single ISD that's around our site, around our plants, around our office, every college, every university. And as you can imagine, 5 or 6 years ago, there wasn't a lot of cybersecurity focused programs. It has changed slightly now is there still aren't a lot of programs focusing on cybersecurity, but I just shot out a ton of emails, did not get a lot of response.
The the responses that we did get back, I tried to nurture some of those relationships. There were some universities that maybe were in the beginning of their of building a program. There are people that had nothing. So they were grateful for us to be there. But it became very apparent that quality was going to be better than quantity.
So I started to focus on the relationships that would where we could fit in the best. There were some folks that we met with, and they just felt like we were going to bring everything to the table, and that became very clear that we would not be successful and they would not be successful. If you know, they expected so much from us.
So I kind of backed off of the quantity and started focusing on the quality and program. Maturity was huge again, like there were programs that had nothing all the way to to folks that had a lot of structure. So that helped me determine also what I had to offer them. So I focused on those that we could both be mutually helpful to each other.
Those weak relationships naturally kind of fell to the wayside. And then mirror comes in with the timing. So she's telling us this is the great window to send correspondence. This is a great window to not send anything out whatsoever because no one's going to pay attention to you like she said. And then she was also crucial in helping us adjust our activities, adjust our cybersecurity challenge, our Save Sara challenges, which we'll talk about here shortly.
As far as difficulty level goes. So building these projects and these challenges, it's a bunch of cybersecurity folks that love gaming that are super smart. So we're all building these puzzles that we think are so cool, but they end up being so difficult that we don't want to get our students discouraged. So she was also crucial in helping us kind of reel that back a little bit.
Let me see if I can make it. So specifically, we target, like I said, local ISD's around our plants and our sites. Colleges and universities from the smaller colleges and universities all the way up to the big D ones. The demographic around our plants is, is kind of our focus that again, that is, you know, girls underrepresented categories.
First year, college generation, maybe financially, a little struggling. Those were the ones that we wanted to focus and we wanted to help. So we would do career fairs. Those are a bit overwhelming. So we would we love to do one on one talks. At the college level, specifically with student organizations, that's kind of our sweet spot.
It's a much more personal presentation where you can talk about their interests because they're there at a cybersecurity student organization. So we know that they're interested in cybersecurity so we can get them talking. We do parent nights at the local ISD's, we also do career fairs. Those can be, you know, slightly overwhelming because you're talking to a thousand students at one time.
You're kind of saying the same thing. They're saying the same thing to you that they said, you know, next door at the other booth. But, you know, we do those so that we can get exposure. And then community organizations with great folks like Rene here from EA plus, we work with him, with grit, which is girls reimagining tomorrow.
We have a huge event that we do for them every year. It's amazing. We also work with computer art, if you haven't heard of them. There are not for profit that we donate life cycle computers to, but we also do women in tech with them as well.
Next slide.
We can do it. Okay. And then just digging down a little bit specifically, with the colleges and universities and local ISD's hands on is huge. Standing in front of a bunch of students talking like this doesn't always get the point across. But if there are things that we can do that, get there, get them thinking on their own, using their hands and actually experiencing something, even for the first time.
It's super cool experience to see the little light bulb go off in a girl's head that has just done block coding on a microbit, and now she knows that she's able to do that. It is so rewarding. We get them talking. You'd be so surprised at a career day talking to a fifth grader. And you say, what is cybersecurity?
And they're like, when my grandma pays the guy that sent her the text about his toll is overdue. And my grandma sent him $500. My mom was. So I mean, they will just go on and on. So, it's really amazing how they understand at every single level now. We offer security awareness material at those family nights or those parents nights and English and Spanish.
Myra is a Spanish speaker, so she has been essential in, translating that stuff. So we have that available, the spots where we go and set up for parent night. Much, much of that population, the parents do speak Spanish only, even. And I'm proud to say that with several ISD's and, colleges and universities, I have team members on my cybersecurity team that are in roles where they do, some feedback on curriculum and structure, infrastructure for their, for their programs, for their facilities, for their labs and things like that.
Jonathan. In the front row, he does that for seniors in the college, which is super cool. We do capstone judgment judging and, freshman project judging at HQ, which is which is cool, new for us, but we're doing that. And we also at the college level, we stress soft skills. So you may know Python, you may know how to pen test.
You may know how to do all of these great things. But can you sit in a SoC, find an issue, fix that issue, and then go and write a report and present that to your leader so that he knows what happened, how you fixed it, and it's not going to happen again. So we talk to them about communications, both verbal and written communications.
We talked to them about working as a team. We specifically, referenced the ISC Squared Workforce report that talks about what hiring managers are looking for. And some of those top, you know, five out of ten are soft skills. So we make sure they know that they're, that they need to work on that. And the other thing is Myra did talk about the shortage that we have of candidates for these jobs that are available.
Unfortunately, they are not 100% entry level jobs. Even though you're seeing these entry level positions, they want experience. So you have this this student that's in college who thinks that, oh my gosh, all these companies are looking for people to fill these positions. I am going to get a job like that right out of college. You go and look at the at the at the job req and it says you have to have two, three, five years of experience.
So the college student is standing there defeated like what am I going to do? So we push the fact that they need to do volunteer work, go find a church, a not for profit, a small business, someone that will let you do cybersecurity, that will let you do it. So that you can put that on your resume and you have that prerequisite experience to get that job.
And then you're also making connections. We tell them. I, I stress that I've gotten tons of jobs because I worked with somebody. They had an opening, and the first thing they thought was, I worked with Maggie. She's awesome. Call her. So it gives them that connection. That personal connection. And then for the community organizations, those are typically, you know, full days, full of, fun stuff.
We do micro bits. We do Morse code bracelets. We do. We volunteer where we can with confident. Not only we do women in tech, where we have a full day of hands on activities, we also go and stand in a hot warehouse, package up live cycled laptops so that those can be passed out to students that don't have the opportunity to purchase one on their own.
It's not working.
What is?
There. Next. So I will talk a little bit more about in detail about that stuff we do. So how exactly do we get to make our lessons to be engaging. So it's important for it to be capturing. Right. The students minds are overtaken by things that are probably more interesting to them, like social media, YouTube. So like how do we beat YouTube, right?
And make them want to do stuff that's cybersecurity related? So important thing is that we want to make that our lessons be culturally responsive. So make sure that we are taking students interests into account. Every school that we go to is not going to be the same. The community, the culture, it's going to be different. So knowing our audience is very important.
So we get to know our students. We then connect the the lessons to a real life context. So make it relevant to them. Use examples of figures that they can also relate to. We encourage collaborative learning, so making sure that the students are talking to each other like cross-culturally getting to know each other. And they always end up learning from each other.
And we like to celebrate culture contributions to tech. So not just people who look like us, but people who look like them. So there's a lot of examples. It just takes a little bit more time for us to go and find it. So just some examples of lessons that we've done. We like to go to different schools and do these career talks, and we always like to bring a guest speaker.
So one of the middle schools that we went to was Wunderlich Middle School, and we so happened to find a colleague who also was a graduate from Wunderlich Middle School. And it was perfect for these young girls to see someone who came from a school that they went to, they can see themselves and say, hey, she had the same struggles, had the same bad teacher or the same awesome teacher, and she herself also made it.
And she now is, women in tech. So just making sure that you go a little bit above and beyond and find those connections. And then also another activity, I'm not sure if we have any Swifties in the crowd, any Swifties. Okay. Like, I know there's a few, but in case you weren't aware. Yes. So, Taylor Swift went on tour for two years and something that was really popular at her concerts were friendship bracelets.
So everybody knew if you were going to a Taylor Swift concert, make yourself 1020 friendship bracelets, because this was something that she did, and she passed out to her to the people who are sitting around you. And once you're done with the concert, you go home and you have a handful of friendship bracelets. So we knew that was something that was popular.
So what we did was we tied this friendship bracelet idea to a morse code. So the girls are given a personality quiz. This quiz just asks you random questions like, do you see the glass half empty, half full, or are you. Do you see yourself more of as a leader or a follower? And at the end of the quiz, the girls were given an answer of what cyber security role best match to their personality.
So either you were more of a manager, a SoC analyst, a pen tester, and then we then translated that word into Morse code, and then we used the beats, the circles or the dashes to create that bracelet. And then these girls took these bracelets home and it was just something for them to once they wear it at school, it's a great conversation starter, like, hey, what's that bracelet?
And even though we didn't talk to all the girls or boys in that school, it's a good conversation starter to say, hey, what is that? Oh, it has to do with cyber security. And there goes a conversation like, what is cyber security? So it's just going above and beyond a little bit and just thinking like, maybe I'm not going to reach everyone, but the things that I do make are going to make an impact and reach other students.
You know, we also like to incorporate student voice and choice. Address the equity, equity and access. So making sure we're aware of the digital divide. So some of the schools that we've gone to, we like to introduce this microbit lesson. Some girls are like, hey, I do this in my classroom already. Other schools are like, what is this?
You can just see the girls are very intimidated, don't know what to do. They're just kind of waiting for us to give them, like exact detail, video instruction. But then they start doing the activity. They realize, hey, this is not as hard as it seems. They learn how to do block coding, and then they can see how it's also translates into Python.
And they're like, oh well, I can see how this is not so bad. And by the end of the lesson, these girls are doing their own projects, doing their own thing. And it's just really rewarding to see how just from the start of the workshop, the girls are very shy, intimidated, and then by the end of the workshop, they're like, hey, can I take this home?
And again, something that they can take home or even show their classmates, and then that's that conversation starter like, oh, what is this? Oh, I did this at a cybersecurity workshop. And just also making sure that we use inclusive language. Don't go in talking very tech and professional and just like, you know, these are kids and just make it more relevant to them.
Today, today. Next slide.
So one of our ultimate lessons that we like to create is our cybersecurity challenge. And where we incorporate like here we go. Incorporate everything that we've learned into this one challenge. It's not perfect, but over the years we've perfected it. And Maggie is going to talk to you a little bit more about how we got to this day.
That where we're at today.
So I lined up a cell, about 11 years ago, we started a cybersecurity challenge. It was developed by our team for our team to compete against each other just for bragging rights. Mostly. But as we started to do outreach, we thought it would be cool if we kind of switch gears a little bit and, made it geared towards the students and offer that to our students and then actually offer it globally, via social media and that type of thing.
To any student aged, sixth grade through first year in college. So our first challenge was safe. Sarah. I'm not sure what's going on right now. Our first challenge was safe, Sarah. And that year, we had, two winners. One was a boy, I think, from Connecticut. Oh. We can't. Sorry, guys, we don't have any more.
Our our license ran out. So the first we had two winners. One was in Connecticut. And the other one was here local in Porter. That was a girl. The reason we had two winners was because it was our first challenge. That was outside of the land network. We didn't realize that you couldn't use a MacBook to solve some of the puzzles.
So we gave her a little bit of extra time. She finished, so they got to share the prize that year. So as we started to move forward, we kept with this Sarah theme. Sarah is always getting in trouble. She's constantly kidnaped or whatever. She she's just a mess. So we went forward. The next game, I believe, was Sarah's safe space.
And this game was absolutely, ridiculously complicated. Not so. We offer it in October to our team every year. Students, around, depending on when we finish. And then October for sure. To our team, even the adults could not solve it. So, so we went to the drawing board. We created another game, the following year. Sarah cyber sleuth.
Right. Sarah. Cyber sleuth. And, we did have an adult solved that one, so that one was exciting. Unfortunately, we didn't have a student make it to the end within the time window. So the following year, we went back to Sarah Safe Space with the recommendation. That's when Myra steps in and says, guys, this is too hard.
You can't be. So because, you know, our vice president of cyber security, his idea was the hardest puzzle should be the first puzzle. Because then if they can finish that, they'll be able to finish the whole entire thing. But what my stress was, no. That's when students get discouraged and stop. So we kind of flipped things a little bit when we made some adjustments, we added some extra clues and things like that.
While we didn't have a student finish, we did have an adult finish that that challenge. And then, we do then we get to cipher Sam, save Sarah, which was the effort that we did in 2025. This is specifically kind of cool because, again, all volunteers, about 97% from LyondellBasell. But most of the people that worked on this game had no game development experience.
We had about three guys step up and say, I'd really like to learn it. So on our team, we do have one person that that's his job developing games. So he mentored these folks, taught them unity, taught them game development, and they were able to build the puzzles. Karina is one of them. This chick is sitting right here in the front row.
Yay, Karina. So she built one of the puzzles. Actually, the coolest puzzle as far as I'm concerned. In this whole entire thing, Myron and I became graphic designers by using, an AI server that our vice president of global cybersecurity built. So we use that server to create images. We use Canva, we use other generative AI products to create images so that in most of the images that you see in the book and the book, in the, and the game were created by Myra or me.
So that was exciting this year. Yay us! We did have a student finish the game. We haven't given it to our adults yet. That will be in October. And it was exciting because it was in Spring Branch ISD. We had gone to do a career talk. We introduced the game to them. We walk them through the first portion to actually enter the game, and within a week we had a winner from Spring Branch ISD.
So we were so excited to go back to Spring Branch. I do about two weeks later and offer them the super cool drone that, they were very excited the DJI mini three to receive. So this, like I said, is exclusively volunteer. It's only LyondellBasell through fierce rodent, connection because we all know each other. We are open to have anybody come and help us develop this game.
So if you're interested, talk to me. I'll be more than happy to talk to you. So what are our next steps as far as outreach goes? I think that next steps are different for every person in this room. Whether you're part of a program like we are a part of, lucky enough to have this outreach program at LyondellBasell and have a team that does things for us and with us, or you're just a single person that's maybe taking the mentor track here at this conference.
Taking this step is the biggest thing. You may have someone in your family, your daughter, your niece or nephew that you have exposure to that could potentially be interested in cybersecurity. Maybe they play games all day. You have the background and the knowledge to talk to them and see what their interests might be, might be in a time where the economic cycle is on a downturn and that small check, big check, any check could potentially not be available to to give to an organization that we always have time and we always have knowledge.
You just have to make the effort to to offer that, whether it's small or whether it's on a larger scale. We all have that to give. Next, next slide. If you can make it work. So here's just a cool slide of things that we've used, resources that we shared with schools, universities, organizations of just stuff that we've gathered along the way.
It's not everything, but it's just some stuff. You can share. Also, use yourself or share with someone that you may know. And that brings us to the end of our presentation. If anybody has any questions, we'll be glad to answer. Yes.
I looked forward.
Cool. Yeah, we'll do that. Absolutely. Yes. I I'm an instructor at Allen High. One out of four, I suppose, of teaching technology. So anybody who has resources, I would love this is exactly what I saying. So. Oh, really? Thank you. I want it all. So I'll reach out to you. You can definitely come to your classroom. Exactly what you meant to my role.
Thank you so much. Yes. Thank you, thank you. And if yes, sir.
Years ago in Know You program. Different programs.
Yes. Working for me to figure out,
Great. Yeah. In a perfect world, I would love to have co-ops for Deca. I always tell a story about my friend. She's. She's in contracts and procurement, but she was part of Deca, and she's my age. You know, 50 of, you know, tell you. She started at shell as a junior in high school. She didn't leave there until she was about, I think 45, because they outsourced her position to somewhere in Europe.
But yeah. So Deca is I would love. I mean, I've talked to Joy about, you know, doing co-ops with high schools, just, you know, maybe sitting in the SoC and things like that. But I, I totally agree. That's that's a good way to kind of make a connection. A program has gone through the CTE programs. Yes. That's what spring branches did as a city.
That's how we have a connection with their, technology center. Yeah. Yes.
Certifications? Oh, GRC. Okay. Yeah, yeah. I'm actually on the board trying to do my.
What I can that actually, Yeah, I see all the different.
What program do you even work with that lets the kids? I would love to talk to you. I was a graduate student. I'm sorry. Gotcha. So when we do our personality test auditor, our GRC very rarely come up. We have one student at U of H that when we were doing it and he didn't even know it existed, and he was like, what is this?
It does match my personality. Now he's a member of Isaca. He just got a Isaka, scholarship. And actually the girl that I didn't mention it, but the girl that won our first save, Sarah, that kind of caused her to go into cybersecurity. And now she's at Cornell pursuing a college degree in cybersecurity. So, yeah. So that's awesome.
Yeah. GRC is something that a lot of students don't know exists. That and, you know, architecture and those types of things. Anything else? Yes, sir.
I don't. Oh yeah. Sure. So it.
And if you're interested in an if you're an educator and you're interested in that personality test, it's actually on ice wall is ice wall. So it's on ice law.com. You can access it there. I think. If not, I can send it to you will connect the. And I can see the. Well if there's no more questions. So we appreciate you listening.
