{"id":626,"date":"2017-10-18T14:44:11","date_gmt":"2017-10-18T14:44:11","guid":{"rendered":"https:\/\/securitycurve.com\/?p=626"},"modified":"2017-10-18T14:44:11","modified_gmt":"2017-10-18T14:44:11","slug":"dunning-kruger-marketing-and-why-intentability","status":"publish","type":"post","link":"https:\/\/securitycurve.com\/?p=626","title":{"rendered":"Dunning-Kruger, marketing, and why intent!=ability"},"content":{"rendered":"<p><img decoding=\"async\" class=\"alignright size-large lazyload\" data-src=\"https:\/\/cdn.psychologytoday.com\/sites\/default\/files\/styles\/image-article_inline_full\/public\/field_blog_entry_images\/Dunning%20Kruger%20Chart.jpg?itok=BNNfmcfj\" width=\"639\" height=\"470\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" style=\"--smush-placeholder-width: 639px; --smush-placeholder-aspect-ratio: 639\/470;\" \/>So we&#8217;re midway through cybersecurity awareness month.\u00a0 Yay!\u00a0 Are you aware yet?\u00a0 Good for you.<\/p>\n<p>This morning, I came across an article on the marketing-focused publication &#8220;adage&#8221; (see what they did there?\u00a0 It&#8217;s clever because it&#8217;s both &#8220;Ad Age&#8221; and also &#8220;adage&#8221; as in short proverb) entitled <a href=\"http:\/\/adage.com\/article\/cmo-strategy-columns\/cmos-cybersecurity-experts\/310902\/\">&#8220;Why CMOs Need to Become Cybersecurity Experts.&#8221;\u00a0\u00a0<\/a>I don&#8217;t typically read &#8220;AdAge&#8221; &#8212; this one showed up in my feedly filter because of their liberal use of the term &#8220;cybersecurity&#8221;.<\/p>\n<p>Now, you might sense that I&#8217;m winding up to complain about it, having adroitly noticed me crawling forth from my &#8220;internet hole&#8221; this article in hand.\u00a0 You&#8217;re right of course, but let me start with the fact that I don&#8217;t hate the content here.\u00a0 It&#8217;s basically a thought piece from Carbonite&#8217;s chief marketing guru about why Equifax is a wake up call for marketing professionals.\u00a0 It goes on to cite the brand implications of a breach using Equifax as an example, cite the role of crisis management for marketers, and explain why marketing professionals should support security goals for the organizations they work in.\u00a0 For the record, I love that message.\u00a0 And it&#8217;s expressed in a lucid, articulate way without relying on FUD.\u00a0 Also fantastic.\u00a0 So gogo that guy.<\/p>\n<p>What irritates me about this is the title.\u00a0 Because &#8220;giving a crap&#8221; != &#8220;expert.&#8221;\u00a0 Saying they are equivalent is dangerous.\u00a0 For example, I &#8220;give a crap&#8221; about climate change; I am not an expert in it.\u00a0 \u00a0I can tell you why I think climate change is important to society generally, and to me specifically (living, as I do, close to the ocean.) Likewise, I have a layman&#8217;s understanding of the forces involved in climate change: the trends at work, the general contours of the research, policy considerations, and the like.\u00a0 But am I a &#8220;climate change expert&#8221;?\u00a0 No.\u00a0 I am not a geologist, meteorologist, hydrodynamics engineer, physicist, etc. etc.\u00a0 I&#8217;m likewise not a policy expert.\u00a0 See? Interested, not an expert.<\/p>\n<p>Why does this matter? It&#8217;s just a title, right?\u00a0 But stay with me on this.\u00a0 There are a few things here.\u00a0 First, people listen to experts.\u00a0 They listen to them in a way that they don&#8217;t to the average Joe.\u00a0 We know (for example, from the <a href=\"https:\/\/en.wikipedia.org\/wiki\/Milgram_experiment\">Milgram experiment<\/a>) that people are more likely to comply with authority figures.\u00a0 If someone is perceived as an &#8220;expert&#8221;, others will tend to give them more credence, defer to their judgement, even to the extent that doing so causes injury or harm.\u00a0 Scary, right?\u00a0 I think so too.\u00a0\u00a0To the extent that we reinforce the message that &#8220;being an expert&#8221; means &#8220;caring about the topic&#8221;, we set up the situation where some people &#8211; maybe intending no harm to others &#8211; can cause damage because their definition of expert doesn&#8217;t include actually understanding the topic in detail.\u00a0 They can cause that damage because others perceiving them as an expert will tend to defer to their judgement.\u00a0 When the person they are deferring to is someone who is equipped to help, that&#8217;s great &#8211; when it&#8217;s someone who is a specialist in something else (but has decided they really care about the topic but don&#8217;t really know anything about it), that&#8217;s not so good.<\/p>\n<p>The second thing has to do with something called the <a href=\"https:\/\/en.wikipedia.org\/wiki\/Dunning%E2%80%93Kruger_effect\">Dunning-Kruger effect<\/a>.\u00a0 If you haven&#8217;t heard of it, it&#8217;s (per Wikipedia), &#8220;<em>&#8230;a cognitive bias wherein people of low ability suffer from illusory superiority, mistakenly assessing their cognitive ability as greater than it is. The cognitive bias of illusory superiority derives from the metacognitive inability of low-ability persons to recognize their own ineptitude.<\/em>&#8221;\u00a0 Paraphrased, a fancy way of describing why people who don&#8217;t understand a topic think it&#8217;s easy &#8212; it arises because they are unable to recognize what they don&#8217;t know, and therefore have no ability to plumb the depths of their own ignorance.\u00a0 Truth.\u00a0 So, it&#8217;s not unreasonable envision a situation where someone, reading this, might actually believe they\u00a0<span style=\"text-decoration: underline;\">are<\/span> an expert in security, despite having woken up a lifelong marketing dude.\u00a0 That too is dangerous.<\/p>\n<p>So what makes someone an expert?\u00a0 I&#8217;d argue that it takes a depth of understanding of a given field that puts them in the upper tier of practitioners &#8211; for a given specialization &#8211; based on their ability, knowledge, and skill.\u00a0 I&#8217;d love that to be true&#8230; it&#8217;s the definition I hold myself to and use to evaluate others.\u00a0 But as a practical matter, that&#8217;s not how it works.\u00a0 Instead, what makes a person an &#8220;expert&#8221; is, in large degree, that they say they are with sufficient chutzpah for people to believe them.\u00a0 It helps if they are well versed in message-crafting and they believe it themselves.\u00a0 I&#8217;ll leave it to you to draw the conclusion to the article title.<\/p>\n<p>So, just a title?\u00a0 Maybe.\u00a0 But to the extent that titles can be dangerous, this one is top tier.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>So we&#8217;re midway through cybersecurity awareness month.\u00a0 Yay!\u00a0 Are you aware yet?\u00a0 Good for you. This morning, I came across an article on the marketing-focused publication &#8220;adage&#8221; (see what they did there?\u00a0 It&#8217;s clever because it&#8217;s both &#8220;Ad Age&#8221; and also &#8220;adage&#8221; as in short proverb) entitled &#8220;Why CMOs Need to Become Cybersecurity Experts.&#8221;\u00a0\u00a0I don&#8217;t [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[4],"tags":[79],"class_list":["post-626","post","type-post","status-publish","format-standard","hentry","category-security","tag-marketing"],"_links":{"self":[{"href":"https:\/\/securitycurve.com\/index.php?rest_route=\/wp\/v2\/posts\/626","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/securitycurve.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/securitycurve.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/securitycurve.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/securitycurve.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=626"}],"version-history":[{"count":0,"href":"https:\/\/securitycurve.com\/index.php?rest_route=\/wp\/v2\/posts\/626\/revisions"}],"wp:attachment":[{"href":"https:\/\/securitycurve.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=626"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/securitycurve.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=626"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/securitycurve.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=626"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}