Security departments tend to get a bad reputation. Most often, it’s for being obstinate and oppositional towards whatever new thing the operations side of the business wants to do. The security ethos, after all, is that’s it’s better to not do something dangerous if you have any choice in the matter while ops functions tend to take more of a “damn the torpedoes” approach until and unless they’re forced to mitigate risk. This is natural. It’s the dynamic tension between the two viewpoints that helps upper management make informed risk management decisions.
Sometimes, though, security departments gain a reputation for being unable to communicate clearly. To a layman in the boardroom, security engineers seem like sharks; insatiable eating machines that relentlessly convert budget into useless infrastructure. I empathize more with the senior leaders in this respect: far too many of my colleagues have failed to explain to me – an insider with some technical savvy – what exactly it was they wanted to do, where they wanted to end up, and why it mattered. If I couldn’t grasp it, my non-technical executives hadn’t a chance.
Oddly enough, I think this critical deficiency isn’t due to some character flaw or artefact of an overly technical education. Instead, I think it’s a fundamental defect in communications skills. Specifically, a fundamentally flawed assumption that your audience mystically shares your personal vision of what you want, and therefore will understand your desired end-state even though you never clearly explain it. This assumption almost always leads to disaster. As an example:
When I was around five years old, my parents signed me up for piano lessons. I hadn’t ever expressed interest in playing the piano. While we had a piano, neither of my parents knew how to play it. The only music in our house came from my father (a) playing guitar in his office and (b) playing old 1930s and 40s country music on a transistor radio while he did the washing up. It’s not like we were some sort of “musical family” from a heart-warming TV drama.
Why, then, force your kid to learn the piano? It was probably due to an academic theory popular in the 1970s about how music helped make kids smarter or something. Learn an instrument and something, something, do better in maths. That’s my guess.
Anyway. As you’ve probably guessed, I didn’t “take” to the piano. I wasn’t interested in learning how to play “Mary Had a Little Lamb” and didn’t care what a “treble clef” was. Being five, I couldn’t see how knowing those things could improve my life. Getting scolded by a stranger I didn’t like for not “fingering” correctly on a song I didn’t like and didn’t want to play made no sense. Five-year-old me would’ve had more fun playing aimlessly in the dirt. As such, my piano “lessons” went on for a year before the endeavour petered out and died.
When I was seven, I transferred to a new school in a more upscale neighbourhood. There, I made new friends who listened to (and introduced me to) pop music. Stuff that I didn’t ever hear at home. Admittedly, most of the stuff my new friends were into was radio pop and disco, but whatever; it wasn’t 1930s twangy country. I hadn’t heard music that made you want to dance. That seemed much better than music that made you want to give up on life and take up drink.
So, when my parents circled back to the idea of their sprog learning an instrument, I surprised them by saying I was legit interested in playing “drums.” I’d seen a few high-energy drummers on TV and had a vague idea of how they were supposed to sound. I wasn’t really sure what a “bass drum,” “snare,” or “cymbal” were, but I understood roughly how they worked together to make radio-friendly funk and rock songs. I wanted to be able to do that. What those guys did.
My parents seemed delighted to get me back on the tutoring train. They signed me up with a fat old weirdo tutoring out of a skeevy instrument repair shop in a gloomy strip mall. I was issued a “training pad” and a pair of sticks, then spent one night each week for a miserable winter being taught how to precisely tap out morse code: TAP TAP TAP (pause) … TAP TAP (pause) … repeated endlessly. Spine as straight as a royal guard, arms rigid, holding one drumstick backwards in the most awkward grip, tapping in time with a metronome … It was obvious to my tiny brain that tap-tap-tapping had nothing to do with music and was probably something industrial.
I asked my “tutor” how what we were doing would get me to the point where I could play actual “music” like a real “drummer.” He never answered me. Instead, he lit another cigarette and wearily demanded that I mechanically tap out some tramp steamer’s last known coordinates.
I was, as you’d expect, exasperated and disillusioned. Little seven-year-old me was not smart, but even I could tell that what we were doing had naught to do with what I wanted to do. I felt I was wasting my time, so I hated practising. What was the point? My negative attitude, naturally, irritated my parent. Why were they paying good money for “lessons” when I wasn’t taking it seriously? I agreed! Why were my parents wasting money on morse code lessons when I wanted to learn to drum? They tried telling me that all drummers were required to learn classical rhythm something-of-other. I countered that my mate Clay had an entire record made by a “punk band” that didn’t know how to play their instruments and they were international celebrities.
In retrospect, I can understand why it all played out the way it did. My parents knew nothing about drumming, nor much (if anything) about modern popular music. When we each used the word “drumming,” we each pictured something completely different. With the best of intentions, they consulted a music teacher and were referred to an affordable tutor for people who wanted to drum in a high school marching band, not to perform with Earth Wind & Fire. Same verb, completely different end products.
As such, it was all time and money wasted. Worse, it had been a one-time opportunity. By the time I was 14 and met a young Neal Peart acolyte – a buy who both owned his own kit and could slam out a fantastic 45-minute improv solo – I couldn’t follow in my new role model’s footsteps. I was just marking time until I joined the Army. The only thing I’d be able to do with music was to play it on my car on the drive into work.
That silly story stuck with me when I got into the IT field. I watched fascinated as my various supervisors, engineers, and support staff tried and failed to explain what exactly it was that they wanted to be able to accomplish once everything was said and done. Instead, they’d talk about what they wanted to purchase, how long it might take, how expensive it would be, or perhaps why some obscure regulation of industry best-practice demanded … whatever it was they were trying to get funded. Boffin after boffin botched their pitch because the brass either couldn’t make sense of the ask or – worse! – had a completely different vision of what the end-state would be than the presenter had in mind.
If I had just sat my parents down – somehow – at the beginning of the discussion about drum lessons and showed them some video footage of John Bonham doing his thing in concert, it would have immediately disabused my poor parents from their assumption that had any interest at all in the school marching band. They might not have understood how to getme to where I wanted to be, but the shared operational picture of where we were going meant they could make shrewd decisions about what not to do.
I was a young subaltern when I first leveraged my botched “drum lessons” experience to successfully sell a controversial idea to my commander. I didn’t yammer on about cost or complexity or elements of my proposed project; I painted a clear picture of the finished product and only then explained how I proposed to get there … and I left myself open for my commander to suggest better ways to achieve my objective.
“Captain,” I said, “If I can build us a working PC out of parts from the DRMO yard, our clerk-typists can save all their memos, training schedules, and other docs as templates on floppy discs and then quickly create new records in half the time it’s taking them now to create everything new on the typewriter.”
My commander grokked my pitch immediately and helped me sign for a few pallets of scrapped IBM PC-XTs from the base hospital. Two weeks later, fourteen “broken” and obsolete PCs became two working machines, giving A Company the only unit in the Battalion with working computers. The boss became a rock star among his peers for his technical acumen and our clerks no longer had to work late into the evening generating paperwork. All because I was able to clearly communicate a vision (and knew how to tinker with old computer kit).
All that said, I strongly recommend that the most important professional development class a tech worker or security boffin moving into management can take is an interpersonal communications class. Yes, even before they pick up their baseline industry certifications. After all, what good is a GSEC or Security+ line on your CV when you can’t get the powers-that-be to understand whatever it is that you’re trying to do?
Pop Culture Allusion: The Art of Drumming(2018 documentary series that we didn’t get to see in America, dagnabit!)
