I’m fortunate enough that the deployments that my employer puts me on are always fun and interesting. It’s like changing jobs every year

Currently I’m running a operational team at a financial institution (no more details needed), and it’s interesting to note the different styles of management. Being 38years old, I would like to consider myself a adult, and the youngest person in my team is 24years old. Also someone I would regard as an adult. Now, I’m billed out for 8 hours a day, so I make sure I work the 8 hours, even if I’m on site for 9 hours since I can’t bill the client for my lunch hour (that would not be ethical, even though 50% of the time I eat my lunch at my desk).

Yet, the team spends quite a substantial portion of their day doing timesheets on various systems. As team leader / manager, I’m now required to verify those times to clocking system etc, and report on deviations (either over or under). Essentially, this reminded me of the time I was with <my old employer>, and we were religiously “clock-watched”. You could sit nearly 3hours in the canteen and talk to your buddies drinking coffee, spend another hour smoking, and no-one would be the wiser. If you arrived 8:10am, you were frowned upon It almost reminded me of my national service days, where we stood roll-call every day twice a  day. This is not school, we are not children, please treat us like adults. A concept that never seemed to take hold.

Now, here is my question to my fellow Info-Sec practitioners. Do you work on timesheets, or output-based delivery? Yes, there are scenarios where services are outsourced, and the company pays for 40hours a week, thus the person needs to be on site for that amount of time, but I find that I am more and more leaning to the output-based delivery for the team not based on hours billed.

If you want to come in at 9:30am, leave at 5pm that is your prerogative. If I ask you to do something by a certain date or time, and you don’t, then I’m going to be annoyed. If you want to do it at 9pm while at home while VPN’d in, that is your bad planning (or maybe your choice). You committed to deliver work at a time and date, and how you manage your time is up to you. If calls are piling up, tickets are unresolved and service to the business suffers, then those timesheets are not going to mean anything. You have bigger problems in your team(s) which need addressing.

When you manage your teams, do you clock-watch, or do you measure them on delivery?

It’s with interest that I read Haroon’s article “Infosec needs an injection of honesty“, since it echo’s quite a bit what’s been going on in the blogosphere and twittersphere lately. I disagree though, our industry doesn’t need as much an injection of honesty, as business needs an injection of honesty.

There, I’m disagreeing with Haroon (who I do think is one of the single smartest people I know). In some circles, to use an example, anti-virus vendors have almost been labelled worse than the child molester in the Santa suit handing out sweets outside a school. It’s true though, some of the vendors are terrible, but they should not take the brunt for the problem. Business should, and this is why.

In my previous employment I worked for a large retailer as a ISO for 11 years. We had a AV product, and the product was terrible. We went through the process of doing POC’s on new AV software, trialled it for weeks, even months, and when the time came to sign on the dotted line for the purchase order, we were simply told we are renewing the old licences.

The question then begs, who is to blame in such a situation? The bad AV vendor for making a bad product in the beginning? The good vendor for not selling his product well enough? Or the $CIO for not making the right decision? This situation repeated itself ad-infinitum during POC’s for products that would actually really secure the business, or in scenarios where business processes needed to change, or or or… Sure, you can blame the ISO for not being able to convince the CIO that the product needs changing, you can blame the project manager for not convincing the CIO that there is enough time and resources to make the change, or you can blame the business analyst for not convincing the CIO of the benefits of the change on the business. Ultimately, if all those people did their jobs, and the CIO still makes the decision not to change, it’s a business decision.

The company (which shall remain unnamed for this article) launched a loyalty card / program, with a huge infrastructure back-end etc, and the first time ‘security’ was made aware of the program was at the launch. When asking the enterprise architect if a pentest or other security initiatives had been done, the answer was “no, and before you do we need to fix one or two things”. Is this the infosec area’s fault, or is this the fault of business that wanted to launch a campaign in secret without considering the impact of over four million users details being leaked should there be a breach? How can security make the business aware, when it has been excluded from the process completely?

The point I’m trying to make is that, infosec as a industry might have some problems, but I don’t believe we’re to blame. Business is to blame for the situation it finds itself in. As a consultant (luckily not too green), I see many organisations where the problem isn’t a lack of will to secure the systems, the problems are political minefields where budgets and ego’s play a far bigger role in choosing bad designs and products. Business should not be allowed to choose products and services based on what happens on a gholf course. Hell, most info-sec guys I know don’t even know how to play gholf! Then again, no-one ever got fired for buying IBM or SAP.

Luckily at Performanta, we offer consulting, services and products that I will stand by. Our consultants actually have a clue, our services guys actually know what measurable metrics are, and our products are some of the best in the industry.