Lockheed Martin Corporation, USA
Copyright © 2000 Virus Bulletin
(This article was first published in Virus Bulletin, December 2000.)
I sometimes feel like a weatherman with a part-time job as a car salesman. Just as the guy on the news predicts the weekly weather I get to predict what type of viruses might be coming, and the level of protection I will need to employ to protect my company. Those of us who do make these predictions have the near impossible task of selling them to the pivotal people in our corporations so that they don't think we are just crying wolf.
For example, many people in the industry believe we are on the cusp of a new wave of viruses that will be Linux/Unix-based and will cross over to that aloof group of Unix users which often says 'I use Unix so viruses can't touch me'.
I'm fortunate to have receptive server administrators who take my recommendations seriously but, how do you convince someone who doesn't respect your knowledge they should spend thousands of dollars on a solution for something that doesn't exist yet? How do you communicate to someone that the best you can expect from your solution is that nothing will happen? How do you get the policies implemented to make your job easier?
Recently, I attended a conference where I had the opportunity to meet many people who share the same daunting task that I do protecting their corporations from viruses. Most of these poor souls have the job of tracking viruses, testing products, pushing out updates of existing products, and reporting virus statistics. More often than not this is on a limited budget with limited manpower. Some are doing the job part-time and many of them have little of the actual organizational power that would allow them to do their jobs properly. Most of the conversations I had involved having to deal with 'stupid users' and not being able to get the resources needed to do the job.
As I listened to the various reasons (and, frankly, endless whining) being given for their problems, I thought to myself that the problems that AV people encounter are very often brought on by their own attitudes. Being something of a technical 'weenie', I sometimes forget that I perform a service to a customer.
Realising that I serve a customer (albeit, in my case, an internal one) was an eye-opening experience for me. I had fallen into the trap that there were no grey areas when it came to my recommendations. Newsflash folks, a hard-line approach like this will cause people to go on the defensive, with the result that nothing you say will be heard. This is what causes many of us to lose our credibility and more importantly, funding.
So what is the answer? Instead of telling your audience what you want, sell them what you want. As with many of my peers, I work in the Information Security department. Most people see any department with the word 'security' in its name as the enemy. To overcome this my supervisor, who has a degree in Marketing, suggested that I should sell what I do instead of just telling what I do. So when I receive an inquiry from a client regarding a particular virus, instead of saying 'yes, we're protected' I'll say, 'We've been protected for 3 weeks, and here is a little information about it, thank you for your help'.
What's the difference? One is directly to the point and the other is user-friendly. Always let your customer know that you're happy to help and that it is all part of the service, even if the question is about an annoying two-year old hoax. When you attend inter-departmental meetings introduce yourself to employees you don't know and let them know that they can call you if there is ever anything that you can help them with. Many times this has put me in direct contact with Managers and Directors – the very people who will be approving the new software I need or the new policy I need support on.
The bottom line is 'get over yourself' and change the way you approach the whole process. Most of you reading this article have the technical skill but do you have the people skills? Sell yourself and your service. Not getting the funding and the staff you want might not be the problem. You might be the problem.
Before you can get people to provide the tools you need, they have to want to listen to you. You have a much better chance of getting funding, more people, or a new policy if the people who perform these services think of you fondly. I know it sounds campy and is terribly friendly but those 'stupid users' pay your salary, and let's face it a grumpy virus researcher without a job is an unemployed nerd with a bad attitude.
