Getting the Job Done

As an Air Force Academy cadet I was taught a training philosophy for developing subordinates. It used a framework of Expectations - Skills - Feedback - Consequences - Growth. This model appears in documents like the AFOATS Training Guide. In that material, and in my training, I was taught that any problem a team member might encounter could be summarized as a skill problem or a will problem. In the years since I learned those terms, and especially while working in the corporate sector, I've learned those two limitations are definitely not enough to describe challenges to getting the job done. I'd like to flesh out the model here.

The four challenges to getting the job done can be summarized thus:

  1. Will problem. The party doesn't want to accomplish the task. This is a motivation problem.

  2. Skill problem. The party doesn't know how to accomplish the task. This is a methods problem.

  3. Bill problem. The party doesn't have the resources to accomplish the task. This is a money problem.

  4. Nil problem. The party doesn't have the authority to accomplish the task. This is a mojo problem.

I have encountered plenty of roles where I am motivated and technically equipped, but without resources and power. I think that is the standard situation for incident responders, i.e., you don't have the evidence needed to determine scope and impact, and you don't have the authority to change the situation in your favor. What do you think?


MK said…
I think that another thing that can be added to this list is the "situation problem" i.e. you may have the will, the skill, money and authority, but your present situation which could be your location, people around you, or maybe in an extreme case your physical condition e.g. a wounded soldier in a war zone - which does not allow you to carry out the desired action.
Matt Franz said…
How about the still problem? As in sitting still. You are still doing that?

You might have a team or individual that is sufficiently motivated, resourced, or skilled but they are unable or unwilling to evolve to meet organizational, technical, or global changes. They also don't look at the problem space with a fresh set of eyes or question why they are doing things.

Oooh, I like that -- but is that a variation of "will"?

If it is separate, it could be a "still / mobility" problem, to keep the theme going.

We should put this on a glossy handout and charge HR depts millions...
Anonymous said…
i work in the public sector and sometimes summerize the challanges of our work as 'our colleagues/customers have a certain age, a certain education and thus a certain motivation'.
Unknown said…
I am not sure about the NIL problem. I have in the past been concerned about not having the proper authority to complete a task. Altough authority (formal) is usually required, it is not always enough. (Sometimes it means absolutely nothing). By that I mean that authority is often percieved, and people around you most of the time percieve different that you. This also applies to so-called formal authority. I have come to realize that authority is not the thing that get the job done. The ability to influence the right people at the right time, having and selling the best idea is much more efficient, as far as my experience goes.
Anonymous said…
Nil has in the past always been the biggest problem for me. Either your management lacks any backbone to support your decisions or the organization has a culture of "no", where any change regardless of its merit is fought tooth and nail. The prior problem is even more furious when you upper management is afraid to make waves in the name of improving security and either are concerned about advancing their own careers or trying to coast out to retirement. Either way, its pretty much makes the case for having security separate from other IT functions and reporting directly to some three lettered executive.
Ari E-B said…
How about the case where they don't even know they have a problem :-)
Anonymous said…
There are very few problems of the later types that can't be easily classified into the former 2 categories.

Resource issues are frequently caused by a lack of resourcefulness on the part of the InfoSec manager. Let's face it, we never have all of the resources we need (want?) to fully mitigate every risk we can think of. A motivated and skilled team can overcome a lot of resource short comings.

Mojo, while I love the term, is just one's ability to motivate others to do what you want them to. To me, that's a skill. Persuasion and coercion are tools that need to be in the tool box of every information security professional because we're in the business of telling people what they don't want to hear.

Let's not make excuses as to why we can't do our jobs. If we can't convince someone in authority to give us the resources to accomplish our mission... then we clearly haven't presented an argument that's compelling enough, or it probably isn't important enough to the organization... yet. Try again after the poop hit the fan.
Anonymous said…
Got to disagree with the last poster. My previous job (before moving into security) was a classic example of all 4 of those things.

Sure, you can argue that will and skill get you a long way, but without formal authority, you could find yourself hung out to dry for what you did.

And as for budgets? Crazy! More money spent on defending and tuning the budgets than on the "R&D" that was supposedly done. And R&D that is so micromanaged surely never finds anything great, because who has time to innovate when there's another TPS report to be filed?

And eventually, lack of those last two destroys the first two, and your will goes, and then your skill goes - right out the door, without working your notice.
DanPhilpott said…
Wouldn't Bill and Nil problems be a subset of Will? If you have Will you can get resources and authority.

Hmm, of course this ignores the whole notion of whether you should be working on a problem in the first place. I suspect that's a design element addressed outside of this model's context as the the top-down authority model of the military tells or presents you with the problem to be solved. The model presented only describes why the agent assigned to affect the problem has not achieved resolution. Or something like that.
Anonymous said…
This comment has been removed by a blog administrator.
Anonymous said…
This comment has been removed by a blog administrator.
Anonymous said…
This comment has been removed by a blog administrator.
Anonymous said…
This comment has been removed by a blog administrator.
Anonymous said…
This comment has been removed by a blog administrator.

Popular posts from this blog

Zeek in Action Videos

New Book! The Best of TaoSecurity Blog, Volume 4

MITRE ATT&CK Tactics Are Not Tactics