Thoughts on our security bubble

Last week I spent time with a lot of normal people. Well, they were all computer folks, but not the sort one would find in a typical security circle. It really got me thinking about the bubble we live in as the security people.

There are a lot of things we take for granted. I can reference Dunning Kruger and “turtles all the way down” and not have to explain myself. If I talk about a buffer overflow, or most any security term I never have to explain what’s going on. Even some of the more obscure technologies like container scanners and SCAP don’t need but a few words to explain what happens. It’s easy to talk to security people, at least it’s easy for security people to talk to other security people.
Sometimes it’s good to get out of your comfort zone though. Last week I spent a lot of the week well outside groups I was comfortable with. It’s a good thing for us to do this though. I really do think this is a big problem the security universe suffers from. There are a lot of us who don’t really get out there and see what it’s really like. I know I always assume everyone else knows a lot about security. They don’t know a lot about security. They usually don’t even know a little about security. This puts us in a place where we think everyone else is dumb, and they think we’re idiots. Do you listen to someone who appears to be a smug jerk? Of course not, nobody does. This is one of the reasons it can be hard to get our messages across.
If we want people to listen to us, they have to trust us. If we want people to trust us, we have to make them understand us. If we want people to understand us, we have to understand them first. That bit of circular Yoda logic sounds insane, but it really is true. There’s nothing worse than trying to help someone only to have them ignore you, or worse, do the opposite because they can.
So here’s what I want to do. I have some homework for you, assuming you made it this far, which you probably did if you’re reading this. Go talk to some non security people. Don’t try to educate them on anything, just listen to what they have to say, even if they’re wrong, especially if they’re wrong, don’t correct them. Just listen. Listen and see what you can learn. I bet it will be something amazing.
Let me know what you learn: @joshbressers

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s