Speaker 1: Hi this is Kip Boyle welcome to Episode 218 of the cyber risk management podcast. Jake and I recently took some time off. So this week, we are bringing back one of the most popular episodes from the past few months. It's about how to get buy in to be influential so people actually want to do what you are asking. If you miss it the first time, or if you just want a refresher, there it is. Enjoy!

Speaker 1: Welcome to the Cyber Risk Management Podcast. Our mission is to help executives thrive as cyber risk managers. Your hosts are Kip Boyle, Virtual Chief Information Security Officer at Cyber Risk Opportunities, and Jake Bernstein, partner at the law firm of K&L Gates. Visit them at CR-Map.com and KLGates.com.

Jake Bernstein: So Kip, what are we going to talk about today in the Cyber Risk Management Podcast?

Kip Boyle: We're going to answer another question. This one is, how do you get buy-in for your good cybersecurity ideas?

Jake Bernstein: This is a sequel to episode 179, right?

Kip Boyle: It is. And as a reminder, last time we were also answering a question, which was how do you do cybersecurity when you don't have any allocated budget?

Jake Bernstein: Right, and we reviewed an entire year's worth of tasks that were going to move the needle, but didn't require any additional money beyond that, that was spent just for the cybersecurity analysts' salary, right?

Kip Boyle: Yeah. Yeah, that's right. But there's a dimension of answering that question that we really didn't get to, and that's what I want to talk about today, which is how do you convince your coworkers to collaborate with us? And that's a really important part.

Jake Bernstein: It is. Well, actually, I can tell you right now that it doesn't always work. Even if you wanted to grab the compliance hammer and bludgeon people into...

Kip Boyle: Submission.

Jake Bernstein: ... into submission, it doesn't work. And if you do-

Kip Boyle: Well you inaudible-

Jake Bernstein: And if you do and you do it, it doesn't have good long-term impact on your ability to maintain good relationships, which are critical for cybersecurity.

Kip Boyle: Yeah. As much as people want cybersecurity, and I know not everybody wants this, but some people really want it to just be about the ones and zeros. They don't really want to deal with the people dimension. But what they're dismissing is, I think the core belief that I have, which is it's all about people, even though there are ones and zeros involved. And so to act like, that the people dimension doesn't matter and that I could just swing the compliance hammer around whenever messy people come up into my field of view, yeah, not good.
We need to be influential, not dictatorial. You're right, we have to have good relationships because we're going to have to work with these folks, and we don't want them saying what they think we want to hear and then turning around and going and doing whatever it is that they want, right? That's the definition of shadow IT, shadow AI.

Jake Bernstein: It is. And we have, at this point, multiple episodes about cybersecurity culture, and in some ways, what we're talking about here is an aspect of culture. And I got news for you, culture is anything but ones and zeros. It's all about people.

Kip Boyle: Yeah. Yes, exactly. And it's just unfortunate that people are non-deterministic, unlike computers. You can give the same input to a person and you're not always going to get the same result. It's going to depend on how they feel that day, whether something awful has happened in their personal life or not, did they get coffee? Did they get the right coffee? I mean, there's just so much that will influence the way somebody's going to react. And I know that that can bother people who work in cybersecurity because they would prefer things to just be logical and somewhat predictable, but it's not. And that's why we have to talk about this subject.

Jake Bernstein: Yeah, absolutely. Okay, are you going to refer back to the tasks in the plan from our last episode, or are we going to do something different?

Kip Boyle: Yeah. I thought about going back to those tasks, but the issue that I found as I went back to them, is that was kind of sort of an academic exercise, and I really felt like we needed to do something a bit more real world, something that I'd actually been a part of, something a little bit more visceral. So that's what I'd like to do, and so here it is.
What I want to talk about is something that I've actually faced before, which is I was working with an organization that had a public facing web portal. One of the things that we did is we got in there to try to figure out how many stale accounts there might be. Now, this web portal had tens of thousands of accounts, and thousands of them were stale, like really, really stale, like hadn't been logged into for a year, two years, three years.
So the customer experience manager, who was responsible for all things related to this portal, Milton, name changed to protect the innocent. Milton didn't want to deactivate any stale accounts because he was concerned that somebody might suddenly want to log in and then wouldn't be able to. And so that was the issue, was how do I get Milton to help me lower the risk of a cybersecurity problem, a compromise of a digital asset that I don't think he either sees right now or doesn't believe is as important as allowing somebody to log in whenever they want to?

Jake Bernstein: Even if that's years later. And we're not even talking about anything more than just deactivate the account so that no one could use it. Back in the day, there might've been passwords on sticky notes that would've been a good compromise.

Kip Boyle: Yeah. Yeah, possibly. But I think at this point, Milton doesn't really understand that either, right?

Jake Bernstein: No. No. I mean, probably not. He's the customer experience manager, and his job is very different.

Kip Boyle: Yes, yes, exactly. So it's like, okay, how do we do this? What do you think?

Jake Bernstein: Well, I'm going to get my compliance... Oh, wait, no, I'm not supposed to get the hammer. To be fair-

Kip Boyle: inaudible from the last time you used it?

Jake Bernstein: I mean, see Kip, one of the things why it's great to do these episodes is to remember our different perspectives, is lawyers come with their own compliance hammers, right? We just carry them at our waist. And there's something about when we wield them, they're more impressive, or they're more effective. But that isn't the situation here.
You asked me what would I do? I have to take a minute to think, okay, well, I'm not the lawyer. Because quite honestly, when the lawyer says, "You need to do this for compliance reasons," that actually does work.

Kip Boyle: Right, and you're usually not talking to Milton.

Jake Bernstein: I'm usually not talking to Milton. What I would do here, if I'm not a lawyer and I'm talking to Milton, we can talk about executive buy-in, and cybersecurity starts at the top all we want until we're blue in the face, but let's just go with what we have here. I think what I would start to do is try to help him by explaining the risk as clearly as possible, in a way that is persuasive.
To really boil it down, I would look at this as a persuasion task. That's ultimately what we're trying to do. We want him to understand our perspective and then get him to think like we do. Here's a way that... A simple analogy is a good way of helping Milton think about this. We want him to think of stale accounts like leaving thousands of spare keys to your house with former neighbors, people who used to live next to you. And even if most people are honest, it only takes one bad actor, or this is not in the script, just someone careless who just leaves it around. I mean, that's almost more realistic, isn't it? I mean, there are plenty bad actors-

Kip Boyle: Or they didn't lock their door.

Jake Bernstein: Yeah, I mean, look, there's plenty of bad actors out there, but simple negligence is plenty dangerous enough. So here's what we would say. We have, let's say attackers use old accounts to steal data, customers will blame us, not the attacker. The data breach hurts our brand, makes customers leave, which is... What's the phrase there, Kip? Unplanned customer churn?

Kip Boyle: Unplanned customer churn, and that is something that, I don't remember the exact source of that, but that's been in my brain for a long, long time, because I think it was the cost of a data breach from the Ponemon Institute, that might've been where I heard that from.

Jake Bernstein: Could be, yeah.

Kip Boyle: But customer churn is something that organizations are used to. Customers are always leaving for different reasons, and so there's a planned amount of customer churn. But then when you have a data breach or something that is reputation related, that's negative, you can have additional customer churn that you didn't expect, that's not consistent with your typical business cycle. And then sales has to work really hard to replace not just the ones that naturally leave, but now they got to go get all the others replaced. It's a big problem.

Jake Bernstein: Yeah, for some reason, I'm thinking about some of these newfangled football statistics, like yards over expected or something, that it's just these crazy statistics that are super useful, but very esoteric. And unplanned customer churn is not that difficult to understand. It's how many customers did you lose that you didn't plan for, right?

Kip Boyle: Right. Yeah. If your normal churn rate is 2% per year and all of a sudden you're at 8%, wow.

Jake Bernstein: That's not good. What else? Customer trust impacts. Recovery from breaches will take months and can cost millions. The irony is that we're trying to protect customer experience, but a stolen account can lead to fraud and spam. Customers get really upset when their accounts are hijacked. And frankly, the service quality to all the other customers drops when we handle breach cleanup, because it's an all hands on deck situation.

Kip Boyle: Yes.

Jake Bernstein: I have a real world example here, a real business example, and this is 2024 when hackers used old accounts to steal data from Marriott. The breach hurt Marriott's reputation with loyal customers. Many customers left after the breach. And it's a basic, simple, real world example of exactly what this is.

Kip Boyle: Yeah. Yeah, okay, well, that's great. I think you're right on point. Probably people in our audience can think of even more things they could say to Milton, or take the things that you said and make them more substantial. But what I like about this is we're just confining the persuasion to the topic that Milton cares the most about, which is customer experience. We're bringing in other dimensions of it in order to make the point, but yeah. So yes, we need to explain to Milton what the real risk is in terms that he can understand.
Now, the thing here though, is it's probably not just Milton that we have to convince, although maybe with Milton as an ally, we could get this thing done. But let's assume he wasn't persuaded by all of that, because let's be serious, some of the things that you talked about he would never get blamed for. So he could just say, "Oh, yeah, that would be a problem, but it wouldn't appear on my performance appraisal next in the cycle."

Jake Bernstein: Yeah, he might say, "Well, don't create vulnerabilities that make this a problem." He could easily twist it over onto cybersecurity.

Kip Boyle: That's right, yeah. I think what we need to do as far as preparing for this conversation with Milton, is we also have to recognize that there's more going on than just Milton. For example, information technology, so the team, they have to put up with a lot of dead weight. If there's thousands of stale accounts, well that means they are scaling systems to handle more accounts than they strictly have to. That's a lot of extra expense and an effort on their part. The volume of data that needs to be backed up is greater and so forth, so that matters to them and they may not even be thinking about it right now.
Sales probably would be very unhappy to confront the idea that if we deleted a bunch of stale accounts, they'd lose contact with people who used to be really interested in doing business with us. But now we've deleted their account, or at the very least, we've deactivated it, so we've thrown friction into the idea that they might want to come back and buy something new from us.
If you've got an Amazon account and you haven't ordered from Amazon for a year, they want that account to just sit there and just wait for you to return. If you try to come back and order something, but you've got to reactivate the account, maybe you don't do that, right? Maybe you go someplace else, maybe you go to Walmart. So that's the sales dimension. And of course marketing, which, in the era of surveillance capitalism, they just want all data they can get their hands on. And I would imagine that the idea of deleting these accounts would probably make them feel a little crazy, because data's where it's at.
Yeah, so I think we have to recognize other teams have positions on this, pro and con, and I think the struggle here is that if we don't get all of these teams lined up, then we could end up in a deadlock. A situation that a lot of cybersecurity people end up in, which is, "Hey, we see this risk. We bring it to these stakeholders, they all say, 'We don't care,' or, 'Meh,' or whatever." So they're blocked somehow and then the risk just stays there. It hasn't really been accepted because nobody has said, "I'll sign the form that accepts that risk," but it hasn't actually been mitigated either. And so the problem just keeps growing and nobody makes the call.

Jake Bernstein: Yeah, I mean, abandoned risk is a huge problem. I mean, it's the tragedy of the commons, that's what this is. it happens in many, many places, and I think that when you have a situation like this, this is why it's so important for every problem and every risk to be owned by some team or another. Just because otherwise you end up with the tragedy of the commons, which for those who aren't up on that lingo, it just means that when nobody owns something, everyone else thinks that someone else will take care of it, and so it doesn't ever get taken care of, simple as that.

Kip Boyle: Yeah. Do you know which commons I believe... Well, when I first heard about the tragedy of the commons, it was with a story about a particular place. When did you hear about it, the tragedy of the commons?

Jake Bernstein: I honestly don't even remember. I can't even remember. I mean, I think I would've... No, honestly, I'll be making it up if I tell you what I think, so I'm just going to say I don't recall.

Kip Boyle: I heard it in the context of the Boston Commons, which is a park now in the middle of the city, but used to be a shared pasture that any farmer could take their cows or sheep to, they could graze.

Jake Bernstein: Yeah, could be. And I was just in Boston and I saw the Boston Commons plaque, and it was dated to the early 1500s. It was one of the first places in North America settled by Europeans, but well before the United States became a thing. So yeah, no, it's definitely an issue.

Kip Boyle: Yeah. This whole idea of tragedy of the commons goes all the way back to agriculture, and probably for a lot longer before that. But just this idea that you've got this public good or this public resource that nobody owns, and so everybody just takes the most they can get from it and ruins it, right? Fishing is another great example of that. You deploy fishing fleets and it completely depletes a certain species of fish, and then nobody can make any money.
But I like this example because I've been in this situation before, as I said, and I think that everybody listening to this episode who has ever tried to do cybersecurity work, has probably found themselves in a situation like this. So I hope that it's going to be relatable.

Jake Bernstein: A couple of things that come to mind while we're talking about this before we move on is that if you're a parent, you can say, "Do X because I said so." And when most kids, they don't like hearing that, and there's a reason they don't like hearing that. People don't want to do things "just because." And in business, the only person who can do that is the CEO, or anyone delegated authority by the CEO. But most of the time, that is not a very effective leadership strategy to just do things because I said so. What I was thinking more is that getting buy-in is a classic rhetorical challenge, and I don't mean that in the sense of rhetorical question, which-

Kip Boyle: You mean rhetoric, that ancient skill.

Jake Bernstein: I mean the ancient skill of rhetoric, exactly. And rhetoric is the ability to persuade, the ability to get a group of people to basically take your position-

Kip Boyle: Like a jury?

Jake Bernstein: I mean, yes. It used to be the critical skill of lawyers way back in the day. Well before there was forensics and e-discovery, so much of the cases were, how good at rhetoric are you? How well can you persuade the jury? The modern day version of that in the security standpoint, and I think, Kip, you can tell me if I'm wrong, but I think it is unfortunately common for security practitioners to go around and say, "Because security." Why do I have to do this? Because security. And that's only slightly better than saying because I said so.
The reason I think that is the case is that, because security makes the mistake that security is the end goal of the entire business. And this is a classic issue that frankly, I think many departments have run into over time, the whole tail wagging the dog issue. You hear about it a lot in the IT context where the business, it gets frustrated with its IT department, because from their perspective, it's like IT behaves as if the entire business exists to-

Kip Boyle: Feed it.

Jake Bernstein: Yeah, the entire business only exists to have an IT department. And that's obviously exactly the opposite, is the IT department exists to help the business. And the same is true of security. Security exists to help the business. It is not the end goal. So when you say because security, it's just not very persuasive because everybody knows, I mean, unless you're the CIA or NSA where because security actually could be accurate, then it just doesn't work very well.
The other thing too is you might be tempted, well, that's okay. I will go get mom and dad. I'm going to go run to the CEO or the CFO and I'm going to tattle. Well, that can be effective just like with sibling conflict, but just in sibling conflicts, if you tattle on each other all the time, it really just leads to more strife until you are old enough to grow out of it. And let's be honest, Kip, that can happen too inside an organization, with cybersecurity practitioners and anyone in the situation who is like, "I just want to do my job, I just want security, and people aren't listening to me." When we say this whole episode is about getting buy-in, and I think that what I just described over the last minute or so is a major barrier to getting buy-in. What do you think of that?

Kip Boyle: Yeah, I think you're right, and I think that it begs the question, if you are correct, then why do people keep behaving like that?

Jake Bernstein: They do.

Kip Boyle: Why do security people keep saying, "Because security," and why are cybersecurity people swinging or trying to swing the compliance hammer? Boy, it's endemic.

Jake Bernstein: Well, and I didn't even intend for this to be such a perfect segue into the next part of the script here, Kip, but one possibility is that they just don't know how, because it's not part of the training. It's like lawyers, we don't go through any training on project management or business management in law school. And a lot of lawyers come out, start their own law firm. Well, guess what? That law firm is business, and they're going to struggle for a while until they go and get business training. And so what we want to do here in the last 20 minutes or so of this episode, is tell you how to get everyone on board to the extent that we can.

Kip Boyle: Right. Yeah, exactly. I think anybody who's ever actually succeeded in getting buy-in or who can maybe guess at where we're going will not be surprised to find out that so much of this is just about what's in it for them? If you want Milton to do something, you've got to make sure that it's clear that he knows what's in it for him. But also sometimes when that's not persuasive, then it's like, okay, well what else can I do? And I think one thing you can do is you can start building a consensus so that when Milton realizes that everybody else wants stale accounts to go away, well then Milton has a choice to either defy that or get with the winning team. That can work.
Now, let's say that we want to build consensus because Milton heard everything we said, but he's still not convinced, so what would we need to do? Well, now the order in which you do this is up to you, but let me just go through the list here. The executive team, so let's say you have the ability to go talk to the CFO or the COO, then you could explain to them how hacked accounts stop sales from happening, and that cleaning up these stale accounts is a way to keep revenue flowing.
Now, you really don't have to... I think a lot of people get tripped up with this because they think, well, I've got to prove that hacked accounts stop sales. I've got to have hard data ready to go right then and there, and in my experience, you don't. It's just a rational explanation given with a certain amount of passion for the wellbeing of the business, is usually all that's necessary. That's how I would talk to the executives.
To the IT team I would go and say, "Look, we've got thousands of old accounts. They're slowing down the system. They're increasing storage costs, they're making everything... The data backups are taking longer as a result of that. You're having to buy more CPUs or cloud CPUs or whatever." That's how I would talk to them about it. For legal and compliance, I don't know if there was somebody on this podcast who could check me on this, but I would say that account cleanup is a form of audit defense, and it shows that we protect customer data by being diligent about these stale accounts. But how does that sound to you, counselor?

Jake Bernstein: Yeah, and it also reduces the potential e-discovery burden. I mean, we're making the assumption that these accounts are maybe just an email and a set of credentials, but there could be tons of data within the account. There could be be email communications. I mean, again, there's lots of different ways to interpret our little-

Kip Boyle: There could be banking information.

Jake Bernstein: There could be all kinds of stuff. Absolutely. I mean, absolutely there could be. I guess what I'm saying is don't use our example to discount any of these possible persuasive techniques, because just tweak the facts a little and it will make sense. I mean, account cleanup isn't necessarily an audit defense, but it sure is if the account cleanup means that you're getting rid of ancient transaction data.

Kip Boyle: Yeah. Right. You have to contextualize all this, I think is what you're saying.

Jake Bernstein: You really have to contextualize all of it. I mean, it is very much a fact-driven question every time.

Kip Boyle: Yes, you do like to say that.

Jake Bernstein: I do. I mean, it's the way that-

Kip Boyle: It's facts, right? You want some good facts.

Jake Bernstein: It's the way to go... Yeah. Yeah, well, good facts make good law. Bad facts make bad law. Couldn't help it, you got it out of me.

Kip Boyle: Yeah, I've heard you say that before. Okay, so there's some other people we might want to go build consensus with.

Jake Bernstein: Well, and sorry, Kip, I have to interrupt because now you've got me going on this. Just like good facts make good law and bad facts make bad law, good or bad facts can make or break your attempts to persuade. If I come to Milton and the facts are that the account cleanup is nothing more than a glorified email list, some of my attempts at persuasion are going to fall a little flatter than if the... When I say account cleanup, I mean accounts with megabytes or gigabytes even of data attached to them, just very different... The context does matter.

Kip Boyle: Yeah, EPHI, credit cards, I don't know, whatever.

Jake Bernstein: Yup, whatever, exactly.

Kip Boyle: Okay, so we want to build consensus with other people as well, so we could go to marketing and we could say... I mean, marketing's really concerned about reputation, so we could say, "All these debt accounts are a data breach risk, but a clean portal is more supportive of customer trust." And the last thing we want is a bunch of embarrassing headlines about a data breach, which is going to completely ruin their world because now they're going to have to drop all these campaigns that they wanted to run in order to be able to do damage control on a story that potentially is out of their control. It could be really a real big nightmare for marketing, so that's what I would say to them.
To finance, I would say, "Hey, storage costs are going to drop, license fees will probably shrink. We won't need our databases to be as big." And oh my gosh, the breach costs, I could just hand them a copy of the DVIR. We can avoid those. That's what I would say to finance. Then finally, to operations, right? "Well, less accounts means faster system response, fewer support tickets, and a better user experience." Do you think I missed anybody in this consensus building?

Jake Bernstein: No. I mean, so first of all, it depends on the facts, Kip. But I think this is a good list of... I think what this list shows really, is that you need to go to each relevant team and you need to persuade them with things that matter to them. If I go to the marketing team and I tell them how storage cost is going to go down and the system's going to respond faster, and oh man, there's going to be fewer support tickets, they're like, "Okay, I don't care about literally any of those things."

Kip Boyle: Yeah, they're going to be like, "You said there would be pizza?" So there's that.

Jake Bernstein: In order to get buy-in, I can't say this enough, you have to persuade with the facts that are relevant to your audience. I mean, I feel like this is just such a basic part of lawyering, but it's not taught in a lot of places.

Kip Boyle: Right. A lot of security people who would say, "Well, I'm just going to go tell marketing about the risk," right? Whoa, no, because remember Jake just said it, if you go and tell people about the risk and you're not getting a horrified, pearl-clutching response, it's because they don't understand why it's important to them.

Jake Bernstein: Well, and Kip even zooming out a little bit, before you go talk to anybody about risk, you better understand your own organization's risk tolerance and culture around risk. Because it would be... And this might horrify some of our more hardcore security professionals, but it is not an invalid response for any of these other teams to say to you, "The risk is fine. I'll take the risk."

Kip Boyle: Or just, "So what?"

Jake Bernstein: "So what," right? "Okay, the risk is higher, so what? It doesn't..." And I think that is something that can be very hard to accept. It happens to lawyers all the time. We're like, "But the risk of this," and the business is like, "Whatever." Which is why... And Kip, I don't know if I've ever said this before on the podcast, but I view my job in a lot of situations as being to provide options-based, risk-weighted options, or advice. Sorry, advice. Options-based advice, described by risk.
In other words, I want to be able to give clients, "Here's your choices, A, B, and C. A is the highest risk, and here's what that means. B is the medium risk, here's what that means. And then C is the lowest risk, here's what that means. And by the way, I recommend you take C, but you do you."

Kip Boyle: Right. Okay, that makes sense.

Jake Bernstein: I think in a lot of situations, security is in a similar position. We don't get to dictate policy. The business gets to do that. And if you can keep that in mind, I think you can really impact your persuasiveness when you know this is a bad risk to take, something that you want to fix, but you just can't necessarily get everybody to see that from your perspective. The way to do that is to give options and say, "Here's A, B and C. Here's the risk for A, B, and C, and this is my recommendation." I think anyone can feel pretty good about that at the end of the day.

Kip Boyle: Well, it may not be quite as satisfying as having people jump up and down and go, "You're a genius. Let's fix that immediately. Here's a bag of money."

Jake Bernstein: That doesn't happen all that often. When it does, great. I celebrate it, take it, take the win, but you certainly can't rely on that as the outcome.

Kip Boyle: No, you can't. But I want to say something to a point you made, which is if you go to somebody and you explain something, you've got an idea, like, "If we do this, then we can bring down this risk that I've seen." And if they say something to you like, "So what? It hasn't been a problem yet, why should I deal with it now?" That is a great example of the kind of pushback that I hear all the time, and it turns out that that is a very, very well understood form of pushback. And if you want to get really good at detecting common pushback patterns and how to deal with them, there's a book you ought to go get. It's called Buy-In, what a surprise. And it's by a guy named John Kotter, K-O-T-T-E-R. He is a very well renowned expert on organizational change management. And he has many other books.
This particular book though, is highly readable, and it's not just for Fortune 500 people. Anybody in any line of work that has to persuade people, will find this book helpful. So I wanted to put a word out for that book. I'm going to put a link to that book in the show notes, because sooner or later you're going to need that. And if you feel like you're not prepared for objections, even when you think you've done a good job of persuading, but you're still getting objections, well then maybe you're going to need this book. I really think it's worth the effort for you to get and to read.

Jake Bernstein: Yeah. I think this whole episode is really targeted at security professionals who are working their way up the chain, right? Because when you start as a SOC analyst, frankly, a lot of this isn't super critical. I mean, it could be, right? inaudible-

Kip Boyle: As a career skill, no. inaudible.

Jake Bernstein: Well, I should say as a role skill, right?

Kip Boyle: Yes.

Jake Bernstein: If my job is just to review the SOC logs, and of course I say that but then I realize it actually could be if you spot something and have to convince people that it's a big deal, it actually could be an issue even then. But that might be rare, it might not be.

Kip Boyle: Well, and you're probably talking to other cybersecurity people inaudible.

Jake Bernstein: You are, you would for sure, right? But certainly by the time you're headed toward CISO, this is going to be a critical component of your professional success. The ability to get buy-in is really going to make you stand out and really make your attempts more effective.

Kip Boyle: Yeah, and you're going to either stand out for a good reason or a bad reason, depending on whether you get this right. And I can tell you from firsthand experience that it is absolutely the case that when you're CISO, you are operating in more of a buy-in influencer environment than anything else. So you've really got to be careful if you think you're going to become, say at CISO, and you're just going to start issuing orders and people are just going to salute and do it, because yeah, that doesn't happen.

Jake Bernstein: Yeah. If that somehow is your reality, well then you stay there because that is a special position of authority that you've got.

Kip Boyle: That's right.

Jake Bernstein: It is not common.

Kip Boyle: No, it isn't.

Jake Bernstein: Okay. So Kip, first of all, that's a lot of conversations that we just talked about having. That could be days or weeks to convince everyone, are you sure you don't want to just reach for that compliance hammer?

Kip Boyle: I have a visual in my mind of Thor reaching for the compliance hammer.

Jake Bernstein: Oh, that's exactly the same, I was thinking Mjolnir as well. It is the compliance hammer.

Kip Boyle: But no, I think I'm going to continue to resist that temptation, but I think I can probably get the other stakeholders on board, or at least enough of them that I can go back to Milton. Now, if I can't, then I'm going to follow your advice, which is I'm going to say, "Okay, you want to accept the risk." I'm then going to go to the highest authority, the person that I can get to, and I'm going to say, "If you'd like to accept the risk, I'm cool with that, but I do need to document that you've accepted this risk, because I'm not going to just let it go."

Jake Bernstein: Oh, a hundred percent, a hundred percent. If someone wants to accept risk, fine, but whether you consider this to be good practice, CYA or whatever, get it. Make a record. Make a record. Because here's the thing, if someone accepts a risk and you don't have any evidence that they accepted the risk and it's a cyber problem, it will come back on you. And if you don't have the thing that said, "Hey, I gave everyone the advice, I gave them options. This is the one they chose." You have no defense.

Kip Boyle: No, no, you're going to get in trouble because a guy Jake's going to come along. Well, I mean an attorney inaudible.

Jake Bernstein: No, that's right. It is true.

Kip Boyle: And he's going to depose you and ask you, "Well, I see you identified the risk. What did you do about it?"

Jake Bernstein: That's true. I mean, this is correct.

Kip Boyle: And then you're going to say, "Well, I got frustrated because nobody would listen to me, so I just stopped bothering." And you're going to say, "Really? That was your answer?" Are you a inaudible by any chance?

Jake Bernstein: I'm going to say, "Thank you very much..." I'm going to say, "Thank you very much, no further questions," because that's all the evidence of negligence I might need.

Kip Boyle: Yeah, so let's not go there. Okay? But let's say you were persuasive and you've got other internal stakeholders on board. Now I would go back to Milton and I would probably say something like, "Milton, I just spoke with a bunch of other senior leaders and they absolutely agree that this is an issue and we should do something about it. Now, I know you want to keep the door open for returning customers, but what if we work together on some kind of a friendly approach to check to see if people still want their accounts?"
Maybe it could start with an email we send to them and say, "We miss you. If you'd like to keep your account open, no problem. Just log back in." Jake, I get these emails every now and then for stale accounts, and I'm not put off by it. We could give them plenty of notice before we deactivate their account if they choose not to activate it again. But we'd also make it easy for customers to keep their accounts active too. Then I'd say to Milton, "Can we work together to come up with a plan that's going to protect our customers as well as the experience that they have dealing with us?" And I would hope that that would be persuasive. If it wasn't, then, okay, now I'm back to that place of like, okay, so I'd need to escalate this now, and-

Jake Bernstein: There is definitely a time and a place for escalation. But Kip, what I want to ask you is where'd you come up with those three options? The three inaudible?

Kip Boyle: Those three options?

Jake Bernstein: Yeah.

Kip Boyle: Well, I told you I've actually been in this situation before. These are three options that we came up with as we worked through this.

Jake Bernstein: What I want all of our listeners to take away from this is that even when you're in security, it pays to understand the business. It pays to understand, at least to some degree, what other people in your organization do. And it goes back to the not being overly focused on just one thing. If you spend all your time focused on security only and your gut reaction to any challenge is, "Because security," you're going to find it hard to come up with alternative solutions that might work.
Reason I asked you that, Kip, is it isn't necessarily obvious, particularly if you've only ever worked in security, that how you might come up with ideas like this. Because these are customer service ideas, right? They're customer experience driven. And, I don't know, what advice do you have for people... And do you agree with me that this is why it's important as the security person, to understand your business. You can't just understand security and call it good.

Kip Boyle: Yeah. Yeah, I totally agree with you. And the more senior you become in your cybersecurity career and eventually maybe you're the VP of information security or director level, or whatever it is, you've really got to show everybody that you can think about the business to which you are serving. Now, when this came up for me, it was in the insurance context, and so I didn't know anything about insurance when I started working there. I mean, I knew that I could either give my money to a Geico or Flow. I knew that.

Jake Bernstein: Yeah, of course.

Kip Boyle: But I didn't really know how insurance worked. Well, by the time I left there seven years later, I really understood how insurance worked. But that wasn't because anybody force-fed it to me, it's because I knew as a, how do I survive and thrive here? That I needed to learn how insurance worked, at least enough to be able to participate in insurance related conversations and that sort of thing. But if you don't want to learn about the business, I would say just don't expect to get promoted.

Jake Bernstein: Well, and I'm glad you said that, Kip, because what I was going to say was that when you think about what causes people to not listen to you, if they can accurately have the thought of, well, "This person doesn't know anything about the business," or, "This person doesn't care about the business," which is what matters most, if they have those thoughts, you're going to have a real hard time persuading anyone to do anything.

Kip Boyle: That's right. Yeah. They're not going to take you seriously.

Jake Bernstein: They won't take you seriously. And because security isn't good enough 900 times out of a thousand, or 999 times out of a thousand.

Kip Boyle: Yeah. And that's a fact you can put in your brief.

Jake Bernstein: Yeah. All right. Well I think we have very adequately discussed how to get buy-in. We've summarized it as learn the business, be persuasive, understand the importance of building consensus and how to do that, and really-

Kip Boyle: And the book, don't forget Buy-In inaudible.

Jake Bernstein: And the book. And that even though this has nothing to do with ones and zeros, it is critical skill for cyber security professionals, particularly as they advance in their career.

Kip Boyle: Absolutely. Well that wraps up this episode of the Cyber Risk Management Podcast. Today we asked, and I think answered the question, how do you get buy-in for your good cybersecurity ideas? We'll see you next time.

Jake Bernstein: See you next time.

Speaker 1: Thanks for joining us today on the Cyber Risk Management Podcast. If you need to overcome a cybersecurity hurdle that's keeping you from growing your business profitably, then please visit us at CR-Map.com. Thanks for tuning in. See you next time.