4 ms·

Can't you present it as a risk / benefit analysis? Basically at the beginning of the quarter the open / larger risks were XYZ and now those risks have been miti

Can't you present it as a risk / benefit analysis? Basically at the beginning of the quarter the open / larger risks were XYZ and now those risks have been mitigated or reduced.

Terretta 6y ago
Here’s how that goes before the quarter, by deciders less close to the situation on the ground, or whose own job performance evaluation depends on the situation not being as dire: “You’re being alarmist. Don’t ask us to deploy troops, it’s not like Americans are going to actually storm their own Capitol.” And then after the quarter, “OK, Americans didn’t storm the Inauguration, but are you sure that’s because you so-called mitigated the risk with 20K troops? All this money, no attack, maybe we should spend that money on teachers instead of troops.” In this space, lack of negative outcomes breeds contempt for the mitigation. (Hmmm...) Interestingly, in the very long long run, that might even be right, as better education on civics is solving the problem at the left, earlier in the production line. So now you have a new problem, which is to convince those deciders not close to the problem and disinterested in openly admitting gaps, that they need to both spend on the 20K troops now, and double down on teachers for a payoff 10 years from now, so that after that they don’t have to spend on the troops... best luck.
BrandoElFollito 6y ago
Well, in reality this is what I present because this is what people usually present. What I am trying to say that if I was management, I would be only interested to see things that are useful to the business. If my business needs to be compliant with XXX, then a green status for XXX is what I need. If there is a problem information security cannot handle because (whatever reason: no commitment form another organisation, no budget, ...) I want to know that. Knowing that there are 7 attacks/sec or that there were 17 incidents would not help me. This also means that I trust Information Security to provide me the right information and do their job correctly otherwise. This is usually checked by an anual external audits (at least for financial compliance). What I do not want (this time in my real role in infosec) is to spend time providing meaningless data which management does not use anyway (but since "everyone" shows them, they want to see it too for a reason that escapes me)

Can't you present it as a risk / benefit analysis? Basically at the beginning of the quarter the open / larger risks were XYZ and now those risks have been mitigated or reduced.

Terretta 6y ago

Here’s how that goes before the quarter, by deciders less close to the situation on the ground, or whose own job performance evaluation depends on the situation not being as dire: “You’re being alarmist. Don’t ask us to deploy troops, it’s not like Americans are going to actually storm their own Capitol.” And then after the quarter, “OK, Americans didn’t storm the Inauguration, but are you sure that’s because you so-called mitigated the risk with 20K troops? All this money, no attack, maybe we should spend that money on teachers instead of troops.” In this space, lack of negative outcomes breeds contempt for the mitigation. (Hmmm...) Interestingly, in the very long long run, that might even be right, as better education on civics is solving the problem at the left, earlier in the production line. So now you have a new problem, which is to convince those deciders not close to the problem and disinterested in openly admitting gaps, that they need to both spend on the 20K troops now, and double down on teachers for a payoff 10 years from now, so that after that they don’t have to spend on the troops... best luck.

BrandoElFollito 6y ago

Well, in reality this is what I present because this is what people usually present. What I am trying to say that if I was management, I would be only interested to see things that are useful to the business. If my business needs to be compliant with XXX, then a green status for XXX is what I need. If there is a problem information security cannot handle because (whatever reason: no commitment form another organisation, no budget, ...) I want to know that. Knowing that there are 7 attacks/sec or that there were 17 incidents would not help me. This also means that I trust Information Security to provide me the right information and do their job correctly otherwise. This is usually checked by an anual external audits (at least for financial compliance). What I do not want (this time in my real role in infosec) is to spend time providing meaningless data which management does not use anyway (but since "everyone" shows them, they want to see it too for a reason that escapes me)