With BYOD (Bring Your Own Disaster Device at the workplace) gaining traction, there is no point in having three sets of users / user machines (internal, external and the DMZ plus spaghetti policy exceptions). You only have external users and the DMZ.
Internal users and insider threats “do not exist”. It makes life simpler and you get rid of hybrid characterizations for consultants and outsourcers…
The book expands on an earlier 1992 version written by Drucker and contains essays by him and other experts in the field of management. All essays are centered around five basic questions which as Drucker writes it is important to ask:
“The most important aspect of the Self-Assessment Tool is the questions it poses. Answers are important; you need answers because you need action. But the most important thing is to ask these questions.”
The five questions are:
What is Our Mission?
Who is Our Customer?
What Does the Customer Value?
What Are Our Results?
What Is Our Plan?
Non-profit organizations are about changing lives and these questions are a tool to achieve this. Even without reading the explanatory essays their importance is evident (as is answering them in a sincere way). And while the book itself is not a self-assessment tool for an individual, the questions themselves are a good start.
It is beyond evident to people that know me that the concept of organized abandonment is what I liked most in the book. I’ve been (unsuccessfully) advocating a similar stance within my employer’s organization for years but I had never seen it so clearly articulated until now. Plus this time it is not only me saying this, Drucker said that too, see? IMVHO, organized abandonment is the basic evolution mechanism for organizations (public and private sector).
This is definitely a book I will revisit in six months time. To evaluate its impact on my way of thinking within my own organization and to see whether I managed to pass anything along.
PS: I bought the PDF version of the book by mistake. Normally I try to read ePub versions on my BeBook Mini, but luckily in this case the BeBook rendered the PDF adequately.
When the image popped in my timeline, I was immediately reminded of Bob Lucky‘s May 1998 essay about Electrical Engineering:
“Electrical engineering will be in danger of shrinking into a neutron star of infinite weight and importance, but invisible to the known universe.”
Others fear that CS might not be far behind. And systems administration, even in its DevOps morph is not far behind too. So while the artist (anybody knows who the artist is?) drew that with engineering students in mind, the image reflects the situation for more.
“Ειναι αποριας αξιο πώς ολοκληροι ομιλοι στηριζουν το IT τους σε τραγικα ηλιθιους IT Directors.”
Αυτό εμφανίστηκε κάπου στο timeline. Θα επιχειρήσω μια προσέγγιση. Δεν είναι κάτι για να πέφτει από τα σύννεφα κανείς. Είναι κάτι το αναμενόμενο. Με την εξαίρεση οργανισμών που ασχολούνται με την Πληροφορική (και δεν εννοώ τους box movers) το ITιλίκι δεν είναι καριέρα. Δεν είναι μια διαδρομή που θα οδηγήσει κάποιον στα “ανώτερα πατώματα” της διοίκησης. Και γιατί να ήταν άλλωστε;
Μια τυπική πορεία ξεκινάει από τον τύπο που “τα φτιάχνει όλα” και τον αγαπάει όλος ο κόσμος. Αλλά αυτό τελειώνει. Τελειώνει όταν δεν τους δείχνει πως να κατεβάσουν μια ταινία, όταν δεν τους αφήνει να εγκαταστήσουν σπασμένο πρόγραμμα στον υπολογιστή τους, όταν τους φωνάξει γιατί για 32η φορά μέσα στο μήνα πρέπει να στήσει το PC τους που κόλλησε ιό “από μόνο του”. Φυσικά αυτό συμβαίνει στην πορεία του χρόνου και ενώ ο ήρωάς μας “ανεβαίνει” την ιεραρχία του οργανισμού (δεν έχει σημασία εάν είναι θεσπισμένη ή όχι) με την κούραση να σωρεύεται και την συνειδητοποίηση πως παρόλο που το IT είναι “η καρδιά του οργανισμού” (α) δεν το ξέρει κανείς άλλος και (β) δεν είναι το αντικείμενο του οργανισμού.
“Κάθε φορά που σε βλέπω μου έχεις έξοδα!”
Αυτό το είπε στον head of IT ο ιδιοκτήτης μεγάλης εταιρίας με παρουσία σε πολλές χώρες. Και δεν του είπε ψέμματα. Όποτε τον βλέπει μιλάνε για δαπάνες. Ποτέ για κέρδη. Οι καλύτερες μέρες είναι αυτές στις οποίες μιλάνε για περικοπές και για εξοικονόμηση χρημάτων που έχει επιτευχθεί. Φανταστείτε λοιπόν μια συνάντηση όλων των επικεφαλής στον οργανισμό κατά τη διάρκεια της οποίας οι άλλοι μιλάνε για τις πωλήσεις που έφεραν, τα έσοδα που έχουν έρθει, τι περιμένουν να έρθει ως εισροή και μόνο ένας να μιλάει στην καλύτερη περίπτωση για εξοικονομήσεις και στην γενική για έξοδα. Ακόμα κι όταν όλοι του ζητάνε θαύματα η χρηματοδότηση της υποδομής τους είναι ένας αγώνας στον οποίο μάλιστα τα προηγούμενα θαύματα δεν παίζουν κανένα ρόλο.
Στο παράδειγμα που ανέφερα πριν, ο συγκεκριμένος head of IT έσωσε (στην κυριολεξία) την εταιρία μια και είχε καταφέρει να διαθέτει ένα NAS με snapshots και έτσι όταν ένας χρήστης έσβησε σημαντικά στοιχεία προϋπολογισμού κατά λάθος και γύρω στις 04:00 το πρωί, μπόρεσε να τα επαναφέρει άμεσα. Θα περίμενε κανείς, αυτό να του έδινε μια ευχέρεια για έξοδα. Του έδωσε το παράπονο που διαβάσατε.
Τέτοιες ιστορίες έχει να αφηγηθεί ο καθένας πολλές. Αυτό που συμβαίνει όμως όσο εμείς ανταλλάσσουμε ιστορίες είναι πως οι καριερίστες αποφεύγουν τις θέσεις ευθύνης IT και πάνε προς αυτές που τους φτιάχνουν το προφίλ μέσα στον οργανισμό. Που τους διευκολύνουν την καριέρα και που θα τους εξασφαλίσουν μια καλύτερη θέση και σε άλλο (ανταγωνιστικό;) οργανισμό. Ταυτόχρονα οι ITήδες ενώ ασχολούνται με το να υπάρχει ο οργανισμός, δεν ασχολούνται με το αντικείμενό του. Δεν είναι να απορεί κανείς λοιπόν που:
“When times are tough IT gets beaten hard” –Rolf von Roessing
Ποιοι μένουν λοιπόν; Μένουν αυτοί που δεν μπορούν να προαχθούν αλλού αλλά ούτε και να “φύγουν” (δες το σαν δυσμενή προαγωγή), αυτοί που δεν ενδιαφέρονται και που μετράνε τις μέρες για να πάρουν σύνταξη, αυτοί που από ατυχία βρέθηκαν εκεί και σχεδιάζουν να αλλάξουν τμήμα μέσα στον πρώτο χρόνο. Α ναι υπάρχουν και αυτοί οι λίγοι και άτυχοι που τους αρέσει το ΙΤ, που θέλουν να τρέξουν αποδοτικά αυτό το κομάτι και που έρχονται να τους πουλήσουν κάτι που “θα τους λύσει τα χέρια” ενώ στην πραγματικότητα θα τους τα κάνει περισσότερο κόμπο:
eternal meeting, n.:
The meeting in an endless loop. Meeting after meeting over the same subject. Participants may come and go, but progress is non-existent. In fact the only result is fatigue and loss of time.
In discussions with @MrBoJensen we’ve concluded that most of the times virtual friends (people who we do not actually know) surprise us with their positive and supportive reactions. Yesterday I was to be surprised twice this way.
New book on Security, Game Theory and Algorithms http://bit.ly/sBuUY4 | Pretty expensive for me though
At $64.99 the book carries the typical price from academic publishers. Which of course results in making knowledge contained in the book inaccessble, a contradiction to the very publication of a book. Really people someone has to make the Laffer curve for academic books, paper and textbook prices. Maybe you’ll understand. But I digress.
Minutes after I posted my complaint the Net responded. In my INBOX resided a gift of $64.99 to buy the book. A friend, a net friend whom I’ve never met but with who I’ve discussed various issues over the years and a mutual respect has grown between us, decided that I needed a Christmas present. THANK YOU Sakis. I am deeply moved.
Hours later yet another amazing gesture came. This time from a highly accomplished and respected Greek (a role model one would say). Again I stood speechless for a while trying to comprehend what had happened.
“Other people can do those activities and do them well. Maybe a few years ago it was a good idea for you to help get this farmers’ market started because those Vietnamese farmers in your area needed a place to sell their produce; but it’s going well now, and you don’t have to run it anymore. It’s time for organized abandonment”.
As system administrators we manage organized complexity. When systems outlive their scope, organized abandonment is the way to go. Unmaintained legacy systems is what we get for not planning so.
Vasilis Katos at the 1st Athens Chapter ISACA Conference argued that we do not need cyber security experts, rather we need champions on the multitude of the different and complex areas that this domain encloses. He is not alone in believing this about experts. With the domain being new, hot and with commitment from Governments for financial backing of projects, the landscape is open for expertship claim. And since we are at the infant stages, many try to establish themselves as the strategists who set the pace, no matter how disconnected from reality they may be.
Whenever a new domain is introduced, until it is sufficiently comprehended people try to use analogies to make the connection. It is a no brainer then that since anything colored “cyber” starts to get a military approach, analogies with highly successful strategists of the past and relevant studies of them will appear. Think of it: Sun Tzu seems to fit every subject, from the battle ground, to sports, to (non military) management. I’ve seen efforts for both Sun Tzu (although far from a complete treatment) and Clausewitz and I am sure that others exist too. It is no wonder then that John Boyd and his OODA Loop would receive treatment too.
Since I found the OODA Loop concept interesting I set out to learn a bit more about it. This is not an easy task for a civilian for Boyd did not really leave much written work behind with the exception of a continually refined set of slides that when finalized took about 15 hours to present. To understand the loop, I read “A vision so noble” by Dan Ford. It’s chapter 2 contains a longer explanation of the OODA Loop than Wikipedia does and even includes a hand written sketch of it:
The OODA Loop as John Boyd sketched it toward the end of his life
Boyd is mostly an attacker and not a defender and indeed one can find cyber similarites in his work, where in page 40 Ford uncovered from his boxes:
Infiltration
* Blitz and guerrillas infiltrate a nation or regime at all levels to soften and shatter the moral fiber of the political, economic and social structure. To carry out this program, a la Sun Tzu, Blitz and Guerrillas:
* Probe and test adversary to unmask strenghts, weaknesses, maneuvers and intentions.
* Shape adversary’s perception of the world to manipulate or undermine his plans and actions.
Purpose
* To force capitulations when combined with external political, economic and military pressures.
or
* To minimize the resistance of a weakened foe for the military blows to follow.
Do not all the above match Cyber Warfare aims? So there exists value in studying Boyd and his tactics, but not a one-to-one mapping as many would hope that would make the transition to a cyber domain easier. The OODA Loop is there, one has to understand that it is not completely linear (OODA means Observation, Orientation, Decision, Action but you are constantly in an observation state that provides feedback) and is valuable.