What do you do if your information security ideas are met with resistance?

If your information security ideas are met with resistance, addressing concerns through education and communication is important, illustrating the potential risks and consequences of inaction. Demonstrating the value and necessity of the proposed security measures, possibly by referencing case studies or examples of similar organizations that have faced cyber threats, can help persuade stakeholders. Engaging in open dialogue to understand the reasons for resistance, whether budgetary, operational, or cultural, allows for tailoring your approach to address these concerns directly.

Active listening proves invaluable in addressing resistance. We regularly engaged stakeholders through meetings to comprehend the reasons behind their reluctance towards security upgrades or adopting best practices. This approach allowed us to tailor solutions accordingly. Additionally, in some instances, stakeholders were unaware of the security implications, so our discussions also served to enlighten them on potential risks and benefits.

If your information security ideas face resistance, start by understanding why. Listen carefully to stakeholders' concerns. They might be worried about costs, disruptions, or effectiveness. Identifying these reasons lets you tailor your response, whether that means explaining your ideas more clearly, showcasing their benefits with real examples, or tweaking your proposal to fit better with what the organization needs and can handle. This approach can help turn resistance into support by directly addressing the root of their hesitations.

I've found it good to get buy-in on a clear problem statement. This helps the one resisting to get out of the complaining phase and gets them into helping to remove their own resistance.

Persistir e adaptar-se s?o essenciais, especialmente considerando que reconhecemos a natureza gradual da assimila??o das melhores práticas e que as propostas de seguran?a da informa??o nem sempre s?o prontamente acolhidas. Caso uma tática inicial n?o alcance os resultados esperados, é crucial demonstrar flexibilidade ao ajustar estratégias e explorar novas abordagens para fomentar a seguran?a da informa??o na empresa, mantendo vigilancia constante sobre as tendências do setor e as exigências regulatórias em muta??o.

Getting buy-in from other stakeholders is key to building support for your information security program. And this is only possible by building relationships. Focus on gaining an understanding of key stakeholders' current objectives and current obstacles, then use security to help them attain their objectives. Show them that security is a business enabler, and that your goal is to help them accomplish their goals, and you will rapidly gain support throughout the organization.

The question of support depends on the source of the resistance. If resistance is coming from the top, I get other executive allies to help garner stakeholder support. I start these in informal "water cooler" conversations. Then on active calls, I refer back to the problem statement they helped craft and remind of the support from all of the other allies. If the source of the resistance is a technical person, I start with them and not just allies. Once we've addressed their concerns, they become champions. For instance, if a network manager is concerned that a particular control is going to slowdown traffic, I ask them to help quantify requirements, do a PoC and validate before and after. That shows that their concerns are being addressed.

Building support within your organization is key to advancing information security initiatives. Engage colleagues who share your vision for better security, as they can advocate for your proposals and add credibility. Additionally, seek endorsements from respected figures in the security field or your company. Their backing can be a powerful endorsement, reinforcing that your ideas are valuable and worthy of consideration. This coalition not only strengthens your proposal but also fosters a more security-conscious culture within your organization.

A key reason why Information Security ideas and the function are met with resistance by business stakeholders is the "Gate keeper" mindset of InfoSec professionals. Multiple instances when InfoSec will say "NO" to changes to business processes or systems. This leads to loss of trust and collaboration amongst the functions. Instead of saying "NO" based on existing policies, develop a mindset to work with stakeholders to identify solutions. InfoSec leaders have to develop a shared vision with the stakeholders. Be an enabler to improve business processes based on a agreed risk management approach. Communicate. Demonstrate clearly the value in terms of tangible and non-tangible ( compliance, process improvement) etc. to stakeholders.

Security must be seen as a benefit not a cost. Otherwise you will end up in wasteful discussions with single priority budget holders.

As I said all the time, having clear communication is key to reaching out to stakeholders. Try to break down the idea into smallers peaces that are easier to understand for someone that it is not that technical. Also, always showcase what the company will gain following your ideas, whether it is more productivity, greater security, etc.

To effectively present information security proposals, ensure your communication is clear and accessible. Steer clear of technical jargon and explain concepts in simple, everyday language. Use relatable analogies and practical examples to demonstrate how your ideas will positively impact the organization. Focus on highlighting both the practical benefits and the potential return on investment. This way, your proposals become more engaging and easier to grasp, enhancing your ability to win support from a broader range of stakeholders.

Additionally, this compromise has to be accompanied by risk acceptance, where someone within the organization takes accountability for the agreed-upon risks.

It is vital to take a different approach when explaining the importance of security needs. When trying to justify the need for a cybersecurity budget to a business, there may be resistance. However, presenting the information from a different perspective can help you achieve your goal of explaining the security needs and the rationale behind it.

The ability to compromise is so underrated in IT security, OT security, and technology in general. By putting things on the table that are easy to get "Yes" votes, that helps ease the way towards more compromises. Also, always offer choices. By offering choices, the discussion is not focused on yes or no, it is which of the options to select. This already has the stakeholders taking an active role in removing their own resistance. I typically try to do a quick threat modeling exercise before it comes time to compromise. This way, I am able to offer a clear risk model of each option. Then the stakeholder's risk appetite drives the decision.

Communicate the info sec idea clearly and link it with the Organisation strategy and objectives. Also, try to explain the risk factor that will have an impact on the business side.

In my experience, backing up information security proposals with solid evidence was a game-changer. I've leaned on case studies, industry best practices, and pilot project data to showcase my ideas' real-world benefits. This approach not only added credibility to my proposals but also helped address skepticism head-on. Presenting this evidence clearly and succinctly made a significant difference, turning doubt into support for innovative yet practical security solutions. It's a strategy repeatedly proven worth in creating a compelling case.

From my experience, I've learned that while persistence is crucial in championing new security measures, it's equally important to balance enthusiasm with patience. After sharing your ideas with stakeholders, following up is a great strategy to keep discussions going and show dedication. However, it's wise to tread carefully and not overwhelm them.

When driving for high impact security initiatives, following up quickly and with the correct level of information builds confidence in stakeholders. If one of the headwinds or blockers was perceived slowness, then we work to confirm or squash the concerns. If the resistance was about timing, we make sure to communicate frequently with updates. When people follow up with me, I both think more favorably of them, I think of them more. So, if opportunities arise that I need their assistance, it becomes easier to work with them.

The language of risk management always needs to be at the right level for the audience. Reducing friction is often just a case of speaking the right language and the right level. * Talking about market pressures to a network engineer won't work. * Discussing encryption algorithm details to an executive stakeholder also probably won't work. The skill we should all learn to develop is that of learning to speak to the audience we're working with. It took me time to develop this skill. But once I did, resistance was less.