Enemy At Your Gates
Jim Seaman
Business Information Security Officer (BISO) | Cyber Security & Risk Consultant | PCI DSS Compliance Specialist | Author | Speaker | MSc, CISM, CRISC, CDPSE | 20+ Years in Security Risk Management
In memory of Victory in Europe (VE), I thought it would be prudent to write about the important leadership lessons that were learned from World War 2 WWII).
Captain Sir Basil H LIDDELL HART (Military Commentator & Correspondent From Thoughts on War, 1944) wrote:
"A Commander should have a profound understanding of human nature,
the knack of smoothing out troubles,
the winning affection while communicating energy,
and the capacity for ruthless determination where required by circumstances.
He needs to generate an electrifying current, and to keep a cool head in applying it."
Introduction
Today, every business faces their own modern battlefield and everyday needs to be able to repel and react to the ever present threat to their critical business processes and assets.
Much like the WWII battles, an effective strategy needs effective leadership and management:
- Often called the 'Top-Down' approach.
Good leadership needs to have a good understanding of each of their Commander's strategies to ensure that there is an integrated approach, to ensure that each Section is working in harmony with each other.
Failure to do this presents the opportunity for your enemies to infiltrate your business environments. Every one of your business processes are heavily reliant on processes and, as a result, becomes the main cause of compromise.
Consequently, it is not a requirement for business leaders to understand the finer, or technical, details but it is essential that they comprehend the risks and how each of their managers are helping to mitigate these risks.
Findings
Over my RAF Police career, I have experienced some outstanding Commanders who were just natural leaders and whose capabilities naturally grew through their various roles. Whilst, on the other hand, there were others who were fantastic Managers but struggled with leadership responsibilities.
Although more prevalent in military life, the same experiences can be seen within the corporate environments. In fact, it was after having transitioned to corporate life that I discovered one of my most rewarding lessons:
- Communicating to Business Leaders.
With the high risks threats that were ever present in the military, it was rarely a problem for a Counter Intelligence specialist to get a Commander's attention, as they understood the importance of having effective protective security measures and the risks associated with practices that did not align with the Ministry of Defence's Joint Service Publication 440 (MOD JSP 440).
However, in the corporate business environments , this message is extremely difficult to effectively convey to the decision-makers. As a result, protective security professionals can often feel under appreciated and that they are "Talking To A Brick Wall!"
How can this be?
Don't Business Leaders want to protect their business?
It is very rare that a Business Leader does not care about protecting their own business but, rather, they are extremely busy individuals that are focused on ensuring that their business remains successful.
Think of it like someone driving a motor vehicle.
The focus is on watching the road, navigating corners, changing gear, applying the brakes, accelerating, etc. and not having to know the finer technical details of how the vehicle should operate.
However, should the vehicle's warning lights illuminate on their dashboard, they would be foolish to ignore this.
- Check Engine Warning Light
This is the most difficult part of a protective security specialists role, getting the message across in a succinct and concise manner, so that the Business Leaders do not need to have an in depth understanding the reason for the 'Warning Light' but that they understand the importance of reacting to this warning!
Compliance frameworks, provide organisations with guidance on how to mitigate known risks and to help maintain secure operations. Much like, you might reference a Haynes Manual to help provide you with specialist guidance.
Recommendations
It is perfectly normal for a protective security specialist to want to demonstrate to their Business Leaders that they are competent and knowledgeable in their chosen profession. However, is that not why you were chosen for the role, in the first place?
Consequently, it is more essential that you can deliver the message in a more effective way (aka The Elevator Pitch), so before attempting to report the issue/ risk, think:
- Does this easily convey the 'So What?' message (warning light) or does this message have a closer resemblance to an instructional page from a Haynes Manual?
Your Business Leaders are unlikely to have the time or interest to read, and understand, the technical details as to why the 'Check Engine' warning light is on.
What is important to them is what is the potential risks, if they were to continue to drive their business in the normal manner and what they should be doing to mitigate these risks?
The simplest way to convey this message is through the use of the following 3 words:
- Vulnerability.
- Threat.
- Impact.
Effective leaders will embrace Captain Sir Basil H LIDDELL HART's ethos and be extremely supportive, and appreciative, of the value their specialist bring to their organisation.
Consequently, effective leadership (Top-Down) and management (Top-Down & Bottom-Up) are essential components of an organisation's integrated protective security strategy.
Conclusion
Virtually all businesses are facing continual threats to their operations, which can come from a variety of differing avenues (e.g. Theft, Natural Disasters (e.g. #covid19), Cyber Attack, System Outages, etc.) and it is the job of the protective security specialist to act as the businesses warning system.
By tailoring your messages, you will ensure that the decision makers easily understand the things that they need to take notice of and react to, whilst the department managers are responsible for maintaining the various working components of the business.
Risks need be equally managed from the perspective of external and internal threats, to ensure businesses can continue to drive safely and not end up broken down on the side of the road.
Business Information Security Officer (BISO) | Cyber Security & Risk Consultant | PCI DSS Compliance Specialist | Author | Speaker | MSc, CISM, CRISC, CDPSE | 20+ Years in Security Risk Management
4 年https://youtu.be/HS4XsCdP55k