A practical approach
I previously wrote about building security culture in the organisation, in this blog, I look at the security team itself and share some tips for CISOs to develop a culture of performance for their teams.
I just returned from my trip to Bangalore, India, where I was asked to deliver a series of training activities to the KPMG offshore teams. Spending a week there came with lots of wonderful insights.
First of all, India is a beautiful country. I didn’t really have a lot of time to travel around, but I still had a chance to visit the Bangalore Palace, drive up and down the Mahatma Gandhi Road, see the Parliament and many beautiful parks.
Moreover, apart from delivering training sessions myself, the local leadership organised a presentation for the UK team, where we were described the services they offer globally. I was impressed by the level of innovation and standardisation, which clearly demonstrate the rapid technological growth in India.
I’ve had a chance to work with some of the marvelous members of our offshore team before, and it was very valuable to finally meet them in person. I had an opportunity to interview a few people for a position in my programme and we are already on-boarding the successful candidate.
Not only I was able to share my knowledge and meet some lovely people, but I could enjoy a brief but wonderful taste of India and its warm hospitality. I’m sure the effectiveness of our communications and project work will increase substantially in going forward.
Imagine the following situation. A father with his son are driving to the camping site for the weekend. The deer was crossing the road and the car hit it. The father dies in the accident and the son is badly injured. He was swiftly brought to the emergency room and requires surgery. A surgeon enters the room, sees the boy and exclaims: “I can’t operate – this is my son!”.
How is it possible?
Think about it for a few moments…
Didn’t his father die in the accident? The answer is really simple.
A knowledge management system is an integral part of a modern organisation. It involves processes, people and technology that make sure information is not only kept in the individuals’ heads but is shared with the whole department. It is usually implemented in the form of an intranet portal which requires processes to maintain it and people to support it.
Because I believe having the right information at hand is crucial in making effective business decisions, I volunteered to take on the role of a knowledge management champion in my department. A knowledge management champion is the person who oversees the adequate operation of the system. In this case, to lead the project that would re-launch the system that wasn’t being fully used.
In my company, the knowledge management system is mainly intended to support the bid management process, where we respond with proposals to fulfill specific requests from our current or prospective clients. It is also used to assist project delivery when a piece of work is won.
As a first step, I managed a team of four to analyse the current state of the system and to gather feedback from the users to understand the limitations they felt they encountered. We discovered that the portal was hardly being used because some users were unaware of its existence, and many others found the navigation not very user friendly. This meant that the information stored in it was out-dated.I then developed a strategic plan to promote easy access to static information such as templates, proposals and engagement created data for the department. Several design changes were introduced based on feedback from the users.
Because the portal is only useful if it actually contains data that can be easily searched for, the next step was to collect as much information as possible from the department. We held multiple interviews with engagement managers to gather case studies and relevant data to add to the system. To ensure that the quality of the data collected was constant, we created a case study template consisting of three main parts:
When the design changes were implemented, the outdated data was removed and a sufficient amount of information was collected, everything was ready for the system’s re-launch. This re-launch was important enough to be given a presentation slot at the quarterly departmental meeting, where we talked about the improvements, encouraged the users to use the system and requested further feedback.
Though this successful project, as all projects, had a defined desired outcome due by a specific date, knowledge management never finishes and requires continuous improvement. It is now in the operational “run-and-maintain” state. New information is being uploaded to the portal and processes are in place to make sure it is maintained and information remains up-to-date.
I also organise regularly and participate in knowledge sharing events. I believe participating in such events and communicating lessons learnt to the rest of the team can help everyone to avoid mistakes we’ve made in our projects and improve the quality of deliverables.
Image courtesy of cooldesign/ FreeDigitalPhotos.net
We discussed improving team productivity previously. I received a few comments regarding this topic, which I decided to address here. I would like to cover the question of developing your team members through coaching.
I remember attending a workshop once, where the participants were divided into two teams and were presented with a rather peculiar exercise. The facilitator announced that the goal of this competition was to use newspaper and tape to construct a giraffe. The teams would be judged on the height of the animal: the team who will manage to build the tallest one wins.
There are many variations of this exercise, but they all boil down to the same principle. The real aim is to understand how people work together. How they plan, assign roles and responsibilities, execute the task, etc.
In the end, everyone had a chance to discuss the experience. Participants were also presented with feedback on their performance. But can people’s performance be improved? And if yes, what could have been done in order to achieve positive and lasting change?
The answer to these questions can be found in coaching.
Coaching is all about engaging people in an authentic way. There might be different opinions on the same problem, which doesn’t necessarily mean that there is only one universal truth. How much do you appreciate and respect what other people think?
Coaching, however, is not about knowing all the answers, but about listening, empathising and understanding others. Here are some example questions you can use:
The last thought I would like to mention here is about giving people time to reflect. Some silent and alone time can yield unexpected results. Our brain is bombarded with enormous amounts of information on a daily basis. Finding time to quiet your mind and slow down can help you to listen to your inner voice of intuition. This can help you come up with innovative solutions to seemingly unsolvable problems.
All companies have assets. They help them generate profit and hence require protection. Information security professionals help companies to assess and manage risk to these assets and make sure that cost-effective and appropriate response strategies are chosen to address these risks.
Enterprises in turn may decide to implement mitigation strategies in the form of technical, procedural, physical or legal controls. These implementations would have a defined start and end date and would require resources and hence a project rather than an operational activity.
However, such implementations have their own project risks. According to the Guide to the Project Management Body of Knowledge, risk is an uncertain event or condition that, if it occurs, has a positive or negative effect on one or more project objectives.
The project risk management process is similar to the information security risk management and consists of four stages:
1. Identification – Log risk, agree and assign an owner
2. Analysis – An owner assesses risk and sets probability and impact
3. Monitoring and Control – An ongoing process of tracking identified risks, monitoring residual risks, identifying new risks, executing risk response plans and evaluating their effectiveness throughout programme.
4. Response planning – What response will be taken to manage the risk
It is a good practice to involve your team and all relevant stakeholders during the project planning stage to identify the risks and populate the risk log
During the execution of the project, the risk log should be continuously revised and kept up to date to ensure that project issues, risks and mitigating actions are fully and formally assessed and managed throughout the project lifecycle.
Enterprises across the world are becoming more and more aware of security-related issues and their impact on the business, making them increasingly willing to address them. Although they are open to listening to the security professionals’ advice, the language the business speaks is different.
It is important for security specialists to understand the business requirements and communicate the value of security accordingly. Managing stakeholders and communication is therefore becoming one of the essential skills of the modern security professional.
One should understand that the earlier people are involved in a security project, the easier it is to get their buy-in. It is useful to spend some time on planning the communication prior to a project kick-off.
As a first step to such planning, a stakeholder register could be created capturing the contact information, expectations about the project, level of influence, and other characteristics, as in the table below.
As soon as the stakeholders are identified, a communication management plan should be created. One can engage the stakeholders to identify the best way of communication, its frequency, responsibility and a reason for sending.
While managing a project, a security professional spends almost all his / her time communicating in various ways. Proper stakeholder engagement and communication planning can make the security-related projects run much smoother. At the end of the day, security professionals are there to help people to make the business more secure. This task can be achieved more easily when people are cooperating with the security professionals rather than trying to sabotage the project.
Today’s security professionals must know how to design and implement security transformation programmes on an enterprise-wide scale. In order to be successful at this, not only must they be technically savvy, but they should know how to build, lead and manage a team effectively for this purpose.
When dealing with teams, many people mistakenly assume that some team roles are more important than others, when in reality, all participants are equally essential. The diversity of skills makes a team versatile and is reinforced by the active involvement from all parties. Each role, trade or character type has its own strengths and weaknesses, which should be identified, harnessed and optimized (or reduced, in the latter case) in order to enhance the team’s overall performance. There are several existing resources for thoroughly exploring these complex human dynamics. One of the strongest ones available is the Belbin Model.
Dr. Meredith Belbin designed a personality test, known as the Belbin Team Inventory, in which he defines nine team roles that are necessary for a team’s optimal performance.
Through a 360-degree feedback mechanism (which includes the individual’s as well as the observers’ evaluation, mutually contrasted with one another), this test is designed to identify an individual’s personal behavioural traits and interpersonal strengths. It is not uncommon to see, however, that many people score strong tendencies towards multiple roles.
Based on the assessment of the individual’s behaviour within a team environment, Belbin sorted these nine roles into three main categories which include the action oriented roles, the people oriented roles and the thought oriented roles.
The action oriented roles and their strengths are the following:
The people oriented roles and their assets comprise:
Finally, the thought oriented roles and their potency characteristics include:
One of the core foundations of the Belbin Team Inventory is that a team can be considered well-balanced when all nine roles are present and participate actively. When we recognise our individual role within a given team, we can further develop our strengths and manage our weaknesses in order to improve our contribution to the team.
If several members within a given team have similar behavioural styles or team roles, the team becomes unbalanced and doesn’t function up to its full potential. The underlying cause for this is that similar behaviours imply overlapping strengths, which can foster interpersonal competition rather than cohesion or mutual collaboration. Additionally, similar behaviours mean similar weaknesses, which can be extrapolated as a general weakness of the entire team. Belbin’s nine role definition also includes the identification of the characteristic weaknesses that tend to accompany each team role. These “allowable” weaknesses should be recognised in order to allow for improvement.
The weaknesses of action oriented roles typically include:
The weaknesses associated to the people oriented roles are usually the following:
The drawbacks of the thought oriented roles include:
After many years of studying teamwork, Belbin broadly defined a team role as “a tendency to behave, contribute and interrelate with others in a particular way”: a tendency that people normally adopt when they assume a particular team-role. The individual and interpersonal behaviours might, however, depend to some extent on the situation, since it is not only related to one’s own natural style of working, but to the interaction with others and the actual work itself. This means that each one of us may behave and interact quite differently according to the nature of the team members and/or the work we are exposed to.
How to use the Belbin Team Inventory as a tool
The Belbin Team Inventory is a rather handy tool, and can be used in different ways, like in managing interpersonal differences within a given team, for example, or in considering how to construct a balanced team properly before a project starts, or in developing oneself as a team member.
The Belbin model can be used to analyse an existing team, as well as a helpful guide to develop the team’s strengths, and manage its weaknesses. The following tool can be very helpful in analysing team membership, checking for potential strengths and weaknesses within the team:
1. Observe the individual members of your team over a period of time, to see how they perform individually, contribute and how they conduct themselves within the team.
2. Make a list of the team members which includes their observable characteristics: both key strengths and weaknesses.
3. Make a comparison between each team member’s strengths and weakness with the descriptions provided by the Belbin Model. What team role would you say best describes each person more accurately?
4. Once you feel you have identified each individual’s corresponding role, answer the following questions:
o Are there any roles missing from the team? Which ones? If so, which are the strengths that are most likely to be missing from the team overall?
o Is there are prevalent team role that many of the team members share?
When there are teams of people who perform the same job, there will be specific predominant team roles. In a team of business consultants, for example, there might be numerous Shapers and Team Workers, as opposed to a research department which will mainly consist of Plants and Specialists. These are perfect examples of unbalanced teams, which might be lacking key approaches and outlooks.
If the team is considered to be unbalanced, the first step is to identify the overall weakness that results from the team. The following step would be to recognise areas of potential conflict. An example would be an excess of Shapers that might weaken a team if each one wishes to drive the team in different directions.
5. Once potential weaknesses, areas of conflict and missing strengths have been identified, identify the options you have to improve and change this. Consider:
o Whether one or more team members could develop or adapt how they work together and with others in order to avoid potential conflict of their natural styles.
o If an existing team member could compensate by adopting different a team role. Through awareness and intention, this is sometimes possible.
o Whether new skills need to brought onto the team to compensate for the weaknesses.
The Belbin Team Roles model may introduce more coherence into the team.
It is important to mention, however, that although the Belbin model can be very useful, it should mainly be regarded as a good guide for building a team. One shouldn’t mistake this for depending too heavily on it in order to strive for perfection, which might restrict other potential strengths a team and its members may have. It is basically up to the team leader’s professional intuition to evaluate and decide for him/herself what would be the greatest overall benefit. Perhaps the main concept to learn here today is that in order to have a very high performing team, “the key is BALANCE”.
Resources:
http://www.mindtools.com/pages/article/newLDR_83.htm
Images courtesy of digitalart and jannoon028 / FreeDigitalPhotos.net
Cyber Security Leadership 