From Dork to Diplomat: Communicating Coherently for Vulnerability & Incident Response

From Dork to Diplomat: Communicating Coherently for Vulnerability & Incident Response

Speakers: Tom Millar (CISA), Rina Rakipi (CISA)

Conference: FIRSTCON

YouTube: https://www.youtube.com/watch?v=W4jTVILwd18

Overview

In the fast-paced and high-stakes world of cybersecurity, effective communication is as critical as technical prowess. This talk, "From Dork to Diplomat: Communicating Coherently for Vulnerability & Incident Response," delivered by CISA experts Tom Millar and Rina Rakipi at FIRSTCON, addresses a pervasive challenge: bridging the gap between highly technical security practitioners and the decision-makers who need to act on their findings. The speakers, self-proclaimed "dorks" in their technical fields, aim to equip their audience with the strategies to become "diplomats"—individuals capable of distilling complex "engineer speak" into clear, concise, and actionable intelligence.

The core message of the presentation revolves around the necessity of a strategic shift in how cybersecurity professionals communicate. While brilliant technical discoveries are abundant, their impact is often diluted or lost due to poor communication practices, such as excessive detail, lack of specificity, absence of clear courses of action, and failure to convey urgency. Millar and Rakipi argue that by adopting specific frameworks and cultivating strong relationships, practitioners can ensure their insights lead to timely and effective incident response and vulnerability remediation, ultimately enhancing an organization's security posture.

This article delves into the practical frameworks, strategic shifts, and essential soft skills advocated by Millar and Rakipi, providing a comprehensive guide for cybersecurity professionals aiming to elevate their communication game. From structuring critical alerts using the BLUF (Bottom Line Up Front) method and Five W's to navigating political sensitivities and fostering inter-organizational relationships, the insights shared are invaluable for anyone involved in cybersecurity incident and vulnerability management.

Background

▶ Watch: Introduction: From Dork to Diplomat (0:00)

The problem addressed by Millar and Rakipi is deeply rooted in the inherent nature of cybersecurity work. Technical experts, often deeply immersed in the intricacies of systems, code, and threat actor TTPs (Tactics, Techniques, and Procedures), tend to communicate using a specialized lexicon. This "engineer speak," while precise and necessary among peers, often becomes a barrier when conveying information to non-technical stakeholders, senior leadership, or even colleagues in different operational domains. The speakers highlight several common pitfalls that sabotage effective communication:

• Too much detail / Rabbit holeing: Conversations become bogged down in minutiae, diverting from actionable outcomes. A personal anecdote shared by Millar illustrates how an "incredible" finding—a threat actor's engineering workstation involved in novel TTPs across three incidents—was initially presented as "six, seven paragraphs of a bunch of findings with an 11-page document filled with screenshots and evidence and technical jargon." This overwhelming detail delayed action for several days.
• Not specific enough: Vague language leads to confusion and misinterpretation.
• Word choices matter: Ambiguous terminology can hinder shared understanding.
• No courses of action: Reports often detail findings without specifying what needs to be done, leaving the burden of interpretation on the recipient, which is detrimental when "time is of the essence."
• No indication of urgency: Without a clear timeframe (e.g., "solve this within the next 72 hours"), prioritization becomes difficult, and critical issues may be overlooked.

Beyond these communication failures, the speakers emphasize the organizational context. Modern cybersecurity division operations involve multiple teams with diverse equities—from vulnerability prevalence insights to threat actor TTPs and international partnerships. Effective response requires shared ownership of information, collaboration, and a shift from reaction-driven engagement to proactive relationship building. Without established points of contact and communication channels, incident response is inevitably delayed, especially when organizations frequently reorganize. This foundational understanding sets the stage for the practical solutions offered in the talk.

Key Findings

▶ Watch: Strategic shift: Build proactive relationships (7:40)

The central "key finding" of the talk is that effective communication in cybersecurity is not merely a soft skill but a strategic imperative that directly impacts an organization's ability to respond to and mitigate threats. Millar and Rakipi present a series of actionable insights and strategic shifts designed to transform technical experts into effective communicators:

1. Strategic Communication is Essential for Action: Brilliant technical findings are useless if they cannot be understood and acted upon by decision-makers. The goal is to distill complex information into a format that enables swift action and resource allocation (human, financial, time).
2. Shift from Reaction to Relationship: Proactive relationship building with internal and external partners is critical. Knowing who to contact and their preferred communication methods before an incident arises significantly reduces response times and friction. This includes maintaining relationships even through organizational changes.
3. Collaborative Information Sharing: In multi-team environments, shared ownership of information is paramount. There should be "no hoarding of facts" or control of information flow; rather, a collaborative approach where a single briefer represents the collective intelligence of a team.
4. Structured Communication Frameworks: Specific frameworks enhance clarity and impact:

• BLUF (Bottom Line Up Front): Immediately convey the core message ("what happened, why it matters") and save details for follow-up questions. This is crucial when briefing senior leaders with limited time.
• The Five W's (Who, What, Where, When, Why) + Sometimes How: Provides a comprehensive summary without immediately diving into technical "how" details, which should be reserved for specific inquiries.
• Threat to Impact: Clearly articulate the potential consequences of a vulnerability or incident (e.g., "a novel vulnerability in critical infrastructure products... could shut down water plants in an entire region"). This quantifies urgency and potential severity.

1. Appropriate Communication Mode Selection: The choice of communication channel (email, chat, verbal/video call) should align with audience, time constraints, and urgency. Verbal communication is highlighted as the highest bandwidth option for critical situations requiring immediate attention and nuanced discussion.
2. Managing Political Sensitivities and Disagreements: In situations with differing personalities or misaligned incentives, starting with a shared goal or point of agreement can foster positive momentum. It's crucial to acknowledge and respect differing equities. The "goats and stars" framework (rating your day and the difficulty of the conversation) helps practitioners choose the right time for difficult discussions.
3. Gradual Escalation: When issues arise (e.g., personality friction, single points of contact), escalation should be gradual and thoughtful, starting with immediate supervisors, rather than jumping to the highest levels, to maintain relationships and effective problem-solving.
4. The Triple Constraint for Information Flow: Communication quality is governed by a trade-off between accuracy, timeliness, and comprehensiveness. Achieving all three simultaneously is often impossible. For example, accurate and timely communication may not be comprehensive, while accurate and comprehensive communication will take more time. This model helps manage expectations.
5. Fundamental Soft Skills: Beyond frameworks, basic human decency—being nice, establishing rapport, admitting when you don't know, moving with urgency, and knowing your audience—are foundational to successful communication.

These findings collectively underscore that effective communication in cybersecurity is a deliberate, learned skill set that integrates structured frameworks with interpersonal intelligence, ultimately driving better security outcomes.

Technical Deep Dive

▶ Watch: Case study: Overcoming communication pitfalls (17:30)

While the talk itself is focused on communication of technical details rather than a deep dive into specific technical vulnerabilities, it provides a robust framework for how to effectively convey complex technical information to diverse audiences. The "technical deep dive" here, therefore, refers to the mechanisms for translating "engineer speak" into actionable intelligence.

The speakers emphasize that the "how" – the intricate technical details of an attack or vulnerability – is often best kept in reserve, ready to be deployed if specifically requested by a technical audience or during a deep-dive session. Instead, the focus for broader audiences, especially senior leadership, should be on the threat-to-impact and the bottom line.

Millar and Rakipi present three key frameworks for structuring communication around technical findings:

1. BLUF (Bottom Line Up Front): This principle dictates that the most critical information—what happened and why it matters—should be presented immediately. For example, instead of detailing the specific exploit chain, a BLUF statement might be: "A novel vulnerability in critical infrastructure products, highly prevalent across the sector, could lead to the shutdown of water plants in an entire region." The technical details of the vulnerability (e.g., specific CVE numbers, exploit techniques, affected software versions) are kept readily available but not offered upfront. This allows decision-makers to grasp the gravity and relevance without being overwhelmed.
2. **The Five W's (Who, What, Where, When, Why) and Sometimes How:** This classic journalistic framework is adapted for cybersecurity communication.

• Who: Which threat actor? Which organization is affected?
• What: What is the vulnerability or incident? What is the core finding?
• Where: Which systems, networks, or geographic regions are impacted?
• When: When was it discovered? When did the activity occur? When is the patch expected? This "when" is particularly crucial, as the urgency of "scanning of systems versus active exploitation are two different things."
• Why: Why is this significant? Why does it matter to our organization or mission?
• How (Sometimes): This is where the technical deep dive resides. "How did the threat actor do the thing that he or she did?" This includes specifics like attack vectors, exploit techniques, malware families, command and control (C2) mechanisms, or initial access broker methodologies. The speakers explicitly state, "Keep that how for later and only if asked about."

1. Threat to Impact Statements: This framework directly links a technical threat to its potential business or operational consequences. For instance, instead of merely stating "CVE-2023-XXXXX affects XYZ product," the communication should be: "A novel vulnerability in widely used critical infrastructure products (the threat) could enable adversaries to shut down water plants in an entire region (the impact)." This contextualizes technical risks into tangible, high-level business risks that resonate with non-technical leaders and drive prioritization.

The talk also touches upon the technical challenge of CVE numbering rules, acknowledging that disagreements on what constitutes a vulnerability can be a point of contention even among technical experts. This highlights the need for clear, agreed-upon definitions and potentially third-party mediation (like CISA provides) for coordinated vulnerability disclosure scenarios.

Furthermore, the discussion on communication channels includes specific technical tools:

• Microsoft Teams: Mentioned as a common platform where overwhelming technical details are often shared.
• Signal: Recommended for "out-of-band communication" with close partners, indicating its use for sensitive or urgent discussions.
• CISA KEV (Known Exploited Vulnerabilities) Catalog submission form: Plugged as a formal "front door" for the community to suggest vulnerability inclusions, demonstrating a structured technical input mechanism.

In essence, the "technical deep dive" from this talk is a meta-analysis of how to present technical information effectively, emphasizing clarity, conciseness, and audience awareness over an exhaustive enumeration of technical minutiae in initial communications.

Demo / Proof of Concept

▶ Watch: Triple constraint for information flow (23:20)

The talk did not feature a live technical demonstration or a software proof of concept. Instead, Millar and Rakipi utilized a case study to illustrate the principles of effective communication in a high-pressure incident response scenario. This approach served as a practical "proof of concept" for their communication frameworks.

The case study described a culmination of high-pressure incidents where an APT actor began employing a novel vulnerability on a highly prevalent system. While specific names and details were intentionally vague due to the TLP (Traffic Light Protocol) Clear nature of the talk, the scenario provided concrete examples of what worked, what didn't, and how communication evolved:

• What worked: Bringing the right people into the room, leveraging established relationships with partners, and knowing internal stakeholders.
• What didn't work: Personality friction, disagreements on labels (e.g., "CVE numbering rules are out of scope for this presentation" was humorously interjected to describe the complexity of vulnerability definition disagreements), and reliance on a single point of contact, which created significant bottlenecks and risks if that individual was unavailable.
• Communication Evolution: The key lesson was gradual escalation. Instead of immediately contacting senior leadership over minor disagreements, issues were first discussed with immediate supervisors. Escalation to higher levels only occurred when the situation was "inhibiting our ability to reduce risk" and the risk was deemed "severe enough." Other crucial elements included respecting each other's time and effort, recognizing partners' missions, and converging on shared goals (e.g., "reduce risk").

This case study served as a powerful narrative demonstration, proving that the abstract communication frameworks presented (BLUF, Five W's, relationship building, gradual escalation) have tangible benefits in real-world, high-stakes cybersecurity incidents. It effectively showed how shifting communication strategies can transform a chaotic, friction-filled response into a collaborative, risk-reducing effort.

Defensive Implications

▶ Watch: Q&A: Communicating priority to CISA (28:00)

The defensive implications of Millar and Rakipi's talk are profound, directly impacting how organizations can bolster their resilience against cyber threats. By adopting the communication strategies outlined, defenders can significantly improve their incident response capabilities, vulnerability management processes, and overall security posture.

1. Accelerated Incident Response: The primary defensive benefit is faster and more effective incident response. By using frameworks like BLUF and Threat to Impact, security teams can quickly convey critical information to leadership, enabling rapid decision-making and resource allocation. This means less time spent "wrenching the genius out of my genius" and more time spent on actual remediation. The ability to articulate urgency (e.g., "solve this within the next 72 hours") ensures critical vulnerabilities or active compromises receive immediate attention, preventing wider damage.
2. Proactive Relationship Building: Defenders should actively cultivate relationships with internal stakeholders (legal, PR, IT operations, senior management) and external partners (peers, national CERTs like CISA, vendors). This ensures that when an incident occurs, the necessary channels and points of contact are already established, avoiding delays and miscommunication. Knowing who to call on Signal for out-of-band communication or who handles CVE numbering rules disagreements in a partner organization is a critical defensive asset.
3. Enhanced Vulnerability Management: For vulnerability response, clear communication of the Five W's and Threat to Impact helps prioritize patching and mitigation efforts. When engaging with vendors or researchers in coordinated vulnerability disclosure (CVD) processes, the advice on managing misaligned incentives and leveraging third-party mediators (like CISA) can prevent impasses and ensure timely disclosure and patching of flaws. The mention of CISA's KEV submission form highlights a practical defensive tool for ensuring critical vulnerabilities are on the radar of national agencies.
4. Improved Resource Allocation: By clearly articulating the "why it matters" and the potential impact, security teams can more effectively advocate for the resources needed to address threats. This includes investments in human capital, technology, and time. When leadership understands that a "novel vulnerability in critical infrastructure products... could shut down water plants in an entire region," they are more likely to approve necessary defensive measures.
5. Reduced Organizational Friction: The advice on managing political sensitivities, starting with shared goals, and gradual escalation helps prevent internal and external disagreements from hindering defensive operations. This fosters a more collaborative environment, essential when multiple teams (e.g., threat hunting, vulnerability research, partnerships) have equities in a response.
6. Strategic Communication as a Defensive Skill: The talk reframes communication itself as a core defensive skill. Just as firewalls and endpoint detection and response (EDR) are technical defenses, the ability to "play a bit of a different song" for different audiences (engineers vs. policy people vs. directors) is a strategic defense against misinformed decisions and delayed actions.
7. Managing Information Flow (Triple Constraint): Understanding the trade-offs between accuracy, timeliness, and comprehensiveness in communication allows defenders to manage expectations during an incident. For example, in the early stages of a breach, timely and accurate (but not yet comprehensive) information is more valuable than a delayed, perfectly comprehensive report. This deliberate approach to information flow is a tactical defensive advantage.

In summary, the defensive implications revolve around operationalizing intelligence through superior communication. It's about ensuring that the hard work of technical defenders translates into informed decisions and swift actions across the entire organization, ultimately strengthening its ability to detect, respond to, and recover from cyberattacks.

Key Takeaways

• Prioritize Actionable Communication: Distill complex technical findings into clear, concise, and actionable intelligence using frameworks like BLUF (Bottom Line Up Front) and the Five W's (Who, What, Where, When, Why) to ensure decision-makers can act swiftly.
• Quantify Impact and Urgency: Always articulate the Threat to Impact (e.g., "could shut down water plants") and provide specific timeframes (e.g., "solve this within the next 72 hours") to effectively convey the severity and urgency of a cyber threat.
• Cultivate Proactive Relationships: Build and maintain strong relationships with internal and external partners, establishing clear communication channels and points of contact before an incident occurs to avoid delays and friction during critical response periods.
• Tailor Your Message to Your Audience: Adapt your language and level of detail based on who you are speaking to (e.g., engineers, senior leaders, policy makers), saving deep technical "how" details for when they are specifically requested.
• Embrace Soft Skills and Gradual Escalation: Foster a collaborative environment by being respectful, admitting when you don't know, and managing disagreements through shared goals and gradual escalation rather than immediate high-level intervention.
• Strategically Manage Information Flow: Recognize the triple constraint of communication (accuracy, timeliness, comprehensiveness) and make deliberate choices about what information to prioritize based on the situation's demands, understanding that you often cannot achieve all three simultaneously.

About the Speaker(s)

Tom Millar is an expert from CISA (Cybersecurity and Infrastructure Security Agency), specializing in vulnerability response and threat hunting. He is part of CISA's threat hunting side of the house within the cybersecurity division operations. Millar is known for his ability to translate complex technical findings into actionable intelligence for senior leaders. His personal anecdote about owning 36 pairs of Converse and matching them to his outfit highlights his approachable yet detail-oriented personality. He actively engages with the community, promoting resources like CISA's new KEV submission form for community-suggested vulnerability inclusions.

Rina Rakipi is also an expert from CISA, working within the operations side of the house, specifically involved in cyber division operations meetings. She is responsible for ensuring senior leaders receive distilled information to advise on and make critical decisions regarding cyber incidents and vulnerabilities. Rakipi emphasizes the importance of strategic communication, relationship building, and managing political sensitivities in high-stakes environments. She brings a vibrant and "hyper and jolly" personality to her presentations, often laughing at her own jokes, which she recommends as a way to foster rapport and manage stress in the demanding field of cybersecurity. Together, Millar and Rakipi leverage their complementary expertise to provide a holistic view of effective communication in incident and vulnerability response.