🏴‍☠️ BJ Withrow

1. It is software = 100% guaranteed security risks 👍. 2. No matter the size of your organization invest time, talent, and treasure in developing a strong vulnerability management program and move as quickly as you can to exposure management. 3. Have a great day.

I usually slam my fist on the desk and demand the vendor buy me Starbucks for the next six months. In all seriousness I try to keep these things in mind. 1. We live on a small planet so be kind, respectful and remember people change places and products improve. 2. Measure the vendor's response. Are they defensive and still try to push the solution or do they look for ways to help and problem solve? 3. Evaluate just how big the gaps are. If you have a two hundred row spreadsheet with requirements just know that no vendor will meet everyone, unless your current vendor or already selected vendor wrote the requirements. There may be ways to still partner with the vendor.

1. Schedule all updates after hours, during non-peak sessions to lessen any impact on production. 2. Give them a Starbucks gift card and tell them to grab a cup of coffee while you reboot their machine. 😎 It is critical that you build relationships with the people you support to minimize internal battles. You will have enough troubles from the outside to contend with, no need to add to that with infighting.

Take a common sense approach starting with the fundamentals. There is no silver bullet. Trying to tackle everything is not possible and only leads to burnout. 1. Know what is within your environment, software, assets, people. 2. Know what vulnerabilities and misconfigurations you have on item #1. 3. Leverage technology and well defined metrics to prioritize where to spend your time, talent, and treasure. Understand that security is a practice and not a one and done project.

1. Stop seeing people as prospects. Everyone you come in contact with has dreams, goals, pressures put on them by the business to perform, tasks to do, etc. They have families and feelings just like you do. Treat them as such. 2. Be a real human. Be yourself and inject some humanity in your communications. Stop copying and pasting, and stop speaking like a corporate robot. Look to build trust and relationships. 3. Focus on solving problems NOT on selling widgets. Pushing people, trying to manipulate people to purchase something never goes well and will only damage your reputation. 4. If your company’s culture does not support 1 - 3 maybe it is time to look at moving to another company.

We tend to overcomplicate the sales process as evidence by the hundreds of books and sales training programs. It really is as simple as the golden rule, “treat others as you would like to be treated.” Don’t look for ways to sell your product, look to understand problems the customer is having and see if you can help. If your product can’t solve the problem but you can point them to a solution you have forged a relationship of trust. Most of all don’t judge the person or put them in a box labeling them as “outdated.” They have reasons for what they are doing and you need to take the time to understand.