Lunch With Kelly: We're All Ears

How many times have you caught yourself shaking your head, wondering why no one seems to understand you? To you, the value you bring to the organization is self-evident. How can they not get it? The issue of feeling misunderstood is a common complaint among infosec professionals. The role we play in our organizations is not always clear to executive management, business department heads and users. When we try to explain our function and ways we contribute to the bottom line, the result is often blank stares and vacant nods. The urgency of communicating our corporate value cannot be underestimated. When we are perceived to be a cost center making ever-expanding budgetary demands (with little direct evidence that security is actually improving), the threat to our employment is palpable. If we want any semblance of job security, we must figure out how to connect with our colleagues and relate the tangible value of the work we perform. Now here's the rub. We'll never succeed unless we develop and deliver a solid marketing strategy on our own behalf. The good news, according to one expert, is that this strategy does not require an in-depth marketing background, development of a formal talk-track, or even time for endless networking. Nan Shaw, a leadership coach who has worked with business leaders for more than 25 years, says there is only one skill we need to develop to accomplish our goal. "If you want to ensure that you and your message are heard fully, start by listening," Shaw says. Shaw believes that at the root of most communication breakdowns is our inability to listen to others with genuine interest. If we feel we have been misunderstood in the past, for example, we will be more likely to scan for how we are being misunderstood again. So we assume a defensive stance, in effect shutting down to what our colleagues are actually saying. "The ultimate irony of expecting to be misunderstood is that you virtually guarantee that you will be," Shaw explains. "In almost every conceivable situation, we are listening to our expectations instead of listening with curiosity to what the other person is saying." The only way around this communication trap is to suspend our expectations and start cultivating business relationships with a newfound desire to understand our colleagues' thoughts and opinions. For many of us Type A personalities, listening as a marketing strategy seems too passive. We need to get in there and do something. The simple truth is that no self-respecting marketer would be caught dead launching a new product without some intensive research up front. Marketing experts know you can't craft a brand message until you solicit and evaluate consumer input, typically through focus groups and interviews. One practical approach we can apply immediately is to leverage our daily interactions with co-workers as an opportunity to do some "market research." Over coffee or lunch, ask executives and peers about their individual and departmental goals, and how they think infosec can best help them meet those goals. Done well, this gives us an opportunity to deepen our institutional understanding and foster a new level of trust among disparate parts of the organization. Better still, we learn firsthand about the perception of infosec within our organizations, so we're no longer operating just on our own projections and assumptions. Ultimately, the real benefit of listening is that when others feel heard--truly heard--they are more likely to return the favor. Then, and only then, can we start marketing the value of our department and our programs. E. Kelly Fitzsimmons is CEO of Neohapsis, an information security consultancy and enterprise IT product-testing lab. Write to her at kfitzsimmons@neohapsis.com.