Home » Security Leadership » Career/Staffing

In Depth

Security and Business: Communication 101

Communication skills are the number one requirement for leadership success. In security, step one in communication is understanding the language and priorities of the business.

By William Brandel

June 17, 2008 — It never fails. Ask security executives to name the biggest boon or detriment to their careers, and they'll respond with the same answer: communication skills. This isn't news. But what does "communication skills" really mean, particularly when seen in the context of a security leader's success?

Perhaps the answer can best be gleaned from a close look at an actual communication breakdown. Before Russell Walker became the VP of information security at Starbucks in Seattle, he was a security consultant, a role that tends to provide an unvarnished view into corporate dysfunction.

While working with an East Coast financial firm, he witnessed the not-so-rare occasion where a CSO struggled mightily and repeatedly failed in his efforts to sell a new Internet security solution to management. "His message to management was, We're vulnerable." Walker says. "The audience was thinking, What's vulnerability? What does this have to do with me?"

What they were saying, Walker says, was, Show me how to quantify my exposure and calculate the risk to my business. So, instead of trying to sell the project through yet another presentation, the CSO tried a different format: a live demonstration.

"We demonstrated how easy it was to break into the site and get personal info on the executives in the room," Walker says. "We showed we could get their salary, their 401(k) contributions and where they lived. Suddenly, the issue of personal identification and vulnerability resonated with them. It became personal."

This anecdote helps underscore the various components of communication for the security executive. It was based on a format that conveyed the message. The demonstration used just enough information to get attention but not so much that it embarrassed or put off anyone in the room. In short, it was sensitive to its audience.

In other words, you can write, speak and present until you're blue in the face, but unless you know how to reach your audience, you lack the communication skills needed to help provide adequate security to your company and be part of its success. In other words, you're really not communicating until the other party—most notably, the holders of the budgetary purse strings—can actually understand you.

Sensitivity to the audience and its context is a cornerstone of excellent communication. This is especially important for executives who function in widely distributed business operations. Just as the security strategy for an East Coast financial services concern will be far different from that for a West Coast entertainment company, so is the business culture that permeates these organizations. At the same time, what is an acceptable tone for one region within the U.S., or the world, may be offensive or unacceptable in another.
One CSO cites an example where a simple, to-the-point message about compliance at a finance company out of the New York City headquarters was received as a reprimand on the West Coast. The result was that the company spent more time focusing on the insensitive tone of the message than on its contents.