Digital Sniper

Hamstring: To destroy or hinder the efficiency of; frustrate

This definition brought to you by Merriam Webster. Recently, I became a member of the most crippled security operations team I have ever seen in any organization. The principals managing the security operations are essentially strangling the capabilities of the SOC. An extremely troubling aspect is the SOC is tasked with responsibilities and service deliverables, but not the access to tools required to provide the level of service laid out in the statement of work.

The onus lies on the SOC too and there have been multiple occasions where they have displayed a lack of effort and attention to detail. The personnel are jaded and paralyzed by fear with the ability make decisions or act in any fashion resembling a SOC.

So how do you repair this failed operation? The principals can’t be replaced and the overall organization suffers from a clinical case of indifference and incompetence. If the contractors are replaced in the SOC, the same management environment still exists. Note the use of the term management and not leadership. You can start there by implementing a leadership culture. Next, bring in outside experience not affiliated with current organization or similar vertical markets. A good antidote for stagnation is fresh ideas from professionals outside your market. As for the SOC analyst, sometimes you need replacements, but they need to have the trust of the principals and belief in their abilities.

Ever pulled a hamstring?  Well if you haven’t it hurt like a mother and you have a very hard time walking with any fluid and graceful motion.  Metaphorically speaking, this is what happens to organizations when they operate in organizational silos with no cross-functional interaction.

In my experience this is commonplace in the Department of Defense and virtually every other US Federal agency, but it is more commonly referred to as turf wars.  Call it whatever you like, it’s dangerous to the business whether it’s the bottom dollar, lives on a battlefield or public funds.

So what is an organizational silo?  Well think of a grain silo and fill it up with people from one specific group of an organization who focus on one part of the business or operations.  There is your silo.  People in the silo operate in their own little grainy world and have no desire to share or accept input from other silos.  When they are forced to play as a group it is very succinct and sometimes unprofessional, resulting in less than stellar project performance and operational gains.

Why does this happen?  I’m sure it has something to do with sociological issues surrounding informal group definition.  People tend to stick together and form groups.  Organizational silos may form a large scale informal group because everyone in the silo has something in common, their mission.  Many people don’t like change and cross functional exercises introduce strangers and God forbid, interaction with others!

So how the hell does this relate to digital security?  If you look at the interaction between groups in an organization when performing a security assessment, it’s easy to see the relationship.  The business group operates like a ballistic missile leaving a wake of carnage in its path with IT requirements, ideas and pointed demands.  This is all warranted.  Yes that’s right, warranted.  Remember, IT and digital security are not the focus of the business, only enablers.  It may not seem fair, especially if you are feeble progressive school raised digital security expert, but guess what?  Life ain’t fair!  It’s our job to keep the business moguls and the infrastructure tyrants in check through balance, tactful approach and documentation of recommendations which are nullified by higher powers.  It’s usually a good idea to have proof you attempted due diligence and it was disapproved.  Sometimes if feels good to say “I told you so!”, but I don’t recommend it.

How does cross functional activities overcome silos?  Consultant answer, it depends.  Cross functional activities may be utilized by having resources from each silo contribute to a project which affects all the organizations.   Be careful, interaction!

Matrix organizations normally don’t deal with silo issues because of the meshed operations and utilization of resources across the functional silos.  Once I got to this point, I Googled organizational silos and the fifth result was an article called “Smashing Silos” by Evan Rosen of Bloomberg Business.  Unfortunately, I have rehashed almost everything he stated but the point I’m trying to make is that any project involving IT change or development should include someone from the CISO’s staff to provide guidance and stop the surprises or pointed demands, also known as risk acceptance.