Category: Career Advice

I don’t necessarily mean faith as it pertains to religion, although that is by far the best example of how faith can completely negate ever having to think for yourself. Ever again.

When I talk about faith, as defined by; “A complete trust or confidence in someone or something.” you can perhaps see where faith can be a force of tremendous good, or horrific bad. When you remove the need to question something, you remove any reason for that thing to change. When your most valuable asset; your ability to reason, is subsumed into a concept not of your making, you have lost your individuality, your uniqueness. You have lost your sense of self.

When humans first became self-aware (estimated at around 60,000 years ago), the number of things to fear rose exponentially. Animals don’t fear an eclipse, but humans managed to attribute countless negative interpretations to this natural phenomenon. With self-awareness comes both the need for rationality (a reason for something), and the trait that I think truly defines us most as human;

Curiosity.

When you are absolutely certain of something, you can effectively ignore it; I have absolutely faith the sun will rise tomorrow or why would I bother getting out of bed? I have absolute faith that my wife loves me or why would I be with her?

The difference between the above paragraph’s examples, and faith in religion (for example), is both tangibility and direct experience. The sun has come up every day I’ve been alive (except the few days I spent in Scotland), and I’ve been with my wife for 10 years. That’s proof enough for me. But what if I base my faith on a concept that has only been passed on by others? Or out of a book? What does that do to our thinking? In some cases clearly not much, but some of the worst horrors in history have been perpetuated based on interpretations of words written centuries before.

And what happens when such thoughts becomes mandatory? When not having the same thoughts becomes a valid reason to violate the rights of others. Again, this is not just religion, but science and even sports aren’t immune from unshakable faith. Scientists and fans alike have committed atrocious acts because in their mind the victims were so wrong that their very lives were forfeit.

It’s a combination of things that keeps this destructive force self-perpetuating; from bigoted parents teaching their kids to hate, to inflexible older generations unable or unwilling to adapt, to a general unwillingness to admit when you’re wrong. Hiding bigotry against sexual orientation behind the bible, racial bigotry behind past atrocities, and murder behind a God all have their roots in the natural byproduct of misplaced faith; ignorance.

I have no answer for this, all I can do is not be part of the problem. Life is not fair, life just is, and YOUR life is what you make of it. That fact remains that it is already difficult enough to find sufficient happiness to make the life you have worth living without making it difficult for yourselves by hating, and hurting everyone around you by your selfish actions.

Believe in whatever you want to believe, just leave the rest of us out if it.

[If you liked this article, please share! Want more like it, subscribe!]

I had the honour of presenting at an ISC2 London Chapter meeting a little while ago, and my chosen subject was ‘Mobile: Changing the Face of Identity Management (IM)’. What I thought was going to be half an hour of me espousing my ideas (or ranting, depending on your point of view), turned into the most lively debate I have ever had in front of an audience.

Initially I wondered if my 10 slides was going to be enough (although I never actually read to the material), but I didn’t even make it past slide 7. By the time I was on slide 5 the questions started, then the dissenters chimed in, and by the time I reached slide 7 the presentation was forgotten. My 30 minute slot was over before I knew it, and it was clear a lot of people had a LOT more to say, which they did over beers afterwards.

The culmination of this discussion was when I heard the following; “I don’t agree with ANYTHING you are saying!”, which for a lot of people (especially ‘expert’ presenters) can be the cause of anger, considered a challenge, or can even cause outright panic. To me it should only ever be the cause of curiosity; WHY am I wrong? I certainly don’t think I am, and probably still won’t after I hear your explanation. I’m curious nonetheless.

But what I will do is hear what you have to say as objectively as I can, and respond as neutrally and I can. Usually without much success mind you, we are all very attached to our opinions, but I will at least try.

Presenters are supposed to be experts in their fields, otherwise why the Hell are they on stage, but that does not [necessarily] make them right, especially when the subject is focused on future-state concepts as opposed to subjects which are long established. I have no idea where Identity Management will be in 5 years, but I have a rough idea. Also, my ideas are also right for ME, but I am decidedly on one side of the privacy challenges that surround the field of identity and privacy like a miasma.

I guess in the end you must decide for yourself if you want to be a lecturer, where your subject is not really up for debate (like when I train groups in PCI for example) or a presenter, when your ideas must be open to not only comment, but potentially ridicule. I have to admit, it makes presenting is a lot more fun, and if I only have to produce 7 slides to get an audience engaged, then I have a lot less work to do! 🙂

The lessons I learned in that presentation will stand me in very good stead for the next one, and who knows, maybe I’ll even finish all 10 slides.

[If you liked this article, please share! Want more like it, subscribe!]

There are some things in life that you assume everyone must know by now; give a firm handshake, never accept credit for someone else’s efforts, never be rude to waiters and so on. Yet so many vendors in the information security industry fall foul of an offence far worse than these.

They use phrases like:

  • 100% secure
  • Unbreakable
  • Completely safe
  • Fraud-proof
  • Hack-proof
  • and so on…

The fact remains that NOTHING in information technology is 100% secure. Nothing. If someone wants it badly enough, and they have the necessary skill-set/support, they are going to get it, and anyone who espouses differently should find another line of work before they cause any[more] damage.

And it’s all so unnecessary. You don’t need 100% security even if it was possible, what you need is security ENOUGH. The bad guys are lazy, and if you’re too difficult to breach they will move on, so just ‘build your fence higher than your neighbour’s’ From what I’ve seen in the 15 years I’ve been consulting across the globe, this should not be too difficult.

The calculation you have to make is this;

If the Cost of Security > Value of Data = do what you can afford and no more, OR, if the Cost of Security < Value of Data = do it, but do only what makes sense.

So what process magically gives you the answers to this equation? Easy, the Risk Assessment. One of the most basic tenets of a security program done well, and one of the most under-utilised business tools in every organisation I’ve helped. A risk assessment process performed appropriately will tell you what you’re not doing well, how to fix it, AND how much to spend on doing so.

But I digress.

I can actually empathise with organisations and individuals trying to sell security. It’s tough, but that’s no excuse for lying about your products, and that’s exactly what you’re doing if you claim 100% security. Lying. You have a responsibility to your customers, and whether you like it or not, and whether you ARE or not, you are the usually the expert in the room (if you know 1% more than the other person you are the expert). Your client came to you for help, it’s up to you to provide what they NEED, not necessarily what they asked for.

Your credibility as a provider of information security services or products goes hand-in-hand with your integrity as an organisation and/or individual. Think of your integrity as a form of currency; you can either invest it in your credibility, or spend it on quick wins. Only one of these has a long-term future.

I will note however that if you’re a buyer of security services, you have as much responsibility as the seller to buy only what you need. YOU must ask the right questions, and the only way you can do that is to either do your homework, or hire someone to do it for you. Never expect a salesperson to think twice about giving you what you ask for, then charging you again for providing what you should have asked for in the first place. This scope creep is your fault as much as theirs.

This white paper is not how to sell, I can’t do that, this is how I think you sell with integrity; How to Sell Security

The title alone will severely limit the interested audience, as the 11 Plus is a concept that even at its ‘height’ was restricted to England and Wales.

The premise was that children in their last year of primary education (aged 11 – 12) took a test to narrow down their options for their secondary education. The better they did on the 11+ the more choices they had. I wish I had ‘failed’ mine way back in 1978, going to an all boys school absolutely sucked.

A friend of mine’s daughter had recently gone through the process, and like me he was amazed at the questions being asked. This was not a straightforward maths/english/reasoning test, this was a test of character that put to shame my interview techniques as a Senior Manager in charge of adult security consultants. Should I be unfortunate enough to ever be the manager of people again, I will be using these questions:

Why should you get priority over other children for a place in this school? – How would YOU answer that question, or what answer would you be looking for?! Say the wrong thing and you’ll come across as arrogant, insecure, indecisive, desperate, disinterested or a combination of several of these.

List 3 things you are good at or like doing. – Generally speaking, people like doing the things they’re good at and dislike things they aren’t. Sadly most people don’t KNOW they’re bad at something, so a question like this can help weed out the humble from the potentially deluded.

What is the most exciting thing that has ever happened to you? – Personally I would dismiss anyone saying anything about work. Passion for your chosen career is one thing, but someone without other interests is to me rather suspect.

Is there anything that I haven’t asked you about that you would like to tell me? – This one’s a doozy! Do I say no and let the person think there’s nothing more to me, do I say something and perhaps come across as trying too hard or do I ramble on because I’m nervous and end up boring the hell out the interviewer?

The above were good, but the next one was to me astounding;

Is life fair?

Bear in mind this is being asked of an ELEVEN year old, but now think about the answer you would give. No it’s not fair is whiney, yes it is fair is delusional, which leaves the only real answer; life is neither fair nor unfair, it just is. It is surprising just how many people cannot accept this.

Life is what YOU make of it, so any answer outside of that speaks volumes to the person you’re interviewing. If they consider life unfair then they are clearly not taking full responsibility for their own actions, anyone who thinks life is fair has likely never been truly tested and makes the following quote rather appropriate;

“I’ve never met a strong person with an easy past.”

Experience is one thing, you can read that on a person’s LinkedIn page, character is something else and rarely glimpsed during the interview process. Perhaps by asking questions we would ask our own children we can change that.

Unless by some ridiculous twist of fate you’re Novak Djokovic, Lionel Messi, or Steven Hawking (and their like) reading this, you are not the best at anything. Perhaps like me, even if you had spent your entire life practicing one thing you still would not have been the best.

Nor do you have to be.

World-class talent is exceptionally rare, but we humans have the unfortunate habit of holding ourselves up for comparison to these unique few. How could we possibly come up anything other than short?

A single skill or talent (see Choice: Love What You Do, Or Love Doing What You’re Good At?), properly developed, can take you far …IF you’re very good. But it’s the combination of your skills and talents that will enable you to excel at a far greater array of your life choices.

No-one, I mean NO-ONE can be you better than you can.

The challenge is; Who ARE you? What are your skills, your talents, your likes, dislikes, even aspirations? A disturbingly large portion of us spend our whole lives without answers to these questions, and we die never having achieved a fraction of our potential. Not someone else’s opinion of our potential, but our own sense of happiness and self-worth. Our feeling of achievement for a life that made a positive difference. At least to someone.

We have all come across people we simply can’t believe haven’t been fired yet, and we have all met people we are amazed are not doing significantly better. In my mind they have both committed the same ‘crime’; they have failed to understand themselves. These examples came from different angles, but the results are the same; neither is doing what they should or could be doing with their lives.

While I absolutely believe you must leave this life with regrets (A Life Without Regrets is a Life Without Mistakes) doing a poor job or never doing a great job should not be among them. Others can help – and usually love to do so – but only you can choose the right path.

There is a good chance I can beat Djokovic at darts (and perhaps several other non-athletic endeavours), and I likely know a lot more about payments security than Hawking. We all make our OWN choices in life, I am where I am because of mine, so why should I ever compare myself to them? Or to anyone else for that matter.

No, I have no-where near their money or their fame, but if I was to measure my life by those standards I have a lot more issues to address first. I am very good at what I do, but equally important, I know when I’m out of my depth. Like most people, I will never know EVERYTHING I’m good at, but I am self-aware enough to know when I should keep something going, or let it go entirely.

I have no problem being fired for being too opinionated, I would very much object to being fired for incompetence, but they are both very much my responsibility.

With self-awareness comes true personal accountability, only then can the regrets you have be the kind you want.

[If you liked this article, please share! Want more like it, subscribe!]