Security Careers: Responding to questions successfully
Michael Santarcangelo tells us why explaining the reasons behind security policy, rather than relying on a quick answer, can go a lot further toward employee compliance and understanding
By Michael Santarcangelo
July 19, 2010 — CSO —
"Why can't I used my iPhone at work?"
A simple, common question asked in organizations around the world on a daily basis driven by policies against using iPhones, iPads and other "unapproved" portable electronic devices. As a result, questions abound.
And that's a good thing.
What is more versatile and powerful than a question?
A simple approach to learning, sharing, teaching and exploring, questions are as much art form as workhorse of our ability to communicate. While learning how to ask questions and listen to answers is important, an often-overlooked key for career success is learning how to respond.
When someone asks a question, what is your response?
We are asked dozens, maybe hundreds of questions a day. Are these questions treated as interruptions to be dismissed as quickly as possible, as personal challenges, or are they given consideration and addressed with the right response?
During a recent awareness assessment where we understand key behaviors, opportunities and challenges one of the participants explained, politely, that the current policies prohibiting iPhones were misguided, restrictive and unenforceable. The anonymous response ended with a question, "if the policy isn't going to be enforced, why restrict us?"
This is why questions are so important. Individuals ask questions for a variety of purposes to find out if they can do something, to understand a situation, to make a decision all focused on gaining information. Now, while many questions require a simple yes or no answer; a question like this is an opportunity to share an explanation.
- 12 percent of employees reported intentionally violating company policies in a survey conducted by Fiberlink; in my experience, the actual number is likely to be even higher.
- 90 percent of employees reported their own ability to manage risk as good or excellent (good enough they'd bet their paycheck on it) in a recent Awareness that Works" assessment I conducted (Security Catalyst, Spring 2010)
- 35 percent of respondents have felt the need to work around their organization's established security policies and procedures just to get their job done
- Nearly half (41 percent) of the respondents have determined that employees have been using unsupported devices, and more than one-third of that number said they have had a breach or loss of information due to unsupported network devices.
- 65 percent of respondents frequently or sometimes leave their workplace carrying a mobile device such as a laptop, smartphone and/or USB flash drive which holds sensitive information related to their jobs.