Diana Initiative 2021-Charu Bansal-Navigating the Imposter Syndrome

### Overview In this talk at the Diana Initiative 2021, Charu Bansal shares her personal journey and practical strategies for navigating imposter syndrome within the cybersecurity industry. Transitioning from a liberal arts background with no formal technical education to serving as an Information Systems Security Officer (ISSO) for a global enterprise, Bansal addresses the pervasive feeling of inadequacy often experienced in technical environments. She highlights why the condition cannot simply be permanently cured, framing it instead as an ongoing navigation process, and provides actionable advice for both individuals facing imposter syndrome and mentors supporting them.

### Key Topics - **Personal Background and Transition:** Growing up in rural Himalayas with limited access to technology, Bansal pivoted from liberal arts into security seven years prior when a team took a chance on her. Her early days involved learning foundational terms like penetration testing, man-in-the-middle, and Burp Suite while navigating underrepresentation as one of few women at technical conferences. - **Knowledge vs. Intelligence:** Bansal emphasizes that not knowing specific jargon, tools, or acronyms does not indicate a lack of intelligence. Intelligence is the capacity to learn, and technical knowledge can be acquired through self-directed study, security podcasts, newsletters, community meetups, and conferences. - **Rejecting Limiting Boxes:** She cautions against allowing colleagues to pigeonhole individuals into non-technical administrative tasks (e.g., solely taking meeting notes or maintaining Confluence pages) under the assumption that they cannot handle technical or engineering discussions. - **Non-Technical Strengths in Security:** Security is inherently rooted in human behavior, not merely technical problems. Bansal discusses how non-traditional backgrounds provide critical perspectives in threat modeling, cross-border payment platforms, incident response planning, and creative phishing exercises through an understanding of international laws, cultural differences, and life experiences. - **Mentorship and Support:** Effective mentoring requires genuine dialogue to understand a mentee's exact knowledge gaps rather than overwhelming them with generic resources (such as lengthy course lists or extensive GitHub links) or doing the work for them.

### Technical Details - **Threat Modeling Integration:** Threat modeling is highlighted as a collaborative exercise aimed at identifying and proactively mitigating potential threats to systems, processes, or applications. Bansal illustrates how life experiences—such as anticipating what could go wrong when moving across continents—translate directly into threat modeling frameworks, including evaluating payment methods and threat vectors on a global payment platform. - **Human Factors in Incident Planning:** Non-technical domain expertise, including familiarity with multi-jurisdictional legal and regulatory requirements, contributes directly to incident response planning, while behavioral insights inform anti-phishing simulations.

### Takeaways - **Normalize Asking for Help:** Imposter syndrome thrives when individuals hide their struggles out of fear of exposure. The security community must normalize admitting knowledge gaps and asking for guidance. - **Show Up Prepared:** When faced with intimidating meetings, demand an agenda, research unfamiliar terms beforehand, and continuously show up and listen attentively even if only a fraction of the discussion is immediately understood. - **Guidance for Mentors:** Mentors should prioritize targeted teaching over fixing issues for mentees, avoiding resource overload and establishing mutual trust through targeted questions. - **Internal Affirmation:** Acknowledge your accomplishments and bravery in challenging established industry biases, reframing self-doubt with the reminder that diverse perspectives provide vital security value.