Cyber security ... a resource list

---

 

If you are looking for reference material in the domain of cyber security, you may not find a better list of sources to begin work than that compiled by Glen B. Alleman and found here.

 

---

Buy them at any online book retailer!

Taxi cabs in the field

---

This year -- 2020 -- there have been photographs of taxi cabs being stored in fields afar for lack of passengers .... and thus, no jobs for drivers.

 

Bummer!

But what does that have to do with project management?

 

To answer: In the late 1970s there was a depression in the defense and aerospace business as the Federal budgets were re-prioritized.

What happened? 

Software and hardware designers found themselves driving taxi cabs to make a living, forced out of the tech industry.

And now what?

Taxi cab drivers are being forced out of their jobs by the realignment of work location, and some are seeking training as software and hardware designers

As the door revolves!

First, tech engineers are forced into the taxi business, and now drivers from the taxi business want to get into tech.

For project managers:

• Presumably, there is a vetting process for aptitude and a training budget for basic skills, likely not part of a project, but handled at the enterprise level, or in a public/private training program
• Project mangers will be asked to take on some of these newbies and that will require mentoring, job planning, and perhaps some adjusting of project velocity. 
• There may be some fall-out ... even after training, etc, some will not cotton to the job and will drop out ... or be forced out. That broken work stream will have some cost/schedule impact
• There may be some super-stars: who knows who drives a taxi these days ... there may be some tech gems waiting to be discovered. Having an open mind to this possibility may garner a real asset for the project and the business.
  

---

Buy them at any online book retailer!

A very short course in PM

---

Take a look at this slideshare.net presentation for a very short course in project management

Five tools for managing projects from John Goodpasture

---

Buy them at any online book retailer!

Eggs-to-basket ratio

---

The oldest advice in risk management is this little ditty:  

"Don't put all your eggs in one basket"

 

It's obvious on its face: if you drop the one basket, you may lose all the eggs in just one accident. Why not carry two baskets, or three, or  four, or how many ..... ?

Well, what we're talking about here is diversifying the risk, and making the situation less fragile: that is more able to absorb shock without catastrophe. 

 

Of course we are also talking about cost: more baskets cost more money. And, there is the additional effort -- not free -- to distribute the eggs into multiple baskets, and then gather all the eggs from all the baskets so the eggs can be used where they are needed. 

 

And so arises the "eggs to basket ratio": how much diversification? How much less fragile? And at what cost?

First, the ideas from statistics:

It can be shown that if the eggs are separated into multiple baskets where the risks to an individual basket are completely independent from one basket to the next, then the overall range of risks outcomes is reduced exponentially. 

 

Actually, in the ideal case, the exponent is 1/2 applied to the number of baskets. So, by example, if the range of outcomes was "4" when there was one basket, the range of outcomes for two baskets taken together is only "2". This is the so-called rule of "square root of N", where N is the number of baskets. (*)

As a practical matter in projects, as elsewhere -- like the stock market -- it's pretty hard to meet the criteria of complete independence of risks among the baskets. If it rains, it may rain on all baskets. So, the exponent is less than 1/2 in the real world. Nonetheless, the principle holds: isolating risks will improve the chances that risk outcomes are reduced.

 

Second, common sense:

• You're unlikely to drop all the baskets at the same time. Thus, the risks to all the baskets is not the same as the risk to any one basket
• You can add redundancy: there can be more eggs overall than you really need. If you drop a basket, there will still be enough eggs to do the job
• You can add "rip-stop" or containment: If one basket is damaged (or dropped) by some phenomenon, barriers may be erected to contain or stop the spread of the phenomenon to the other baskets or eggs

But at what cost?

Back to the original question: how does one get the right eggs-to-basket-ratio (the right degree of diversification)?

 

It's really a question of insurance (or overhead, or non-value-add): how much are you willing to pay to avoid or reduce the cost of a risk occurrence? Whatever you pay for insurance, the cost doesn't add to throughput, so it goes toward overhead or the non-value-add cost embedded in the project.

• If you can absorb the total cost of a risk occurrence, then no insurance is needed, and thus the cost of diversification is a cost not worth bearing
• If otherwise, then the case is situational to your project: you'll have to decide if 10% or 25% or whatever is a fair price to pay for diversifying the risk.
  

I wish I could end this with the formula for figuring all this out, but alas: there is no formula.

----------------

A bit of math: "square root" is the name given to the exponent 1/2

Statistically, diversification reduces the "variance" of risk outcomes. "Variance" is a figure-of-merit for the range of risk outcomes

---

Buy them at any online book retailer!

Command vs Comment

---

Now, the word 'command' is probably a no-no among many. It's all about synergy and shared commitment, etc.

 

Maybe

On projects of any scale, and businesses of scale, there are people 'on the commanding heights', in a command situation, and with command responsibility. Don't believe it? Check in with the C-suite and see what they say.

 

So, that said, we arrive at today's topic: Commands and-or comments. Which is which is sometimes vexing, but does it matter?

 

Actually, Yes, it can matter a lot. Consider some of these situations and outcomes:

• A PM is not promoted for lack of 'command presence'. What is that? See below.
  
• 'Commands' are given (in the civilian world) but for lack of follow-though  the permanent bureaucracy all but ignores them
• A casual comment is understood -- in context -- to mean "get it done"
• A casual comment is misunderstood to be a command, when it reality it was just a casual comment

So what's going on here?

Command presence: You know it when you see it. A confident aura that invites -- rather than demands -- followership. Obviously, no empty suit!

Sloppy communication. The "one in command" is careless about a comment, not understanding or observing the reaction that surrounds it

Underlings too eager to please. These guys make the most of reflected and proximate power -- power and authority absorbed simply because they are in close proximity to the throne.

Bureaucrats understand the impracticality or incompleteness of the command.  And so it is ignored or modified on the spot. Actually, this is a very common consequence of "flow down of goals and objectives" and also of assuming operating detail will be filled in below by the people who actually have to do the work.
So, don't be surprised to see how a command actually materializes!

---

Buy them at any online book retailer!

Throughput accounting: pushback

---

 

Whenever I write about or talk about 'throughput accounting' I get pushback.

Fair enough.

You won't find such accounting in your Accounting 101 textbook, except perhaps in a chapter dedicated to cost accounting wherein the concept of 'variable cost' is discussed.

But 'variable cost' doesn't quite capture the concept:

'Throughput' is the stuff that gets through to end-users, beneficiaries, or customers that they can apply to whatever it is they do. 

Accounting for what it takes to produce 'throughput' is the essence of 'throughput accounting'

• First, of course, is 'variable cost': If you have to buy a gallon of paint to put the finishing touch on 'throughput', then the cost of the paint is 'variable' to your day-to-day expenses, and the cost of the paint is directly part of the cost of 'throughput'.
• But second, you might reallocate resources from day-to-day 'running the business' to specifically and directly produce the throughput. If such is reallocated, then add that to the cost of throughput.

What about the day-to-day?

But, many ask, what about all the day-to-day stuff to make possible the environment and capabilities and capacity to affect throughput. Shouldn't there be some "ABC" of those costs? (*)

• My answer is: no. But ....
  
• Yes, you can try that. But, be prepared for endless arguments about allocations which in-and-of-themselves add no value. 
• And be prepared to 'de-conflict' allocation overlaps such that the sum of the ABC costs does not exceed the sum of the actual business expenses, to wit, by example: a manager's cost is allocated to several projects in an ABC sense. Then it's discovered that the sum of all the manager's allocation exceed the actual cost of the manager. Back to the allocation drawing board!
  

What about revenue?

Does 'throughput' have to generate new revenue in order to be 'throughput'?

No.

Back to the definition: the users or beneficiaries may not be revenue customers. So, there's no direct tie of throughput to revenue.

 

What about 'value'?

Does throughput have to make the business more valuable ... in effect, increase the size of the balance sheet? 

No.

Value is consequence of throughput, but in many instances the value which is consequential to throughput can not be directly monetized. Such is the case for many non-profits and government agencies. Yes, they have balance sheets; but no, those balance sheets don't accumulate the consequences of their activities like a for-profit business' balance sheet does.

It's complicated

Yes, but ....

Throughput' is the stuff that gets through to end-users, beneficiaries, or customers that they can apply to whatever it is they do.

 

----------------------

(*) Activity-based costing (ABC) is a method of assigning overhead and indirect costs—such as salaries and utilities—to products and services. The ABC system of cost accounting is based on activities, which are considered any event, unit of work, or task with a specific goal.

---

Buy them at any online book retailer!

Institutional stability

---

Certainly since the dawn of the internet in the mid-90's, and gaining momentum since the millennium, disruptive change has been a fact of business life, to say nothing of the impacts on culture and behavior in the general population.

But, there's a case for institutional stability among all the disruption and debris of change.

And that case is built on the value proposition of strategic outlook:

That is to say: individuals come and go; incumbent leadership teams come and go, but the general framework for business activity changes at a much slower pace, in effect providing strategic stability and security even if there is great tactical maneuvering.

It's not too much to say that this institutional framework, consisting not only of process and procedure, but also cultural norms, actually facilitates effective change in product substance. 

 

How so? Consider this: The new team doesn't need to invent the framework -- at some cost -- while they are inventing the new "thing"; they may only need to bend the framework a bit. 

 

PMO Stability

The thing about strategic stability is that people don't have to keep looking over their shoulder to see if they've been left behind or left out on a limb. 

What does this mean to the PMO? 

• Less overhead, for one thing; and greater throughput for another. 
• Stability means less rework, and 
• It means that remote teams can get the job done with a much less onerous overlay of constant communication with the mother ship.

Command vs cooperation

Admiral "Bull" Halsey, a disrupter in his day (WW II in the Pacific), has been quoted as saying "cooperation is no substitute for command". "Command"was the culture of his day. 

 

We've moved along. Today, we might say: "Cooperation is an essential replacement for command"

If that is so, and few would argue otherwise in the mosaic we call the modern economy, then strategic stability is all the more important.

How can you reasonably cooperate if the basis for cooperation is in constant flux? To cooperate is to assume and accept that certain behaviors and commitments of the counter-party will sustain over time while you do your thing. 

Thus, the inherent value in institutional and strategic stability.

---

Buy them at any online book retailer!