How to become a "security guru"

A comment on my last post claimed that every company needs a "security guru". This is a good idea, but the problem is that technical experts rarely have the "people skills" to be effective gurus.

The most important issue facing you experts is that people aren't going to listen to you most of the time. It doesn't matter if you are the summer intern or the CEO: getting people to listen is hard. It's not your job to "tell" people what the right answer is, but to "sell" your idea. If you get angry and poison your working relationships, you are not going to be an effective salesman. The reason experts get angry or frustrated is because they blame others for not listening to the "truth", rather than blaming themselves for their inability to sell their ideas.

The second most important issue is that there is no such thing as a "right" answer. Technical people fail because they always strive for the optimal solution to a problem, but as Voltaire says "perfect is the enemy of good enough". Your job as the guru isn't to steer to the organization toward the best solutions, but to steer them away from those that aren't good enough. Frankly this is because while you are often correct about what is "good enough", you are probably wrong about what is "best".

The geek's approach to selling ideas is to construct a logical proof of their idea such that nobody can disagree. This never works. Selling your ideas means you have to social engineer your co-workers. People make decisions for emotional reasons more than logical ones.

The most important social engineering technique is to shut up. The human emotion that drives most arguments is that we just want the other person to listen to us. The reason that somebody opposed your expert advice isn't so much that they don't like it, but that they wanted you to listen to their point of view. Often all it takes is win acceptance of your idea is to listen to your opponents. When you talk, you should ask pertinent questions or paraphrase what they've said in your own words. It doesn't matter whether you care about what they are saying or agree with it, what matters is that you prove them that you are listening. Objecting or arguing with them, no matter how wrong they are, puts you into the "not listening" mode, and should be avoided.

Your success often depends upon how well you deal with objections by others. Your instinct is to respond like you've been attacked, to go on the defensive, and respond with an argument. Resist that urge.

Try to figure out the reason for the objection. For example, the person may actually support your idea, but be looking for any problems before publicly endorsing you. Angrily counterattacking will, of course, be precisely the wrong thing to do in that situation. Some objections come from people who just like to hear themselves talk. When you argue with an idiot like this, most observers will assume you both are idiots. A big reason is for objections is that the person has some other agenda: your goal is to deal with that agenda, not with the individual objections that the person brings up.

Following the "shut up" principle above, the best way to deal with objections is not to argue. Your first instinct should be instead to ask questions. Good questions to ask are "Can you be more specific?", "Can you give an example?", "Is that your only objection?", "How would you fix it?", "I have no solution to that objection, does this mean that my idea has no merit?". The last one is one of the best: it social engineers the objector into feeling uncomfortable, and encourages them to overcome their own objection so that you don't have to. Remember: when you are listening to them talk, you are winning, when you are arguing, you are losing.

Don't go all emo. People pick up on your emotional state. You want to project a "calm-assertive" attitude. I get that term from "The Dog Whisperer" TV show, where the dog trainer tells owners to be calm-assertive with their pets, but the same applies to dealing with computer geeks. Showing emotion occasionally is okay, but only if you are in control of the emotion you are displaying, rather than letting the emotion control you. Remember that people pick up on subtle emotions well. You may be sitting quietly in the room, but be loudly projecting your sullen anger or agitation. When you can project an attitude that you don't seem upset by the fact that many (or all) disagree with you, then you've won half the battle. When you project the attitude that you are in control, then others will believe you.

I describe this as "social engineering", but you've probably guessed is that it really more than that. My previous company, Network ICE, had three founders. The reason we got along so well was because of instead of angry arguments, we aggressively attempted to social engineer each other. A typical "argument" would go like: "(Alice) What is your idea? (Bob) No, you tell me what your idea first! (Alice) No, I don't think you'll like my idea, so I think we should start with yours first.". Arguments where two people are trying to out-listen each other always end better than those where they talk to out-talk each other.

I could write a whole book on the topic, but these are the essentials:
- sell your idea, don't tell
- accept that there is no "best" solution
- listen, listen, listen
- don't get drawn into futile arguments
- stay calm and assertive