My Guest Blogger Eddie Block (CISSP, CIPM, CIPP/G, CISA, CEH) is a senior attorney in Gardere’s Litigation Group and member of the Cybersecurity and Privacy Legal Services Team who focuses on all aspects of information cyber security, including credentialing functions, firewall and IDS deployment and monitoring, and penetration testing, and related complex litigation. Eddie blogs at JurisHacker.

For many years I have said that anybody “that’s anybody that’s good with a computer is incapable of having a meaningful relationship with another human,” so I was pleased to see Eddie blog:

When I was a penetration tester I struggled to adequately express the importance of the vulnerabilities I identified. For some reason, I couldn’t convince the business and legal teams that the vulnerabilities had to be mitigated and that the business had to spend time and money on the effort.

Like many young and excitable IT and security people, I couldn’t understand why no one could grasp why this was important. “Are they idiots?”, “Don’t they get it?”, “They just don’t care about security!”

It turns out it wasn’t their failure, but mine. I wasn’t speaking in the right language.

I dropped out of the security world for three years and went to law school. When I enrolled, my goal was not to become a lawyer, but to learn to think and write like a lawyer. I enjoyed law school and took full advantage of the opportunities presented to me. I was able to work as a research assistant for one of the legal research and writing professors (Thanks Mike!), serve on the editorial board of the Law Journal, earned a fellowship in the Center for Terrorism Law, and leveraged my IT skills to get a job in the Westlaw lab.

I really enjoyed law school.

After law school I returned to security, this time with a different language under my belt and a better understanding of how to present my concerns. I couldn’t think in terms of security vulnerabilities anymore. I had to speak another language.

My big discovery was:

  • Security thinks about vulnerabilities;
  • Executives think about risk; and
  • Lawyers think about liability.

While they sound similar, they are distinct ways of approaching a decision. In order to communicate the importance of security to different audiences, I had to adapt to them and not expect them to adapt to me.

So need additional funding for a security project? Write up your proposals geared toward the audience and how they think. Does the lack of a security control create risk to the organization? Will the organization breach a duty and become liable under a contract, law, or regulation?

These subtle shifts in thinking may help drive the discussion forward and lead to better understanding and better security.