The document summarizes key points from a presentation on the human side of information security. It discusses how managing technical experts can be challenging, even for technical managers. It emphasizes maintaining work-life balance through inbox and task management. It stresses the importance of building cohesive, interdependent teams through shared goals, recognition of accomplishments, and enriching jobs. It also recommends regular communication, marketing of successes, and organizational clarity.

1. The Human Side of
Information Security
Presented by: Rob Arnold, CISSP

2. Rob Arnold
• Human for 47 years
• Musician for 39 years
• IT guy for 19 years
• Security guy for 17 years
• Manager for 8 years

3. Agenda
• The Security Connection
• The CEO of One
• There are two “I’s” in team
• Drill Deeper

4. THE SECURITY CONNECTION
The Human Side of Information Security

5. When Worlds Collide
• Security managers are usually senior security
practitioners first
• Managing (developing and retaining) technical
experts is hard, even for a manager who is one
of them
• Receiving management support mentorship
and training is the exception, not the rule
• Best techs may not make the best managers

6. Demand > Supply
• Understand the market
– http://www.bls.gov/ooh/computer-and-
information-technology/information-security-
analysts.htm
– http://www.bls.gov/oes/CURRENT/oes151122.ht
m

9. Area: Kansas City, MO-KS
Employment: 720
Location Quotient: 1.24
Employment per 1,000: 0.73
Annual mean wage: $79,550

10. THE CEO OF ONE
The Human Side of Information Security

11. Maintain inbox zero
• The four-D system
– Delegate
– Defer
– Do
– Delete
• Only touch a piece of mail (or paper) once
• Use rules, conditional formatting, and other
mail client features to impose order

12. Manage your now
• Planning at the 1-day time scale
– Schedule your day, once a day
– Weekly wrap-up of deferred work
• Strategic deferral of work
• Quick win: turn off notifications of new email

13. Track your success
• Support your team by reviewing their
individual accomplishments
• Yes, this is resume building
• Every quarter, review this list with each of your
team

14. THERE ARE TWO “I’S” IN TEAM
The Human Side of Information Security

15. The first: Identification
• Actively seek inside jokes, code names,
restrictive vocabulary
• Find a common adversary
• Not: tshirts, uniforms, pieces of flair
• Focus on characteristics you share
• Manage how your team is perceived

16. The second: Interdependence
• Change the emphasis from “we’ll fail unless we
pull together” to “cooperation is the best
success strategy”
• Let cooperation be the proxy for
interdependence
• Look out for undermining team members
• Look out for “groupthink”
• Make your team exclusive--“select” rather than
“assign”

17. Open your mouth
• Make it as close as possible to the result
• Tell other people about your team’s successes
• Make it in front of the team if at all possible
• Your team hears your praise long after you give
it

18. Set the tone
• Don’t let the praise get diluted by a
background level of indifference (or worse)
• Talk to your team, and listen.
• Quick win: Make a list
– Mark a + by the people you greet regularly
– Mark a 0 by the people you greet occasionally
– Mark a – by the people you greet rarely

19. Enrich their jobs
• This is not “more work to do”
• Think vertical, not horizontal
• Look for opportunities to engage with your
organization’s senior leaders
• This is an effective way to challenge and
reward high performers
• Increases a sense of mastery

20. Stand up your meeting
• Quick win: Daily stand up meetings
• Rules of engagement:
– Mandatory
– Standing
– Only discuss today’s work plan
• Benefits:
– Visibility, accountability, reduced duplication of
effort

21. Marketing is not a department
• Marketing is:
– Every time your staff answers the phone
– Every email sent from your team
– Every invoice you send
– Every deliverable you generate for a customer
• The sum total of all the things your team does

22. Cultivate organizational clarity
• A healthy organization knows:
– Why the organization exists
– What values are fundamental
– What business it is in
– Who its competition is
– How it is unique
– What it plans to achieve
– Who is responsible for what

23. DRILL DEEPER
The Human Side of Information Security

24. Death by Meeting: A
Leadership
Fable...About Solving
the Most Painful
Problem in Business,
Patrick Lencioni

25. The Man Who Lied to
His Laptop: What
Machines Teach Us
About Human
Relationships, Clifford
Nass

26. Rework, Jason Fried
and David Hansson

27. First, Break All the
Rules: What the
World's Greatest
Managers Do
Differently, Marcus
Buckingham and Curt
W Coffman

28. Total Workday Control
Using Microsoft®
Outlook, Michael
Linenberger

29. • HBR Management tip of the day:
@ManagementTip
http://hbr.org/tip
• Ask A Manager:
@AskAManager
http://www.askamanager.org/

30. Thank you!
rarnold@ku.edu