Navigating Cyber Crisis: Essential Communication Tactics for IT Leaders

That's good.

And welcome to a new episode of Digital Coffee Marketing Brew.

I'm your host, Brett Dyster, and as always, please subscribe to the podcast through YouTube and through Rumble and also through your favorite podcasting apps as well.

It really does help with the show, but this week we're going to be talking about IT management and communicating between both of those, which PR pros need to know and other professionals need to know, because we always need to know how to communicate better with people.

With me, I have Nathaniel with me, and he is an expert in this.

He's an expert in ways of communicating from IT to management.

And this is specifically where we talk about, like I said before.

So welcome to the show, Nathaniel.

Thanks.

Enjoy being here and looking forward to the conversation.

Brett.

Yes.

And the first question ask all my guests is, are you a coffee or tea drinker?

Oh, I'm going to go with tea.

I'm in that 50%.

Who's going to be on the tea side?

Do you have any, like, specifics?

Do you have, like, green tea, black tea, like any specific teas that you enjoy?

Primarily black tea.

And I prefer it iced, actually.

So classic iced tea works beautifully.

It's okay if you put a little fruit in it here and there.

You know, peach or mango is delicious, but classic black tea is just like.

Regular tears are like sweet tea.

Because I know down like south, they love their, like, sweet, sweet tea.

Well, the syrup with a little tea is a little much for me.

I don't mind a little sweetener in it, but we're not going to go probably heavy South Georgia sweet tea.

That's a little much for the taste.

That's fair.

And I gave a brief introduction to you.

Can you summary summarize your expertise with our listeners?

Absolutely.

So my expertise is in working between technology and business and leadership.

I've spent about 20 years in the technical trenches and working with executives leading IT organizations.

And I specialize in helping all parts of the business work better with IT and IT work better with the business.

All right, and so what are some of the problems with communicating between IT and management?

I mean, we all kind of have this idea that IT are like the nerds.

They don't know how to do much.

And then the management is kind of like the, I guess the cool people in a way, but, you know, like the common stereotype is like, they just don't know how to communicate.

But how.

What are the real common problems with that?

Yeah, I think one of the biggest problems that I see over and over again is the disconnect between looking at them as two different silos.

And it's okay to have boundaries between IT and business, so that's appropriate.

But if they're full silos and they're operating independently, then, then what you get is it feels like your local drive through where some business owner drives up and says I need this and I expect it at the next window.

And that can work, but it's not nearly as beneficial to the business owner as being able to say, okay, here's the problem that I am currently experiencing in my business, here's what I'm trying to accomplish and what's my best way of getting there.

And so that's really about the communication between creating a shared understanding where the business and tech are able to sit down together.

And let's look at the problem and come to a collaborative solution.

If either side, and I've seen it from both, it says business doesn't know what they need, I'm going to do it my way.

Or if business says I just want exactly this checkbox, well, that may not be the most efficient option.

So we work collaboratively, we're going to get a lot more results for the business.

Gotcha.

And is it because like there's a lot of like foreign or people think it's like foreign for it.

Like it's this like mysterious thing that just happens in the background.

And that's why management doesn't really understand it very well, is because the IT may use a lot of jargon.

Is that kind of the miss the like the miscommunication that comes about it?

Yeah, that can happen a whole lot when, when you get an IT individual in the room and they start using their language and talking about their specifics of acronyms.

And every industry has their acronyms.

Technology and finance seem to have monopoly on acro acronyms.

But when you start getting the lingo thrown around, then the business feels disconnected.

They may feel talked down to and it really begins to become a challenge.

And the business just says, I'm done dealing with them because it's too technical.

I don't understand it.

I don't want to look ignorant.

And so by changing the conversation and putting the business owner or the manager in a position of strength to say tell me about the business problem.

And even if a business owner saying hey, I've got to talk to it, they don't really, you know, these aren't productive conversations.

I really challenge a business owner to walk in and say I'm not going to ask for a specific solution.

I'm going to tell you my business problem and I'm going to ask you how you would best help me.

Because if you can start the conversation in the business context, everyone begins to get into a better frame of mind towards the end goal, which is it's not about an upgrade, it's not about new laptops.

It's not like it is about what's my business problem.

Because I can hand you a new software, a new solution, I can implement it, and I did my job.

But if I build a bridge to nowhere, then it doesn't help anybody.

Right?

So if I'm a bridge builder, I've got to make sure I know where you want to go from and where you want to go to.

Same thing with tech.

Gotcha.

And then, I mean, should, let's say the IT person is working within a company, should they ask for PR pros to help them with that?

Because a lot of times PR pros understand, like the communication aspect of it.

It's like, hey, look it, I don't feel like my message is getting crossed.

Can you help me?

Would that help with them?

Quite a bit.

Because I feel like if you collaborate with other teams, they'll understand and then that will help with the management understanding.

Is that a good way of going about it?

Yeah, absolutely.

Anywhere that you can get the context of the business.

And you know, one of the things that is also an opportunity is in the event that your business has a retail storefront or has a place where you engage with customers or you have some kind of.

Even if it's a digital storefront and it's a website, spending time to deliberately build that relationship and say, hey, let me show you what we're trying to do here.

Let me show you what we're trying to accomplish is very helpful.

And you know, I've seen marketing leaders who succeed by even sitting down and saying, hey, look, I'm spending a million dollars on this advertising campaign and here's what I'm after, right?

So this is why this matters to our business, and this is what I'm trying to accomplish.

That adds a lot of context because it shows trust.

And when you exhibit that vulnerability of saying, here's what I'm trying to do, here's what my goals are, and I'm asking for your help, then you begin to establish those relationships where it may actually say, hey, we can do X, Y and Z to make it better for you, but we didn't even know what you were trying to do.

Gotcha.

And then what are some ways to be effective at this?

Would it be like doing like a newsletter for management saying, like, this is what we've done.

Would it be like doing like a simple email with just bullet points?

Because everybody's busy and everybody doesn't want to read, like, paragraphs upon paragraphs.

So it should be like, we've changed this.

This is how to do something.

Maybe relying on somebody to do a video for a new feature, would doing, like, extra content help with that side of it?

Because I feel like you can come out with great features, but if nobody knows how to use it or even know about it, then there's not really a point.

Well, there's a couple different tactics that I like to see used.

One is absolutely, communication and an email can be helpful, but to your point, it can get lost.

I really encourage if an IT team can work with a PR team or marketing team to say, hey, we'd love to do a technical newsletter, or if there's a company newsletter, we'd love to have a couple of pages in it to show what we're doing.

And maybe it's some tips, maybe it's some tricks about things and how to better use and really build that rapport in that liaison.

It's not about saying, hey, we have this many servers, or our uptime is X.

It's about being clear from a business perspective about business impact.

So that's one newsletter.

I've also worked with teams and encouraged, and we've done a quarterly or annual video where the technical leadership team, the head of support, works with marketing and says, hey, I want to talk about the most common issues we see coming into our support organization, and I want to talk about how to fix them.

And maybe there's, you know, here's the resources where you can go fix it yourself without having to waste time, you know, getting on the phone with it.

And let me, let me help you learn where your tools are.

So that's been very beneficial at times.

I've also seen, and I think this can be extremely powerful as well, is when you start getting into an organization where you want to communicate and share some of this information out it, getting out in front of developing relationships with the field and getting to the point where you get sort of evangelist that you can work with and power users and you bring them in.

So, for example, you might say, hey, I'm a part of a retail organization.

We have 500 storefronts.

Maybe you need to find somebody in each region and bring them to headquarters, show them the beta, show them where you're going People who will be excited, who are early adopters, who are always kind of pushing the envelope, maybe they're the people you're constantly dealing with.

They're breaking the system because they're always trying to get an edge.

Embrace that right.

Get those early adopters in there and say, hey, this is what we're doing.

And then let them go back into their roles and be an evangelist for what's happening.

And I think that's really, really powerful.

More so even than just broadcast communication.

Mm.

And then, I mean, when talking about management, should.

Is the basic thing just understanding who you're talking to?

Because I feel like if you do the right message to the right person, so it's basically solving a problem with your communication.

You're like, okay, what do they need to know the most?

So you could write that email and will actually be a targeted email to them.

So how can they go about actually doing that?

Should they, like, talk to their bosses?

Should they figure that out?

How do they go about figuring that out?

Because it takes time to understand people.

It does take time to understand people.

But I will say there's two shortcuts that I've seen that are very, very helpful.

One is write the content that needs to be communicated from your lens first.

Right.

Because that's where you're going to get all of the facts on the table.

But then sit down and.

And look at it from the end consumers context.

So if you're sending a note to finance as a management, or if you're sending a note to the sales management or vice versa, if they're sending it to it, look at it from their context and put what you're trying to communicate in their context and at their depth.

If you're sending it to an accountant who is in the weeds of the, you know, details, and you're saying, here's what's happening with the new finance system, or here's what we're doing with the rp, you need to be very detailed, because that individual is in a very detailed role.

But if I'm sending it to the director of accounting or if I'm sending it to a cfo, the depth needs to be reduced because that individual is not in the weeds.

And so context and depth are your two shortcuts where you can put your communication through that filter and then you can really resonate because that person is able to digest it in their context and at the appropriate depth.

And showing it to somebody else might actually help too, within the company.

If you're working for a company, because Sometimes they'll see something else.

Because when you're in the weeds and you write it, you're going to be in the weeds.

You're going to do way too technical.

So you may need that extra person to get outside of it and be like, okay, this is what I really need to know.

Because I don't know all this technical stuff and this is getting too muddled for me.

Yeah.

And it's very helpful when you can do that.

Someone else looking at it is across different areas.

Right.

So you're reaching into a different area to say, hey, I want your opinion before I send it to the next tier up or before I send it down into the lower tier.

It may be.

So by getting that shared context and sharing it out.

I used to send the emails a lot of times in communications.

I just preface it.

I'd say, here's the subject line I'm intending to do.

I'd put the word draft in front of that subject line, have the full email, have the full document, send it to somebody and say, hey, I need some feedback that creates buy in.

And it'll help you avoid mistakes as well as the fact of they're going to be an evangelist for it.

Because what's going to happen, you're going to send it to your targeted recipient and they're going to go talk to their team or they're going to talk to their boss.

If you've already gotten their feedback, they're familiar with the communication.

Gotcha.

And then moving to cyber attacks.

Because unfortunately it's not if it will happen, it's now when it will happen.

So how can it pros communicate the beginnings of it?

I know cyber attacks are long processing.

You got to figure out how they got into it.

So how can they do the preliminary, like, message to their bosses about what's going on?

Because it feels like a lot of times when it does happen, the management kind of knows what's going on, but then doesn't really know.

And then it really just confuses users.

Especially if you're a B2B or B2C type company.

It's like, wait, so it's worse than what I thought it was?

Yeah.

The.

When it comes to cyber, one of the most important things is doing a table talk exercise.

And a lot of times technical teams will do this from a technical, technical perspective.

But I work with a lot of teams and say, all right, who's your communication individual?

Who's the individual who is doing nothing but managing the communication out?

Because the team itself is going to be so involved in a response and how do we stop it, how do we fix it, those type of things.

And there's a leader over that project.

Well, you want someone designated as a role, it doesn't have to be an in named individual, but you need to say in the role this individual is the communicator.

And so we're going to work with them and here's the expectations.

They're going to communicate with leadership, they're going to communicate with customers, key customer accounts, whatever it may be.

And pre building that workflow and going through some of those exercises is really important because what I've seen teams do, and I think it's really important is pre built distribution lists so that you know, everybody is appropriately on it.

Pre build some existing templates, you know, that says okay, we know we have to notify these people contractually, we know that we've got to do these things.

So have some of that work pre done to where you're not trying to invent it on the fly because it's really hard under stress, right?

When you know there's a continuum that I use and it talks about the fact that the more chaotic an environment, the more structured your response needs to be.

Military conflict is the easiest example.

Right.

Military is trained to be extremely structured in their operations and what they do because they're operating in a chaotic environment.

So a cyber attack is a chaotic environment and you need to be very structured and have as much as you can pre planned so that that communication goes out.

And you know, one of the easiest things there is to develop a shared vocabulary.

And there's very simple frameworks for some of this out there.

But you know, what does it mean to say we're under attack?

Does that mean our data has been stolen?

Does that mean that somebody's in our system but we have them contained?

Does that mean that we have a ransomware and data is encrypted?

And now we're talking about a rant like we need to have clear lines because we can't have five different people say attack and mean five different things.

So it needs to be a really simple and sometimes the easiest way to do this is with a, a scale.

You know, the military uses a DEFCON system, for example.

Develop a scale that says hey, we're at a level 1, 2, 3, 4 response.

And this is what it means.

And here's who needs to be involved at this level.

And I think those are your.

By pre planning those, you'll get a lot better from a communication perspective as it goes Internally to employees.

Gotcha.

So I mean as a PR pro we have something called a crisis plan.

So we basically write everything that may happen to a business and it's usually the top pre crises that may happen.

So in that case it's almost like you should pull aside the PR pro, even if it's already written, just have a pre described thing.

But you pull aside the PR pro, be like, hey, look at this is what's going on and kind of clue them in so they can write whoever their point person is to actually talk to the media.

Is that kind of like what I'm hearing?

Exactly.

I talk to media, talk to key individuals.

In this case, you may have government contacts you need to make, there may be, you know, contractual contracts you need to make.

So absolutely, you said sliding scale.

So for PR pros it's like an issue.

To a crisis level one would be like an issue.

It may be annoyance, but it will eventually go away.

And the crisis is like this will stay in the news for like several months or to a year or whatever.

So in that way I think for IT pros they probably should just pull them in and like come together.

Figure out a crisis plan for cybertech that helps with the IT people but also helps with the management because those are the two you're going to have to worry about the most.

And then has a little bit of a message for regular employees, say like please don't say too much about what's going on.

This is your can response.

And then basically show them to the point person for that.

Absolutely.

You want to make sure that you have the message understood.

You want to have it pre built as much as you can.

To your point.

You know, if something leaks out from a PR perspective, you want to know what level are we talking about?

And even how you communicate that out.

Right.

I mean you're going to see, did we lose some passwords?

Did we lose 100 customer records?

Did we lose 10 million customer records?

Like do we lose employee records?

You want to be able to put context on it pretty fast because cyber is a trigger word and it's a headline word if you want to think of it that way.

And so you want to put context around it pretty fast to understand the scope.

Then realistically, how long does it figure out how much damage the attack actually took place?

Does it take months, does it take years to figure that out?

Because I know all of them are sophisticated and they can and it's all different things, but realistically, how long should this crisis communication go on from an IT Perspective.

So from point of awareness, because a lot of times attacks are happening and companies aren't aware.

Right.

So from point of awareness, you're going to talk about the fact that it depends on how big the scope of it is.

But it could go on from a matter of, let's say, a week or two to the fact that this could, as far as communication going out to it could linger on for months.

It really, you know, there's the initial sort of wave of something happens.

And usually that's met with a round of we're involving forensic teams, you know, and you're trying to exude confidence because most companies are going to say, we're bringing in forensics.

Here's what's going to happen for customers who had data compromised and here's their opportunity for credit monitoring and all those type of things.

So you have that initial wave and then the forensics are going to come around and say, here's the results of what we found.

And that really could come in a few weeks later, it could come in months later.

And if it's not as bad as we thought it was up front, then it's less of a story.

But if it turns around and says it was 5,000 records and now it's 5 million, well, then the second wave is worse than the first.

Right.

So there is some amount of, once you get that notification cycle going and from a PR perspective, then you're also going to want to know what's my regular update?

How am I getting communication back and forth on this incident?

Because if it's not closed, then you're going to have some amount of where's the forensic team at?

When are we going to get an update, that type of thing that's going to continue to be out there.

Gotcha.

And is there something just not to do during a cyberattack when it happens?

Because we talked a little bit about it, about keywords, but is there any other thing that's like, do not do this.

This will hurt you so bad.

Let's not be an experian that had a cyber attack and kind of like, or even LastPass is I think the most recent one.

Like, learn from their mistakes, what should not happen.

There's two fatal flaws that I see that happen oftentimes.

One is trying to suppress it.

Right.

Because it will get out and it will look worse.

If you're trying to say nothing happened and it really did.

And then the other thing is guessing.

Right.

So these are two dynamic of environments for us to say, oh, we know it's contained.

Right.

I wouldn't be absolute on those type of things until you can truly have forensics look through it and get some answers.

But especially in that initial kind of conversation going, oh, it's not a big deal.

It's not an issue.

You're guessing or you're suppressing.

Those two will ultimately burn you.

And that you're.

You've mentioned a couple of headlines.

There are others I can name as well, that that's exactly what happened.

It tried to be suppressed, or people tried to guess and say, you know, it's, it's only this.

And then that's where it backfires.

Yeah, specifically because if, like, for example, for me, I was a LastPass user and I've had a terrible time the last few months just trying to secure my own passwords, and that gave me a headache because someone ordered something through Amazon, someone blocked or banned me from an account, and I was just like, what is going on?

So specifically for B2C, because the last pass was mostly B2C.

Their problem was what wasn't that bad.

So I, I feel like the messaging for the beginning should be.

Our preliminary results show this, but we don't know how much is yet.

Yeah, absolutely.

I think it's definitely about saying, here's what we do know, but that doesn't mean that's everything.

So preliminary results, here's our findings so far.

Phrasing like that, communicating like that, and then some amount of confidence around we have the right people.

So whether it's, you've engaged the external firms that are authorities, whether it is a situation where it's large enough, you bring in government investigators, that type of thing.

I do believe it's important that you share some of that information upfront so that there is a confidence that we've, we've got the right individuals on it.

I mean, if you have, for example, a public transit issue or if there's a plane crash, everybody says, okay, the government investigators are coming in, great, now we understand.

Same thing in these.

Right.

Sharing who's who you're bringing in and what's happening.

Add some amount of confidence because it, it's an immediate fear.

Right.

I will also say one of the important things to work from a technical perspective and PR perspective is understanding what has been lost.

So are we talking about, hey, you know, there's a possibility you need to change passwords because maybe somebody got access or could gain access.

Once you change password, you know, you solve it.

That's different than saying, hey, I'm sorry, your name, birth date, Social Security number, et cetera is all out in the wind.

So really understanding what is also part of some of your escalation and some of your communication internally so that we're really clear on breach, what does it mean?

You know that that goes back to your scale as what data is impacted.

So I mean it feels like from me, from last pass, like it took me forever to get like, to secure my own things.

I had to move over to another programs.

I was like, I'm not dealing with this anymore.

So I feel like a lot of times they don't, they say things.

But it's not like our preliminary results should show.

Should it be like our preliminary results is this.

But we don't know the extent of the damage yet.

Yeah, absolutely.

One of the best practices I've seen is from a technical leadership perspective, establishing an annual calendar.

So for example, I would set up quarterly meetings with some of these key teams and say these meetings are on the calendar, they're already booked.

And then we would have all of our leadership knew they were there and we didn't.

I mean we would book these for October at the beginning of the year in January and we would just go ahead and put them on the calendar and then you didn't wind up with issues coming in.

We would have agendas, topics we wanted to make sure we covered.

Let's talk about the latest security, let's talk about this, let's revisit, you know, this practice.

Maybe we're having some type of a tabletop and we would build that plan ahead and that allows you now to walk through the year and you know you're not just going to look up and it's been nine months since you've had the conversation.

How do it pros maintain, regardless of issues or crises, just in general, how do they maintain that good communication level?

Let's say you already started it and it's been going really great.

But the maintaining part, I always feel like is the hardest part because you could have a great start and then all of a sudden crash and burn because you get lazy or whatever happens or work gets like crazy amount.

I mean it could be anything.

But how do you maintain that good communication with management and maybe your PR team at the same time?

Yeah, Slack is a great communication tool, especially if you have some dedicated channels for some of those type of things, for example.

But I also feel like there's a good bit of either over zoom or face to face.

There's a good bit of conversation that needs to happen.

So tactical updates through Slack Strategic conversations of here's what we're currently seeing, here's our current threat profile, here's what's new happening or hey, you know, this is the follow up from something that happened a year ago.

Those type of things ought to be a little more structured perhaps so that there's time for question and really digesting.

But you're right, it does.

It's not a weekly thing.

We're talking a monthly or a quarterly cadence typically.

Gotcha.

And should you use any like of the communication platforms and maybe like Slack or anything like that to do like maybe monthly check ins instead?

Because I don't feel like you need to like meet everybody every week because that would just be.

You get no work done.

Yeah, absolutely.

So there's a lot of great tools out there and particularly when you're talking internal communication, whether companies using SharePoint or Slack or something like that where they can communicate and have a hub for that type of information, there should be a set of questions on you know, common issues from a technical perspective, common cyber issues.

There also should really be and this is important as well, there should be a venue to report things.

So for example, there was a great article I just came across on some of the work that Target had done with some of their looking for skimmers in their stores.

And so ideas can come from anywhere and being able to say hey you see something, there's something off or maybe it's a phishing link continuing to create that communication flow inbound.

So not just FAQs but hey I saw something is also an important communication vehicle.

Mm.

And I mean what's going to let's say IT person is like new to this or they're going into a new company and they're trying to establish that communication line.

Like what are the, some of the steps to actually start to do that?

Because it's a process obviously.

But there are some steps to start to do that.

Yeah, absolutely.

The first step I always, especially if you're walking in new to an organization as an IT professional.

IT all starts with learning the business because everything is going to centrally focus around that business and that comes down to what's the business model.

So how do we make money, how do we spend money?

And then the other conversation is where are the most valuable components.

So maybe we're a healthcare company so we've got patient records or maybe we're a payment company so we got credit card records.

Whatever it may be, we want to make sure we understand where our sensitive things are.

Maybe we're manufacturing and our recipes or our intellectual property is super important, whatever that might be.

We need to make sure we understand that that's first.

So I don't recommend you go in as a new IT person and say, I want to make a bunch of changes.

I'm going to have all these meetings and tell them what to do.

Like, first you got to learn the business.

Once you have that context, then you can speak in that context and start going down the path.

What I like to do is to say, where we at?

So what's our current baseline?

Where are we?

Where are we sitting?

And what are the simple things that make the biggest impact?

So it's just, it's a cost benefit analysis.

It says, hey, these changes are going to take me a lot of work and they're going to make us some better.

These changes are going to take me a little work.

They make me a lot better.

So structure those and start tackling those first.

And as you can, after probably three months or six months and you've built some relationships and understood the business, start setting up some of those quarterly meetings and set them up as just workshops and say, hey, here's what I'm seeing.

Maybe I don't fully understand what's happening here.

Or help me work through and build that collaboration.

Because as you can build that collaboration and show some exercises, show some new knowledge and educate as you go along, you really become a coach.

It's less about being a prescriptive and it's more about being a coach to say, hey, I have tools that can help the business be better.

Because here's how our cybersecurity hygiene is.

Here's our technical debt is let's improve that.

Gotcha.

And then where can people find you online?

So the best place to find me is on LinkedIn.

I put out a lot of content on business and it, so that's the best website.

EQDigital.com has some information about what we do as well, but I would love for you to follow me on LinkedIn and engage there.

All right, Any final thoughts for listeners?

Biggest thing I would say is the communication ultimately comes to trust.

So build those relationships, establish that so that there's a clear opportunity to have hard conversations.

And then the second one we've talked about is understand the other context, because the same words mean different things to different people.

So sharing that context and you need help building those bridges between it and business, that's what we do.

Let us know.

All right, Nathaniel, thank you for joining Digital Coffee Marketing Brew and sharing your knowledge.

On IT PR and communication between all that stuff.

Absolutely.

Br.

Thanks for having the time.

I appreciate it.

You're welcome.

And thank you for listening as well.

Join me next month as we talk to another great father in the PR and marketing space.

All right guys, understand your IT people and help them communicate better for the better of the business.

All right guys, see you next month.

Later.