Chaordic Mind

I never liked the word polyamorous or the social stigma that came with it. This along with the years of pressure to live the white-picket-fence lifestyle meant I worked for years to exemplify that ideal. The moment l I had it all is when things started falling apart.

I started letting go of expectations and re-discovering myself – this time without judgement or shame. I started reading books such as the Ethical Slut and Opening Up as well as having endless conversations with the limited number of people I knew who were already in open relationships.

Podcasts for me turned from a business focus to hanging on every word Dan Savage said and embodying his GGG (Good, Giving, and Game) approach to partners and relationships. The more questions I asked friends the more questions came flooding into my head. New relationships spawned new feelings and experiences such as jealousy, boundary setting, and hell even just knowing what boundaries to set or talk about.

Then there was the kink community. This has been a part of me my entire life but something I only recently openly engaged. The variety astounded me. There’s people who are private about their lives, people who are open with friends, and exibitionists who are very public about how they feel and what they want. People who like impact play and others who enjoy complicated scenes. I found an even more limited number, like me, enjoyed the mental side of play. My head was spinning when I started learning about sub-genres I never even considered existing.

The hardest part about living an open relationship with kink-positive people for me is knowing what questions to ask. I felt as if I had suddenly slipped into a relationship that no one had prepared me for and few people ever talked about. The public shame associated with alternative relationships is sad considering the number of these same people buying copy-after-copy of Fifty Shades of Grey (a book I can’t bring myself to read.)

Life over the last few months has been a roller coaster of self-discovery. I’m thankful for the small handful of experienced friends and those just present for me. It’s not easy taking the road less traveled but it helps to have not one but a network of friends who help me walk that road.

When I feel like giving up or letting off the throttle, I remember Let Robert Frost’s poem:

Two roads diverged in a wood, and I—
I took the one less traveled by,
And that has made all the difference.

If there’s any advice I can share, it’s to be true to yourself and to those you love. Follow your heart and be open to loss. I guarantee you it’s only the beginning, and what lies over the next hill is more rewarding than anything you can imagine.

Also, reach out to others. There’s more people like you out there than you think. Many more.

rhizoming the plan of consistency . . (Photo credit: jef safi \ ‘Parker Mojo Flying)

It’s easier to be consistent than accurate.

In our every day lives we fall into patterns of behavior that encompass everything we do. These behavior patterns are consistent and can even be used to fingerprint us as individuals and help us identify those closest to us. Have you ever heard someone say, “That’s totally what Sarah would do?” or “You seem a little off, normally you are not like this?”  Sometimes we don’t even see these behavior patterns in ourselves and rely on those around us who watch and observe us to help surface them to our consciousness.

On the other hand it’s rather difficult for us to develop a high degree of accuracy in our behaviors. Malcolm Gladwell hypothesized in his book Outliers that it takes practicing over 10,000 hours for someone to master a skill with a high degree of accuracy. (That’s practicing 8 hours a day, every day, without break for almost 3.5 years.) Furthermore, how many people become virtuosos in a skill or field? Looking back on history we see few names who persist today in the field of music and architecture, though undoubtedly hundreds of thousands more practiced and even worked in these fields.

Why we do what we do

Why is it so easy to ‘slip’ into consistent behavior patterns and so hard for us to hone our skills to a high degree of accuracy? Why do some people stay in their consistent behavior patterns and others continue to grow and change? Furthermore, how can we switch from being a consistent actor to being a more accurate one?

I believe people don’t often become accurate and successful people because they can only see down (until they look up.)  Let’s take being a physicist as an example. You might imagine three levels of skill set: someone who has never learned about physics before in their life, someone who has taken several classes in physics, and someone who is a professor of physics. The person who has never taken a physics class may understand that gravity exists but does not know that in a vacuum both an apple and a feather will accelerate at the same rate. How could they? Why would they? Their behavior patterns do not push them to experiment with gravity as they did for Isaac Newton.

The person who has taken physics classes and understands why apples and feathers accelerate at a uniform rate in a vacuum may not understand quantum field theory. This is how I say that people can only see down the skill curve and not up. Now imagine these three levels of physics knowledge stacked one on top of the other. A person with a greater level of skill can identify inaccuracies that a person of lesser skill is making but they cannot look up and identify the inaccuracies that a person of greater skill than them may make.

Now imagine that this applies to every aspect of life including ourselves as friends, co-workers, lovers, neighbors, and citizens.

Parents talk to teenagers about being safe. Friends talk to friends about relationship patterns. Self help book sales are at an all time high. We call this progress but we are only stirring the mental pot, not learning how to really cook. In the argument of who was right Aldous Huxley vs George Orwell, the clear winner is Huxley who shows we are amusing ourselves to death.

Two steps to looking up

The first step to looking up, improving ourselves, and breaking free from the consistent pain we cause ourselves is to stop searching outside ourselves and start finding out individual strengths. When we do this be begin to realize that the only true guru is within. Sufficed to say, there is no one else who will ever been as good at being us as ourselves.

This along does not change us from consistent characters to more accurate ones. No, to accomplish that we need one more thing. We need to look up the skill curve and observe what others do. Other with the sense of calm we desire, or others with the gift of gab that the introvert inside us wishes to attain, or other with the sense of guidance that we with disorganized minds would like to channel.

Too often we observe others and try to follow them, but this is wrong. Only by looking up at the attributes and finding a way to implement them in a way that is our own can we more our consistent behavior in the direction of a more accurate path. Introspection alone can lead to a dangerous place, and following others results in the same. But imagine what can be accomplished if we combine the two.

Now imagine how fast and far we can go with those plus my Three-Ds (discipline, determination, and drive). Being consistent enables us to operate in the world around us. Becoming accurate enables us to shape the world around us.

I’m thankful for my many friends around the world who take such great care of me. My global travels have all been the result of or under the hospitality of local friends who taught me that “you see what you know.”

I’m thankful for the many people who enter (and sometimes exit) my life on a regular basis. I’m thankful for those who taught me to “let go of expectations while holding on to passion, desire, and ambition,” who remind me that I’ll survive longer if I “be like the reed rather than the oak,” and who taught me that “competing with myself is easier and more rewarding than competing with others.”

It is my friends who regularly remind me of the words of Sir Isaac Newton: “If I can see further than anyone else, it is only because I am standing on the shoulders of giants.”

Letting go means not trying to control everything around you. It means giving up expectation and replacing it with hope, desire, and acceptance.

Making Sense of Life

This is a realization I came to recently while trying to make sense of change in my life. I recently faced the greatest fear in my life and what happened as a result has changed my life.

You see I learned that I’ve been living, arguably the last 15 years of my life, on auto-pilot. I wanted to excel in everything that I did but never stopped to question if the values and goals in my head were my own or a reflection of others that interact and influence me. It is like that scene from the movie Fight Club where Tyler Durden explains how he go to where he is in life:

Tyler: My dad never went to college, so it was real important that I go.
Narrator: Sounds familiar.
Tyler: So I graduate, I call him up long distance, I say “Dad, now what?” He says, “Get a job.”
Narrator: Same here.
Tyler: Now I’m 25, make my yearly call again. I say Dad, “Now what?” He says, “I don’t know, get married.”

My dad did go to college, in fact he got his PhD and is a practicing doctor of medicine in addition to a scientific researcher. Perhaps that is part of the reason I worked so hard to excel in everything I could. This approach to living has served me well in life.

I took risks; some worked and some didn’t but overall my life graph has been moving up and to the right. Even situations that turned out bad I looked at as positive life experiences. Regardless of what life threw at me, it made me stronger. To the outside world I was a smiling center of zen in the universe. Inside, I had a secret fear that propelled me forward faster than ever. That fear was my greatest ally and my most heavy burden.

Facing Life’s Greatest Fear

My great fear in life was that my entire history and existence was nothing more than a house of cards and if I ever stopped moving forward everything would fall apart. It’s hard to explain this to others who cannot comprehend how a mind can view such a solid foundation as the most fragile of Fabergé eggs. You see I always compared myself to the next person at the next level.  Every achievement ever made was like a drug and I always needed more to keep me happy.

One day I faced a situation I could not overcome.  I tried every brute force method of change to no avail.  In the end, I did the only thing left to do.  I let go. I stopped trying to force the situation.  I said to myself, “everything you have tried hasn’t worked so maybe not trying is the thing to do.”

The moment I did this it was if everything started falling into place in a way I never imagined. I vividly recall being at a conference after party and someone asked me what I was drinking.  I paused for a moment looked at my drink and replied, “exactly what I want.”  It was an iconic moment for me that I could live my life in any way I wanted.

The trick to unlocking my life laid in listening to those voices in my head and being able to differentiate between my own and those of friends or society at large.  As I began to rebuff societal norms and expectations I began to unlock my own personal happiness.  This is still a work in progress – and one that takes work – but for me “letting go” of expectation has helped my find more joy and love than I ever could before.

Opening Up

I used to put people into Procrustean boxes.  There categories included: work colleagues, social friends, and personal relationships.  Sub-divided within those were family, close friends, acquaintances, and activity partners.  When I looked at each person I wanted to place them into a category and became frustrated when their entire existence didn’t fit into one of those boxes.

I had ‘close friends’ but some I didn’t see or speak with for years. I had ‘family’ that acted more like ‘friends’ and ‘family’ that acted more like ‘colleagues’.  For the most part it worked out but I really struggled with the overlap, or lack of overlap.  For example, there were people I wanted to put in the category of ‘close friends’ but we were really only close on one level and not much beyond that.  Can a uni-planar friend count as a close friend?

So again I used the key that worked for me in the past: letting go of expectation.

Instead of putting people into boxes, I simply want to embrace those parts of people who match with parts of me.  I no longer care if the overlap is 5% or 95%.  I’ve accepted that I can experience people in part or whole much more happily than I can searching for those few people who will match 99%.  Opening up my friendships and relationships in general has enabled me to experience parts of people I would have written off or simply never come in contact with because our worlds would never collide.

I want simply to experience more from those around me. I want to not limit myself by expectation. I want to love freely and share experiences with those closes to me.

The lack of expectation, outside of experience, is what prevents disappointment for me.

These days it seems like every time I work through a situation I say, “but this for sure must be a wall/limit” and then remind myself that life and love really are limitless.  Life and love are bound only by our own constraints, and thus our troubles are often times self-imposed.  By removing expectation and my own constraints I’m learning to truly live without limitation.

Dear friends,

We started Security B-Sides (BSides) to do something different. We wanted to create a platform to help the security community achieve things together that we could never do alone, and expand everyone’s opportunities.

Thanks to the incredible support of all our volunteers and sponsors, over the past two and a half years, the community organizers have held 37 conferences across four continents involving over 100 organizers, and thousands of participants. I am so proud to be a part of this, seeing people help each other and doing things they would never have done otherwise.

However, this week, some criticisms were published about BSides. As the person named in some of these statements, I want to set the record straight on items that are factually incorrect, as well as address some of the growing pains I mentioned above. BSides, as a community organization, has a responsibility to our community and our sponsors.

Not-For-Profit Status

BSides is not yet a not-for-profit (NFP) organization. It is true that I initially included language stating this on the website and Facebook page because that is the spirit in which the organization was developed. This has since been removed. We have not misrepresented ourselves as a NFP to any sponsors or vendors, nor have we provided them with a receipt claiming such.

We are in fact pursuing NFP status. Please know this: I took the initiative to file for California state acceptance, which is the first step to filing Federal 501c3. The state filing was approved this year after many cycles. Due to state budget cuts, we waited months for each reply.

I have recently engaged a third-party company who specializes in these types of organizations to walk us through the process of selecting Board members, drafting bylaws, and completing our Federal application.

I admit that I might’ve taken more time than needed to address some of these important administrative details, but this delay was never out of malicious intent; getting caught up in the growth of the organization delayed this process. The foundation of BSides was never lost along the way.

In the spirit of growth, and to further that foundation, I’m happy to announce that the three initial board of director members for BSides will be: Jack Daniel, Gene Kim, and myself. Gene is the newest member of the team, and is an experienced executive and well-respected member of the information security industry and has served as an adviser and board member for many organizations.

Financials

Regarding the financials and banking issues, quick factual clarification. Shortly after forming BSides I applied for an Employee Identification Number (EIN) with the IRS. I then opened a separate bank account for BSides into which we deposited funds received. Since some sponsors wished to pay via credit card we used PayPal to accept these funds. I linked the PayPal account to the BSides bank account to be able to transfer funds.

This quarter we engaged a third-party bookkeeper to review the bank account and help us create an event-by-event accounting of all funds received and expenditures made. Let me emphasize, all BSides funds have gone directly to the events, to cover administrative costs, or were donated to charitable organizations. To go a step further, neither myself, nor Amber, have received any compensation for our time or effort and all of the funds have been kept in a separate account from our personal funds.

Another important piece to the financials is the management of events. When we had 5-10 events spread out over the year, it was easy to manage all invoices and all accounts from one central location. This process broke down and we ended up paying for one event using funds raised from the last as we tried to collect on committed funds. Going forward, we have discontinued the “global” sponsorship and will require each event to raise their own funds and cover all expenses. There will be no co-mingling of finances.

Responsibility and Accountability

Although we are not yet a NFP and not required to publish financials, we will publish a report in accordance with typical NFP practices. We are diligently working on this and our hope is to have it completed in the next couple of weeks. If any sponsor would like to know how their funds were used, we are also ready to provide a full itemized accounting details for them.

I am not perfect, and many of the changes that occurred in the last two years came from extreme growth and change. I agree with Bill Brenner that this is an opportunity to build something better. We learn, we evolve, we move on. We now have a formal board of directors, a third party bookkeeper, an organization that will help us complete the 501c3 paperwork and filings. We have new processes for each event operating independently. I think the good we have created should not be abused or ignored.

The Future of BSides

My main concern is what the future holds for the many event organizers whose sponsors may question their involvement in BSides. I will continue to assure our sponsors that BSides remains a worthy investment and that we are laser focused on making this a better and more transparent organization for the benefit of the security community and broader industry.

I would like to encourage others to continue to be collaborative, and help each other do good things. If you want to volunteer and participate in our improvement, please contact me at mike@securitybsides.org or join the BSides Google group.

If you have any questions about BSides or any of the accusations, please email me. In the spirit of total transparency, I will attempt to reply to all of your questions.

Going forward, I hope the community can help itself heal, band together, and continue to help others do together what they could not do alone.

Sincerely yours,
Mike Dahn

As January of this year rolled around, I hadn’t planned on changing jobs but I knew the year ahead would be interesting.  During my tenure at Verizon Business I learned quite a bit and met many wonderful people.  When I decided to join the company two years prior I did so because of the people.  One lesson I learned long ago is to rank my job by: (1) what I will be learning and (2) who I will be working with.

Tenure with Great People

The most wonderful thing about working for Verizon Business was working with the RISK Intelligence team, led by people like Wade Baker and Alex Hutton.  These gentlemen and their team are responsible for the famous Data Breach Investigations Report (DBIR) and the Verizon Enterprise Risk and Sharing (VERIS) risk modeling tool.  Many companies put out research reports but few focus so much on making their methodology transparent and unbiased.

One of my favorite projects from 2010 was working with the Verizon RISK team on the first annual Verizon PCI Compliance Report (PCIR).  It was hard work, and needed to happen alongside an already heavy work load, but it’s one of the most important projects I’ve worked on.  The reason why is that it analyzed reports and data over the two years prior – of actual assessments – and portrayed the results openly.  This year, Martin McKeay is taking over the PCIR and kicking it up a notch by providing even more ways of splicing the data.  I can’t wait to read it!

My eternal three items for improving the information security industry (in response to Josh Corman asking) have been:

1. Education, education, education
2. Flexibility of controls
3. More data for risk modeling

It’s the #3 that the RISK Team at Verizon is famously known for.  In fact, security researcher, Anton Chuvakin recently referred to the DBIR as “a piece of juicy awesomeness that only comes once a year”.

It’s Good to have Options – but hard to Choose

I hadn’t planned on moving on but when a good opportunity came along for me to grow and learn, I had to take it.  I received a number of casual job offers during RSA 2011 week, during which Martin and I presented on PCI compliance in the Cloud and the entire Security B-Sides team had a successful BSidesSanFrancisco event.  Nothing was compelling enough to make the big switch.  Then came Square.

Thanks to Sam Quigley, I had the awesome opportunity to contract at Square, a mobile payments startup in San Francisco. Square is not just another startup, it’s a company that is going to revolutionize the payments and social landscape.  They make payments simple and elegant.  Check out the TechCrunch post/video of Jack Dorsey’s famous “bridge” speech as to why they will be the Apple of payments.

Why will Square succeed?  Because they are a company of people following their passion and have a community of customers who love them.

Although I love the company, and will pimp them every chance I get, I decided to take another path.  I still love the people I met at Square and the lessons I learned.  So here are a few of those lessons:

1. Follow your passion, passionately.
2. Everyone in the company is part of idea creation, but it’s the leader’s job to be the “editor” of these ideas.
3. Ideas that are not used do not get discarded, they go “on the shelf” for later use or re-evaluation.
4. Measure everything.  ”If you cannot measure it, you cannot improve it” – Lord Kelvin
5. Don’t fail fast; iterate fast.
6. Know and tell your story well.

I cannot emphasize this last part enough.  Watch Jack Dorsey tell his story at Stanford.  He does so without slides or prompts.  He knows his passion and his direction and can articulate it easily.  How many of us can tell our story this well?

Knowing your story and being able to articulate it helps us live the direction we want to go instead of just zig-zagging through life.

Conclusion

Although Square is a great company and will change the world, I believe that my work there would not be as impactful as it would at another company.  I’ve decided to take a job as Director of Threat and Vulnerability Management (TVM) at PricewaterhouseCoopers (PwC).  Here I will be able to follow my passion and have an enormous impact.

My fundamental passion is empowering people to have a greater impact on the world around them.  At PwC, mentor programs are built into the DNA of the company and I’ll be able to help grow a team.  Much like I do with Security B-Sides, I’ll be able to leverage a team of people to be more than the sum of their parts.  I have some great plans for working in a leadership position at a multi-national and well-respected firm.

Much like at Verizon, at PwC I’ll be able to work with a smart team of professionals such as Gary Loveland and Mark Lobel who curate the PwC Global Information Security Survey.  I’ll be able to move beyond PCI compliance and focus on helping companies manage risk, however it makes the most sense for their company.

Most of all, we as a firm will leverage the talented and ambitious professionals that make up PwC.  I always thought that the Big4 sold products and services, but the reality is that their only service is their people.  I look forward to working with a group of talented professionals and helping them grow as a team.

When interviewing at PwC, I was asked a question I will never forget.  “Anyone can sell themselves.  How will you sell your team?” It’s true that you reach a point in your career when it’s simple to sell yourself, but the true measure of a leader is how well they grow, position, and market their entire team.

I look forward to the challenge and am excited to see what the future brings.

A few days ago I posted a message to Facebook:

Learning & living to follow my passion, ignore the rest, and happiness will follow.

I know so many people who believe they will be happy when they get more money/status/recognition.  Happiness comes from the in-between, not the end goal.  You need to be happy doing what you believe in and to do that you need to follow your passion.

I’ve recently encountered some major changes in my life, and with these changes I’m trying to live by a new set of revised rules.  So I’ve collected for you a two examples of people following their passion and getting so much more.

Jack Dorsey founding Twitter

This video is not only a great story but an example of how following your passion can lead to great success – when you pursue it greatly. Jack, co-founder of Twitter, tells his story about growing up in St. Louis and his passion for maps.  This passion for maps lead to him later working for the largest dispatch software company in the US, wherein he found great pleasure in mapping out the status updates of police and emergency vehicles.  This passion for dispatch, maps, and status updates later lead to him co-founding Twitter.  A similar passion lead to him co-founding Square.

Most people think that great companies are formed by people sitting around thinking how they will take over the world with computers, but the reality is that they are formed by people following their passion.

Jack leaves us with the quote by Lynda Barry, ”Expect the unexpected. And whenever possible BE the unexpected.”

LCD Soundsystem Gets Big

I’m a big fan of both music and The Economist so when I saw this article it struck a chord. It turns out LCD Soundsystem has a great story.

After three critically acclaimed albums and a decade on the road, James Murphy and his electro-rock band have decided to call it quits. Last night was the second of four warm-up shows for what they’ve promised is their grand finale: a headlining gig at New York’s Madison Square Garden

James Murphy wasn’t always the renowned rocker he is today.  In fact years ago his life almost made a big change.  At age 22, Murphy was offered a job writing for the sitcom Seinfeld which was then little-known. He did not expect the show to be successful and chose to continue with music instead. He struggled for years as an artist as his friends ate at nicer-and-nicer restaurants and moved up the socio-economic ladder.

At an age on the cusp of no longer being able to make it as a rocker, he formed LCD Soundsystem and released the first big hit Losing My Edge, which brought him international acclaim.  He goes out on top playing at Madison Square Garden to a stadium of fans sad to see it end.

Following your passion is not always easy and does not always bring you great ending success, but I can promise you two things:

1. Following your passion will keep you happy along the way
2. Following your passion-passionately will increase your likelihood of achieving success

Today I’m switching gears to talk about something we all do but don’t often consider, LEVERAGE. This post explores ways in which we can leverage the world around us to to maximize our strengths. The areas we can leverage include our job (delegation), out career (social networks), our business (cost centers to revenue centers), and many more. Many of these are examples of chaordic frameworks, but let’s expand on a few of these to better understand them.

Martin Fisher kindly invited me as a guest on his Southern Fried Security podcast. He stipulated that we talk about something other than PCI, which made me very happy since I’ve been looking for a venue to discuss some of my ideas for leveraging the world around you.

You’ve seen it done in the movie The Matrix where Neo bends the world around him to dodge and eventually stop bullets. Let’s see how you can warp and leverage the world around you to maximize your ability to succeed in several areas of your life you.

Goal

Martin stipulated that we should focus on how “information security professionals (especially leaders) need to position themselves (e.g. subjects to learn/become more familiar with, conferences to attend, ideas/concepts to embrace) better for 2011.” Just like a life or career coach, let’s break this down into three categories we want to apply leverage:

• Job – by leveraging delegation either assigning tasks to others or taking on tasks of others
• Career – maintaining networks (social, physical, electronic) to help make you better (smarter, more employable, etc.)
• Business – turning cost centers into revenue centers

LEVERAGE your JOB

Long ago I had a manager who believed you could delegate anything. I thought this strange because to me there are some things you can easily get done yourself but assigning to others will take much longer. The problem with my old mindset is that you end up thinking you are the best person to perform 80% of tasks thus taking up all your time and preventing you from leveraging the skills of others. Remember, delegating is not just about getting other people to do work it’s about assigning tasks based on area of expertise or helping someone improve and expand their skill set.

Task #1 is to delegate to others tasks that can help them grow or maximize their skills to complete a project. Sometimes you won’t even know how a task will help someone grow until they complete it.

Task #2 is to time-share between those individuals who have taken on tasks and help them complete the task in a successful manner. Assigning and walking away is often worse than never assigning at all. For delegation to work you need to foster growth in those who are taking on the task and provide them the resources necessary to be a success. Sometimes these tools are connections, access to resources, providing experience, or building confidence in their own abilities. Sometimes these tools are timelines, deadlines, project management skills – whatever it is the individual needs to get things done.

LEVERAGE your CAREER

I landed my first job out of college via a job fair at the University. I landed my second job via Lee Kushner, a professional recruiter. Every job after that has been something I created myself or offered to me via my network of connections. Beyond the simple job search, leveraging your network of connections can be critical to almost every success you see in your personal career. When people talk about networks they may be discussing a wide range of topics including: social networks (twitter, facebook, linkedin); physical networks (co-workers, neighborhood friends, hackerspaces, meetups); or electronic networks (irc, email, phone calls). Everyone has a different way of leveraging these networks but we all do it – either to keep in touch with friends or build communities.

Task #1 to grow and farm your network is to make smart connections. You need to keep in touch. You need to help other build connections. Growing and farming a successful network is not about helping you get something out of it but helping your network get something out of being connected to you. It’s a strange thing in that regard that the most connected of us are not always the smartest individually but they are able to connect you to a smart or capable person in the area of your interest.

One of my end-goals is to “connect smart people” and so every time I meet someone I think of someone else I can connect them to. Working on a Bay Area art project? Reach out to Chris Rusak. Interested in lock picking? Reach out to Deviant Ollam. Want to know about creative data exfiltration techniques? Reach out to Iftach Ian Amit. Social Engineering? Mike Murray and Jayson Street. Need a job and are a skilled professional? Lee Kushner. The list goes on and on. Photography, life coach, physics, startup company … you name it and I’ve got a person for you to connect with.

Task #2 (and here is the tricky one) is to leverage your network to create a bigger/better network. But why you ask? Isn’t it time to “harvest” the network? No, never, nada. The hard thing for people to wrap their heads around with networking is that the benefits to you are natural side effects not pre-planned end-goals.

Community growth is organic and as such so should be the way you leverage them. For example, after starting Security B-Sides I though we could leverage the 10-15 events to help solve the “big problems” facing the information security community. Although not a bad goal, the idea that I could direct the solving of these “big problems” was an incorrect assumption. Instead, I encourage companies to get involved in the community and organically solicit interested participants in helping them solve specific problems they are facing. This type of involvement helps complete the organic virtuous circle of helping the community help itself.

I said it best via twitter:

Every time I think tools are for making products someone reminds me that tools are made to build more tools.

LEVERAGE your BUSINESS

Few people other than the CEO and CFO within a company think about things such as “cost centers” vs “revenue centers.” For example, the sales and delivery departments may be revenue centers while the marketing and IT department may be cost centers. Companies need to stop accepting these as a way of life and begin to think of ways to turn cost centers into revenue centers.

Case Studies:

IBM realized long ago that their internal IT department was really good at providing one great company with IT services. If the IT department could do good things for one company why not let it do good things for many companies? IBM stopped thinking of IT as a cost center and turned it into IBM Professional Services and expanded the services offered to create an amazing organization.

Kaspersky Labs realized early on that marketing can be a cost center, but only if you let it. They created a separately branded news company, ThreatPost, that grew into an organization until itself. Instead of hiring staffers to write all the articles they turned their marketing people until content farmers, connection people who wanted to write about smart things with an audience of readers who wanted to learn. In doing so they maximized their staff abilities to create more than any one individual could. ThreatPost has since expanded from the US into Latin America with locally written articles in Spanish and Portuguese.

Goldcorp had a problem in that it didn’t know where next to mine for gold. Instead of keeping it geological data secret it opened it up to the community and offered a prize for who could come up with the best place to mine for gold. This was a big risk as no other companies were offering up their valuable geological data online for anyone, including their competitors, to access. The payoff was huge and direct in their monetary return.

Task #1 is to re-examine the parts of your company from marketing and HR to IT and supply-chain-management. Every part of your company that is a cost center may have the potential to be a revenue center. Start questioning why you do things the way you do? Why do we write our own marketing materials? Amazon has users write book reviews for them. Why do we pay people to solve problems? Many companies have developed APIs and allow others to write plug-ins to their software. Find ways of letting other people solve your problems for you.

Task #2 is to pick one thing you want to convert from a cost center to a revenue center and focus on it alone. Like a scientist trying to determine the key factor in an experiment, do not get over zealous and try to convert everything at once. Remember that you are learning and want to take it one step at a time. Find one thing to revolutionize and become very good at. Wash, rinse, repeat.

As you might know, I love Security B-Sides.  One of the many benefits of participating in BSides has been the fact that, not only is it a free event, but it raises money for charities – primarily the Electronic Frontier Foundation (EFF).  The short story is that the EFF defends the digital rights of those who could not otherwise.  They are the ACLU of the digital frontier.  I respect their work greatly and feel safe knowing that they will be there for me one day if the need arises.

Individually, I only donate so much but by leveraging a platform on individuals we can do so much more.  That is what I love about communities.  You can accomplish more than any one individual, and (properly driven) chaordic communities can do (measurably) more than any structured group.

In addition to money raised from the BSides events, there are speaking events that I do for which I’m precluded from monetary compensation by my employer.  No worries, I just ask that they donate the money to the EFF.  Win!

Here’s a short accounting of the monies I’ve helped raise for the EFF.

• Security B-Sides SanFrancisco 2010 ($1,000)
• Security B-Sides LasVegas 2010 ($2,893)
• Unnamed speaking event ($250)
• Unnamed speaking event ($1,000)
• PCI #HugItOut with @JoshCorman @McKeay @RealGeneKim ($1,000) and matching funds for Hackers for Charity ($1,000)

Folks, we are getting close to raising $6,143 for the EFF in one year.  Considering the average donation might be $100/year this is over 61 years worth of donations.  (Ok, so the math is strange, but it’s my math.)

In addition to this, Security B-Sides have a semi-strategic relationship to cross support each other.  We will help individuals help raise money for the EFF at their BSides event (if they wish) and the EFF will help promote and publicize events that do so.  Win-win.

Call me the opinionated curmudgeon or the truth-telling sage.  Call me anything you want, but when you do please don’t use some empty slogan.  If there is one thing I dislike more than spin and FUD, it’s the empty slogans that back them up.

Problem Statement

Too many times I’ve heard analysts, and those wanting to make a name for themselves, coming up with phrases such as “wield the power or yield the power” without any real solution for change.  These empty slogans rally the uninformed with their easy to relate to sound, yet fall on dead ears of those who understand that complex situations cannot be solved with catch phrases.  At best empty slogans fall by the wayside, and at worst they deter progress by keeping people in the dark about the true complexities of problems, enabling the problem to persist and even exacerbate itself like a cancer.

I don’t have a problem with slogans that come with backing, but empty statements have no place in bringing about positive change.  My current frustration is with the slogan, “Rugged Software“.  Is it slogan or a challenge? Will it be effective or is it a hollow statement?  My position is that any effective call-to-action slogan must carry with it some meaning and, even better, a toolbox of item with which to execute it. This slogan has neither.

History of Slogans

1. “Don’t Mess With Texas”

Probably the most well known slogan, though few know its intended purpose, is “Don’t Mess With Texas“.  This slogan has little to do with Texas individualism but with trash or should I say litter.  That’s right, in 1985 the Texas Department of Transportation (TxDOT) used this slogan – after many failed slogans – to reduce the amount of litter on Texas roadways.

The National Corporative Highway Research Program (NCHRP)’s Reducing Litter on Roadsides mentions “the campaign reduced the amount of visible litter on Texas highways by 72% in 6 years (Texas Department of Transportation 2008). The DOT asserts that the success is the result of, at least in part, the use of athletics and musicians who are admired by the the target audience.”  After millions of dollars and a plethora of celebrity endorsements middle-aged males were finally encouraged to reduce the amount of litter they threw out the window or onto the ground.

So why was this slogan so successful?  Earlier slogans of “Don’t be a Butt!” failed to launch even though they targeted the same audience of 18-35 year old males that were most at risk for littering.  Remember that even back in 1985 we knew the leading cause of litter was cigarette butts.  In a 2005 Visible Litter Study of Texas it showed that:

• Over the course of 2009, approximately 1.1 billion pieces of litter accumulated on our highways; while this represents a 33% increase over 2005, it marks an 11% decrease relative to 2001.
• Why the increase in litter since 2005? Cigarette butts! Tobacco trash – including nearly 400 million cigarette butts – comprised 43% of all litter on our roads.
• The Texas Dept. of State Heath Services estimates 18% of all Texans smoke, and six in 10 smokers admit they litter. What does that mean? It means that just 11% of Texans are responsible for 43% of all our litter!

Apparently not only does smoking kill, it also accounts for the greatest form of litter in Texas from 1985 to 2009.  In fact, “According to the VLS, the amount of litter in nearly every category has increased since 2005 — tobacco, cups and cans (non-alcoholic), construction items, household and personal, and automotive debris.”

Has the program been effective?  Well picking up trash along the Texas roadside has cost the state “$47 million in 2009 … up from $38.7 million in 1986″.  This increase is costs is prevalent even though studies show a nationwide decrease (by 50%) in smoking from 1965 – 2007.  The smoking rates for Texans was 18.6% in 2008, almost on par with the national average.

2. “Take a Bite Out of Crime”

On July 1, 2010, McGruff the Crime Dog turned 30 years old with his famous slogan “Take a Bite Out of Crime” created for the National Crime Prevention Council. The goal was to reduce the levels of crime in 1980 which had reached a peak.  Now “crime” is a relative statement but is most often measured by a combination of violent crime and property crime.  There are other categories such as drug and cybercrime but for the sake of continuity of numbers we will account for just violent and property crime, the prime targets of the slogan.

According to the US Department of Justice, Bureau of Justice Statistics (BJS) figures, ”the crime rate had risen sharply in the late 1960s and early 1970s, bringing it to a constant all-time high during much of the 1980s, it has declined steeply since 1993.”

Though the anti-crime slogan was adopted in 1980, crime continued to rise for another decade.  In fact, if you review the BJS figures along with the FBI crime figures you will notice a pattern outlined in the graphic above.  Both show a rise in violent and property crime from 1960 to a peak in about 1991-92.  This means the slogan either took 11-12 years to really take hold, or there’s another explanation for the decline in crime from 1993 to 2003.  (Some people suggest it was the introduction of the Three Strikes Law first passed by Washington state in 1993.  This turned out to be statistically incorrect after a 10 year study proved no correlation between such state laws and the reduction in crime.)

Instead, could it be the economic rise that lasted from 1993 – 2007?  If we measure the Dow Jones Industrial Average (DJIA) from 1993 at 3,500 to its height in 2007 14,000 one can easily understand why the violent crime rate followed an inverse pattern.  (Sure there was a DJIA dip in 2002 but it rebounded in only a few short years.  Crime shows a leveling off in those years but still a decline across the board.)

3. “Click It or Ticket”

One of my favorite examples of a slogan is “Click It or Ticket“, a National Highway Traffic Safety Administration campaign to increase the usage of seat belts in the US.  The slogan campaign specifically targeted young adults due to their low usage of seat/safety belts.  According to the Social Marketing Institute that closely monitored this program, we understand the following items.

Before 1980, usage of seat belts in the United States lingered around 11% despite volunteer and educational campaigns at local, county, and state levels. Between 1980 and 1984, individual organizations, public education programs, incentives and policy changes strove to increase the use of seat belts. However, these efforts failed to significantly affect usage in large, metropolitan areas, and in by the end of the effort, national seat belt usage had reached only 15%.

In 1984, New York became the first state to enact a mandatory seat belt use law, and by 1990 37 other states had followed suit. The vast majority of these laws were “secondary safety belt laws”, meaning that an officer had to observe another traffic violation before issuing a citation for a seat belt infraction. Despite this, the national usage rate climbed from 15% to 50%.

An extensive evaluation of the program showed not only when both communication and enforcement were combined in a single unified marketing strategy, the results were impressive (a 14% reduction in traffic fatalities), but when the communication was withdrawn and the enforcement left in place, seat belt use dropped dramatically. Once the communication component was restored compliance went back up.

An empty slogan alone would not have helped save lives and neither would just the law.  It was the combination of strong communication and message of call-to-action (“Click It”) plus deterrent (“or Ticket!”) that made this slogan an effective winner.

Analysis

Each of the above three slogans teaches us some important messages about about communication.

1. “Don’t Mess with Texas” sounds to me like an empty statement and has little backing behind it.  Though it was effective for a short while, and though a high percentage of Texans associate it with anti-littering, the rate of such problems only slowed at best.  It is hard to say if the slogan was effective since the volume and cost of cleaning up litter both increased.  Perhaps the slogan slowed the activity but it had nowhere near the effectiveness as the seat belt slogan.
2. “Take a Bite Out of Crime” sounds a bit more direct.  It mentions the call-t0-action and the direct object it wishes to affect.  It is debatable and perhaps unlikely that this slogan had a noticeable impact on crime due to the increase after its inception.  The eventual decrease in crime over a decade later can easily be explained in the increased economic jumpstart that rose the level of affluence across the board. (The 1980s were one of the worst economic recessions since the Great Depression in the 1940s.)
3. “Click It or Ticket!” is just a great slogan since it combines call-to-action with deterrent and in this case an actual law.  Police in many states can now pull people over just for violation of this law instead of previously requiring another, more serious, reason.  The statistics show clearly how a good slogan combined with enforcement can be a powerful duo in affecting change.

Conclusion

How does one measure a slogan, and how does “Rugged Software” measure up?  Do you inherently understand the call-to-action? Is there a deterrent? Is the slogan celebrity endorsed and targeting the proper groups with the right incentives?  Only time and data will tell, but I challenge such organizations that wish to affect change to consider these criteria.

Moreover, I think a good slogan should also be backed by a solid set of tools, resources, guides, and such that lower the barrier to entry for people to participate.  In the case of litter due to cigarette butts, we can encourage the use of additional ashtrays in cars.  In the case of software, we should provide a series of guides, e-learning, checklists and such that provide guidance on how to secure applications based on both the functional use of the application and the language in which it is developed.

Update: I have received more cuss word feedback on this blog post than I have on anything else I have ever written; so let me clarify end explain the goals of my position.

I actually like the “Rugged” software movement as a method of raising awareness. I didn’t give it enough praise for starting a movement, but that is all it is, a start. Rugged is an infrastructure that in order to be remembered as an effective movement need a nervous system and muscular system.

Just like “Click It or Ticket” we need to pair the positive awareness with tools, checklists, and even enforcement of some sort (be that regulatory, legal or other).  I don’t want the success of Rugged to make people complacent or feel that a manifesto alone is an effective strategy.