PG - Dropping Hell0days: Business Interaction for Security Professionals - Or Anyone Else - Elliot J

Johnson whose uh mentor was windy neither who's sitting here in the front left hand corner the name of the talk is dropping hello day's business interaction for security professionals or anyone else Elliot all right thank you thank you very much I appreciate as he said my name is Elliot Johnson this is my presentation dropping hello day's business interaction for security professionals or anyone else we're to be talking about how to get better at working with the talking with the business leaders of organizations infosec as a community is maturing and growing fast we have a lot of really awesome people doing some really cool things in this space but we need more people we need to continue to grow

there's a lot of threats out there that we know about we need to combat but there's also a bunch we don't know about yet so we need to keep growing our community and get stronger this is not going to be a technical talk those of us that are technical need to work on our soft skills as well those need as much practice as our technical skills we need to get better at dealing with the business side of things and all the focus for this group is security is applies to anybody in IT at any level or even in your everyday dealings with anybody else so Who am I I've been in IT for 16 years

past five have been focused on security I actually have a journalism degree with a major in advertising from the University of Kansas and thank you and when I was in school there was only one information security type class they offered it was a queue basic programming class and I took it I enjoyed it but that was all there was there was nothing else so I left school with my advertising degree and realized i never wanted to use it and so i had to get a job and i went to a manpower staffing agency and they placed me at help desk answering phones for a telecom giant and i found out i really liked it I liked

the interaction with people like talking to people like solving problems and I liked working with computers I was very fortunate also to have some really strong people help guide me in what I needed to do to get better taught me how to troubleshoot tell me what kind of classes to take things to study up on and really helped me progress my career so throughout my career done helped us desktop Support Operations Support special project work AKA go get that guy that never says no to anything and security now and security have done a lot of things and currently I'm working for a fortune 50 company in their IT risk and security department as the audit liaison for senior leadership Sox

IT general controls line of business coordinator and also vendor contract negotiator around information security and data security and what that means is I work with a lot of people outside of IT I have to deal with people like lawyers procurements other companies vendors and really build relationship with relationships with them as well the point of all that is that my background is probably similar to a lot of people my age or even older where we didn't have formalized education programs in college everything we know we had to learn as we went along and kind of work our way through it yeah we did random things in IT just to keep getting the job done and keep

growing and along the way i found i really liked working with people and i liked working with technology and helping those people use it it's possible to be very successful within our field as long as you like to continue learn and get to do challenging yourself and lastly you have to really want to help people and that's why we're here helping people both within our community and without and that's why we're here so the business let's dive into it what is it these are the companies and organizations that we work for that are making the products and offering the services to make our lives better maybe their charities or organizations helping other people then the business leaders are the people in

these companies and organizations that are making the decisions in driving the direction of these enterprises that is the business well I should I interact them I just want to show up to work and punched my clock 925 and go home well I think most of us really want to be part of something bigger than ourselves and we want to ultimately help people and we want to make things safe and we want to do things right in helping the companies that we work for to do this is a good thing and it's going to help us get there and we need to get better interfacing with the business leaders of our companies in order to accomplish

this so some general personality skills and everybody has these skills just some varying degrees of them and sometimes you just need to be reminded to use them first is don't be a jerk you know we've habit of applying for things that we think are a dumb or stupid question with flip and see your ass near sarcasm and it's very off-putting for someone as funny as Roy is you know sometimes they answer the phone like come on you can't do that so imagine if you took your card at jiffy lube and you get an oil change I don't know to change my own oil but if I went there and they start making fun of me because I couldn't do it and then

charge me money for it and may call me the whole time I'm there I wouldn't go there again I wouldn't give them money for that same thing when we are interfacing with the business they don't have our skill set they don't know what we know so we need to have patience and we need to help them you know when we're helping them we want to make sure our interactions are pleasant hold the conversation with them ask them some questions just make sure that interaction is helpful and it's pleasant and they're going to remember that next you want to be positive your outlook on a problem or an issue can influence other people and it could be

contagious you know if it's all doom and gloom and you're negative all the time no one's going to look to you for help they're just gonna say that guy's just a roadblock an obstacle he's not gonna help me let's find someone who can help so keep a positive demeanor encourage other people to help you solve problems and collaborate with someone see where it goes you know just like helpful interactions positive ones are memorable as well next it's important to have confidence even if you don't think you have it you do you want to believe in what you're saying believe in what you're doing and know that you're doing the right thing all kinds of people in

the organization have confidence in you your boss your co-workers your customers if they didn't have that confidence in you probably wouldn't be working there next you want to commit to what you're doing you know show up to choke to your job you committed to work in their show up to your job and do it take ownership of tasks and assignments that are given to you when you have that ownership tell someone when you're going to deliver it and deliver it when you say you're going to if you don't know something that's okay and ask somebody or find out the answer and then deliver it when you say you're going to and then lastly it's important to stay calm and have a thick

skin sometimes unpopular opinions can be polarizing you know people don't like them if someone doesn't like your take on an issue or a problem it's important to remain professional during that interaction even if they're becoming aggressive or combative you know office bullies do exist unfortunately they're out there and you're going to have to be able to learn how to defuse them and deal with them professionally so what I like to do is you kill them with kindness you know you you you nod your head you say that's a valid point thanks for bringing it up and you be agreeable without agreeing to anything and when they're finished speaking you can turn ask a question of

them and get their intake on that and hopefully steer the conversation into a more conversational tone in a professional manner does it always work of course not some people just like to bully but unfortunately other mean fortunately other people in the room are going to see how you handle it and know that it was done professionally and they're going to take no they're going to remember that okay

we know we want to help so how do we go about engaging the business first we need to communicate effectively when you're talking with someone you want to speak confidently make eye contact speak clearly to them and really believe in what you're saying don't mumble drop your head shuffle your feet if you do that no one's going to believe that you believe what you're saying so they're not going to take your word for it you know when someone's title or position shouldn't intimidate you and not speaking with them no matter what level a person is that they should be willing to take input from anybody if they don't it's not because of their title it's

probably because they're a jerk so you can respect the title but you don't have to fear it conversely if you're in a management level encourage your team to go out and make decisions and be active and give them that confidence you know if you set up as a delegate to a meeting for you let them know they speak with your voice and what you say go or what they say goes and user speaking for you and back them up when they do that it's important because it builds confidence in your team builds trust in them and it builds your relationship with your direct reports and it goes a long way next you want to know your tone when

you're speaking if you're in a business meeting might not be the best time to crack a joke or make a sarcastic comment to somebody you know people are there to solve a problem work on an issue and be professional about it now if it's an after work function and you're out having a few drinks you know be a little more liberal with your language have some fun you know build that team camaraderie which is important but want to make sure you don't go too over-the-top not too vulgar rude because you do have to show up to work the next day and you don't want to do anything that's going to beres you and of course

there's varying levels of that some people are really good friends inside and outside of work and they could probably push those boundaries a little farther but if you're not sure you know just use good judgment next you want to make sure you're writing effectively an email is different than documentation you know anything more than two or three sentences is probably just going to get skimmed over if it's a wall of text it's probably going to get ignored or deleted now a technical document our process is different you're going to want to have it more detailed more verbose everything you can have in that documents got to be in there and then you attach that document to an email saying a Joe here's

the document you asked for please read it when you have a chance first who gets that email now knows okay he wants me to read it review to them documents in there I'll file that away it's when I can get to it they know exactly what they're supposed to do with it you also want to craft your email depending on who you're speaking to someone who's technical like you are you could probably use jargon and lingo that they understand because you're on the same page if it's someone maybe in marketing or sales that may not understand the technical info you're going to need to present that information different maybe it's going to be in a graph or a chart

with some numbers that they can just look at it real quick process the information and move on so it may be the same message but you're gonna have to convey it differently depending on your audience finally listen you learn more about listening to others than you do yourself and I know it sounds crazy but it's true if someone is speaking don't interrupt let them finish you know you'll have a chance to respond and it doesn't mean you just wait until there's a break or a pause and what they're saying so you can just blurt out whatever you were thinking your head now you want to actively listen to what they're saying and respond accordingly you know

conversation is a two-way street and both of you need to participate in to it participate in them all right persuasion engineering first thing everybody can do is smile show some teeth introduce yourself just to cut your hand be friendly so all things we can do to garner favor with people if you don't know someone don't hesitate to introduce yourself you know when someone sees you as a positive person they're an approachable they're more likely to engage in a conversation with you engage in a discussion with you

dressed for the part if you're heading to a meeting with executives or their senior leaders maybe the board of directors you're going to want to wear a nice shirt unfortunately some pants the suit coat or a tie maybe depending on the corporate culture and you want to go in because you people respond to people who look like them and so when you go into board directors they're all suited up you're going to want to do the same now can some people walk into that meeting you know wearing camo shorts and a slayer t-shirt and get all the money they're asking for and leave to a round of applause yes there are some people who have that charisma and can do that

but I do not so unfortunately I have to wear pants and a nice shirt and for the women out there you know I'm not even going to pretend to tell you what to wear I've been married long enough to know that's a bad idea I will just trust your sensibilities that you know how to approach that situation the point is if you show up to that meeting in your wearing jeans and a t-shirt or polo even you may you might start to feel underdressed you might lose some confidence that speak is clearly or strongly and your message is going to be conveyed the way it should be so you want to make sure you looked apart then

you could speak to part you know what you're talking about and you can answer all the tough questions that the board is going to ask you next a very important thing to do is conveying complex scenario and easy to understand terms now the cloud is a perfect example everybody knows what the cloud is I put my pictures up there I can get to a for any device people don't want to know you know that it's some massive server farm with virtualized hardware and scaling technologies you know people going to glass over when you say that just say the cloud and they get it you know it's easy to understand I like to use the heartbleed common for

XKCD in this case because when this came out I had to explain this to my boss last year when this came out and just did the job for me thankfully but I think it's a really good example because it shows a complex scenario like what heartbleed was but it illustrates what it does and what the impact is you know so in the first two slides someone's doing what it's saying I'm going to request this information back from you with this many letters it gives it back next two frames does the same thing but the person says wait a minute what if I decide to put extra characters at the end and have it give more information

and suddenly it dumps all this information back someone who doesn't understand the technical piece behind it can see that's bad we better fix that ASAP go do it lastly is a concept called fuzz of the chain I don't know who came up with this term but I think it's great it means getting buy-in from one person or more people to get your ID or solution accepted by someone else so for example I think a certain vice president you know non-audit issue and I know he's going to say no that's not me hit the bricks get out of here so what I do is I go to one of my audit counterparts and I lay out

my case for when I say this is why I think this vice president should on this issue and they agree with me say okay great I go to my box layout the scenario for that they also agree maybe I get two or three more people to buy in with me so I call a meeting with all parties go to the meeting I presented to this vice president and if he starts to push back and say nope that's not me I know I've suffer other people that are on board with my idea that can help convince him and champion my solution to get them to accept it alright so we know we have these skills we know how to communicate

and work on that so let's go ahead and use our new skills the first thing we do is we're going to show up you know bonus points if it's on time no matter how much you love or hate your job just being there is very important it's important to your team members in your boss and i'll see your customers and it doesn't mean it doesn't matter if it's virtual or physical you know virtual teams are out there and they work great together lots of tools skype link what not to make sure that you're communicating collaborating with your teammate on a constant basis say hi to someone smile works someone sees that you're in a good mood and when

you say hi they're more likely to view you as someone that they want to work with of course there's always the occasional person in your office who just hates everything and thinks you're annoying guys guys always smiling what's this problem but you can't let that affect your outlook your demeanor and how you handle your day you know just keep smiling at them and saying hi and maybe they'll come around one day have manners when you're talking with someone you're saying please and thank you goes an incredibly long way give compliments of somebody if they do a really good job and then they help you out now maybe they give you a really important spreadsheet that you don't present to

your boss and gets all the information they need to make a decision they help make you look good tell them that let them know that maybe your company has some sort of recognition program where you can nominate them for that now sometimes if you nominate somebody they get a fifty-dollar amazon gift card you know that goes a long way and people are gonna remember that people like to be recognized for doing good work and when working hard go ahead and just strike up a random conversation with somebody you see somebody no waiting in line maybe at the cafeteria or down for coffee see hi how's it going what'd you do this weekend you know about that sports team

and just interact with them talk to them see where it goes maybe going to find out that you share something in common and it's something you could talk about next time you see them well just a quick side note this isn't very effective in restrooms so just please let people have their space there and lastly you know buy someone a coffee or beer I prefer beer but sometimes when you're at work coffee will do not too long ago I had a lot of back and forth with some of my audit counterparts and we're on very different sides of an issue we finally came to a resolution and afterwards I invited them down to the cafeteria in

bottom coffee and just wanted to thank them so you know even though we disagreed vehemently on this issue we were able to come together present a solution that we both eventually agreed on and we're able to constructively argue to get there and I think that goes a long way in building positive dealings with people that you work with knowing you can work together even though you disagree is very important you know and we spent the next 25 minutes talking about personal things you know getting to know each other a little better building our relationship lastly interaction is easy you know the business is important to us it's important to our culture our technology into our well-being we need

to engage with the leaders of our business and our companies to be effective at our jobs there's a lot of bad guys out there we want to help keep people safe and we talked about some tools and techniques we can do to accomplish this yeah you don't through all of them but just try one or two them smile at somebody you know this is a great place to try some of these out introduce yourself to somebody and who knows maybe it's going to solve some long-standing issue that you've had at work you know maybe it's going to let you reach out to somebody that's not within your immediate group and you start talking to somebody else on sun

maybe you come up with an idea or a solution to a long-standing problem at the company you know and don't make excuses you know we're not shy we're not awkward we're not nervous it's okay we all are but that's okay you know we have to put ourselves out there we can't make excuses anymore we need to make the effort and get better we need to keep growing and fill the significant amount of information security jobs out there you know with good people with the right people so any questions Oh I just wanted y'all thank Wendy neither very much for being my mentor through all this she was she was great also the proving ground track has been great and

Johnny xmas actually the one who gave me the idea for this talk a conversation over beers a few months ago I don't think he's here but i want to thank him as well and also that our verb sec north and besides rally groups for supporting me and let me bounce ideas off him and present this to him so that's it