In June my brother phoned me to offer my wife and me two complimentary tickets to the U.S. Open. Even though I am not a golfer, I understand this event is a relatively big deal, and took I him up on the opportunity to see the likes of Tiger Woods, Ernie Els, and Fred Couples play live at the beautiful Pinehurst #2 course about an hour away from my weekend retreat in North Carolina.
The forecast was what my brother refers to as Chamber of Commerce weather—sunny and warm with crystal blue skies punctuated by passing clouds that look like giant cotton balls. My wife and I dropped the top on her two-seater convertible and headed south. We turned up the CD player, ready to enjoy the trip as much as the planned destination.
About 20 miles into the trip, we were startled by a car horn blaring behind us. I looked over my shoulder to see a Mercury Grand Marquis with New Jersey plates begin to pass us on the right. The driver was gesticulating angrily to show us he was peeved we were cruising in the left lane of the highway at a mere four miles an hour over the speed limit. As the car passed, each of its three middle-aged male passengers—all wearing golf hats—shot us a steely glare.
I gave the driver a friendly wave and he responded by making a single-finger hand gesture I knew was not intended to tell me I was Number One, but I was enjoying the open cockpit and sunny weather too much to be annoyed. He floored the accelerator of his air-conditioned land yacht and swerved in front of us, racing ahead to the U.S. Open, no doubt.
About 10 miles later we saw him parked along the shoulder. I almost missed him because the North Carolina state trooper that was parked directly behind him with lights flashing initially captured my attention. We slowed down to honk and wave again. This time, he looked up and only gritted his teeth.
Later that day, my wife and I were seated in the viewing stands on the 15th green at Pinehurst. One of the U.S. Open contestants had dropped his initial drive on the far side of the green. The ball lay in the rough, down a little incline and out of sight of the hole. As he eyeballed this difficult shot, he swung his wedge absentmindedly at his side and managed to dislodge a piece of turf the size of a credit card. He walked back down the incline, checked his shot again, and then proceeded to chip the ball up onto the green.
After he had finished the hole and was walking off the green, one of the spectators jumped up in the stands and angrily called out, “Hey buddy, aren’t you going to fix your divot? Yeah you, you turkey! You made a divot! Now go back and fix it!” A security volunteer started toward the stands, but the big-mouth spectator had ducked out the other side. More golf angst.
As I watched the shenanigans, I was reminded of one of my first times trying to play golf. A friend had encouraged me to give the game a try, so I borrowed some old clubs and joined him at a company event. After haplessly chasing my ball around several acres of grass, my buddy and I arrived at the eighth tee to give it another go. As we waited for the party in front of us to finish, I was remarking to my friend about what I needed to learn when someone near the tee angrily spun around to shush me. I blushed, clamped my mouth shut, and sat down in the cart until the party was out of earshot.
Later, I chided my friend for not warning me about the rules for talking, eating, cigar smoking, location of the golf cart, and all manner of other peculiarities around the straightforward game of whacking a small ball with a mallet toward the small hole a long way off. He said he didn’t want me to dislike the game, and preferred to allow me to have as much fun as possible on my inaugural golf outing.
“Hey,” I responded, “it’s no fun getting chewed out by the real golfers. I’ve been checked now at least three times by other players, and I feel like a recalcitrant third grader with a bad case of ADD.”
“Well, you need to learn the rules,’ he said. “You’ll eventually get it figured out.”
On that same outing, I witnessed several incidents of obnoxious foul language, one thrown golf club, and several displays of incredibly poor fashion sense. I just didn’t feel comfortable.
I have tried golfing several more times. Each time, my experience has been similar. Most golfers seem to enjoy having performed well on a certain day or recall fondly a round on a certain course, but there always seems to be an underlying anger associated with the game. I am not a psychologist, but I cannot understand why someone would pursue a hobby that wouldn’t bring him or her some kind of enduring satisfaction or enjoyment.
Why would four guys going to the U.S. Open on a beautiful day be in such an all-fired hurry, express such disdain for their fellow motorists, and not stop to wonder why the grinning yokels with North Carolina plates are sticking close to the speed limit in an area renowned as a speed trap? I’ve sat in major back-ups going to Jimmy Buffet and Grateful Dead performances, and I do not recall one instance of untoward behavior between merry (if not fully sober) concertgoers.
Why would a spectator who dropped a C-note for a basic entry ticket feel compelled to loudly chastise a professional golfer over a tiny chunk of sod? The fine people of Pinehurst were paying an army of greens keepers and turf specialists to handle that type of problem. What value was in it for the angry spectator? It seemed he was just unhappy with his choice of sport.
In a similar vein, I often meet security professionals who do not seem to enjoy the many rewarding aspects of their chosen career. These are the practitioners who most often pursue the development and enforcement of security policy not as a means to an end, but as the end in itself. These people are rather easy to spot.
Angry security practitioners feel they alone must shoulder the burden for organizational security. Instead of working with senior decision makers to establish the security program, they develop their policies in a vacuum and only approach management seeking approval for a fait accompli. Unfortunately, many senior managers are happy to let such an onerous burden fall on the shoulders of this type of security professional. Then they know just whom they can set up as the scapegoat when something goes wrong.
Another trait of angry security professionals is an inclination to speak in absolutes. They look at security through the prism of their policies and demand compliance without regard for the dynamic organizational risk environment. They can only relate in terms of what is policy compliant and what is not.
Finally, angry security practitioners treat infractions like personal affronts. Since it is their policy, anyone who violates it must be treated like the disobedient child they appear to be. Security policy enforcement may require difficult decisions and tough calls, but in the end, it is not about you, it’s about your responsibility to provide adequate and reasonable protection of organizational assets. I may be over the top in my assessment of the angry golfer, but I am sorry to say I have too much first-hand experience with the angry security professional. If you notice someone exhibiting the telltale signs, it would be a fine thing for you to mentor your colleague. Perhaps this job is not for everyone.
If you are a golfer, I hope you weren’t the one shouting at Davis Love III during the U.S. Open. If you’re a golfer from New Jersey with an expensive speeding ticket, next time look around you, and consider why that couple in the fast yellow sports car is choosing not to wind it out on that particular highway. When in doubt, look for the radar detector on the dashboard.
John McCumber is an IT security professional and the author of Assessing and Managing Security Risk in IT Systems: A Structured Methodology from Auerbach Publications. He can be reached at [email protected].
John McCumber
John McCumber is a security and risk professional, and author of “Assessing and Managing Security Risk in IT Systems: A Structured Methodology,” from Auerbach Publications. If you have a comment or question for him, e-mail [email protected].