Monday, November 23. 2015
Chapter One: "Up & Out"
Earlier that morning...
“Here’s the deal Julie”, Bob started off as he closed the door to the small conference room near the executive suites at the end of their floor. Small talk didn’t come naturally to him and being a recent transplant to the Midwest he had not picked up on the importance of it. He just wasn’t really interested in what was going on in other peoples lives. He felt that his title and salary made him simply too important to have the bandwidth. He also felt that it created a necessary distance between him and his direct reports. "Don't fraternize with 'the help'", he thought, "especially when you're about to throw them under the bus.”
He slapped down a folder on the table and slipped into the chair across from Julie.
“Good morning to you too”, Julie replied and took a sip of her triple venti soy latte from the Starbucks drive-thru in her neighborhood. She had cashed in a reward she’d earned from her frequent patronage. “It’s the little things” she thought and licked the foam from the lip on the cup.
It was earlier on a Monday morning than she cared to be awake, let alone dressed and in the office. Perky was going to cost extra. She wasn’t sure why Bob had scheduled a meeting with her over the weekend. She did not mix business and personal life together and she almost missed the meeting invite had she not randomly logged into her work laptop Sunday night. While other employees seemed to enjoy having their personal lives disrupted by company emails at all hours, Julie simply would not give her employer the power to remotely erase her phone. She had seen it happen “accidentally” just one too many times at other companies to take the risk of losing all her photos.
Bob didn't bother looking up and instead peered intently at piece of paper he had pulled out of the folder that had hand written notes and several post-it notes attached to it. When he flipped it over Julie could see it was the email request she had sent him late last week asking for his support to be repositioned closer to the teams in the business that she had been working with for the past year.
"How was your weekend?" she asked taking another sip of her coffee. She set it down and cradled it in both hands in front of her, the warmth of it comforted her as did the implied barrier between her and her manager. She could tell he was up to something and the idea that the large cup of hot coffee was a sentry on hand to defend her gave her a reason to crack a wry smile.
"Fine." he said taking his glasses off and set the email down in front of him. Julie thought "coffee trumps paper" and for a second she imagined the scene she could create by accidentally spilling her coffee onto the table and the run of hot froth that would race towards Bob. She wondered how fast his reflexes were? Would he kick back from the table to avoid the torrent? She then imagined them engaging in a kung-fu battle above the conference room table parkour style off the chairs and walls.
"I volunteered at the Humane Society's adoption days event." she offered to the unreciprocated question.
Bob rubbed his eyes and then stared at her for a moment. If he squinted he could almost imagine her in her younger days. He then decided it was just going to be easier to find a 'younger model' to replace her, someone with less experience that he could mold in his own image. "An empty vessel for me to fill in more ways than one" he thought to himself and tampered down the urge to smile. No point in sending Julie the wrong message. He put his glasses back on and tapped the paper in between them.
"So, I got your email and I am afraid I can't support your request to transfer." he said with practiced patter.
“You certainly COULD, you just WON'T” Julie thought to herself. “In retrospect I should have just spilled the coffee. There’s still time!” She held her expression still with her eyes focused on Bob’s lowered lids. He was purposely avoiding her gaze. She snorted and smirked. “Why the urgent need to meet?” she wondered. “He could have just sent an email stating that. It looks like he’s papering over my file, likely in support of some kind of documentation for an action."
“I see” she said, “Can you share with me your reason for choosing not to support my request to get closer to the business?” Her subtle emphasis on the word ‘choosing’ caused Bob to go flush in the face and his eyes shot up to try and stare her down. Julie blinked a few times and smiled a little wider. She could see that whatever anger Bob had mustered from her insinuation was giving way to confusion.
“Does she think this is a game?” Bob wondered to himself and then realized that it was. He already resented her for trying to leave his team but the fact that she wasn’t taking him seriously really goaded him. He wasn’t used to having direct reports that were as smart as him and the thought that she might be one step of ahead of him was concerning. “One more reason to get her on a corrective action plan and out the door so that I can hire some pretty young thing to boss around” he thought and regained his composure.
“I just don’t think you’re ready for a promotion.” he said and smiled for the first time since he walked into the room. She knew immediately that he was lying. It was a nervous tic of his that she had observed by watching him interact with vendors. Whenever he stretched the truth or did not believe what he was saying he smiled. She had heard that he was great to have at a poker table because his tells were so obvious.
“With all due respect ‘Bob'”, she paused just long enough to sharpen the tone of his name, “I’ve held positions much higher than 'lead business process consultant.' You do know I ran a consulting company for over 10 years before joining this firm yes? I think I can handle the work. Besides the business wants me there. They are even willing to open a req for me.”
A feeling of panic swept over Bob and for a moment he almost felt sick. It was one thing to have an employee try to leave on their own terms, but to have a star performer poached by another part of the business meant war. As far as he was concerned she was in on the conspiracy and could no longer be trusted. She was not on the bus with him so that meant there was only one place to put her.
“Listen Julie”, he paused for equal effect, "we agreed that your big deliveries this year were going to be the business process optimization effort as well as getting to be known as 'the expert' in the eyes of the business as the 'go to' person for efficiency. The BPO was a complete disaster. I can’t believe how much money we spent on it!” he said, leaning back in his chair and tapped his fingers together. Bob liked to steeple his fingers whenever he felt like he had the upper hand.
“Whoa whoa whoa. Hang on a second here BOB!” she said bolting upright. “You’re the one that hired Delwood and Associates against my recommendation. I was concerned about the low return on investment we would realize from bringing them in from day one, but you said the decision had already been made. Delwood was taking the lead on the assessment and we were to play supporting roles to facilitate introductions, remove barriers, analyze findings and contextualize the results. All of which I’ve done to the nines!” she said motioning like an orchestra conductor.
“Here’s the deal” he said again. Julie braced against the urge to gag upon hearing the ‘Bobism’ — the kind of trademark saying that her manager was infamous for overusing.
“I’ve taken the personal time to gather some feedback from your peers” he said as if it involved scouring African plains in search of sustenance for his tribe. Clearly he wanted to convey that he was put out and wanted to be stroked for actually doing something.
“This should be good”, Julie thought to herself. For the past nine months she had been so deeply embedded in the business that she had hardly spent any time with her peers. Many of them were as involved in their own projects for other lines of business that it felt like a Hallmark ‘Homecoming Episode' every time they passed each other in the halls. She doubted that she would be able to offer any feedback about their performance and wondered now what they could possibly have to say about hers. "As for the job that ‘Deadwood’ provided, it’s true it was a complete disaster.” she thought. “And this job was totally out of their league, but for some reason they had been selected to take the lead on the BPO."
“Did you ‘gather' any feedback from my customers?” she asked, short circuiting the script Bob had prepared and likely practiced. “Seems to me that the kind of feedback that would matter most is from the teams I’m actually supporting on a daily basis. Honestly Bob, I’m not sure I would be in a position to say how one of my co-workers was performing.”
Bob closed his eyes and shook his head from side to side. “I asked fifteen people what they thought of your performance and they all said the same thing.” Bob said stretching the truth further than he felt a hundred percent comfortable admitting. "The number was certainly between one and five” he thought and grinned.
“Come on Bob, you can’t get fifteen people to agree on lunch let alone what happened at the scene of an accident.” Julie said grabbing her coffee cup and gesturing around the room as if they were both victims of said accident. In her mind they were floating over their now lifeless corpses arguing about whether there would be a bright light to beckon them forward into an after-life. She imagined a trap door opening beneath Bob and sucking him down to a special level of hell while she simply went on to be reincarnated as an un-plucked snowy white edelweiss flower on the side of a high alpine cliff.
“I asked fifteen people what they thought of your performance,” Bob repeated, willing it to be true, “and to the person they all said that you have a problem with your ‘say do’ ratio.”
“Huh, that’s interesting, I’d LOVE to know who said that, because you’re the only person I know that uses that phrase.” Julie said instinctively crossing her arms over her chest. She knew that it was a classic defensive signal but considering that she had just been attacked she felt justified in the response. “Unless by ’say/do’ you mean the kind of things the sycophants and hypocrites you surround yourself with seem to get credit saying but not doing...” she thought to herself puzzling over who might have an issue with her. She had heard recently that someone on her team had been taking credit for others work in an effort to look busier than they were, but for the life of her she could not remember who it was.
“I’m sorry, I can’t disclose my sources. This is 'anonymous feedback.' I’m sure you can understand?” Bob said air quoting. He lowered his eyes again, avoiding her gaze. He dragged his finger across the marked up letter on the table and tapped on a post it note that just had the words ‘say’ and ‘do’ written on it in his handwriting.
“Can you give me an example?” Julie asked.
“Well, they all said there was a gap between what you said and what you did.” Bob tried to look casually at the fingernails on his outstretch hand. She knew he was bluffing and imagined him holding a sock-puppet and conferring with it in private, it’s head bobbing in agreement.
“So you’ve said Bob, but I’m looking for something specific, measurable, or actionable.” Julie uncrossed her arms and sat up straight in her chair and leaned in. "Just repeating that assertion doesn’t give me any kind of guidance or context! And just so you know, I’ve found that ‘anonymous’ feedback isn’t very credible. I have no way of determining what motivation any of your purported feedback providers might have had? Are they jealous? Are they competitors? Are they themselves under-performing and looking for some kind of deflection or a scapegoat? For example, it would be really interesting if some of that feedback had come from a Delwood associate? Surely if you talked to fifteen different people independently over some period of time, you must have ONE example.”
Bob shifted in his chair uneasily. He wasn't prepared to have someone push back. He was clearly used to just making stuff up, speaking authoritatively and having his word go unquestioned. His plan to walk Julie through his justification for putting her on a corrective action plan was unraveling before his eyes. He looked nervously at the pages he had drafted that lay just inside the folder to his left. He cleared his throat and looked for the bottle of water he thought he had brought with him.
“Uhm” he began, “I guess I could probably reach out to a couple of them and see if they would be willing to meet with you to provide some coaching and feedback directly.” His mind was racing trying to figure out who owed him favors, who had the biggest grudges against her. He realized anyone he selected would need coaching themselves, assuming any of them had the courage to be in a room alone with her. Then there was the pesky issue of HR getting involved. She could certainly demand to have an HR associate present during the feedback. He moved the folder off the table into his laptop bag on the chair next to him. "Time to take a different tack.” he thought.
“I would welcome that! Because for all I know the gap is that I am not taking credit for everything I’m doing!” Julie said bright eyed. “Now, I’ve got an example for you if you’ll indulge me?”
Bob looked stunned. He opened his mouth to say something but only the sound of his hot breath came out.
“Mouth breather.”, Julie thought and smirked.
Bob regained his composure, leaned back and smiled. “Yes of course!” he lied, "What have you got?”
“Well, the first time we met, before I took this job on your team, you told me that you’d be hiring technical writers to augment the business process consultants. In fact half-way through the Delwood engagement I specifically sent you a reminder and ask, suggesting that we could do the work ourselves at a fraction of their bill rate.”
“I’ve been too busy with the capital request budgeting project!” he said defensively.
“I hope you understand that I say this with the deepest respect Bob, but that is kind of my point. We all say things that we’d like to do, but then 'business happens.'” she said, softening her voice and turning her palms upward to suggest vulnerability. “If you’re willing to give yourself an out, I would ask that you consider cutting the rest of us some slack too?"
Bob coughed hard and squeezed his eyes closed tight. “Think! Think Bobby boy” he thought to himself. What else what else can I nail her for?” He opened his eyes and picked up the printout and flipped it over once and then again. He spied one of the other post-it notes.
“Ah ha!” he said a little too excited, "The second metric you were being measured on”, he began anew, “was becoming the 'go to' expert for the business. I have heard nothing about that. They should be coming to me to tell me how awesome you are. I consider that a failure as well. You need to own that!”
“Well, again, did you ‘interview’ any of my stakeholders? Was ANY of the fifteen people you claimed to have received this supposedly anonymous feedback from anyone in the business?”
“I can’t say.” he replied. It was Bobs turn to cross his arms.
“Oh yeah that’s right” she said leaning back and mirroring his stance, “what with it all being ‘anonymous'. Sure that’s fine Bob. I can certainly ask anyone of the what? Four contacts I work with in the business on a daily basis to see what they say? In fact we have a happy-hour later this week after the next big release, I’ll just ask them there."
“Here’s the deal Julie. I didn’t ask anyone in the business about your performance because I had already heard what I needed to from your peers.” he said face flushing red again his bluff called.
“Well BOB, I don’t know how you can measure me on something like being perceived as the 'go to' expert in the business if you don’t bother to ask them? As far as I’m concerned until you have some specific examples of your ‘say do’ ratio thing COMBINED with gathering feedback from our business partners, I’m not sure we have much else to talk about?” she said picking up her coffee and pushing back from the table.
“I guess not. I’m really sorry it didn’t work out.” he said defensively and pushed back as well standing.
“Yeah me too.” she said standing as well.
“Expect to get an invite to talk with Dennis in HR? Maybe he can help us sort this out”, Bob said reaching for the conference room door and muttered “stupid bitch” under his breath after he thought he was out of ear shot.
“Sure Bob. Dennis in HR. Sort it out.” she repeated. "Have a good day!” she called out as he disappeared around the corner.
“What the hell just happened here?” she wondered and paused to look out the window towards the employee parking lot. “All I did was ask for my managers support to get closer to the business where I could be more effective for the company. He’s taking it way too personally and now this? He’s putting his own interests before the companies!”
“Time to update the resume" she said softly to herself as she flipped the light switch off in the conference room and went the other way.
Saturday, November 14. 2015
HR: “Horrible Rules” or Why your organization can’t attract (let alone retain) top talent (Chapter One)
“Up & Out”
“I’m stuck!” Julie said in disgust to her colleague Nancy after coming back from a one on one with her manager Bob. “He’s not going to ‘support’ my request to be transferred” she said making air quotes around the word support. “Everyone knows who is actually doing the work around here and I bet old Bob is freaking out that if I leave he’d have to figure out how to do the work himself!”
“That really sucks.”, Nancy said in sympathy. “But it’s always been like that around here for as long as I can remember. It’s why we call it ‘up and out’ – you just reach a point where you can’t advance so your only option is to leave the company for greener pastures. That or get 'promoted to customer'" Nancy said casually, then added "It's a euphemism for getting fired."
“Right now I’m just looking for ‘less brown’, Julie sighed. “I’ve worked in a lot of different places for some very large companies and I’ve never even heard of this practice.”
“Really?” Nancy stopped scanning her email and turned to face Julie. “I guess I’ve been here so long I don’t even remember what it’s like to work anywhere else” she laughed a little.
“No never. The closest thing was at the megabank I worked for – there you needed your manager’s approval if you’d only been in your current role for fewer than six months. Internal transfers are expensive so that makes sense. But this is just crazy. Has anyone confirmed that it’s even legal for them to prevent you from transferring?”
“That’s a good question!”, Nancy turned and looked out the window into the quad below. “Why do you think it might be illegal?”
“It creates an unfair competitive advantage for external candidates”, Julie said a little loud. She paused and looked around and then lowered her voice and leaned in towards Nancy almost at a whisper ”many of whom it appears are friends of the new management. I wonder what the EEOC would think of such a policy?”
“Yeah I guess. That would explain why none of the current employees, many of whom have been here since the beginning ever get considered for promotion. It’s always the friends of the new management du jour that get placed. The twenty and thirty something’s with little to no actual management experience telling seasoned veterans how to do the jobs they’ve been doing for years.” Nancy said picking up her empty coffee cup and peered inside.
“It doesn’t make any sense to me. My manager would have ZERO say over my applying to any job outside the company. I wouldn’t trust him enough for a recommendation anyway. His only job would be to confirm that I worked here and my salary.” Julie said picking up her coffee cup and motioned towards the breakout area on their floor.
“The way they describe it is that your manager is ‘sponsoring’ you and that if you are not performing that it somehow would reflect poorly on them. As if there is some explicit mentor/mentee relationship? I don’t quite get it either.” Nancy said, slipping her shoes on and standing. “You’re right though, their only job should be to confirm the things you’re taking credit for and their assessment of your potential. It should be up to the hiring manager to choose whether with full-disclosure they want to hire you.” she said, smoothing out the pleats on her pants. She beckoned her work friend onward towards the break room with a wave of her mug.
Inside the break room they stood over a small round table that held an assortment of treats that other’s had brought in. A well picked over cheese and fruit plate from a vendor sponsored meeting was precariously placed near the edge of the table, next to a baking dish of homemade cinnamon rolls.
“The whole ‘need for support’ is ridiculous.” Julie hissed, “I don’t need my bosses permission let alone his ‘endorsement’ to switch jobs. I’m not some fresh-faced pledge in a sorority. It’s just a job after all. We all sell our time to the highest bidder. Today that’s this place. Tomorrow who knows?”
Nancy was ten years older than Julie and sometimes wondered about the younger workers who seemed to have so little loyalty to their employers. “Then again”, she thought silently to herself, “what loyalty does the company actually have towards its employees? Didn’t they just fire a whole bunch of grey hairs recently?” Self-consciously she touched the edge of a temple and wondered if she was due for touch up on the color.
“It’s true” Nancy said picking up a strawberry off the cheese plate, ”You can be held back because an incompetent manager knows you’re the reason they are successful. So they selfishly prevent you from moving on. And they can always poison the well by artificially rating you a three out of five.”
“I saw an article recently on LinkedIN from someone in my network. Basically it said that people quit bosses, not jobs. I believe that now. I love this place, the people I work with, and what we’re doing. It’s the Bob’s of the world that will make me quit and go somewhere else.” Julie said biting her lip and picked a part of dangling cinnamon roll from the pan.
“I heard recently that the head of HR thinks we have a ‘talent crises’ – that the company is having a problem trying to attract new talent. Evidently people aren’t even applying for jobs posted. We have something like a thousand open reqs here and in India! Isn’t that crazy? And instead of finding new people, our top talent is fleeing. “ Nancy said looking around to see who might be within ear shot.
“Now that you mention I saw a presentation recently where after they announced and welcomed all the new hires, they flashed an interesting set of numbers on the wall. Evidently in the last year we’ve hired about 140 new people and lost about 110. So in one year we’ve only added 30 new people. That doesn’t seem like anything to brag about to me!” Julie said looking wide eyed. “I’m no math wizard but that means they’d need to hire two to three thousand people to reach the goal of filling the open reqs right?”
“Ha! Good luck with that! This is a pretty small town and people talk. Do they really think that all the people leaving are encouraging others to apply here?” Nancy picked up another strawberry and motioned Julie out of the break area.
Wednesday, November 11. 2015
The Science of Persuasion and the Art of the Sale: The Role of Framing in Developing Defenses to Bounded Irrationality
It’s late fall when the compliance expert makes her way down the block of a quiet urban St. Paul neighborhood known as West Como. The leaves of the maple trees lining the streets have started turning fire red and the setting sun lights them like burning bushes. She scans the block and selects the side with fewer houses. “Fewer houses mean more land between the houses”, she thinks, “which means larger tax revenues collected from the owners ergo more donation margin” she recalls from a pep rally she attended last week. She’s profiling her primary targets and a quick check of the clock on her clipboard tells her that she has plenty of time to make her way up the other side of the street. Besides, she thinks to herself, if she’s only marginally successful in her goals on this side of the street, it will only make it easier to work the crowd on the other.
She starts with the larger 1930’s stucco two story on the corner. The lot is large, taking up the equivalent of three houses on the other side of the street. A semi- private cedar fence rings the backyard. A quick check to the driveway reveals a bright yellow Smart Car, license plate “B SMART”. Bingo she thinks. These are my people.
She sees movement inside the house and casually approaches the front door. Ringing the bell she hears a buzz from deep inside the house, reminiscent of some indiscriminant sound from a black and white television show she can’t name. Must be original, she thinks and mentally puts a checkmark next to frugal.
“Hi my name is Molly” she says suddenly bright and cheery to the skeptical eye from the man staring her down from behind the screen door. “We’re out today collecting signatures from like-minded people who care about water quality. Would you be willing to sign here along with your neighbors that you care about water quality too?”
He opens the door and takes the clipboard – scanning the list of names he realizes that he doesn’t recognize any of them but also realizes that he hasn’t made an effort to really get to know his neighbors. He notices the stack of strategically fanned brochures underneath the signature sheets as he hands it back to her. She’s tracking his every gaze, feigns a small hurt look that he’s not impressed with the trophies she’s collected so far, but it fades as quickly as it appeared. She knows she collected them in another neighborhood, so it is really unlikely that he knows any of them.
She see’s the clock on the clipboard again – that constant drumbeat compelling her forward. She quickly snatches one of the brochures and tries to hand it to him. He humors her by scanning through it as she runs through her canned spiel on how important clean water is, and how few people world wide have clean water, and how X thousands or hundreds of thousands of people die every day or year, he’s not really sure which, “because they don’t have clean water” she finishes.
He looks up from the brochure and raises his hand, signaling that she can stop.
“You can keep the brochure” she says.
He knows what she’s after and plays along, “yes, I care about clean water and would be more than happy to help with a donation, the thing is I don’t normally have a lot of cash on me, mainly plastic to help me track my purchases. You understand?”
“Well, we do take checks”, she offers sincerely. “Most people have been giving between thirty-five to forty dollars”, she lies. Most people SHOULD be giving that much she thinks internally to reconcile the dishonesty. Molly really does care about clean water. She also cares about winning the trip to Mexico.
“Let me see what I have”, he says stepping back inside the house to check his wallet. She makes another mental checkmark and thinks tonight’s compliance run is going to be easier than she thought.
He comes back with a twenty and hands it to her in exchange for some additional brochures and the clipboard again for his signature. He politely refuses and she makes up some excuse about needing people’s names for “accounting purposes” and flips up the signature sheet to reveal another page with donors and dollar amounts. He tells her to put down “Doe” and steps back inside. Again the fleeting wounded look appears but she realizes the clock is ticking and shifts back into a sunny disposition. Besides, she knows from the public tax records she printed out on the backside of her clipboard who he probably is. Looking down the street she sees a neighbor out raking leaves and resets the check list and prepares to tell the neighborhood of the generosity of the guy on the corner.
The guy on the corner was me, and I had just been played.
The rest of the story can be found here:
The Science of Persuasion and the Art of the Sale: The Role of Framing in Developing Defenses to Bounded Irrationality
Cross-posted to LinkedIN, Facebook, and Twitter
Sunday, November 1. 2015
"I don't mean to brag, but I have enough money in my pocket right now to buy that mini-fridge" -- Jake Johannsen
I was watching a movie recently that had a corporate awards ceremony in it where everyone was shuffled into a room and watched a senior executive hand out blue ribbons to a few people who had shown up. Embarrassed junior managers accepted the trophies and paused nervously for the obligatory hand-shake photo.
The main character was opining to his wife about how it seemed so unfair that his work was going unnoticed and how he felt slighted for not getting the recognition. She did a great job of counseling him that "it was just a piece of plastic" and that no one was going to remember the person giving it. In a feel good moment, the man's daughter gave him a hand colored "award" for "Best Dad."
I started thinking about the whole deal around corporate award ceremonies. They typically are not competitive events, though they certainly feel like it. The tacit message of course is "be like this person". On the flip side, it is also unfortunately a trend I see with millennials who come from "the winningest generation" and expect blue ribbons "just for showing up."
The wife was right though: those vapid trophy chunks of lucite would eventually find their way to a landfill and the person handing them out would likely be long forgot before then.
I realized their actual intrinsic value wasn't in the ceremony, or the cube squatting token that would eventually have to be thrown into a box when the employee quit or was "exited".
Their value lay in the dubious claims the recipients could make on their resumes, as in "Winner of the 2015 XYZ award" -- you see this in car commercials all the time, where they claim "Best in Class" -- which is totally meaningless when you think about it.
Nearly impossible to fact check, and other than the physical trophy that no one is going to carry into their next job, I realized that we might as well start making up our own trophies to celebrate our achievements!
We can go online right now (just google "lucite awards") -- and create a trophy to celebrate our Awesomeness* Order it, pay for it, and receive it. Done & Done.
Then on our resumes we can literally put down "Recipient of the Q4 Awesome Award" -- and we would not be lying in the least.
We'll even have the trophy to prove it
So go ahead and give yourself or someone you respect the recognition they deserve.
* "Awesomeness" is actually a skill that I added to the LinkedIN profiles while they were still in public beta -- you can endorse someone for "Awesomeness" -- which I frequently do if I think you have it.
Follow me on Twitter @TheLittleDuke
Cross Posted to LinkedIN
Saturday, October 3. 2015
Bad Security Architecture Can Kill
On August 1, 2007 I was crossing the I-35W Mississippi bridge on my way to one of my last MBA classes at the Carlson School of Management, University of Minnesota. I was on my motorcycle at the time and traffic was stop and go. That summer the MN Department Of Transportation (DOT) had decided to resurface the bridge and traffic had been pushed to the outer lanes while the scrappers and jackhammers were busy removing the old surface.
The bridge wasn't just vibrating it was bouncing! I could feel its momentum beneath my tires and could see the cars around me rising and falling slowly. It didn't feel safe, but my thought was, "well they wouldn't be doing this if it wasn't safe, right?" I kicked it into gear and finished crossing the bridge pulling into the parking ramp when it happened: the bridge collapsed behind me killing 13 people and crippling some of my classmates. A minute earlier and you would not be reading this today.
The NTSB cited a design flaw as the likely cause of the collapse, noting that too-thin gusset plate ripped along a line of rivets, and asserted that additional weight on the bridge at the time of the collapse contributed to the catastrophic failure.
That day inspired two clear security mandates for me:
1. Trust but Verify
2. Build Security In. Don’t bolt it on
The first is a well-known tenant of security. The bridge falling was a wake up call for me, because I recall vividly thinking as the bridge was bouncing up and down, “surely this must be safe because they wouldn’t be doing this otherwise?”
“When you see something, say something”
Now when I see something suspicious I raise my hand and say something. This is the security empowerment mandate. This doesn’t just apply to security it’s any situation where the pattern suggests an anomaly, in security posture or business practices alike.
The second lesson learned was the icon of that gusset-plate, as a reminder that security should not be simply bolted on. Modern bridges no longer rely on gusset-plates for their strength and security. Why should modern software?
In information security the gusset-plate approach is essentially Security Operations or “SecOps” – all the structures put in place to build sandboxes around vulnerable assets. It’s the firewalls, anti-virus systems, file-systems scanners, and web application proxies.
I see the same complacency in terms of the trust by assumption that companies place into their infrastructure. Developers don’t take an ownership in the security of their systems because they have been trained to rely on the SecOps infrastructure to keep them safe in their sandboxes.
If we’re going to build modern software we can no longer afford to place our trust in the apparatus of SecOps – we must move the ball back squarely into the applications themselves – an AppSec, or SecDev program.
The old methods of trying to enforce input data types, lengths, and sanitization at the edge are brittle and do not scale horizontally. The tightly coupled coordination between Development and Operations (DevOps) to manage the Web Application Firewall (WAF) rules creates so many bottlenecks in the application delivery pipeline that few organizations deploy more than a handful of vendor supplied generic rules, hoping to filter out the most basic attacks.
Instead of relying on web application firewalls and proxies to try and prevent, let alone detect, malicious activity, we must embed that capability within the applications themselves. The developers know what is an anomaly – they code for it with structures like “assert()” and “try/catch” blocks. By linking in a standardized logging system that can feed into an enterprise Security Information and Event Mangement (SIEM) system, malicious activity can be discovered AS IT’S HAPPENING in a way that scanning log data can’t even match.
“Don’t try to train developers to code securely. Give them secure code”
By collapsing towards a set of hardened input sanitization routines we can wipe out most of the OWASP Top Ten exploitable defects. And since few developers have a passion for rolling their own, it behooves us to find and promote secure tools that they can just leverage. Later in our maturity we can add rules to our code scanning tools to detect if the approved libraries are being used adding in a layer of enforcement.
Once input sanitization has been handled and security events are being consumed by the security logging tools, focus on standardizing authentication and authorization handling. You’d be surprised at the number of exploitable systems that can leverage authenticated sessions to pivot and access other assets because the developers did not think to confirm that the entitlements were bound. “I have a valid token or session cookie, let’s go and modify that user number that was passed in as part of the session…” The ability to pivot on credentials is not the kind of defect you’re going to find from code or vulnerability scanning. Very few penetration testers are going to find it either. The best method is to “trust but verify” – demand to see evidence in the log files that the session-handler can detect when access request is being made on assets not bound to that token.
This is the essence of a SecDevSecOps approach:
1. Trust but Verify
2. Build Security in -- don’t bolt it on
Tweeting about #SecDevOps on Twitter @TheLittleDuke
Cross posted to LinkedIN
(Page 1 of 6, totaling 29 entries) » next page