I just watched Leigh Honeywell's talk on "Building Secure Cultures" on the YouTubez. (BTW, it is a must watch for anyone remotely involved in security) I've been a big fan of Leigh's work and she lays down a lot of practical and effective advice. Her talk also struck a chord with me and my recent book on how to build a successful security program to pass audit.
For one, I felt great that she was also emphasizing empathy and coaching when delivering security advice. She, like me, has seen how counter-productive the elitism, abrasiveness, and condescension (and just plain rudeness) that somehow has become associated with a lot of the security industry. I especially liked how she called out "feigning surprise", an insulting practice I too have been guilty of doing.
"What? You didn't patch it?"
Her talk raises a powerful point: It serves no useful purpose beyond belittling the person seeking advice. Remember, we want people to bring their security problems to us and report suspicious things.
Those of you who have read my book may have noticed a running theme of working to see things from other people's perspectives. Yes, it's real work. In fact, Leigh touches on that in her talk as well (if you haven't watched it, you should). I've said it before: the hard part of security is sometimes the soft parts. By that I mean managing our feelings. Sometimes we have to suppress our fear and anger and present a positive face despite what may be a valid emotional response. This is work -- hard work. There's even a term for it - Emotional Labor.
Working in security, especially if you're trying to actively improve things in an organization, takes emotional labor. Many of us are geeks, having worked our way up from the techie trenches to meet the challenge of security work. The term geek itself should tell you something about our innate people skills and our limits on managing our external personas. Nevertheless, these soft skills are force multipliers we can leverage for effective security work done. I've woven practical advice on how to do this into a number of chapters. It's nice to see it called out on its own as a critical success factor in security work. Empathy is powerful in designing security solutions - how would a non-security tech react to what you think is obvious? I'm happy to see there is work now starting to blossom in this area.
Being able to modulate our own external outputs is critical not just in social engineering, but in being heard and acknowledged by others. Yes, listening to the other person before delivering your advice levels up your ability to create meaningful change.
As I said, none of this is easy. But it's definitely worth checking out.
No comments:
Post a Comment