Twitter streams so quickly that it’s easy to think you have to go faster, too. A blog post leads to a Twitter conversation that leads to more blog posts and more conversation… who wants to miss the opportunity to contribute (and be recognized for contributing)?

In watching the activity, it can be difficult to remember two key points:

1. Everyone goes at their own speed.
2. In failing to go at our own speed, we miss things… sometimes important things that might make the difference in how we differentiate our thinking from others’.

As social media and communications expert Amber Naslund wrote not long ago:

Reflection itself has a few benefits, from cool-off time to the ability to let thing sit and process for a while, like steeping tea leaves. Sometimes I notice something I didn’t before. I notice that I didn’t say something or make myself clear enough, something that might have made the conversation easier, and I know to be more articulate and specific next time.

How I create social content

An example: to get to the post I wrote about contributing to the DFIR community, things sat in the back of my mind for a few days. I had seen Twitter conversations among Harlan, Ken, Erika and others; I’d read their blog posts. I knew there was something I could add… I just wasn’t sure what. I didn’t want to rehash what everyone else was saying, and I didn’t want to let the opportunity pass.

At the same time, two totally unrelated articles sat in my browser tabs. As with the DFIR conversation, I’d read them, knew I wanted to do “something” with them (bookmark them? Use them in a blog? Did I have a client who needed their wisdom?) but wasn’t sure what… until I began to see how they related to the DFIR discussion. What if, I asked myself, the writing itself might be the problem? And so my take on the “contribution” topic became about my own specialty: content.

Like Amber, I need time to process things. I’ve found this outside of Twitter too, in the last few months especially, whether in an email thread or in-person meetings or at trade shows.

• It might take me two or more days to respond to email, not because I’m consciously stewing about something, but because I’ve read the thoughts and want to be sure I’m getting the issues and requirements right.
• In person or on the phone, it’s not unusual for me to come back to meeting-mates a day or two later with more information, clarifying things I said and usually in relation to what I heard. (I sometimes struggle to articulate myself verbally.)
• At DC3, on the last day of the trade show I came to the expo hall floor early and spent half an hour with the notes I had taken, connecting the dots between people and the thoughts they’d shared.

Among the connections I make is where good content lies. That’s why I don’t blog more than weekly on any blog I maintain.

Learning from the researchers

It’s hard to remember, amid the constant stream of content, that everyone has their own pace. This is true of fiction writers as well: some writers are just naturally more prolific than others (and may even suffer from hypergraphia). But it is also true that the more you write, well, the more you write. You learn to see the ideas in the everyday, to splice them together with other ideas.

And then there are the DFIR researchers.

It’s sometimes difficult for me, as a PR pro and content marketer, to see clients’ best minds working so slowly. Months can pass between good articles that support, say, a client’s training course, or that review a client’s forensic product.

Of course, all that means is that the writer is taking time with the research. Day jobs take precedence, and good research deserves thoroughness. It’s the only way to provide content that will be meaningful to the reader.

Back to Amber’s point: there is power in slow thinking, and perhaps what we owe most to our readers and followers is not the ability to keep up… but the ability to filter, connect, distill, and purify according to our own unique experiences and perspectives.

Are there times when you could have thought slower, or where you chose to think slower? Tell us about it below!

photo credit: KarolGajda

And yet, also a little apprehensive. Early on I learned that conferences are alternate realities. All kinds of things happen there that wouldn’t happen in typical workaday life. As I commented on Conversation Agent Valeria Maltoni’s blog recently:

You meet people and have great, deep conversations, you brainstorm all kinds of possibilities. But when you go back to the normal schedule, after you’re all caught up and looking for a little of that ‘spark’ you found in a different time and place… you’re still constrained by schedules, responsibilities, expectations that temporarily didn’t exist at the conference.”

Valeria wrote an excellent post, “30 Connective Things You Can Do at a Conference,” about how best to manage that alternate reality, to network the way you want and need to. Because conferences and networking are so important to the DFIR community, I’d like to riff off her original post and talk about 20 connective things you can do after a conference.

1. On your day of departure—in your hotel room the night before you leave, in the airport, on the plane or train or in a coffee shop during a driving break—take the time to reconstruct your sessions, meetups, after-hours conversations, etc.

• What did you learn, and from whom?
• What ideas did you and others come up with?
• What did you observe, what did you overhear?
• What patterns do you see?

Write all this down to come back to in a week or so, after you’re caught up at work.

2. Share what you learned with your team. Remember that you’re coloring the information with your own perspective, so if possible, share the slide deck and/or handouts with them and invite their feedback.

3. Revisit your notes. Together with your team’s feedback, decide if there’s enough for new research, a new paper, blog article or podcast. Be sure to set aside time daily or weekly to work on the project (depending on how in-depth it is); when you publish it, be sure to refer to the conference, people and ideas that led you to complete it.

4. Didn’t get a chance to provide feedback to speakers? Make a point of emailing one or two speakers per day after you get back to the office. Be specific about the takeaways you gleaned. Leave the door open for further discussion.

5. Share what you learned about products and vendors with your team. Collect their questions and needs—not just about what the product(s) can do, but what they need to do their jobs better. Follow up with the vendor(s) to ask those questions and see how well they respond to your team’s needs. That response will be an important part of your purchase decision.

6. Take time to think about things you wish could’ve been different:

• More time meeting new people?
• Hanging out with old friends and colleagues?
• Lecture track you would’ve wanted to attend for yourself, rather than work?

Decide to make those changes at the next conference you attend.

7. Start a Twitter, LinkedIn group, forum/listserv or blog conversation about something you learned. (Sometimes conferences have their own LinkedIn groups.)

8. Identify the 3-5 people you connected with most strongly. Make a point of calling or emailing them every so often with things you believe they’d benefit from:

• an article that recalls your conversations
• a speaking opportunity at another conference or with the media
• a congratulations on one of their accomplishments. Comment on their blog; tweet @them; find them on Google+ Hangouts.

9. While you’re at it, think about the things that made you click.

• Particular ideas?
• Core themes that connected your conversations and ideas?
• Shared values?

Again, see if there are patterns—finding them can help you work out where you can benefit the community the most.

10. Set a goal for yourself to speak at next year’s conference, especially if your topic is based on the ideas you heard at this one.

11. Did you meet someone you thought would benefit from knowing a friend or colleague? Make sure you email-introduce them (and perhaps even conference call) the week following the conference. And be clear about the value they would have to each other.

12. Find a way to invite the best speaker(s) to your local area. A Security B-sides event, HTCIA or other association chapter meeting, or one-day training session can be ideal. See whom you can partner with to make it happen. Or, hold a virtual event. Your employer may be amenable to a webinar, or you might suggest the speaker to an event like #DFIROnline.

13. Pace yourself while reconnecting. Follow up immediately after the conference, but then let your relationship build naturally. Remember: conferences are alternate realities. Remind the other people who you are, then let the dust settle so that the ideas you built can stand by themselves for further building.

14. Who organized the event? If you can, volunteer to do something at next year’s conference, or encourage your employer to support it in some way (if they aren’t already) by sponsoring a giveaway or networking session.

15. Between this event and next year’s, you’ll network with more professionals. How might they benefit from coming to next year’s event—especially if they’re based in other countries? Invite them based on what you’d like to learn from them, and tell them you’ll be glad to introduce them to your connections.

16. Did anything you learn at the event change your mind, or send you in a new direction? Use a blog post to write not just about what, but also about how it happened—the old idea you’d never heard expressed that way before, or the unexpected angle. Did it help you solve a problem, or are you still mulling how to apply it in your own professional life? Either way, share it with the community.

17. Join a social network that’s new to you:

• Well-traveled ones like Twitter, or underrated ones like SlideShare.
• Volunteer for the SANS blog (if you’re qualified).
• Create a new Google+ Circle and spend time there daily.
• Guest blog for your favorite DFIR bloggers.

18. Publicly acknowledge the conference and what you thought was great about it. Mention by name those who made it great: organizers, speakers, people you connected with. A video testimonial can be especially powerful.

19. Traveling to where a speaker or conference connection is based? Let them know ahead of time, and tell them you’d love to get together if they’re available. Use your notes from your conversation(s) or their lecture to drive your conversation.

20. Think beyond your constraints. We get so caught up in our day to day responsibilities, we forget the things that made conferences spark for us. Make the time to recapture it, if not in conversation (that’s not always possible), then for yourself, in your own mind, from your own notes and memories.

“…follow through is key,” Valeria wrote. “Closing the gap between promises made and promises kept builds a solid reputation, and helps you make stuff happen, too.” It takes practice for sure, but the DFIR community is forgiving as long as you’re trying your best, and values face-to-face as much as virtual relationship-building.

What are some things you do to follow through with people you’ve met at a conference?

photo credit: kenteegardin

The need to embrace uncertainty

Jonathan Fields hooked me in the first chapter of his book Uncertainty by describing why uncertainty matters:

 When you begin, nothing is certain save the drive to create something worth the effort….

Not knowing on day one how it’s going to end or what it will look like when it’s complete can be paralyzing for many. It’s brutally hard to act in the face of incomplete information or assurances that you’re on the right path. But it’s that very lack of assurance that also serves as proof that the journey you’re embarking on is not derivative. That the quest and the potential outcome are unique. That both will matter.”

Fields holds up inventors, technologists, artists and business owners as his examples; the book is geared toward creatives rather than any one way of making money. That’s important for DFIR practitioners, for whom forensication is as much art as science: applying the science in (ethically) creative ways, and creating new ways to refine the science.

But there’s a difference between creating for one’s own use, and creating (or communicating your creation) for everyone’s benefit. The latter is riskier, and potentially much more rewarding. Later on, in Chapter 9, Fields asks the reader to consider doing nothing at all:

In reality, there is no sideways in life…. There’s only up or down…. if you’re teetering on the edge of happiness, health, liquidity, and contentment now and if you’re stuck in a “do nothing to change” scenario, then ten, twenty, or thirty years from now, your creative life, your business, and your body of work will likely be somewhere between really unpleasant and really dead.”

He reminded me of why I quit my job over 10 years ago to become a freelance writer, and why I later convinced my husband to let me try full-time self-employment: the status quo wasn’t a happy place to be. Ultimately, I wanted our children to have the example of adults who strove for happiness and fulfillment.

Embrace uncertainty, unleash creativity

Between Chapters 1 and 9, Fields goes into detail about what it takes to “lean into” uncertainty as you pursue your dreams and goals. He effectively dissects the fear of failure and gives the reader tools to nurture creativity, to the point where it becomes possible to change plans when needed.

And so, after describing both the physiology and the psychology of uncertainty, Fields devotes several chapters to two main concepts:

1. training mind and body through the routines of meditation and exercise, which help the creator release work from his/her mind
2. “socializing creation,” which provides the creator with a way to get feedback even as a work is in progress.

I can think of many forensicators to whom exercise is a critical part of success, and I’m implementing Fields’ recommendations in my own daily life as a creative. However, it’s the latter concept I want to focus on, because it speaks directly to the “community” discussion.

A forensicator’s fear of looking stupid or failing is not, on its face, all that irrational. Who wouldn’t worry about how one’s employer or a courtroom will react to the disclosure that you don’t have all the answers?

But contributing to the community is not about giving something up; it’s about a give-and-take of knowledge and skill. You would not have gotten to where you are without others’ help (no matter how alone you felt at times).

Therefore, worrying about how other forensicators will react is not rational. The conversation from the last few weeks demonstrates a ready-made “hive” of trusted professionals. These people will offer feedback and advice towards anyone’s goal of creating something useful, be it a piece of software or a presentation. Do the work, and you’ll get the support.

Make it a closed hive, if you must; I’ve experienced the nasty side of hypercompetition, and the DFIR industry has no shortage of it. But Fields argues that we need judgment in order to be valuable, that creativity needs constraint to birth something useful. Involve others early on, and not only do you get that constraint; you also get the support and validation you’re fearful you won’t get.

Committing to your calling

“How committed are you to the specific endeavor?” Fields asks. “Is it a project or a calling, the thing you can’t not do? Understanding the difference informs the choices you make, but it also changes the way you act in a thousand tiny ways. It changes your personal energy and leads people either to buy in on an extraordinary level or to view your quest as something not all that important.”

In life we are all driven by the desire to be important, in varying degrees. For some, being important to one’s own children is the highest calling. For others, it’s importance to the local community as a public safety professional, journalist, or business owner. Others want to be important to a cause, such as stamping out cybercrime.

Contributing to the community is as much about self as it is about the group. Paradoxically, protecting self from the pain of failure ultimately starves self along with community; whereas contributing feeds both self and community, nurturing knowledge for all.

Edited: Over on Google+, Gregory Pendergast asked me for a more direct assessment of the book itself. Here’s what I told him:

It’s positive and practical. Nothing “The Secret”-ish about it; I was a little surprised to see such an emphasis on meditation (“attentional training”) but even that resonated because I have experienced brief times when deep contemplation or focus on exercise  (for instance, swimming) worked exactly as Fields was saying it does.

The writing itself is clean and direct, and I liked that Fields would state an idea early on, then circle back around to it once it had had a chance to percolate in the back of my head. Chapters built nicely on each other, and the book has stuck with me in the weeks since I read it, like quiet encouragement to stick with the good habits.

With thanks to Conversation Agent Valeria Maltoni for her generous gift of Uncertainty. Here’s her Amazon affiliate link if you like what you’ve read and want more.

Substitute “write” for “program” and you’ll see a statement that novelists, journalists and other authors have been hearing for decades. The thing is, looking at Harlan’s list (case studies, book reviews, even asking questions), I can see how those “simple” suggestions might be just as intimidating as reading the Rob Lee post that started it all.

William Zinsser (one of my very favorite writing authorities) wrote in On Writing Well:

Take an adult chemist or physicist or engineer and ask him or her to write a report, and you’ll see something close to panic. “No! Dn’t make us write!” they say…. They were told at an early age by an English teacher that they don’t have “a gift for words.”

Which is criminal. As Zinsser goes on to explain:

“Writing, demystified, is just another way for scientists to communicate what they know…. Describing how a process works is valuable for two reasons. It forces you to make sure you know how it works. Then it forces you to take the reader through the same sequence of ideas and deductions that made the process clear to you.”

That sounds an awful lot like the standard for “reproducible” to me!

Helping the reader identify with your work

My observation is that most of the DFIR practitioners who are active on Twitter and Google+, also keep blogs; many also teach. In other words, they already communicate in a way that, as Zinsser suggests, “…take[s] much of the mystery out of science writing by helping the reader to identify with the scientific work being done.”

You can do that, he explains, by telling a story from your own experience, or someone else’s; relate your science to something the reader is already familiar with and can easily visualize; writing clearly and sequentially, pacing what you explain.

But how many are out there, reading these blog posts, thinking to themselves, “Yeah but… I can’t write”? Or feel as if they’re doing all the writing they already wish to do in their reports?

I’m going to estimate that these readers fall into two camps:

1. Those who yearn to be better writers, more effective communicators. They’d like nothing more than to blog and tweet and write trade articles and maybe even a nonfiction book or novel that draws on their experiences. But they’re terrified of looking stupid.
2. Those who could not care less about writing more, or they’re too busy to put the work into it… but they’d nonetheless like to contribute more to the community, although they aren’t sure how.

Communicating DFIR experience through writing

Harlan’s suggestions are right on the money, but I posit that for people who are not in the practice of writing regularly, it can be hard to figure out where to get ideas. Two posts I’ve read recently describe seven easy ways to turn old content into new content, and ten mindful ways to use social media.

These posts suggest things like:

• making blog posts out of LinkedIn conversations
• turning blog comments into new blog articles, or written content into video
• knowing your intentions before posting
• sending “random tweets of kindness” offering help
• responding with your full attention

One article is purely about content creation. The other is about the attitude you need for creating good, valuable content. Both worth a read, and worth deeper thinking about how you can contribute.

Contributing without writing

Those of us who love the way a spirited Twitter chat rolls along have trouble understanding those who don’t just jump in, or indeed, who don’t even understand Twitter. There are plenty, though, and I’d like to see the DFIR community come together to use tools like Google+ Hangouts or group podcasts. In other words: natural conversation, for those who are more comfortable communicating by voice.

I also want to put in a plug for getting more involved with professional associations, volunteering on some level as a board member or event organizer or committee member. I know: employers can be stingy with the time you take for this kind of thing. But it can benefit them, too — corporate citizenship is a term I’m hearing more and more about, and building into some of my clients’ strategies — and can be a way for you to contribute in a way that fits you best.

Where do you feel you’ve fallen short in the community? How do you think you might improve?

photo credit: opensourceway

That part caught me by surprise. The truth is, I don’t focus on SEO in that blog. I know it’s important, and at times when I’m writing, I think to myself “Hey, that’s a good search phrase.” When I link, it’s to articles or other resources that will support when I’m writing, and the fact that it will help both our search rankings is a bonus.

In short, I still think like a journalist. And reading articles like this one from Social Media Today, and this one in Thought Leaders, I have to believe it’s an important focus to have — even as Google’s algorithm is newly focusing on dynamic content. It reminds me a little of my husband’s favorite baseball adage: “Good hitting sells seats. Good pitching wins championships.” Short-term attention-getting, vs. long-term relationship and brand building: indeed, much more strategy is involved with pitching, than with hitting.

Market segmentation and buyer personas…

In Social Media Today, Marc Meyer asks:

As the tablet and smart phone markets continue to expand, so will the amount of water downed re-used content. Thus, we need to get back to a time when content mattered, when good content mattered. I’m not so sure we can as long as we’re still trying to figure out who we’re supposed to be creating content for. Is it people or search engines?

Do we even have to ask? It stands to reason that search engines’ users are, after all, still people (even though Skynet was supposed to have become self-aware by now). So logically, SEO isn’t so much about the keywords… it’s about the keywords people are likely to use.

Not sure which keywords your target market is likely to use? You may need to work on getting to know your prospective customers. What kind of expertise do they have? What level of technical knowledge? What keeps them from doing their jobs effectively, and what wish lists do they have?

… and the writing mechanics matter, too.

I think a main reason that my writing succeeds in the SEO arena is that I’ve learned to cut out the fat. Stuff like turning “of the” possessives into apostrophes (the track logs of the GPS vs. the GPS’ track logs) and, of course, using active voice (I use active voice vs. passive voice is used by way too many writers).

Depressingly, somewhere along the way business writers decided they sounded more authoritative when they added in extra words. Cut them out, and SEO becomes what marketers call “organic”: naturally occurring within a text.

Readable, engaging content should be the goal. Readable: it flows, doesn’t distract the reader from learning. Engaging: it’s as close to enjoyable as you can make it. For digital forensics, learn from conversationally written blogs like Harlan Carvey’s Windows IR, or many of the posts on the SANS blog.

(Also note Evan Weisel’s note from the above article: “Yes, a blog may read in a conversational, even casual manner. But the good ones require serious intellectual “sweat equity” into the often painful process of writing. In other words, it takes effort to make it for an effortless read.”)

Perhaps the biggest reason I don’t blog daily is that I want to have something meaningful to say: quality vs. quantity. I can think of only a handful of people who can manage both simultaneously. So while I’d like to manage a daily blog (two, even), the family-client-personal situation means if I can only find something of quality to say once a week… that’s okay. Likewise for you. Yes, search brings people to your website. But only great writing will keep them there.

How often do you blog? How important to you are quality and quantity, and how much of a balance do you try to strike?

photo credit: c.mcbrien

That’s why his recent post about (pseudo?) reporter Judith Miller struck a professional nerve. Having moved from trade journalism to public relations, I was especially struck by this point:

When there is a real danger people need to know about, you have to report it. That’s when people need to hear the scary truth. But I do mind, because the fear she threw around was not based on truth… if you are the writer, you should care about how people will react.

Then again, if you’re willing to write lies, you’re not really going to care about that, are you?

I have faced a lot of skepticism over my motivations in the past 10 years. To cops, I was “the media,” even if I was writing for their publications. Newsroom journalists on listservs made snide comments about “PR fluff.”

These days, I worry when journalists don’t get back to me. Did my article suggestion not meet their needs, or do they think the story I just pitched them is a cover for a sales pitch? And it always makes me cringe a little when I see the occasional tweet about marketing manipulation and PR spin.

The business of inspiring (re)action

The skeptical are right to be. The spin machine can be ugly, especially in the face of a crisis. The problem isn’t that we don’t care how people will react. The problem is that we’re paid to care about making them react a certain way.

Sometimes the two converge, and that’s when you get great PR and great journalism. But sometimes we care more about making readers and viewers react, than we do about how they actually feel.

Journalism, just as much as any PR client, is in business. Journalists sell newspapers and magazines, or pull in ratings, on the strength of their storytelling and how well it adheres to editorial guidelines. Both types of messaging are about building and sustaining a brand, which every good businessperson knows is about trust.

Judith Miller and her ilk take shortcuts, go for short-term reaction rather than long-term trust. On a lesser scale, but no better at trust-building, are those who are chronically too overworked or lazy or demotivated to spend time getting every fact right.

Some might say this makes them a perfect fit for PR. How many times have you read a white paper that referred vaguely to “statistics say…” without citing the actual research, a name and date if not a link to go with it?

But for one problem: in the last few years, since the economy coupled with social networking broadsided the media industry, the PR-journalism symbiosis has changed. We still depend on one another, but we also compete with each other.

Consider: fewer journalists at struggling publications means more PR pros are competing to provide the content. That makes it harder for us to get our clients’ stories told. Conveniently, social media provides an alternative outlet, but needs a constant stream of content to stay in followers’ minds. Therefore, we encourage our clients to become publishers of their own content.

Brand journalism requires high standards

That’s because ideally, our clients’ content provides better context for media as well as buyers. When we pitch a reporter who likes what we’ve had to say, s/he can come back to our website with its blog and videos and white papers and infographics, and use them for the article s/he’s working on. Or s/he can find them via search, including social media monitoring, and be the one to make first contact.

That’s why it’s incumbent on us to hold our content, which some call “brand journalism,” to the same high editorial standards as journalism does. Truth, as everyone knows, is subjective, based on human interpretation. Good PR is about helping our clients and their customers understand each other’s truths, and adjusting our messages accordingly, with the end goal in mind of inspiring action — sales.

Making it easier on them is a form of building trust. At some point, buyers and journalists alike take a leap of faith: they choose to believe what they’ve researched, and go forward with the purchase or the story. Shortening that leap is what will keep them coming back. Here are some ideas:

• Research, whether from a vendor or from academia, is constantly being tested, refined, even disproved. We need to be transparent about showing what has changed and how, whether we are referring to someone else’s research, or promoting our client’s own.
• The phrase “statistics show” is condescending when it stands by itself. Treat white papers like blogs long enough to link to the research that shows the point you’re trying to make. Let your reader draw his or her own conclusions. It will make for better story-telling.
• It’s the job of a good journalist to find opposing as well as complementary points of view to balance what our clients present as truth. Use these as opportunities to drive future research, content and business forward.
• Much as been written about the power of social media in correcting reporters’ errors, which can be important to reputation management both in and outside of a crisis. Twitter, LinkedIn, YouTube and your company blog are all good places for this.
• Use journalists’ own fact-checking tools for content — and remember that fact-checking still carries with it a certain degree of bias, as you look for facts that support your argument.

“Brandwashing” is alive and well, unfortunately. But if we want our content to build trust with prospects and customers, only taking the time to get our facts as right as we can — and to engage in discussion when people disagree — will keep our relationships in balance and both our businesses in the black.

photo credit: Marquis Lewis

How do you find #DFIR examiners to beta test your tools?

If you’re a small and/or unknown digital forensic tool provider, getting people to beta test your tool(s) may be a challenge. Ideally, you’re located in an area where you can partner with local labs and their experts. But what if you want to expand into a new geographical location, or you’re so new that the local experts don’t know who you are?

I asked the digital forensics/incident response experts on Twitter and Google+ what they thought:

Fill a need

“In my corporate work,” wrote Joseph Shaw on Google+, “we find that our investigations always fall within a very strict set of technologies and use cases, so the only time we look at a new tool is if it does something we really need done and can do it faster and cheaper than an existing tool we already use.”

Shaw’s lab follows the same procedures as Stacey Edwards’, who wrote: “We test both new products and new versions of old products against a standard set of data. If the results match what we would expect, and the product is affordable, more stream-lined, or runs faster, then we’ll proceed with it. If the product does nothing extra for us, then we’ll typically pass on it for the moment, but we may decide in the future to go back to it.”

“For me, it was a new product with a lot of potential, that would fill a void in email processing,” tweeted Frank McClain, “and that’s usually what gets my attention: new, potential, unique and that does something interesting; something I relate to, think I can help with.”

Filling a need is also about making it easy for the users. Any demo needs to provide full access, not limited features. “If I have time and the vendor makes it easy to obtain, I’ll test it and compare to end results [from established tools],” tweeted Daniel Parsons. “The no namers tend to be buggy and ease of use is still low, but you never know what you’ll find.”

Finally, as the “Big Kahuna” tweeted, “bragging rights” can be important. Examiners who are involved with tool testing should be able to say so, as it enhances their credibility as well as yours.

Be available

Where do users find out about new forensics tools — i.e., how might you let them know about yours? Says Edwards: “Twitter, email lists, blog posts, etc is usually how we find out about them. Or, if we have a need such as ‘products that convert OSTs to PSTs,’ we’ll poll people and do a Google search. It’s typically a need arises first, then we’ll do the searching and testing.”

This highlights the importance of two tools: SEO, and social media. Anticipate the keywords your intended customers will use. And follow — and engage — with them using social tools. Twitter and Google+ have the strongest digital forensics followings, though some LinkedIn groups may net good feedback as well. In addition, forums like Forensic Focus continue to be important to many users.

Likewise events. “I just demo’d the new Oxygen Suite 2011 because they gave it at #htciacon [the HTCIA Conference],” tweeted Parsons. Earlier in the year, at the Techno Security/Mobile Forensics Conference, Cellebrite made available a demo of its latest version of Physical Analyzer software. They made their demo part of a contest, in which participants underwent a timed analysis for the chance to win a new BlackBerry PlayBook. (Disclosure: Cellebrite is a client.)

Most of all, community

The digital forensics/incident response community is all about its relationships. Good investigators know that the time to build them is before you need them, and it’s no different for companies seeking beta testers. Get involved early and often — months before you need testers.

McClain, who seeks open source tools, looks to build relationships “with smaller developers, other forensicators (like [Andrew Case]) who build tools for the community,” he tweeted. Likewise Gilbert, who relies on word of mouth to find out about noncommercial tools, and on his relationships with vendors for commercial tools. “Usually [there are] no true betas on production work,” he tweeted.

Are you an examiner who has participated in beta testing, or a vendor who has asked examiners for help? Leave a comment — how do you prefer to make these connections?

Image: dpstyles via Flickr

I’ve written before about how tightly packed certain markets are. Forensics investigators as a whole value community, but within that group, vendors for mobile device forensics, e-discovery and other sub-fields are quite competitive. (At times, I visualize sharpened bared teeth. But anyway.)

By now most people in the industry know that I represent the High Technology Crime Investigation Association. As part of that work (especially in the months leading up to its conference), I have promoted directly competing firms, sometimes while I was contracted with one or two. I also contract with three mobile forensics vendors.

How do I manage without violating contractual agreements, or ethical boundaries?

Transparency without disclosure

Without disclosing specific needs or intended strategies (e.g. “ABC wants to focus on e-discovery…”) I inform current clients of new contracts. Sometimes I do this even in negotiation stages, depending on how I feel about the situation I’m hearing and the role I’m expected to work in. I also inform new prospects of existing contracts, right at the start, in case it’s a deal-breaker for them.

I don’t sign contracts I don’t feel comfortable with. If something is a clear conflict — two direct competitors in the exact same space (think AccessData/Guidance, or Cellebrite/MSAB) I don’t play them off against each other. That’s just too much to ask.

But in less clear instances, where I feel there’s more flexibility and I do sign, I am diligent about keeping the work separate.

For instance, among my mobile forensics clients, one has me working on a campaign basis. Their PR team is firmly established, and I am working with the messaging direction they provide, rather than helping them determine and direct messaging. Another client opted to have me work on product promotion rather than the training branch of its business, because I was already working with another client on its own training.

In all three cases, differentiation is key. The clients had already mapped out the way they wanted to differentiate themselves, possibly the most important thing they could do in such a tight market. Why… and how are the differing messages not a conflict for me?

The community standard

It comes back to “community.” Each vendor has something to bring to the table. Each has its strengths and its weaknesses; within the company, each product has its own strengths and weaknesses.

Moreover, each forensic examiner has his/her preferences when it comes to tools, based on the tool interface, ease of use, and a dozen other intangible factors. And because the mobile forensics industry still has yet to produce a tool that can acquire all the data from every digital device with every operating system on the planet, most examiners use multiple tools — including directly competing products if they can afford it.

In that regard, what I do shouldn’t be much different from what a vendor-neutral reseller does: find what works best for the customer. (This is perhaps most in play when I’m representing HTCIA, when what I do on their clock is to benefit the membership community as a whole. And no, I don’t charge clients for promoting their company on HTCIA’s behalf.)

In my case, it’s a matter of finding the communication that will:

• Best highlight the answers to customer questions, at whatever stage in the buying or ownership process. Use cases, for instance, are clear examples of showing one product’s strength without coming at another product’s expense.
• Align with client values, experiences and strengths in a way that matches media needs. Depending on whether the client has an investigative, legal, hacking, government or private background (or some combination thereof), I pitch stories that draw on that experience. Subject matter experts don’t come from cookie cutters, and the possibilities for good stories are endless as a result. I haven’t pitched the same story for two competing clients, and I doubt I ever will.
• Start and continue conversations according to community values on social networking sites. Forensic examiners value truth above all else, so they like healthy debates that challenge one another and keep standards high. Marketing messages don’t work with them, and the best vendors respect that.

Remember: I was a journalist first, and it’s this sense of impartiality that I bring to my PR work. I was writing for the investigative community long before I started in PR, and those are the people — my readers and sources — I feel the most sense of responsibility to: contracts and paychecks come and go, but the community remains the same.

Their needs are what I’m responding to when I counsel clients and write content. The point is not to water down the message, but rather, to raise the bar on clients: to bring their strengths and values out from behind the veil of marketing-speak like “innovative” and “revolutionary” and to show the customer how the clients will help solve their work problems.

At that point, keeping client strategies separate pretty much works the same way as keeping my own personal biases out of client work. Clients pay me to incorporate their values into the content I craft for them, so as long as they clearly communicate those values and goals to me, I’m able to come up with strategies that work for everyone — and that don’t conflict.

photo credit: jesse.millan

We always talk about how this social media thing is supposed to “humanize” us, but sometimes we only seem to mean that if the human stuff are things that make us comfortable. But the reality is that vulnerability is what draws people to one another….

I sometimes get the impression that clients along with prospective clients are trying to figure me out; I’m sure it doesn’t help that I blog rarely, don’t have e-mail newsletters, and have a curious phobia about picking up the phone.

So in the interests of transparency, here’s what I’d like you, clients, prospects, and the casually interested to know:

My top three strengths are also my top three weaknesses.

I analyze just about everything. I love puzzles, dissecting a problem and exploring it from different angles, I love working toward solutions. If you go along with the “boxes” in which the Myers-Briggs Type Indicator put us, I’m an INTJ — rare among the general population, even more so among women.

Yes, I do get stuck in “analysis paralysis.” Not often, but sometimes. When it does happen, kick my butt (but please don’t make it personal) and help me understand why you feel confident moving on, so that I can improve my consulting for the future. Also: it helps if you give me a new project or problem to solve!

What I just said about not making it personal? I’m hypersensitive. You would think being analytical would cancel out the sensitivity, but actually all that analysis is a way for me to process emotional input which could otherwise overwhelm me. I empathize deeply with other people, tending to internalize both joy and pain.

The weakness is probably obvious, but for a marketer/PR consultant, the strength is profound: combined with my analytical skills, I’m able to listen to customers’ feedback and then figure out how that might translate into better PR or marketing content.

I’m intuitive. Solutions to problems often come to me in exciting brainstorms, and so much the better when I have a great team to bounce ideas off and refine further. Where’s the weakness there?

I can’t always figure out how to articulate what I’m thinking. I’ve taken to sometimes explaining how my brain leaped from Point A all the way over to Point H (although judging by the expressions on people’s faces, sometimes that makes it worse). I think this problem with articulation is partly because it takes me time to process things, especially when I feel they are important. Writing them down can help. So can patience.

Bonus strength/weakness: Ideas fly me. There’s something about the raw energy of an idea not yet brought down to earth, processed and refined and then finally realized. Even better if I have someone to share it with, helping me do the processing and refining — I think it’s because having that additional perspective helps keep the idea in the air until it absolutely has to come down.

The weakness in this: I sometimes put ideas ahead of people. It can be very difficult to have one or more awesome ideas, then find out that the people I so wanted to work with are unavailable. I’ve damaged relationships with this kind of single-mindedness. I’m working on finding balance.

I’m always looking for a great collaboration.

My sons are huge Scooby-Doo fans, and once, while watching one of their DVDs, played a special feature that was Bill Hanna talking about his partnership with Joe Barbera. He said something to the effect of, “Either one of us alone would have produced something good, but we could only have achieved what we did together.”

I love finding and writing great stories — an exercise in problem-solving, at its core — but because I can get so caught up in ideas and how to put them across, having a partner to work with is actually my ideal. The right partner can ground me or inspire me to new heights, or both, and that kind of support is mutual.

Even so, over the course of my career, I’ve met few people I deeply connected with, the kind who always seemed to know exactly what information I needed for an project, whose words I always seemed to be able to set down in exactly the right way, and who continued to build strong relationships with me over time. I’ve experienced this just enough to know it’s possible, and I can’t wait to find the next one.

I write crime and horror fiction.

I have cop friends who don’t understand how I can gravitate towards evil, but the fact is, fiction is how I have always processed evil. Remember, because I’m so sensitive, I internalize emotions, and I need a way to get them out. Therapy never worked when I was a kid, and I found over time that writing helped me think, so I write: cops, crime and criminals; zombies, werewolves and ghosts. (But no vampires. I’ve never been able to pull off a vampire story.)

And yes, I’m a huge horror- and crime-movie fan, too. But only awesome ones.

I am a jazz lover.

I love all kinds of music, but classic jazz speaks to me in a way that rock, soul, electronica, and even blues cannot. Something about it, even the energetic bop I’m listening to as I type this, relaxes me. I’d like to think it’s the improvisation helping my subconscious mind let go of all the structure, so I can be more fully creative, or at least more relaxed. I would be very happy (and would spend a lot more money) if my favorite coffee shops played jazz all the time.

I’m a city girl.

I grew up in city suburbs. Nothing was ever more than a train ride or a few blocks’ walk away, and there was never a lack of things to do… until my family moved to northern New England. Then we started having to drive everywhere, and for longer periods of time. This became a serious problem after my husband and I moved to a house in the country and had babies. In the dead of winter, we just… couldn’t… go anywhere.

Where I live now, Greenville, SC, is a perfectly sized city for raising children. My boys are getting the great city-living experiences I had growing up (museums and parks and so on) without the anxiety of living in a really big city. (Or the subway. I confess I do miss the subway.)

I’m deeply faithful, but not religious.

I’ve believed in God all my life. I believe prayer works. I’ve experienced things that were too profound to be coincidental.

But I don’t go to church, I don’t witness to people, I believe religion has caused as many problems as it has solved (if not caused more). I enjoy reading the work of other people who turn rules and assumptions on their heads. Philosophically I may even have more in common with atheists and agnostics than I do with other Christians.

I say this because my faith is a key part of where I am in life and in business. If that turns people off, so be it. But I hope it draws more in, and forges the deeper connections I’m always looking for.

And about that phone phobia…

I once made a complete idiot of myself when I was 11, calling up a neighborhood girl I barely knew to ask if she wanted to come over. “Maybe,” she said, her voice tremulous with I-have-no-idea-who-you-are-how-did-you-get-this-number, and we hung up and I’ve been terrified of picking up the phone ever since.

That isn’t to say I don’t pick up the phone. I’ve conducted hundreds of interviews over the past 10 years, nearly all on the phone. (My first, by the way, went terribly. I decided if that was the worst it could get, it could only get better.)

Although I’m still much more comfortable listening rather than talking — see above, that it takes me time to process and then articulate what I’m thinking — and I see phone calls as far more intrusive than emails, I’ve been making a conscious effort to pick up the phone (or at least Skype) more often.

That’s by no means a comprehensive list, but it’s a start. If you want to know something specific, please ask. And if there’s something you’d like me to know about you, please feel free to leave a comment (or email me in private). I’d love to get to know you, too.

photo credit: Spec-ta-cles

Do you reflect the image you want to?

Last week I attended the Techno Security/Mobile Forensics Conferences in Myrtle Beach, SC. Because this year, as last year, I was there to represent a client, I spent the bulk of my time in and around the exhibit hall.

At one point I wandered past the spot where, last year, I’d been set up in my client’s booth. I noticed that across from the spot was a different vendor from last year’s. Then I realized the vendor I’d seen last year was nowhere in sight.

This was a bit of a surprise. The vendor was one of the larger companies, so while the economy is tough for everyone right now, what had made them decide not to spend money on attending this conference — even though it’s one of the largest in the industry?

Usually vendors tie their event decisions to the number of leads they can get from face-to-face interactions. Looking back on last year, I remembered that I couldn’t recall a time when I had seen the two booth attendants actually interacting with anyone. They’d spent the bulk of their time, noses down, typing away on their laptops.

Whether they intended to or not, they’d sent a clear message: “Don’t bother us. We’re busy doing more important things.” People had walked right by their booth, even after interacting with booth reps beside and across from them.

If the company really did opt out of this year’s Techno because their cost-to-lead ratio was too high, it’s a shame they didn’t realize that the solution was completely within their control.

Communicating your place in community

Conferences are, arguably, a microcosm of PR. Your customers show up. Media show up. You may have multiple company representatives there. And you interact with other vendors. All represent facets of your public relations efforts.

How you interact with them may be one of the most important gauges the participants have of your company’s values. This is a critical factor in their decision about whether to do business with you — it is part of your branding, to a much greater extent than product or value proposition.

In the digital forensics and information security industry, the highest premium is placed on community. Information is important, but it can’t be shared without emotional and intellectual connections. Therefore, disengaging from any part of the community (as the vendor I described did last year) shows your company doesn’t really value that community.

This goes for the other vendors, too — even your competitors. No one wants to see uncles or in-laws at each other’s throats during a family dinner, so why should this be okay at a conference? Yet this year, a competitor of one of the event’s sponsors went too far in positioning itself apart from the sponsor:

• Their team stayed clear of hosted events (even one involving free food. Gasp!) At one point, they clustered in the hotel lobby as if circling the wagons while everyone else gathered to socialize.
• Their sales representative had changed out the sponsor-branded nametag lanyard for a lanyard from a previous conference — that his company had sponsored.
• They didn’t come over to the sponsor’s booth to socialize, as I’d seen them do at previous events.

I was not alone in noticing their choices. Trickiest: although at least one (the lanyard) was a conscious choice, the others may not have been. The sales team may have decided to go out to dinner rather than attend the social event, simply because they wanted more robust fare. Still, it would have been wise for them to consider how that choice looked from the outside in. That’s because while choices may not affect sales to any measurable effect, every action ripples, many times in ways we don’t see.

Match conscious with unconscious

To communicate a consistent brand message, all the pieces have to come together, not just consciously — what you are telling customers and others — but also unconsciously: what you are showing them through your actions.

If the “tell” and the “show” don’t match, it may not cost you short-term sales, but the longer the mismatch goes on, the less equity you’ll have… and the more ground you’ll lose to competitors who are consistent in word and deed. In other words, don’t risk ego — corporate or individual — against community.

Does your approach, conscious and unconscious, communicate what you want customers to believe about you and your organization? If not, what will it take to fix it?

photo credit: Unhindered by Talent