“Inspectors – they always find something!” – this was the reply from my neighbour when I complained about a particularly hair-splitting building inspector. My previous inspector was on holidays, and the new one was overly pedantic.
Which made me think – why this is the case?
The new inspector was young, smart, and, perhaps, just proving himself. Small comfort, as I left with a long list of rectification works, a bill for re-inspection, and a lot of frustration.
There are parallels between Security Architects and building inspectors. Like building inspectors, Security Architects perform compliance checks against standards and best practices. Like building inspectors, they prescribe the list of rectification works. Like building inspectors, they have the power to delay works and cause pain.
Being on the receiving end of such treatment made me wonder if I ever caused the same pain to my “customers”. I believe I have established a good reputation in the industry, so I don’t need to prove myself. There is a brief period when I join a new company, where I need to demonstrate skills and build trust. In that period, I would look hard and do my best to find gaps and vulnerabilities. Though I would try to be reasonable and not blow findings out of proportion. If the “defect” is minor – it is minor.
If you are a security professional, performing security assessments, I encourage you to be reasonable.
On the other side – if you are about to go through scrutiny, and you feel that the inspector might be overly meticulous for personal insecurity reasons – there are several things you can do:
First method – you can help them. If the inspector doesn’t find anything, he/she may feel that they haven’t done their job properly. One small trick I used when I was a student – I would leave small gaps in my exam presentations. The teacher (inspector), would find the gaps, ask additional questions, I would answer the questions, the teacher would feel good, and I would get my good scores. That, of course, will work only if you know your subject well, and you don’t have any other gaps in your brilliant work 🙂 As a responsible adult, I do not use this method anymore.
The second method is to question the inspector’s judgement. If the inspector is truly insecure, it will be a difficult conversation. I will post some further tips on how to best handle difficult conversations. Such conversation can easily go wrong, so please use it with caution – it requires good skills and self-control.
The third method is what I used to deal with my building inspector – I asked for another one.