Have you ever left a meeting frustrated that you didn’t get your point across?  Have you ever wondered why other people don’t “get it” when it comes to security?  I certainly know that I have and it was a moment like this that initially caused me to look at the problem differently.  I decided to turn the question around and began asking myself what I was doing that got in the way of other people getting it.

That was about 10 years ago and since then I have learned quite a bit about communicating effectively.  That isn’t to say that I don’t backslide on occasion or that I’m some sort of expert in effective communication.  I’m not but am lucky to know someone that is.  His name is Michael Santarcangelo and if you live near enough to Fairfax, Virginia you have a treat in store for you.

In addition to being a lifelong security professional, Michael is a professional speaker (as in member of the National Speakers Association and not some guy who gets to speak in public occasionally like me).  That means that he has refined the ability to communicate effectively and quickly something that is very important in these days of bullet point meetings and decreased budgets. 

Michael has put together a program to teach others to effectively communicate the value of security and is just about ready to roll it out in an upcoming 15 city tour.  All he needs to do is give it a test run and that is where this amazing opportunity comes in. 

On Saturday July 25^th (This coming Saturday), Michael will be giving a preview of the Communicating the Value of Security Seminar at George Mason University in Fairfax, Virginia.  He has worked with GMU and their Cauldron project to deliver this seminar.  Better still since it is on a Saturday he is offering a pool party and BBQ for the attendees and their families (provided courtesy of Cauldron).  The price is $12.75 per person/family. 

That means that you can pay to attend the seminar and then have your family meet you for the pool party and BBQ for only $12.75.  Now where are you going to be able to feed your family for that price?  I use to live in the DC area and can tell you that you won’t fine anyplace around where you could feed a family of four for under $15.  Even if you consider yourself a master communicator, you can always pick up a tip or trick and at this price can you afford not to go?  The normal seminar will probably be quite a bit more expensive and probably won’t include BBQ and a pool party. 

Check out Michael’s site for a description of the seminar and a link on where you can register.  Please spread the word too.   It is always important to support those in our community that are working to make our jobs easier and Michael is definately one of those.

Okay this week the post is going to be a bit of a cop out.  Things have been a bit hectic around here and while that is a good thing, it is typically just me that can do them.  I know that I have a few series postings that I need to finish up but billable work must come first. 

What I wanted to mention this week is an article out on CSO Online by Joan Goodchild.  It is entitled “5 Steps to Communicate Security’s Value to Non-security People” and is based on an interview with Michael Santarcangelo.  If you recall that I reviewed Michael’s book last week (wow – it seems like that was a month or so ago) and I was part of a podcast put out by Michael’s company, the Security Catalyst. 

Needless to say I’m a Michael Santarcangelo fan and, in the spirit of full disclosure, we’re discussing some collaborative efforts sometime in the near future.  (More on that as we work the details out.)

Anyway – back to the article:  Ms Goodchild’s article is a timely one as it addresses what information security practitioners can do to demonstrate their relevance in these tough economic times.   The article covers the five steps that you can take to communicate effectively and demonstrate your value.  I think that the time that you take to read the article will be well spent. 

I’ll be back next week with my usual long winded posts.  J

I just finished a book by Michael Santarcangelo entitled Into the Breach: Protect your Business by Managing People, Information, and Risk. I am ashamed to admit that I hadn’t run across this book sooner and didn’t know about it until after I was a guest on Michael’s Podcast a few weeks back. At 110 pages the book is a quick read but don’t let that fool you – there is a lot of information in here.

The book is aimed at executives and other decision makers and not at technical information security professionals themselves. That is not to say that there isn’t value in here for the technically minded as long as they remember that they are not the targeted audience. There are a few things in here that might actually cause the technically focused some anguish but if they are honest with themselves and take a step back they should admit that what Michael says is true.

Into the Breach is the book that I wanted to write. I share Michael’s perspective on many of the topics discussed and have come to the same conclusions, although independently. We attack the problem from different angles but we share so much in common that I’m left to wonder if the differences are merely trivial. As I read the book I heard my own thoughts being echoed back to me more than a few times. I found new and interesting perspectives on issues that I have worked hard to solve and I even learned a few things (which means that it was time well spent.)

The book is broken up into three parts. The first part explains the human factors at play in any environment and seeks to provide a understanding of the human factors as they relate to protecting information. I really couldn’t find fault with anything I read in this section.

The second part lays out Michael’s Strategy to Protect Information and its implementation. Michael’s approach to the problem is different from mine but in no way does that make it any less valid. He does a good job explaining not only how something needs to be done but why it needs to be done which is the key to mastering anything. That said I have some constructive criticism to provide with regard to a few things that were mentioned.

The first being that Michael talks about how a management team can learn and deploy his strategy by just reading his book. The concepts that he lays forth are simple and well explained however I can say that I have facilitated groups through similar processes and it is not as easy as Michael makes it sound. The greatest fear that I would have by someone reading Michaels book is that they will try to implement his program without guidance then in failure believe that this approach is just a load of crap and go back to the way they have been doing things. Processes like this need to have someone with experience facilitate their adoption in order to steer teams around pitfalls and ultimately achieve success.

The second criticism is that near the end of Part Two, Michael talks about metrics and how to measure the success of the program. This is indeed an important point however his examples did little to illustrate his point and may have in fact made his argument weaker. He talks about the blending of quantative and qualitative measures (a concept that I’m wholly in favor of) but gives his executive/decision maker reader little to take back that is actionable.

The third part addresses considerations for extending and enhancing the strategy laid out in Part Two. Michael talks about how his strategy can help protect the bottom line and help reduce the cost of compliance. I agree that it will but again the topic was treated so quickly that a reader may be left to conclude that this is all that there is to the argument. They couldn’t be more wrong however would someone in the targeted audience know this – perhaps it would; perhaps it wouldn’t.

Please dear readers, don’t construe my criticisms as a damning critique of this book. At 110 pages it is nearly impossible to cover the topics that Michael has attempted. This book is exactly where it needs to be in terms of detail when considering the intended audience. I applaud Michael for writing the book. It is a book that has been needed out there for a very long time. I highly recommend it. I would even go so far to say that you should buy several copies and give them out to senior executives in your organizations. But only do so if you intend to follow up with several conversations about how to apply these principles in your environment. Use this book as a basis upon which to build conversations on how you can improve security within your organization and environment.

This past weekend I was asked to participate in a podcast for The Security Catalyst, a blog and website run by Michael Santarcangelo.  Michael is a security professional who much in demand on the national speaking circuit and the author of Into the Breach a candid view of how the human factor is the greatest threat and asset to securing information.  A topic near and dear to my own heart. 

I was honored to do the podcast in conjunction with Michael Smith (of Guerilla CISO fame) and Joe Faraone (another close friend, colleague, and contributor to the Guerilla CISO).  Mike, Joe and I worked on a presentation entitled The Authorizing Official and the Accreditation Decision which addressed these topics as a stage of Certification and Accreditation, a process that the government must follow in order to manage and document security practices and controls. 

The podcast addressed these issues as well as some of the parallels between the process and the private sector.  If you are interested in hearing the podcast you can click on the link to the Security Catalyst blog or put

http://tinyurl.com/candapodcast           into your browser.