Critical Thinking Cafe

IT Security: A Problem Worth Anticipating

Several years ago I met a young man after he had been terminated from his role in IT security at a large service company. As he explained his work to me, it became apparent that in the most simple and unrefined terms, this guy was a skilled hacker--the kind of person you want on your IT team because you don't want to find out what kind of damage he'd do if he was on the other side. I kind of wondered if he was hired so the company he worked for would have some measure of comfort that they knew what he was doing. . .at least during the day.

I was reminded of this man after listening to Ron Rittenmeyer, President and CEO of EDS speak at the Ernst & Young Management Briefing Series presented by SMU's Cox School of Business. Mr. Rittenmeyer's presentation could make you afraid to share any information more personal than your shoe size. But his balanced and reasonable perspective gives one confidence that the battle for IT security has not been lost and that you can still bank on-line and sleep at night.

What struck me most during Rittenmeyer's talk was how much the subject of IT security is like the issue we discussed yesterday. It seems that like politicians, some IT departments can't get attention without a crisis. In many organizations the need for greater levels of security is recognized only after that security has been violated. After hundreds of credit card numbers show up on someone's PC a reactive step gets taken to enhance security when a proactive initiative might have prevented the problem from ever taking place. But how do you get people to invest in a solution to solve a problem you don't yet have?

The consensus from yesterday's comments is that our society tends to be reactionary by nature--an unfortunate situation for those charged with trying to protect sensitive information for companies and individuals. But organizations that play light with security need to consider this: If you don't have time or resources to invest in preventing a problem--what makes you think you'll have the resources you need to fix the problem after it happens?

Can a Politician Get Attention Without a Crisis?

Is it possible for someone in Congress to capture the attention of their colleagues, the media, or the public until they declare that a situation has become a crisis? A short piece about the energy crisis on today's CNN blog underscored this unfortunate reality. One of the democratic presidential hopefuls announced that Senators "had multiple chances to reduce our dependence on foreign oil by investing in renewable fuels. . ."

Without lending support to the candidate or discounting his legitimate concern, I wonder if his comment draws attention to a bigger problem in Washington--that fact that our legislative process is primarily a reactionary system for fixing problems, not a proactive process for preventing problems from developing.

It is difficult if not impossible for a political leader to draw attention to the need to proactively address and prevent a problem when the public's attention (and future vote) is captured by something that has already boiled over into a crisis. It would be interesting to categorize every bill passed during the last 20 years to determine whether the legislation was proactively preventing a problem from developing or a law enacted in response to a problem that was already threatening us.

This scenario reminds me of a pretty reliable formula for raising money (whether you're a preacher, a politician, or a thief):
1. Show people there is something "out there" they should be afraid of.
2. Tell them that you have a way to save them from it.
3. Convince them that you need their money in order to protect them from the problem.

Problem prevention always provides a better return on the investment than crisis resolution. It would be nice if that were true in Washington as well.

Harvey Mackay on Problem Solving

One of business legend Harvey Mackay's recent columns provides some valuable insight into solving business problems. Mackay's sharp wit and keen insight are always valued. His article is worth a quick read.

Is a Bungee Jumping CEO a Problem?

A brief article about thrill-seeking CEO's in the October issue of HR Magazine caught my attention. Labor attorney Jules Crystal points out that CEO's have the wiring and genetics to do things differently than the masses, and so a percentage of them engage in what some would consider high-risk hobbies like sky-diving, car racing, and flying planes to out-of-the-way destinations. The question gets raised as to whether or not a CEO should be allowed to pursue relaxation in risk-prone situations and whether or not a talented CEO might walk away from a job at a company where high risk behaviors are discouraged.

Will a CEO that enjoys "going to the edge" to relax tend to operate the same way when pursuing an acquistion or in the way finances are managed? Does risky relaxation on the weekend lead to risky business in the boardroom? Or are the keen senses of an adrenaline-enjoying CEO what is needed for successful enterprise management?

Is a high-octane CEO an asset or a problem? What do you think?

A Fresh Wave of Optimism

The majority of CEOs leading small private companies are optimistic about the future and and enjoy what they do according to a recent survey of CEOs conducted by some management professors at the Cox School of Business at SMU. The detailed survey results can be found at http://www.coxceosurvey.org.

Ninety percent of the survey respondents lead small companies with revenues of $10 to $50 million annually and less than 100 employees. Since the majority of employers in the U.S.fit in this profile, if the results of this survey from the fourth largest metropolitan area in the country (Dallas/Fort Worth) are representative--we have reason to feel a bit bullish.

Blind optimism leads to the kind of fiscal stupidity we saw perpetuated during the dotcom craze. An optimism that is tempered by reality yet anchored in the belief that people really will engage in work that is meaningful and rewarding puts a leader at a distinct advantage in a competitive market.

You Can't Fix a Problem by Scaring Away the Cure

My colleague, Scott Dannemiller and I were in a bit of a hurry to return our airport rental car last night . We accidentally pulled into the wrong terminal garage and were told by the rental car attendant that we needed to drive back out of the garage and go to Terminal 3 to return our car and catch our flight.

We got back into the car and pulled up to the exit as the metal arm lowered across the driveway. The arm didn't raise again, so we asked the uniformed attendant if the gate was working. He told us it was indeed operational, but that the rental car employees were on strike and their "rules of engagement" required that only one car exit the rental car garage every three minutes. Being congenial guys, we passsed the time talking more with the guard. We learned that early in the strike one car was allowed to escape from the garage every 45 minutes!

Labor disputes and worker strikes are a part of life. No issue there. What struck me a bit odd is that the person feeling the ultimate pain in this scenario is the customer. We waited out our three miniutes with a modicum of patience. You can be sure the news of a 45 minute wait would have not been met with the same level of congeniality.

The root cause of this strike is undoubtedly a disagreement with management about one or several issues. Generally, these kind of disagreements center to some degree around money. If the bargaining process alienates the customer base to the point they won't return, the future revenue of the company is impacted. Less customers=less revenue=less operating cash=fewer options.

Scaring away the people that can help you get what you want seems like an odd way to try to solve a problem.