When I was a penetration tester I struggled to adequately express the importance of the vulnerabilities I identified. For some reason, I couldn’t convince the business and legal teams that the vulnerabilities had to be mitigated and that the business had to spend time and money on the effort.
Like many young and excitable IT and security people, I couldn’t understand why no one could grasp why this was important. “Are they idiots?”, “Don’t they get it?”, “They just don’t care about security!”
It turns out it wasn’t their failure, but mine. I wasn’t speaking in the right language.
I dropped out of the security world for three years and went to law school. When I enrolled, my goal was not to become a lawyer, but to learn to think and write like a lawyer. I enjoyed law school and took full advantage of the opportunities presented to me. I was able to work as a research assistant for one of the legal research and writing professors (Thanks Mike!), serve on the editorial board of the Law Journal, earned a fellowship in the Center for Terrorism Law, and leveraged my IT skills to get a job in the Westlaw lab.
I really enjoyed law school.
After law school I returned to security, this time with a different language under my belt and a better understanding of how to present my concerns. I couldn’t think in terms of security vulnerabilities anymore. I had to speak another language.
My big discovery was:
- Security thinks about vulnerabilities;
- Executives think about risk; and
- Lawyers think about liability.
While they sound similar, they are distinct ways of approaching a decision. In order to communicate the importance of security to different audiences, I had to adapt to them and not expect them to adapt to me.
So need additional funding for a security project? Write up your proposals geared toward the audience and how they think. Does the lack of a security control create risk to the organization? Will the organization breach a duty and become liable under a contract, law, or regulation?
These subtle shifts in thinking may help drive the discussion forward and lead to better understanding and better security.