All Posts in Leadership

|In: Leadership|Last Updated:

It’s summer — the season when sunlight falling across a sandy beach will warm you through and through, driving the last vestiges of winter’s cold from your chilled and battered muscles. Ahhhh.

Put a convex lens between you and the sun, though, and OUCH!

The difference between diffused warmth and ignition is focus.

Swing a hammer at a piece of wood and you’ll get a dent in the wood. Swing the same hammer at a nail positioned over the wood and you’ll get a hole in the wood, filled with a nail. The difference between a dent and penetration is focus, too — the nail focuses the hammer’s energy onto a much smaller area.

Want your IT organization to have more impact? The secret is no secret — it’s the ability to focus your organization’s energies.

The only problem is, the entire company’s political ecology operates to blur your focus.

It happens like this: A dozen or so different executives and managers submit project requests … important requests … for IT. IT has enough staff to support only three of them at any one time. That, however, would result in winners and losers, so you reach a compromise with the executive committee. Instead of choosing three projects to work on, staffing them fully, and getting each done in the six months a fully staffed project would take, you instead launch all twelve. With twelve projects in play you assign your staff among them so that everyone works on four projects at once.

Being reasonable, you recognize that each project will take four times as long as it would with dedicated teams working on them. But that’s okay, because while nobody is getting exactly what they want, everyone is getting enough.

Except that it isn’t okay. It’s a disaster. First of all, no project should ever have a timeline longer than six months. Beyond that there’s no sense of urgency — two years and forever are mathematically equal, according to the calculus of project management.

Second of all, it isn’t the case that a developer, divided among four projects, will get the same amount of total work done as one who is dedicated to a single project. It takes time for people to switch their attention from one to another — real, significant time, which translates to perhaps 10% or more additional overhead.

And finally, even if neither of these effects were true, it’s still bad business. Compare the business benefit to be had in the two cases. With dedicated project teams, every six months another three projects would finish, delivering their business benefit. One fourth of the total benefit would arrive after six months, another fourth after a year, and so on. With divided effort, the company experiences no benefit at all until two full years has elapsed. If all projects deliver the same annual benefit … call it a Benefit Unit (BU) … then after two years the company with dedicated project teams will receive nine BUs. The one with divided effort will receive none.

Nine to nothing — that’s a winning score. The mathematics behind it isn’t even complicated. In most companies it’s also unachievable, due to a recently-discovered psychological effect known as “envy.”

Okay, I lied about it being recently discovered.

Envy works like this: Imagine I offered you five thousand dollars, just for reading Keep the Joint Running every week. I imagine you’d be happy to have it.

Now imagine that after a few months you found out that I’m giving your colleague in the next cubicle ten thousand dollars for reading it. Would you still be happy about the five grand you’re getting? If so, you’d be unusual. Most people would be unhappy at the unfairness of it instead. They’d be envious.

So it is with IT governance. Give the members of the executive committee a similar choice — everyone gets the same small benefit, or everyone gets more benefit, but it’s distributed unequally — and most will prefer the former.

Most CIOs think of IT governance as a process — an organized series of steps, that operates on evidence and logic in an almost algorithmic fashion to establish IT’s priorities.

It sure would be nice if that was the case. It can be the case. But only if, as a prerequisite, the executive “team” is really a team — aligned to a common purpose instead of each one focusing on personal perquisites.

It does happen. It just doesn’t happen very often.

Comments

|In: Industry Commentary|Last Updated:

I got into a bit of an altercation in one of this week’s Advice Line postings. It was in response to an exceptionally snide episode of Roger Grimes’ Security Advisor column in InfoWorld. According to Roger, there is exactly one way that all companies should manage desktop computing, and that’s to lock all PCs down tight.

Roger hauled out all of the expected arguments: End-users are, to paraphrase, lazy slackers who will install anything so long as it has nothing to do with their jobs. One of his examples was GotoMyPC, which allows them to work from home (I’m not making this up) which gives you an idea of why I felt compelled to offer a critique.

To be fair, in other columns Roger has pointed out that in order for a total lockdown strategy to succeed, IT has to become highly responsive so that end-users can get the tools they need to do their work quickly and without a lot of fuss. Amen to that.

Roger also makes a useful point — that the nature of malware has changed, from attempts to shut you down to attempts to steal information. His conclusion — that the risk, in consequence, is now much higher — is questionable, akin to claiming that because bad guys now want to pick my pocket instead of whacking me on the noggin, I’m in more danger. But the shift in emphasis is nonetheless important to you as you formulate your security tactics.

Highly responsive IT coupled with total lockdown is one way to start securing the enterprise from information thieves, but it’s far from the only one and it’s sadly lacking in many important respects. It doesn’t, for example, protect your information assets, except from a specific type of threat.

Many are pointing to the theft of a Veterans Administration laptop computer that had a huge number of veterans’ social security numbers as evidence of the need for tighter security. That total lockdown wouldn’t have helped doesn’t seem to faze many of those who haul out this example.

Frank Hayes has written about this extensively, and his point is right on the money (as usual): The solution is to not put social security numbers, or credit card information, or any other highly sensitive but unneeded data field, into any downloaded data. If you don’t have it, nobody can steal it.

Next, encrypt all sensitive data fields. If an intruder or disgruntled employee downloads gibberish, there’s no harm done, and taking names, addresses and telephone numbers results in minor inconveniences, not identity theft.

Third, pay attention to physical security. Securing PCs might be fun, but it does little good if anyone can sit down at a desk in Payroll, after the employees have gone to lunch but before the login has timed out.

Fourth, institute disciplined procedures for identity management — for employee on-boarding, transfers, and departures. This helps ensure that employees only have access to the data they need, not all data they ever needed in all roles they ever held. If an employee doesn’t have access to sensitive data in the first place, malware on that employee’s desktop is less likely to transfer sensitive data outside the corporate firewall.

Fifth (of course): Install malware prevention on every desktop and keep it up to date. There is no shortage of choices, and all will do an excellent job of blocking most intrusions.

And sixth, go beyond being responsive. Anticipate what employees are likely to need and make it available … easily and without red tape. In various places in the company are employees who will be more effective if they can make use of: Digital cameras, MP3 players, a work-from-home solution, a work-from-hotel-rooms solution, PDAs/Treos/Blackberries, a real Personal Information Manager, Google Desktop, Instant Messaging, and a PDF writer (as just a few examples).

Don’t believe me? Property Management uses the cameras to document site visits. An increasing number of employees listen to podcasts while commuting. I’ve lost track of how many times Google Desktop has found files I’ve lost track of. Just for starters.

Few employees “need” these things. Need is a poor measure, though. Providing tools that make work incrementally easier is a good investment of your time and energy. That’s because, while there is no magical demarcation point, a pile of incremental improvements turns into a qualitative change. The proper test is always value, not need.

Want to make sure employees don’t install software on their own? There’s an easier and better solution than totally locking down their desktop and laptop computers.

That’s beating them to the punch.

Comments