Selling cybersecurity to superiors --- Great exchange, friends! I like the two practical steps (there may be more) that you outline: 1. A high-level champion / Tone from the top 2. A realistic simulation / Fear

On 1., a government champion at the Ministerial level may just show up, but this is not often; an alternative is to build one. This requires time and efforts, but is possible: a smart Minister, invited to be a speaker at the relevant (international) conference on cybersecurity, would ask to be briefed about this. A good briefing with the right person(s) could make him/her attracted to the topic, and dig further to show off as being smart - and realise that this topic offers future opportunities for visibility and leadership. One example I witnessed was when a Minister planned for about 30min for such a briefing prior to an important conference, yet ended up discussing the issue with the experts for almost 2 hours - and performed great at the panel, in fact (without any prior knowledge on the subject)! Thus - make sure you grow the Ministerial champion, don't leave it to chance.

On 2., while organising an effective simulation in controlled circumstances is not easy (and putting down all systems just to show the effect might be dangerous for those attempting this :), often we don't use the real crisis to the right extent. Almost every national incident - even of the smaller scale - could be used (with bit of exaggerated drumming) to extrapolate what could have happened if... and raise the attention (and fear) of the decision makers. Thus - don't waste (any) crisis!

Source author: Vladimir Radunovic vladar@diplomacy.edu