The need to embrace uncertainty

Jonathan Fields hooked me in the first chapter of his book Uncertainty by describing why uncertainty matters:

 When you begin, nothing is certain save the drive to create something worth the effort….

Not knowing on day one how it’s going to end or what it will look like when it’s complete can be paralyzing for many. It’s brutally hard to act in the face of incomplete information or assurances that you’re on the right path. But it’s that very lack of assurance that also serves as proof that the journey you’re embarking on is not derivative. That the quest and the potential outcome are unique. That both will matter.”

Fields holds up inventors, technologists, artists and business owners as his examples; the book is geared toward creatives rather than any one way of making money. That’s important for DFIR practitioners, for whom forensication is as much art as science: applying the science in (ethically) creative ways, and creating new ways to refine the science.

But there’s a difference between creating for one’s own use, and creating (or communicating your creation) for everyone’s benefit. The latter is riskier, and potentially much more rewarding. Later on, in Chapter 9, Fields asks the reader to consider doing nothing at all:

In reality, there is no sideways in life…. There’s only up or down…. if you’re teetering on the edge of happiness, health, liquidity, and contentment now and if you’re stuck in a “do nothing to change” scenario, then ten, twenty, or thirty years from now, your creative life, your business, and your body of work will likely be somewhere between really unpleasant and really dead.”

He reminded me of why I quit my job over 10 years ago to become a freelance writer, and why I later convinced my husband to let me try full-time self-employment: the status quo wasn’t a happy place to be. Ultimately, I wanted our children to have the example of adults who strove for happiness and fulfillment.

Embrace uncertainty, unleash creativity

Between Chapters 1 and 9, Fields goes into detail about what it takes to “lean into” uncertainty as you pursue your dreams and goals. He effectively dissects the fear of failure and gives the reader tools to nurture creativity, to the point where it becomes possible to change plans when needed.

And so, after describing both the physiology and the psychology of uncertainty, Fields devotes several chapters to two main concepts:

1. training mind and body through the routines of meditation and exercise, which help the creator release work from his/her mind
2. “socializing creation,” which provides the creator with a way to get feedback even as a work is in progress.

I can think of many forensicators to whom exercise is a critical part of success, and I’m implementing Fields’ recommendations in my own daily life as a creative. However, it’s the latter concept I want to focus on, because it speaks directly to the “community” discussion.

A forensicator’s fear of looking stupid or failing is not, on its face, all that irrational. Who wouldn’t worry about how one’s employer or a courtroom will react to the disclosure that you don’t have all the answers?

But contributing to the community is not about giving something up; it’s about a give-and-take of knowledge and skill. You would not have gotten to where you are without others’ help (no matter how alone you felt at times).

Therefore, worrying about how other forensicators will react is not rational. The conversation from the last few weeks demonstrates a ready-made “hive” of trusted professionals. These people will offer feedback and advice towards anyone’s goal of creating something useful, be it a piece of software or a presentation. Do the work, and you’ll get the support.

Make it a closed hive, if you must; I’ve experienced the nasty side of hypercompetition, and the DFIR industry has no shortage of it. But Fields argues that we need judgment in order to be valuable, that creativity needs constraint to birth something useful. Involve others early on, and not only do you get that constraint; you also get the support and validation you’re fearful you won’t get.

Committing to your calling

“How committed are you to the specific endeavor?” Fields asks. “Is it a project or a calling, the thing you can’t not do? Understanding the difference informs the choices you make, but it also changes the way you act in a thousand tiny ways. It changes your personal energy and leads people either to buy in on an extraordinary level or to view your quest as something not all that important.”

In life we are all driven by the desire to be important, in varying degrees. For some, being important to one’s own children is the highest calling. For others, it’s importance to the local community as a public safety professional, journalist, or business owner. Others want to be important to a cause, such as stamping out cybercrime.

Contributing to the community is as much about self as it is about the group. Paradoxically, protecting self from the pain of failure ultimately starves self along with community; whereas contributing feeds both self and community, nurturing knowledge for all.

Edited: Over on Google+, Gregory Pendergast asked me for a more direct assessment of the book itself. Here’s what I told him:

It’s positive and practical. Nothing “The Secret”-ish about it; I was a little surprised to see such an emphasis on meditation (“attentional training”) but even that resonated because I have experienced brief times when deep contemplation or focus on exercise  (for instance, swimming) worked exactly as Fields was saying it does.

The writing itself is clean and direct, and I liked that Fields would state an idea early on, then circle back around to it once it had had a chance to percolate in the back of my head. Chapters built nicely on each other, and the book has stuck with me in the weeks since I read it, like quiet encouragement to stick with the good habits.

With thanks to Conversation Agent Valeria Maltoni for her generous gift of Uncertainty. Here’s her Amazon affiliate link if you like what you’ve read and want more.

Substitute “write” for “program” and you’ll see a statement that novelists, journalists and other authors have been hearing for decades. The thing is, looking at Harlan’s list (case studies, book reviews, even asking questions), I can see how those “simple” suggestions might be just as intimidating as reading the Rob Lee post that started it all.

William Zinsser (one of my very favorite writing authorities) wrote in On Writing Well:

Take an adult chemist or physicist or engineer and ask him or her to write a report, and you’ll see something close to panic. “No! Dn’t make us write!” they say…. They were told at an early age by an English teacher that they don’t have “a gift for words.”

Which is criminal. As Zinsser goes on to explain:

“Writing, demystified, is just another way for scientists to communicate what they know…. Describing how a process works is valuable for two reasons. It forces you to make sure you know how it works. Then it forces you to take the reader through the same sequence of ideas and deductions that made the process clear to you.”

That sounds an awful lot like the standard for “reproducible” to me!

Helping the reader identify with your work

My observation is that most of the DFIR practitioners who are active on Twitter and Google+, also keep blogs; many also teach. In other words, they already communicate in a way that, as Zinsser suggests, “…take[s] much of the mystery out of science writing by helping the reader to identify with the scientific work being done.”

You can do that, he explains, by telling a story from your own experience, or someone else’s; relate your science to something the reader is already familiar with and can easily visualize; writing clearly and sequentially, pacing what you explain.

But how many are out there, reading these blog posts, thinking to themselves, “Yeah but… I can’t write”? Or feel as if they’re doing all the writing they already wish to do in their reports?

I’m going to estimate that these readers fall into two camps:

1. Those who yearn to be better writers, more effective communicators. They’d like nothing more than to blog and tweet and write trade articles and maybe even a nonfiction book or novel that draws on their experiences. But they’re terrified of looking stupid.
2. Those who could not care less about writing more, or they’re too busy to put the work into it… but they’d nonetheless like to contribute more to the community, although they aren’t sure how.

Communicating DFIR experience through writing

Harlan’s suggestions are right on the money, but I posit that for people who are not in the practice of writing regularly, it can be hard to figure out where to get ideas. Two posts I’ve read recently describe seven easy ways to turn old content into new content, and ten mindful ways to use social media.

These posts suggest things like:

• making blog posts out of LinkedIn conversations
• turning blog comments into new blog articles, or written content into video
• knowing your intentions before posting
• sending “random tweets of kindness” offering help
• responding with your full attention

One article is purely about content creation. The other is about the attitude you need for creating good, valuable content. Both worth a read, and worth deeper thinking about how you can contribute.

Contributing without writing

Those of us who love the way a spirited Twitter chat rolls along have trouble understanding those who don’t just jump in, or indeed, who don’t even understand Twitter. There are plenty, though, and I’d like to see the DFIR community come together to use tools like Google+ Hangouts or group podcasts. In other words: natural conversation, for those who are more comfortable communicating by voice.

I also want to put in a plug for getting more involved with professional associations, volunteering on some level as a board member or event organizer or committee member. I know: employers can be stingy with the time you take for this kind of thing. But it can benefit them, too — corporate citizenship is a term I’m hearing more and more about, and building into some of my clients’ strategies — and can be a way for you to contribute in a way that fits you best.

Where do you feel you’ve fallen short in the community? How do you think you might improve?

photo credit: opensourceway

How do you find #DFIR examiners to beta test your tools?

If you’re a small and/or unknown digital forensic tool provider, getting people to beta test your tool(s) may be a challenge. Ideally, you’re located in an area where you can partner with local labs and their experts. But what if you want to expand into a new geographical location, or you’re so new that the local experts don’t know who you are?

I asked the digital forensics/incident response experts on Twitter and Google+ what they thought:

Fill a need

“In my corporate work,” wrote Joseph Shaw on Google+, “we find that our investigations always fall within a very strict set of technologies and use cases, so the only time we look at a new tool is if it does something we really need done and can do it faster and cheaper than an existing tool we already use.”

Shaw’s lab follows the same procedures as Stacey Edwards’, who wrote: “We test both new products and new versions of old products against a standard set of data. If the results match what we would expect, and the product is affordable, more stream-lined, or runs faster, then we’ll proceed with it. If the product does nothing extra for us, then we’ll typically pass on it for the moment, but we may decide in the future to go back to it.”

“For me, it was a new product with a lot of potential, that would fill a void in email processing,” tweeted Frank McClain, “and that’s usually what gets my attention: new, potential, unique and that does something interesting; something I relate to, think I can help with.”

Filling a need is also about making it easy for the users. Any demo needs to provide full access, not limited features. “If I have time and the vendor makes it easy to obtain, I’ll test it and compare to end results [from established tools],” tweeted Daniel Parsons. “The no namers tend to be buggy and ease of use is still low, but you never know what you’ll find.”

Finally, as the “Big Kahuna” tweeted, “bragging rights” can be important. Examiners who are involved with tool testing should be able to say so, as it enhances their credibility as well as yours.

Be available

Where do users find out about new forensics tools — i.e., how might you let them know about yours? Says Edwards: “Twitter, email lists, blog posts, etc is usually how we find out about them. Or, if we have a need such as ‘products that convert OSTs to PSTs,’ we’ll poll people and do a Google search. It’s typically a need arises first, then we’ll do the searching and testing.”

This highlights the importance of two tools: SEO, and social media. Anticipate the keywords your intended customers will use. And follow — and engage — with them using social tools. Twitter and Google+ have the strongest digital forensics followings, though some LinkedIn groups may net good feedback as well. In addition, forums like Forensic Focus continue to be important to many users.

Likewise events. “I just demo’d the new Oxygen Suite 2011 because they gave it at #htciacon [the HTCIA Conference],” tweeted Parsons. Earlier in the year, at the Techno Security/Mobile Forensics Conference, Cellebrite made available a demo of its latest version of Physical Analyzer software. They made their demo part of a contest, in which participants underwent a timed analysis for the chance to win a new BlackBerry PlayBook. (Disclosure: Cellebrite is a client.)

Most of all, community

The digital forensics/incident response community is all about its relationships. Good investigators know that the time to build them is before you need them, and it’s no different for companies seeking beta testers. Get involved early and often — months before you need testers.

McClain, who seeks open source tools, looks to build relationships “with smaller developers, other forensicators (like [Andrew Case]) who build tools for the community,” he tweeted. Likewise Gilbert, who relies on word of mouth to find out about noncommercial tools, and on his relationships with vendors for commercial tools. “Usually [there are] no true betas on production work,” he tweeted.

Are you an examiner who has participated in beta testing, or a vendor who has asked examiners for help? Leave a comment — how do you prefer to make these connections?

Image: dpstyles via Flickr

What can you accomplish as part of your community?

Eric Huber’s post about Guidance vs. AccessData touched a nerve (as you’ll see from the comments I left there). Over the last 18 months of business-building, I’ve read many a blog from marketing/public relations/social media people who all say the same basic things:

• If you want loyal customers who consistently buy your products and services, build relationships with them.
• Connect those customers to one another via your products and services.
• Your relationships with them, and theirs with each other, constitute a community.
• Be part of that community, not outside it or over it.

These are the values that create loyalty over the long term. They are part of an organization’s culture. And I worry that too many digital forensic solutions providers, at least the “big guns,” are not part of the community they serve. They’re too focused on competing with one another.

Community vs. competition

It’s not just what I’ve heard and read that leads me to say this. It’s the almost complete lack of presence on social networking sites. There are exceptions — the SANS Institute and AccessData, both of which  put out valuable information as well as engage customers — but most everyone else? Might have a presence via blog or Twitter or LinkedIn, but only rarely update.

Which is a shame, because they’re missing out on a phenomenal little community. A community of developers and examiners, investigators and problem-solvers, many of whom blog or podcast their thoughts and expertise. What if forensic brands regularly joined these daily conversations?

I suspect one or more of several reasons why they don’t:

• They’re afraid of getting too cozy, of the chance that an off-the-cuff comment might betray an important secret.
• Their PR staff running the social networking show aren’t privy to enough of what’s going on in the company.
• Their PR staff know plenty about what’s going on in the company, but not enough of what’s going on in the industry to be able to talk about it.
• They’re afraid the competition will go after customers with whom they actively engage online.

There are probably at least a few more reasons. But the upshot is, even if they are monitoring the blogs and podcasts, they are still too busy looking sideways to focus on things the community wants and asks for beyond product-specific features. Of such needs and desires is innovation born, and companies too focused on remaining the leader of the pack can never rock their customers’ world by breaking free and doing something truly special.

Sure, they might offer intriguing and even ground-breaking information in conference labs or lectures… but those only reach the people who are there. And you can’t earn loyalty by taking business cards and putting the email addresses you find there on an email list that spits out the same content. Loyalty comes after customers recognize that you’re trying to make their lives better: easier, faster, more efficient.

Community-building as business strategy

So whether it’s great content that teaches, great products that help them do their jobs, great customer service that solves their problems, or (best of all) some combination of the three, good value-adding, community-building strategy has got to be part of more forensic vendors’ offerings. You’re not helping digital investigations by keeping your cards close to your chest, and you may even be making them harder.

All the while, you’re leaving a gaping wide opening for community members who do understand each other’s needs to come along and take what you’ve been taking for granted all along: customer loyalty.

Because at that point it won’t be about the products anymore. It will be about all the intangibles that go with them: the things you can never compete with because your C-suite isn’t willing to share enough of its passion, values, personality, the things that drove the company into the digital investigations industry to begin with.

What can you do today to become more fully a part of the investigative community?

Image: diamondmountain via Flickr