Do the work behind the scenes and don’t be a workflow bottleneck

InfoSec as an enabler

If I were to choose only one thing to share with you, it would be that there is no place for a naysayer in a security department.

It’s unbelievable how many of us kept doing the wrong things for so long. It’s tough, because the impact we’ve had on IT societies is something that’s chasing us till this day. I’ve had to spend a lot of energy on working out healthy relationships with my peers by convincing them that not all security people are rude and negative. I don’t want to point fingers at anybody, because I’ve made those mistakes as well, however, we – as an industry – must acknowledge an elephant in the room and recognize how many cultural mistakes we’ve made in our careers. We must confront that our strategy of whining about insecurities of everything and desperate attempts to slow down innovation turned out impractical. We’ve tried hard to keep the comfortable status quo instead of learning the new technology and figuring out how to allow others to do their work more efficiently. We had good intentions, however, people couldn’t follow our incompetent lead and always found a way to bypass our restrictions.

I know it’s getting better and there are fewer infosec specialists who default to denial and rejection. Yet, I feel like it’s worth emphasizing that our ghosts of the past  made it tough for social-savvy security pros to create healthy relationships with engineers and other employees.

Saying no is easy, being creative and looking for innovative solutions is challenging and for us, hackers, we should strive to solve challenging problems as that’s part of our DNA. If you’re not creative enough, people will find creative ways to bypass your negligence and it’s all for nothing.

Your mission is to enable your coworker’s workflows and demonstrate that you actually have an honest intent and willingness to help them address challenges of their day to day struggle. Don’t romanticize the path you had to follow in order to be where you are today. Just because they haven’t been studying security for the last 10 years like you had and they aren’t aware of the risks involved with the technology they want to use, doesn’t entitle you to have an attitude and razz them for it. You’re there to help them, that’s why you are a security specialist, and you’re ought to use your skillset to support them, no matter what.

If you want to be a rock star, then earn that status, because the status is something that’s provided to us by a society, not something we tell ourselves. We can say as many blank statements as we want, but if our actions don’t back it up, we’re just being delusional. We’re hired to build robust products other people can use, and must use our greatness to solve the challenges. Even though it’s uncomfortable and it may be something you don’t want to do, it’s still the right thing to do.
So make sure you revisit your attitude, because even though your competence may be fantastic, your attitude must be in check as well to enable yours and your team’s productivity.

Listen and execute behind the scenes

Those who aspire to be great leaders must master one skill before others, because this skill alone can take them far and enable their growth in other areas. It’s listening and execution. Execution, especially when no-one is watching and expecting it.

Delivering the work no one asked you for, just to improve the life of your co-workers, is something that people know how to appreciate. So whenever you feel like doing something for the community, just do it, and the satisfaction will come to you sooner or later. Going the extra mile, is something that can help you build the image of yourself as an outgoing leader and problem solver. Our world needs people who identify problems and try to solve them on their own, without waiting for someone else to pick up the fight. People always seek someone to lead them. Someone who’ll inspire them and someone to whom they’ll be able to secretly look up to. Be that person, or at least give it a shot because there nothing you can potentially lose by doing the good work.

If you provide upfront a lot of value, people will feel emotionally obligated to give something back, because we can’t stand the feeling that someone gave us so much, and we haven’t even attempted to return some of it. It doesn’t need to be tangibles, the ROI can be their eagerness to work on security improvements for you. We’re all in human business, and technology comes second, so if you have good relationships with people, they’ll do something for you, even if it’s something they won’t be acknowledged for by the business. It’s in their human nature, and that’s all it takes.
Obviously, like for everything I’ve shared with you so far, there will be exceptions and you’ll face totally ungrateful people, but just because of those few individuals, you shouldn’t abandon the whole society of great people who’d love to work with you side by side.

Sometimes we just need to step out and take things in your own hands. Even if you think like there is no tangible incentive to do so, the feeling of doing something for better future of your coworkers is wonderful and justifies the sweat equity.

You must ensure that you’re doing whatever possible to show people your determination, competence, and passion, but be wary of taking too many little things — like code fixes — on your shoulders, because it may lead to cognitive and time overload. You can’t take so much on yourself that it’ll become impossible to do the actually important tasks that only you can do because of your skillset.

If it happens that you need to fix some code or tweak configs, then that’s perfectly fine as long as it’s an exception, not a rule. The key is the balance.

Embrace DevSecOps

The concept of purple teaming is something I fell in love with, many years ago when I was experimenting with a variety of ways to make myself more productive. Everything has changed  for better when I started embracing a culture of collaboration, where attackers and defenders work together to find the best approach of securing the products.

Although it’s great to focus on your narrow specialization and be an expert, it’s not the actual reason we’re getting paid. We’re getting paid to improve the safety of our organization, not just do the work for sake of doing the work. To be truly productive, I really recommend to at least try collaborating with all stakeholders across the organization.
Being a pwn-all-the-things rockstar will take you only this far. It’s overrated and while fun in short-term, gives terrible results long-term. I must remark tho, that there are great people out there, who provide immense value to the industry by doing only the thing they love but those are exceptions. It’s much easier to achieve success and long-term satisfaction if you learn how to work with others.

Become a member of each department

Having an independent security department is expensive and hard to scale. What worked for me, was working side by side with people who ship the products. This is a good thing to focus on, especially in small organizations where security culture isn’t yet established and people don’t realize they should inform you about some matters. While it is obvious to you and you expect them to use you as a consultant, people just often don’t have it on their mind if they weren’t ever required to do it before.

As a third party consultancy entity, you’ll be often late to the party, because people either forget, don’t have enough time for proper communication or are afraid that you’ll introduce additional burden to their existing workflow.

Becoming a team member will make everyone more socially comfortable with your presence and role, which enables you to cover more things with your security expertise. Some of us, painfully learned that approach “we VS developers” doesn’t really work if the goal is to create a healthy and friendly environment. If you introduce that competitiveness, it often creates a toxic atmosphere where people do their best to hide stuff from you instead of collaborating on convenient solutions

Join one team for a few weeks and then jump into another to create a well-intentioned relationship with your peers. Don’t just sit in your cubicle waiting for someone to call you for help, because that’s not going to happen.

Delegate instead of trying to fix everything yourself

To maximize your impact, you should learn how to delegate some of your workloads, because you don’t want to become a bottleneck for security improvements which is completely contrary to your goal. Except for time management and the fact you can’t always be a one-man army, there is an important educational purpose of tasks delegation.

By relaying work to a person who wrote or deployed the code/service, you help them understand mistakes they’ve made so they know how to do it better in the future. If you fix everything yourself behind the scenes, people will keep making the same mistakes over and over again. They may not be even aware that they did something wrong as no one ever raised any concerns in regards to their code quality.

Apply the same approach in all aspects of the business and educate people on how to improve the security of their day to day execution. You can, for example, teach internal QA teams on how to do basic security testing, thanks to which you’ll have additional eyes looking at the products from a different perspective.

Use your exceptional skill set to focus on things that matter and leave rest of stuff to others who’re more capable or who’re actually supposed to do given type of work.

If you’re great web pentester and good software engineer you surely can fix the bug you’ve found, but is it the smartest thing to do? If you’re the only security expert while there are 50 software engineers in the company you’re better off delegating the fix to others, so you can focus on execution within your domain of expertise.

Internal security training and awareness awards

Conduct recurring security training

Videos and online presentations are good, but nothing can really replace quality in-person meetups. Show as many demos as possible and don’t stick to overwhelming PowerPoint presentations which put people to sleep.

It’s fine to share raw technical details as a recap material, but while starting out you must make people excited about the subject, otherwise, it’ll be just another corporate training which they’ve attended only because it’s obligatory.

Don’t shy away from showing off your skills to non-techy people. It makes sense to show some real-life exploitation to impress them to build a great human relation and gain their respect for your skills even if they haven’t understood all of the things you’ve just shown them.

I personally like to show real-life testing, including very first steps from setting up Burp through vulnerability assessment, exploitation to data extraction. When you go step by step and show how you find a specific type of vulnerability — how you exploit it and how it can be fixed/prevented — people get the big picture perspective which is understanding the business risks. When they actually realize how code quality affects business longevity, they’ll pay much more attention to it.

There is plenty of Open Source resources that come handy in such exercises so squeeze the max out of them to create enjoyable and valuable security training.

Guiding them through detailed flow is practical, because while you’re doing the hacking part, the participants have a chance to directly and comfortably ask you many (un)related questions. Interactive meetings are the greatest, as they’re much better memorized than a blunt slide deck and they give you an opportunity to show the human part of yourself. Standing in front of people, gives you an invaluable opportunity to cultivate the relationships I’ve mentioned earlier.

The same concepts apply to physical and personal security and the key message is that training should be engaging, exciting and relevant. They should also be periodic so people are constantly reminded about the importance of security.

Popularize internal Bug Bounties and awareness recognitions

Bug Bounty programs are great and I’ve been a solid advocate of it for the past decade, but before you jump into spending crazy amounts of money on external BB, you should give it a try internally.

It’s smart to start with internal initiatives first and give your peers an opportunity to learn new skills and get some fancy rewards for their efforts. Consider hackathon-alike efforts where engineers can work on complex security issues they consider interesting, or just do some internal bug hunting with you.

While the BB is mostly a vehicle to create a security culture, there is actually a real chance of finding a few security issues because each person has a different perspective and a developer may find a bug in a place you’ve never thought of.

Make it fun and offer rewards like a few additional PTO days or gift cards for individuals who’ve found security issues in the specified timeframe or if they came up with great security tool during the hackathon. Except for the fact that everyone likes awards and rewards, people get excited when they’ve been publicly recognized as security aware. At most organizations, people remind being razzed for security, rather than being appreciated, so you’ve got a chance to use it in your favor. Don’t forget to properly acknowledge the effort of all those who’ve also tried but weren’t as successful, because you want everyone to feel engaged and appreciated.  You can use the Bug Bounty concept for non-technical people as well to show your appreciation e.g. if they report you a physical security incident. The key is that you need to cover the whole organization with the awareness because the security is as strong as its weakest link.

Initiatives like this help shaping a culture where being security aware is appreciated and rewarded and after a while, it can become employees’ habit to take care of company safety. Besides all security benefits, it’s simply a great team building exercise that organizations so you should employ on regular basis.

“Tell me and I forget; teach me and I may remember; involve me and I will learn.”

You need a separate room if you want to be effective while working remotely. There are so many reasons for it that even though I’ve been working remotely for over 7 years, every few months I discover new benefits of it.

Many people attempt remote work, hoping that their lives will get so much better if they only don’t need to commute to work anymore. They portray remote work as something that’s easily manageable, where you just comfortably sit on a couch in your living room, with the TV turned on, kids running around and you working on your computer in the middle of it all.

That’s how most people see the remote work and that’s precisely the reason why most people fail at it. Remote work is a fantastic opportunity that comes with many advantages, but only if you know how to manage them. But as with most things in life, if an opportunity doesn’t meet the preparation, it’s all for nothing.

There is nothing extraordinary with the amount of preparation for remote work in comparison to other things in life. Humans –  myself included –  are simply really bad at looking at the big picture and understanding how many factors influence the quality of our lives.

If you want to be effective and remain sane while working remotely, you need to find yourself a place where you can isolate yourself and train your brain to recognize when it’s time to work. To give you an example that every one of us can relate to, let’s take a look at some other space we spend our time at. Let it be our bedrooms.
A bedroom has two general purposes. It’s a place where you should sleep and have sex. And that’s it. The consequences of not understanding that purpose of a specific room should be respected are dramatic, yet so easily avoidable.
Your brain must be trained so that whenever you head to your bedroom, it’s thinking either about rest or about making love, and both should generate chemicals in your brain that bring positivity into your life. For most of us, our bedrooms aren’t necessarily clear synonyms to the positivity, because we don’t respect the rules of the bedroom. We eat in bed which makes our brain associate bedroom with specific smells and tastes. We keep bedrooms messy, which causes irritation and makes our thought to wander and think that we should clean up, rather than just enjoying a moment. We bring computers to the bedroom, and we either review social media, reply to emails or browse the Internet in general, even though all these things have a huge potential of generating stress, anxiety, and irritation.

Unconsciously we bring negative emotions to the bedroom, and then when it’s time to sleep or have sex, we’re distracted. We’re not in the mood, because we’re pissed off by someone who sent us a crappy message on social media; because we’ve reviewed our email and know there is so much work to be done; because there is a nasty smell of the leftovers; or because there are crumbs everywhere that seem to be hiding everywhere and are never gone no matter how long we vacuum the bed.

We fuck ourselves up, because we don’t respect the simple rules of space management. Clean up your bedroom and make it a neat place where you enjoy spending time in solitude or with your partner. If you got to pick up a phone, leave the bedroom and answer the call from the living room. Really, the world isn’t going to collapse if you answer it 5 seconds later. If you know you’re going to have an argument with your spouse, get out of the bedroom and argue in the living room. You’re going to ruin your day anyway, so you seriously can take 10 seconds to go to another room and not ruin the atmosphere of the bedroom.  Don’t talk negative shit in there, don’t talk about work, about problems and bills in the bedroom. Because when it’s time for pleasure, you want to experience the pleasure to the maximum, focused entirely on you and the other person. You don’t want to think about the bills you need to pay, get distracted by the notifications flashing on your smartphone or to get uncomfortable because you’ve got cookies crumbs everywhere.

Now let’s get back to the office space, because the example I’ve given above is something everyone can relate to and it’ll give you a context allowing you to understand what I’m about to say in terms of the office space.

When you get into the office, your mind should be calm and focused. If you want to get things done and you’ve set high standards for yourself, you need to be able to focus and allow your brain to get into the state of flow. For that, you need physical isolation, because you can’t be even slightly afraid that someone is going to disturb you. When you’re in the living room, you subconsciously know that there may be other people around, or someone can scare you when you’re focused. We don’t like to get scared and our primitive brain is always on the watch, so it can’t give you all the headspace to focus on creative work. It’ll be constantly in the reactive mode, which jacks up your adrenaline and cortisol levels, generates stress and causes a depletion of your cognitive pool.

Your brain must feel safe, it must know what to expect and you can’t be constantly looking around the room to ensure no one is coming or asking you any question. You need isolation, the same way you’d need that in the office. Most people never get to experience the flow state, because current open space offices are the biggest enemy of productivity, but let’s leave that for a separate story.

At the office, you still manage to get some work done, because you know you got to do it and that it comes first before the strangers who constantly interrupt your work. But it’s a whole different story when you’re at your home, because at home it’s not the work that matters the most. Family and loved ones matter the most, and very often we put work away in order to ensure we’re giving our best to the ones we love and for whom we care.  That’s to me is the bigger reason why people manage to somewhat get stuff done at the office, but they barely manage to do anything done despite working long hours from home.
Of course, there are people, who need to feel the pressure of their peers, who need to be directly managed and constantly verified, otherwise they slack off. But I’m not writing this particular post for people who can’t get their shit together and they play video games instead of working, abusing the trust that was given to them by their team and company they work for. I’m also not writing this post for digital nomads who enjoy traveling and working in a meantime, because their priorities and responsibilities are different of those that I hold for myself.  Digital nomads lifestyle was never for me, so I won’t talk about the things I have not experienced for a prolonged period of time. So if you’re a digital nomad and you enjoy your life, then most likely I don’t have anything valuable to offer for you. Keep doing what works for you.
I’m writing this post for people like me, who are in the point in their lives where they have other things they deeply care for, and they want to ensure that whatever they do, is matching their high standards. For people who want to leave no stone unturned and also for those who just want to get shit done and experience life beyond work. Some people just want to separate their work from their personal lives and they’re seeking ways to do it most effectively and for those, this advice should come handy.

Get yourself a separate room in which you do nothing but work. It’ll allow you to focus better, because your body won’t be jacked up with the adrenaline, and your brain will know that this particular place is when you get shit done. This is the place where you get all the stress on yourself, where you don’t play around and where you do what needs to be done. Don’t eat in the office, don’t play video games in the office, don’t have sex in the office, because it’s going to mess up the way your brain produces specific chemicals. If you play video games in the office, you’ll have a hard time focusing on work, because you’ll crave the dopamine hits and you won’t be able to manage the delayed gratification that comes after many hours of work put into completing a task at work. If you have sex, watch TV, eat food in your office, your mind will get easily distracted each time flashbacks kick in. That’s why it’s hard to work remotely – for a longer period of time – on your couch in the living room. Because there are no rules of the living room. The living room has no restrictions as it’s meant to do all the living-related activities.
There are simply too many distractions, too many ways to escape the work, and too many priorities. Sit down in the separate room and leave yourself no chance to notice a sticky note on a fridge to pay the bills or to take care of the laundry. Because if you just take a look at it, you’ll lose focus over the work, and you won’t give the best of yourself while working. You’ll be stressed out because there are other tasks, you’ll keep it in the back of your head and it’ll slowly but surely consume your cognitive pool for a day.

It’s hard to tell someone you live with, that they shouldn’t talk to you when you’re in the living room. It creates a toxicity in the air, where people don’t know when it’s a right time to talk to you and when it’s not, so you make your stress contagious. If not communicated properly with your family members, they may get a feeling like you don’t care about them, if you don’t interact with them when they ask you something or want to interact with you.

Our brains, bodies and social interactions are tough, so you got to find a way to make it less complex at all cost. Even if you communicate it all well, when everyone understands that you’re working,  and it’s not that you don’t love them, but you simply need to work; when you have social dynamics under control, it’s still bloody tough to control your brain and primitive instincts. When you sit on a couch and your kid wants to watch the TV, you’ll take a look once in a while, because the flashy lights will drive your attention to it. When you work from your bedroom, and you notice your spouse stopping by to change the clothes, you really think you’ll be able to just continue working like nothing has happened? Your brain will desire pleasure and intense emotions, because the work we do most of the time isn’t exciting enough for it. The brain doesn’t like boredom, it likes action, it craves the chemicals that will be generated when you fall for the pleasure.

If you work in a separate room, you just don’t give yourself a chance to get distracted. That what it really is all about. By keeping a discipline of working in a separate physical location you make it easier for your mind to stay disciplined.

And back to that bedroom for the last time – I’m far from giving anyone any personal advice, but if you don’t respect the purpose of other rooms in your house, you should really consider doing so. Because if you manage your bedroom properly, if you manage your kitchen and living room properly, it’ll be way easier to manage the office space. It’ll be much easier for you to detach from work when you need it, because you know where you need to go in order to get some rest or leisure. Everyone needs some escapism once in a while, and it’s good to know it’s just a few steps away.
If you respect the purpose of your kitchen, you’ll go to the kitchen anytime you need to eat something, saving you from creating a mess in your office space which would then distract you.

So yeah, that had to be said, because work-life balance matters. Work is part of life and I want to treat it as such, which is why the mindset I’ve chosen for myself is to focus on building the best work-life harmony. Because when I’m done with work on which I focused all my energy for X hours, I want to close the doors of my office and go experience other things life has to offer. I want to spend quality time with people I love, I want to devote myself to my hobbies, I want to do other things, but I want to do it all with the highest quality I can, with the laser focus to know that whatever I’ve done – I’ve given my best and I leave myself no space for any regrets. I close the doors of the office and leave all the good and the ugly in there, ’cause the last thing I want is for me to be distracted and not pay attention to other important things in my life so they know how important they are to me. Priorities are priorities and work needs to be done for various reasons, but that mustn’t get in the way of higher values. And while working remotely, a separate office space is the number one thing, without which I wouldn’t be able to perform at the level I need.

And that seems to be having good results so far. For me. You do you. And if you decide to apply this advice in your life, do it with a dose of common sense, because you want to be disciplined thanks to your rules, not enslaved by them.
It’s okay to write some code from the living room. It’s okay to turn on the TV, play some Netflix and reply to emails in the meantime. Let’s not get too serious about it, we’ve got to have ways to decompress when we need to. Of course, you can – heck, you should! –  have sex outside of your bedroom, in your living room, in the bathroom, in the kitchen, on the balcony, in the car, on the car and wherever you feel like it. You obviously can play games or eat in the living room, kitchen or surprise your spouse with a great morning meal delivered to the bedroom. Make it all work in your favor, but on some qualities, you shouldn’t compromise, and you should not allow an exception to develop into the habit of making your bedroom/office a hideous place.

Focus, energy, and time are limited. Manage the resources wisely.