97 Things Every Information Security Professional Should Know

Chapter 67. Empathy and Change

Nick Gordon

How do we deal as individuals with change that occurs in both our profession and our companies? What if your company is rapidly hiring and you no longer can tap the relevant person on the shoulder because you no longer know who they are?

Bringing Change

As someone who works in security, you are often the harbinger of change and bad news—we are in charge of looking after the interests of the larger group of the company. You will need to build partnerships across your organization to enact sustainable change. Patching a specific issue will not help when future bugs are introduced—unless you build out the relationships with other teams that can identify and notify you.

This means people skills need to be part of your toolkit, and to complement them you will need a lot of empathy for both those who came before and those you are now working with. Very rarely are people deliberately acting maliciously, and what may look like a poor decision now was often based on the knowledge and tools available at the time.

Mandates Only Work When Someone Is Watching

Sometimes you will need to absolutely mandate a change, but that will have consequences unless you keep it narrow and have already built the relationships. People who were affected will not forget that they did not have a choice.

The long tail also comes up here—anything that was not explicitly ...