Latest / CYBR.Signal / Wrong, Too Much, or Irrelevant Info: Know Your CyberSecurity Audience

Transcript

Wrong, Too Much, or Irrelevant Info: Know Your CyberSecurity Audience · CYBR.Signal

• 0:00
  SPEAKER_00: And hello everybody, happy Cyber Sunday, Michael Farnum here.
• 0:03
  SPEAKER_00: Hope you're doing well.
• 0:03
  SPEAKER_00: So I'm going to talk about three things and I'm going to try to tie them together in less than five minutes and make sense of this.
• 0:09
  SPEAKER_00: So let's go.
• 0:10
  SPEAKER_00: First, I'm going to talk about my truck.
• 0:12
  SPEAKER_00: Second, I'm going to talk about an old job I had when I was in technical marketing doing a lot of writing.
• 0:18
  SPEAKER_00: And then third, I'm going to talk about an MDR vendor and a customer, a mutual customer of ours.
• 0:24
  SPEAKER_00: My truck, I got some work done.
• 0:25
  SPEAKER_00: You know, I love my truck.
• 0:26
  SPEAKER_00: I'm always in here on Cyber Sunday doing the Cyber Sunday.
• 0:29
  SPEAKER_00: This is where I love to do this.
• 0:30
  SPEAKER_00: I love my truck a lot, got some work done on it, tires, wheels, paint jobs, stuff like that.
• 0:36
  SPEAKER_00: Was talking to the guy who did the work on my truck around some warranty stuff and whether I needed to take it in to get some work done.
• 0:44
  SPEAKER_00: He explained to me in pretty big detail on why I did not need to bring it in at a certain time, talked about the suspension of the truck, all of these things.
• 0:53
  SPEAKER_00: It was a lot of information that while interesting, I did not need to know.
• 1:00
  SPEAKER_00: I'm not of that technical level that he is.
• 1:03
  SPEAKER_00: I didn't need to know that information.
• 1:05
  SPEAKER_00: I just needed to know whether it was the work was getting done and whether I needed to do a certain thing or not.
• 1:09
  SPEAKER_00: Okay, no shade on him, just didn't need to know all that information.
• 1:15
  SPEAKER_00: Second, my old boss, way back when I was doing digital marketing and writing and stuff like that, Susan Valencourt, she may be watching this.
• 1:23
  SPEAKER_00: Hey, Susan.
• 1:24
  SPEAKER_00: Susan and I would go back and forth, and she remembers this quite well.
• 1:27
  SPEAKER_00: We joke about it sometimes when we talk.
• 1:29
  SPEAKER_00: We would go back and forth when I was writing a blog or a white paper, that I didn't need to spell out certain concepts and certain acronyms because my audience knew what I was talking about.
• 1:40
  SPEAKER_00: So I didn't need to say CISO stood for Chief Information Security Officer.
• 1:45
  SPEAKER_00: My audience would know that.
• 1:46
  SPEAKER_00: So we would go back and forth and kind of argue about that.
• 1:49
  SPEAKER_00: She would usually win because she was my boss.
• 1:52
  SPEAKER_00: Third, I had an MDR provider talking to a mutual customer, and they were providing metrics that showed how the MDR vendor was doing well in certain cases, how they had met certain goals.
• 2:06
  SPEAKER_00: But what they were giving was justifying them more than actually giving good useful information to the customer that the customer needed to make sure there was success, successful threat hunting, and things like that in their environment.
• 2:21
  SPEAKER_00: So, how do these all kind of tie together?
• 2:23
  SPEAKER_00: It's all about knowing your audience.
• 2:25
  SPEAKER_00: So, in the first, in the first case about the truck, I did not have the same technical knowledge.
• 2:32
  SPEAKER_00: I am not in the same business as the guy who was working on my truck is.
• 2:36
  SPEAKER_00: He knows all the stuff about the suspension, and he was giving me all this information.
• 2:40
  SPEAKER_00: Again, curious, interesting information.
• 2:42
  SPEAKER_00: If you're curious about vehicles, very good information.
• 2:45
  SPEAKER_00: But for me, I just needed to know certain aspects were taken getting taken care of, and I didn't have to do certain things.
• 2:51
  SPEAKER_00: I I bring that to the or kind of should say that's at the same level as if you're talking to a CEO or an executive or something like that in your environ in your uh company, and you're explaining to them some of the things about cybersecurity and what you've done to make your environment more secure, that kind of thing.
• 3:12
  SPEAKER_00: You don't need to spell all the things out about how you're doing those things.
• 3:16
  SPEAKER_00: You just need to let them know they're getting done, giving them enough information to know that those things are getting done, show some proof, but don't get into all the details.
• 3:24
  SPEAKER_00: They are not of the same level technical knowledge you are.
• 3:27
  SPEAKER_00: Their knowledge and expertise are in other areas, so just let them know and explain it, but you don't have to go into detail, it's just not useful.
• 3:37
  SPEAKER_00: You need to know your audience.
• 3:38
  SPEAKER_00: In the second case, with the with Susan and I going back and forth, I knew I again, it's all about knowing your audience.
• 3:48
  SPEAKER_00: I said, Hey, if we're giving our readers who know this stuff already all of this extra information, it's going to take them longer.
• 3:57
  SPEAKER_00: It's not exactly useless, it's just too much information that they already know.
• 4:03
  SPEAKER_00: So we're on the same technical level.
• 4:05
  SPEAKER_00: Why do I give them all this extra information?
• 4:07
  SPEAKER_00: So, again, that to me was a know your audience thing.
• 4:11
  SPEAKER_00: The third thing about the MDR was they were providing so much information to the customer that was not useful to the customer.
• 4:20
  SPEAKER_00: It was good information to say they were successful, but not necessarily good information for the customer to know.
• 4:27
  SPEAKER_00: So that in that example in itself is kind of self-evident, right?
• 4:31
  SPEAKER_00: You need to know your audience because you need to know what they need, not what you need to tell them to make them know that you're doing your job right in certain ways.
• 4:42
  SPEAKER_00: They need certain information to know that their environment's secure and you're securing it, and you need to make sure those types of metrics line up.
• 4:51
  SPEAKER_00: So that's it.
• 4:52
  SPEAKER_00: It's basically all around knowing your audience, knowing the type of audience, knowing what kind of information to give, how much to give, not too much, not too little, and the same level when you're trying to explain cybersecurity concepts and what your job is and how you've done your job.
• 5:07
  SPEAKER_00: Hope that makes sense.
• 5:08
  SPEAKER_00: Let me know what you think in the comments.
• 5:10
  SPEAKER_00: Talk to you next time.