Incoherent Ramblings

Posts by Christopher

Identifying Risks Part 1

Oct01
2011 Leave a Comment Written by Christopher

We started last week with a simple example of the overall process and description of risk management. In the prior example I gave you the risk that we wanted to focus on, but never went through the process of identifying all the risks that would be associated with the task (or mission or project).

What is the task or mission?

This may seem obvious, but knowing the mission makes a big difference in the risks you will ultimately evaluate. Focusing on the wrong goals will waste time and could lead to mitigating the wrong risks. In addition, the task will help to identify the your stakeholders.

Stakeholder is a big word for who cares about task. This could be as minor as an individual or a large group numbering in the hundreds. Stakeholders will be useful in identifying risks as they will be impacted by failure of the task.

In our running example, the obvious stakeholders are you and your boss. Beyond those you might want to expand the circle a bit. Maybe include your family, coworkers, clients. If you expand the circle extremely wide you could include your fellow commuters. At some point you do need to decide which of the infinite number of possible stake holders actually have enough of a reason to care as you won’t be able to track them all.

By this point, you’re probably wondering what all this has to do with Identifying risks. These first two pieces are important in bringing the right people together to help out. Identifying risks works better when you have multiple minds involved. Everyone has their own biases as to what counts as a risk and how severe it is. The intent with involving multiple participants is to average out these biases and help develop a consensus view.

Next time we’ll look at some of the techniques you might use in these groups to facilitate risk identification.

Posted in Risk Management - Tagged , , ,

What is Risk Management?

Sep15
2011 Leave a Comment Written by Christopher

The first thing I want to stress is that risk management is something that we all do every day of our lives. There are varying degrees of this process and some are not even aware of this process. The most obvious example that most of you are familiar with is purchasing insurance. Insurance is actually a method of risk transference but we will get to that later. The amount of coverage you get, your deductible, and various restrictions are all risk management decisions that you make. Effectively what I am mostly doing in the office is this on a larger, formalized scale.

Everything we do, every day, has some measure of risk in it. How we respond to every risk is different. What we want to try to do is gather the information related to each risk and come to some agreement as to the response. This is usually a simple exercise for yourself. Even on a family level the decisions are not usually that fraught with difficulty. Expand this with an organization, involving thousands of stakeholders, it becomes more like herding cats.

Let’s start with a scenario that commuters are familiar with. Your boss wants you at work by 9am. You live about 30 minutes away. When do you leave the house? I’m sure we all make these decisions quite readily and without putting a lot of thought into it. But for this exercise let’s break it down by asking a few questions.

  1. What is the impact of being late?
  2. What is the likelihood that you’ll be late?
  3. What can I do to avoid being late?
  4. How much does it cost be to not be late?

What is the impact if you’re late? Basically, what’s the penalty? The answer probably depends on your boss, your schedule, and how late. If you had a meeting scheduled first thing that would probably be a bigger problem than if you had a one hour buffer.

In a given month (20 working days) how many times are you late? Is there generally a lot of traffic so the commute takes longer? Maybe you take the train and it is almost always on time. Even when the train is late you never end up more than 10 minutes late.

Next we are asking about what you can do to not be late. We call this a mitigation strategy. The obvious one is to leave earlier. But let’s think broader. Maybe you could move closer, or change the mode of transportation you use (helicopter?). Could you adjust your expected arrival time?

The last question is extremely important. For the options you come up with above what is the cost of doing it? Leaving earlier probably doesn’t cost much, but think about the value you place on time, or maybe taking an earlier train costs more because of peak pricing. Renting a helicopter could be really expensive, but maybe moving closer is ultimately cheaper (less gas, lower taxes …). I would also consider the opportunity cost of leaving earlier or buying a helicopter. Leaving sufficiently early may mean you can’t eat breakfast, or take your kids to school.

After you go through and look at each of these questions you can now compare the cost of being late to the cost of being on time. This is a very important point about why we do this. There is a cost associated with any option you choose. Ideally you are now able to balance the cost of being late and the costs of being on time and decide on the best time to leave the house or potentially completely change the options you have. You could choose a short-term plan and a long-term solution as well.

This example probably took a lot longer to come up with an answer than you use every single day. But effectively this is what we do when evaluating risk and trying to manage it. Most of what I do is managing risk related to IT infrastructure, but again, the concepts here can extend to just about any other field.

Something I do want to clarify before finishing out today, is that risk management is not the same as compliance auditing. In my opinion compliance auditing is a mindset and a process born from our desire to make checklists to reduce deviation. This is a well-intentioned process, and is very effective in some situations. When we overuse checklists we often stop thinking about the reason for the rules. When something goes wrong we blame the checklist. Taking away flexibility, the ability to think keeps us from creating effective, efficient solutions; sub-optimal results. This is why I focus on risk management and not just pure compliance. Risk management allows adults to make decisions based on a variety of factors.

Posted in Risk Management - Tagged , , , ,

Discussions on Risk Management

Sep08
2011 1 Comment Written by Christopher

Over the years I have tried to work on ways to explain to people what I do at my job and my blog seemed like a good avenue to carry out a number of goals that I have for myself. One obvious goal is to communicate better. I’ve never been a great writer, but from everything I’ve seen, the only way to get better at writing is to do it, and have people critique you. So, I’m going to put these up and maybe some of you who are better writers can help me get better.

Another goal is to get better at explaining things in common language. People in my industry and every other industry have a habit of communicating with everyone the same way. We expect everyone to understand our jargon, use the same language, or think the same way. Obviously that doesn’t work. Even some people in the same field can have differing terms for the same thing. I cannot even count the number of disagreements I have had with team members that resulted from differing definitions of the same terminology.

Finally this is also a learning tool for me. I have always found it easier to learn something when I am ultimately required to teach it. If I have to teach about these topics in this forum, there is a hope that I will better understand what I need to know to begin with and get better at my job. So since my primary job is currently focused on managing a team of security analysts, I am going to focus these posts on Security and Risk Management. Most of my examples will come from the information technology or information assurance field, but apply to other areas  such as physical security, finance, and personal decision-making.

Today’s post is just an introduction for my plans. I am hoping to keep to a plan of posting something new every week. If no one ever reads this stuff and recommends topics I’ll just use whatever random topic comes up that week. Who knows how long I will keep this up, but if I can get 25 solid posts in the next year I’ll be pretty happy. So the planned first topic for next week will be an Introduction to Risk Management, where we will go into some basic terms and concepts to set the groundwork. The intro may end up spanning two or three posts. After that I definitely want to talk a little about the book on security convergence that I’m reading now.

Posted in Ramblings, Risk Management - Tagged , , , ,

Funny SPAM comments part 1

Sep05
2011 Leave a Comment Written by Christopher

When you allow reader interaction on a blog or forum you will inevitably have SPAM comments. On WordPress I am using a plugin called Akismet that does a pretty good job catching the SPAM. I read through them once in a while and thought it would be funny to include some of the comments. It’s amazing how ridiculous some of them are while others are pretty well crafted.

No one has ever said my writing is elegant and graceful.

Your artical is simple however retains a little elegance and also grace. And using the options and also customization you’ve got enabled, I’m sure it will eventually appeal to a lot of bloggers. It’s rather commendable that you are interested in let individuals, the people, to employ a wide range of themes for the blogs. Keep these individuals coming!

This one is spot on. His site has nothing to do with what I said.

[...]I’m so impressed with how well this article was gathered and put together. It’s well formatted and written. Quality work like this is a rarity. I appreciate the information and I agree with the author. Although unrelated to my blog, worth linking …

This one actually tried to write something intelligable but his site doesn’t even use WordPress.

Your artical is simple however retains a little elegance and also grace. And using the options and also customization you’ve got enabled, I’m sure it will eventually appeal to a lot of bloggers. It’s rather commendable that you are interested in let individuals, the people, to employ a wide range of themes for the blogs. Keep these individuals coming!

 

Posted in Ramblings - Tagged , ,

Resume Advice

Sep02
2011 Leave a Comment Written by Christopher

So one of my new favorite authors also happens to be my technical writer. He’s been putting up a lot of posts on his blog and he’s been encouraging me to post more myself. We’ve recently been reviewing a lot of resumes (well over a hundred) as my division has a few open slots. If you’re interested, please feel free to apply. Joe has heard me complain about some of the submissions and decided to document a number of my comments with his own observations as he’s been going through them with me. I don’t want to rehash everything he said, you can catch his well written funny post directly, but I do have some additional comments to add.

Contact Information

I really don’t understand why you would not include basic contact information on your resume. You have no idea how that resume will get to someone and any other artifacts associated with that resume can easily be lost. I would say a phone number and email address is the perfect combination, and preferably a cell phone number. If you are applying outside of your company, or want to post a resume for people to scour, a personal email address is best.

If you are applying for an internal position though, I would highly recommend that you use your company email address. It doesn’t take that much effort to update that and apply. It helps to remind the reviewer that you are an internal candidate.

Dates

Please, please, please put month and year. When you only put the year down or nothing it makes it really hard to figure out how long you were really at a position. Were you there for a month or 12? The margin of error on a guess like that is just too high. My particular contract requires that I am able to confirm the years of experience down to the month, so without that information I can’t figure out how much I can bill you out for.

Degrees, Certifications, & License

I understand the desire to apply for positions for which you are slightly under qualified for as a stretch. There’s also a desire to push the boundaries a little and prove that you can do the job. I can definitely relate, as I wasn’t fully qualified on paper for my first job, but I knew I could do the work. If a position calls for a bachelor’s degree and you are going to graduate soon, sure put that on the resume and list the expected date.

In terms of certifications and licenses I don’t think you should list plans for these on your resume. If you don’t have them, you shouldn’t highlight that fact or try to confuse us by saying you took a boot camp or class for that certification. It might help you through the automated screening tools because the certification name shows up on the resume, but when I read that you took the class back in 2009 and still did not obtain the certification two years later, it just suggests to me that you did not learn enough from the course to pass the test. That’s probably not the impression you want to leave.

I might grant an exception if it’s the type of license or certification that requires multiple exams and you’ve passed most of them so far and have a schedule for completion. Just make sure it’s up to date. I’ve seen a lot of resumes where the planned certification was years ago.

Another note on education. I know that there are a lot of alternative school programs out there. Far be it from me to judge the quality of the education that these programs offer. There are a huge variety of learning styles, ability, desire to succeed, and life situations that make a bigger impact on your knowledge base than just the school you attend. That being said, if you are planning to attend a degree granting program, i.e. bachelors, masters, doctorate …, at least make sure the program is accredited. The US Department of Education maintains a database of these schools that is easily searchable, and your institution should also proudly display their accreditation on their website. The accreditation doesn’t guarantee you’ll learn something, but it does show that a group has reviewed the program and feels that the program and process of education is conducive to education. To me accreditation is a minimum bar for the institution.

You work for whom?

A final story that I want to share. We had an interview a little while back. We looked at his resume and thought, “This might be worthwhile to talk to Bob” (not his real name). He seems to have the right experience and it looks like he worked for us 10 years ago.

As we were going through the interview Bob kept mentioning tools and systems that we are using today at my company and we were shocked at how much he knew about our organization. It wasn’t until the last 10 minutes of the interview did we figure out he actually still works for our company. The way he had written his resume it looked like he left us 10 years ago and started working directly for government. Turns out he was just working on a contract for the government but still employed by us.

Obviously the format of his resume did not make that clear as we were all dumbfounded at the realization. It also did not help that he listed his government email address as his primary contact. This goes back to the issue of applying for an internal position. If he had at least listed his internal company address and not his client site address we may gotten the hint.

Posted in Ramblings - Tagged , , , ,
« Older Entries

Archives