Get. Out. Of. My. Head!

I had the honor to participate in the 26th FIRST Conference (www.first.org) this past week, learning  more than a few things in the sessions that I attended.  I felt compelled to sit in on one that had to do with using Anthropology to design better SOCs (how can you resist that?) and was glad I did- it certainly made me think!

One point that I really pondered was that it's just plain difficult to get the passive knowledge that people have and make it an explicit knowledge that can be documented and shared with others.  This is so true! How many times have we tried to train others on what we do, when it's all based on decisions that we personally make based on our experience?

If it's difficult for someone like me who strives to share the knowledge that I have gained, then imagine how hard it is for everyone.  The reason isn't that we don't want to share, either.  Its that we simply have trouble articulating our thought processes.  Some do this better than others.  Some never do.

Which brings me to the point:  we need to start figuring out how to do this better.  This applies to talking to management about why they should care about security risk.  And how to train our analysts to trust that funny feeling they have about that one little thing in the logfile they spotted, ignored the first time, but went back to check on later.  And how to get IT to work with us and not against us because together we can truly kick butt and make progress.

So how do we extract that passive knowledge?  I go back to the basics again:

1) Communication skills, both written and verbal

2) Applying critical thinking out loud

3) Plain old brainstorming.  Heck, make documentation fun!  Get a group together, make a game of it and encourage participation through some sort of competition.  The person with the more ideas wins a prize.  Also, provide food.

4) Reward sharing in general.  No silos.  Embed it into the group culture.

5) Practice.  Run through scenarios and capture actions.

These are just me throwing ideas out while I write this on a plane ride back from the conference.  I challenge all of you who read this to add one more idea.  Share your passive knowledge.  Make the community better.  Add value to the profession overall.  And then turn around and do it again!

Sent from my iPad=

Leaders, time to take action

A new report out from the Ponemon Institute (Exposing theCybersecurity Cracks: A Global Perspective), sponsored by Websense, states: "Eighty percent of respondents say their company's leaders do not equate losing confidential data with a potential loss of revenue, despite Ponemon Institute research indicating the average cost of an organizational data breach is $5.4 million"  Even better: "Forty-eight percent say their board-level executives have a sub-par understanding of security issues."

Regardless of your feelings about surveys sponsored by a vendor, these statements merely being published as any sort of status of how we are doing is now out there in public.  And, it made me really angry.  Not that I am mad that they published it.  No, I am mad because if this is even close to being true, then we as InfoSec Leaders are failing.  And according to this report, we are failing badly.  If that much of senior management still doesn't understand the importance of information security, then we simply are not doing our jobs.

This reminded me of John C. Maxwell's series on the 21 Irrefutable Laws of Leadership, specifically the Law of Influence.  If no one is following you, you're not a leader.  So I have to ask myself: am I providing the right influence?  You should ask yourself the same.  It's OK if we are in fact we are low on the influence scale, or perhaps in one of the other 20 areas of Maxwell's book.  The important part is that we ALL take a moment to examine our weaknesses, and then go do something about them.

Some thoughts on how to do this:

1) Take a leadership class.  Yes, you techies, get out of your comfort zone and learn something about how to improve an important area of our jobs.

2) Teach a class.  We all have strengths as well as weaknesses.  Take some time to teach others what you know so that you can pass along the good stuff.  I am currently developing a class focused on areas that I think are critical for all leaders.

3) Ask for feedback.  Constantly.  OK, don't be obnoxious about it, but ask around.  Get some honest feedback and then think about how to best act on it.

We can't afford to wait, InfoSec professionals.  We are all leaders, in one form or another. If we don't take action quickly, then more studies, breaches and crazy stories that make our profession look silly will occur.  In fact, start right now.  What are your thoughts about this topic?  Share your action plan.

Sent from my iPad=