Slashdot Mirror
How to Approach Customers with Security Issues?
stuntshell asks: "We're a group of IT Professionals and we're starting our own consulting firm. We're most systems administrators, and not business admin, nor lawyers, and we're all have worked on big companies and most of the time the job to be performed was just passed on to us. The scope of the work we're about to perform will be security related, so how do you approach a customer in this kind of business? Do you wait for them to come and ask you to test their firewall? Or do you go scanning and discovering holes on other's network for you to offer them your solution? Do write a letter/email or do you propose a meeting? What works?"
and you give him a budget big enough to do his job. You know, sales? The basis of business? Oh, didn't think you'd need that? Note to investors: GET OUT NOW.
How we know is more important than what we know.
Or do you go scanning and discovering holes on other's network for you to offer them your solution?
Boy, does that sound like an astonishingly bad idea. Sorta like a locksmith picking the lock on your front door, coming inside and offering to sell you a better lock. Sounds to me like a great way to get shot.
Figuratively speaking, of course.
Get submittal about your company approved on Slashdot ... oh s*it ... forgot to post our URL!
Every company reads about you and wants to hire you.
Profit
Hulk SMASH Celiac Disease
Sniffing me, then emailing me to plug the holes for a price is almost the equivalent of blackmail. This may earn you one of 2 things:
1) A very nasty letter from either management or legal telling you to cease and desist
2) From the more nasty management/legal, a call to the police..
The best way really, is the more conventional way, advertise, network and otherwise legitimately promote your business, this gray area finding holes and near-blackmail will get you more grief than it's worth.
By the way and offtopic: I woulda probably had first post if my new kitten didn't continuously stomp on my keyboard. Cans of air certainly are handy...
...in bed
Absofreakinglutely do **NOT** any such thing. **NEVER** intrude on a network unless you have **EXPLICIT** **WRITTEN** authorization to do so. You're going to be very, very sorry if you make a practice of doing such things.
I realize that it's impossible to make this point here without a stream of common-sense-impaired nerds lining up to insist that some stupid analogy makes unauthorized intrusion a great idea. You can listen to them or listen to me...
What I'm listening to now on Pandora...
As far as "getting the sale", what worked for salespeople that sold goods/services - security or otherwise - to your previous company/companies? That might be a good place to start. If you were never brought into sales-discussions, you might want to ask yourselves "why not?".
What you *definitely* want to do is perform unauthorized scans and/or penetration attempts on a potential customer's external firewalls and/or servers. That will most assuredly endear you to them. Why, they might even ask to have a police escort for you!
One of the last things you should do is approach a new career in security consulting without really knowing that part of the IT world like the back of your hand (and not just the tech bits).
(Have you considered starting up a Starbucks franchise instead?)
Mind the gap...
Well, speaking from my experience at a fairly successful consultancy business, I think there are a couple of strategies. First, there are some key skills you all need:
1) Distinguish yourself as a group that provides "practical, effective" security. Never leave any of your first customers wondering why they paid you.
2) Solve the problems they want solved rather than the problems you think should be solved. Don't go tell the customer what they need you to do; instead, listen to what they say are the problems and solve them.
3) Brutally asses all the communication skills of your team. Know who your great communicators are, and who are the people you need to hide from the customer. Face it, as a consulting firm, it matters most how you interact with the customer.
As far as strategies go:
1) I bet your primary battle will be convincing people that it's worth investing in security. Start gathering factual stories of security failures so that you can talk about specific incidents and what happened. Be prepared to explain to a non-technical user why they should spend money - and make sure it's completely relevant to them.
For instance, I worked at a web-firm that doesn't really care about security... but they also have about 12,000 social security numbers in one of their databases. When we tried to push "network security" in general, there was no traction. When we asked "what if we have to announce to all our customers that their SSN's were stolen from our database?", that allowed us to push for greater security controls.
2) Consider focusing on the "virus-protection" market. I know a lot of small businesses completely struggle with Windows viruses that can bring down the network. Since good network security can help stop the spread of viruses, it might be a reasonable fit. "Stop the havoc that viruses cause" is a strong selling point.
3) Maybe offer a "security review and emergency assistance when needed" package. Basically, you do a review of their network for a nominal fee and then you're available for emergency issues if they have a security issue. Sell it as "now you'll know who to call if you really have a problem."
Once you get in to do the review, you can even make some suggestions to improve logging/auditing so that you can respond better in an emergency.
4) Get some street cred. Publish some articles on security issues, find a security weakness in Mozilla (we just heard that it's buggier than IE, right?) and get your name out there as a "security firm".
As an alternative, answer questions on newsgroups or forums. If you're good, you can get a rep as knowing your shit by answering people's questions. Sometimes, the sysadmin who asks for help could really use a consulting group instead.
Finally, one last piece of advice:
1) Always treat your clients' problems more seriously than they treat them. If your clients are a little concerned, you need to be very concerned. If they're satisfied, you need to be slightly concerned. And don't just sound like you're taking them more seriously - take them more seriously! If the client thinks it's a little problem, treat it like a big problem and get it fixed right away. If it's a big problem, treat it like it's the end of the world.
I know it sounds silly, but it means that every time your customers contact you, they will always get the impression that you're more on top of the problem and solution than they are. And that, in the consulting world, is gold!
Good luck.
-Peter
Treat it just like any other project that uses a cyclic lifecycle management. I'm supposing you already have your foot in the door, you are just unsure as to how to conduct yourself. At the end of each round, the customer can decide if they like the kind of progress being made and has the option to cancel the contract after each round if they disagree with methods or results. Start small and simple and develop their trust. If they really have security problems, you are best off finding a way to make them want to change rather than just telling them off.
Round 1: Spend one week writing a paper on the intellectual or physical property deemed essential to the company, and then document what measures the company believes they are practicing to protect them. At this point, you should also define your known enemies, be it a competitor or vast amounts of time wasted during virus outbreaks. Don't dwell on anything but the obvious as we all learned in the Six Dumbest Ideas In Computer Security document.
Round 2: Propose a paper exercise approach to physical security, both in the server room and in the cubicle farms. Spend a week and not too much money. This will confirm or deny that declared in Round 1.
Round 3: Address disaster recovery options because arson and other DOS techniques are just as bad for protecting IP as is an electronic attack. This is a check to see if the current protections methods covered this usually underfunded area. Don't forget offsites.
Round 4: Propose, via contractual methods, solutions for closing gaping holes in the protection measures. That is, cover the areas for which no protection is provided, be it physical, procedural, or electronic. Implement if approved and have alternate, albeit less-effective approaches for those rejected due to cost or time.
Round 5: Propose a development area be established to test current and future configurations of electronic equipment for known attack vectors (e.g. new patches on a firewall don't open new ports). [At this stage, your customer has confidence that you know what you're doing, but it took you this long before you really started touching the inside of their network.] You never subject the production network to most scans, except maybe for proper patch deployment. All the exploit attempts happen in the lab.
Round 6: Like every good reader of Bruce Schneier's Secrets and Lies , you now propose methods and procedures for monitoring and reacting to attacks against the core intellectual or physical property documented in Round 1. Depending on your company goals, you can hope to win this one, or you can let them run the service while you move on to another customer.
Tips: If you get lots of resistance at Round 1 telling you that you aren't moving fast enough, beware because you will be the victim of the blame game in Round 6. Don't forget that sometimes the attack vector is physical theft - encrypt core files anywhere they are found, most especially on laptops. Round 1 may have identified Internet access as a risk, so in Round 4, consider using a private, internal network and force all users to use thin-client tools for Internet access - no removable media, highly-enforced group policies, and the ability to quarantine viruses at the door. For that matter, proxy all Internet access and monitor it in Round 6.
This question should've been titled:
"How do I perform a security audit?"
It's clear from the phrasing that you have no idea what system security actually is, so instead of asking how do you market it, and how do you talk to people about it, it'd probably be a good idea to understand it yourself.
Here are some hints:
* Real security professionals don't "test anyone's firewall."
* Real security professionals don't "discover" holes. They prove them.
It sounds like what you really want to know is "how do I go about charging people for my script collection?" which is a shameful thing indeed.
You are the reason business is booming for me, so while I despise everything you are, I will also offer you advise:
Learn how to build a secure system. Sell that. Sell the solution for customers that is a secure system. Don't offer to tell them what's wrong, but tell them what's right.
DO NOT scan/test a company's network without their permission! This is the fast track to a jail cell. Like QuantumG said (albeit a little sarcastically), get a sales manager and expect to pay out a lot of money in advertising.
If you think you're post was well composed, I would recommend some English/technical writing classes. If you recognize your post has some grammar problems and you know your writing skills are good, I would not worry about it.
Check out Bruce Schneier, Counterpane Internet Security, or SecurityFocus. Gibson Research Corporation is another site to check out. This is just a start to getting some background on the basics and depth of IT "security".
I would say from the post you are not coming from a security background. Assuming you have an IT Bachelors degree, the minimum I would recommend is for you to study for some basic security certifications (such as the CompTIA Security+ and the MCSE/MCSA: Security on Windows Server 2003 specialization) and take them if you have not already. On top of this, I would recommend doing research into security conferences and possibly even local university classes on IT security (although I recommend these with a grain of salt as there is a lot of variance between the quality and type of information offered currently). There are whole books written on this subject, so visit your local bookstores and research what they have available. My rule of thumb in evaluating books is to see how in depth they get with their subjects. If they just talk in general about their subjects with no specific examples, I typically look for something else (unless it is an introductory book, of course).
Finally, just remember security is different to everyone (even in the business/corporate world). One company might just need you to identify their weak spots, patch them, and setup a plan to make sure they stay patched. Another company might need you to analyze everything from weak spots/patches to physical security of IT assets. Your job as a consultant would be to identify what they need (Business 101).
Hope this helps.
I would definitely get someone to proofread anything you would send to a potential customer so you don't sound like a complete ass or, even worse, a scam artist. I'm serious about that. If you can't take the time to read over what you've just typed and think to yourself "does this make sense?" why would I want to hire you to perform security audits for my company? If you have that little attention to detail, what would you miss when working for me on my network?
This reminds me of a little story that happened to a customer who I was working for in the late nineties.
Said customer wanted to have their (large) network audited for security issues and hired an "established security firm" to do the job. As a first step it was decided that these experts had to try to break into the network from the outside, and they promised to report within a certain time frame.
When the time had come, the customer called them up and asked about the report. The experts said they were still working hard, but from what they had seen the network seemed completely impenetrable. The customer's network admins had not noticed any strange activity or alarming attempts, and asked about the methods used, and the experts gladly explained:
They had gathered a list of public host names via DNS and found an entry firewall.customersdomain.com. From then on they had tried to gain access to or through firewall.customersdomain.com in all possible means and using every tool at hand, but they had not succeeded.
This explanation caused a fair amount of laughter amongst the admins. The DNS entry firewall.customersdomain.com had been created a while ago to perform some tests, but the machine correspoding to the IP address had been disconnected from the net months ago.