With age comes experience and apparently wisdom. And aches, pains and aches and pains. And with that…
Dave M. — Cyber Security Director
With age comes experience and apparently wisdom. And aches, pains and aches and pains.
And with that experience comes the wincing and cringing of seeing the same situations over and over again. It can be workplace politics, the naivety of desperately right young talent who haven't been crushed by the world yet or, a favourite in cyber, the same technical and process problems leading to breaches. We all get bored of hearing people going on about getting the basics right - but like all clichés it has such roots in truth - that's how it becomes a cliché.
Another one I see a lot - leadership issues.
I've done a few contracts helping "fix" cyber security teams - standing in for a CISO or other infosec leader - to sort the team, get the strategy in and "light a fire" under an under performing team. Hire in some new talent, usually before hiring the permanent person to sit in the seat I'm temporarily filling. It's rewarding doing this sort of gig, fixing the broken, setting it up for success.
How it got broken? Very often it's leadership that's the problem. Poor direction, lack of ownership, lack of experience in cyber / infosec, the belief that it's just a management job.
A leader accepts the mission for the team, figures out the strategy, then hires / builds the team to get you there.
And gets out of their way.
My job as a leader?
Twofold:
1. The Mission
Know the mission- at least the top levels of it. Figure out the resources needed to achieve it (by asking the right people the right questions). Be flexible and challenging. There is no right way or best way - absolutes and perfection are the enemy.
2. The Team
Leave every person that works you better then how you found them. This is not their last job, so it's your job to make them better equipped, more confident and more inspiring for the next person.
Provide resources, counsel and trust.
Inspire not command. Lead not bully. Give them fuel and get the hell out of their way.
A little steering, the occasional grounding and always have their back.
That's how I do it.
My retention rate? For customers - 95%+ For members of staff even higher. I've had to fire 2 people ever, didn't see any warning signs in the interview, it happens. I know a couple more have slipped through in people I've hired and then they didn't cut it after I had finished my contract. I once had to tell someone that I would fire them if they didn't take the opportunity that had been presented to them - they didn't want to leave the team...
Not a lot about cyber in there is there? Okay...
Cyber suffers in the mission because it's not well understood - too many experts, no good way to measure success - "We didn't get compromised this month" is not an easy thing to sell as success - and it's even worse if you think it means you are an expert at cyber because of it. The mission suffers because cyber told everyone "this is really hard and you wouldn't understand" instead of just saying "it's risk - we are fire marshals but for computers and data"
Cyber suffers in the people because, again lack of clarity in measuring achievements, lack of clarity in what any job title actually means and what should be expected in the role. A deluge of self proclaimed experts that believe HARD in their own mythos and a lot who are snake oil salesmen. Broken people, diverse people. Some of the brightest people I have worked with are also the worst to try and work with. Technical brilliance is fantastic, but if it can't communicate, or doesn't translate to useful outcomes - it's pointless and very hard on everyone. People who are in the job because they meandered into it, people who are driven. It's a wide range, and hard to manage with traditional methods. If you put people in a box, best not to do it to people who specialise in thinking outside the box and have an incredibly high proclivity for lock picking.
I've learned a lot - from good leaders and bad leaders.
Mostly I've learned to keep learning, listen and try to understand before speaking or discounting. I've learned that I'm not always the smartest person in the room and that's ok. I've learned to try and remember that most people are trying their best.
It's better to ask what is trying to be achieved and help people get to that goal.
Mostly I've learned - look after your people, tell them what you are trying to achieve and then set them to solving it. Get out of their way and remove blockers for them. Give credit often, inspiration more and only ever criticise privately and after much thought.
Leadership of teams isn't a cyber thing. It's a people thing. You just have to speak cyber to lead cyber teams.
5 reactions · 0 comments