Yes in general, because usually it's culture and not an individual failing. No in specific situations, because it's not just culture but also some people are just the weakest link.
Only focusing on either of these while ignoring the other is going to lead to bad results.
Scenario 1: 20% of staff tested failed. Individual targeting is pointless because the issue is systemic. This has happened in aviation, it’s common for accident investigators to conclude that the entire company culture (or even the entire industry) has failed to handle a problem. They don’t waste time in cases like this pointing at individuals.
Scenario 2: you test very regularly and nobody fails the tests. Except Bob, he fails the tests. In this scenario, your threat analysis document will recommend retraining, firing, or restricting Bob specifically.
Scenario 2 almost never happens because nobody has data that good. If your sampling frequency or ability to conduct tests are limited, no specific sample is enough to cover the entire problem. If you focus on a punishing (or just re-educating) the 20% who failed then your next test will fail for (potentially) 20% of the 80% who weren’t retrained, and thus didn’t learn anything.
TLDR: you need to choose the approach based on the situation, but we collectively tend to treat security poorly enough that we’re almost never in the fortunate situation where scenario 2 fits.
Specially for security, yes, shame the personal in a small setting, shame them in a positive way, as in lets all learn from this, but shame is very powerful. Much more powerful than saying "someone in this team failed this" and everyone thinks it was the other guy.
Previously, shame (and other pressure) was just applied without first empathically inspecting why the node was acting in the way it did, thinking that just enough force will surely solve the problem. It kinda did, but with lots of collateral.
Essentially, the security consultants (and everyone else involved) were just being lazy and not doing their job correctly.
But now we have this overcorrection, because people are still lazy and do not want to do their job correctly, which leads to the systems failing in a different way.
___
The solution would be to understand the individual node and apply the correct corrective measure. This can be shame, but it might also not be. And the level of it is also highly dependent on the situation.
This is a hard problem to solve, but it needs to be solved for good results.
The problem here being that scaling that up is hard, but everything needed to hyperscale. With either the individual nodes or the system integrity picking up the slack.
Very well said, and I think your exact description applies to management in general: management is hard, and require hard work to be done correctly, tailoring you response to every person, because two people being bad are their job aren't always bad for the same reason.
But most managers are not suited to the job, because it's mostly a status symbol and not something you give to the most qualified person, and most are too lazy to even try learning about it, so they don't make the effort of adapting to every individual, and in the end they end up either tyrannical or complacent.
Why would you do the hard work when you can also just not do that?
I mean I agree with "people are not suited for the job", however, I also feel like often, "the job is not suited for people".
It's rot all the way down, essentially.
> I'd forever be paranoid about it
Some folks like to work that way, but I don't think most do. This obsession for outward correct behavior, even if it works at the end (at least externally), doesn't sound like a recipe for happy inner life but maybe I am reading too much into that.
As a junior I made the front page of national news. I answered a question with a very big number on a Friday afternoon. Hit headlines on Saturday. Our prime minister had to defend my mistake in public. (He never admitted any mistake. With just enough spin nothing sticks.)
The head of the organization literally cursed and spat at me. In that same meeting from the no. 2 down they stood up for me. It’s still a great story about how to treat mistakes 20+ yrs on. Admit mistakes. What did __we__ (not: he) do wrong? (Hint: from medior to board everyone had an afternoon off and we had never discussed stakeholder management. I was in no position to say no to a ministerial request.)
As someone who has been training and mentoring and managing people for over 25 years: shame is useless as a tool. There's no "you gotta have thick skin" in people management. That attitude is just covering for the deficiencies of the manager. Most people's natural reaction to shame is to shut down and either slink away or become vindictive. You don't get the right corrective behavior out of using shame.
One's employment of shame as a corrective technique also has a wide blast area. When one singles out and criticizes people in public, the people who aren't being criticized still see it and form new, negative opinions of the criticizer. You undermine your own authority as The Boss when you do that.
Truly being "results focused" means studying actual management theory, negotiation techniques, coaching techniques, and conflict management. Praise in public, criticize in private. Always. And when you do have to criticize, keep the emotion out of it and stick to just the facts.
I have two employees I've had to put on PIPs right now. One of them is actually improving. The other one is a habitual liar, for whatever reason HR won't let me fire him outright, but even him I won't break my rules for, regardless of how angry he has made me, because the rest of my team will see it. During the meeting where I informed them I would be formalizing the process, they were not surprised and agreed that it made sense, because I had done the work before then to establish expectations and work with them to try to improve. There's are also people in the past whom I have fired who have messaged me on LinkedIn, thanking me for being kind to them during the process, because it was what they needed to turn their lives around.
You can tell people they aren't meeting expectations. You can put people on official notice. You can fire people. And you can do all of those things in ways that preserve their dignity. And in that mode, you can get mediocre employees to be good, good employees to be great, and great employees to stay. Or you can treat people like shit and constantly have to go back to the recruiting well. I'm sorry, but I'm far too busy to be constantly interviewing and onboarding new people.
Giving people a chance to discuss, as adults and professionals, how they got sniped beats any second hand training and experience by miles.
Now we get to hear that x% of a sample failed including #y elevated privileges people. How will somewhat naive management handle that?
Sometimes I get a feeling many HN-ers work in ultra toxic environments. HR is not your friend, your manager is there to screw you over and the firm will fire you for pennies. That’s just not my experience in working.
Many people in the world work in toxic environments, not just HNers. Especially when the jobs market is shit, people turn on each other like animals.
>HR is not your friend
Where did you work at that HR was your friends? Did they invite you for beers or visit you in hospital when you were sick?
HR everywhere protect the company from liability, that's it. They're your "friends" as long as you don't risk becoming a liability.
>your manager is there to screw you over and the firm will fire you for pennies.
Your manager maybe not, if you're lucky and cares about those below him more than his own corporate ascension, but managers levels above sure screw over the ones in the trenches when shit hits the fan, that's how they got to the top in the first place. The more unscrupulous one is the more likely they are to climb up.
> That’s just not my experience in working.
Good for you.
The second question: yes, in a time of need my manager and HR-consultant did indeed help me find appropriate psychological care. (And we also visit coworkers in the hospital.) This was part humanity, but also part of what ‘we’ (a firm is a collection of people) constitute as being part of what it entails to be an employer. It feels like a reductio ad absurdum to think that this was purely transactional on their part. It was deeply human, or at least I choose to see it as such.
This is unfathomably rare. I hope you realize this just how lucky you are.
> But non toxic I hope as well.
This never happen to me and I live, on paper, in the most livable country in the world. All bosses only care about my performance, not my healthcare. The moment I got too many sick days, I got dismissed and sent off on welfare.
>This was part humanity,
But most employment relationships are exclusively transnational. You're only virtue is usefulness to the boss's bottom line, not your "humanity", as that can't be monetized, unless maybe you work in government, healthcare or NGOs.
If you fall for it (clicking the link) then you get sent to a webpage saying "Hey this was a test and you fell for it... think twice before you fall for this again. Please watch this short security video". Then you get followup emails until you finally get around to watching the video.
Something tells me if you are a frequent offender they have you do additional training.
As annoying as the emails are, I appreciate that this avoids the shaming aspect. Its important to keep the normies on guard against this kind of stuff. And this gets the job done without drawing attention to human level failures. And it keeps everyone a little more on their toes.