The biggest challenge security teams face in their organization is one of perception, according to Michael Santarcangelo, founder of Security Catalyst, a New York-based consultancy focused on changing the way people protect information.
Santarcangelo, who was recently a keynote speaker at the CSO Perspectives conference, said professionals focused on security are practiced at looking at risks and reducing them. Unfortunately, the rest of society often doesn't see risks the same way, making communication difficult.
"They lack relevant context," said Santarcangelo. "So security people get wrapped up in thinking: 'The CFO wants an ROI. We better work on ROI.' But what the CFO is really saying is:' I don't understand what you do. So you have to justify it to me.'
Santarcangelo outlined his strategies for making the case for security investments at the three-day event held in Florida. He gave an audience of security professionals the details of his five step process for getting executives and boards to understand, and even approve, spending decisions in tough economic times.
Create
Santarcangelo believes one of the most effective ways to communicate value is to place focus back on the person to whom you are trying to make your pitch.
"The reason why someone changes a behavior or takes an action is because there is an inherent benefit to the person," said Santarcangelo. "But when many people start to create, they forget that. They tend to fall into the trap of thinking: 'I'm really smart and I know a lot of stuff. So I'm just going to say it and hope they will understand the value of it.'"
Instead, Santarcangelo recommends creating a presentation that keeps the motivation of the audience in mind.
"Talking to an executive is different from talking to a technologist is different from talking to an end user," he said. "If we are going to communicate with someone in a way that they understand the value and support what we are asking for, we have to know what we are asking for. We have to think about what we want them to know. "
Connect
We connect to people through stories, according to Santarcangelo. Before you make your pitch, find something in their experience base that you can reference that your audience can connect to and understand.