Tag: Career

In 2013 I was made redundant from a company where I had worked for the previous 12.5 years. I had grown with the company from the 14th person to join (as a firewall admin) to a position leading 28 people across 14 time zones in a company of over 1,000.

I subsequently discovered that I was basically unhirable, so I started my own consulting practice, which I thoroughly enjoyed. I then joined a very small start-up for a year, which I thoroughly enjoyed, and went back to my own practice.

I swore up and down that I would never go corporate, ever again. I convinced myself that there was never enough freedom, or room for innovation, or ability to make a difference in a large organisation to EVER go back. Not that ‘corporate’ would ever have me back.

Now here I am, at the end of my 3rd week at an organisation that is bigger by far than any I have ever worked for previously.

…and I’m thoroughly enjoying it.

Many times in the course of my blogs I have expounded on the need for self-reflection, on being honest with yourself enough to know when something was entirely your fault, and to adjust your career choices accordingly. Well clearly I had mistaken ‘corporate’ for my own inability to effectively create the change needed to stop me from being made “redundant”.

While I’m not saying I now have that ability, as I will always have a big mouth, when you’re in an organisation who ALL seem to want the change you’ve craved your whole career, it’s a feeling unlike I’ve ever experienced at work. I’ve never needed, or even particularly wanted, to be part of a team growing up, I now find myself in one.

…and I like it.

Frankly I’m not even sure why I’m writing this blog, except perhaps as a tip for those who find themselves in a position where they cannot decide on what’s the right place for them to work. Corporate, start-up, self-employed, or somewhere in between. Every one of my jobs had its benefits, and had its downsides, and I’m under no illusion that this one will be the same. The only difference this time, is that I have now seen both sides of the fence.

It’s not the fence that matters, your skills and talents have no fences.

The only reason I think that corporate fails to attract the truly entrepreneurial is that they are still very attached to job titles and descriptions, effectively pigeon-holing a person into a role that will always limit them. It’s the organisations that go looking for talents to fill known functional gaps, but then get out of the person’s way, that will attract the game changers.

Not saying I’m a game changer, but my title was only assigned to complete a field in the HR system, and my job description was a run-down of the challenges my new organisation was facing. And in just 3 weeks I have not only learned more than I did in the last 6 months, I have a learning curve ahead of me for which I can see no end.

I loved running my own business, and have no regrets about the start-up, but this little adventure is a revelation that has me very excited for the future. And the lesson I learned from all this?;

Don’t limit where you look for your next job, just ask the right questions.

[If you liked this article, please share! Want more like it, subscribe!]

[Ed. June 2016: Clearly this gig did not work out, but I am still not against trying again for the right organisation.]

I don’t necessarily mean faith as it pertains to religion, although that is by far the best example of how faith can completely negate ever having to think for yourself. Ever again.

When I talk about faith, as defined by; “A complete trust or confidence in someone or something.” you can perhaps see where faith can be a force of tremendous good, or horrific bad. When you remove the need to question something, you remove any reason for that thing to change. When your most valuable asset; your ability to reason, is subsumed into a concept not of your making, you have lost your individuality, your uniqueness. You have lost your sense of self.

When humans first became self-aware (estimated at around 60,000 years ago), the number of things to fear rose exponentially. Animals don’t fear an eclipse, but humans managed to attribute countless negative interpretations to this natural phenomenon. With self-awareness comes both the need for rationality (a reason for something), and the trait that I think truly defines us most as human;

Curiosity.

When you are absolutely certain of something, you can effectively ignore it; I have absolutely faith the sun will rise tomorrow or why would I bother getting out of bed? I have absolute faith that my wife loves me or why would I be with her?

The difference between the above paragraph’s examples, and faith in religion (for example), is both tangibility and direct experience. The sun has come up every day I’ve been alive (except the few days I spent in Scotland), and I’ve been with my wife for 10 years. That’s proof enough for me. But what if I base my faith on a concept that has only been passed on by others? Or out of a book? What does that do to our thinking? In some cases clearly not much, but some of the worst horrors in history have been perpetuated based on interpretations of words written centuries before.

And what happens when such thoughts becomes mandatory? When not having the same thoughts becomes a valid reason to violate the rights of others. Again, this is not just religion, but science and even sports aren’t immune from unshakable faith. Scientists and fans alike have committed atrocious acts because in their mind the victims were so wrong that their very lives were forfeit.

It’s a combination of things that keeps this destructive force self-perpetuating; from bigoted parents teaching their kids to hate, to inflexible older generations unable or unwilling to adapt, to a general unwillingness to admit when you’re wrong. Hiding bigotry against sexual orientation behind the bible, racial bigotry behind past atrocities, and murder behind a God all have their roots in the natural byproduct of misplaced faith; ignorance.

I have no answer for this, all I can do is not be part of the problem. Life is not fair, life just is, and YOUR life is what you make of it. That fact remains that it is already difficult enough to find sufficient happiness to make the life you have worth living without making it difficult for yourselves by hating, and hurting everyone around you by your selfish actions.

Believe in whatever you want to believe, just leave the rest of us out if it.

[If you liked this article, please share! Want more like it, subscribe!]

I had the honour of presenting at an ISC2 London Chapter meeting a little while ago, and my chosen subject was ‘Mobile: Changing the Face of Identity Management (IM)’. What I thought was going to be half an hour of me espousing my ideas (or ranting, depending on your point of view), turned into the most lively debate I have ever had in front of an audience.

Initially I wondered if my 10 slides was going to be enough (although I never actually read to the material), but I didn’t even make it past slide 7. By the time I was on slide 5 the questions started, then the dissenters chimed in, and by the time I reached slide 7 the presentation was forgotten. My 30 minute slot was over before I knew it, and it was clear a lot of people had a LOT more to say, which they did over beers afterwards.

The culmination of this discussion was when I heard the following; “I don’t agree with ANYTHING you are saying!”, which for a lot of people (especially ‘expert’ presenters) can be the cause of anger, considered a challenge, or can even cause outright panic. To me it should only ever be the cause of curiosity; WHY am I wrong? I certainly don’t think I am, and probably still won’t after I hear your explanation. I’m curious nonetheless.

But what I will do is hear what you have to say as objectively as I can, and respond as neutrally and I can. Usually without much success mind you, we are all very attached to our opinions, but I will at least try.

Presenters are supposed to be experts in their fields, otherwise why the Hell are they on stage, but that does not [necessarily] make them right, especially when the subject is focused on future-state concepts as opposed to subjects which are long established. I have no idea where Identity Management will be in 5 years, but I have a rough idea. Also, my ideas are also right for ME, but I am decidedly on one side of the privacy challenges that surround the field of identity and privacy like a miasma.

I guess in the end you must decide for yourself if you want to be a lecturer, where your subject is not really up for debate (like when I train groups in PCI for example) or a presenter, when your ideas must be open to not only comment, but potentially ridicule. I have to admit, it makes presenting is a lot more fun, and if I only have to produce 7 slides to get an audience engaged, then I have a lot less work to do! 🙂

The lessons I learned in that presentation will stand me in very good stead for the next one, and who knows, maybe I’ll even finish all 10 slides.

[If you liked this article, please share! Want more like it, subscribe!]

There are some things in life that you assume everyone must know by now; give a firm handshake, never accept credit for someone else’s efforts, never be rude to waiters and so on. Yet so many vendors in the information security industry fall foul of an offence far worse than these.

They use phrases like:

  • 100% secure
  • Unbreakable
  • Completely safe
  • Fraud-proof
  • Hack-proof
  • and so on…

The fact remains that NOTHING in information technology is 100% secure. Nothing. If someone wants it badly enough, and they have the necessary skill-set/support, they are going to get it, and anyone who espouses differently should find another line of work before they cause any[more] damage.

And it’s all so unnecessary. You don’t need 100% security even if it was possible, what you need is security ENOUGH. The bad guys are lazy, and if you’re too difficult to breach they will move on, so just ‘build your fence higher than your neighbour’s’ From what I’ve seen in the 15 years I’ve been consulting across the globe, this should not be too difficult.

The calculation you have to make is this;

If the Cost of Security > Value of Data = do what you can afford and no more, OR, if the Cost of Security < Value of Data = do it, but do only what makes sense.

So what process magically gives you the answers to this equation? Easy, the Risk Assessment. One of the most basic tenets of a security program done well, and one of the most under-utilised business tools in every organisation I’ve helped. A risk assessment process performed appropriately will tell you what you’re not doing well, how to fix it, AND how much to spend on doing so.

But I digress.

I can actually empathise with organisations and individuals trying to sell security. It’s tough, but that’s no excuse for lying about your products, and that’s exactly what you’re doing if you claim 100% security. Lying. You have a responsibility to your customers, and whether you like it or not, and whether you ARE or not, you are the usually the expert in the room (if you know 1% more than the other person you are the expert). Your client came to you for help, it’s up to you to provide what they NEED, not necessarily what they asked for.

Your credibility as a provider of information security services or products goes hand-in-hand with your integrity as an organisation and/or individual. Think of your integrity as a form of currency; you can either invest it in your credibility, or spend it on quick wins. Only one of these has a long-term future.

I will note however that if you’re a buyer of security services, you have as much responsibility as the seller to buy only what you need. YOU must ask the right questions, and the only way you can do that is to either do your homework, or hire someone to do it for you. Never expect a salesperson to think twice about giving you what you ask for, then charging you again for providing what you should have asked for in the first place. This scope creep is your fault as much as theirs.

This white paper is not how to sell, I can’t do that, this is how I think you sell with integrity; How to Sell Security

The title alone will severely limit the interested audience, as the 11 Plus is a concept that even at its ‘height’ was restricted to England and Wales.

The premise was that children in their last year of primary education (aged 11 – 12) took a test to narrow down their options for their secondary education. The better they did on the 11+ the more choices they had. I wish I had ‘failed’ mine way back in 1978, going to an all boys school absolutely sucked.

A friend of mine’s daughter had recently gone through the process, and like me he was amazed at the questions being asked. This was not a straightforward maths/english/reasoning test, this was a test of character that put to shame my interview techniques as a Senior Manager in charge of adult security consultants. Should I be unfortunate enough to ever be the manager of people again, I will be using these questions:

Why should you get priority over other children for a place in this school? – How would YOU answer that question, or what answer would you be looking for?! Say the wrong thing and you’ll come across as arrogant, insecure, indecisive, desperate, disinterested or a combination of several of these.

List 3 things you are good at or like doing. – Generally speaking, people like doing the things they’re good at and dislike things they aren’t. Sadly most people don’t KNOW they’re bad at something, so a question like this can help weed out the humble from the potentially deluded.

What is the most exciting thing that has ever happened to you? – Personally I would dismiss anyone saying anything about work. Passion for your chosen career is one thing, but someone without other interests is to me rather suspect.

Is there anything that I haven’t asked you about that you would like to tell me? – This one’s a doozy! Do I say no and let the person think there’s nothing more to me, do I say something and perhaps come across as trying too hard or do I ramble on because I’m nervous and end up boring the hell out the interviewer?

The above were good, but the next one was to me astounding;

Is life fair?

Bear in mind this is being asked of an ELEVEN year old, but now think about the answer you would give. No it’s not fair is whiney, yes it is fair is delusional, which leaves the only real answer; life is neither fair nor unfair, it just is. It is surprising just how many people cannot accept this.

Life is what YOU make of it, so any answer outside of that speaks volumes to the person you’re interviewing. If they consider life unfair then they are clearly not taking full responsibility for their own actions, anyone who thinks life is fair has likely never been truly tested and makes the following quote rather appropriate;

“I’ve never met a strong person with an easy past.”

Experience is one thing, you can read that on a person’s LinkedIn page, character is something else and rarely glimpsed during the interview process. Perhaps by asking questions we would ask our own children we can change that.