Agile Management

Tips on managing product development and engineering by John Levy, consultant, expert and author of “Get Out of the Way!, An executive’s guide to creating timely, innovative and relevant products.”

5 key things you should know about computer security

Computer security does not come easily.  It requires awareness of the ways in which computers and data are compromised.  To guard against loss, there are 5 key things you should know.

1.   Anti-virus programs are essential, but they’re not enough.

Anti-virus programs will not keep you safe from all attacks.   They are good for blocking older, known viruses, but they’re only as good for that if you keep them up to date.  Since there are always new viruses out there, the time between the virus discovery and an updated version of the virus library is a vulnerable period.

To maximize the effectiveness of your anti-virus program, update it every day.

2.   Vulnerability to malware is PRIMARILY a human-knowledge problem

Many scams are perpetrated by email “phishing” attacks.  These attacks work because the emails look to be legitimate, such as from your bank or a known vendor, complete with logo.

Even worse, it isn’t too hard for attackers to learn about your company by researching public information, and then targeting specific individuals in your company with “spear-phishing” emails.  These emails sound even more convincing because the person’s role is known and maybe even the person’s boss’ name.

There is no substitute for caution: Never click on a link in an email without first examining the detail of where it is going to take you.  You can do this in most browsers by hovering the cursor over the link.  When in doubt, don’t click!

3.   Passwords are often inadequate

When we log in to online services, we depend on passwords to identify and protect ourselves.  But we don’t want to bother with passwords that are long and un-memorable, so our logins are vulnerable to guessing.  In addition, we often use the same password over and over, so once one service is compromised, others can soon follow.

To protect yourself, use a password-generating program to make passwords long and un-guessable.  You can buy a program (such as “1Password”) and use it to keep a secure list of passwords on your computer.  Then you don’t need to remember your passwords and in addition you’ll have a central repository for all of them.  And you won’t use the same one over and over.

4.   Data loss is often caused by human action

There are lots of ways to lose data, and only some of them are caused by hardware failures.  For example, you may mistakenly delete a file, or you may modify data in a file without having a backup.  Also, you may delete your backup files.  Pay attention to what you’re doing when you’re moving or deleting files.  Make extra backups before doing a lot of file operations.

Then of course, you may not have any backups at all, because you haven’t set up an automatic process.  This is unwise.  Always set up an automatic mechanism that will back up your files.

5. Nothing can stop an insider who wants to cause damage

Pay attention to disgruntled employees & visitors.  Be aware of which computers are accessible to anyone who comes to your desk (or other desks).  Set up automatic “log-out” mechanisms, so that if you leave your computer, it will require a password to log back in.  And, of course, know who your visitors are.

Security depends a lot on what you know, what you do, and your willingness to invest the time and money to have the right tools.  Don’t blame insecurity on the malware.  Fix the tools and procedures in your own shop.

 

John will be on a panel Startup Candy: How to Be the Startup Everyone Wants to Work For on March 27 at 6:00 PM in San Francisco.  For a free ticket, visit Founders Space and enter “Levy” as your promotional code.  See you there!

The fastest way to kill your startup is with B players.  How can you attract–and hold onto–hot talent? Get ideas, real-life stories and advice on increasing your odds of funding, innovation, and success when you add smart, creative people to your team.  Our panel will discuss:

  • Why your team matters to investors
  • How to create a killer team
  • How to showcase your team to investors, partners and customers
  • How to identify and reach out to talented individuals
  • How to keep your team engaged
  • How to keep your talent from jumping ship for better opportunities
  • How to position your company as a hot career opportunity

Presenters: Josh Breinlinger of Sigma West Venture Capital; Max Shapiro of PeopleConnect; and John Levy of John Levy Consulting.

Technical debt and causes of software instability

“Technical debt” refers to releasing software products that have significant bugs in them.  The cost of removing the bugs after release must be paid if the software is to survive in the long run.  So the concept is similar to financial debt: the longer you leave it unpaid, the more you must pay in compound interest.

In a recent interview, one of the authors of the term “technical debt” had this to say:

Most companies don’t have a clue on how to get rid of bugs before release. … they’re acting out of ignorance because they don’t know what they’re doing. … the companies that do know what they’re doing … don’t have much technical debt … because they’re using … defect-prevention, pretest removal, static analysis and inspections, and really good testing.

– Capers Jones  as quoted by Joe McKendrick http://zd.net/VjuA38

Evidence of technical debt is all around us:  Maintenance efforts that are larger than the development effort on a product suite.  Failures that keep occurring in software that has been on the market for years.

Three false causes for software instability.

1.    Users don’t care

Many products are delivered quickly to an audience that is not very discriminating.  For example, if your iPhone app fails once in a while, you aren’t too disturbed unless the failure causes the whole system to stop.  And if the app allows malware to infect your phone, you probably won’t be able to tell that it was caused by shortcomings in the design of the app.

But in the long run, people will know whether the software is reliable and secure.  So they will drop out from your customer list without so much as a goodbye note.  You have a few months to get your product up to a reasonable level of reliability, but you don’t have years.

2.    It costs too much to do it right

Everyone knows it is impossible to test all combinations of inputs to a software system.  So we depend on educated guesses when testing.  And when a product is behind schedule (and what product isn’t behind schedule?), we short-change the testing in order to meet shipment date commitments.

But even though exhaustive testing is impossible, it is possible to have a well-crafted testing plan and to execute the plan in a timely way.  Yes, this does require budgeting enough resources for testing.  Doing it right saves a lot of headache and lost goodwill later on.

3.    We don’t know how.

There is no single accepted set of standards for how to create bugless software, so why try to follow the latest trends?  After all, even the biggest organizations (the FBI, airlines, banks for example) have had software projects fail to complete.

But there are management techniques, including Agile methods, that can minimize the risk of a failed project.  So there’s little excuse for ignoring the advances that have been made in software development.

Three true causes for software instability.

1.    It’s complex

As more and more products are designed with software at their core, the complexity of the software tends to get greater generation by generation.  This is good, in that the depth of the software leads to more sophisticated solutions.  But it also makes for complex systems that are increasingly difficult to stabilize.

2.    There’s a shortage of experienced and competent leaders

The demand for professional programmers and software designers is great and growing all around the world.  While many people are moving now into software development, the number who have at least a decade of real-world experience is not growing as fast, and many of those who do have not led large-scale development projects.  The gap is not being closed by traditional project managers, because most of them do not specialize in software development.

3.    We’re still experimenting with management methods

Agile development methods are formally only 12 years old.  And there are many competing methodologies out there, none of which has come to dominate the field.  While it is good that many different approaches are being tried, a manager who wants to be guided to the “best” method will receive conflicting advice, particularly from vendors who are each flogging their own piece of development-support software.

Shall we advise them to come back in 20 years, when we’re down to one or two leading approaches?  Not practical, because the development must go on.

If you’re responsible for software development or the products the software goes in, you’ll have to make some choices based on what’s known now.  It’s best to get advice on the methods and the tools, but not to depend on any one vendor to tell you how to proceed.

—————————–

My recent talk at SofTech, 10 Ways to Fail revealed many indicators of failing projects.  Download the slides & notes here.

Software Development – not by PERT alone

I have great respect for software developers.  Because software is abstract, invisible and runs at extreme speeds, the people who are good at building it have to possess a particular talent at visualization and a willingness to use complex tools.

When software developers become project managers (PMs), they tend to rely on software tools to monitor, control and report on projects, just as non-technical PMs do.  The problems that technologists have in management have to do with inexperience in people interaction, including conflict, collaboration and just plain old ability to listen well.  If you’re a technologist in management, you can find more ideas on what to do about this in my book Get Out of the Way.

For the rest of PMs, there are lots of good tools, such as PERT and Gantt charts, but simply having good tools will not make your project succeed.  Software development projects frequently fail to produce results that the customer or end-user wants.  Why?

Here are three factors that contribute to the unruliness of software development projects:

1.     Estimating the effort and time required to complete a task is difficult.  Even when reasonable-looking requirements and specifications of a software package are provided, understanding the difficulty of development may require architecting multiple layers and investigating interactions with a complex environment.  Since requirements are generally high-level items, and design has to be done at multiple levels, it is difficult to break down the work into “pebble-sized” tasks and then to keep to a schedule with those tasks.

2.      Designing an algorithm often takes experimentation.  Engineering a software system requires trying out some things to see if they work, or testing multiple possible ways to implement something to find one with reasonable performance, for example.  This aspect of software engineering is so prevalent that Fred Brooks in The Mythical Man-Month advised us to “plan to throw one away.”   He meant that at the completion of a complex software implementation (such as an operating system), the designers have learned so much that it is often best to start over and re-implement everything.

3.     Assuring that a software implementation functions properly under all conditions may take as long as the design phase.  In fact, you may never be able to prove proper functioning, because testing all combinations of conditions is impossible.  At best, using test-automation tools and good intuition about where to look for errors, a software team can reduce the number of bugs at the time of a software release, but almost never to zero.

Scheduling a software project is made more difficult by the fact that additional tasks are always discovered during implementation.  This is so prevalent that I learned long ago always to ask “What remains to be done?” in addition to “What have you completed?”  You can count on the list of tasks to be done growing during the project.

One of the best countermeasures to all of these problems is to use Agiledevelopment methods.  Iterative development with regular demonstrations of working software having incrementally greater functionality will help reduce uncertainty and increase the ability of a development team to adapt to a changing world.  It also shortens the time between the initial charter of the project and the point where the customer says, “but that’s not what I wanted.”

Even Agile will not save all projects.  If you’d like to learn more about why not, download the slides and notes from my webinar, ” Why Agile Won’t Fix All Your Problems.”

And good luck.  The world needs software, so we all have to keep on trying to deliver it the best we can.

jlcLogo-Lg

No silver bullet

Software is in everything and we and our businesses depend on it more and more.  Yet Software Quality is not rising, so we have rising numbers of failure incidents and out-of-control costs in maintaining software.  What should you do about it?

Software, software, software

No matter where you look, there is software.  Whether you inspect the thermostat in your home, look at the smartphone in your pocket, or lift the hood of your car, you find digital chips running software that keeps the device going.

And this doesn’t even begin to describe all the software that is running in your computer and in The Cloud.  Software is everywhere and we are dependent on it for so many things in our daily lives.

If you have something to do with creating software, you’re probably in a secure job because software creation is not going away.  On the other hand, you’re probably worried about keeping up with the latest techniques and standards, because software development is in the public spotlight more and more.

Why?  Because software failures, system data breaches and rising maintenance costs are in the news more than ever.

Software can be stable and reliable

I attended this month’s meeting of an organization called SofTech and enjoyed hearing Fred Davis talk about the latest gadgets – which, of course, are full of software.  And in that room were some of the most experienced software developers in the San Francisco Bay Area.  Yet even among those high-tech gurus there is an unspoken acknowledgement that software quality is not very high overall, and that creating stable and reliable software is an arduous undertaking.

How can we make it less arduous?  Well, as Fred Brooks explained, there is no silver bullet — no single countermeasure that will make software development become predictable and reliable.  If you want reliable software, you have to organize and execute deliberately, monitor the results regularly and keep up with the evolving tools and methods that incrementally make the process better.

To learn more about development issues, have a look at Technical Debt.  Also visit SEI, PMI, and CISQ.  But above all, get expert guidance that is not focused solely on technology and tools, because creating reliable software depends as much on management and organization as it does on tools and process.

If you’re managing development projects …

I’ve started offering a series of webinars on managing development projects.  The first two were titled The 10 Danger Signs of a Failing IT Project and How to Fix a Failing IT Project.  The third one, in January, will be Why Agile Won’t Fix All Your Problems.

Even these webinars won’t fix all your problems.  But you may become aware of the possibilities and some of the pitfalls in development.  And that could be enough to get you on a path of improving the software quality in your enterprise.

 

My data in the cloud?

What’s the Cloud?

“The Cloud” refers to computers, storage and software connected to the Internet and accessible via the World Wide Web.  The first question you may have about the cloud is whether your data is safe there.

To answer that question, let’s have a look at how access to data has changed over the past couple of decades.  When the Internet and the World Wide Web (the Web) first became widely available in the 1990s, we were accustomed to the Desktop model:

I’m sitting at a desk with the computer, the software, and the data storage on disk all within reach.  If I have Internet access, it’s probably a wired connection over Ethernet to a cable or DSL modem; I can interact with servers on the Web using my browser, and some of these servers may keep some data that I put into them.

By the mid-2000s, most of us were using the Laptop model:

My laptop computer is with me wherever I am, and the software and storage are inside the laptop.  Storage may be on a disk or a solid-state disk (SSD).  I’m connected to servers on the Web using a wireless (WiFi) connection or a wired (Ethernet) connection.

These days, many people are using the Smartphone model:

The smartphone is in my pocket when I’m not using it.  When I use it, software is running both in the phone (an App) and in the cloud (on a server somewhere).  My data is in the cloud (on a server somewhere).  I’m connected to the Web using a wireless connection (WiFi or the cellphone network).

Software in the cloud

Why would we put software in the cloud?  There are several reasons for this trend.  The main advantages are:

I can rent the software rather than buying it.  This could save me money in the short run.

I don’t have to keep the software up to date – the vendor I rent from does that for me.

I don’t have to configure the software in my computer.

When I want someone else in my company to have access to the same data and use the same software, it’s easy to do – I just add them to the list of users of the software service (and pay the rent for them).

The disadvantages of software in the cloud are:

If I lose my Web connection, I can’t use the software or access my data.

I can’t customize the software very much – I have to use the same features that are available to everyone.

Data in the cloud

Why should I put my data in the cloud?  There are some advantages:

There’s no limit on how much data I can store in the cloud, and the cost of renting space for it is relatively low (if I shop around). I don’t have to buy a new disk to store more data.

The storage vendor does automatic backup of my data (and replication – that is, storing a copy at another site, if I want them to).

The storage vendor typically uses privacy and security measures that I couldn’t afford on my own.

The disadvantages of data in the cloud are:

If I lose my Web connection, I can’t get to my data.

At the beginning of using cloud storage, I have to upload all of my data.

There is always the possibility that someone will break into my data (a data breach).  But then, isn’t that possible even when the data is in my computer?

The storage vendor could go out of business or fail to protect my data. That’s why I should be sure that the vendor is reliable, reputable and stable.

I should probably keep a copy of my data somewhere else as well.  But I had offsite backup copies before, didn’t I?

If my data is in the cloud, do I still own it?

If you’re concerned about ownership of your data, make sure you have a contract with the storage vendor that specifies not only who owns the data, but also how how easily you can copy your data and move it somewhere else.

Check the regulations in your state and your country with regard to data.  When you have customer’s personal information as part of your data, you have legal obligations.  You may be obligated to keep the data in the country, for example.  You also need to have a policy for dealing with data security.  If you do suffer a data breach, you may be obligated to report it.

For example, “California law requires a business or state agency to notify any California resident whose unencrypted personal information, as defined, was acquired, or reasonably believed to have been acquired, by an unauthorized person. (California Civil Code s. 1798.29(a) and California Civ. Code s. 1798.82(a))

Any person or business that is required to issue a security breach notification to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. (California Civil Code s. 1798.29(e) and California Civ. Code s. 1798.82(f))”  (from the Attorney General of California website at http://oag.ca.gov/ecrime/databreach/reporting)

There are other resources that may be useful to you if you’re concerned about malware (software that invades your systems or your data with malicious intent) and cybercrime.  Visit some of these websites:

http://www.rsa.com/rsalabs/

http://www.cylab.cmu.edu/

http://www.us-cert.gov/

I hope this answers some of your questions about data and the cloud.  If you have other questions, please add your comments to the blog.

Bring your own device (BYOD)

The 10 Danger Signs of a Failing IT Project – webinar on Oct. 30

Learn the red flags you should watch for in major IT projects.  I’ll share with you insights about identifying and responding to problems in management of IT projects.

Join me in this free one-hour webinar on October 30 at 10 AM Pacific time.

Register here

 

“Bring your own device” (BYOD) is the latest watchword in corporate IT.  For mid-sized companies and organizations, how should we think about mobile Apps?  Are we ready to embrace them?

Back in the good old days (before the iPhone, for example), companies only worried about laptops and their applications, and about lost BlackBerrys.  Applications did not change more than once every 3 to 6 months at the most frequent, so IT departments could spend a fair amount of time vetting the applications before deploying them for use at the office and away from the office.

Now, everyone has a smartphone and everyone wants to use one for access to the company’s databases.  This opens up a lot of security and usability issues.  Here are some of them:

SecurityCan unauthorized people get access to the databases?

PortabilityWill access from a smartphone compromise the effectiveness of the data because input is less reliable?

AccessibilityWill access from a smartphone make it difficult for the user to read or use the information?

Now that the Apps are in a small portable device, we have to worry about both old and new threats to security:

Spam – unwanted messages coming into our network

Phishing – malware injected into portable devices and crooks getting access to valuable data or login information

Data leaks – loss of valuable data by accident

Lost devices –  loss of the mobile device itself, together with its data and login information

Should I try to control the Apps?  The answer is yes and no.  Yes, make sure that you thoroughly test Apps that are to be used to access corporate data.   And no, don’t prevent people from downloading what works for them.  If and when you run into problems with a particular App, you can always ban its use.  Of course, this means that you should monitor which Apps are being used.

How can I avoid disaster?  Here are a few general principles:

Develop a list of trusted partners & suppliers for mobile Apps.  Also develop an in-house capability for testing and verification of operation (and problems).

Also develop a program of training for everyone who uses a mobile device for accessing corporate databases.  Make sure they understand the company policies about access and sharing of data.

Perform regular review of security policies and procedures.  The policies don’t have to be extensive, but they should be clear and enforceable.  Don’t try to enforce policies related to activities that you can’t monitor.

When introducing new capabilities, start by rolling out a new App on a small group first.  Monitor the new App more closely than you do for mature Apps, and make quick corrections when there are problems.

We are at the beginning of the mobile device era. PCs will have less and less influence on the future of IT interactions, while mobile devices will have more and more influence.  There is no way to stem this tide, so you may as well embrace the mobile devices and their Apps.