{"id":20558,"date":"2023-01-11T23:27:59","date_gmt":"2023-01-11T19:27:59","guid":{"rendered":"https:\/\/me-en.kaspersky.com\/blog\/business-soc-communications\/20558\/"},"modified":"2023-01-11T23:27:59","modified_gmt":"2023-01-11T19:27:59","slug":"business-soc-communications","status":"publish","type":"post","link":"https:\/\/me-en.kaspersky.com\/blog\/business-soc-communications\/20558\/","title":{"rendered":"How to improve communication between information security staff and management"},"content":{"rendered":"

No company can operate successfully without smooth cooperation between the general management and the specialists responsible for different areas of the business. Such cooperation of course requires communication, which can sometimes be difficult since managers and specialists work in different information bubbles and often speak different languages. Management thinks about profit, costs and development; specialists \u2013 and the information security service is no exception \u2013 think about their specific technical tasks.<\/p>\n

A recent study<\/a> conducted by our colleagues found that, while mutual understanding between business managers and information security specialists is generally growing, problems do still exist. In fact, 98% of the business representatives surveyed said that they experienced a misunderstanding with the information security service at least once. As for direct consequences of such a misunderstanding, 62% said that it had led to at least one security incident, while 61% reported negative impacts to the business \u2014 including losses, losing key employees, or a worsening of communication among departments. At the same time, the security professionals themselves are not always aware of any problems: 42% of business leaders would like the security specialists to communicate more clearly \u2014 but 76% of those specialists feel sure that everyone understands them perfectly!<\/p>\n

There are often problems with the language used: managers generally don\u2019t understand all the technical terms that information security services use. But terminology isn\u2019t the only problem in the communication between the managers and information security \u2014 in fact, it\u2019s not even the main problem. Let\u2019s attempt to understand the other issues with the help of Patrick Miller, Managing Partner of Archer International, and his speech<\/a> at the Kaspersky Industrial Cybersecurity Conference 2019.<\/p>\n

Different ideas about risk<\/h2>\n

Most information security specialists have a very low risk-tolerance threshold. But in business, the opposite is true: without risk, there\u2019s no profit, so managers are often ready to take greater risks. For the boss, the main goal is to find the ideal balance between potential profits and potential losses. The real goal of the security department, as strange as this may sound, is not to eliminate all threats but to help the business earn as much as possible.<\/p>\n

From the business point of view, risks can be accepted, avoided, reduced, or transferred (for example, to insurers). Managers will try to take as many risks as possible to increase profits. Information security is just a small part of the picture for them: they probably don\u2019t even want to think about it.<\/p>\n

As a result, information security specialists should not think about how to close all the gaps, but rather how to identify and neutralize those threats that really<\/em> could cause serious damage to the business. And, consequently, they should also think about how to explain to managers why it\u2019s worth spending money on resolving something.<\/p>\n

FUD doesn\u2019t work<\/h2>\n

Trying to persuade managers using tactics of fear, uncertainty, and doubt (FUD) is not going to work because getting scared isn\u2019t what the business pays the information security service for. Specialists are there to solve problems \u2014 ideally so that no one even notices that there are any.<\/p>\n

Another problem with using FUD is that managers are already pretty stressed out, simply because any mistake they make could be their last: there are a lot of folks around who\u2019d jump at the chance of taking their place, they don\u2019t really trust anyone, and so on. They just don\u2019t need any extra fear factors.<\/p>\n

And finally, no boss likes to show that they don\u2019t know something. Therefore, any attempts to bombard management with smart-sounding terms are obviously doomed to fail.<\/p>\n

Think like a business<\/h2>\n

The main goal of any commercial business is to earn money. All managers look at everything from this point of view. That\u2019s what they know how to do. Therefore, if an information security specialist comes to them and says, \u201ca threat has appeared and we need to invest X amount of funds to neutralize it,\u201d what the manager hears is \u201cif we take a risk and do nothing, we\u2019ll save X amount of funds.\u201d Sounds crazy, but that\u2019s exactly how business thinks.<\/p>\n

For the manager, it\u2019s essential that any of their actions (or inactions) results in positive financial numbers \u2014 even if such a positive number happens to be the difference between two negative ones. So, the situation must be presented to the management in a form it can understand: \u201cThere\u2019s a threat with a Z% probability of causing Y damage to the business. We need to spend X to neutralize it.\u201d This is an equation that makes sense to the business mindset.<\/p>\n

Of course, it\u2019s not always possible to realistically predict the cost of potential damage, so you can use known values such as downtime (during which the consequences of the incident would be cleaned up), the amount and type of data that could be lost or compromised, reputational losses, and so on. The business can then convert this information into understandable numbers \u2014 with the help of relevant specialists. But it\u2019s better if the information security team can do this themselves, since it saves a lot of time.<\/p>\n

Naturally, there\u2019s always the possibility that the equation won\u2019t work out in favor of information security. This isn\u2019t always a problem of miscommunication \u2014 maybe the managers hear and understand everything perfectly, but it\u2019s just more profitable to take the risk. Either that or information security wasn\u2019t able to convincingly argue their position because it didn\u2019t learn to think like a business.<\/p>\n

The key here is to have a good grasp of the information security service\u2019s position within the company and the profit it generates. This will make it possible to better evaluate and classify potential threats, avoid wasting your own and other people\u2019s time and nerves on initiatives that clearly won\u2019t go anywhere, and in general to work more efficiently.<\/p>\n

The time factor and deadlines<\/h2>\n

For security, the time factor is crucial: some threats must be protected against immediately. But time is also important for business, because for it \u2014 time is money. You can spend the aforementioned X amount of money today, but if you do so in a month, then in skillful hands X will turn into X*n, and X*(n-1) will stay in the bank.<\/p>\n

Even if the managers understand the problem well and know that it must be solved, they won\u2019t rush to spend money unless they\u2019re given a clear and well-argued deadline. They should also be notified that once the deadline passes, they automatically take responsibility for the specified risk, since then information security can only clean up the consequences.<\/p>\n

This deadline should be as realistic as possible. If information security is always demanding a decision to be made \u201cyesterday\u201d, then management will stop listening and instead treat it like the boy who cried wolf. And if it\u2019s always saying \u201cwell, you can decide within a year\u201d, they\u2019ll simply be fired following the next incident (or simply made redundant). It\u2019s important to be able to assess and set the real deadline and highlight the potential risks.<\/p>\n

It\u2019s worth noting that very few companies simply keep reserve money in their accounts, waiting for the chief information security officer to come and tell them where to spend it as soon as possible. Funds to solve the problem will have to be taken or borrowed from somewhere, and this can take time. And, by the way, in order to understand the time it takes, it\u2019s also important to know how the business works and is financed.<\/p>\n

Be a marketer<\/h2>\n

To communicate effectively, information security specialists should have some marketing skills; then they can sell their solutions to the boss(es).<\/p>\n