Tag: leadership

Sometimes you need a who, A what, no – a who, oh ok 

It always surprises me when I meet a novice or someone who is new to a field or new to a role and they are embarrassed to ask for help. Even worse is when they are afraid that receiving feedback and being less than perfect is a sign of failure or ineptness. I always just want to say, hey let’s go grab a coffee and talk. And in that talk, I would explain to them that when you are new at something it is unrealistic to expect to know how to do the work, the task, etc. without help or in a perfect way and to think otherwise is putting so much pressure on themselves that I can’t understand how they cope.  

When you are first starting an endeavor, you often need a who. No, not a what – a who. As John Strelecky wrote in his book “The Why Café” we often need a Who, a person who already has the skills and knowledge in an area to help us, if we want to become competent in a new endeavor. But here’s the thing, the same person who will get scuba lessons, take pilot lessons, go to a music teacher, etc. Is the same one that will take a new role in their work career and decide that they need to figure it out on their own because if they don’t folks will think they are not capable or that they are a failure.  

So here is my advice. As a novice or someone who is new to a field or a role, it is perfectly normal to not know everything and need help. In fact, it is crucial to seek guidance and feedback, especially at the beginning of a new endeavor. Don’t be afraid to ask for help and seek out a “who” – someone who already has the skills and knowledge in the area that you want to become competent in. It is important to recognize that expecting perfection without guidance is unrealistic and can put an enormous amount of pressure on yourself. You may find yourself struggling to cope with the expectations that you have set for yourself. Just like how you wouldn’t try scuba diving without lessons or attempt to fly a plane without first taking pilot lessons, you should not expect to know everything and be able to succeed in a new role or field without seeking help. It is okay to ask questions and learn from others who have more experience. Remember, asking for help is not a sign of failure or ineptness. In fact, seeking feedback and guidance from those with more experience can help you learn and improve much faster than if you were to go at it alone. Don’t let the fear of appearing incompetent prevent you from seeking the help you need to succeed.  

So, go ahead and ask for that coffee meeting with a more experienced colleague or mentor. You might be surprised at how much you can learn and grow from the experience. #seekcoaching, #becoachable 

Small and Medium Size Organizations at Risk

The bad guys are now starting to target mid-tier companies with their hacking activities.  In many cases these companies have not yet come to realize that having a Certified Chief Information Security Officer (C|CISO) or a Virtual Cerified|CISO (vC|CISO) is something that needs to be accepted as a part of doing business.  The recent Presidential report on how Cyber Attacks impact the economy of the U.S.A. makes it clear that the cost of having a security expert on staff or on retainer is well worth it if the smaller company wants to remain in business.  Cyber crime is putting many of these smaller companies out of business simply because they cannot recover from the post breach losses.   At the same time these companies may not have the dollars to pay for a full time C|CISO, so their alternative is to explore the vC|CISO concept.  The vC|CISO model can be leveraged to effectively manage security risk for small to mid-tier companies.

If a company is going to explore the hiring of a vC|CISO they need to make sure to do their due diligence and ask about the certifications (such as the one in the graphic below) and experience of the vC|CISO they are going to have giving them advice.  While there are a lot of good vC|CISO options available there are just as many vendors and security professionals touting themselves as vCISO’s who lack the background or experience to be of much help.  I lack quantifiable data on this point but I would say you should expect to pay between 3 and 400.00 per hour for a vC|CISO, the good news is you can choose what % of their time you want them to work for you (10%, 20%, on retainer, etc.) and then only pay for that portion of time.

Certified CISO

The Office of No, Really?

No  Successful ransomware attacks are at an all time high, we are losing the cyberwar, cyber criminals are making more money than ever before and it is only going to get worse, a cyber attack could be as damaging as a nuclear war – the headlines abound with comments such as this.   Yet, there are still a lot of postings about how information security should not be the office of No.   Really?  Information security is a security function,  as an information security professional are you really going to say – Yes, sure, go ahead and port that un-scanned software code into our production environment?  I would hope you are going to say no you cannot port that un-scanned software code into our production environment.  No is not a bad word, it is one that the job requires us to say.   If you are offended when someone says you are the office of No- don’t be.  To be a security professional no is a good response.  I train my team members to say “yes, but” in order to soften the perceived impression of the word no …..  (here’s a clue – “yes, but”  is still a no – no matter how you spin it).

However,  I have yet to sit in a business meeting and see any of my peers simply say no without being willing to engage in dialogue that would lead to a good and secure solution.   So for those who don’t like to say no then do it this way – yes you can put that server with 2 catastrophic exploitable vulnerabilities into the environment after we help you remediate the vulnerabilities or work on additional adequate controls that will allow us to use the server in a safe and secure manner.    For me, information security professionals can and should say no,  but after doing so we need to be helpful and smart enough to engage in conversations that help the business figure out how to do what they want to do in a way that is cost effective, safe and secure.

In many ways with the types and amount of successful attacks we are experiencing across the U.S. infrastructure being the office of Yes is a far more scary response than saying No to items that put your business at risk.

A Note I Wrote to Someone Who Once Worked for Me

I recently had the honor to help provide a strong reference for a person who worked for me as a Cyber Analyst.  She got the Senior position she was going for but was just a little worried about what they should do in order to lead a team and be a good leader.  Here is what I related to this extremely competent future Cybersecurity leader.

Hi:

First and foremost – you are going to do great in your new role. I encourage you to model your leadership style after the following rule(s):

Use the leadership model of:
Am I doing the right thing
Am I doing it for the right reason
Am I doing it at the right time
Am I doing it in the right way

This is on the back of the Challenge Coin I had made up for our UC team.

Always act with Integrity and walk your talk. You don’t always need to be right but you always need to be honest with the people you lead.

Remember that “We are smarter than Me” and foster healthy discussion and debate on topics. Try to pull ideas and suggestions from those you lead who are more on the quiet side. Don’t let aggressive Type A personalities (like me) dominate the conversation.

When coming out of a meeting get your team members used to doing a 5 minute feedback session (what did we do right, wrong, what should we (or I) have done differently, etc. Remember – Feedback is a gift.

Training of your people needs to be a priority and always remember to help others be Greater Than Yourself. There is enough success out there for everyone, help grow your people so that they can be your boss some day and if that did happen they would be a good boss to work for.

Don’t hesitate to email if you have specific questions. Have confidence, breath deep and believe in yourself – you got this!