Leadership is never easy;
however, it has its rewards. Information
Security is especially not easy, and I myself have learned some lessons over
time. I’d like to kick off my blog by
sharing some initial thoughts on the leadership topic, and then focus on risk
management and over all professionalism in our daily work. I want to make this blog useful for leaders
and those newer to the profession, but I think these topics can help all levels
of experience.
Disclaimer: Any views or opinions presented in this blog are
solely those of the author and do not necessarily represent those of the
company that I am currently employed at, so please leave them out of it!
So, let’s face it.
The hard reality is that this profession is tough. As leaders in Information Security, all we
ever do is fight uphill battles, spend money and have people avoid us in the
hallways. In between all that, though,
we keep our people out of jail, keep companies running by performing due
diligence and, by golly, we a sarcastically funny bunch of people. We actually are fun to hang around if you
give us half a chance.
What can we focus on to make more of an impact in our work,
especially as leaders? Some trends that
I see that must be stopped include:
- Role ambiguity.
Unhappiness in your work stems from not knowing what you are supposed to
do every day. If you hire someone to do
security engineering, then have them do security engineering. Don’t have
them do auditing and compliance unless this is part of their career path or
expressed desire and they want to do this. Once and a while, role
crossover in a pinch is OK, as long as it’s communicated appropriately and you
stick to your word as to when it will end. Yes, you will have humps to
get by as a group where everyone will pitch in, but if the promised overall
role changes, it’s not fair to your team member nor will they be happy. Bottom line on this one: If your role (or your team’s
role) isn’t clearly defined, define it and get management sign off. Then do it! And do it well.
- Lack of risk management. If you manage day to day work on the ‘what’s
on fire’ methodology, then do whatever it takes to stop that and focus more on
a risk-based approach. Questions to
start with: 1) How do you prioritize you current work? 2) What are the major functions of the
business that will be impacted most when trying to make a decision? 3) Does
Information Security make the sole decision to proceed with a new project
(hint: they shouldn’t be)? We can’t win if can’t prioritize what we do, and
stop doing unnecessary processes that don’t have value to the business. We need to collectively focus on the important,
most impactful issues and measure what we do to show that it is in fact
helping.
- Focus on people.
Take care of your people and they will take care of you. Abuse them and they will leave. Or worse. Make sure that if your team member works on
an incident for 48 hours straight and the incident isn’t over yet… get them
relief and let them get some sleep. If you promise them that they get to
go to that wiz-bang new security tool training class, then make sure they get
the time to do that. Make sure they have a development plan, and then
help them get there. Tell them how wonderful they are once and a while-
and make sure they don’t forget how you feel. Communicate when things
don’t happen the way you’d hoped, and especially communicate how you are going
to fix any issue.
Help add to this conversation. What other challenges can we work on as a
community and fix to make life in InfoSec better for all?
