Know Your Audience: Using Personas for Better PSIRT Outcomes
Channel: FIRST
Date: 2021-02-12

Running a successful PSIRT often has much more to do with the human relationships involved -- internally & externally -- than the technical issues you're trying to address. Whether working with a security researcher, bug bounty hunter, IT admin, or end-user, knowing about your stakeholder is critical to a great outcome. This presentation dives into common personas -- archetypes, not stereotypes -- that a PSIRT will interact on a long-enough timeline. With an associated interaction framework, we explore how more-desirable outcomes can be achieved by placing our stakeholder's motivations & needs at the forefront of the actions we consider. Using real-world examples and sharing perspective from nearly two decades in the information security community, the basis of this presentation is rooted in practical awareness that any PSIRT can take into account the next time they receive an email from a person they don't quite understand how to work with. Incident response is hard enough without compounding issues stemming from poor interactions with third parties. Come hear how one PSIRT manages this interpersonal risk and what strategies your team can take to find a better way forward, too.
---
Mark Stanislav is a Technical Leader in the Advanced Security Initiatives Group for Cisco. Stanislav has spoken internationally at over 100 events, including Black Hat, RSA, DEF CON, SOURCE Boston, Codegate, SecTor and THOTCON. His security research and initiatives have been featured by news outlets such as the Wall Street Journal, the Associated Press, CNET, Good Morning America and Forbes. Stanislav is the Author of the book Two-Factor Authentication. Stanislav holds a BS in networking and IT administration and an MS in technology studies focused on information assurance, both from Eastern Michigan University. During his time at EMU, Stanislav built the curriculum for two courses focused on Linux administration and taught as an adjunct lecturer for two years. Stanislav is currently pursuing his PhD in cybersecurity from Dakota State University. He holds CISSP, Security+, Linux+, and CCSK certifications.