How to Market the Security Group

Anita Leto, as director of IT transformation at Ouellette & Associates, is a consultant who advises CIOs on how to market the IT function internally (so as to “not get outsourced,” she says). That focus also gives her an awareness of the uphill battle CSOs face when it comes to selling the security function within their companies. CSOs need to overcome the perception that the security function is foe, not friend, and instead convince employees at all levels that good security is good for business. Leto has ideas to help get the job done.

Classic security behavior, such as taking the big-stick, do-this-or-else approach, is doomed to failure. Instead, the essence of marketing security involves letting others know what’s in it for them, and customizing that message for different audiences. (See How to Change People’s Minds for another take on that latter point.) For example, tell the CEO and CFO that one of the biggest benefits of security is making sure the company stays out of The Wall Street Journal in a negative lightthat no news is good news. After all, executives care deeply about company image. For lower-level employees, such as customer-service reps (CSRs), the message could be that their jobs are at stake—though using a more diplomatic choice of words. That is, a CSO could talk about how much better it is to have a call center in the United States than in India because security can be better enforced stateside. CSRs can contribute by shredding documents and remembering their badges.

For all employees, the underlying message must be that good security is inherently linked to the success of the business.

Leto exhorts security leaders to be imaginative, even goofy, when it comes to marketing security. She suggests awarding a “spirit of security” award every month to departments. Another twist: Give the award at a traveling dog and pony show. Ask the head of a department for a 10-minute, all-hands meeting during which you give the award rather than merely announcing it via e-mail. Newsletters (in either paper or e-mail form) can be an effective means of communication, but Leto advises keeping them to a half page, and writing them in a clear business language that’s on the catchy side. Another way to reach employees is by putting important security messages on whiteboards set up on easels in entryways throughout a building. One of Leto’s clients, a hospital, flashed a new security policy on the JumboTron in the cafeteria.

Demonstrating security products or issues is also helpful. Hold a tech fair in the company cafeteria to show a new fingerprint ID system or a new log-on procedure. For a frugal approach, hand out trinkets. One of Leto’s clients distributed huge, red panic buttons with an important security message.

Leto likes the idea of coming up with a security theme—a slogan that sums up why security is important. It’s something a CSO could say at every presentation and that HR or other departments could stress. Often, she says, CSOs communicate too many messages, increasing the chance that employees will tune out. One simple theme helps get everyone marching to the same beat.

Mandatory training sessions have their place as well, but again, Leto emphasizes making these sessions fun, not PowerPoint snooze-a-thons. Instead of showing a slide of bullet points on laptop safety, demonstrate how someone’s laptop could be swiped at Starbucks. If you’ve only got an hour, says Leto, “It better be an interesting hour. Or at least have doughnuts.”