Did you know? On this day in 1983 when President Reagan announced the Strategic Defense Initiative, cybersecurity strategy took a major step forward—before cybersecurity even existed.
▶ Did you receive this newsletter? Click here to subscribe.
This edition marks the first of a few newsletters in a series on how CIOs and CISOs can communicate value to their organization. They’re all based on stories and examples from my years in role, and are ones that frankly I forgot about until reminded recently.
Byte Sized Reads
🔗 Very practical advice on avoiding accidental secret exposure and preventing replay attacks in encrypted communications. (You can skip the Python section if it’s not your thing.) The comparison table of security methods is especially useful—well worth a 1–2 minute read.
🔗 Gain incident insights from an expert with 30 years experience investigating security incidents. Learn from others! I listened to it on my walk this morning, but then found out the text is transcribed below too so if you want a quick read instead of a listen, check it out!
From “Sit Down” to $1M Technical Spend Approved in 15 Seconds
A cybersecurity leader asked for $1M—and got shut down in seconds.
A month later, same ask… approved in 15 seconds.
The difference wasn’t the technology. It was how the value was communicated.
For starters, go back into the 1990s, not too long after the first Gulf War. I recently graduated college and was commissioned as an officer in the US Air Force. I had a computer science degree but also several hundred hours of pilot-in-command time. I wanted to be a pilot, and I asked the Air Force, as I was about to graduate college, to assign me to a squadron where I could learn all about flying and then apply to be a pilot. (Because I had an Engineering degree, my job role was already preordained.) Thankfully, they sent me to a fighter pilot squadron which is where this story takes place.
To say I loved it and had a blast is an extreme understatement. The long story short (and another story) is that life had other plans for me but I didn't know it for another two years. So during that time I spent as much effort learning about air combat, airfield systems and much more.
So one day, the General in charge of the base (Chairman) invited all young officers to sit along the wall and observe his meeting with all base commanders (the Board), as long as we were “not seen, not heard 😊.”
I distinctly remember the equivalent of the CIO standing up and summarizing a request for a “million dollars” (I don’t recall the exact amount, but it was a big number) so we could… and then he went into a soliloquy of “… needing a firewall, blinking lights, ones, zeros, wires, packets, and blah blah blah.”
If he’d read the room, he’d have realized that not a single person knew what he was talking about. After a few minutes, the General interrupted him and said, in effect, “No—sit down.”
Brutal. I still feel for the guy!
So the next month rolls around, and we’re back in the same room. The same officer stood up and said, “General, I want to try again. I’m asking for a million dollars for a device called a firewall, which is needed to ensure that threat actors don’t tap into a critical supply chain that keeps your jets flying day after day.”
That short. That impactful.
The General and his staff raised their eyebrows, and within 15 seconds, the officer had his approval for a million dollars.
See the difference? The same ask and the same desired outcome. But the conversation centered on impact that was framed in business terms that leadership could understand.
This is a challenge each and every time, and it’s tough. But it’s doable.
I don’t get it right all the time, but I strive to improve each and every time. By thinking through this and more examples from my prior time, my hope is that I’ll help you with this framing.
Help us keep sharing real stories
▶ Know someone who’d love this? Forward it their way.
▶ Did you receive this newsletter? Click here to subscribe.
Views expressed are informational only and not official advice. No warranties are made; readers assume all risk and should consult authoritative sources before acting.