Thoughts about Change

   We've all heard the cliche, the only thing that is constant is change.  Many of our organizations are undergoing all kinds of change.  We may have professional changes.  And, of course, there are personal or life changes.

   Sometimes you have control over changes - they can be choices.  Sometimes you don't have control over the change.  But you do have control over how you respond to change.

I've spoken with many people whose organizations are undergoing change.  That can lead to some uncertainty, but that is not necessarily a bad thing.  It's really just something new.  And change often brings opportunity!

   One model that can be used to help people through change is the Bridges Model of Transition.  Bridges defines a transition path that begins when a change is announced or recognized. and ends when people are successfully in the changed state.  The key is what happens in between!  Bridges describes 3 stages that people must move through.

1. Letting Go - this means both understanding and coming to terms with the change.  It can be characterized by fear or other negative emotions.  Leaders can help by communicating, listening, and empathizing.  Recognize that different people change at different rates.  Individuals can help by talking things through with their leaders.
2. The Neutral Zone - this occurs once people get past their initial reaction to change.  This can be a period of uncertainty.  Leaders can help by providing direction and continuing to communicate.
3. The New Beginning - this occurs when the organization has arrived at the new state.  Since people do change at different rates, all team members may not arrive here together. Leaders can help by recognizing the state of team, providing extra direction where needed, and celebrating successes of the transition.

   I've been thinking about the topic of change for a couple of reasons.  First, my current organization is undergoing the change of integrating in a new organization.  This is actually a great synergy and creates many great opportunities both for the business and for individuals.  But as we discussed above, change affects different people differently.

   In addition, I'll be undergoing my own change soon as I transition to a new and exciting opportunity!

   Thank you to all my current colleagues for their partnership and support!  I know our paths will cross in the future.

The First Rule of Security

   That's a classic scene from a great movie.  And, if you think the movie is twisted, you should definitely read the book or the audiobook!

   Many people know that the first rule of Fight Club is that you don't talk about Fight Club.  That's because they didn't want to draw attention.

   But in security, the first rule of security is:

   That means a number of things:

• Security Awareness - a program at your organization to promote security themes.  I like to focus on information people can use at home.  I've talked about this in the past.
• Public Awareness - similar to security awareness but here security pros, IT pros, law enforcement pros, or really anyone, talks to the public about security and privacy issues.  There are opportunities through the schools, community centers or school district parent organizations.
• Conferences - are a great way for people to learn more about security and for security and IT pros to learn more, improve their skills and make great contacts.  I was recently at the HIMSS Privacy & Security Forum in Boston.  I saw old friends and made new ones, heard some great speakers (and did a bit of speaking myself) and learned a few things.
• Professional Organizations - There are many IT and security professional organizations.  Some of the organizations I participate in include ISSA, ISACA and Infragard.  There are local chapters in most areas.
• Other local groups - in addition to the formal professional organizations, many areas have local groups for security leaders or security practitioners.  You can find out about these groups and conferences or professional organization local meetings.
• 1:1 discussions - talk with a security pro about security!  Even better... talk with someone who's not a security pro about security!

   Here's the thing... the attackers - the people who are trying to break into networks or your home computer to steal data - talk to each other.  They share ideas and techniques.  They learn from each other.  We must do the same.

   How do you talk about security?