The Newberry Group Blog

Social Media in the Cyber Security Space

Last fall, I started as an intern at the Newberry Group with objectives of assessing the impact of growing a social media presence, developing a strategy for social media use and executing on that strategy. After nine months, my team and I accomplished these objectives and learned a great deal about the cyber security digital community in the process.

In my relatively short, but deep dive into social media strategy and development over the last two and a half years, I’ve witnessed how different the digital communities can be. The cyber security digital community is particularly fascinating. My team found that cyber security professionals tend to fall into two buckets when it comes to social media. There are those who embrace social media due to their above average understanding of its utility, and there are those who avoid it at all costs due to their above average understanding of the risks associated with it.

This creates an interesting obstacle when engaging with the cyber security digital community. The space expects a sophisticated level of engagement, yet can also feel fragmented and reserved. It seems most companies have accepted that they need to be present on social media but there are huge disparities in utilization. Some online presences are merely place holders while others are hosting weekly webinars.

My team at Newberry decided the greatest value was between these two extremes. We saw opportunities for talent sourcing, service promotion, and partnership development, but we also needed to be realistic about the amount of capacity we could commit to these efforts. The value is there to be had, but only with the people and buy-in to capture it effectively.

We knew we didn’t have the capacity to be active in every space or create a large amount of unique content so we focused our efforts on building out the spaces we felt had the most value and created a content strategy that balanced quality and thought leadership with consistency and practicality.

Creating a social media policy also became a critical element of our strategy. The greatest enemy of engagement is uncertainty and, in a space as sensitive as the cyber security community, assessing the appropriateness of a 140 character tweet will likely lead to abandonment. We want to be as explicit as possible about our internal expectations for social media because we believe it will remove that uncertainty and foster greater internal engagement.

The development of a social media strategy and policy that balanced value with capacity is the product of what has become my biggest take away from my time at Newberry. I’ve learned that the benefits of social media do not appear over night. Early wins can be few and far between. But, sustainable and consistent execution of social media builds equity in a digital community that eventually translates into real company value.

This kind of sustainability requires a hard look at where a company can be most effective and then tailoring that to the company’s internal capacity. Instead of leaving social media to the intern as many companies do, my team decided early on that there was no point in me doing any of the day-to-day social media work. Instead, I focused on strategy and setting up Newberry’s internal structure – things that once set in place can be utilized with minimal maintenance.

I’m confident that as I leave Newberry my work will be appreciated, not missed. I’ve helped give Newberry the tools to continue to build value in the cyber security digital community on their own. While this was not part of the three original objectives I had going into the internship, I believe it is by far the most valuable and can serve as an example to others in the space.

Developing Effective Peer Relationships

Being “Action Oriented”, having “Career Ambition”, being excellent at fostering a “Boss Relationship”, maintaining “Customer Focus”, and excelling at “Directing Others” are critical to growing into a management role and being effective in that role.  However, these vital competencies can often get in the way as one moves from being an effective manager to becoming an effective leader.  Career growth early in one’s profession often is dependent on being effective “up and down”.  Building trust and credibility with clients and bosses (up), and effectively directing those junior to you (down) to achieve superior results is of paramount importance.  However, as one’s responsibility begin to expand to support scale within an organization it is imperative that individuals begin to work “across” and foster effective peer relationships.  Learning to work “across” is in fact the essence of organizational leadership.  Leaders are able to achieve positive results for the organization even when they do not have direct power and control over all resources involved in the activity.  Leaders are able to work through influence; trading on mutual respect and goals, share credit and rewards, and build and grow trust.  This highly valued ability leads to a more efficient use of time and resources by easing the exchange of ideas and talent across the organization.  Managers direct their people.  Leaders make the whole organization better.  Certainly this requires putting one’s ego on the back-burner but the rewards for those that do are huge.  You become recognized for being someone that can work and be effective well beyond your direct span of control for the good of the organization.  How do you make this transition?  Fortunately, Lombardo & Eichinger and others offer some suggestions:

Practice #1: Curb your Competitive Nature.  If peers see you as excessively competitive, they will work to cut you out of the loop and sabotage your efforts to work across organizational boundaries.  Always offer an explanation for your thinking and invite others to explain their point of view.  Resist “staking out a position” and focus on generating a variety of possibilities.  Invite, and accept, criticism of your ideas.

Practice #2:  Separate working smoothly with peers from personal relationships.  Remember, you are not forming friendships, you are avoiding “one-upsmanship” and the “not invented here” phenomenon in all your organizational interactions.  You are keeping your ego and pride in check for the good of the organization.  That is the reputation you seek to build.  You don’t have to “Like” everyone.

Practice #3:  Avoid the water cooler banter.  If a peer does not play fair, avoid talking about it with others.  Talking about conflicts with others will often backfires on you by undermining the trust you are attempting to build with other peers.  Confront the peer directly, privately, and politely and give them a chance to save face.  Explain the unfair situation and its impact on you.  Even if you don’t totally accept what is said, you have set the stage for an improved relationship going forward.  More importantly, you will reinforce your reputation as a person who can be trusted even when there is a conflict.

Practice #4:  Keep a balanced Scorecard.  Watch out for “winning” too much.  Look for appropriate opportunities to grant concessions you can live with even if they are not what you wanted ideally. You want to foster a desire in others to work with you again and again.  If you are seen as leader who has a strong point of view but is willing to cooperate and compromise with others that favor will be returned when it matters most.  You will create an army of influential peers who are all to ready to support your position because you supported theirs in the past even when you did not totally agree.

Make no mistake; learning to achieve results through influence alone is a tough skill to master for ambitious people.  However, the fact remains that those who leave positive impressions get more things done more efficiently than those who leave cold impersonal impressions.   Learning how to build and sustain peer relationships is the cornerstone for developing organizational agility.  I look forward to discussing this this vital skill next time.

Social Engineering through Social Networking: Defending Your Organization

Human beings are the weakest link in data protection. Social networking has made this weakest link, even weaker.  Social engineering continues to be one of the most leveraged attack vectors for targeting an organization’s electronic data or IT systems.  Historically, a social engineering attempt would consist of an unsolicited phone call or e-mail. Attackers would attempt to obtain reconnaissance-related information from an unsuspecting employee or get them to click a link, or download an e-mail attachment, that would introduce malware to the system, potentially allowing backdoor access to the network.  As users have become more educated on information security, they have learned not to open attachments or click links from individuals they do not know or trust.  However, with the continued growing popularity of social networking, potential attackers can perform a more targeted social engineering attack that exponentially increases their level of possible success.  

One piece of information typically found in social networking profiles is employment information.  A quick search on LinkedIn or Facebook can reveal a list of potential social engineering targets for just about any organization.  By using the information found in the target’s profile, the attacker can craft an e-mail that looks legitimate and includes an attachment or link containing malicious software.  If an attacker determines the target worthy, they may even establish a false profile reflecting similar interests and befriend the employee, allowing them to eventually introduce the malware through an e-mail or link. 

Since it is not feasible to control and monitor what employees put on their personal social networking profiles, how can an organization appropriately defend against this type of attack?

1. User Education:  This has been, and always will be, the most effective tool for combating social engineering.  In addition to the typical IT security training provided by most organizations today, users should be educated on what company information is appropriate for disclosure on social networking sites and how this information could be used to exploit them.  Employees should understand that individuals they make contact with online should not be considered a trusted contact.  E-mail attachments or hyperlinks from these online contacts should not be accessed from company-owned computers. 

2. Policy and Procedures:  Organizations should prohibit employees from using, or listing, their company e-mail addresses on social networking sites.  If the social networking sites are a means for networking or marketing and part of official job duties, then look at establishing a generic e-mail account with increased security restrictions that the employee can utilize.  This will allow the employee to identify any contact that is made through the site and treat it as untrusted. 

3. Security Infrastructure:  A reputable web proxy with malware scanning capabilities should be utilized to scan web traffic for potential malware.  URL filtering should be enabled and sites that contain known malicious code or malware blocked.   Social networking sites should also be restricted for users that do not have a business purpose for visiting them.   URL filters typically have groups of sites that are categorized and updated to make this process easy.  Finally, a spam filter device or service should be used to scan inbound e-mail for malware and filter unwanted e-mail.  Some spam filtering devices also have the capability to scan outbound e-mail for sensitive information such as social security or credit card numbers; this is commonly referred to as Data Loss Prevention (DLP). 

With employees advertising more personal information on social networking sites, we can expect to see a continued increase in targeted social engineering attacks.  As with any security threat; a layered defense strategy is the best defense against social engineering attacks. 

Making Quality Decisions

You have worked hard to become a confident decision maker, even in the face of ambiguity.  How do you ensure that you hit the target more often than not and, more importantly, get closer and closer to the bull’s-eye over time?  You must practice.  Making good decisions requires the right amount of patience, humility, and ice cold nerve to step up and make the call.  As I discussed last month; no one is right all the time, it’s being more right than wrong over time that matters.  You must develop a highly refined sense for the right amount of data, analysis, intuition, wisdom, experience, and judgment required for each decision opportunity.  Michael Lombardo and Robert Eichinger and others have proposed some ways to refine that “6th Sense”  that is so recognizable in people renowned for their decision quality.  A few of my favorites include:

Practice One: Know your biases.  We all have them; attitudes, beliefs, opinions, prejudices, favorite solutions or ways of doing things.  The key is to not let them influence your cold objective point of view.  Before you make any significant decision, step away.  Examine your motives; look at your past decisions; talk through the consequences of various decisions with a trusted third party.  Look for patterns.  Do I see every problem as a nail demanding a hammer as a solution?  A great decision maker is constantly, humbly, examining the source of his intuition and challenging himself to recognize each problem as new while eliminating his own prejudices and biases.  Much of what we learn is relevant to the next problem, but a lot is not.  Work to know yourself first, then the problem, and then decide.

Practice Two: Holster your gun and sleep on it.  Life is a balance between waiting, and doing.  Clearly in business a premium is placed on doing over waiting.  However, decision quality can often be greatly improved with just a small amount of additional data and/or reflection.    Challenge yourself to gather one more piece of data relevant to a meaningful “Why?” question.  Let the subconscious brain aid your efforts.  Get a good night’s sleep and get back to it in the morning.

Practice Three: Understand the difference between “Thinking”, “Understanding”, and “Knowing” when defining a problem.  Do you ever represent (or more accurately, misrepresent) as fact your personal assumptions or the opinions of others using the expression “I know that…”?  I personally believe this common tendency of people, to mischaracterize personal thoughts and the conjecture of others as “known” facts, is the leading cause of poor decision making.   There is a very simple formula to get out of this trap:  When you “think” something (created between your own two ears), seek validation from a credible third party or obtain first-hand knowledge of the critical facts.  When you “understand” something from a credible third party, seek first-hand knowledge of the critical facts.  Only when you “know” the critical facts through direct first-hand exposure - - act.

So quality decision making is born first of self-knowledge.  Being humble enough to examine our motives and tendencies as a starting point and building a framework of the problem through careful consideration and seeking to understand cause and effect; asking “Why?” a lot, as we discussed last month.  The final step is to have the patience to seek relevant data and most importantly having the guts to seek first-hand knowledge of the most critical facts.  In doing so, you elevate your perspective and attain that “6th Sense” for the right call.  You will become recognized as someone who is willing to own their decisions and the basis upon which they are made.  And that is the first building block for effective peer relationships and effective team building, which are the essence of leadership.  I look forward to discussing those skills next time.

Dealing with Ambiguity

How does one survive - - and thrive - - in this modern world? In my experience, it starts with learning how to effectively deal with ambiguity. This critical skill, which I introduced at the end of my last post, is important because; congressional leaders are unable to make tough budget decisions; good people can sometimes do bad things while bad people can also do amazingly good things (consider Lance Armstrong); Getting great at anything runs straight through being awful at it; The solution for today’s problem may not be the solution for tomorrow’s problem. In fact, for 90% of business it’s not clear what the problem even is, let alone what the solution could be; the only constant is change.  We live in a “grey” ambiguous modern world.

Please note that I did not say “make only good decisions...”  I said “make more good decisions than bad...” All successful people today have learned to live comfortably in the “Grey Space” by cultivating a well-developed tolerance for errors and mistakes - - both for ourselves and others - - and absorbing the heat and criticism that might follow.

Make no mistake, this is a tough but extremely valuable skill to learn and develop.  In the words of English Statesman George Savile - - “He that leaveth nothing to chance will do few ill things, but will do very few things.”  And we all know that “doing very few things” just won’t cut it in today’s world of work - - and especially not in a dynamic, energetic, and empowered culture like we have here at Newberry Group.  We must learn to thrive and act effectively in the “Grey Space”.  So how do we learn and develop this tough skill and effectively deal with ambiguity?  Michael Lombardo and Robert Eichinger propose some of the following in their book “For Your Improvement”:

Practice One: “Incrementalism”.  Research indicates that we do not grasp the essence of a new problem until the second or third attempt at solving it.  Plan on making a series of small decisions, get feedback, correct course, and get a little more data moving forward until you have solved the problem. Start small so you can recover quickly and build confidence that you can “handle the heat” and course correct.  You will not build this confidence if you start with “the” problem.

Practice Two: Recognize your Perfectionism for what it is - a roadblock to success.  Perfectionism is born of an obsessive need to collect more information than the other guy, thus limiting your personal risk.  Try to decrease your need for data and your need to be right a little every week.  Pick small decisions and try to act on them with little or no data at all, trusting your gut.  As discussed before, the real test in the world of business is who can make a good decision on limited or no data in a reasonable time frame.  That takes practice so start with the small stuff - - you will likely be surprised how often you are right.  (And if you find that you’re not more right than wrong, you need to read next month’s blog  :).)

Practice Three: Ask “Why?” a lot.  Evidence from decision-making research makes it clear that the better your problem definition, the better chance you have at finding the solution quickly.  Focus on causes, not fixes. http://www.isixsigma.com/dictionary/5-whys/

Practice Four:  Develop a philosophical stance toward failure/criticism.  Learn to crave feedback.  The faster and more frequent the feedback on small problems the faster and greater our learning.  Teach yourself by letting others “off the hook” when a mistake is made by focusing on what we can learn from the mistake, not the consequence.  In doing so, you will bolster your own ability to handle failure and criticism.

Practice Five:  Become Process focused, not results focused.  To work well in uncertain times means that you must recognize first and foremost that your work is never done.   If the only constant is “change” then that constant will demand that you jump from incomplete project to incomplete project. You must alter your internal reward structure so that you feel good about moving things forward incrementally instead of finishing it. In taking this approach, you will not only cease to be easily frustrated, you will also find that the critical few things that need to be finished – in the sea of insignificant many things - will be.  Trust that “through the process” the results desired will be derived from completing the critical few, not everything you start.

Working to develop your ability to deal with ambiguity will give you the will to confidently act when information is limited.  But like every well-developed competency, its over-use can become a weakness if relied upon too often or worse, exclusively.  A complete person or a complete organization fosters complementary competencies that provide balance and assure that strengths don’t become weaknesses.  One of the strongest complementary competencies for those that are comfortable with ambiguity is a strong sense for what is, and is not, a quality decision.  Developing this critical competency in our culture will be the topic next month!

Building Culture through a Common Language

5 Tips for Building a Cyber Security Career

The cyber security field is rapidly expanding to deal with the accelerated risks of changing technology and now is a great time to make the move into a security career. However, not only do you need the qualifications, but also an analytical mindset and good communication skills to effectively convey your expertise to the wide range of customers. Cyber security experts are always chasing an elusive problem and you have to think outside the box quite a bit to find that advanced persistent threat. Here are five tips on how to build your successful career:

1. Develop a Solid IT Foundation

In the case of cyber security, it's really beneficial to have a strong background in information technology. A lot of universities have modified curriculum to provide security focused-degrees. Previously you might have been restricted to computer science or information technology, but now there are actual degrees tailored around computer security.  These programs are often sponsored by entities that are focused on cyber security and want to help build the workforce. For example, currently the U.S. government has a shortfall of cyber security professionals. So they have started working with universities to establish these programs to help grow the cyber security field and fill the jobs that they know will be out there.

2. Get Certifications and Training

Certifications are necessary because they establish a foundation. They identify the individuals that have put in the time and effort to understand the fundamentals of cyber security.  The CISSP certification is a well-known and internationally recognized security certification and is a great starting point. But with all the different domains of expertise within the security field, you should hone your craft and acquire certifications for your specific area.

3. Use Your Past Military Experience

Today, information technology in the military is no different than it is in the corporate world. There are disciplines within the military that focus on IT and cyber security, so veterans have an opportunity to directly transfer their experience from military service into commercial cyber security work. 

4. Use Your Existing IT Career

If you've been in IT for a long time and you have a strong background, you have most likely been exposed to security issues. In all reality, you probably have a level of experience that would qualify you to easily transition and adjust to cyber security work without having to start from the ground up. Talk to your peers or managers about what security opportunities are available to you. Also take some personal initiative to start working on a certification in your area of interest.

5. Build Up Practical Experience

At the end of the day, just like in any field, you need the qualifications and the practical experience.  And you have to work your way up. Unless you have a lot of applicable experience, expect to start at the bottom and prove yourself so that you have the evidence to put in your resume. Certifications are great because they establish a foundation through the training, but practical experience is just as important. If you don't have the experience, be forthcoming about it, but also have the wherewithal to press forward with developing your career.  

Are there jobs out there?

There is a wide range of cyber-related jobs and almost every industry will have availability whether it's on the commercial side or federal side. In some cases, a cyber opportunity might be there, it just might be coupled with 2 or 3 other roles at the same time; You might be the cyber expert and the IT guru. Newer fields within information technology or security, such as cloud security, mobile security, digital forensics, and malware analysis, are all hot domains so you'll see a lot of opportunities advertised. However, no area in cyber security has lost momentum. Cyber security as a whole is a hot industry to be in, and I predict it to be so for the next couple of decades. It's not slowing down.

October is National Cyber Security Awareness Month (#NCSAM)

We’re one of the official champions of National Cyber Security Awareness Month (NCSAM) and there’s still time to get involved!  National Cyber Security Awareness Month is a campaign focusing on the need for improved online safety and security for all Americans. The National Cyber Security Alliance has sponsored National Cyber Security Awareness Month every October since its founding in 2003. 

This year’s theme is “Our Shared Responsibility.”  So how can you help?

1. Share Tips and Resources with Your Friends and Family

The National Cyber Security Alliance (NCSA) website is full of tips on how to protect your personal information, teach online safety, and keep your business safe online. Would you know what to do if your accounts were hacked? Do you need resources to help teach cyber security in your classroom?  Does your small business have a Cyber Security Plan?
Find resources and tips on www.staysafeonline.org.

2. Attend An Event and Share It!

Organizations all across the United States are hosting cyber-related events to help raise awareness.

• Find an event in your area on the Events page: www.staysafeonline.org/ncsam/events
• Stay at your computer and check out these FREE Webcasts from SANS:
  Securing The Human 
  Oct 16th and  Oct 30th
  Register on their website: http://www.securingthehuman.org/blog/2012/09/06/three-security-awareness-webcasts-for-oct/

Newberry Group is proud to be a part of National Cyber Security Awareness Month. Anyone can help raise awareness in their community, let’s continue to help others stay safe online!

To learn more about the National Cyber Security Alliance, visit www.staysafeonline.org.

Understanding the ‘Why?’ in B2B Social Media

Last January I came across this post by Brad Friedman, Build Your Social Media Schedule For 2012.  He explains that while more and more business are getting into social media marketing, many get into it for the wrong reasons. I came across this post while skimming through an abyss of opinions on ‘Social media resolutions for 2012.’ What caught my attention was this:

Start with the – "Why?"

Intrigued, I went back and took the time to reflect on what Brad had to say. Early in the post, he gets right to the source of most ineffective social media marketing.

Are you involved with social media to boost your ego?

…do you just want to promote yourself or your product all the time?

Did you join…because ‘Everyone I know is on …?’

Brad encourages us to evaluate ‘why’ – our motivations for using social media. Unfortunately, not much has changed in the last 9 months. As more research supports the benefits of social media in business, more companies are joining social networks, creating blogs, and hiring social media staff. Although no manager will admit it, their motivations are often as unjustified and misaligned as the questions listed above, and with no consideration of the information security implications. In order to reap the benefits of social media and use it in a way that is safe for the company and its employees, a more comprehensive approach is required.

This begins with an evaluation of the business model, value chain, and internal as well as external communication channels. Understanding the information security risks of social media use and, more importantly, how to mitigate these risks is also a critical yet often overlooked step. Once the institutional framework is in place, a company can begin identifying opportunities for social media, developing metrics for evaluating performance, and, finally, implementing social media into business operations. Even if a social media strategy is working for competitors, it doesn’t mean that strategy, or even social media in general, is going to be effective.

The staff at Newberry Group understands this and has given me the opportunity to research and prove an opportunity for social media in their business model. As a social media intern, I’ll be developing a business case for social media use at the Newberry Group. I’m excited by this opportunity, not only because I have a deep interest in B2B social media development but also, because I believe my role is a fundamental step that every business should take, even if it is already engaging social media.

I hope to share some of my work and findings in subsequent blog posts over the next few months. If you have any thoughts on, contributions to, or questions about my work, please do not hesitate to email me: rsteinbach@thenewberrygroup.com or shoot me a tweet: @R_Steinbach (note: tweets are my own and in no way reflect the views or opinions of Newberry Group)

5 Tips to Get Your Data and Computer Storm-Ready