Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

5/24/2012
09:28 AM
50%
50%

Don't Be The Nerdiest Person In The Room

Technical language has its place, but overuse hampers compliance

In the interest of full disclosure, I am fluent in "nerd." I have an engineering degree and years of experience working on technical projects. I know the purpose of a processor reset pin, why "i" is the most common loop counter for software developers, and the purpose of a debounce function in a keyboard driver. Only recently did I give away my EPROM programmer.

In any specialized field, a corresponding technical language is almost always very important. It allows for greater precision, accuracy, and efficiency. We don't want our surgeon to ask for "that long, sharp, curved knife" when we're on the operating table. Surgery requires a number of highly specialized instruments, and accurate, efficient communication between a surgeon and his team is a matter of life and death.

Likewise, designing and managing secure and compliant data systems requires language and terminology a home PC user would never need. For your business, however, precise technical language is not only helpful, it can be a matter of life and death.

Technical documentation designed for other technical professionals must include such precise, technical language to ensure that the systems are secure and verifiable. Such technical documents are a required part of every compliance process.

It is important to recognize that even though highly technical documentation is critical for proper system operation and for passing compliance audits, this level of documentation alone is insufficient. The processes and procedures of people must also be documented and done so in a way that makes sense to the people performing these tasks.

Using jargon and complex technical terms may create important-looking documentation. Unfortunately, this type of documentation can not only be inappropriate for your nontechnical employees and end users, but also absolutely useless. If the documentation governing "people processes" is unusable by your people, then probably the correct people processes necessary for compliance are not happening.

For instance, which of these statements will a nontechnical employee mostly likely remember and follow daily:

1. "Duplication, replication, or any other reproduction of system data files to any media, device, or network by unauthorized employees or other individuals is strictly prohibited in all instances."

Or

2. "Staff should never copy system data."

Compliant systems include people operating in compliant ways. Highly technical language not only hinders nontechnical staff, but also increases the likelihood it will be ignored. Furthermore, nontechnical senior management who cannot understand certain documents cannot honestly vouch for them or help integrate them into a companywide compliant culture.

Excessive and ill-applied use of technical language is, at best, inappropriate and disrespectful. At worst, it is arrogant and dangerous.

Compliant systems need documentation and training that all applicable staff can understand and easily follow. Remember, there is no value in confusing or overly complicated language. The goal should always be to communicate in the most efficient manner that will help create successful and complaint business operations.

Glenn S. Phillips, the president of Forte' Incorporated, works with business leaders who want to leverage technology and understand risks within. He is the author of the book Nerd-to-English and you can find him on twitter at @NerdToEnglish.

Glenn works with business leaders who want to leverage technology and understand the often hidden risks awaiting them. The Founder and Sr. Consultant of Forte' Incorporated, Glenn and his team work with business leaders to support growth, increase profits, and address ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Data Leak Week: Billions of Sensitive Files Exposed Online
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/10/2019
Intel Issues Fix for 'Plundervolt' SGX Flaw
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-5252
PUBLISHED: 2019-12-14
There is an improper authentication vulnerability in Huawei smartphones (Y9, Honor 8X, Honor 9 Lite, Honor 9i, Y6 Pro). The applock does not perform a sufficient authentication in a rare condition. Successful exploit could allow the attacker to use the application locked by applock in an instant.
CVE-2019-5235
PUBLISHED: 2019-12-14
Some Huawei smart phones have a null pointer dereference vulnerability. An attacker crafts specific packets and sends to the affected product to exploit this vulnerability. Successful exploitation may cause the affected phone to be abnormal.
CVE-2019-5264
PUBLISHED: 2019-12-13
There is an information disclosure vulnerability in certain Huawei smartphones (Mate 10;Mate 10 Pro;Honor V10;Changxiang 7S;P-smart;Changxiang 8 Plus;Y9 2018;Honor 9 Lite;Honor 9i;Mate 9). The software does not properly handle certain information of applications locked by applock in a rare condition...
CVE-2019-5277
PUBLISHED: 2019-12-13
Huawei CloudUSM-EUA V600R006C10;V600R019C00 have an information leak vulnerability. Due to improper configuration, the attacker may cause information leak by successful exploitation.
CVE-2019-5254
PUBLISHED: 2019-12-13
Certain Huawei products (AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace AntiDDoS8000;Secospace USG6300;Secospace USG6500;Secospace USG6600;USG6000V;eSpace U1981) have an out-of-bounds read vulnerability. An attacker who logs in to the board m...