The Code of Ethics

I already mentioned the risk analysis project we were carrying out for Brasil Telecom. While we were running that project, the company I worked for kept trying to land other contracts with this client. On one of those occasions, the client asked for a proposal for a project that would involve contacting practically every team in the company. If I’m not mistaken, the goal was to validate access profiles. It was a last-minute request, and my boss called me asking for help finishing the proposal by the next day. Since I had two small kids and Gisele was taking an evening course, I explained I couldn’t leave the house. So I suggested we work on it at my place, after I put the kids to bed. He ended up coming over, and we worked in the living room until late.

Because our prior experience with Brasil Telecom had not been easy, we made an extremely conservative estimate of the effort required. We had had problems before because the scope wasn’t precisely defined, and then the client would pressure the company to deliver more than had been planned. In this case, maybe we were too conservative, which ended up driving the cost estimate way up. Because of that, the proposal wasn’t accepted.

Going back to the risk analysis project, it was a complicated one, not only because the client didn’t know exactly what they wanted, but also because we didn’t have experience delivering something of that size. We had a good grasp of risk analysis theory, but little idea of what kind of result would really be useful in a company of that size. Looking back, I can see that the internal political situation of our client-side department also wasn’t great. Management was clearly under pressure to deliver something but didn’t really know what. Risk analysis can be presented as a standard, almost textbook solution for a company’s security problems, but defining the scope depends heavily on a good understanding of the business and of how the company is organized. From what I recall, that understanding wasn’t well established at that moment.

When the project came to an end, they decided to give a presentation on the results to various areas of the client organization. My boss came to talk to me and said that the presentation had been requested as the final stage of the project, and he put me in charge of preparing it. In the first version I put together, I focused on the results, but I also included a relatively long section on the difficulties and problems we encountered during execution. Many of those difficulties came from the client itself, which, as I’ve already mentioned, didn’t have a clear definition of the project’s goals and lacked the political clout needed to secure time from the specialists whose input was needed to gather the data for our analysis.

My boss reached out again to say that the presentation wasn’t heading in the direction either he or the client wanted. The intention was to convey an image of a successful project. My answer came as a question: how could we talk about success in a project that, from my perspective, had been far from successful? He insisted the presentation’s angle needed to be a positive one.

At that moment, I pushed back. I took the opportunity to mention that I had earned and maintained the CISSP certification, which has a clear code of ethics. I argued that I wasn’t comfortable presenting something that could distort reality and that I didn’t want to risk compromising my certification. The conversation then shifted a bit. He said he wasn’t asking me to do anything unethical, just asking me to adjust the focus. After talking a bit more, we reached a middle ground: I would prepare a presentation more centered on the products delivered, especially the risk analysis reports, and would include, at the end, a section with strengths and opportunities for improvement. In that format, the presentation could be factual while still being constructive. I agreed and prepared a new version of the slides.

I think this was the first time in my career that I actively resisted carrying out a task I was asked to do. Even so, I don’t regret it. My stance made room for a compromise. It wasn’t exactly what I wanted, which was to say the project had important issues, nor was it exactly what my boss initially wanted. It was an important lesson. Sometimes, you need to state your position clearly and define how far you’re willing to go.