Non-technical post here, however this might be useful if you’re running a business in this industry and want to learn how not to handle your relations with members of the community.

Core Security recently sent out emails about their party at Black Hat USA 2009, asking the recipients to claim their pass.  I assumed that Core were bright enough to do their homework and only send out invites to people they wanted to attend the party, but, as you’ll see, that’s not the case.  I filled out the form, submitted it, and made sure that a colleague of mine attending the conference had also received an invite and submitted a claim.

A week later, today, I get a phone call from Core Security.  The guy on the other end of the line asks me several questions about my affiliations (McGrewSecurity and the MSU CIPC/CCSR), company size, how I heard about Core Impact, etc.  All of this was information that I had already filled out on the form requesting my pass, which was sort of irritating to start with.  Then, he explained how all of this information would be passed to their marketing folks, in order to make a decision as to whether or not they want to issue me a pass to their party…  and that if I didn’t make the cut, I would go onto a waiting list.

I realize that a party like this is an opportunity for Core Security to reward loyal customers and woo potential large clients.  I realize that there is a need for a process like this.  That process should, however, be done in such a way that they’re not alienating large chunks of the community that they sent emails out to.  Do a little legwork and figure out who you’re asking to your party ahead of time, and you might just avoid awkward situations like this.

After being given the “you just might not be cool enough for the Core Security party” speech, you can imagine that I didn’t exactly have warm and fuzzy feelings towards Core after getting off the phone.  As a matter of fact, I couldn’t wait to get off the phone with the guy.  I’m sure that a lot of productive and contributing members of the security community that don’t work for large companies will feel the same way after being grilled over the phone.

And if I’m “just cool enough for the waiting list”, that’s almost worse.  Am I expected to sit around anticipating that lucky moment when enough people bail to allow me in?  Maybe I’m the only one who feels insulted to get a phone call for the sole purpose of ranking me, without having even bothered to look up anything about me beforehand or even the thinnest veil of being interested in any of it.

Core Impact’s a cool product and all, but after that encounter, I’m not in the mood to give them five bucks for it.  Maybe that doesn’t matter to them, because they’ll have a party full of folks who will give them much more.  If they keep riding rough with their relationships with members of the security community, however, they might find their talent pool and word-of-mouth support drying up.