Observations From DEFCON

I was put in an especially difficult business situation recently. My
company, represented by myself, and another company (a massive superpower)
were working the same project for the same client. The massive company had
designed a network for this mutual client, and I was brought in to evaluate
the security of said design.

I found it unsatisfactory. They disagreed. I had the entire industry on my
side. They had their own ideas and made a concerted effort to convince the
client that there was nothing unorthodox about what they built for them.

I presented my findings yesterday to the client. In the Powerpoint I
included 5 slides of content that pretty much proved that my proposed design
was superior. Included were three main points:

1. NIST standards

2. The giant company’s own website supporting MY design

3. The fact that my company deploys networks for the giant company
   in precisely the configuration that I recommended

But I didn’t use those slides.

What I did instead was send an advance copy of my entire presentation to
“opposing team”. The proof content was hidden behind my final slide where I
could get to it quickly if necessary, but where it was not part of the main
presentation.

I made this fact very clear to my associate from the other company right
before the meeting. I was not going to discuss this supporting content in
the presentation unless I had to. I offered a simple solution: they admit
that my design is superior and industry standard (true), while I lend
support to their claim that if enough controls are used their design will
likely be adequate (true).

The meeting went smoothly, and I’m quite confident that it would have become
a blood bath had I not taken this action. I was even warned by multiple
parties that this is precisely where it was headed.

The concept is this: always leave an opportunity for your opposition to
“save face”. It avoids additional conflict caused by them having no other
option but to attack. My friend
Jason
reminded me that Sun Tzu talked about the same thing:

Yeah, it works.