Socializing Cyber Security to Staff & Leadership

A challenge with IT Security is communicating real risk to leadership and users in a way they understand, that also moves them to action (e.g. giving budget, or not clicking a malicious link in an email).

The foundation for this discussion is that business risk decisions are not technical decisions. This needs to be considered when a Chief Information Security Officer (CISO) wants to apply a security control or restrict a user behavior.

With a business decision, we must ask: what are the potential impacts to this control? What risk is it reducing? What would that impact be to the business? Are users going to work around this control and do something even riskier?

A CISO’s role is similar to a General Counsel, where we provide guidance to manage a risk. We provide the facts and information to help the business make risk-based decisions. And the senior leadership needs to understand they have four options: mitigate, accept, transfer, or avoid that risk.

You will have many risk-based discussions, so here are two fundamentals to consider:

1. What works for one doesn’t work for all.
   1. Maturity levels and risk acceptance levels vary by organization or an individual.
2. You are talking to individuals, and each has their own goals, incentives, currency, and biases.
   1. These incentives may be financial, reputational, competitive, ego-driven, aspirational, or ethical.

When talking specifically to leadership, there needs to be a baseline set for future discussions:

1. What does success look like?
   1. “Everything working?”
   2. “Are we making money?”
2. What does failure look like?
   1. “Were we hacked?” — what does that really mean?
3. How do we measure each?

When talking to anyone in the organization, keep these two things to keep in mind for success:

1. DON’T push FUD factor (fear, uncertainty, and doubt)
   1. This doesn’t work, it never worked; it might get their attention, but never ultimately leads to long-term buy in.
2. DON’T focus on technology challenges or benefits
   1. They won’t understand, and that shouldn’t be your strategy anyway.

Instead, use these core strategies:

• Remember you are talking to people, not a “corporation.”
• Know your audience. What are their backgrounds, interests, and their motivations?
• Know your company, what it does, how it makes money, who its customers and partners are, what the culture is, and what a “bad day” looks like.
• Know what your competitors and peers are doing in this area.
• Know your industry and its regulations.
• When considering threat scenarios, use threats and risks to business processes, not technical threats.
• Don’t let an incident or crisis go to waste.
• Realize the approach that works for you this year might not work next year. Management got smarter (you educated them), so you need to go further.

Lessons in Effective Communication (Courtesy of Dale Carnegie)

There was a book written in 1936 called How to Win Friends & Influence People by Dale Carnegie. It’s something most business students have read, but not a lot of IT people know about it. This provides a guide for good communication within the business context. It’s also a foundation for good customer service, which is a skill CISOs need to have.

The book has three main sections of interest:

Three Fundamental Techniques in Handling People

1. Don’t criticize, condemn, or complain
2. Give honest and sincere appreciation
3. Arouse in the other person an eager want

Six Ways to Make People Like You

1. Become genuinely interested in other people.
2. Smile.
3. Remember that a person’s name is, to that person, the sweetest and most important sound in any language.
4. Be a good listener. Encourage others to talk about themselves.
5. Talk in terms of the other person’s interest.
6. Make the other person feel important – and do it sincerely.

Twelve Ways to Win People to Your Way of Thinking

1. The only way to get the best of an argument is to avoid it.
2. Show respect for the other person’s opinions. Never say “You’re wrong!”
3. If you’re wrong, admit it quickly and emphatically.
4. Begin in a friendly way.
5. Start with questions to which the other person will answer “yes.”
6. Let the other person do a great deal of the talking.
7. Let the other person feel the idea is his or hers.
8. Try honestly to see things from the other person’s point of view.
9. Be sympathetic with the other person’s ideas and desires.
10. Appeal to the nobler motives.
11. Dramatize your ideas.
12. Throw down a challenge.

Defining & Measuring IT Security Goals

So now that we have tools to communicate more effectively, what is our goal? We return to the baseline discussion at the top of the article: Defining success and failure factors. In a comprehensive IT security program, they would include what we are doing well, or poorly, in the following areas: