How to Market the Security Group

Experts show how to sharpen six key skills for the future CSO

June 01, 2004 — CSO — Anita Leto, as director of IT transformation at Ouellette & Associates, is a consultant who advises CIOs on how to market the IT function internally (so as to "not get outsourced," she says). That focus also gives her an awareness of the uphill battle CSOs face when it comes to selling the security function within their companies. CSOs need to overcome the perception that the security function is foe, not friend, and instead convince employees at all levels that good security is good for business. Leto has ideas to help get the job done.

Classic security behavior, such as taking the big-stick, do-this-or-else approach, is doomed to failure. Instead, the essence of marketing security involves letting others know what's in it for them, and customizing that message for different audiences. (See How to Change People's Minds for another take on that latter point.) For example, tell the CEO and CFO that one of the biggest benefits of security is making sure the company stays out of The Wall Street Journal in a negative lightthat no news is good news. After all, executives care deeply about company image. For lower-level employees, such as customer-service reps (CSRs), the message could be that their jobs are at stake—though using a more diplomatic choice of words. That is, a CSO could talk about how much better it is to have a call center in the United States than in India because security can be better enforced stateside. CSRs can contribute by shredding documents and remembering their badges.

For all employees, the underlying message must be that good security is inherently linked to the success of the business.

Leto exhorts security leaders to be imaginative, even goofy, when it comes to marketing security. She suggests awarding a "spirit of security" award every month to departments. Another twist: Give the award at a traveling dog and pony show. Ask the head of a department for a 10-minute, all-hands meeting during which you give the award rather than merely announcing it via e-mail. Newsletters (in either paper or e-mail form) can be an effective means of communication, but Leto advises keeping them to a half page, and writing them in a clear business language that's on the catchy side. Another way to reach employees is by putting important security messages on whiteboards set up on easels in entryways throughout a building. One of Leto's clients, a hospital, flashed a new security policy on the JumboTron in the cafeteria.