Change, failure, defeat and...motivation?

This month hasn't been the best for me.  I won't go into detail, but there were enough challenging things that happened personally that I actually tried to sing them all to the tune of the 12 days of Christmas.  Once I realized it would go over 12, I quit trying.

Instead, I started thinking about work.  This can be dangerous, but I encourage everyone to take a step back and try it, especially this time of year.  As security professionals, we face change, failure and defeat all the time.  My favorite TV show line this fall was from 'Sleepy Hollow': "Crane, you and I can't have lunch without peril".  Our jobs are a lot like that.  The key is not to let it get to us.  Yes, it may seem like we are never going to make progress, no one wants to help us and maybe we should just go eat worms.  Me, personally, I don't care to eat bugs, so I chose to do something completely different.

After I got over the Christmas carol thing, I got motivated.  Maybe even a little aggravated in an energizing way to quit whining and go do something.  I started small- I literally just went for a quick walk.  But after that, I started thinking again.  What do I need to do next year?  Who are three people that I need to work better with?  How can I do my job better?  And, even better than that:  how can I learn from my failures and improve the next time?

Its all about understanding what is truly important, prioritizing what is, and charging ahead.  I find this good advice for not only my fellow security professionals, but also personally.  There is always some way to do things.  If you keep asking questions and friends for their thoughts, you will figure it out.

What I am not saying is go off and make some New Years' resolutions.  Typically, those don't last (and either will my energized euphoria).  But I will take the energy for now.  I won't let challenges defeat me.  After all, challenges are temporary too.

Here I go, thinking again

I talked in a previous post about being clear, but this last week, I achieved a moment of clarity.  Several moments actually- which felt quite nice!  I thought I would take a minute to reflect on the experience in the hopes to remind/inspire others to do the same.   

The best place to start is to stop for a minute and think about your typical day.  If it’s anything like mine, it’s pretty chaotic.  You move from one fire to the next while trying to make sure the fire you just put out doesn’t start up again.  Somewhere in your head swims the long-term strategy that you should be striving for as well as how you will get there.  But you never seem to slow down enough to make it to that next strategic step, or even get the chance envision what the next step is.  Sound familiar?

My moment of clarity occurred during a class I was taking.  The class was incredible in itself, but it also allowed me to get out of the fray for a little while.  I had a peaceful few minutes in between to let my brain settle, and suddenly I figured a few things out that I haven’t had a lot of time to figure out.  It was almost alarming how easily things just fell into place.  I wrote down my thoughts quickly before they escaped my head, though.  Good thoughts tend to do that!

My message today is simply this: there is no magic formula to what happened, no specific list of things to take away this time.  Just strive to find that quiet time (whatever is your version of quiet) to think.  As leaders, thinking time is invaluable.  So whether it’s a few quiet moments first thing in the morning when you get in the office, or on a crowded bus on the way home, or right before you go to bed, stop checking emails, stop facebooking or linkedin-ing, just stop doing everything…and don’t even try to think.  Just be and your brain will do the work for you.

Privacy? Seriously?

I have been looking a lot at privacy lately.  At a professional level, I want to provide value in this area by making sure that my organization is compliant with relevant privacy laws.  At a personal level, I feel like my privacy erodes on an hourly basis with the nearly weekly data breaches of companies that I use on a regular basis. 

So how do we resolve this conundrum?  First of all, don't panic!  You don't have to live in a shack in the woods herding goats to protect yourself (although some days, I think this might be a nice option).  I think the good old detective controls come into play, in addition to some still proactive useful ones.  The key, at least to me, is a balance that won't make you crazy.

The controls are simple:

1) Get a credit card you can use for purchases (online and in person).  It doesn't seem to be better one over another any longer, so just get one that you monitor frequently for oddball transactions.  Then commit to reviewing it.  As soon as you get something, dispute it and get a new number.

2) Keep your passwords different for different services and secure them in a key safe.

3) Keep your personal information OFFLINE.  I have a dear friend who posts every single place she goes at all times.  It's kind of cool to know what she is up to, but (sorry) I don't trust privacy settings of sites.  They change too frequently and you never know what glitch will happen that exposes your info.

4) Keep you online presence fairly limited.  Since you will ignore step 3 because you like to interact with everyone else in your social circle, then focus on a site so you can monitor it.

The last step is really just to make sure that you keep breathing.  Its pretty easy to panic, but there are some things in life you can't control.  You can either never leave your house or you can just monitor what you can, limit the threat vectors (to throw a security term in the mix) and keep on going.

Quick check:  breathe in, breathe out. 

See?  I knew you could do it!

Sent from my iPad=

Promises, promises

"Let's do lunch!"

"I will make that happen"

"I can get that to you by Friday"

I bet either you've said that or heard that recently.  If you said it, did you deliver?  Nothing is more irritating than having something promised to you, then the commitment is not met.  Then you have to nag the person mercilessly until they provide it.  So, did you promise something and then not deliver it, and now you are being nagged?

An instant way to build trust is to deliver on your promises.  No matter how little, following up on something you said you'd do will pay off handsomely in the long run.  The key to  this; however, is not over-promising. We tend to automatically spit things out like: "of course I can do that in 24 hours!"  when our brain truly knows that we can't in fact do that in a week.  There is no shame in taking more time to provide a realistic estimate rather than promising to do something then not doing it.

Even worse, if you can't make your commitment, don't ignore the promisee!  Communicate a clearly revised deadline with plenty enough notice so that they can reasonably adjust whatever may rely on the output of your task.  Again, I don't care how small you think the promise is, the person you committed to may think that it is much more important.

Lastly, if you can't do it, then say so!  How often would you have appreciated a real answer versus a tap dance?  As infosec professionals, being honest and ethical is part of the job description.  If our partners can't believe and trust in our work and ourselves, then why would they want to work with us?  Think about the traits of people that you like to work with: I bet one of them is delivering on their promises.  We must be the examples if we are to succeed, so start practicing now!

For a little more on this topic, here is a good article.  

 

 

To be clear....

Do you catch yourself saying this out loud once and a while?  Do you find that the more you say this, the less clear you are?  I do, so I am hoping some of you do the same, and we can help each other get out of this mess.

Being clear in writing and speech is critical in our field today.  How many times do you give direction to someone, or have a meeting with a bunch of someones only to come back later to have them produce something that's not what you asked for.  And how do we know if we are being clear or not?  Short of saying "repeat that back for me" a thousand times, it can be a little challenging.

One of the best ways that I find to be more clear is to...yes...talk to people. Heck, even if you do that, you may think you have something completely clear, only to have it be interpreted very differently.  However, if I hear:

"I think we should measure density."

And you aren't exactly sure that makes a ton of sense in the context of your discussion, then ask more questions, or provide clarifying statements.  Sending and receiving the right message is crucial.

I do a lot of writing, and let me tell you, I may think that I wrote something that was brilliant, only to come back later and realize it was full of typos and missing crucial pieces, oh like, nouns.  A great little book I found called: How to Speak and Write Correctly (free in Kindle), has a whole chapter dedicated to this topic.  'The Pitfalls to Avoid' chapter discusses good stuff (e.g. mistakes) like putting the verb to far away from its subject with a bunch of unnecessary words, split infinitives (she was scarely able to even write)  and overuse of the words 'one' or 'only'.

There are a lot more great examples in that chapter, and every once and a while, I like to go back and read part of it to make sure that I remember grammar and little things like that.

After a while of realizing that maybe you haven't been too clear lately, and you work to be more clear, then you'll know you are on your way when that little lightbulb goes off.  Yes, indeed, they call those moments of clarity.  Pat yourself on the back, turn around and keep trying.  You'll have plenty of more opportunities to find these without even trying too hard!

Meeting etiquette

Yes, I know.  This shouldn't have to be a topic of any modern blog.  But, by golly, I still attend useless meetings that are not run well, and I bet you do too.  This is my plea to my peers to help run better meetings and to teach those who work for us how to do so as well.

Why do we care?  I've ranted in some previous posts that we simply are not getting our message across. If we hold meetings without purpose or good outcomes, no one will attend and if you get lucky enough for someone to actually attend then they still won't take you seriously.  It may be a small thing, but a well run meeting enhances your professional profile.  If your meetings are seen as effective, then maybe your Infosec program isn't all that bad, too.

So what is a good definition of a meeting?  Number one rule: don't have team meetings on Mondays.  This tip, thanks to Manager Tools, is a good one because people are either 1) ready to dive into work on Monday mornings or 2) not ready to have any sort of check in first thing on Mondays.  Now that I think about it, this is really true, and I myself need to stop this practice.

Next up: be organized.  You called the meeting.  Don't get a group of highly-paid professionals to break away from the million other things they have to do just so you can flounder around a topic.  Have an agenda, send it out in enough time that people can wrap their heads around what they are there to do and then keep to the time you set the meeting for.  It's just plain disrespectful to run over.  Those folks in the room have other commitments, so don't hold them hostage just so you can finish yours.  Schedule a follow up or follow up via email.

A couple other good thoughts from an article I found: please, please, please show up on time.  If you organized a meeting, you should be the first one there.  And here is one that a lot of people don't think about any more: make introductions.  If not everyone knows each other, then make sure they all do before the meeting starts.  This makes a more comfortable environment for all to participate in.

I am sure there are plenty of other meeting pet peeves that you encounter all the time.  Feel free to share so that we all can strive to make the dreaded meeting not so dreaded any more!

Nope, I don't need my eyes checked

While working on a couple things this week, and I was reminded of a very important technical tenet in forensics that I realized applied to leadership very well: looking at things with different viewers can reveal things you didn't see before.  My thoughts came to light today as my husband and I took a quiet hike out in the beautiful weather we are having in Arizona right now.

We were just about to turn around when I peeked over the next gate we'd have to go through had we decided to go ahead.  I saw something that made me think I was hallucinating: water! (For those of you not in Arizona, this is an odd thing to come across while hiking in the forest.)  We forged ahead a little ways to see a beautiful pool of water in a field of grass.  The extra look and effort made it worth the entire hike.

How does this apply to forensics?  More importantly, how does it apply to leadership in Infosec?  Well, in forensics, if you look at a file in two different viewers, oftentimes you'll see new snippets of data that you didn't see in both viewers, just the one.  If I hadn't peered down the hiking path today to see what may lay ahead, I might have missed something that was well worth my time.  The same in any of our leader roles: take the time, make the effort, look at things from different angles.  You never know what you may find...or may have missed by giving up too early.

Oftentimes, we fight long hard battles up impossible hills in our field.  If we all take a second look, through a different viewer, that little bit of extra effort may let us see something we missed.  More importantly, that could lead us to a better, more effective path.  Take a moment on this long holiday weekend (or after!) and do just that.  What do you see?

Stabilizing change

"It would be all so easy if you had a map to the maze."  Remember 'Who moved my cheese?' by Spencer Johnson?  Yes, well we don't exactly have a map to our work mazes, and neither do our teams.  As I reflect on this topic, I thought I'd share my thoughts on how we as leaders can help to stabilize change.

I know that this title is counter-intuitive, but as infosec leaders and as professionals, we should be considering this every day.  Not only is it important to our selves to be able to navigate change,  but we need to navigate and lead through change with our teams, our partners and our management.  Bear with me as I walk through my thought process.

Change will happen.  For some of us, it happens a lot more than we can really keep up with.  One thing we have to keep in mind as we navigate the change: "for those who found their way, the maze held secrets that let them enjoy a better life" (Johnson).  I have seen changes handled in many different ways, handled better in some cases over others, even when the change happened to myself.  Here are some thoughts:

1) Communicate, participate in communication, reflect and then communicate some more.  As change is taking place, its important that you not only are communicated to so that you as a leader and individual know what is going on, but you need to be able to plan out how to best implement this change within your teams.  Which leads me to:

2) Plan how to implement the change.  Teams need some structure to weather the change.  Have a plan as soon a possible, even if it's: don't change what you are doing until we have a better plan.

3) Try to understand how change is affecting each of your team members.  I have underestimated or guessed wrong many times about how folks will take change, so don't assume.  Go right to them and have an open conversation.

4) Make yourself available.  Don't hide in your office while this is happening, even if its having a big affect on you too.  Being visible in times of change is the best and right time to be visible.

Can you be good at changing?  Maybe you can.  What you can be good at is rolling with the change and embracing it.  You never know what kind of good secrets will come out of your path through the maze.