Mark down: July 31-August 2!

I started doing these workshops online to allow smaller companies, not able to host a live workshop, to attend.  This also eliminates any travel requirements, and by scheduling over three days, you only need two hours each day to attend, leaving the rest of the day free to work on your business opportunities.

If you’re in sales or marketing you should try to attend one of these.  This is not a basic sales class – I assume you know how to sell.  This is more about knowing where the security opportunities are – both in large and small accounts, reaching decision makers (even in new accounts where you don’t have a relationship), and building justification.  I routinely have people call me to tell me they’ve multiplied a simple product opportunity in to something major or closed a deal in one day following an assessment.  Last year one of my attendees called to let me know he landed his first million dollar deal using these principles – and another reseller went from unmeasurable results with lunch & learns to a 71% conversion rate – attendees to an assessment.

You can learn more here: http://securitysalesworkshop2.eventbrite.com/ – as well as sign up.  If you’ve been through my coaching program be sure the select the Mentor Program Alumni rate!  Seating is limited and I have selling out of the past three quarters, so don’t wait.

© 2013, David Stelzl

The House & the Cloud

Protection, Detection, Response – In my book, The House & the Cloud (Written in 2007), I proposed the idea that IT’s security model of Protection, Detection, Response, while technically correct, is flawed.  Most organizations were putting too much stock in the “P” and not nearly enough in the DR – Detection/Response.  I went on to say that “D” is actually the most important one – the response needs to be there, but the D must be nearly perfect or the entire model falls apart (For more detail on this, read the book).

Well here it is, 2013, and the Wall Street Journal writers agree – Prevention is Over: Assume Your Intellectual Capital is Under Attack (May 27, 2013).  This is a sound bite…if you’ve taken my Making Money w/ Security Sales Workshop (note the next one coming up in July) – you’ve heard me talk a lot about great sound bites and how to use them – this is one.  When the IT guy says, “We’ve got it covered” – no they don’t!  But there’s no reason to argue the point.  Simply quote The Journal – but do it in the direction of your asset owners (those with business level liability), not IT.

James Holley and Jeff Spivey, the writers of this WSJ article state, “Enterprises (and companies of all sizes) are being attacked because of who they are, what they do and the value of their intellectual property. But they are responding with security controls that are years out of date.”  When they say, “Years out of date” I think of the older security models that assumed we could keep hackers out.  Physical security did away with that notion back in the days of castles.  It didn’t work then, and it doesn’t work now.

APT (Advanced Persistent Threats)

“The APT are groups of people – they are a “who”, not a “what””.  This is important.  Advanced Persistent Threat – has been a buzzword in the security industry for a while now.  It refers to some very serious attacks – think of Stuxnet and other attacks we’ve seen on energy companies and perhaps cyberwar efforts or Anonymous attacks reported over the past two years.  Holly and Spivey point out that you can’t just look for Malware, although malware (BOTS) are the major tool most often used to grab data.  But APT is bigger than Malware. “They have very sophisticated attack tools and will conduct operations specifically to hide in your environment. These groups want one thing:  your intellectual property. And they are not giving up and moving on to the next easy target. They’ll simply find another entry point—likely through one of your unsuspecting employees,” say Holly and Spivey.

Author Bruce Schneier points out, security is not a math problem, it’s a people problem.  People are the entry point for these attacks.  In fact, Kevin Mitnick, author of The Art of Deception goes into some great detail on how people are deceived and talked into offering up credentials for just about anything.  About a year ago the Wall Street Journal reported on a white hacker, disguised as a 25 year-old woman using Facebook, who managed to talk 13% of the men in one financial organization out of their passwords.  This is kind of attack will defeat almost any security architecture.

What’s the solution?  Detection, Response, and lots of training – making sure your people really understand data handling in the same way tellers are trained to handle cash.  You can’t really remove the “P”, but as I state in the House & the Cloud, the “P” should simply be viewed as the trip wire that sets off the alert – “D”, which then signals the proper timed response.  If you don’t have a copy of The House & the Cloud, get it free in PDF format on the right hand sidebar of this blog.

© 2013, David Stelzl

This quote (above), written by Nate Freeman of Network People in Largo, FL, appears on the comments page of my blog – events work, but only when done with conversion in mind.

This morning I had the privilege of meeting with various resellers from the US to talk about demand generation and exactly what it is that differentiates success from an expensive lunch meeting.  I covered the seven steps presented in my most recent book, Event Marketing, 7 Steps to Profitability Using Lunch & Learns.  One of those steps, and the one asked about this morning, involves using the right speakers – without the right speaker, you’ll just end up with an expensive lunch.

On a recent call with a reseller on the west coast, we were discussing the agenda with a proposed vendor partner/sponsor – a partner willing to support the event with JMF.  On the call he said, “If we are going to fund this, we want a speaking slot.”  The reseller on the call deferred to me, asking me what I thought I of this.  What happened next is the important part…

I simply said, “It doesn’t really matter to me who speaks – in fact, I don’t even have to speak at this event.  The only thing that matters is conversion.  Will more people move from the Attendee box to the Doing-something-about-it box if you speak or I speak?  At the end of the day, the only thing that matters in this event is conversion between these two boxes.”  It would be rare for someone to actually buy a product or service right there at the event, however , converting them to some sort of assessment or strategy session is not that hard given the right message and the right people group.  In fact, the length of the meeting, the location, the food…every decision we make should be based on maximizing conversion. Nothing else matters.

When the vendor heard these words it finally made sense – he had never thought of it quite like this.  From there we stopped worrying about who was doing what from an ego standpoint and started talking strategy – what will bring in the right audience and what will yield the highest conversion rate?

You can find more great tips in my ebook – or wait for the recording link on this webinar to be announced.

© 2013, David Stelzl

Sound Bites and Helpful Articles

One person asked about some of the sound bites I mentioned as we went through the session on how to effectively use sound bites.

1. I mentioned a WSJ article that describes how the CISO/CIO needs to be involved in the overall security architecture – Here’s the link.
2.       In a recent interview with Richard Clarke, reported on by Ron Rosenbaum, the statement was made that Every Major US Company Has Already Been Hacked Into – where is the article?  Here’s the link…
3.       The WSJ article that references how 70% of small businesses think they are secure -I comment on this in one of my blog posts – here it is.

Typical Responses to the Question, “What are you trying to protect?”

One of the three questions I ask in my book, The House & the Cloud, is “What are you trying to protect?”  When given the opportunity to sell a security product, this should be your first question.  It’s an Asset Owner question.  IT can’t answer this question – so don’t look for answers like – servers, storage, network, etc.  Rather, you are looking for internal systems and applications business people rely on.  Your best answers are going to be the internal names of systems they use.  In one business I worked with, the company kept referring to their FIS system – FIS for Financial Information Systems.  I worked on another project involving the ARMS systems – Account Relationship Management.  These are the internal systems asset owners use every day to do their job.

Another possible answer might refer to intellectual capital, R&D data, trade secrets involving a new development or secret formula such as is used in Coke products or Michelin tires.  The bottom line is, if you’re asking a technical person, you’re not likely to get what you need.  Learn to speak the internal language and you’re likely to get a lot further down the road on the sales process.

Today we will be covering effective security assessment strategies.  I will be going through several real assessment projects, looking at deliverables, and showing why a thorough security assessment that did uncover “Bad stuff” doesn’t necessarily lead to remediation work.  I also want to show some simple ways to rewrite the assessment deliverable to drive that remediation process forward.

© 2013, David Stelzl

Sales Training Is Crucial to Success!

Sales training is crucial if you want to grow sales, and specialized training, not product training, is the key to moving from Vendor to Adviser.  Yesterday’s class is an example of security-focused sales training.  Google Information Security Sales Training, and you’ll see that this type of training is rare.  Google something like Solution Selling and you’ll find that, even though Bosworth wrote the book in 1995, everyone from vacuum sales people to high-involvement technology sellers are taking the same classes from millions of so-called solution selling trainers.

Not that basic sales training isn’t important – it is.  But taking the next level and specializing is what creates differentiation.  Yesterday we covered a number of areas including where the trends are, where the business is, and what is expected to happen around the world with security in 2013.  Security continues to be a hot topic among business leaders worldwide.

We also covered sound bites.  Part of our home work was to discover more recent hard hitting sound bites and evaluate their usefulness as a sales tool. Most security presentations I’ve seen in a sales call contain sound bites – but most of the sales and marketing people I know are using them incorrectly.  They are actually defeating themselves before the competition ever arrives.

Today we’ll cover how to use them.  Using them incorrectly leads to a judgmental, left-brain mindset – one that won’t make a buying decision even when there’s an urgent issue at hand.  Here are come examples of sound bite evaluation…

1.  “China is stealing trade secrets as part of plans to bolster its industry.” Wall Street Journal on April 22,2013.  This is a good sound bite – it’s global in nature, speaks of an ongoing trend, and affects any company that store mission critical information such as intellectual capital and trade secrets.  It also comes from a source that speaks to executives – the Wall Street Journal.  No one is going to question its validity.

2. LivingSocial.com, a site that offers daily coupons on restaurants, spas, and other services, has suffered a security breach that has exposed names, e-mail addresses and password data for up to 50 million of its users.  4/27/13 – Ars Technica Magazine – This one isn’t bad…it’s an identity theft sound bite which in my opinion may be too common – it doesn’t wake up as much as the first one.  The other problem is the reference.  No one reads Ars Technica – at least not the C-Suite as far as I know.

3. “What most organizations do is overreact: they throw all of their efforts into that one incident and are not looking at what they should be looking at,” says David Amsler, president and CIO of Foreground Security. “And worse, they don’t have a playbook [for response]. It’s so haphazard, and that’s where they fall down.”  – This one is good…it speaks to the security strategy and can leveraged to up-sell the bigger picture.  It’s what Cisco would call the architectural sale – an opportunity to look beyond the immediate disaster, and over the entire enterprise to sure up things.  One downside on this one – it’s too long.  If you can’t quickly quote it, you’ll lose your audience.

4. “More than 90 percent of user-generated passwords, even those considered strong by IT departments, are currently susceptible to hacking, according to Deloitte’s analysis.” – I love this one.  It’s quick, quotable, concrete (meaning visual), and from a trusted source…and it affects every organization, federal, commercial, big and small.

If you’ve never attended one of these classes, make sure to stay tuned for our next class which will like fall in August or September 2013.

© 2013, David Stelzl

WATCH THE INGRAM MICRO REPLAY!

Make the Move!

Earlier this week Ingram Micro – distributor for all kinds of technology, sponsored a webinar on Moving From Vendor to Adviser – for it’s technology resellers.  In my book, I talk about at least 12 things resellers need to start doing if they want to remain relevant in the coming years. In this 50 Minute webinar I provide five key things to start doing and relate them to information security.

( CLICK TO LISTEN )

Summary:

• Becoming a risk adviser to the companies you serve
• Conducting effective demand generation programs (See my recent ebook on Event Marketing)
• Implementing the secrets of high-priced consultants
• Using value-based pricing strategies – no more block time or time and materials.
• Redefining the way you approach the proposal process – writing great proposals that actually close business.

Also, make sure you have a copy of my book, The House & the Cloud – available on this blog sidebar for free – in PDF format.

© 2013, David Stelzl

Just Outside of Boston

My wife and I on stage

David Stelzl Jr. In Action

Bennington Pizza – NH

I was surprised to find some pretty good pizza in downtown Bennington.  The crust is a little thicker than I like – more like the Ohio Pizza than NY – but over all pretty good.  I’d recommend it if you are in the area.

My boys trying out the NH pizza

Rotolo’s in Ohio

Why do the pizza places in Ohio insist on cutting round pizza into squares?

Ohio Sicilian Pizza

Sicilian Pizza in Ohio – this was probably the best pizza we had on this trip….

© 2013, David Stelzl