Last week, we discussed how User Experience design can help you identify the best opportunities to improve the experience of your internal customers. Today, we’ll make those lessons real with an extended example, constructing some user stories within the experience of authenticating to a model CRM. Each starts with a…

Last time, we discussed the doom and gloom of why nobody actually cares much about security. Today, we’ll discuss what you can do. Every day, people in your organization make decisions that impact security, and most won’t consult you or anyone on your team. To scalably reduce security risk, you…

Addressing a Persistent Lie in the Security Industry It’s a popular canard: security is the most important thing to get right. You hear it directly: some of the hippest of tech firms make pretentious pronouncements. You hear it via implication through the security industry: how Security Awareness and Education is so important, that all those people just need…

Building influence the boring way: making people’s lives better After raining on your parade and then telling you to be a better marketer and that everyone already hates you, we’re gonna dial up the crazy this week and propose something that I’ve never heard anyone in security seriously propose: put some real energy into good user experience. If your…

This is a continuation of a previous article. A year ago, I was discussing The Phoenix Project and unplanned work with a non-IT friend. He is an Optimizer like me and was pre-convinced of all these ideas. He suggested a fifth type of work: Performative Work. …

A lot has been written about Agile and its faster and crazier sibling DevOps. I won’t repeat it all here, but I’m generally sold. For those that aren’t convinced or are trying to convince others, you may like this great infographic that explains the most important parts. This time, it’s…

Last week, I explained how customer dissatisfaction can hinder progress in an overall approach to a successful security program. Today, we’ll talk through deeper organizational barriers in that strategy and what you can do. Cultural barriers to change If your organization prefers capitalizing spend, you may be vulnerable to stagnating capabilities. Continual improvement (or…

Last week, I laid out an overview of how you can use standard best practices of sales and marketing to achieve your security goals. Today, we’ll talk through some common barriers in that strategy and what you can do. Security’s Brownfield Problem Most IT professionals are familiar with greenfield and brownfield and know…

Last week’s post was a bit of a downer; it lays out an important but bummer truth for security people: your goals will never be a top priority for your organization. …