[ISN] Going to InfoSec: five things to remember

[InfoSec News]

http://www.techworld.com/infosec/features/index.cfm?featureid=1360

By David Cartwright
Techworld
15 April 2005

Although there aren't so many IT shows going these days as there were, 
say, five years ago, it's fair to say that the average IT manager 
could still spend a reasonable slice of his or her life attending such 
events. The attraction of a trade show in particular is that you're 
given - potentially, at least - the opportunity to look at a wide 
range of competitor products in a single hit, to see them with your 
own eyes, and to ask questions about them. The downside is that it's 
very easy to lose your focus and get negligible value out of what ends 
up as a wasted day. Here, then, are the top five things you should be 
thinking about when you get ready for your trip to InfoSec - or any 
show for that matter.


Why am I going?
 
To some, a trade show is a day out of the office. Not a bad thing if 
it exposes you to the current state of the art in technology, but 
remember that by taking a day out, you're giving yourself a 
catching-up exercise to look forward to on your return.

The first thing to consider, then, is the reason you're thinking of 
going. Because most shows tend to offer you free registration, and 
will post you your shiny plastic delegate badge in the week or two 
running up to the event, it's easy to sign up and then feel compelled 
to turn up. Before you do either, then, read the blurb (there's 
usually an exhibitor list on the website) and ask yourself whether (a) 
the stuff on show is relevant to your day-to-day job; and (b) if so, 
you're actually in the market for any of it.

If the subject area isn't really your field, you're likely to have a 
boring day - why not see if one of your colleagues, to whom the show 
would be more relevant, would think of going instead? If the material 
is relevant to you but you don't have any looming purchasing plans, 
this isn't an automatic "don't go" decision but in order to make the 
trek you should be comfortable that you're at least going to learn 
something about what's new in the trade.

Am I looking for anything in particular?

If you have a specific requirement and there are going to be several 
companies in the relevant field(s) at the show, it's pretty much a 
no-brainer that you should go along. This is particularly the case 
with high-end and/or hardware products - although you can get eval 
copies of small and medium software products to play with in the 
office, the same isn't true for high-end expensive kit unless you're a 
massive company with the clout to demand that vendors come and show 
you stuff. So the more high-end your specific requirements, the more 
likely it is you should go along, because it's the only way you're 
really going to get an initial glimpse of it in action.

Before you go

Preparation is the key to a successful trade show visit. You need to 
look up the exhibitor list, dig out the floor plan, download PDFs of 
their product blurb, speak to distributors for pricing, and generally 
research the subject to death well before you physically go there to 
see who's worth visiting and who isn't.

There are two types of exhibitor at a show: those you can figure out 
beforehand, and those you can't. They're differentiated by the quality 
of their marketing documentation - the good ones tell you in the blurb 
what the product does; the bad ones tell you they make "extensive 
security portfolio solutions for forward-thinking businesses" but you 
want to go see them just in case the product you want is somewhere 
behind the bullshit.

When you've decided who you want to go and see, draw up a tentative 
timetable as a guide to how long you can spend with each company. 
There's no way you'll stick to it rigidly, so don't spend hours on it, 
but you need something to remind you that you can't see 20 companies 
in a day if you're wasting half an hour with each. 

A final note on this topic is that if you are bored, you might like to 
call the companies you're particularly interested in seeing at the 
show and trying to arrange specific appointments. It won't work nine 
times out of ten, but you sometimes get lucky.


Do I care that it does that?

When you're being rambled at by a sales droid on a stand, you'll find 
that he or she (but usually he) loves to tell you about all the nice, 
unique features of the gadget in question. If they're really on form, 
they'll also tell you about the special way that their product does 
the job, which is way better than the competition.

Remember to engage your cynicism circuits before interacting with such
individuals. Some good questions are: 

* "If your system is unique,
doesn't that make it proprietary and thus unable to interface to the
one I've already got from X?"

* "That's an interesting range of connectors, but where's the RJ-45 I 
put my Ethernet into?"

* "Okay, yours is the fastest in the industry, but it's only 1.2 
percent faster than X's, so do I give a stuff?"

Obviously you'll have to pick some key questions that fit the subject
in question, but you get the idea - namely that what matters is what
they don't tell you. And ask them things like "What new features are
planned for the next versions?" - remember, the "fab new features" in
the next release may well be the things they forgot to put in the
current one.


Shows are also for the vendors?

The vendor's mission at a trade show is to get as many names as 
possible on to the mailing list. They're not there to show you their 
wares, because it's an incredibly inefficient place to do so. Let's 
face it, they have a handful of staff and several thousand potential 
customers, and thus the time they can spend per customer is next to 
nothing. So unless you're the CTO of a billion-pound company, you're 
not going to get any real value out of turning up at a stand and 
saying: "Tell me about X". (And if you are the CTO of a billion-pound 
company, you don't need to go to shows - you phone them and say: "Hi, 
come and bring me one to play with").

Do not expect, then, to be treated with anything but polite contempt, 
or to hear anything but a marketing line. Learn as much as you can 
prior to the show (as we said earlier) and ensure that you prioritise 
the companies you need to see because you have specific questions 
about their products. You'll only get to interact with a handful of 
them at the show itself, so make sure you start with the ones you care 
most about.


Summary

Tradeshows are hard work and you get at best modest value from them. 
To maximise the benefit from going, though:

* Plan before you go, so you make the most of your time at the show 
asking questions that aren't covered by the marketing material. 

* Just as you would with any salesperson, take everything that's said 
with a healthy pinch of salt, and remember that what's not said is as 
important as what is. 

* Don't expect to spend hours on one stand, because neither you nor 
they have the time, but if you go armed with good questions (i.e. 
those whose answer isn't: "as you'll see from page two of the 
brochure") you'll get more value and the vendors will spot that 
you're not just a techno-muppet. 

* They want to get your details from your delegate badge so they can 
market to you. Make sure you get their salespeople's contact details 
too, so that you can follow up once you've had a chance to digest 
everything you've seen.