Getting the Job Done
As an Air Force Academy cadet I was taught a training philosophy for developing subordinates. It used a framework of Expectations - Skills - Feedback - Consequences - Growth. This model appears in documents like the AFOATS Training Guide. In that material, and in my training, I was taught that any problem a team member might encounter could be summarized as a skill problem or a will problem. In the years since I learned those terms, and especially while working in the corporate sector, I've learned those two limitations are definitely not enough to describe challenges to getting the job done. I'd like to flesh out the model here.The four challenges to getting the job done can be summarized thus:
- Will problem. The party doesn't want to accomplish the task. This is a motivation problem.
- Skill problem. The party doesn't know how to accomplish the task. This is a methods problem.
- Bill problem. The party doesn't have the resources to accomplish the task. This is a money problem.
- Nil problem. The party doesn't have the authority to accomplish the task. This is a mojo problem.
I have encountered plenty of roles where I am motivated and technically equipped, but without resources and power. I think that is the standard situation for incident responders, i.e., you don't have the evidence needed to determine scope and impact, and you don't have the authority to change the situation in your favor. What do you think?
Comments
You might have a team or individual that is sufficiently motivated, resourced, or skilled but they are unable or unwilling to evolve to meet organizational, technical, or global changes. They also don't look at the problem space with a fresh set of eyes or question why they are doing things.
Oooh, I like that -- but is that a variation of "will"?
If it is separate, it could be a "still / mobility" problem, to keep the theme going.
We should put this on a glossy handout and charge HR depts millions...
Resource issues are frequently caused by a lack of resourcefulness on the part of the InfoSec manager. Let's face it, we never have all of the resources we need (want?) to fully mitigate every risk we can think of. A motivated and skilled team can overcome a lot of resource short comings.
Mojo, while I love the term, is just one's ability to motivate others to do what you want them to. To me, that's a skill. Persuasion and coercion are tools that need to be in the tool box of every information security professional because we're in the business of telling people what they don't want to hear.
Let's not make excuses as to why we can't do our jobs. If we can't convince someone in authority to give us the resources to accomplish our mission... then we clearly haven't presented an argument that's compelling enough, or it probably isn't important enough to the organization... yet. Try again after the poop hit the fan.
Sure, you can argue that will and skill get you a long way, but without formal authority, you could find yourself hung out to dry for what you did.
And as for budgets? Crazy! More money spent on defending and tuning the budgets than on the "R&D" that was supposedly done. And R&D that is so micromanaged surely never finds anything great, because who has time to innovate when there's another TPS report to be filed?
And eventually, lack of those last two destroys the first two, and your will goes, and then your skill goes - right out the door, without working your notice.
Hmm, of course this ignores the whole notion of whether you should be working on a problem in the first place. I suspect that's a design element addressed outside of this model's context as the the top-down authority model of the military tells or presents you with the problem to be solved. The model presented only describes why the agent assigned to affect the problem has not achieved resolution. Or something like that.