Author Archives: Joshua Goldfarb

Security for the Ages: Make it Memorable

Posted on by

Those of us That Spend our Lives in Security Sometimes Forget How our Field Looks and Sounds to Others

Recently, on way to work, I heard the song “Mr. Jones” for the first time in years.  For my younger readers, this Counting Crows song was quite popular when I was in High School.  I found hearing this song again after so many years fascinating. Why? Because I still knew every word of the song.

Whether or not you are a fan of the song, you are likely asking yourself what this could possibly have to do with security. That’s certainly a fair question. To understand the connection here, we need to ask ourselves why I still remember the words to this song after all these years.

In my opinion, the answer to that question lies in the fact that the song was fun for me. For whatever reason, it found favor in my eyes.  I internalized it. I heard a lot of songs in the 1980s and the 1990s. But the number of songs from that period whose lyrics I still remember is relatively small.

We can learn a lesson from this in security. Those of us that spend our lives in security sometimes forget how our field looks and sounds to others. When presenting or discussing our work, it’s important to focus on how that message is received and internalized by the people on the other side of the conversation.  Let’s take a look at ten situations in which we can leverage this powerful lesson.

Making Security Memorable1. Conferences:  I’ve sat through a fair number of conference talks in my life.  Some have been better than others.  Know your audience and stay focused on what will resonate with them and/or help them understand what you’ve been working hard on and the value it provides to the greater security community.  The best talks are those that people still remember after a year or two has gone by.

2. Board:  In previous roles, I’ve had a few opportunities to present at board meetings.  What I took away from these encounters is the extremely high level at which the board thinks about risk.  It’s incredibly strategic and miles away from tactical.  Something to keep in mind when formulating your board presentation.  Your job is to get the board’s attention and cause them to focus on what’s important, not to overwhelm them with details.

3. Executives:  While perhaps not as high level as the board, executives are still pretty high level. Tactical mumbo jumbo will put them into a trance. Best to tune your message to the audience and ensure it will resonate and stay with them. For example, if you need to make the case for additional budget, try doing so in the language of mitigating risk to the business and return on investment.

4. Team: Your team needs to have a good idea of where you’re going and what you expect from them. The message needs to articulate that clearly in terms that are meaningful to the broader team. You want the message to stay with them and for them to be thinking about the organization’s priorities when approaching different tasks each day.

5. Stakeholders:  In order for any security organization to be effective, it needs to work collaboratively with the business. The way the business thinks about risk, however, will be different than the way the security team does. And, of course, the business’ primary focus is on, well, the business and the revenue it brings. The savvy security team will take care to communicate in terms that the business can relate to.

6. Customers:  Your customers likely want to understand that you take their data and privacy seriously. But have you thought about how you can best communicate that in order to allow them to internalize it?  It might be a different message than you would normally go with.  Focus on how you protect what matters most to your customers – likely their sensitive, proprietary, and confidential data.

7. Peers: We all benefit from peer interactions. People who understand what our day-to-day professional life is like, the challenges we face, and who run in our circles. We can bounce ideas off of them, brainstorm together, and share information. With our peers, it is better to give than to receive. Those who are generous with ideas, time, and and information will be first of mind when a peer has something to pay forward.

8. Clients:  If you are a security consultant, how do you sell your or your firm’s services to potential clients?  Do you talk about all of the skills and capabilities you have?  Or, do you talk about how you can address the problems and challenges that the client may have in the language of the client? I will leave it to you to decide which approach is generally more effective.

9. Insurance:  Cyber insurance is becoming a hot topic. While the field is still in its infancy, insurance companies are beginning to take an interest in how they can more appropriately assess risk. As you might guess, the insurance industry looks at assessing and quantifying risk a bit differently than we might be familiar with as security professionals. Keep that in mind when communicating to them how you minimize, mitigate, and manage risk. Make sure to tailor the message to the audience.

10. Vendors:  As an enterprise, you likely understand that your supply chain can introduce risk into your overall information security posture. Assessing, measuring, and tracking this risk over time is an important part of managing third party risk. It’s important to communicate your security priorities clearly to ensure that your vendors understand what keeps you up at night and how they can address your security concerns.

Joshua Goldfarb (Twitter: @ananalytical) is an experienced information security leader with broad experience building and running Security Operations Centers (SOCs). Josh is currently Co-Founder and Chief Product Officer at IDRRA and also serves as Security Advisor to ExtraHop. Prior to joining IDRRA, Josh served as VP, CTO – Emerging Technologies at FireEye and as Chief Security Officer for nPulse Technologies until its acquisition by FireEye. Prior to joining nPulse, Josh worked as an independent consultant, applying his analytical methodology to help enterprises build and enhance their network traffic analysis, security operations, and incident response capabilities to improve their information security postures. He has consulted and advised numerous clients in both the public and private sectors at strategic and tactical levels. Earlier in his career, Josh served as the Chief of Analysis for the United States Computer Emergency Readiness Team (US-CERT) where he built from the ground up and subsequently ran the network, endpoint, and malware analysis/forensics capabilities for US-CERT.

sponsored links

Continue reading Security for the Ages: Make it Memorable→

Security Practitioners: 10 Signs You Need to be More Direct

Posted on by

Conflict isn’t Pleasant, But Sometimes it Can be Healthy and Necessary When Done Properly and Respectfully

Living and working in different cultures gives you a broader perspective across a variety of different areas than you might have attained otherwise. It is one of the things I am most grateful for professionally and has taught me to appreciate that each culture has its own advantages and disadvantages. There is one particular aspect of some cultures that I think we in security can learn a lot from.

Which cultural aspect am I referring to?  Directness. Those of you who know me know that I am very direct and that I am a big proponent of directness.  Directness is something that some cultures do better than others.  So how can we as security practitioners identify areas in which directness can help us improve? I present: 10 signs you need to be more direct.

1. Bad ideas hang around:  I remember watching the challenger explosion on television.  After the investigation, groupthink was found to be one of the reasons that the launch was allowed to go ahead, despite known risks.  People were simply afraid to state their concerns directly.  While the stakes are certainly lower in your security organization, the principle holds true.  If people are afraid to be direct, it often results in bad ideas hanging around far longer than they need to.  Whereas in a direct culture, a bad idea can be considered and politely dismissed in a relatively short amount of time, in an indirect culture, it may linger far longer than it should.  That results in valuable resources being spent on activities that don’t provide much value.

2. Good ideas don’t come forward:  In a similar manner, if people are afraid to be direct, it often keeps them from suggesting new ideas.  Perhaps the solution to that big problem you’ve been worried about is found in the thoughts of one of your team members.  But if it stays there, it doesn’t do you any good.

3. The team has no idea where it stands:  Security teams need to know that the work they’re doing adds value to the organization, improves its security posture, and helps mitigate risk.  In order to gauge where they stand, the security team needs to know what success in each of those areas means.  The only way I know of to communicate what success means is to do so directly.  That enables the team to make progress more effectively.

4. Strategic direction and goals are unclear:  Building on number 3, communicating strategic direction and goals clearly and directly helps the team understand where the organization is going and what success means.  Not surprisingly, that clarity will assist the security team in maturing far more quickly and efficiently.

5. Everything is above average – always:  I always love it when I hear people tell me that everyone on their team is exceptional/above average/a star.  Or that the intelligence they mine from their data is world class.  Or that their processes are the most refined and mature in the industry.  I hear this almost universally.  Unfortunately, statistically, this is simply impossible.  Everyone knows that organizations have different strengths and weaknesses.  Try being honest.  I think you’ll find that people will appreciate your candor and will respect you and your organization more for it.

6. Vendors are in the dark:  Is a vendor meeting your expectations?  Or, perhaps they are falling short of expectations?  Are they trying to sell you something that you aren’t going to buy?  Or perhaps they could benefit from some honest, constructive criticism?  Did the initial phone call or meeting with the vendor reveal that we don’t have a great fit here?  Then tell the vendor what you think.  Directly.  As someone who transitioned to the vendor side, I can tell you that trying to guess where you stand isn’t much fun at all.  If we don’t have a match here, let me know, and let us both move on to other things.

7. You don’t reply to email more than you do reply:  Did someone ask you a tough question by email?  Did a vendor follow-up to check up on things?  Did someone ask you to do something that doesn’t make a lot of sense to you?  Reply.  It could very well be that you indicate in your reply that a face-to-face discussion needs to happen around this matter.  Or, perhaps the answer is simply no. But at least do the person the decency of replying directly.

8. Executives get things sugar-coated:  It’s tempting to sugar-coat issues, challenges, shortcomings, and/or bad news to executives to avoid “burdening” them and to make ourselves look better in the short-term.  But most executives I have met want to know about risks to the business, including information security related risks.  Granted, you need to communicate clearly and concisely, and you need to have a plan for action.  But, assuming you have all those things in place, it’s best to be direct.  Sugar-coating things can make things easier for you in the near-term.  But in the long-term, cracks in the foundation will show.  And in the event of a serious security incident, past attempts to sugar-coat known risks will not go over too well.

9. You avoid conflict at all costs:  Conflict isn’t very pleasant, but sometimes it can be healthy and necessary when done properly and respectfully.  Maybe you disagree with someone’s approach.  Maybe you know that a given project will not benefit the organization.  Maybe you feel that a certain problem is at risk of remaining unsolved.  In these cases and others, it’s quite possible that there will be others that don’t see it the way you do.  But if you challenge them or they challenge you, it’s okay to be direct and have a bit of a respectful conflict.  That’s really the only way that both sides can be heard and understood.  Shying away from conflict accomplishes nothing other than to ensure that no one’s ideas get communicated.  Over time, it also teaches people that their concerns will not be dealt with and will instead be left to die on the vine of indirectness.

10. The story keeps changing:  The sad result of indirectness and conflict avoidance is that the story keeps changing.  Life in the security organization becomes a moving target where no one is really certain what they should be focused on or what will add the most value.  Obviously, this is not a great situation for the organization to be in and doesn’t help its security posture.  Directness is the only cure for this as far as I can tell.

Joshua Goldfarb (Twitter: @ananalytical) is an experienced information security leader with broad experience building and running Security Operations Centers (SOCs). Josh is currently Co-Founder and Chief Product Officer at IDRRA and also serves as Security Advisor to ExtraHop. Prior to joining IDRRA, Josh served as VP, CTO – Emerging Technologies at FireEye and as Chief Security Officer for nPulse Technologies until its acquisition by FireEye. Prior to joining nPulse, Josh worked as an independent consultant, applying his analytical methodology to help enterprises build and enhance their network traffic analysis, security operations, and incident response capabilities to improve their information security postures. He has consulted and advised numerous clients in both the public and private sectors at strategic and tactical levels. Earlier in his career, Josh served as the Chief of Analysis for the United States Computer Emergency Readiness Team (US-CERT) where he built from the ground up and subsequently ran the network, endpoint, and malware analysis/forensics capabilities for US-CERT.

sponsored links

Continue reading Security Practitioners: 10 Signs You Need to be More Direct→

All Hail The Ambulance Chasers of Security

Posted on by

Wikipedia defines “ambulance chasing” as follows: “Ambulance chasing, sometimes known as barratry, is a professional slur which refers to a lawyer soliciting for clients at a disaster site. The term ‘ambulance chasing’ comes from the stereotype of lawyers that follow ambulances to the emergency room to find clients.  The phrase ambulance chaser is also used more loosely as a derogatory term for a personal injury lawyer.”

read more

Continue reading All Hail The Ambulance Chasers of Security→