Archive 7 min read

Working Together To Improve Security

There's only upside to collaborating more deeply with other teams in the org. So why doesn't the security get out there and do it?!?

Working Together To Improve Security

Watch this episode on YouTube.

Reasonably Accurate 馃馃 Transcript

Morning everybody. Welcome to episode 76 Already of Mornings with Mark. Um I wanted to follow up on yesterday's episode in episode 75 we talked about service design thinking and how that's really security thinking, how a holistic point of view um working through problems start to finish.

Um It turns out uh I would love to say I planned that topic um to follow uh or to precede what I was doing for the rest of day. Um But it was totally random, totally circumstance. Um Just a few things that triggered um you know, traveling through the airport, seeing the uh signature service from uh Air Canada.

Um and, you know, dealing with some Apple issues and seeing that end to end um support for service or product. Um But I was in a design review meeting yesterday all day. Um It was myself and a couple of colleagues.

And what really struck me was that power of that end, end thinking of service design thinking. That's what I want to talk to you today um about and it ties back to our continuing theme around perspectives. So in this review meeting and I won't go into the specifics, um proprietary, all that kind of deal.

Um But what I wanted to talk about was the fact that we managed to get four people in a room with very different viewpoints. Um deep technical knowledge, but more importantly, a deep respect for the other people in the room, at least for their work, even if they hadn't worked with them directly um uh in person, but knowing what they had accomplished, knowing what they had achieved and just a general respect for people.

Um Right. And we have that kind of a vibe starting off a meeting, things really start to get rolling because we were discussing the work, not somebody's work, but the work itself. And that's a really fine distinction. And I know I struggled with this early in my career.

It took a long time and a lot of gray hair um to get to the point where I can clearly separate the work and the issue versus the people. Um And that was critical to this. We spent a whole day um working through a problem, working through a set of designs and we started start to finish, we did service design thinking.

We picked apart every little aspect of what was already a phenomenal set of choices of phenomenal design. And we made it even better because everybody focused on the work, they focused on the issue, not the politics, not um the personality, not attributing um or sort of anthro I can never even say the word.

I will type it down below. Um anthropomorphizing. No. See, it's too early. I haven't had my tea yet. Not on associating the work with the person, but talking about the work itself in a respectful manner. Um And, and going through and that only happens because of the strength of relationships because of the professionalism of the people involved, but primarily because of the leg work done to ensure that teams are working smoothly.

And I think this is a real problem in security in general, it goes to the isolation. We've talked about a ton on the show. Um because security teams, uh organizations take uh all the security talent, put them on a security team and shove them off to the side that makes it extremely hard for security teams to build strong relationships.

You need people who go out of their way on the security team to go out and create relationships, maintain those relationships, strengthen those relationships in order to have that sort of mutual respect. Um in order to not let things break down to what I see.

So, so often in organizations where the security team is seen as the enemy, it's them, they're going to say no to me, they're seen as a roadblock. But if you want to make an idea better, you know, you need to collaborate, you need to work together people with different viewpoints and this is what I loved.

I got so energized even though I was literally in the same room though, we left a little bit obviously for bio breaks and we, we had some food brought in. Um I was in the same room for almost eight hours with these folks.

Um And we were, it was so energizing, it was so invigorating because we were working through a problem with a shared goal of trying to make it better for our customer, for our user. Um And that's a rare thing, unfortunately, and it shouldn't be, this should be happening all the time.

So what do you need to make this happen? I already mentioned the relationships. Let's let's review this. Let's have this as the takeaway. How do you implement service design thinking? How do you implement um sort of group review?

How do you make ideas better? Couple things right out the gate. You wanna make sure that you're talking about the idea that you're talking about the merits of the idea or the product or the solution or whatever you're building out, you're talking about that.

You're not talking about the people who did the work. So it's a different, if you have a problem with me, you should not have a problem with the work. You should view validate the work on its own merits and people who did the work should not take it personally.

If there are things that can be done better or things that should be. And that's hard. People are tricky. Um, I know that's tricky for me to do. That's tricky for everybody to do. But that needs to be called out.

You need to talk about the work in isolation, not as associated with people or groups. You can't worry about hurting somebody's feelings, don't be a jerk about it. Um, but you need to talk about the work isolated that leads into the second point.

You need to be respect, respectful. You need to understand that everybody around that table. If you've done your job, well, getting the right people to the table, everyone around that table has a different set of expertise, they have a different perspective.

Um And they deserve to be heard. Um And they should be heard and they, what they suggest should be again evaluated on its merits, not on who it's coming from. Um And I think that the third um is willing to put aside your own preconceptions and your own biases and that's really, really tricky.

Um especially when you're coming from a particular group or a particular angle. I think it's critical to be able to kind of put that to the side and say, OK, what's the bigger picture here? What is the shared goal for the team?

And this happens a lot in security reviews where the security people come out and they go, no, you absolutely have to adhere to this implementation. Um because that's just the way it's done and that that's the only way to be secure.

Whereas you need to take a step back, you need to look at that bigger picture. You need to understand. Ok, well, wait a minute. Uh, you know, the example I used yesterday is, you know, you can't ask people to do a new pass phrase for your service if they're using a bunch of other crappy passwords back there because they're going to get resentful at the better security.

Yes. It's a better choice to do pass phrases. But you need to look at the holistic angle and you need to put yourself in somebody else's shoes and more often than not, that's the end user or the customer.

Um And you need to understand that the trade off and this is absolutely critical and sort of the last aspect. So, um put yourself in their shoes have that perspective. But the last thing I would say is you need to understand that if somebody needs to have a pain uh point in the experience should be internalized, not by your customer.

Um And I think a lot of people fall down and I go well from an engineering perspective, it's easier if we build this. Yeah, but that makes the customer take three extra steps every time. Yeah, but it will save us six months of development time, wrong call, always in favor of the customer with very, very, very few exceptions.

This is not like everyone's an above average driver I mean, very few exceptions. It's tough to do. These things are very difficult to do. But I think if you're aware of them, I think if you're aware of talking about the idea on its merits, getting different perspectives in being respectful.

Um making sure you put the customer first and thinking end to end, I think you're gonna have a full time. Um And you could be locked in a room for the most of the day but come out energized um Because of that collaboration, that shared set of ideals, uh everybody working towards that common goal.

Um It's a rare experience. It should be a common experience, work towards it. What do you think? Hit me up um at marknca uh online in the comments down below are as always by email me@markn.ca.

How do you find collaborating, working on problems? Do you get into your white board together? Um Are you breaking down those barriers? What do you find the biggest barrier is? Um let me know as always, we only get better by talking about this stuff um by working together, by collaborating, which again was the theme of today's episode.

So, you know, hey, double doubling down on that. Um I hope you're set up for a fantastic day. I will talk to you tomorrow. Take care.

Read next