Hacking For Dummies® 3rd Edition

Chapter 19. Ten Tips for Getting Upper Management Buy-In

Dozens of key steps exist for obtaining the buy-in and sponsorship that you need to support your ethical hacking efforts. In this chapter, I describe the ones that I find are the most effective.

Cultivate an Ally and Sponsor

Selling ethical hacking and information security to management isn't something you want to tackle alone. Get an ally — preferably your direct manager or someone at that level or higher in the organization — who understands the value of ethical hacking as well as information security in general. Although this person might not be able to speak for you directly, she can be seen as an unbiased third-party sponsor and can give you more credibility.

Don't Be a FUDdy Duddy

Sherlock Holmes said, "It is a capital offense to theorize before one has data." Accordingly, it's up to you to make a good case and to put information security and the need for ethical hacking on upper management's radar. Don't blow stuff out of proportion for the sake of stirring up fear, uncertainty, and doubt (FUD). Managers worth their salt see right through that. Focus on educating management with practical advice. Rational fears proportional to the threat are fine — just don't take the Chicken Little route, claiming that the sky is falling with everything.

Demonstrate How the Organization Can't Afford to Be Hacked

Show how dependent the organization is on its information systems. Create what-if scenarios — sort of a business impact assessment ...