Security Confidential S5 E9 Confidence Staveley

Manoj Tandon: Hello everyone and welcome to another episode of Dark Rhino Security Confidential. I’m your host, Manoj Tandon, and today we have a very special guest joining us all the way from Lagos in Nigeria. It’s Confidence Staveley. Confidence is a cybersecurity awareness evangelist. She’s a cybersecurity professional with a mountain of experience in the profession. She is an author and entrepreneur, and she has a lot of superpowers. One of the ones that we’re really going to be interested in today is she was nominated for and won Cybersecurity Woman of the Year. That’s pretty powerful. So, Confidence, thank you and welcome to the show. Thanks for being here.

Confidence Staveley: Thank you so much, Manoj. It’s such a pleasure to be here.

Manoj Tandon: I really appreciate you taking the time at the end of your day to do this for us. I’m sure our listeners are going to be eager to hear what you have to say. You know, one of the—a great place to start is, you are a cybersecurity evangelist. How did you get into cyber? What was your “why cyber?” Why not something else?

Confidence Staveley: Okay, so this was an accident. I say this quite a lot, but yeah, it was an accident. It was an accident of curiosity, which, honestly, was just that I was doing my MSc at the time. I had earned my first degree and just wanted to do an MSc straight away. And I was to pick it because it was an IT management MSc and I was to pick an elective, like one of those nice courses to have. And I looked around and was like, nothing was challenging enough for me. I didn’t want to get bored. So, I’ve learned a lot of the steps. Just to put things in perspective as well, I came from a programming background, so I was someone who codes a lot. I was like, “Oh, every other thing seemed very familiar to me.” But there was this elective that was Cryptography. And I was like, “Okay, so what is cryptography about?” And some of my mates were like, “That’s a very, very tough module. You know, it’s something that we have to share with the engineering department.”

And I was like, “Okay, that means it’s exciting. That means it’s challenging. I want to be there.” And they’re like, “Do you really want to do that? Because you know, the person who takes that course has like 10 heads, literally.”

I’m like, “You know, every time you guys say the word ‘tough,’ that means it’s for me. I really want to see what’s there. I want to see why this is challenging. It should be exciting.” And you know what? I signed up for this elective and I had a blast. I had a blast, and I knew that I wanted more from this space. I knew I wanted to know where this came from, literally. And that was it.

Manoj Tandon: Did you have a heavy math background?

Confidence Staveley: I didn’t have a heavy math background, but I had, at the time, I was coding in Java and C# and C and OpenCV as well. I had built this automated intrusion detection system, but with facial recognition. Okay, so I had built my version of a brand that actually works. I’m not going to mention the name, but when you come into somebody’s house, you ring the bell and they can see you. I had built it.

Manoj Tandon: Okay.

Confidence Staveley: I had built a mini version of Ring at the time. So I was in programming—that was what I was enjoying. So I came in from that background to enjoy cryptography. I was like, “Okay, so there is more where this came from and I just want to explore.”

Manoj Tandon: You know what? You’re the first cybersecurity professional I’ve met that says they enjoy cryptography. Really? But please, keep going. That’s why I asked if you had a math background, because it’s a very math-heavy subject.

Confidence Staveley: Yes. I didn’t know I enjoyed it, honestly. I didn’t know I enjoyed it, but—

Manoj Tandon: You wanted more after that?

Confidence Staveley: Yeah. And I was curious. For me, I think cryptography brought out a key part of me that I find has been keeping me going in InfoSec, which is curiosity. The curiosity that sparked up has helped me grow my skillset in many, many domains in cybersecurity. And yes, that was how it all started. I started building out the skills. I started, of course, working in environments where these skills were needed as well.

Manoj Tandon: So when you landed your first job in cyber, were you starting off as an analyst or what did you do?

Confidence Staveley: I was starting off as an analyst. So I worked at the time for a small company. Before that time, I didn’t exactly land my fresh role immediately after uni in information security. I was doing what we call side gigs in Nigeria—there are some side gigs in Nigeria within the InfoSec industry, but nothing really formal. So I would sort of be like a freelancer you call in. At the time, I was more interested in VAPT. That was what I was doing. And then I landed as an analyst at a small firm where they were building the next generation insurance products for the masses in Nigeria. Literally, my role was to ensure that that solution stayed secure. So that was my first real role in InfoSec in the corporate setting, and it was also exciting.

Manoj Tandon: You know, here stateside, when we get a lot of news about Nigeria, high tech is rarely mentioned, if ever, right? So it’s so refreshing to hear from a professional that the country is actually investing in technology.

Confidence Staveley: Yeah, right.

Manoj Tandon: And are you seeing, just as a quick aside here, the corporate sector in Nigeria—are they embracing technologies for cyber, or do you see them lagging behind?

Confidence Staveley: Okay, so in Nigeria, the maturity levels vary across sectors. You find that the banking sector is very mature. The banking sector in Nigeria is way ahead of a lot of the sectors here in terms of the tools they use. Even with the governance of cyber within those organizations, their CISOs actually report straight to the board and do not have to report through the CIO or have any such independence. Governance-wise, with tools and a lot of the things they do, they’re quite ahead of the curve. But there are many more industries that are still struggling to see the value of cyber. I also believe that the reason why that is so is because digitization is not at the same pace or at the same level as the Western world. In the Western world, where there’s a lot more digitization of just about every day-to-day task or business task in most organizations, cyber increases in value. Of course, you can easily tell why this investment is worthy. But I see that COVID has actually done us some good here. What has happened is we’ve sort of been fast-tracked and then moved straight on to the Fourth Industrial Revolution in Nigeria here. Everyone is like, “You know what? Let’s digitize stuff.” While we’re digitizing, everyone is conscious about cyber. Also, within the lockdown period, we had quite a lot of breaches as well. We’ve also had breaches across the world affect companies in Nigeria. So the reality of cybersecurity issues has become very apparent, even to the woman who sells groceries on the streets, to the guy who wears a nice shirt and a nice tie and sits in a nice corporate office. The realities have been spreading across the board, and so people are beginning to engage in conversations around cyber. I mean, I’m looking forward to October, which is Cybersecurity Awareness Month, and it’s celebrated a lot here as well. The conversations are really kicking in. We can see a whole lot more embrace of technology and all of the other things that are required.

Manoj Tandon: Well, one thing you mentioned—you folks are a little more advanced than some of the things even that we’re doing here. You mentioned the CISOs have their own office. We’re big advocates of that in American companies. In a lot of American companies, that’s not the case, and there’s a debate about that—whether the CISO should be part of the CIO’s office or not. But typically, if they are separate, then it would take the politics out of the competing interests.

Confidence Staveley: Exactly what we’re also seeing here, and that’s been enabled by regulation by the central bank as well. I find as well that here, cybersecurity is more compliance-driven. So maybe that’s also where you guys are sort of ahead of the curve, or possibly at the same level. But here, cybersecurity is so compliance-driven. The reason we have that CISO guy who can now report to the board is a regulation from the industry’s regulator. So we’re finding that a lot of those regulations are playing a big role in expediting cybersecurity best practices across Nigeria.

Manoj Tandon: That’s fantastic. That’s great to hear. So tell me, what led to your nomination as Cyber Security Woman of the Year? And congratulations, by the way, for actually being given that recognition. Fantastic work there.

Confidence Staveley: Thank you so much, Manoj. If I truly was going to answer that question, I would say I don’t know, but I’m going to mention a couple of reasons why I think I was nominated. One of them—and just to share a very funny story—I didn’t know I was nominated. I also didn’t even know I was shortlisted. What happened was, three days before I saw the email, I went to LinkedIn and saw a couple of people who were shortlisted sharing their pictures. I was actually sending applauses and greeting other women. I had no idea. I had no idea. The email attached to my LinkedIn is not one I check often. The forward-facing email isn’t one I really monitor, so that was where the communication had been sent. So I didn’t see it. I think it was a day before the shortlist was over, and I just randomly one morning went to that email address and checked. I found out on that same day that I had made the top influencers list and that I was shortlisted. I screamed my head off.

Manoj Tandon: That’s fantastic. What a surprise.

Confidence Staveley: Like, morning, and I was screaming around the house. I was like, “What’s going on here?” I was all over the place. I’m happy that I was congratulating other people and that I was genuinely happy, just to find out that I was also shortlisted. But I would say that some of the work that I’m doing in Nigeria, also spreading now to the rest of Africa, these days is really commendable. Humbly, some of it—I have been quite a strong player in driving awareness around cyber issues. Some of it has also come with very unconventional but very effective methods. For example, my organization, CyberSafe Foundation, was able to secure a partnership with the Federal Government in Nigeria to launch a cyber awareness campaign in response to the increased cyberattacks that COVID was enabling. We did something very profound. We launched Africa’s first Afrobeat cybersecurity awareness song. So it was literally like a song you could be dancing to, but it’s teaching about cyber.

Manoj Tandon: Can you send us a link to that?

Confidence Staveley: I definitely will.

Manoj Tandon: We’ll put that in the video. We’ll put that in the podcast. We’ll put it in the video part of it.

Confidence Staveley: Okay, put snippets of it, please. I definitely will. So we did something like that. We also share these really nice TikTok-like videos, but we don’t use TikTok. We use Instagram Reels and we make them really funny, but they’re driving cyber awareness. We make really short videos that also drive points home. We are also working with girls across Nigeria to give girls in underserved communities globally sought-after cybersecurity skills. For example, as of yesterday, some of our girls attained hacker status on TryHackMe. These girls are only between the ages of 15 to 21. They’ve only been learning for four months. It’s all of this work combined. We’re also working with seniors as well to create content that’s purposed for seniors to protect them. We work with Facebook as well to build literacy materials around protecting children. We actually have spread out. A key focus is to ensure that the most vulnerable people in our society have all the knowledge and the skills required to protect themselves. This includes even businesses. We’ve also found in our work with the UK government that small businesses are very likely to be attacked and are very likely to become victims. So we’re supporting them as well. We supported them during that time. All of this work—there’s just so much we’re doing. In one year, we’re still doing that. I think that was the reason why I was nominated.

Manoj Tandon: Do you ever sleep? Do you ever sleep?

Confidence Staveley: I guess especially not a lot. I think one of the things that I do really well and I want to share on this platform is I think I have a strength for rallying people around something I’m passionate about. So I pitch, and I get the team that is even more passionate than I am on the subject. So you find that I’m able to do so much, but it’s not me. It’s all the people. It takes a village to do all of this. It takes a whole community to do all of the work. So I’m very proud of the NoGoFallMag community. It’s a community of young people in Nigeria that all they do is just drive awareness around cybersecurity and specifically social engineering. Across our initiatives, we’re able to rally support enough to help us lift the heavy weights without killing any one of us.

Manoj Tandon: And you founded the CyberSafe Foundation?

Confidence Staveley: Yes, I did. Yes, I did.

Manoj Tandon: And all this work is being done by your foundation?

Confidence Staveley: Yes, yes.

Manoj Tandon: How big has your foundation gotten? How many people are helping you do this heavy lifting? Maybe get a little sleep too.

Confidence Staveley: Okay, so we’re sort of segmented across our initiatives. We have four initiatives, and I think I’ve mentioned them on this call. We have CyberGirls, which is equipping girls in underserved communities with globally sought-after skills. For that, for example, we have a volunteer community of about 21 mentors across three continents and 13 countries in the world. Yeah, we have coaches; we have about 12 coaches. If you go across the batches, I think about 24 right now. We have facilitators in each of the locations where we’re working, so that’s about 12. So it’s quite a lot of people at different levels helping. In each initiative, in the campaign I spoke about driving awareness around how social engineering happens and how people can protect themselves, we have 200 volunteers over there.

Manoj Tandon: Wow.

Confidence Staveley: And they’re spread across the country as well. So really, it’s just a community; it’s a big organization.

Manoj Tandon: That is a very significant effort and a wonderful achievement to be able to build an organization that’s as big and as capable and doing the work that you’re doing.

Confidence Staveley: Thank you so much.

Manoj Tandon: So, you know what? One of the things with CyberSafe Foundation is, when you are looking at empowering women in Africa, in Nigeria, and across the world in all the places that you’re working, what is the biggest set of challenges you’re facing in that effort?

Confidence Staveley: I think the biggest challenge is funding.

Manoj Tandon: What’s that?

Confidence Staveley: Funding.

Manoj Tandon: Money?

Confidence Staveley: Funding, yes. So, we are struggling with that at the moment, but we found creative ways. For me, I don’t stop. I don’t stop when I want to achieve something. I go for it, and we find ways to work around it and get it to work. But I think that’s—recently, for example, we were lacking on laptops to help our girls learn. These are very enthusiastic girls who would not ordinarily be able to afford the quality of what we’re giving to them for free, and we couldn’t afford the infrastructure. Just to give everyone listening to this perspective, the three major issues for girls gaining digital skills in Africa are power, internet, and access to computing devices. These are things that are not problems in Western countries.

Manoj Tandon: Right. Stable power, great internet—

Confidence Staveley: Just say “access to the internet” for starters, not even “great.”

Manoj Tandon: Yeah, not even, yeah.

Confidence Staveley: And then the third one is access to devices. A lot of the girls cannot afford devices. So how are you supposed to learn a digital skill when you don’t have a laptop? We had a situation where in some of our hubs, we had one laptop shared by five girls. It’s something as bad as that. So what we did was—recently, we couldn’t afford to buy, so we put out a tweet. In the normal nature of the InfoSec community, people are just so gracious and they sent us laptops. Now the girls I mentioned just a few minutes ago have achieved hacker status and the top five percent on TryHackMe, just one month from the time I’m speaking about. So, if they’re given the tools they need, the people we want to help are ready to learn and ready to make the best out of their lives. But these shortcomings have been an issue. I also believe that—okay, you’re going to say something, Manoj.

Manoj Tandon: Yeah, I was going to ask, have there been cultural hurdles with women taking a more advanced role, especially in cybersecurity, which is a very critical function?

Confidence Staveley: Yes, there have been. There’ve been those conversations, and I posted about one of them on my LinkedIn two or three days ago. One of the girls who is a beneficiary—she casually said it, so I didn’t think it meant so much to her, but it actually made me shed a tear. She said, “Oh…” because I checked on how she made so much progress. Usually, when our girls make so much progress or they’re underperforming, they get a “hello” from me. So either way, you’re going to get a “hello.”

If you’re doing so well, you get a thumbs up. If you’re not doing well, I’m like, “How are you doing? Are you okay?” So I sort of do that with the girls. This girl was doing so well and I was like, “Oh, well done! I can see your progress. How’s it coming?” She said, “I’m very proud of you.” And then she goes, “Oh, thank you so much. This means a lot to me. You know why? Because every day I wake up and I’m trying to prove a point, because my mom said, ‘You know what? There’s no point in investing in you so much; you’re going to get married away.’” So every day, she wakes up trying to prove a point that she’s worthy. So there is that culture.

Manoj Tandon: Yeah, I saw that video on your LinkedIn. It’s crazy. It’s crazy in Nigeria and in many parts of Africa, where this is not an exceptional case. Girls are having to cross multiple hurdles to access education first. If they have to choose between the boy and the girl in a family because resources are scarce, you know what? It’s better to educate the boy. That is one. And then, going from basic education to entrance into tech, there’s a stereotype that girls won’t do great in tech. “Why not do something else? Tech is so difficult.” And then you go from that stereotype to cybersecurity, where there are many more hurdles to cross. So we’re dealing with all of that. But what we are finding is that girls, once given those platforms to learn and once given access to role models—if you notice, I mentioned mentors, and all of our mentors are female. That’s intentionally designed so the girls can see that this is possible. “She’s done it; I can do it.”

Confidence Staveley: That’s fantastic.

Manoj Tandon: Yes, so it’s carefully designed so girls can see what is required and have everything they really require to bloom into the best version of themselves.

Confidence Staveley: See, that’s fantastic and that’s very brave. I can understand those cultural hurdles, and especially when you look at non-Western societies, a lot of those stereotypes are prevalent. But there’s one stereotype that I’ll demystify for everybody who’s listening—I think I’ve mentioned it a few times on different episodes—but we had a recruiter on and she mentioned to us that cybersecurity is one of the only professions out there where women are making 1334 percent more than men are in the same field, at least in the United States.

Manoj Tandon: Yeah, at least in the United States. I don’t know about the rest of the world, but everyone that you’re bringing up, if they come over to this side of the world, they’ll do well.

Confidence Staveley: Oh, I need to clap for that, actually. I’m so excited to hear that.

Manoj Tandon: Yes, I was surprised when I learned that. I didn’t know that, but it’s apparently true. It stems from the fact that women in cybersecurity—at least what was described to me—is that women in cybersecurity are coming in immensely qualified. They’re spending a lot more time and effort, and they’re getting the qualifications. So they are in demand. And here in the US, we have a skew in supply and demand. We have more jobs than we have people for InfoSec. So it’s led to a good living for women.

Confidence Staveley: I’m happy to hear that. Yes, please share that with the rest of the people.

Manoj Tandon: So, when you look at cybersecurity, what do you see, particularly about that profession, that can empower women in African nations versus going to medical school or going into engineering? Do you see an advantage that cybersecurity provides over some of the other STEM or non-STEM based curriculums?

Confidence Staveley: Okay, so I want to start by saying that for a lot of the girls we’re able to reach and a lot of the women we get to empower, we find that they never saw this as a route first of all. I believe that women should be given all of these options to pick from.

Manoj Tandon: You’re saying these women had never imagined that they would be going into this? So the people you are helping are not necessarily people who are coming to you with a dream.

Confidence Staveley: I think I can really understand them given my background. Let me share a bit about myself. I started coding at age 18. I was supposed to be a medical doctor.

Manoj Tandon: Oh, really?

Confidence Staveley: But I found later that that wasn’t my dream; it was a dream of my parents. Honestly, my dad still wants me to be “Doctor Confidence,” and I pray that a university gives me an honorary degree.

Manoj Tandon: Well, you can go back and get a PhD and you can be one.

Confidence Staveley: To put some context in, both my parents do not have degrees. I was that first child they wanted to give the best to, and in all their understanding, they wanted to give me the best. I think the best field to go into, in their mind, was medicine.

Manoj Tandon: They were just going all the way.

Confidence Staveley: Exactly. And it all fell to me. Fortunately or unfortunately, I’m a child that always had a mind of her own. My parents randomly said, “You know what? Don’t while away time.” In Nigeria, there is an exam right before you get into university, but you have to wait after you finish high school to write that exam. In that period of time, my parents said, “You know what? Go into this computer school”—that’s what we call it—“some place where you just learn computing.” And I was like, “Oh yeah, let me go there.”

Manoj, you wouldn’t believe it—two months, three months into that time, I started coding. I came back home one day and told my parents—at the time, I didn’t have a computer. Remember, this is also why I can relate to those girls. I had to go to that place to use a computer to gain the skills and practice. That’s why I can relate to every single thing they feel. I came back and scribbled out on cardboard—I made a presentation on cardboard and I had to convince my parents why being a medical doctor wasn’t going to be the thing I would do anymore. I had to go into IT. So I made my argument, and my mother looked at me with tears streaming down her eyes and said, “Okay, if that’s what you want, go ahead and do it.” I was lucky enough to get some scholarships. When she saw the scholarships started coming—“Great, you’re doing well!” I got a scholarship for the first degree, a scholarship for the Master’s, and it was okay. I actually had this thing together after all. And so that was how I started up. I can see those girls in myself very much. They were not given those experiences. For me, it was just experiencing tech for the first time. I was like, “This is what I want to do.” So for those girls, we’re also letting them experience it and they say, “Okay, wow! This is mind-blowing. I actually love it.” We’re giving them the exposure and that’s igniting the imagination that’s driving motivation.

Manoj Tandon: Incidentally, we actually share that story in common. I was going to be a medical doctor. I bailed out of it. I was like, “You know what? This is not my thing. This is boring as heck. I don’t want to do this.” And I became an aerospace engineer, but took a little bit of a different path, and eventually, now I’m in cybersecurity.

Confidence Staveley: Wow, that’s such a nice—but I know the conversation with parents where it’s like, “You know what? Nah, I’m not going to do this.”

Manoj Tandon: It’s not going to happen. I’m sure my dad never said it to me, but I’m probably sure he was disappointed.

Confidence Staveley: I understand; I totally do. I believe my parents were very brave. They didn’t understand what I was saying, but maybe they just saw that I had this thing figured out. I don’t know if I can ever be as brave as they were. They just let me have that, and I want to bring that back to these girls as well. I find that cybersecurity, as a woman, gives you options for balance as well. You can have a lot more opportunities to work remotely, which a lot of women find can help them balance different areas of their lives. I think that’s also a key thing I present to the girls.

Manoj Tandon: I actually had not considered that. That makes a lot of sense. Women can work remotely, and that creates flexibility to do many other things that they would like to do. One thing I also notice: You’re a very passionate person.

Confidence Staveley: Thank you.

Manoj Tandon: For our listeners, I think that’s a key to success. If you follow what you’re passionate about, you’re going to do well, and you’re a testament to that. You’ve had great success, and it’s obvious to anyone who’s going to watch and listen that you are absolutely passionate about what you do. It matters to you, and I think any human being that takes that kind of mental attitude is probably going to have success in their life.

Confidence Staveley: Thank you so much.

Manoj Tandon: I think we touched on this a little bit, but you mentioned cybersecurity in African companies, especially in banking, has come a long way and it’s very regulatory-driven. But you also mentioned small businesses are equally susceptible, and we would agree with that statement completely. We’ve seen the same thing in the United States. Do you think those smaller companies are developing an awareness? Is the CyberSafe Foundation holding any educational classes or seminars to educate some of those other sectors in the economy about cyber?

Confidence Staveley: Thank you so much, Manoj. I actually wrote a full-page article for a major Nigerian daily. I’m going to share the link as well.

Manoj Tandon: Thanks! We’ll put it in the show notes.

Confidence Staveley: Yes. Some of the findings we had—I mentioned that we worked with the UK government to drive awareness. That project was broken into two main parts. One of it was mass awareness, where we reached millions of people with cyber tips, and then the other segment was targeted at small and medium scale enterprises. What we did on that side of things is we brought in employees—technical and non-technical—of SMEs and we upskilled them. Now, in that time, we had crazy findings. We found out, for example, that over 50% of the people who came into the training did not know how to recognize phishing emails from legitimate ones.

Manoj Tandon: I can believe that.

Confidence Staveley: Yes, and that’s a big source of vulnerability. We found that a lot of them didn’t have any basic security controls. I’m a big believer in going back to the basics. What are the basics? Having great passwords with authentication, having firewalls, and having ways of detecting cyberattacks. Those very basic things—a lot of them didn’t have any of those measures. Down to—when I mean small businesses, I mean sometimes small schools that just do business via Instagram. Some of them didn’t even have two-factor authentication on those accounts. I’ve had people speak to me and say, “Oh, this is my livelihood,” at the point where they’ve lost their account to a cyberattack. That livelihood could have been preserved by having two-factor on it. What we have done is, in that time where we had the support of the UK government, we were able to have these sessions with over 4,000 SMEs. The results are just mind-blowing. Again, I’m going to share how those people progressed. They’ve been able to put controls in place in those organizations. A lot of them are coming back to say, “You know what? We want more knowledge,” and we’re referring them to more resources. We’re seeing them telling us, “Well, we found this out in our environment and we’re doing XYZ about this.” So we’ve had quite great success stories, but we are hoping that we can continue to do that work and possibly begin to build models around how other countries as well can implement this, because we find that this is a big problem.

Manoj Tandon: It’s a huge problem, and it’s fabulous that you’re doing that. In fact, share some of those things with us and we’ll even get them posted on our website.

We’re big proponents of educating. We think if people did the basics, they would be much, much safer. As you put things out there, share them, and we’ll make sure that they get out as much as we can. If you’re putting them out on Twitter and whatnot, we’ll recast them as well.

Confidence Staveley: Sure, I would definitely share them.

Manoj Tandon: In terms of progress that’s being made, let’s switch real quickly to career progress. People that you are helping through the CyberSafe Foundation—how have their careers progressed? Have you tracked them? I’m sure you have lots of great stories there.

Confidence Staveley: I’m sure you found one of them. The video you were speaking about was one of them. I would share it again with you so you can add it to the notes.

This is our first cohort for the CyberGirls program. This cohort ends in December. What we have seen—really, with the CyberGirls program, what we have is seven months of intensive training and then three months of internship placement.

These girls came in—a lot of them without digital literacy skills. Literally, we had to tell them, “Oh, this is a PC. This is a mouse.”

Manoj Tandon: They’re starting from ground zero?

Confidence Staveley: We didn’t assume anything, honestly. If there was anything lower than ground zero, we possibly would have started from there, because we didn’t assume anything.

I saw these girls come in every single workday to learn. These girls who didn’t know anything currently know how to use Bash, for example, for automated network reconnaissance. They know how to use Linux. Like I mentioned earlier, some of them have achieved hacker status; some of them are on Level 8 on TryHackMe. They’re just blazing, and we’re seeing a very positively steep curve in the uptake of the knowledge.

They are excited. You need to watch the testimonial videos—they’re speaking from their hearts to show that they are progressing.

What we want to be able to do is give them options. They can choose out of the seven learning paths we are offering them. We don’t want to overload them with too much knowledge so they’re all over the place.

We’re getting them right now to be able to pick between our seven options, which include threat intelligence, cloud security, penetration testing, network engineering, and incident response. They get to pick one of those paths and then land quietly in that path for the next three months.

What we have seen so far is we have been able to get them from ground zero to an appreciable level of the basics of information security and cybersecurity, generally speaking, with so much excitement for more.

Manoj Tandon: How much time does it take to take them from starting from less than zero to being competent? Let’s pick incident response. What’s been your experience?

Confidence Staveley: Interestingly, with a combination of approaches—we don’t use just an instructor-led approach; we also have project-based learning. A lot of girls also learn in groups, which means there’s a lot of peer learning.

Typically, to get to competent levels takes seven months.

Manoj Tandon: That’s very quick. That’s very quick, but the training is quite intensive.

Confidence Staveley: It’s a mixture of things. Let me tell you how intensive this is, and it’s also fun the way we’ve designed it. There’s a lot of gamification.

Manoj Tandon: Well, I would imagine anything that you have your hands in would probably be fun.

Confidence Staveley: We even have, outside of the classroom on Fridays—we call it Cyber Friday—the girls come and casually chat about cyber incidents across the world. We give them two topics and they chat among themselves.

What that is doing is building a culture of reading and getting acquainted with what’s happening around the world and learning from incidents, but in a way that’s comfortable enough for them to have a casual chat, like they were gossiping among themselves.

So even when they are not in the classroom, they don’t realize that we’re setting them up to learn and get great habits that will help them do very well in the industry. So, yeah, it’s fun.

Manoj Tandon: I would assume that you have a lot of corporations that are helping you so that they can actually get that project-based experience.

Confidence Staveley: Yes, yes. We have the fellowship. We also have something called the Open Day. It happens every last two days of the month. We currently have September’s Open Day.

Manoj, I’m inviting you. Come and see the girls actually showing off—we love the idea of showing off. They’re coming in their peer learning groups across our six physical locations in Nigeria, and they just connect via the internet and show off.

For some girls right now, they’re learning how to work with Splunk, so they might come in and show off what they’ve been able to do with Splunk.

Project-based learning isn’t just outside of the fellowship during an internship, but it’s also set up in such a way that they work on a project toward their Open Day. In so doing, they actually get something done that they will be taking into the real workplace. By the time they get placements—which we’re getting support for from corporates within Nigeria—they go in with their hands slightly soiled and can actually get work delivered.

Manoj Tandon: Fantastic. Send me an invite. You know, this COVID thing has shut down everyone’s travel. It’s just made everything not fun anymore. But please send an invite. I would love this.

I’m very interested in the curriculum, because we’re doing work here with disadvantaged people, trying to get them involved with cyber. Instead of reinventing the wheel, if you have good ideas, I’d just love to learn some of those and maybe we can apply them to some of the work we’re doing with disadvantaged people here in the United States.

Confidence Staveley: That would be wonderful. I would be very glad to share.

Manoj Tandon: That would be fantastic. I can see why you won Cybersecurity Woman of the Year. You’re tough competition.

So, getting back to cyber real quick: if there was one thing you were going to evangelize with everybody about cyber or information security, what advice would you give them? What would you have to say if there was only one thing? Because we know there’s a lot of things, but I’m going to force you to one thing.

Confidence Staveley: Two-factor.

Manoj Tandon: Really?

Confidence Staveley: Yeah, multi-factor authentication is such a big thing that I believe can really, really help. If people struggle with password hygiene—

Manoj Tandon: Oh, big time. It’s one of the biggest issues we have on the African continent as well.

Confidence Staveley: Yes. After insider threats, one of the biggest sources of incidents or cyber accidents within our continent still has to do with passwords. Really, you could still have been able to manage that if, even when passwords were very poor, there was some sort of strong multi-factor authentication there.

That’s why I’m such a big advocate of two-factor authentication, or multi-factor authentication as you want to call it. If there’s one thing, it would be that.

Manoj Tandon: Fantastic. Let me ask you, how could our listeners get involved with your work? Is there anything that our listeners could do if they wanted to get involved with the CyberSafe Foundation?

Confidence Staveley: Oh, there’s so much. Volunteering opportunities here—I tell people that come in contact with us: you really want to decide that you want to volunteer, because once you get in here, you will get so—what’s the word? You will get blown away. I don’t want to say the word that’s coming to my head.

Manoj Tandon: You’ll be captivated.

Confidence Staveley: Exactly. You will be so captivated that you’ll really want to do more.

So yes, we have volunteering opportunities within all of our initiatives. As we speak, if you know how to speak a language other than English, for example, we’re working on some handbooks to ensure that the information we’ve been able to put into materials in English, we can translate to other languages consumed across Africa.

So if you speak Arabic, Swahili, French, or any other language within Africa, please—your skills are required here. We also need volunteers across the CyberGirls initiative to help with the girls. Those skills are required here.

We really need donations as well. I can share a donation link. We need partners; we really need partners. For some of the partnerships, we need them to subsidize the cost of things that we are currently consuming. We’re a non-profit, and we need all the help we can get with funding.

It might not be handing us cash; it might be giving us something for cheaper or for low amounts. It could be with infrastructure—we’ve spoken about laptops, for example. That could help a girl in Nigeria or Ghana, where we’re going very soon, with our learning.

So yes: you can donate, you can partner, and you can volunteer.

Manoj Tandon: That’s fantastic. We’ll put all the links in the show notes that you send us. Everyone listening, please make sure that you open up the notes and get engaged. Confidence has a great organization and they’re doing fantastic work.

We’re at the hour here. I wanted to give you a chance—anything that you would like to mention or bring up? The floor is yours. Are there any other publications you’re doing? Any books you might be writing? Any movies that you might be appearing in?

Confidence Staveley: Yeah, movies. I’m planning a watch party for the girls as well. Chill out and just learn.

I’m really liking some movies, like Clickbait on Netflix. I think everyone should check that out. And there’s a book I’m also really digging: Cybersecurity Attack and Defense Strategies. This is one that, if you really want expert insight—especially if you’re making an entrance—this is a very great book and I would absolutely recommend it.

I know that the camera is mirroring this, but I hope you can make sense out of it.

Manoj Tandon: Who’s the author?

Confidence Staveley: Yuri… I can’t say his last name. Yuri Diogenes.

Manoj Tandon: Okay.

Confidence Staveley: I could send you that as text.

Manoj Tandon: I’m sure the camera will get it correctly. But it’s great of you to share that.

Confidence, I want to thank you so much for being on the show and for the wonderful insights and the great work that you’re doing. You absolutely deserved the award. Congratulations.

Confidence Staveley: Thank you so much, Manoj. Thank you so much.

Manoj Tandon: We look forward to it.

Our mission is to expose people to different ideas in information security—the work that people are doing not just from a cybersecurity perspective, but in how it’s affecting people’s lives. You are a great personality to have on. I had a great time.

Confidence Staveley: Thank you so much.

Manoj Tandon: Having this chat on a Friday—what a great way to kick off the weekend. We’ll have to get you back. We’ll have you back on the show at the next major milestone, which I’m sure will only be a week away at the rate at which you work.

But again, thank you so much, Confidence.

Confidence Staveley: Thank you so much.