Magazine menu Close Magazine menu

Author

Nick Drage

Nick Drage is a cybersecurity consultant, helping customers make informed decisions about products and services, and their overall cybersecurity strategy. Nick is interested in how individuals and organisations find, test and create winning strategies in any field, from cybersecurity to American football or Tetris.

Get in touch with Nick

Latest stories by Nick

successful collaborative working

What 20 years of remote collaborating has taught me

  • Leadership
  • min read
    • The future of work is partly or fully remote, especially for tech-led professions. According to McKinsey and Company, more than half of employees want more flexibility from their employers and want to work remotely more than from the office. The pace of attitude change has been fast, even if your usual way of working stayed the same. Effective collaboration is an ongoing challenge for many remote teams. Businesses of all sizes have been known to reach for the next new collaborative tool on the shelf, expecting it to bring minds together for a lightbulb moment continually. Thinking back over my career in cybersecurity, I believe it's not the tools that make or break collaboration. But I have a few ideas on what the critical cruxes of collaboration might be. Let your empathy drive how you work I first worked with others remotely at the beginning of the 2000s. The tech was basic back then: A mobile phone, laptop and dial-up internet. I was giving on-call technical support for an internet service provider's security team. Waking up in the middle of the night to giving out-of-hours support was an abrupt introduction to working with others online. Most people would wake me and launch into a description of an incident ticket, immediately asking questions while I juggled my mobile phone, laptop and coffee cup. But there was one person who'd thought about the person on the other end of the phone. They would call to wake me up, say they'd ring back in five minutes and hang up. It meant I was set up and awake when we started working on the problem together. It made a big difference to my ability to think about an issue in the right frame of mind and not make it worse by being half asleep. Shift the barriers to deep focus For over a decade, I worked as a penetration tester in different teams and companies, either onsite or remotely. I would mimic a cybercriminal and try to compromise a software implementation or do general technical audits, aiming to find as many issues as possible. Often this would be as part of a team. Some organizations I worked for insisted everyone work from the same location, while for others, everyone worked remotely. Penetration testing benefits from seeing someone else's screen and easily sharing ideas around a group. A chance comment by a colleague might give you a clue on your target. But it also benefits from long periods of concentration, learning on the fly and going down rabbit holes without being asked what you're doing. I usually preferred the work-from-home teams. It was easier to talk to a colleague over the phone and email screenshots remotely than to focus intently in a busy office. But for others, having team members close at hand and the feelings of camaraderie were most important. Wherever your team is and what type of people make it up, management must play a crucial role in making sure everyone has a chance for deep focus. University of California's Professor Gloria Mark is one academic asking the price of an interruption. Her paper, The cost of interrupted work: More speed and stress, concludes that distracting someone from their work doesn't slow them down, but means they produce poorer quality work and feel more frustration and stress. Use face-to-face time for what it's best for My last full-time job showed me how the remote work approach is more important than tools or factors like how often staff meet. I was giving technical expertise for cybersecurity product sales. Our collaboration tools weren't great. There was the usual nightmare of email and calendar software, partly integrated with more software for phone calls and text chat. Collaboration was mainly over conference call rather than video. I usually worked remotely, but some of the team used offices shared with colleagues or the wider company full- or part-time (known as hybrid working.) Management also drove the team feeling by continually staying in touch and freely giving both praise and suggested improvements. Physical meetings were infrequent but scheduled. They were both practical and social, giving a chance to get to know colleagues outside text or phone interactions. Colleagues and associated teams made the most of face-to-face meetings. The sales team always made sure they spent time together before and after visits to customers and potential customers. Consider team skill mix and have a driving purpose Recently, I worked with a small team to organize the first game-based cybersecurity conference, Play Secure. It was hard establishing a new conference around a novel theme. And with the conference being entirely online, we needed to ensure it didn't feel like just another set of webinars. For fully remote working with a new team, it went especially well. I think the team's success secret was the right combination of interpersonal skills and a shared sense of mission. We didn't get so burnt out through increased online interaction and were motivated enough by purpose to overcome the limitations of the tools. Use your tools on a strong foundation Lockdowns led to my becoming a fully remote worker, which fits the needs of my customers spread across different time zones. My work is usually intensive with short periods of decision support for customers, then intervals for research and consideration. Projects can have different delivery speeds. You need to adapt to others' work demands and availability and establish rapport over a simple video call. In this case, I think tools make a difference. It's hard to find a positive aspect to the pandemic, but the mass adoption of video conferencing has helped my work. It lets me give timely advice to customers without being limited by travel time and cost. When deciding to go remote-first If you or your team want to go remote-first, think through what has worked for you and what hasn't. Take staff preferences into account. Meeting in person once a week, once a month, or once a quarter can greatly affect team wellbeing and cohesion. It's easier for a distributed team to come together than for an in-office team to work apart and avoid interruptions successfully. With the savings on the costs of office space and time spent commuting, opportunities abound for thoughtful organizations to enjoy the benefits of remote work by forging their own 'new normal.'
diverse team

For a more effective IT security team, hire for diverse perspectives

  • Women and diversity
  • min read
    • Cybersecurity is stuck in a conceptual rut. Security professionals tend to believe if they had more people, technology or budget, their problems would be solved. Those calls for more of everything are sometimes answered, but there seems little correlation between getting more resources and getting more effective. I'm oversimplifying a whole discipline, but as a rule, cybersecurity suffers from a lack of creativity. The benefits of diverse thinking in teams One way to encourage creativity may be to increase the diversity of the people you hire. Diversity is not a strength of the industry; there's much work left to do. Here I consider diversity in the widest possible sense, covering for example race, gender and sexual orientation, but also things like neurodiversity and social background. Instinctively it feels that a wider variety of people and the experiences they bring comes a richer pool of ideas. Scientific studies support it. "If you want to build teams or organizations capable of innovating, you need diversity. Diversity enhances creativity," said the late Katherine W. Phillips in Scientific American, formerly Professor of Leadership and Ethics at Columbia Business School. Her article, based on decades of research, is a treasure trove of ideas, particularly on how diverse groups have better interactions. How to look for diverse perspectives in new hires Some in cybersecurity suggest, to solve the industry's perennial recruitment problem, businesses should look beyond their usual sources for new hires. So what should you look for? Ant Sharman, Director of Evocatus Consulting with a background in civilian and military management and training, says "For me, with my interest in wargaming, I look for people with different experiences understanding situations, seeing threats and opportunities, and coming up with alternative solutions." Diverse experience needn't mean length of experience. With the pace of technological change in cybersecurity and all employees needing to learn fast, that "ten years' experience" expected from a candidate to get an interview may limit a team's potential. Differences in experience can come from, for example, growing up in a different generation. The candidates whose perspectives the team needs may come from backgrounds different than that of the hiring manager. Expanding the skillset within program teams is also a way to achieve diverse and complementary approaches. Jemma Davis, Security Culture and Awareness Consultant at JeMarketing Services, highlights the benefits to a security awareness program team. "Someone from marketing understands how to influence behavior, someone from privacy understands regulation, someone from security understands integrity and someone from IT understands availability." Davis feels you need different types of people to achieve everything you need, as creative people tend not to be good at execution, whereas "doers" focus on getting the task done before considering other options. Combining both, within or between teams, means benefits. Your corporate rivals will be fishing in the same pool to compete for the same people from the same backgrounds. So instead, boost your team's creativity by hiring someone different. This article reflects the opinions of its author.
choosing testing solutions

Four types of security testing and when to use them

  • Cybersecurity
  • min read
    • When it's time to 'security test' your infrastructure, what should you do? Security testing can mean all kinds of things, and it's not always obvious what's the right choice, and when. Here I'll summarize what I think are the four main types of security testing, when to use each and pitfalls to watch. 1.  Vulnerability scanning What is vulnerability scanning? Vulnerability scanning means running automated software that looks for common vulnerabilities in your systems, like a web server that hasn't been patched or misconfigured cloud storage, exposing customer data. Ideally, you give the software a list of targets, set it in motion and wait to get a report listing vulnerabilities and remediation advice. It's not vulnerability scanning that improves your security, but acting on the results. Depending on the scanning software, it may just check your software against lists of known issues, or do something more complex, like a brute force attack: Guessing user credentials and passwords to see if they're secure. When should you use it? Use vulnerability scanning on everything you have that faces the internet (endpoints), like corporate web servers, virtual private network (VPN) endpoints and office internet connections. You can also run vulnerability scans sporadically or scheduled on internal network systems, or as part of your software development lifecycle. When shouldn't you use it? Vulnerability scanning isn't helpful when you want to know how a human attacker would see your infrastructure. What are the advantages and disadvantages? You can run vulnerability scanning yourself, which puts you in control. Or you can have a third party run it for you. While vulnerability scanning is often seen as the "poor cousin" of security testing, I don't agree. It quickly highlights problems you might have missed, like a temporary internet-facing website the development team forgot to take down or the internal user account with an easy password. It helps you tidy up low-level issues at little cost. 2.  Penetration testing What is penetration testing? Penetration testing, or pen testing, can mean different things to different people. I define it as combining automated and manual techniques to look for weaknesses in the target's security posture. A penetration testing team emulates the methods of genuine attackers. How close it is to a real attack depends on the team. They may use the kinds of tools attackers use, or just their techniques, like trying SQL injection on a web interface, when another method might work better. With help from the system administrators, developers and project team, a penetration testing team can do a more cost-effective and useful audit. They shouldn't be wasting time evading intrusion detection systems or trying not to get noticed by your Security Operations Center. If that's the kind of security test you want, see the section below on red team exercises. When should you use it? A pen test should have a tight scope around a new installation, project or area of concern. It must concentrate on the most likely source of security issues for your organization. When shouldn't you use it? Don't use a penetration test to see how your security teams and Security Operations Center would react to a real cyberattack. A penetration test is overt: The system administrators should know it's happening. See it as an "aggressive technical audit" rather than emulating how attackers think and work. What are the advantages and disadvantages? You'll get an attacker's mindset to look at your project, program or installation. It's useful to have someone on your side who sees what you've built as a set of weaknesses and targets. And it's easy to schedule and assign budget for, compared with red team exercises. Results may not be consistent between one pen test and the next. This isn't necessarily a bad thing. If you repeat it or have several pen testers, you may find more issues. Pen testing is poorly defined. There will be penetration testers reading this who define the term differently to me. Do some work before you pen test to make sure there's a shared understanding. 3.  Red team testing What is red team testing? Red teaming, also sometimes called ethical hacking, is a simulation to test how well your people and technology would respond to an adversary's attack. It's hard to find the line between penetration testing and red teaming. I define a red team exercise as an engagement with much wider scope than a penetration test. The scope of a red team exercise could be your whole organization. It's up to the red team how they attack. Agree strict rules of engagement in advance. Red teamers will stay within the law, but you should also address ethics, staff relations and cultural norms before you start. When should you use it? Use a red team exercise when you want to see, as closely as possible, how real attackers would act against you. It's more of an adversarial simulation than pen testing. A penetration tester finds as many weaknesses as possible in the time available to help defenders see issues. A red teamer will only find and exploit any vulnerability they need to, to achieve a goal. If they can get into your internal network through a poorly configured VPN but could've achieved the same through poor wireless security at your remote offices, you may not discover both issues. "Purple teaming" can make a red team exercise more useful. It's when you have an attacking red team and a defending "blue" team. When shouldn't you use it? Only hold a red team exercise when you've done vulnerability scans and penetration tests, and fixed problems found. Otherwise, the attackers' level of expertise will probably overwhelm the organization's defenses, giving no useful insight. What are the advantages and disadvantages? A significant part of a red team exercise is testing defenders' detection abilities. Attackers must be covert, careful and evasive, like a genuine attacker. There must also be clear paths for contact and escalation. You don't want the Security Operations Center concentrating on the red teamers, but missing a genuine compromise. If you need to show stakeholders the breadth of issues to get resources to fix them, a red team exercise tells a compelling story. It will build a picture of how real attackers could work their way through your infrastructure. A red team exercise is not the same as adversarial analysis: Examining a company's way of working or project plan for issues without attack. For a deeper look at adversarial analysis, see the work of Mark Mateski of Red team journal or Bryce Hoffman of Red team thinking. A downside of a red team exercise is cost. The people involved are specialists with skills and tools that need constant maintenance. They use methodology that encourages slow, careful work. All this affects the day rate. 4.  Bug bounty programs What are bug bounty programs? Bug bounty programs see companies offering a reward to those who report specific vulnerabilities in parts of its infrastructure within a given scope. The programs may be by invitation only or open to anyone. When should you use it? I would only run a bug bounty program after running and responding to the results of at least two types of tests already mentioned. Get an expert to determine the scope and rewards, and how to run it. When shouldn't you use it? A bug bounty program might distract staff and give you more reports than you can use if your organization is still working out how to deal with penetration tests and red team exercises. What are the advantages and disadvantages? All other testing methods are paid on effort rather than results. Your organization may be mature enough that other options aren't what you need. Bug hunters follow some of the same steps as an attacker, so their judgment on what's worth attacking and how may be close to a real attack. Running a bug bounty program makes it clear to anyone who discovers a security issue with your organization that you're approachable on security issues. As bug bounty hunters rarely share details of successful attacks until they've got their bounty, your company must do the work of filtering out duplicate or irrelevant reports. Now when you're asked about security testing and what your organization should be doing, you can start the conversation informed. Stay aware of the flexible and overlapping definitions out there – always ask what someone means by a term they're using before you devote budget or schedule testing.
business reputation data breach

How to strengthen your IT security operations after a data breach

  • Leadership
  • min read
    • The aftermath of a data breach can be measured in many ways, depending on who you are. For those outside the organization, the public perception that an organization has been compromised, known as reputational damage, is often quoted as the most significant long-term aspect of a data breach. To measure the effect of a breach on a company's health, Comparitech analyzed the long-term impact on the share prices of breached companies. This research is nuanced and worth reading in full, but one of the headlines from the September 2019 edition is telling: after about a month, share prices rebound and catch up, on average, to NASDAQ performance. And most importantly, the companies keep operating. The companies in the analysis include many brands we continue to use every day in our digital lives: Yahoo!, eBay, LinkedIn and Facebook. So what's the real cost of a data breach? According to research by Adrian Sanabria, a well-regarded former senior analyst in the information security community, there are a relatively small number of companies that are hacked out of existence. Examples of severe consequences for companies of all sizes are few and far between. So for the board, it's easy to under-estimate the impact of a breach by looking at share price or sales targets alone. However, the real impact and costs from loss of continuity go much further. For Kaspersky's Global Corporate IT Security Risks Survey, organizations of all sizes across the globe were asked about the broader costs they have to deal with when recovering from attacks. For enterprises, it's now, on average, a cool $1.4M to clean up a data breach. Beyond the financials, if you want your decision-makers to see all the consequences of a compromise, there are other factors to review. These are harder to define in absolute numbers, but they all affect the company's performance and reputation. Keep these points in mind when assessing risk or advocating for an additional budget for defense. Internal reputation damage The internal reputation of the security team can be hit hard. Regardless of the actual cause, they can be seen as responsible. This has even more risks to the long-term success of the team: Loss of continuity A CISO (Chief Information Security Officer) is often expected to resign after a significant breach; they carry the can as their position is viewed as taking responsibility for the failure. I would argue the removal of a single leader as a way to solve often systemic and complex problems is a strategy only good for Hollywood villains. Next time you're at the cinema, notice how successful their organizations are by the end of the movie. Scapegoating your CISO is an unwise strategy. It will take months, or even years, for the new CISO to be hired then acquire the knowledge of their predecessor, the established relationships, ways of working, and so on. The new CISO, as with any incoming C-suite leader, tend to make changes to make their mark, which can cause further disruptions in continuity and additional strains on the InfoSec team. Low morale Morale is tricky to measure and account for, but from the conversations I have with members of the InfoSec community, your IT staff can be despondent after a breach, particularly the security team. This may be in part due to the implication that their efforts didn't protect the company, and in part, due to burnout from the increased efforts to recover after a breach. The negative effect on Equifax staff is a particularly good example. Individuals were criticized in social media and even received death threats, and without appropriate support from the organization to safeguard team member's reputations and mental health. Increased auditor scrutiny For both your internal audit teams and the third party auditors you bring in, they will all increase their efforts to ensure they're not seen as missing something, and therefore being the party to blame for any future compromise. That sampling approach you used before that saved hours of unnecessary analysis? That won't be allowed anymore. More internal bureaucracy Organizations often respond to a breach by imposing new requirements on all staff, rather than by making the existing requirements easier to understand and follow. This may increase your employees' chances of understanding and following instructions or their willingness to bypass them to get their job done, which, in turn, could increase your organization's exposure to risk. So what should you do differently? With all these potential consequences and risks, here are some tactics you could try to have a happier ending after a breach. Keep your CISO Unless the incident can be directly attributed to an irreversible failure on the part of the CISO, don't fire them to appease customers or shareholders or any other aggrieved group holding a short-term view. Your CISO will have the experience and knowledge you need to see you through this issue. According to Kaspersky's 2019 survey based on more than 20 personal interviews with CISOs, unless the incident was directly their fault, the majority felt their employer would support them. Invest in building a cyber-aware culture Strengthen cyber-awareness training for all employees. This can help your employees work together more effectively in the face of a common enemy (cybercriminals), and appreciate the difficulties the security team faces keeping the organization safe. Plan your breach recovery strategy The best time to prepare for your recovery from a breach is before it happens. Take one step today, maybe start to look at how your organization would detect a breach, or how you can test the detection capabilities you have. Re-examine your existing strategies. For example, Kaspersky's IT Security Economics report highlights the benefits of having a DPO (Data Protection Officer) and SOC (Security Operations Center) in reducing the financial impact of an incident. When estimating impact, at any point before or after an incident, make sure you and your stakeholders appreciate these factors and consider them alongside the financial assessment. Ensure everyone has all the facts, not just those that are easiest to quantify. Any organization today has to "assume breach," from the smallest company keeping an offline backup away from the office to the largest enterprise looking to implement an advanced defense solution stack, which includes EDR (endpoint detection and response) and an anti-targeted attack solution. But a side effect of this wise approach can be an undue pessimism about the effect of being compromised. By giving your CISO confidence to make longterm plans because they'll survive short term problems, by improving the security awareness within your organization and by preparing in advance, you can make it through a compromise relatively unscathed. With a more planned and supportive approach to safeguarding the reputation and strengthening the performance of your InfoSec team, you will build a more secure and resilient organization in the long run. This article was published in Jan, 2020.
cybersecurity purchasing strategy

Avoid costly firefighting: How to be smarter about cybersecurity procurement

  • IT infrastructure
  • min read
    • Impulse buying IT solutions feels like you've achieved something today, but have you just given yourself an integration headache for tomorrow? With a more planned approach, you can get more from your budget and protect your resources more effectively. Here are two questions to ask yourself: For most organizations, their approach is to try to understand the vendor landscape and then understand the breadth and complexity of their IT security problems. To an extent, this strategy can work. If you buy the best products you can find according to the budget you have, then you're working towards having the optimal security posture for your organization. But the vendor landscape today is so concentrated that you can spend all of your time just trying to understand all of the products you could use, then choosing between them. Keeping an eye on Sounil Yu's Cyber Defense Matrix helps you deal with this. As you read this, I expect your risk register is top of mind, right alongside the most recent data breach you've just heard about. So it can feel right to get on and do something rather than stop, think and consider alternative courses of action. By taking action, for example, buying a product, you think the problem's fixed, giving you one less thing to think about. The problem?  This 'strategy' doesn't work. But why? Firstly, it doesn't support an organizational policy. It's just what you did before, and so it's what you continue to do. Easy win. This approach prevails without proper reflection, and no one can question the decision because it's never clearly expressed in a way that permits it to be challenged. Secondly, your company ends up with a mix of disconnected solutions that are installed but not configured, and sometimes their monitoring capabilities and logs, which looked so impressive during the sales presentation, and only considered after a suspected breach. However, with some small changes, the buying approach can pay off, or at least reduce the effort you spend firefighting down to a manageable level, so you have breathing space to focus on new projects. Here are three ways you can get smarter about buying the right cybersecurity solutions for your business. 1. Have a buying strategy for attending events Firstly, use the conferences and exhibitions you attend intelligently. InfoSec conferences, especially those dominated by a vendor hall rather than by tracks of presentations, can be beneficial if used in the right direction. It can be tempting to use the occasion to catch up with contacts in the industry, put in an order for a new solution to justify the time and money it took to attend and then go home. But you can be smarter than that. Don't be afraid to play off vendors against each other. Shuttle between them comparing advantages, answers and prices, examining any criticisms raised by one vendor with the responses of another. Ask someone who has left a booth you've been at, or are considering visiting, what they thought of a solution and its vendor, and if there are any aspects they found particularly useful or troubling. It's a good way to think through your current position, with a side benefit to make the most of networking opportunities without the shallow performance of pushing your business card (or scanning your pass at more technologically advanced events.) 2. Try before you buy Secondly, consider either a bake-off or a trial period or a pilot project – whichever is your organization's preferred way of working. A bake-off is similar to the televised cooking competitions; each of the products under consideration is put in direct competition with the others to see which offers you the best solution for the least code. The options you select, of course, depend on the structure of your estate and many other factors about your organization, but in a rush to resolve an issue, you can instead spend a few weeks testing your implementation, and so saving yourself time in the long run. In particular, either a bake-off or a pilot project shows that the products are under serious consideration, and your vendors should be able to devote resources to making the test period a success and resolve any technical issues before a full rollout. I recommend sequential pilot projects over bake-offs, only progressing to the next pilot project if the previous one didn't give you the results you wanted. A pilot project is far less intensive than the effort required for a bake-off and dealing with multiple vendors simultaneously. Also, it's much easier to have set aims for a pilot project, making it an easy purchasing decision at the end of the trial period, while keeping everyone focussed during the exercise. 3. Take a lesson from the world of gaming Finally, consider "table-topping" or "wargaming" the introduction of the technical solution. This is like running a pilot project, but conceptually. By "wargame," I mean a business wargame. It's called a "tabletop" because that's where you run the game, and that's specifically where everyone concentrates their attention. You can either buy an appropriate game, hire a consultant to build one, or design one yourself. The process is more straightforward than you think. To put a simple wargame together, you need some kind of board to represent the situation you're discussing (for example, a network diagram), some pieces or markers to represent different resources (like some coins to represent the available budget) and a brief set of rules to determine how the game progresses. This prevents decisions being made according to the opinion of the most senior person present. Unfortunately, the word "game" has all kinds of unhelpful connotations, making the exercise not seem serious enough for the gravity of the decision you're making, but the game and its rules are there to help you think and to encourage everyone to contribute. Meetings are a poor format for decision-making, with the quality of the decision usually determined by how long the meeting was, who shouted the loudest and how close it was to lunch. By running a tabletop exercise playing through the implementation of a project, you can get everyone around the table to consider the impact of the new technology in their field. Does a more efficient endpoint threat management solution send too many alerts to the over-worked Security Operations Center? Does the new firewall implementation work with existing configuration maintenance software?  From there, scenario plan a typical day or week and judge the impact on your staff and those departments who you work with on taking on the new solution. Don't be afraid to modify the format of the game as it progresses, to use counters or markers on a board to represent the impact of network changes or the demands on staff. A simplistic representation of your proposed solution can quickly reveal unrealistic demands or requirements that never come out in discussions or a spreadsheet-based analysis. As a side benefit, getting people together to think through a procurement decision and its ramifications in this structured way can have serendipitous benefits, as different silos within your organization form stronger links, improving decision making in the future. Overall, buying the best solutions you come across can get you through the next quarter, especially if you combine it with the occasional heroic effort by your employees when inevitable problems occur. But that kind of strategy isn't sustainable, and it isn't the optimum use of your resources. Your attackers are becoming smarter, but your budgets aren't getting bigger, so you're going to have to out-think your opponents. By planning more strategically before buying, you can make the most of your IT security budget. The opinions in this article represent those of the author.
non technical ciso header

The accidental CISO: How to lead tech teams without a tech background

  • Leadership
  • min read
    • The role of the CISO, the Chief Information Security Officer, has traditionally been a technical one. With organizations taking a technology-first approach to secure their infrastructure and data, it seemed natural to elevate technical members of staff into the role to make the best use of their knowledge. But not everyone in this role is a hands-on technical security expert. What do you do if you don't have a technical background and you're a CISO (or the equivalent level of task responsibility) and people expect you to understand all of their technical security problems and issues? You'll most likely be encumbered with many non-technical requirements: personnel management of direct and indirect reports, all of the admin that goes with a senior position, being able to understand the new language those around you are using or the concepts they're referring to, translating between technical and non-technical staff, understanding and prioritizing business outcomes over purely technical or security-related results, threat modelling issues around compliance and liability and litigation… all of this… while trying to learn the technical knowledge at the same time. Or even if you were in a technical position before, you're expected to maintain up-to-date knowledge in an ever-changing field, while learning all the new skills required for your management role. Thankfully, many organizations now realize how important mental health concerns are for their people, particularly senior staff, where impaired decision making or forced absence from work can have a detrimental effect on the business. But while trying to stay balanced, you still have a problem to solve: how do you stay up to date with technical developments when you're not in a technical position? Here are a few solutions to consider, depending on the situation you're in. Talk to your staff openly When you're the most senior person within a particular discipline in your organization, it can feel that you need to be the most knowledgeable and most incisive. But that attitude is more suited to bosses in video games and Hollywood villains than to a corporate hierarchy today. Talk to your staff. Find the experts and ask them for their opinion, or ask them to brief you on the latest developments in the field. Not only are they saving you considerable time and effort, but this common ground where you're asking for advice helps build a much better relationship with your team. Being a source of knowledge to you is part of their duties, and if you honor this task with that level of importance then they will too. Of course, you need to be aware of any local considerations and biases, for example, a technical expert in data loss prevention (DLP) is unlikely to advocate the abandonment of this technology for a different platform, but with this context in mind, you can access decades of their accumulated knowledge in a few hours. Build good relationships with your vendors Image credit: Getty Images Find a good vendor, ideally, a good systems integrator (SI). They usually have a poor reputation in the industry, but it's unfairly so. However with this being a technology-led field, you're going to have to refer to experts, and who better than organizations that sell multiple types of solutions. Find a good SI. Ensure they're aware of your budgets and constraints; also that they know you're looking to build a relationship rather than make a quick purchase. As there's a greater upside for them than an immediate sale, your chosen SI should see you as a long-term relationship, and as your organization grows, so will your budget to spend with them. Subpar salespeople think in the short term to make a quick sale today. Better salespeople realize the pressure you're under and know how valuable they can be to you if they're trustworthy and offer high-quality advice – and, in return, if you go straight to them for your next purchase, they've just saved a considerable amount of sales effort. Befriend the technical staff at your vendors My opinion of salespeople is built around those I've worked with, so it might be more favorable than yours. Maybe the vendors you deal with simply aren't that trustworthy, or you don't have the budget to attract any of the SIs. In that case, focus on the technical staff at your vendor, the pre-sales support who accompanies the salesperson. This technical person will either be a dedicated pre-sales resource or a developer or architect for smaller vendors. It's unlikely they'll be on commission and evaluated on sales performances, so they won't be financially influenced to deceive you. It's also quite likely that they're blunter, technically minded and a bit of a problem solver – they'll see your situation as a puzzle to be solved rather than a business opportunity to be exploited. And if their current employer's product doesn't fit, then they're more likely to explain why. In particular, keep this in mind at conferences. See if you can catch the technical sales support person away from their stand or after a talk to get an honest opinion of their solution. Alternatively, at either a conference or a sales meeting, see it as your job is to discuss the financials with the sales rep and protect the technical person you've brought along with you; that way your technical team member can talk, unhindered, to the technician from the vendor. While you're soaking up the infographics and sales numbers, your technical person can get a more honest view and report back to you afterward. How to avoid bluff or burnout It's common for security leaders to pick one of two approaches: Bluff – especially for non-technical or formerly technical leaders, it's easy to try and bluff your way through decisions, to give confident guesses, expecting your team to make the best out of what you've decided. You might get lucky for a while, but bravado alone can lead to staff taking you out of the decision-making loop to avoid your mistakes. Burnout – try to take on all the new business skills while maintaining your existing specialist skills, to be the leader everyone expects you to be. This approach isn't sustainable. The strategies I've proposed are more difficult as they need more investment and commitment, but it's a better way forward in the long term that will lead you to make more effective technology decisions in the future. The opinions in this article reflect those of the author.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries