What's Really The Problem?

Time and money are always scarce in a security operation. The last thing we want to do is waste them. When it comes to security education, however, we sometimes have done just that. Like managers in all fields, we tend to want to do something about a problem, and do it now. We're wary of studying the problem to death. But sometimes that leads us to take action without impact solve the wrong problem and waste our time and our organization's resources while we're doing it. Performance problem solving (PPS) is all about making sure we understand the problem before we attack it. Actually, it's just common sense. It's doing what we would probably do anyway. The key is that PPS gives us a method of systematically applying that common sense, of making sure we've looked at all the angles, and of helping us consider all the possibilities.

PPS is based on the simple idea that all sorts of factors influence employee performance of security functions as well as all their other job responsibilities. There are factors that promote good performance and factors that get in its way. To improve performance, you want to accentuate the positive and eliminate the negative. (Hmm, that would make a good song lyric.) But to influence these factors properly, you have to know what they are and how they're operating first. Now, that's not exactly rocket science. We all knew that already. The problem is that...