Monday, May 16, 2016

Eli Whitney - no one trick wonder

Eli Whitney invented the cotton gin, (gin is short for engine). Everyone knows that. And he patented it. Most people know that. And his intellectual property was essentially stolen and increased the value of slavery.

When creators are ripped off many of them quit creating. The number of first time inventors with a successful invention that are crushed by large organizations can't be counted.

And Eli was down in the dumps. But he did not give up. Instead he did something audacious. He asked for and received a contract to manufacture 10,000 guns for the United States military, something that was literally impossible in the state of the art in 1797. Guns were hand built one at a time. Eli, decided to make all the parts the same so they were interchangeable.  He did it, perhaps not in the two years the contract stated, but he changed the arms industry for all time.

http://www.history.com/topics/inventions/cotton-gin-and-eli-whitney
http://www.politico.com/magazine/story/2016/05/how-the-government-launched-the-us-gun-industry-213892?curator=MediaREDEF&utm_medium=email&utm_source=digg

Monday, May 9, 2016

Leadership and Evacuation

Evacuations have saved thousands of lives in incidents ranging from small building fires to massive regional disasters. For many personnel security threats, facility evacuation is effective. In addition, for regional disasters, personnel evacuation is the important first step for families to reconvene and evacuate to another region. Leaders are responsible for ensuring that procedures for evacuation are prepared and practiced; and coordination with Human Resources, Business Continuity and Disaster Recovery Planning, and Executive management should be tested and refined.


Case study Richard Rescorla

When Islamist terrorists bombed the World Trade Center in 1993 (see World Trade Center bombing, Rescorla was instrumental in evacuating the building. He was literally the last man out. He and his friend Dan Hill prepared a report that warned authorities of another attack, but was ignored. At Rescorlas insistence, all employees practiced quarterly emergency evacuations.

On September 11, 2001, American Airlines Flight 11 hit World Trade Center Tower 1 at 8:46 a.m. (see September 11, 2001 attacks). Rick Rescorla ignored officials advice to stay put, and began the orderly evacuation of Morgan Stanley's 2,800 employees on 20 floors of World Trade Center Tower 2, and 1,000 employees in WTC 5. Rescorla reminded everyone to "be proud to be an American", and sang God Bless America and other songs over his bullhorn to help evacuees stay calm as they left the building. Rescorla had most of Morgan Stanleys 3800 employees, as well as people working on other floors of WTC 2, safely out of the buildings by the time United Airlines Flight 175 hit WTC 2 at 9:07 a.m.

After having reached safety, Rescorla returned to the building to rescue others still inside. He was last seen heading up the stairs of the tenth floor of the collapsing WTC 2. His remains were not recovered. He leaves a wife and two children. A memorial stone was erected in Hayle to commemorate his life. We learn three things from Rescorla:

Strong situational awareness, his perceptions matched reality and he anticipated upcoming events
Selflessness, bravery, extreme determination
Exceptional leadership, he was able to save so many people because they followed his leadership in a time of stress and confusion
A biography of Rescorla, Heart of a Soldier by James B. Stewart, was described by Time Magazine as "the best non-fiction book of 2002".

Why Evacuation Matters

We would like to share four quick stories and then ask you a question to help drive home the point that evacuation is an important issue for senior managers to personally oversee.

My first professional job after college was at Defense Mapping Agency (now NIMA) at the Brookmont MD facility. He worked on the fifth floor, and one day they had a fire drill and it took him over 15 minutes to get out of the building. There were simply too many employees and too few stairwells. He remembers thinking "this is not good". In a real fire, people would panic and trample one another. As he drove home, he started pondering finding a new employer, if they care that little about their employees, it would be wisest to move on. Three months later he was working at a new location. This story is the genesis for one of the core concepts we teach in Management 512, SANS Security Leadership Essentials. If you are technically competent you can always find employment. The trick is to find the right employment that allows you to develop your career.

Only two years after 9/11, we were on the 24th floor lounge of the Sheraton New Orleans when the fire alarm sounded. There were about six SANS attendees in the lounge; we looked at each other and we all headed for the stairs. No one else moved. As we were descending, someone mentioned that on 9/11, only the people that started immediately to get out of the building made it. That is not entirely true, but it certainly motivated us to keep working down the stairs expeditiously. The really scary thing is, that as the six of us worked our way down, we only saw one other family enter the emergency exit. The hotel was sold out; if it had been a major fire or a terrorist act, the loss of life would have been considerable just because people did not bother exiting the building.

We teach evacuation as a small part of Security Leadership Essentials.[4] At a class at Silver Spring, we were covering that exact section talking about the importance to commit the evacuation route to memory and to test it when the fire alarm goes off. The class headed for the fire escape under our leadership. We were carrying our laptops with us, because of the sensitive data that resides on our hard drives. When we got to the exit, the stairs were so narrow, we could not fit our feet on the rungs. It was impossible to get down without holding onto both handrails. We had to jump back and put the laptops on the floor. We had known that we ought to encrypt our laptops, but it took this event to push us to do the right thing.

We were running a conference on the Disney property and while one of the instructors was teaching, another took some time off to attend a business meeting. On the way back to the Security Leadership Essentials[4] classroom, he noticed another classroom that was completely empty and all of the laptops were sitting unattended. What an incredible data risk! He was getting ready to hunt down a conference manager and ask "how can this be?" when the Disney security personnel caught up with him and briskly escorted him out of the building. While he had been gone, there had been an alarm and the building had been evacuated.

Try it now! Most people have an evacuation story, take a minute to write yours down or use one of ours. Now practice telling it and time yourself. Try not to take more than 40 seconds, we have tested all of these, you have to speak quickly with the first, but you can do it. People do not want to think seriously about evacuation and stories can make them think. As long as you can keep the story under 60 seconds there is a good chance you can keep their attention.

And finally, our question to you is, has your organization held a fire drill in the past year?

The University of Minnesota Deluth has a Word template Building Evacuation and Exit Plan (BEEP). We strongly encourage you to download, read, and either update yours or create one. Here are a few of the points they make:

Evacuation route postings should be posted near elevators and other prominent locations. Every evacuation procedure should include evacuation routes and meeting points. Each procedure should show clearly the route from the current location to the nearest exit, to a second exit, and should be able to be removed easily and carried with the evacuating individual.

The procedure should include instructions for safety techniques:

Know your exits, primary and backup
Keep your exit paths clear
Count doors to find the emergency exit
Know where the nearest fire alarm and fire extinguisher are located
Move quickly, but do not run
Remain close to the floor if smoke is present
Test doors for heat before opening
Procedures should be posted liberally throughout the work area, not forgetting auxiliary areas such as break rooms, rest rooms and lobbies. Sample procedures from UMN.edu[5] are shown below:

Remain calm, do not give in to panic
Do not ignore alarm.
Leave the building immediately, in an orderly fashion.
Do not use elevators.
Classes in session must be dismissed and students directed to leave.
Follow quickest evacuation route from where you are (see posted floor evacuation diagram/map).
Do not go back to your office area for any reason.
Proceed to the designated emergency assembly point for your area. If the designated assembly point/area is unsafe or blocked due to the emergency, proceed to the alternate assembly point.
Report to your Work Area Rep at the assembly point to be checked off as having evacuated safely; also report any knowledge you may have of missing persons.
Return to the building only after emergency officials or building monitors give the all-clear signal. Silencing the Alarm doesn mean the emergency is over
Signage should be marked clearly and printed in high contrast with a large font size. Use of the color red is highly recommended since the color is associated with emergency procedures - with the exception that the text should not be colored in a manner that makes it difficult to discern for individuals with red-green color blindness.

Meeting Point - Each procedure should identify specific meeting points for personnel evacuating from the facility. The meeting points should be within easy walking distance from their respective locations. Simple signs, "Meeting Point A", for example, should be visible for convening employees. Depending on the size of your building, you may have an initial meeting point close to the building and a secondary meeting point further away. Think worst case, what if your building falls down.

Practice - Periodic evacuations should be performed to ensure employees can execute the procedures in a genuine emergency. Employees should be required to take these drills seriously and should be subject to disciplinary action if they ignore alarms or instructions from personnel managing the drill. Employees should be trained to quickly secure sensitive materials if possible, since an emergency or false emergency could be prime opportunity for spies and saboteurs. If securing materials puts an employees life in danger, or their immediate safety is threatened, their first priority is to get to safety. Once employee testing has shown that employees can exit the building in an orderly manner and within the time frame recommended for the facility, the organization can consider conducting drills with emergency services teams. These drills, often conducted by emergency services for their own practice, accept volunteers from local businesses.

City State Evacuation

Ibibiliois a tremendous resource to plan evacuations within the USA. Every place your organization is located in should be reviewed for the natural disaster threats, and even in so called safe zones, a plan should exist to evacuate your employees. Working with your local authorities in advance to create a plan is highly advisable.

These links were tested and were working at the time this document was created. In some cases we keep a link after it is no longer available.

1. http://en.wikipedia.org/wiki/Category:World_Trade_Center
2. http://en.wikipedia.org/wiki/September_11%2C_2001_attacks
3. http://www.amazon.com/Heart-Soldier-James-B-Stewart/dp/product-description/0743244591
4. http://www.sans.org/training/description.php?tid=452
5. http://www.d.umn.edu/ehso/beep/
6. http://www.ibiblio.org/rcip/evacuationroutes.html

Pearls of wisdom from Linkedin

If you are careful who you follow on Linkedin, the odds are high you are going to come across some nuggets of wisdom. Here are some that I found interesting and maybe we can add to this as time goes on!

Paul Wayne Every new innovation, bright idea, new management theory or best practice begins with one of two types of curiosity. The first is a state of curiosity, where you wonder how on earth anybody can drive so slow in the “fast lane” while still calling himself a driver. The other is a character trait -- a perpetual mindset of inquiry that distinguishes the intellectually curious from the mentally stagnant or apathetic.

John Clifford Rule #1, Don't lose money. Rule #2 If you forget, go back and read rule #1.
Warren Buffett

This may not sound like leadership but it has the essence of clarity of purpose and that is the true secret of leadership.

Rob Davis "If your actions inspire others to dream more, learn more, do more and become more, you are a leader." John Quincy Adams

Dr. Terilyn J. Goins "A testimony is a life lived, not a word spoken."

Krishna Kumar Ramamoorthy

1. Mutual respect - Stephen R Covey ( 7 Habits of highly effective people)
2. Trust and openness - Covey Junior ( The Speed of Trust)
3. Humility - Gandhi

Rich Primo

While I have - and continue to - study leadership, one thing that stands out to me is something I read in Fortune Magazine concerning current-CEO of Intel Andy Grove.

At the time Intel was in the computer memory business and they were failing fast due to stiff competition. Grove and then-CEO Gordon Moore needed a solution, but were having a hard time finding one. Then, according to the article, Grove asked Moore this: "If we got kicked out and the board brought in a new CEO, what do you think he would do? ...Why shouldn't you and I walk out the door, come back, and do it ourselves?"

This jumped out to me right away. As a business should always be evolving, it is important to think of things from a different perspective, to not get caught up in traditional solutions because they may not be the best solutions. Take a moment to step outside of yourself, and your organization, and look at a problem with new eyes. You will be surprised what you might see.

krishna koney Control your destiny or someone else will. I agree, in fact I posted something similar. If we do not manage change, change manages us.

Heeral Kothari

The rags to riches story of Dhirubhai Ambani (Founder of Reliance Industries) is a story that must be motivating millions of people. It was his determination, conviction, need for perfection, vision and his charisma that made him one of the most famous business icon in India. That is what he has taught me.

Some quotes by him:

"Our dreams have to be bigger. Our ambitions higher. Our commitment deeper. And our efforts greater. This is my dream for Reliance and for India."

"You do not require an invitation to make profits."

"If you work with determination and with perfection, success will follow."

"Pursue your goals even in the face of difficulties, and convert adversities into opportunities."

"Give the youth a proper environment. Motivate them. Extend them the support they need. Each one of them has infinite source of energy. They will deliver."

"Between my past, the present and the future, there is one common factor: Relationship and Trust. This is the foundation of our growth"

"We bet on people."

"Meeting the deadlines is not good enough, beating the deadlines is my expectation."

"Don't give up, courage is my conviction."

"We cannot change our Rulers, but we can change the way they Rule Us."

"Dhirubhai will go one day. But Reliance's employees and shareholders will keep it afloat. Reliance is now a concept in which the Ambanis have become irrelevant."

Glain Roberts-McCabe "What lies behind us, and what lies before us are but tiny matters compared to what lies within in." by Oliver Wendall Holmes or Ralph Waldo Emerson (they both get credited with this quote).

To me, this is the essential lesson of leadership. If you aren't in touch with your own core and who you are as a leader... how can you lead others? This is where we have to look first and from that place we can bring our best to our organizations and teams.

And my personal favorite:

Barbara Garabedian "I don't judge a person when they make a mistake...everyone makes mistakes. I judge a person by how they deal with the mistakes."


Intellectual Property - Creative Commons

According to Tim Wu,[1] a Columbia University law professor, there is a new force that impacts authors of material, and Google is at the center of it: "Google has become the new ground zero for the "other" culture war. Not the one between Ralph Reed and Timothy Leary, but the war between Silicon Valley and Hollywood; California's cultural civil war. At stake are two different visions of what might best promote authorship in this country. One side trumpets the culture of authorial exposure, the other urges the culture of authorial control."[2]

Tim goes on to say, "Did you know you can search television? That you can type in "yada yada yada," and find the exact frames where George Costanza's girlfriend Marcy said it first? Weird as it may seem, you can do it with one of Google's little-known products"

So, I decided to try it. I have always enjoyed the Noisy Cricket scene in Men in Black, found from a fragment of one of the quotes, (the long tail search term is illustrated below):



The famous book, The Long Tail,[3] by Chris Anderson,[4] points out these two major perspectives change how the creators of content feel about copyright. "At the top of the curve, the studios, major labels and publishers defend their copyright fiercely, in the middle, the domain of independent labels and academic presses, it's a gray area. Further down the tail, more firmly in the noncommercial zone, an increasing number of content creators are choosing explicitly to give up some of their copyright protections."[5] "Creative Commons provides free tools that let authors, scientists, artists, and educators easily mark their creative work with the freedoms they want it to carry. You can use CC to change your copyright terms from "All Rights Reserved" to "Some Rights Reserved."[6]

Let's take a look at Wikipedia's write up on some rights reserved. They are:
  • Attribution (by): Permit others to copy, distribute, display and perform the work and make derivative works based upon it only if they give the author or licensor the credits in the manner specified by these.
  • Noncommercial or NonCommercial (nc): Permit others to copy, distribute, display, and perform the work and make derivative works based upon it only for noncommercial purposes.
  • No Derivative Works or NoDerivs (nd): Permit others to copy, distribute, display and perform only verbatim copies of the work, not derivative works based upon it.
  • ShareAlike (sa): Permit others to distribute derivative works only under a license identical to the license that governs your work.[7]
How well this will hold up in courts of law, since this is a fairly new idea, remains to be seen, but case law will be developed as we see from, "On March 9, 2006 the District Court of Amsterdam, judging in summary proceedings, decided the first court case in the Netherlands involving the validity of a Creative Commons license. Local media celebrity, Adam Curry (see http://curry.podshow.com/?p=49) had published photos of his family on www.flickr.com under a Creative Commons Attribution-Noncommercial-Sharealike license. The photos also carried the notice 'This photo is public'. The Dutch weekly Weekend, a gossip magazine, had reproduced four photos in a story on Curry's children without seeking Curry's prior permission."[8]

Publishers are starting to receive requests to release material under the Creative Commons license. For instance, here is a section of a letter to Republican National Committee posted on lesig's blog, "We, the undersigned, request that the Republican National Committee publicly urge state parties and other Republican debate sponsors to specify in debate contracts that video footage will be put into the public domain or licensed under a Creative Commons (Attribution) license - so that after the debate, the video will be free for anyone to access, edit, and share with others with proper attribution."[9]

Of course, there are concerns. This BusinessWeek blog talks about finding a cool picture on Flickr, the photo site in the Dutch lawsuit mentioned earlier, but was unwilling to use it since BusinessWeek is clearly commercial. However, Heather Green[10] goes on to say, "But what if I'm not BusinessWeek. What if I want to use it on my personal blog, but I use AdWords on my blog? Isn't that also a commercial use? I wonder if people who choose some rights reserved like this realize that they are actually limiting it this much."[11] Perhaps, no one has put it quite so well as Frankston, Reed, and Friends: "If someone were to repeat any of my ideas, anywhere (for example, the "end-to-end argument") they would be infringing my copyright in that expression, and probably my trademark. If you were to want to build on that idea, or criticize it, you'd have to find a different way of expressing it. And of course, if the different expression cites my work, a mere rewording shows that you almost certainly derived the new expression as a translation, which is a copy, so it may indeed be insufficient (because translation is protected by copyright, as well) to protect yourself from my suing you."[12] So, the some rights reserved is an interesting modification on the limited monopoly rights granted by copyright, but depending on the restrictions may not work in the real world, so we will have to see. These articles get updated every year or so, so it will be interesting to see how things are going then.

For now, in the course we author and teach, Management 512: SANS Security Leadership Essentials For Managers,[13] we suggest the wise information security manager may want to consider the body of intellectual property that your organization currently has under copyright; and, if you feel that some of it might benefit your organization by favoring authorial exposure rather than authorial control, then consider a test where you mark some of the material with a creative commons mark. As you can see in this article, if you try to keep too much authorial control, it will impact the point of the exercise, to put your material to work for your organization. So, consider the Attribution by would be our advice. The Creative Commons folks make it easy; you select a license,[14] they generate the HTML[15] and then you put that in your web page. In text, the license would look like this, "You are free to share X” to copy, distribute and transmit the work, Under the following conditions: Attribution. You must attribute the work in the manner specified by the author or licensor (but not in any way that suggests that they endorse you or your use of the work). No Derivative Works. You may not alter, transform, or build upon this work. For any reuse or distribution, you must make clear to others the license terms of this work. The best way to do this is with a link to this web page. Any of the above conditions can be waived if you get permission from the copyright holder. Nothing in this license impairs or restricts the author's moral rights.[16]

And yes, that is the license we would prefer be used to govern this web page.

References:
1. http://www.timwu.org/writings.html
2. http://www.slate.com/id/2128094/
3. http://www.amazon.com/exec/obidos/ASIN/1401302378/bookstorenow600-20
4. http://www.thelongtail.com/about.html
5. The LONG TAIL, Chris Anderson, ISBN 1-4013-0237-8
6. http://creativecommons.org/
7. http://en.wikipedia.org/wiki/Creative_Commons_licenses
8. http://www.creativecommons.ca/blog/archives/2006/03/14/dutch-court-upholds-creative-commons-license/
9. http://www.lessig.org/blog/
10. http://www.businessweek.com/the_thread/blogspotting/techteam.html#heather_green
11. http://www.businessweek.com/the_thread/blogspotting/archives/2006/01/photos_whats_ri.html
12. http://www.satn.org/archive/2003_04_27_archive.html
13. http://www.sans.org/training/description.php?tid=452
14. http://creativecommons.org/license/
15. http://creativecommons.org/license/results-one?q_1=2&q_1=1&field_commercial=yes&field_derivatives=n&field_jurisdiction=&field_format=Text&lang=en&language=en&n_questions=3

16. http://creativecommons.org/licenses/by-nd/3.0/