Leadership Laboratory

Leadership Lab: Management Competencies

Leadership Essay - Updated January 25th, 2010
Situational Awareness Advice for Security Managers - February 4th, 2008
Temet Nosce - January 29th, 2008
Waking Sleeping Dogs: Information Security Ethics - March 29th, 2009
Using Key Competencies to Manage Career Development and Direction - May 30th, 2008
The Meeting before the Meeting - September 17th, 2008
Leadership in a Technical Role - September 17th, 2008
Motivation Mistakes Inexperienced Leaders Make and How to Avoid Making Them - March 10th, 2008
Improve the performance of a project with a good start - January 11th, 2008
Project Management for Security Managers: Develop a Plan - January 29th, 2008
Resolving Performance Issues Caused by Lack of Skill or Ability - December 24th, 2007
Living Life on Purpose - Personal Branding - Updated September 6th, 2007
Positional and Personal Authority - Updated September 6th, 2007
Cross-training: A Case Study - July 27th, 2007
How to "Pushback" - July 17th, 2007
Should I Apply for this Middle Management Position? - Updated June 13th, 2007
Groups in Conflict: How to Manage their Relationship - June 8th, 2007
Creating the Next Generation of Cyber Security Leaders - May 8th, 2007
How To Budget Time - Updated October 9th, 2009
The Security Manager and Business Situational Awareness - January 29th, 2007
How to Address Shortcomings in Employee Evaluations - January 1st, 2007
Conducting an Exit Interview - Updated October 6th, 2009
Measuring Employee Performance - Updated April 29th, 2009
Coaching to Improve Performance - Updated November 19th, 2009
Google Power Searching for Security Managers - December 3rd, 2007

Living Life on Purpose - Personal Branding

September 6th, 2007
By Stephen Northcutt and Ted Demopoulos



Personal branding is what prevents you from being a commodity and receiving commodity pay. It's why people want to hire you, work with you, have lunch with you, and generally associate with you. Your personal brand prevents you from being outsourced, ignored, or easily replaced. It's why you are not just another cog in the machine. Your personal brand is the unique value you bring to the table. Some people get it by luck, they were in the right place at the right time and stood out as an extra in a movie and were upgraded to a speaking part, or they win the Mega Lottery, but for the overwhelming majority of people on the earth, we have to develop our personal brand purposely.

According to Wikipedia, "The makeup of a personal brand has four main elements: personality, appearance, competencies, and differentiation. An individuals total perceived value takes into account these elements and is considered to be his or her core message or elevator pitch to an audience."[1] The concept is credited to the well known researcher and author, Tom Peters. He says, "Start by identifying the qualities or characteristics that make you distinctive from your competitors -- or your colleagues. What have you done lately -- this week -- to make yourself stand out? What would your colleagues or your customers say is your greatest and clearest strength? Your most noteworthy (as in, worthy of note) personal trait?"[2]

From my own observations, I think the Wikipedia defintiion is slightly skewed. Many people with strong personal branding change their appearance, we can use Madonna, someone that clearly has mastered personal branding, as a case in point: "Madonna is never the same woman twice. One minute she's a modern-day goddess chanting and wearing Mehendi, the next she's an urban cowgirl covered in rhinestones and fringe. Whatever her next look, you can be assured everyone will want it."[3]

Personal Branding in the IT Security Space includes:
  • It is name recognition, people recognize your name, or, far better, discuss your name. That means we have to publish and speak and find ways to get coverage by the press.
  • It is association with one or more "tags" (e.g., SANS, hacking, software security)
  • It is, hopefully, association with desirability or quality (e.g., great instructor, cutting edge researcher)
So where do I start?

Back to Tom Peters, "Instead of making yourself a slave to the concept of a career ladder, reinvent yourself on a semiregular basis. Start by writing your own mission statement, to guide you as CEO of Me Inc. What turns you on? Learning something new? Gaining recognition for your skills as a technical wizard? Shepherding new ideas from concept to market? What's your personal definition of success? Money? Power? Fame? Or doing what you love? However you answer these questions, search relentlessly for job or project opportunities that fit your mission statement. And review that mission statement every six months to make sure you still believe what you wrote."[2]

The Personal Mission Statement

I went through this in my own life. At one point I realized I was destined to be a large fish in a small pond, a leading authority in intrusion detection and network monitoring when there were only about 2,000 analysts that had that as a full time job on the planet. If I wanted to continue to grow, I needed to avoid being typecast for life as an IDS expert but, rather, as a general security expert. We see Tom Peters is right, our personal mission statement changes, we need to find the time to determine what it is, write it down, live it by checking on our progress weekly, and then review it to see if it is still accurate. If you are too busy to create, live and review your personal mission statement, you are too busy to develop a personal brand - and that is a sad thought.

Jerry Maguire

"As the popular 1996 film Jerry Maguire opens, the title character is wrestling with a number of issues that make him question who he has become. These issues offend his set of values. In the opening scenes, sports agent Maguire goes so far as to say he hates himself -- and then corrects himself to say he hates his place in the world.

So, he writes what he calls a mission statement, "a suggestion for the future of our company." Among the values he talks about in the mission statement are the "simple pleasures," "protecting clients in health and injury," "caring," and being "the me I always wanted to be." He harkens back to his mentor, Dickie Fox, who said sports agentry is all about personal relationships."[4] If you have never taken the time to take stock of your life and really think about values, it is worth the investment of time to order Jerry Maguire and watch the movie. It is the best example I know of of this important process, and it also clearly illustrates there will be challenges ahead. It seems the world wants us each to function at a lowest common denominator mode, yet, as you try to pull ahead, people and events will try to pull you down.

Begin to define your Mission Statement by defining the intermediate goals, stop and start

"You are already living your mission on some level. Living your mission may not require massive changes. You can begin right where you are now. Increase your awareness daily of what's really important to you. What do you want to be known for? Increased focus allows you to receive, recognize and fully integrate your mission."[5] Writing down your mission statement does not mean tomorrow or that you do everything differently, in fact, if that is how you think you will probably fail. It is far better to set an acheivable goal, one you can accomplish in three months to two years that gets you to where you want to be. If you achive your first goal and your second, pretty soon you will have a solid handle on your life's mission. And the secret to being successful comes down to two simple decisions:
  • What am I doing today that wastes my time, energy, money, and potential, that I am willing to STOP doing
  • What am I not doing today that would help me build brand, that I am willing to START doing
In my own life, 25 years ago, I gave up television. Together, my wife and I that we could do a better job parenting if we did not let network television raise our child and that we would be more productive if we did not invest the hours in watching TV at night. Initially I still watched movies, but today most of the movies I watch, I see on airplanes. I decided to start writing. First books, now my focus is much more on courseware, articles and my blog. Deciding to live our mission statement is not enough. Weekly we have to check on ourselves, are we doing what we said we would do? This is most important in the first six weeks or so of your new life. Today, I neither think about television or writing, both are ingrained habits.

The things you STOP doing give you time, money, or resources to START doing things

 I was giving a webcast recently on personal branding and told a story from my college days. Even though I was a true computer geek, I didn't have much trouble getting dates in college; I attended Mary Washington College right after they first admitted men. There were forty men on campus and three thosand women. However, just because I could get a date, it didn't mean I didn't get turned down a lot. And the girls did not usually say no, they usually said, "I have to study". Now, even at that young age, I didn't think they were going to study on Friday night. However, whatever they were doing, going out with me was not a high enough value proposition to STOP doing it.

If you want to live life on purpose, you have to STOP doing something to free up the time, money or resources to START doing something else. And let's be honest, we all have things we are not going to STOP doing. So, what time, money, energy waster can you part with in order to live a higher functioning life? If the answer is nothing, that is fine too; many people enjoy drifting through life. If you can think of something, then you have some currency to work with. Now it is time to do some strategic planning. Strategic planning is a management tool to help you do a better job and focus your energy, to establish and work toward your goals.[6] I like to use a 3x5 card, that way I can put it on my dresser and refer to it often until I have the new habit set in.

Lay the 3x5 down in landscape mode.

At the very top, write your goal down, what you want to achieve. For our example, let's say we want to be better known in the information security field, or to stay in context, "I want my personal brand to be known in the field of information security".

So let's say we decide we are going to STOP drinking beer with the boys on Friday. What does that buy us for what we are going to START doing?
What are some of the things that we can do to achieve the goal of having our personal brand known in the field of information security? We could get a GIAC Security Essentials Certification. According to the GIAC web site, "Security Professionals that want to fill the gaps in their understanding of technical information security and demonstrate they are qualified for hands on roles with IT systems with respect to security tasks. This is also appropriate for hands on, technically oriented managers that want to understand information security beyond simple terminology and concepts; anyone new to information security with some background in information systems and networking. GIAC Security Essentials Certification graduates have been taught the knowledge, skills and abilities required to incorporate good information security practice in any organization. The GSEC tests the essential knowledge and skills required of any individual with security responsibilities within an organization." And if we ever want to work for the DoD, their 8570 instruction states this would qualify us for a number of DoD jobs. A little research shows that getting the GSEC has helped people like Peter Giannoulis, who are well known in information security, to achieve their goals.[9]

So, as we have been working on our strategic thinking, we have developed a sub goal, to acquire a GIAC GSEC certification. Since this will take us three to six months to accomplish this sub goal, that will fill up our note card, so below what we are going to STOP doing, we write down our sub goal.

Now, what are the steps to get there? We want to be certain to pass the GIAC GSEC exam. If we buy the SANS Security Essentials course that prepares us for the exam, we can add an exam. However, that looks pretty expensive and our budget is $40.00 per week. They also have an option to challenge the exam; it is a lot cheaper, but it means we will really need to do some work. Let's define the steps to achieve our goal of passing the GIAC GSEC exam.

If the course is too expensive, maybe we can get the books. We do some research and find out they sell the books at large conferences. We go to the SANS web page and find their course listing.[11] It turns out that the large events are highlighted in orange, so we pick one and go buy the books from SANS. OK, that is step 1.

If we don't read the books we likely won't pass the exam, so we have a time budget of 4 hours a week - that is when we study. We would be wise to study for at least four weeks before spending our money on the challenge exam because they say it takes about 21 days to establish a habit.[12] We do some more research and find out that many successful alumni created indexes of the material to prepare for the exam. The GIAC exam is open book, so if we mark our books carefully, that can help us when we need to look things up quickly because the exam is timed. And we do some more research and we find a sample GSEC study guide already posted on the GIAC web page.

Practice tests are also a great way to prepare for exams. When we register for the certification, we see that the web page says "When you register for a Challenge Certification, you will receive access to the certification exam(s). With registration for full certifications, you will also receive two sets of practice exams."[10]

If we are still nervous about passing the GIAC GSEC exam, is there anything else we can do to prepare? We continue to do our research and find they have a product called OnDemand that will allow us to sign up for assessments. These assessments make sure we understand the material we have been reading. We decide to sign up if we do not do well on the first set of practice tests.

Our notecard should look something like this:
I want my personal brand to be known in the field of information security
I am going to stop drinking beer with the boys on Friday: it costs money, I gain weight, it burns four hours and sometimes I don't feel so good on Saturday morning.
As a step to having my personal brand known in the field of information security, I am going to acquire a GIAC GSEC certification
1. Buy the exam preparation books from SANS 2. Study 4 hours per week every Friday night
3. Buy access to the exam 4. Download sample study guide and create my own
5. Take the practice tests 6. If we do not do well on the practice tests, sign up for the assessments

This is just one example, but hopefully it is in enough detail that you can apply it to your goals and sub goals.

The bottom line, living life on purpose

There is nothing whatsoever magic about a personal mission statement, it is simply being willing to think about three basic questions:
  • What is my life about?
  • What do I stand for?
  • What action am I taking to live what my life is about and what I stand for? [15]
The action we are referring to is a goal, or sub goals. It is important to take the time to write down what it means to live life on purpose instead of drift though our remaining days and to check to see if we are on course.[16] There are a number of studies showing the importance of writing down goals. And it is hardly surprising to learn that people who live life on purpose tend to out-perform those that choose to drift.


===
1. http://en.wikipedia.org/wiki/Personal_branding
2. http://www.fastcompany.com/magazine/10/brandyou.html
3. http://beauty.ivillage.com/celebstyle/music/0,,8h10,00.html
4. http://www.quintcareers.com/mission_statements.html
5. http://topten.org/public/BD/BD105.html
6. http://www.sans.edu/resources/leadershiplab/137.php
7. http://www.giac.org/certifications/security/gsec.php
8. http://www.giac.org/certifications/dod8570.php
9. http://www.giac.org/certified/certmatters/GSEC_Certification.pdf
10. http://www.giac.org/reginfo/challenge.php
11. http://www.sans.org/training_events/index_us_canada.php
12. https://www.answers.google.com/answers/threadview?id=786165
13. http://www.giac.org/aids/gsec_ashworth.r.zip
14. http://www.sans.org/ondemand/index.php
15. http://www.quintcareers.com/mission_statement_exercises.html
16. http://www.todayisthatday.com/blog/self-improvement-plan-write-it-down-and-read-it/