2KKUU7ita

Chapter 19
Ten Tips for Getting Upper
Management Buy-In
D ozens of key steps exist for obtaining the buy-in and sponsorship that
you need to support your ethical hacking efforts. In this chapter, I
describe the ones that I find are the most effective.
Cultivate an Ally and a Sponsor
Selling ethical hacking and information security to management isn’t something
you want to tackle alone. Get an ally — preferably your direct manager or
someone at that level or higher in the organization. Choose someone who
understands the value of ethical hacking as well as information security in
general. Although this person might not be able to speak for you directly,
she can be seen as an unbiased third-party sponsor and can give you more
credibility.
Don’t Be a FUDdy Duddy
Sherlock Holmes said, “It is a capital mistake to theorize before one has
data.” To make a good case for information security and the need for ethical
hacking, support your case with relevant data. However, don’t blow stuff out
of proportion for the sake of stirring up fear, uncertainty, and doubt (FUD).
Managers worth their salt can see right through that. Focus on educating
management with practical advice. Rational fears proportional to the threat
are fine. Just don’t take the Chicken Little route, claiming that the sky is
falling with everything all the time.