Throwback Thursday: Adjust Your Attitude!

James Wolfe

Lockheed Martin Corporation, USA

Copyright © 2000 Virus Bulletin


 

(This article was first published in Virus Bulletin, December 2000.)

I sometimes feel like a weatherman with a part-time job as a car salesman. Just as the guy on the news predicts the weekly weather I get to predict what type of viruses might be coming, and the level of protection I will need to employ to protect my company. Those of us who do make these predictions have the near impossible task of selling them to the pivotal people in our corporations so that they don't think we are just crying wolf.

For example, many people in the industry believe we are on the cusp of a new wave of viruses that will be Linux/Unix-based and will cross over to that aloof group of Unix users which often says 'I use Unix so viruses can't touch me'.

I'm fortunate to have receptive server administrators who take my recommendations seriously but, how do you convince someone who doesn't respect your knowledge they should spend thousands of dollars on a solution for something that doesn't exist yet? How do you communicate to someone that the best you can expect from your solution is that nothing will happen? How do you get the policies implemented to make your job easier?

Recently, I attended a conference where I had the opportunity to meet many people who share the same daunting task that I do protecting their corporations from viruses. Most of these poor souls have the job of tracking viruses, testing products, pushing out updates of existing products, and reporting virus statistics. More often than not this is on a limited budget with limited manpower. Some are doing the job part-time and many of them have little of the actual organizational power that would allow them to do their jobs properly. Most of the conversations I had involved having to deal with 'stupid users' and not being able to get the resources needed to do the job.

As I listened to the various reasons (and, frankly, endless whining) being given for their problems, I thought to myself that the problems that AV people encounter are very often brought on by their own attitudes. Being something of a technical 'weenie', I sometimes forget that I perform a service to a customer.

Realising that I serve a customer (albeit, in my case, an internal one) was an eye-opening experience for me. I had fallen into the trap that there were no grey areas when it came to my recommendations. Newsflash folks, a hard-line approach like this will cause people to go on the defensive, with the result that nothing you say will be heard. This is what causes many of us to lose our credibility and more importantly, funding.

So what is the answer? Instead of telling your audience what you want, sell them what you want. As with many of my peers, I work in the Information Security department. Most people see any department with the word 'security' in its name as the enemy. To overcome this my supervisor, who has a degree in Marketing, suggested that I should sell what I do instead of just telling what I do. So when I receive an inquiry from a client regarding a particular virus, instead of saying 'yes, we're protected' I'll say, 'We've been protected for 3 weeks, and here is a little information about it, thank you for your help'.

What's the difference? One is directly to the point and the other is user-friendly. Always let your customer know that you're happy to help and that it is all part of the service, even if the question is about an annoying two-year old hoax. When you attend inter-departmental meetings introduce yourself to employees you don't know and let them know that they can call you if there is ever anything that you can help them with. Many times this has put me in direct contact with Managers and Directors – the very people who will be approving the new software I need or the new policy I need support on.

The bottom line is 'get over yourself' and change the way you approach the whole process. Most of you reading this article have the technical skill but do you have the people skills? Sell yourself and your service. Not getting the funding and the staff you want might not be the problem. You might be the problem.

Before you can get people to provide the tools you need, they have to want to listen to you. You have a much better chance of getting funding, more people, or a new policy if the people who perform these services think of you fondly. I know it sounds campy and is terribly friendly but those 'stupid users' pay your salary, and let's face it a grumpy virus researcher without a job is an unemployed nerd with a bad attitude.

Download PDF

twitter.png
fb.png
linkedin.png
hackernews.png
reddit.png

 

Latest articles:

VB2018 paper: Tracking Mirai variants

Mirai, the infamous DDoS botnet family known for its great destructive power, was made open source soon after being found by MalwareMustDie in August 2016, which led to a proliferation of Mirai variant botnets. This paper presents a set of Mirai…

VB2018 paper: Hide’n’Seek: an adaptive peer-to-peer IoT botnet

This paper presents a thorough analysis of the inner workings of Hide’n’Seek, a peer-to-peer IoT botnet discovered in January 2018. With an exploit table that can be updated in memory and modular in its approach, Hide’n’Seek gives us a glimpse of…

Botception: botnet distributes script with bot capabilities

Researchers Jan Sirmer and Adolf Streda describe the branch of the Necurs botnet that they have been monitoring, the changes it has undergone in the course of a year, and present an analysis of the next stage of the attack: Flawed Ammy.

VB2018 paper: Since the hacking of Sony Pictures

Minseok (Jacky) Cha describes various attacks in Korea which occurred after the Sony Pictures hacking incident and which are suspected to be the work of the same group, the Lazarus Group.

VB2018 paper: Uncovering the wholesale industry of social media fraud: from botnets to bulk reseller panels

In this paper GoSecure researchers Masarah Paquet-Clouston and Olivier Bilodeau explore an undocumented segment of the social media fraud (SMF) industry: wholesaling, from botnet supply operations to bulk reselling.


Bulletin Archive

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.