Throwback Thursday: Adjust Your Attitude!

James Wolfe

Lockheed Martin Corporation, USA

Copyright © 2000 Virus Bulletin


 

(This article was first published in Virus Bulletin, December 2000.)

I sometimes feel like a weatherman with a part-time job as a car salesman. Just as the guy on the news predicts the weekly weather I get to predict what type of viruses might be coming, and the level of protection I will need to employ to protect my company. Those of us who do make these predictions have the near impossible task of selling them to the pivotal people in our corporations so that they don't think we are just crying wolf.

For example, many people in the industry believe we are on the cusp of a new wave of viruses that will be Linux/Unix-based and will cross over to that aloof group of Unix users which often says 'I use Unix so viruses can't touch me'.

I'm fortunate to have receptive server administrators who take my recommendations seriously but, how do you convince someone who doesn't respect your knowledge they should spend thousands of dollars on a solution for something that doesn't exist yet? How do you communicate to someone that the best you can expect from your solution is that nothing will happen? How do you get the policies implemented to make your job easier?

Recently, I attended a conference where I had the opportunity to meet many people who share the same daunting task that I do protecting their corporations from viruses. Most of these poor souls have the job of tracking viruses, testing products, pushing out updates of existing products, and reporting virus statistics. More often than not this is on a limited budget with limited manpower. Some are doing the job part-time and many of them have little of the actual organizational power that would allow them to do their jobs properly. Most of the conversations I had involved having to deal with 'stupid users' and not being able to get the resources needed to do the job.

As I listened to the various reasons (and, frankly, endless whining) being given for their problems, I thought to myself that the problems that AV people encounter are very often brought on by their own attitudes. Being something of a technical 'weenie', I sometimes forget that I perform a service to a customer.

Realising that I serve a customer (albeit, in my case, an internal one) was an eye-opening experience for me. I had fallen into the trap that there were no grey areas when it came to my recommendations. Newsflash folks, a hard-line approach like this will cause people to go on the defensive, with the result that nothing you say will be heard. This is what causes many of us to lose our credibility and more importantly, funding.

So what is the answer? Instead of telling your audience what you want, sell them what you want. As with many of my peers, I work in the Information Security department. Most people see any department with the word 'security' in its name as the enemy. To overcome this my supervisor, who has a degree in Marketing, suggested that I should sell what I do instead of just telling what I do. So when I receive an inquiry from a client regarding a particular virus, instead of saying 'yes, we're protected' I'll say, 'We've been protected for 3 weeks, and here is a little information about it, thank you for your help'.

What's the difference? One is directly to the point and the other is user-friendly. Always let your customer know that you're happy to help and that it is all part of the service, even if the question is about an annoying two-year old hoax. When you attend inter-departmental meetings introduce yourself to employees you don't know and let them know that they can call you if there is ever anything that you can help them with. Many times this has put me in direct contact with Managers and Directors – the very people who will be approving the new software I need or the new policy I need support on.

The bottom line is 'get over yourself' and change the way you approach the whole process. Most of you reading this article have the technical skill but do you have the people skills? Sell yourself and your service. Not getting the funding and the staff you want might not be the problem. You might be the problem.

Before you can get people to provide the tools you need, they have to want to listen to you. You have a much better chance of getting funding, more people, or a new policy if the people who perform these services think of you fondly. I know it sounds campy and is terribly friendly but those 'stupid users' pay your salary, and let's face it a grumpy virus researcher without a job is an unemployed nerd with a bad attitude.

Download PDF

twitter.png
fb.png
linkedin.png
hackernews.png
reddit.png

 

Latest articles:

VB2018 paper: The modality of mortality in domain names

Domains slated for abusive uses are effectively disposable: they are registered, quickly abused for cybercrime, and abandoned. In this paper Paul Vixie describes the first systematic study of domain lifetimes, unravelling their complexities and…

VB2018 paper: Analysing compiled binaries using Logic

In this paper Thaís Moreira Hamasaki provides an introduction to some practical applications of SMT solvers in IT security, investigating the theoretical limitations and practical solutions, focusing on their use as a tool for binary static analysis.

VB2018 paper: Internet balkanization: why are we raising borders online?

Nowadays, walls are not just being raised in the real world, but on the Internet as well. Countries want to isolate themselves and shut down the information they are not comfortable with, or the companies they don’t want to do business with. Freedom…

VB2018 paper: Where have all the good hires gone?

Much ink has been spilled on the subject of the information security skills gap, and how difficult it is to hire and retain people for these positions. And yet, we all know someone who has had a hard time finding a suitable position despite having…

VB2018 paper: Little Brother is watching – we know all your secrets!

In their research, Siegfried Rasthofer, Stephan Huber & Steven Arzt evaluated the security level of the most popular family-tracking apps on Android. They assessed the security of the respective apps and conducted assessments of the corresponding…


Bulletin Archive

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.