Category: Personal Reflections

Forget for a minute that the phrase ‘strategic patience’ was coined over the US’s political approach to North Korea, and consider the actual concept.

In its basic terms, it means that you do very little to actively influence something in the hope that’s it’s already heading in the right direction, and will get there in its own time. Further, if you actually DO get involved, you will potentially prevent the desired goal.

For example; How many times have we cut off our noses to spite our face in forcing an issue? From trying to get someone to go out with us, to getting a raise / promotion at work, to making a sale, I’m sure we have all tried to force something to a point where we actually sabotaged our efforts. Personally, I’ve done all 3, and it was always a long time afterwards before I could work out what went wrong each time;

Me.

In extreme scenarios, trying to push an issue is very much like an ultimatum, in the milder forms, it’s nagging. Either way, people have a tendency to be obstinate in the face of pressure, and you are not likely to get the results you desire. Unfortunately, this does not just extend over one deal – for example  – as you will be labelled in a negative way from that point forward.

There is only one thing in the world over which you can have control, and that’s your own reaction to something. I say ‘can’ and not ‘do’ because the vast majority of us have pre-programmed reactions to which we invariably default. Someone yells at me, I yell back, someone smiles at me, I yell back.  Wait? 🙂

I’m not going to go all neuro-linguistic programming on you and try to STOP you from doing whatever it is you do, but when these defaults involve you forcing a decision from a client (for example), you will eventually lose the client. As much as you would like to think business decisions are made on cold hard numbers/facts, they are every bit as emotional as choosing your personal relationships.

I understand the pressures of selling, but when the sales technique involves someone coming out of their comfort zone, you can only guide, you cannot push. By all means stay in touch, as estimates suggest that 80% of sales are made from the 5th to the 12th contact point, but those contact point can be anything from forwarding an interesting article, to a quick cup of coffee. You do not have to keep reminding them that a decision has to be made. I can assure you they are very aware of it.

Anyone who has ever met me would probably not list patience as one of my virtues (or humility for that matter), and it has taken me a long time to get to the point where I can get out of my own way. But the rewards are significant. When your tendency is to assume the worst when you don’t hear from someone, your written and verbal clues, and even your body language can become increasingly unfriendly. You are falling into a self-fulfilling prophecy.

If you’re in sales and you do this, the issue is your pipe-line, not indecisive clients, if it’s in your personal life, you should be taking a long hard look at yourself first, that’s the only thing over which you do have any influence.

Get your CEO involved.

That’s it, you won’t need anything more than that, just get your CEO to take security seriously and everyone else beneath them will too. It does not matter if they actually CARE, but knowing that the CEO is watching you is usually enough to motivate every layer beneath them. Unfortunately, most CEOs either have no idea that they have this power, are too busy to give it a seconds’ thought, or are too arrogant to waste time on something so mundane.

You just have to look at human nature to understand why CEOs lack this particular vision; They ARE human, with all the usual faults, weaknesses, and insecurities. The only difference is that they happens to be in charge. They focus on what they know well and avoid the things with which they are either unfamiliar, or crap at doing.

Just like us.

What this means is that every organisation focuses on the things that mean most to the CEO. That’s fine, and the natural order of things, but it also means that the things that are equally important – sometimes even more so – get less attention. A CEO focused on innovation and not customer service will fail every bit as spectacularly as a CEO focused on profit and not the security of the data that is the foundation of it.

The thing that most people forget is that the majority cost of security is not capital (technology etc.), it’s the people who end up costing you more. From the wasted effort endemic to the reinvention of the wheel for every simple process, to the gross inefficiency of ‘Doing the way we’ve always done it.’, to the cleaning up of the mess after things have gone badly wrong, the people-element is where the good money is thrown after the bad.

And it’s all so simple. If you accept that it’s the CEO who sets the culture of an organisation, from the policies, to the priorities, to the direction, then they have the power, in a ridiculously easy way, to stop the waste. When the vast majority of security itself is also people and process driven, all the CEO has to do is pay a little more attention and these things become second nature to everyone within a remarkably short time.

Think of it this way; If your boss could not care less about something, how much do you care about it? Now imagine that from the very top down. Every time I’m at a new client the security program is a constant battle of middle-management trying to manage up. Unless the CEO manages down through his Executive Team (C-level), who in turn enforce culture at the department head level, no-one is going to do anything new.

So why not just title this blog; “Want to be Secure, Ask Your CEO to Help?” Be honest, would you have read this far, or, more likely, did the saving money aspect get your attention? You think the CEO is any different?

The greatest challenge we have in security is trying to talk the language of those in whose hands our success depends. Talk security or even compliance and you’ve already lost them, but talk increased efficiency, reputation protection, business transformation, or even financial control and you have a better chance of turning their heads.

But only from the top down.

I have already written on the myriad business benefits of a security program done well (How Information Security & Governance Enable Innovation, Security Done Well, The Ultimate ROI), but shockingly enough my 58 followers have not been able to change the industry as I had hoped. [embarrassed silence]

What I would like to see however, is every middle-manager in charge of a security program draft a email for their CEO to send out to the entire organisation, in which s/he stresses just how important security is to him/her. I think you’ll be amazed at just how much more receptive people will be to your security concepts.

IT and IT Security are here to enable the business, nothing more, but it’s usually the business that lets the side down.

For those looking for a considered, well researched, and unbiased post on the ACTUAL evolution of privacy, you will be disappointed. This is an opinion piece based on my own theory of WHY people want privacy as much as they do, and whether or not they truly understand its implications. Well, my interpretation of those implications anyway.

I do not believe human beings to be either civilised, or that intelligent. We’re heading in that direction, but need to get out of our own way first. From a continued reliance on religious dogma, to a universally accepted misunderstanding that we are more than just another mammal, to the overwhelming prevalence of ignorance, we are no closer to any form of enlightenment than were the people ~1,000 years ago in what we call The Dark Ages. 1,000 years from NOW we will be seen as The Dark Ages – Part II, and you just have to read the news each day for a hundred examples of why.

So what are the benefits of privacy? Why did we evolve the concept of privacy to the point now where it’s a Human Right ratified by the UN as Article 12; “No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks.”

As far as I’m concerned, the only reason for this is that NOT having privacy puts you or yours at some kind of risk. Regardless of our sentience, we ARE just animals, and subject to the exact same primal urges as every other mammal. The need for food, water, sex etc. are at the base of Maslow’s Hierarchy of Needs, but security of body, family and property is only just above them.

If we had truly evolved as a society to the point where these basic needs are provided, there would be little need for privacy. If we didn’t go through life knowing that our ‘secrets’ could be the cause of ridicule, alienation, resource loss, or even physical harm, then the requirement to keep-it-all-to-ourselves would be unnecessary. But we are still in the position where the bad outweighs the good, and the ignorance perpetuated through religion, sex / sexual orientation / colour biases, and political doctrines ensures that these fears are far from unfounded.

The challenge we face is that privacy is one of the biggest reasons we HAVE a perpetuation of ignorance. Human nature does not fall on the side of trust, what we don’t know scares us. At its mildest form, this mistrust keeps us from having as many friends as we’d like, at its extreme, we end up trying to destroy what don’t understand.

All human interaction is based on one thing; trust, and no-one trusts words, only actions. For example, if I was to open my life up to detailed scrutiny, then recorded the results of that scrutiny in a way that’s irrefutable, everyone who ever met me, for any reason, would know exactly with whom they were dealing. My values, level of integrity, likes, dislikes, aspirations, biases and so on would be my permanent and openly available CV/resume. Business partners, employers, potential friends, ANYONE would be able to make a fairly immediate decision as to whether they wanted to proceed. Even if they didn’t LIKE what they see, which is entirely possible, they’d still know enough about me not to be scared of the unknown.

If nothing else, it would save a great deal of time never talking to someone with whom we fundamentally disagree, or whose personality is one we would find offensive.

Finally, if we all have the right to privacy, then NO-ONE has the right to complain about those with bad intentions using it to cause harm. Until Human Rights are a currency – which they should be – our evolution as a species will be stunted by fear, uncertainty and ignorance.

[If you liked this article, please share! Want more like it, subscribe!]

Who has seen a “Zero Malware Guarantee“, or something like it?

More to the point; who saw this and thought what a load of bull$#@?

Anyone who knows even the most basic aspects of information security knows that the ONLY guarantee is that nothing is safe. Ever. To throw out a word like guarantee is nothing except the most despicable attempt to drive business in a field where the experts are SUPPOSED to be trusted!

What is the guarantee?; “…to detect and stop 100 percent of malware that propagates over the web and is scanned by the [blah blah] Managed Anti-Malware Service“. Could this ‘guarantee’ be any more pointless? Who wrote this? Lawyers?

What’s worse, here’s what you get if they fail to detect and stop 100% of the malware; “…one-month extension of the service at no cost, up to four times per year.“.

Seriously? It didn’t work, but you get one more month for free? And why would you possibly need to do this FOUR times in a year? Would you seriously still pay for the service after a second failure, let alone a third?!

Doctor to dying patient: “The drugs we gave you aren’t working, but here, have some more on the house.”

Surely if the product is that good, this vendor and vendors like them (there are many) should WARRANTEE their products. “If we screw up we’ll pay for the fix AND give you your money back.” Now THAT’S something I can get behind!

You can guess how often that will happen.

The reason this is so offensive to me is that security is already seen as something to spend money on only because you have to. Like insurance. And this crass commercialisation of yet another security PRODUCT just makes everyone in the information security field look like ambulance chasers. Incompetent ones at that.

Eradication of malware (as in the above example) STARTS with policy and procedures, continues on with parallel efforts in security awareness training and control definition, and is maintained by a security program done well. Just like every other aspect of security. So the only reason security companies keep coming up with these snake oil ads is because people keep buying stuff from them.

Don’t. Do. It.

I can empathise with organisations struggling to understand security and buying what they think is the right thing for their business. What I cannot even begin to condone is any organisation selling something TO those organisations when the seller damned well DOES know better!

You never need guarantees in security, you only need appropriate security. You can start by avoiding any organisation that begins with making empty promises.

[If you liked this article, please share! Want more like it, subscribe!]

I’ve heard similar phrases to the blog title my whole life, most of which are part of some sickly sweet – and more than a little trite – life-confirming, motivational poster. The kind that usually have kids hugging, or a kitten, or kids hugging kittens.

For some reason, hearing it again during the movie “Her” made a much deeper impact, probably because the movie itself addresses human emotions in a way that is different to anything I’d ever seen before, but perfectly captures something that I have contemplated at many times in my life; emotions are not tied to reality.

It’s not a spoiler, but the main character falls in love with an operating system. Yes it helps that it’s the voice of Scarlet Johansson (the visual certainly does anyway), but nevertheless, she is an artificial intelligence that achieves a simulacrum of humanity, including emotions, and even attempts a more physical demonstration of her feelings.

The point of this blog is not the movie (which is absolutely stunning), it’s that we do something very similar every day. Not to the same extent clearly, but how many times do we invent intricate stories behind some perceived slight that makes the offending party out to be some kind of jerk?

“How DARE they drive slowly in the overtaking lane, they KNOW I’m behind them and are doing it on purpose!?”

“They didn’t return my call, obviously they don’t respect me.”

“The team did not invite me out to lunch, they are probably talking about me!”

On the other hand, how many times have we confronted the offending party/ies about this just to find that they have no idea what we are talking about, and either have a perfectly reasonable explanation for the assumed slight, or are genuinely sorry to have caused us pain unintentionally?

Yet the pain is still there, isn’t it? And we still judge them harshly, sometimes for a significant time after the event, don’t we?

And some of us never forgive.

It does not matter to us humans whether or not the cause of the emotion (love, fear, hate etc.) is real or not, the brain reacts the EXACT same way. From initial reaction to the stimulus, to the retention of the long term memory, real and unreal are identical. WE create the story of every aspect of our lives, and unfortunately we also tend to defend those stories even in the face of all evidence to the contrary. Some call aspects of this ‘faith’, I call it excuse to stop thinking, regardless of the subject.

Anyone who has fallen in love with you for whom they WANTED you to be is no less hurt than someone you intentionally fooled. The responsibility shifts, but the results are the same; they get hurt.

Add to this that most people will naturally assume the worst, not the best, and you have the recipe for a long line of stressful encounters. For example, when was the last time someone was late for a meeting and you assumed they had just won the lottery? Each of these negative stories we invent just reinforces the previous ones, and before long, we are looking at all situations and people through sh!t-coloured glasses.

People who tend towards the judgemental are constantly comparing others actions to their own, and as a result of those actions failing to meet the required standard, create negative stories about people they barely know. Combine judgment with an unforgiving nature and you have a person surrounded by enemies. All in their own minds.

I have no solution for this, I do it myself constantly, but being AWARE of my tendencies has allowed me to be far more flexible, and that can only be a good thing.

[If you liked this article, please share! Want more like it, subscribe!]