Present this!

Today's topic is still dealing with talking to people, but this topic is more about presenting to groups, not just having a conversation.  Some might argue that presentations are about having conversations with groups, but to me the key differentiator is that you need to get a point across to a group of people, and sometimes that may be a radio broadcast versus a two way discussion.

Which is a perfect segue to my first point: know your audience!  If you are presenting to a management team, then you may very well have a conversation.  But the key point: make sure that your point gets to them clearly first, then let them ask questions.  If you ramble on or take too long to get there, the conversation will be swift and sharp, and you will suddenly feel the pull of a hook around your waist as you get yanked from the room.

Second tip: make your point interesting.  I don't care if you are talking about paint drying.  You need to find a way to grab their attention.  Add a related joke.  Add a funny story.  Make drying paint compelling.  You can do it.  You find new attack vectors for breakfast, so you can make paint interesting.

Third tip: Show. Some. Energy.  I don't care how mellow a person you are; find a way to move around and show that passion without sounding completely crazy.  Oddly enough, just some enthusiasm for a topic can help get the point across and show your audience that this should be as important to them as it is to you.  Also, face your audience.  Don't turn around and read the slides from the screen.  That just makes it look like you don't want to be there at all; plus they probably can't hear you.

Last point: Use coherent, clear, brief slides.  A slide should just show relevant points, not not regurtitate 'War and Peace' a few pages at a time in tiny fonts.   Leave white space on the screen.  Add relevant graphics.  Fill in the details by talking about them, not by cramming them in the slide itself.

Feel free to add your favorite presentation tip as a comment here.  Let's share best practices as much as possible!

Happy Holidays to your and your families.

Let's talk

This article is for the true propeller heads out there.  Those of us in Infosec who prefer to operate in a dark cube, typing away all day with the occasional stop for the caffeinated beverage of choice, maybe even food (especially pizza).  Those of us who are very happy if the entire day passes without uttering another word verbally to a human.  If you are socially adept or even an introvert who is social because you see its value, you already get it and can feel free to move along.

So, fellow propeller head, I hate to tell you this, but we need to talk to others once and a while.  Regularly is wonderful, but once and a while works.  Why?  Written communication just can't resolve all issues or properly communicate your message every time.  We may argue that we can by opening up an instant message window and chatting someone up, but yeah,  no.  Have you read what you wrote in that window?  I mean truly go back an read it out loud?  I am betting it looks something like this:

Me: r u there?  My net is down

You: Yup.  If ur net iz down, how u talkin to me?

Me: On phone.  Can u open a HD tick for me? Plz?

You: *eyeroll* sure- but u o me, d00d

Me: thx

Even worse, the person you happen to be chatting with is sitting in two cubicles away from yours.  This is communication, I agree, but this is not always clear when you make up the language as you go.

OK, first let's focus on the communication mechanism, then I'll circle back to the human touch.

Firstly, ALL COMMUNICATION NEEDS TO BE CLEAR

Was that loud enough? 

You cannot use the typically chat window speak to write business communications.  Don't get me wrong, IM is great for reaching someone quickly or on technical calls where you are sharing a lot of detailed information and you want to make sure that your teammate types the right syntax.  However, if you are trying to turn around and communicate what you do to someone, use full sentences and be concise.

For example, say you need to email our manager with a justification on buying the latest whiz-bang tool.  Regurgitating the tool white paper isn't going to cut it.  Try something like this:

Subject: Value proposition for Whiz-bang tool

Cost: $20,000 for perpetual license, 20% annual maintenance and support

Benefit: Whiz-bang will bring better visibility into malicious traffic on the corporate network.  We have existing tools that it will work with to provide more in-depth analysis of data they gather as well as provide better reporting.  Purchase of this tool will eliminate the need to purchase additional and more costly reporting tools. 

Timeframe to implementation: 30 days from purchase

Simple, to the point and concise.  If needed, you provide the entire analysis with technical detail, but chances are the people who need to approve it won't read it anyway.  Don't write a novel. 

OK, now back to the verbal human touch.  Once and a while, it's good to talk to people.  Have you noticed that sometimes you'll go back and forth over email 20 times and still not resolve something?  That's often because verbal communication is priceless.  Some things just can't be resolved via email. 

My rule is that if you have sent three emails on the same subject, that's one too many and you need to go find the person or pick up the phone and chat with them.  You will be amazed at how fast something will get resolved that way.  Try it propeller heads!  I double dog dare you.

That's all for now- just keep in mind that the person you are talking to could be just as nervous as you are, so just go do it anyway!

Sent from my iPad

What I am thankful for- Thanksgiving 2013

Taking a slight diversion this week for the holiday, but will return to the focus of my blog (Infosec Leadership, Risk Management and Professionalism) on the next post!  I couldn’t resist though, reflecting just a tad more since it is Thanksgiving.

Professionally, I am thankful for the following:

• The information sharing.  I am just beginning to really understand the depth of informal information sharing that goes on throughout the community and am simply amazed at the effort others will put forth to help each other.  Very cool.  Keep it going and do some yourself.  It’s worth it.
•  For people who do what they say they are going to do.  In our professional lives, we have a couple of pillars that we can build our careers on.  Two important ones are trust and providing results.  If you don’t establish the trust with your business partners, then your results, no matter how sizable or quickly provided, will be worthless.  Do what you promise to do.  Don’t over-promise.  If you can’t get it done, say so.  Just don’t not do it!
• Vendors who return my calls, work with me and act like they want my business!  Your support is invaluable and it’s nice to have collaborative partners.
• Non-stop learning.  The world is a big place, and I learn something new every day.  Whether it’s about human motivation, a new technical do-dad or a way to solve a challenging issue, I hope I never stop learning.
•  Teamwork.  Getting things done is very difficult alone.  Having good teammates (regardless of who or where they work) who work for a common goal is a thing of beauty.

What are you thankful for?

May you have a peaceful and happy Thanksgiving!

Leadership isn't easy

Leadership is never easy;  however, it has its rewards.  Information Security is especially not easy, and I myself have learned some lessons over time.  I’d like to kick off my blog by sharing some initial thoughts on the leadership topic, and then focus on risk management and over all professionalism in our daily work.  I want to make this blog useful for leaders and those newer to the profession, but I think these topics can help all levels of experience.

Disclaimer: Any views or opinions presented in this blog are solely those of the author and do not necessarily represent those of the company that I am currently employed at, so please leave them out of it!

So, let’s face it.  The hard reality is that this profession is tough.  As leaders in Information Security, all we ever do is fight uphill battles, spend money and have people avoid us in the hallways.  In between all that, though, we keep our people out of jail, keep companies running by performing due diligence and, by golly, we a sarcastically funny bunch of people.  We actually are fun to hang around if you give us half a chance.

What can we focus on to make more of an impact in our work, especially as leaders?  Some trends that I see that must be stopped include:

• Role ambiguity.  Unhappiness in your work stems from not knowing what you are supposed to do every day.  If you hire someone to do security engineering, then have them do security engineering.  Don’t have them do auditing and compliance unless this is part of their career path or expressed desire and they want to do this.  Once and a while, role crossover in a pinch is OK, as long as it’s communicated appropriately and you stick to your word as to when it will end.  Yes, you will have humps to get by as a group where everyone will pitch in, but if the promised overall role changes, it’s not fair to your team member nor will they be happy. Bottom line on this one: If your role (or your team’s role) isn’t clearly defined, define it and get management sign off.  Then do it! And do it well.
• Lack of risk management.  If you manage day to day work on the ‘what’s on fire’ methodology, then do whatever it takes to stop that and focus more on a risk-based approach.  Questions to start with: 1) How do you prioritize you current work?  2) What are the major functions of the business that will be impacted most when trying to make a decision? 3) Does Information Security make the sole decision to proceed with a new project (hint: they shouldn’t be)? We can’t win if can’t prioritize what we do, and stop doing unnecessary processes that don’t have value to the business.  We need to collectively focus on the important, most impactful issues and measure what we do to show that it is in fact helping. 
•  Focus on people.  Take care of your people and they will take care of you.  Abuse them and they will leave.  Or worse.   Make sure that if your team member works on an incident for 48 hours straight and the incident isn’t over yet… get them relief and let them get some sleep.  If you promise them that they get to go to that wiz-bang new security tool training class, then make sure they get the time to do that.  Make sure they have a development plan, and then help them get there.  Tell them how wonderful they are once and a while- and make sure they don’t forget how you feel.  Communicate when things don’t happen the way you’d hoped, and especially communicate how you are going to fix any issue.

Help add to this conversation.  What other challenges can we work on as a community and fix to make life in InfoSec better for all?