Desktop version

Home arrow Computer Science arrow Securing Systems Applied Security Architecture and Threat Models


Building a Team

Since I have stressed the experience-based quality of the practice of securing systems, it will be obvious that the people who perform this work are a determiner of success. It isn’t just the technical skill of the practitioners that is important, but their so-called “people skills” that are an essential factor, as well. Indeed, attitude may be a crucial ingredient. A can-do, optimistic, “we can solve this problem” attitude can even be charismatic, drawing others into solutions, attracting them into the work of securing systems.

How does one go about finding deep technical skills coupled to a love of people and a cheerful, optimistic, solution-oriented attitude? Don’t forget that you will have to work closely with each of your team members. (Your personality is important, too!)

I’ve enumerated what may sound like an impossible combination of skill and temperament. You may notice that I’ve not added, “has a similar approach”? Diversity among your team members will also be critical. In my experience, motivated people who are dedicated to doing “the right thing” don’t need to all be similar. In fact, diversity of approach, style, thought patterns, and work style are not obstacles to overcome but rather gifts to be encouraged.

My teams typically encompass many fairly divergent cultures, most of the world’s major religions, every stripe of political viewpoint, and any number of divergent value systems. All of this diversity makes for a rich stew out of which are born innovative approaches and synthetic solutions—if leadership can find value in a wide range of ideas and personality types and then demonstrate that encouragement. I believe that building a truly global, high-functioning team must start with the first person or two, usually those who will be “leaders” of the team. To paraphrase the famous saying, “Physician, heal thyself,” we might say, “Leader, lead thyself, first.”

Authentic leaders demonstrate a passionfor theirpurpose, practice their values consistently, and lead with their hearts as well as their heads. They establish long-term, meaningful relationships and have the self-discipline to get results. They know who they are.4

Again, numerous material is available on how to select and interview people for the qualities that you seek. Those skills are beyond the scope of this book. Instead, assuming that you can select for the above qualities, what do you do, next?

When starting a new team, I focus on relationships first, and not just my relations with other team members. I work to foster trust and empathy between team members. I’m not very goal oriented. In fact, one architect told me, years later, that he initially thought that I “couldn’t lead,” because I rarely forced decisions on the group. Rather than giving solutions to the group, I often let the group decide, even in opposition to my (rather more experienced) ideas. I let mistakes occur,[1] followed by their natural consequences. This was all purposive, with the full knowledge and support of my chain of management. Several years later, that same architect told me, “Brook, you made a home for us.” That was one of the highest compliments anyone has ever paid to me.

As that team’s capabilities and cohesion flowered, so did their ability to climb mountains and conquer seemingly unsolvable problems. The secret was and is in building relationships, first and foremost, while, at the same time, avoiding being overly pressured by goals, at least at first. Measurable objectives come in once the team starts to function and can do so effectively without its “leaders.” The team will have become self-sustaining.

If I’m starting from scratch, I have to find that first person. This is harder if the work is already piling up, the architectures are complex, and the velocity is rapid. I’ve had two situations exactly like this. My first team member will be key to an ability to add lots of different skills sets, experience, and approaches. That first person’s temperament and communication skills are as important as the candidate’s technical skill.

One of the first additions to the team must foster a spirit of lively interchange directed towards synthetic and creative solutions. This interchange must demonstrate that disagreement does not mean a loss of relationship, but rather a strengthening of trust. If the two of us can set an example of motivation, engagement, and an ability to work through conflict, this will create an environment conducive to diversity. Although it’s great to get a first or second addition who is your equal, as long as these people are open to learning, and to being personally empowered, I believe that the right template will be set.

At one job, I had to build a team from absolute zero; I was the only member of the team, though the work was enough for five to eight architects. My first hire did not fit the above profile; that person deferred to my experience far too often to foster an engaged and empowered atmosphere. We then brought in a very junior person to train, which made matters worse.

Understanding this unfolding dynamic, and how it would stunt the growth of the group, I begged my management for a senior person. I then talked a friend of mine, Ove Hansen, who is a very experienced security architect into joining the team. I knew Ove could find the holes in my logic and that Ove wouldn’t hesitate to challenge my ideas (though professionally and politely, of course). Within about six weeks of bringing Ove onto the team, the dynamic of the group shifted to lively discussions and synthetic solution sets. The team needed an example; they needed a sign that disagreement with me was not only tolerated but would be encouraged.

  • [1] Unless, of course, I saw a major train wreck unfolding. hen I would step in and protect theorganization from disaster.
Found a mistake? Please highlight the word and press Shift + Enter  
< Prev   CONTENTS   Next >

Related topics