Authoritative vs Authoritarian
This article is adapted from a corporate newsletter article I wrote. I have only changed the parts that would leak corporate information.
I speak often about my stance on traditional security teams at many companies. Often they are the Department of No, they act like they are the police, and they aren't very technical. As a result, employees in other departments speak to them only as a last resort and ultimately the security team becomes balkanized and blind to what's going on at the company.
To wit, I'd like to offer a perspective on the contrasting ideas of authoritative versus authoritarian. Authoritative means to be a knowledgeable, trusted resource for people to go to when they need guidance. Authoritarian means being in control, making the decisions and, often, being feared as a result.
I'll go out on a limb and say that nobody likes authoritarians or wants them around. My central goal is that a company's security team is authoritative.
But this comes at a price.
When someone is seen as authoritative by other people, that is the judgement of those people. An authoritative person can't take control (that'd be authoritarian). So the people make the judgement to trust the authoritative person and, over time, this trust increases–this is good. But the people have a responsibility to play that often isn't spoken about.
The authoritative person is perhaps a good resource for one or more topics. They want to be trusted, but they don't want to be in control. If the people listening to the authoritative person don't ask questions, don't provide feedback, don't challenge, or delegate their actions and thinking to the authoritative person, they are converting the authoritative person into an authoritarian. In effect, they are ceding control over to the person they trust. And this conversion can happen insidiously.
The more decisions that are delegated to the authoritative person, the more they are required to control the outcome. The more the authoritative person isn't provided with feedback, the more out of touch with others they become. An authoritative person wants to share knowledge and solicits feedback to gain a better understanding.
While my goal is to ensure a company's security team is authoritative and stays far away from authoritarianism, it is really up to everyone to ensure that the members of the security team are not turned into authoritarians. Because once an authoritarian is created, it is very hard to revert to being authoritative. People have a visceral dislike of authoritarians and can sniff one out instantly–it's just that they may not be fully aware they've done so. The ultimate fate of an authoritarian is to be removed, and that creates a power vacuum. But at least in the case of an authoritative person being turned into an authoritarian against their wishes, it is a sad result but one that goes away without much fuss. The risk then is that the power vacuum is filled with someone who is a true authoritarian, and that would be very bad for the organization and its employees.
So while I strive to be authoritative, please remember that you–dear reader–have a responsibility to ensure that you do not turn me into an authoritarian. Speak up. Ask questions. Challenge. Give feedback. All of this can be done respectfully and it ensures that the proper checks and balances are in place.