Sign Hawaii Claim Secure

Document type sign claim hawaii secure

this is synched a kawaii community matters here hey Aloha and welcome back to the think tech Hawaii studios this is security matters Hawaii and we are blessed today to have Moses Anderson with us put on your big thinking cap because we're going to be talking about the process approach we're gonna this is something that was adopted by ISO it's a standard way to work on your management practices and I it's seemed widespread adoption Moses gonna talk a little bit about a way he improved upon that forest in the second half of our show Moses thank you so much for joining us today and taking time out of your busy busy schedule oh no the pleasure is all mine I'm so excited to be here thanks for the privilege thank you thank you sir so this was I had to go do some reading in some a bit of studying for this topic it's definitely outside of my domain so maybe can you take us back a little bit actually first I give our guest some of some of your history I think just to count again much as you feel like sharing you know to kind of give us a feel for your you know how you arrived at this position in the industry absolutely so I actually like to spot only from 2013 so people don't know how old I really miss my teas my new strategy but in reality for about 20 years I've been in the field of information security you know I started out just like most people I was a programmer systems engineer and network administrator I did all of the techie stuff hands-on but that was life until I figured out that the manager the processes behind the tools and the people is more interesting to me and so I went back to school and got a Masters of Science degree in information security that's what the degree is but in reality they are the true description for it for it is the master of science degree in secure digital business and so on I got to study a lot of intellectual property law as of management system principles critical thinking international law around privacy and or what not and and as much as fun as it was been in the academia doing a ton of research in the application of you know cryptographic technologies to the privacy and video management I figured I needed to go out to the real world again and I'm glad that I did and so they added you know this consulting now forearm you know fortune 100 companies in building security management systems however as time went on it became apparent that my forte was actually not just talking cyber security or privacy it was actually the the the thinking process behind it which which we call the celebrated process approach okay now the celebrated process approach was what I do to my company around in the year 2013 so I started a company called shield is I had the name before I had the idea so the name security was already in the name which is shield is fourth measured security but by the time the company started I was applying this fundamental principle to management systems that is for the process approach so for those who are familiar with that term I turned out to be that 95 percent of management systems in the world run on this principle this way of thinking this paradigm that is called the process approach and what the process approach is really is that whatever business we're running whatever product we're building we always have that objective in mind you know what we want to accomplish and in order to accomplish whatever I love the goal is we do it by set of processes those processes they look random they look disconnected but in reality if we look well enough they are all interrelated and if we can understand the working of their dependencies building it making it a better process not the ego of the people making it about the process not the limitations of the technology we look to the management system that will outlast the people and see the evolution of technology while always delivering the objective or the purpose for setting up the business or implementing the tool so that is manageable process approaches however the thing about the process approaches of us who have taken time to understand it we understood it because we went to school we understood it because it's likely the way people think in the act in the academia and when that gets exported into the into the into the real world no one is talking about the theory people are just talking about the outcomes and so people have a to be indoctrinated on how paradigms like the PDCA works you know plant do you check an act people understand such models for continuous improvement without necessarily know what the process approach behind it he gets convoluted and very easily ready to spend five years or six at the university studying in it and so what happened to me in the year 2012 struck 2013 was I decided that I was going to simplify the process the way that I understood it someone challenged me he said whatever you know if you can't teach it to a five-year-old you don't know it ha ha ha that's that's a good principle actually you know I've got hurt horse so it makes sense absolutely so I came up with this visual that is that is that I called the the page methodology which stands for the process approach visual expansion and so basically was the way of distilling this amazing mindset I mean amazing paradigm includes a one-page visual a one-page visual with three big boxes and six more than ones with two arrows pointing to each other and it tells you the story of the process upwards from A to Z by looking at it if you look at it with the right kind of explanation if it's handed to you as a tool you can go ahead and build a management system whether for security whether for service delivery whether for quality management whether for business continuity whatever it is that is exactly what I saw has done I assume in the international standards organization and the icing which is the counterpart the the partner of ISIL that throws out these management systems that's what they've done they've taken the process approach and a climbing of various disciplines that we go in and out of on a daily basis you know every day we're talking about cybersecurity here privacy there this is kinda greedy evil Treasury operations management at all of these other parts in business areas and the process approach it's for everything you know why you have people who require processes to accomplish their objectives and need tools and technology in the process you can apply the management system process approach to them and it will fit just right Wow the advantage that I got out of it immediately was even though my company started only in 2013 before the end of 2015 I received offers to sell the company because of the intellectual property that we had built by March of 2016 less than three years after starting the company just a little less than three years I saw the company and and asked the beauty of it you know why cuz the people who bought the company so I'm intellectual property that is not only portable very applicable and through that they developed other management systems and one of them I actually champion the development of which is a management system for the at work for IOT for the Internet of Things and also the management system principle called the process approach speaks for itself there was nothing else like it in terms of acceptance in terms of fruits that has come out of it and like again I said 95% of management systems in the world and almost 92 to 93 percent of international standards actually built on this process approach so that's what I've been doing and I want to keep doing this because I see that it helps people and it helps me to wait it's amazing I you know you brought up the the human ego component that it can get in the way so it was that something that caught your mind whereas if if the process is built in and adhered to because it's essentially outputs feeding into inputs which create more outputs and so you moving sort of in in step or a linearly through a process but ego can have make someone look at an output and decide oh that's not what I thought it was or they interpret it absolutely the wrong way and then you've got a broken process was that it's something that you all right we saw in this I mean I can see the so where the human element is sometimes good but when you once something's known and how to do it is clear humans often times should be left out of the way oh absolutely no you are absolutely correct so what I tell people is we don't link people we need rows are responsibilities because if this one I'm not broken down into rows and responsibilities with commitment for policymaking and oversight when we have is chaos I'm the third of my challenge to me a friend of mine telling me I think it was around 2012 he said that he's understood that what ruins our businesses and our ability to achieve our objectives is an acronym that he calls field which stands for fear ego uncertainty and doubt whenever two don't see clearly they become afraid most of us are afraid in the dark and when we can't see in the dark we don't make the right moves we make moves that make us look like we know what we're doing we don't know what we're doing it was somebody calls us out then we bring out the ego we kept insisting that we're not gonna change our methodology even though it's not delivering the right results and the ways to get fear ego uncertainty and doubt out of the way is to introduce such a system or transparency you see the big methodology pun intended actually changed the way for the right kind of thinking because it lets people see the reason why they are where they are and so if I'm in a company and I'm the chief information security officer I don't have to be threatened by my director of security I don't have to be threatened by the CIO because I know his roles and responsibilities Kim knows mine we have a risk management process that is well defined such that each one of us knows the areas of risk that we are owners of the control corners that were working late working with and the process owners that make those controls a reality what everybody knows what they're doing other processes are well-defined guess what when they were not defined they are well supported and when they are well supported you enjoy more what we'll call consistency and execution this thing is as simple as ABC and where people are dominant the question is always what took us so long how come the one is telling us it can be this simple can you can take this one page this one visual and put it on like a pair of glasses I start to look at the environment that you did working in and the products and tools that in the developed and things was just not becoming more and more apparent now and let me say this when I started I started with one visual and that visual I was able to apply it to our 27001 because that was in what most people needed me to do at the time cybersecurity but since then I've been able to map ISO 27001 to ISO 29 100 which is the fundament which is the privacy principles the international standards for private privacy principles I've also been able to map that 29 101 which is the integration guideline for privacy so a lot of people build tools like tastemakers that make up like watches and a smart watching this smart cameras and all of these things gather sensitive information that I personally identifiable personal health information later people know how to integrate privacy principles into those things how much information is too much how much information is poor little so could we report to that we're collecting this those things just become still fake and when people don't know the make up stories or the Midcoast on that things fall through the cracks because in the bad guys well they're not bad guys they're just not aware of the real deal and the real deal is adopting the management principle that actually guides you I mean you can put your business operations in cruise control because everybody that comes in comes in and they already see the path has been set for thinking but for immigration and as well as maintenance or whatever it is that we create so this is not just there for creating things it is also for involved in the maintenance culture that provides the right training and awareness because everyone within your management system then becomes in power to become a trainer because they understand the processes enough to tell somebody else yeah and that documentation is a piece often just just at my level with security a physical security facility you walk in and and there are no policies and there are no guidelines and it's like is this as if everyone's supposed to know what to do and somehow magically divine it from the ether and of course there's confusion when something occurs which slows down response times and maybe people get injured or more people get hurt than could then shake it so you know it's it's a big piece this process engineering plays into human lives and humans say for security more so than then people probably understand or think about and well I tell you what would take a break but it's funny when we come back I'd like to I'd like to we'll talk a little bit about what stops people from doing the planning so we'll take a break I'm gonna take about one minute break and pay some bills and we'll be back with Moses Moses Anderson in just a minute hi I'm rusty koumori host of beyond the lines on think tech Hawaii my show is based on my book also titled beyond the lines and it's about creating a superior culture of excellence leadership and finding greatness I interview guests who are successful in business sports and life which is sure to inspire you in finding your greatness join me every Monday as we go beyond the lines at 11:00 a.m. Aloha hello I'm Dave Stevens host of the cyber Underground this is where we discuss everything that relates to computers let's just kind of scare you out of your mind so come join us every week here on think tech Hawaii com1 p.m. on Friday afternoons and then you can go see all our episodes on YouTube just look up the cyber Underground on YouTube all our shows will show up and please follow us we're always giving you current relevant information to protect you keeping you safe Aloha [Music] [Applause] hey welcome back to security matters Hawaii we're here with Moses Anderson and we're going through I think he's I think he spoon feeding us the process approach and he's given you what's important about it so I hope you're paying attention out there today I had a question about this because oftentimes you you get with an organization and you find that they haven't done that base work you know they they there are no policies they haven't they have an approach to business it's like let's open the doors and everybody do something which is chaos like you talked about and there's something and maybe it's just a gift for some people and not for others you know but what is it about the development of process and procedure I don't want to talk about the following it because that's a that's a discipline issue you know eight human resource problem but you know developing processes I'm implementing them testing them in in and then keeping them updated you know you walk in places and they got the process they built ten years ago it's sitting on the shelf and no one follows it anyway probably it never got updated so in your experience with this what do you see that stops people from doing it the right way it's it's written how to do it it's not that hard absolutely no no no I'm telling you clearly clearly Andrew you as someone who sees the problems on the daily basis because he just went straight for one of the biggest problems that the process approach has been able to solve so the reason why we don't take steps when we are in the dark is because we don't see so when you're in the dark you move very slowly or sometimes it's just like I'm not even gonna take the risk because I don't want to hit the wall so the reason why people don't create the plans the reason why people don't implement the processes if I'm s even go to the very basic one the reason why people don't clear documents now they can continue to develop evolve eggs follow the reason why is because people don't know what to write people find it daunting to just create a manual it' like you're trying to turn everyone into into an offer of books and not everyone has it within them to just creatively write stories but when you hand people the process approach then it becomes very easy just look at each box within the process not word and write something about it so go to your people box so how many people responsible for maintaining all the IP cameras that we have oh then easily we can say get the people responsible will be the logistics manager the physical security directors director of IT these are the people named up about five or six people you don't have to write their name just write their roles and responsibilities and then the next thing you move to what do they do oh the retro facilities is responsible for working with third parties to make sure that the right spec of cameras are implemented the IT director is responsible for making sure that the right security patches are applied to the cameras and then behind the right firewall we first know what's going on by just looking at the people and their roles and responsibilities you've already gotten 80 to 90 percent of your process she found out and you do you do what you extract the processes he put it in another section and then the question is okay when we're doing this what do we use but when we're doing this we use vision mobility server okay so with no committee server what its requirement so it runs on Windows feed mr. Jim okay what about the capacity if we take it like that we would have gone from identifying the people responsible to what they do and the processes got formulates and how those processes relate with one another and then end up with the tools and the operating environment that we've created and then it becomes all-inclusive everyone participates and when everyone participates like that it becomes like a team-building exercise when you tell people after six months hey how about if we reviewed that document that we created together it's always like yay because it's our time for them to engage together again and it's their child they created it no one has a most of us imagine we have a baby we don't listen in the hospital right we'll bring it home we want a rocket every time and that is exactly what happens when you give people an opportunity to create documents that describe what they committed to that also helps them a continuity so that when they're not there others can look at it and see claiming what's been going on and so you hire someone and in a matter of weeks they're already doing the job as well as she would want anybody to do it and so the reason why people don't plan the reason why people don't write is because if you just put them in a darkroom nothing's gonna happen in the life let them see the simplicity of it once it's simplified everybody becomes a champion hmm I was wondering if it was um maybe just a throwback to you know not not giving them enough writing assignments in school you know when they're grown up they let you write up write a page or write two paragraphs or you know it when you when you lay the steps out you know filling that with words you know you start with words or bullets you know and that can become sentences I mean it's pretty straightforward I I am I'm overly verbose so my problem is I write too much stuff in there everybody's like oh my gosh we can either fin this down oh yeah but it's a you know that's it's okay to have too much and you can always edit some hour right I don't mind I don't know I don't have ego in and I just write I have them it's it's interesting I've witnessed this and my team members before that that and I don't know that during the always in the dark but definitely there's a a bit of a a push back for the writing piece um especially what about salespeople they never want to write a sales plan why do you think that's cuz we're gonna stick them to it so the thing is the thing about the process approach is as a structure that it might be it also leaves room for lots and lots of creativity yeah and listen for creativity it leaves room for power what we'll call borrowed brilliance for being able to borrow what other people have done you see because the process approach is a very defined process it's a it's a paradigm I can actually go online and download a template that was written following an international standard built on the process of words and tweeting just a little bit and then it became to become speak for my purpose you know what the guys who built it their problems or the problems you were trying to solve is not unique to them it's just that now they've created the solution in the language that I speak if we all speak the process approach language will never have to be invent the wheel I can take the documents that you have written around configurations management I can take configurations that you have written around the improvement of performance within sales cycle I can take that which you have written and then apply to my environment simply because I start with what you defined and I look at the several roles that I within your sales sales cycle and I'm like no we don't have two of those roles we only are fine but their responsibilities I can distribute it over these other people now this sequence try to review that's our best script every six months why are they doing that and then when you look at the reason why they're doing that they're like oh wow that's why they're doing it every six months we need to review our scripts every three months you see when we get people building blocks even better children you give them little Legos and they'll build a house mm-hmm so when you give people building blocks which is what process at which I force them there they continue to fill now one of the things that came out of this is you know there is this thing that is called the documentation pyramid that stats is it's a triangle of the pyramid that's not a policy procedure and then what is work construction some people call it policy guidelines and mm procedure whatever however grandi like you want to go is it the first time we use that before applying the process approach a methodology it was always talking to people because if I like can't I just write one document do I have to say this one is policy do I have to say that one is procedure I have to sit up on is work instruction but guess what by the time we act like the process approach to it we came up with something that is called the ADHD which is the enterprise documentation hierarchical pyramid which allows for you as an individual with them and enterprises to see your rules your responsibilities and the tools you need the people who depend on you and the people that you depend on in one visual Wow Wow and that makes it at least you are understanding your role and how it contributes we're being on that in our organization you know Christine Christine's very process-oriented and she writes everything and makes makes process a bit along the way she and Shaq see has the team responsible do the writing as you as you've talked about but because she wants them to understand how their role plays into the greater role of the company and how each person's role benefits the other department perhaps or or the efforts of the other department or supports those efforts whatever it may be and that's it he's been very powerful to watch I didn't um I didn't lead like that I was the sort of top-down guy and nobody leads like that anymore that didn't work so there's great when Christine when it took over and actually brought in a methodology called traction I don't know if you've seen Gina Whitman but it's a very structured way to do what you're doing it's not the the writing of the processes but managing with a process in and of itself that everyone understands and contributes to was really refreshing for organization it's been going on for years now and everybody depends on it you know it's amazing when you when you I guess like you said when you come out of the darkness and you're in the light it's like wow this is so simple why didn't we do this forever exactly no no absolutely that's nice because I knew what value we get out of it now since you're talking about performance you see um when it comes to performance improvement people have always relied on disciplines like you know Lean Six Sigma and then you have people bringing in Six Sigma Black Belt do you know that at the very core of those disciplines are the very core of those programs they are processes approach methodologies you know about five or six years ago I on board the six Lean Six Sigma Greenbelt she came and within six months worked on two projects for me one of them was the quality management system and the other one was an integrated implementation of cybersecurity and service delivery and by the time she was done at the end of the six months she said to me everything that I've learned in my Six Sigma Greenbelt now make friends can you know what my response to her is I said to her that I will give you the permission to use the outcome of our project these two projects that you've worked on and the project plan to put submit a proposal to Georgia Tech for them to give you a black belt she thought I was kidding ha she didn't the very first submission she made within a matter of days she got her black bear awesome because everything that we talk about when it comes to process improvement performance improvement quality improvement any one of those things has got to do with improvement what you need is a good understanding management system of the tool like pace and standards like you know the myriad of ISO standards that we have there other things they shortcut to it I tell people you don't have to reinvent the wheel whatever discipline within your organization that you're trying to improve find an international standard that is built on process approach and they'll spell it out for you all you have to do is look and implement Wow is so so these are these are great gifts that you're sharing with our audience Moses so I know you've been at this for quite a while what what are you doing in your future where where are you headed now you've been giving and sharing and I've seen some of your presentations and you know thank you for sharing this today as well what some where are you going next that's because we want to follow by the way you're gonna need a big bus oh yes thank you for that I appreciate that thank you Andrew so I've come to a it's now women I've actually accepted my my role my role in all of these things it's kind of a Solutions Architect you know our business solutions architects for several years and every time I try to be more than a Solutions Architect I try to be something else but nothing I've done to actually embrace that and to accept that I am partnering with another company here in Atlanta called jet row partners who've start another company I was starting a company that were launching next month um and it's called tenor of okay and that is TPN are us is like 10 hours oh yes it's called 10 of us and what Turner knows does is going to management consulting standing on the three pillars of compliance assurance and performance and so those are the areas that we see people struggling compliance assurance performance you know compliance has to do with making sure that the best practices that I've been stronger diced and tried and tested by other people you can adopt that to your business without you learning the hard way that's really the value of compliance assurance is no matter what you're doing and no matter how good you are Eddie you need to be able to tell other people about what you're doing yeah you need to be able to keep your salespeople as to the security of your product they need to know how to communicate the kind of encryption technology that is with them your your IP cameras or your video recorders or your PMS is you need to be able to equip your salespeople to tell the world why their data should be running out of your data center and so that is where assurance comes in assurance is a way of communicating with your partners and your clients and the world around you the truth about your security posture in such a way that they're ready to grow with you that assurance then the third one is performance if people are very happy when they're doing well but no matter how happy you are when you're doing well if you don't find a way to do better you're not gonna be happy for long and that is a reason right oh yes that is reason why we want to apply this fundamental principle out for creating management systems for designing implementing and managing management system we want to apply that to these three areas of compliance assurance and performance and that is what an Arras is about yes so I'm happy you know fully step into my position as a Solutions Architect helping organizations people who design and develop products people who have products that they're trying to sell or just people who want to see the future okay because there's nothing new one matter happens right and so if you want to see the future you just have to put a different spin on the past okay and you put a different spin on the past by being able to anticipate the vuelven threats that are out there and to be generating vulnerabilities that we have in our businesses and whoever can do that best tells the future and how do we do that we subject everything that we know and everything that we assume through these types of the egg blocks let me sorry the mind blocks of the process approach and what comes out of it what comes out of it is a solution that no one's seen before but then at end of the day is not new it's just a different application let me give it a go awesome actually sorry we are out of time already but what I'm gonna do is I write you back maybe in q3 after you've done some time with 10 or us and we'll get an update on how things are going over there how can I be back here I appreciate thank you so much and thank to artis for joining us today because security matters Aloha [Music] [Music]