Level Up the Happiness of InfoSec Teams - Scott Graffius

thank you ashley again i'm scout graffias and this is level up the happiness of info security teams that's great i didn't want to mention upfront for content accessibility purposes i'm deliberately using relatively large size fonts wherever possible and i'll be describing also the on-screen content there are a few slides where it'll be close to word for word but for most slides that's not the case want happier and more productive info security teams and who doesn't among other things that takes great leadership and proven strategies can give a real advantage so that's where the phases of team development comes in it's a framework that has stood the test of time more on that in a moment because

it remains highly relevant and beneficial so if you're a cyber security leader or you aspire to be one you're a member of a team or you might be in one in the future and that covers just about everybody else or you're just looking to develop your related skills uh this talk which is based on dr bruce wayne tuckman's model but with a fresh angle among other things zero percent theory 100 practical information that you can use to help lead and uh fulfill successful uh team objectives speaking of objectives after this brief session you should understand if you aren't familiar with it already the five phases of team development the characteristics of each phase and then most importantly the

usable proven strategies you can use to apply to teams so here's the agenda this is how the talk is structured uh first is the introduction objectives and agenda and we're almost done with that some about information about me as our release of this talk and then the main portion of this uh time together is the five phases of team development followed by a brief wrap up a optional digital download takeaway q a and feedback and speaking of q and feedback i do care about your comments and your questions tremendously but i won't be watching them during the talk i'll be focused on delivering the content to you at the end of the talk there's a section for q a and feedback

and we'll utilize whatever time we have to address any comments or questions you have i look forward to them and if we're short on time there's still a way we can follow up with q a and feedback which will be explained at the end so here's some of that information about me i'm a agile project management practitioner consultant author and speaker and as of last week now in 23 countries i've spoken either in person or virtually last week was nepal and i'm the ceo founder and principal consultant of exceptional agility and exceptional ppm and pmo solutions and the last thing i want to mention about the company quite proud of the fact that 20 of the work that we do is

pro bono or no charge for charities and nonprofits okay and i'm a member of the ieee and other professional associations have a range of credentials and a variety of different industries i've worked in everything from government entertainment consumer products and more and i'm honored that content from my books talks workshops and more have been featured and used by a variety of different organizations and here are just a few and of these i'm going to highlight a handful there is the university of waterloo microsoft oracle computer weekly rsa gartner national academy of sciences and and others so that's enough about me and my background here we are onto the five phases of team development so dr bruce wayne tuckman who received

his doctorate in psychology from princeton did extensive research on what was originally called group dynamics but shortly thereafter was also known as team dynamics group development team development so in the context of this discussion those terms while they're nuanced they're they're used interchangeably so i didn't want to mention that and he published his model way back in 65 you might ask why the heck are we talking about something from 65 well if that's your question i don't blame you and here's the answer it's because the model's still relevant and beneficial today some examples in a moment but this talk does draw on my first hand real world use of the model so it's not some sort of theoretical construct that

i'm speaking of speaking about practical use here right and my talk is supported by research and recommendations from a variety of sources over a hundred went into building this presentation for you and of them i drew the line and said 65 so 65 is the bibliography that i'm sharing with you if you're interested along with additional content at the end of this talk this is a subset of the 65 items in the bibliography and um of these i'll just mention a handful google forbes ibm mit microsoft and many others went into this talk oh and i want to also say that many publications we'll often talk about the benefits virtue and value of dr tuchman's model

and that's great because that's reinforcement but i'm delivering something different in this talk i dug deep into the literature which i know inside and out ever since dr tuchman's model was published in 65 and all the literature since and i took that as my responsibility to be extremely familiar with the content and extract from it not just that as a great model but exactly how you can use it in the real world well that's one aspect again which makes us talk i believe unique so to underscore the continuing relevance and value of the model many of those examples i showed you here on this slide were published in the last 10 years i say that because the model

came out in 65 so i think that's important to make that distinction furthermore many of them were published in the last year so i did want to mention that and when it comes to models usually putting them into some sort of a visual context that you can navigate is often helpful so that's what i've done here and at least for me for this talk clip art just does not work so no clip art not doing that and there's no stock photos and there's absolutely no generic content the only thing i borrowed from is the logo for the conference which is in the lower right hand corner of the screen other than that it's all custom content

and so here are the phases of team development which is a custom visual to give you the overview so as mentioned at the top of the presentation i'm striving to use large font for content accessibility wherever possible obviously that's not the case here because it will be very difficult or maybe even impossible to make out the text however in a moment we'll be zooming in on their respective content so the purpose of showing you this visual on this uh slide here is to give you the overview so i'll jump right into that right now at the top you see a level of performance or productivity across sort of the life cycle of a project team and speaking of which dr

tuchman's model is agnostic in that it applies to traditional agile all flavors of agile scrum and kanban and hybrid models and all sorts of things so whether we're talking about a team we're talking about maybe info security department sort of as a team or we're talking about info security project comprised of info security team members or we're talking about a project where it's sort of cross-functional in that there's members from marketing and legal and also info security all those scenarios apply to this model so i did want to mention that and below the um the the graph that you see and by the way happiness is correlated with productivity um and performance that may not be a

surprise to you but the literature is very clear on that so i wanted to touch on that briefly here maybe more later on time permitting and then you see the five phases going from left to right of team development forming stormy norming performing and a journey and below those markers the first row are the characteristics these are the things that are typically seen or exhibited from the team in their respective phase so if you're not familiar with the model at all or you're uncertain you can almost use it as the diagnostic criteria to identify where is the team once you know that the role below that are the strategies these are the proven strategies that you can apply

to help the team advance its uh performance productivity happiness and that really means move on to the next phase and the direction is typically from uh from left to right more and at the end if we have time but that's the direction and um custom visuals representing the team also accompany each phase so this is sort of a model that dr tuchman's model my customized version of his model but this is about people right so for inspiration i looked for something that i could appropriately use from 1965 when the model first came out and i didn't find anything that resonated with me that made sense for this talk that could also be custom uh or 66 67 68 but in 1969

these characters were introduced now this is the lego version of these characters so this is sort of the modern incarnation of these characters but they were introduced in 1969 and these are rather expensive collectibles i found out but anyways this is my photograph of these characters and they'll be accompanying the visual that you saw earlier slides as we go through the five phases of team development and when we're off here we go first up is forming so this is when i'll give a few different examples because i'm sure that the attendees for this talk come from all kinds of environments every company has their own take on doing things so i'll give different examples time permitting

as many as possible let's say that it is a devops organization and there are continuous just by nature right but there's somebody who has left the team or somebody's joining the team so that the performing stage or maybe it's the very first time a group of people are getting together or it is info security kicking off an initiative or a project there's all kinds of triggers really for this forming phase but here we go zooming in on the content of the characteristics and also the strategies that occur with forming so here are the things that are typically seen things are new and with that comes with typically people are excited and they're eager and they're socializing and

generally speaking the tone is there a point safe topics but you know no matter how much you're shared up front on this project or this endeavor whatever your company calls it the sprint or iteration or whatever it is still you know this is the very beginning and it's perfectly normal according to dr tuchman and others the literature for to have people feel uncertain or unclear about how the team is going to fulfill the objective particularly if they've never done something like it before right so it's really a matter of degree depending on the particulars of the situation but how they're going to contribute and how they're going to personally contribute to the team's performances fulfilling

the objective so because of that it is perfectly normal according to the literature for some team members to have some anxiety and some questioning but here's what can be done about that here somebody and that person could be a info security manager it could be a project manager it can be a scrum master whoever right it depends on the organization and how you run your project or your initiative or your work but somebody's taking the lead and by that i mean they're very very visible right and an example of what might occur is doing introductions even on the team that has worked together before can be helpful it can be brief according to the literature it doesn't need to be long

the whole exercise maybe is five or ten minutes right and it's a one-time endeavor for every time the team gets together it's particularly helpful when you have team members working on the team who haven't worked together before but even for people who have worked together before it's still helpful some companies do icebreakers some don't just giving you that as as a idea for consideration sharing as much information as possible as early as possible and by the way some of these points here and on subsequent phases you might uh reflect just seem like a good practice or good common sense and i if that's your view i would agree entirely with you on that the reason they're listed here is these are

the ones that are particularly powerful and effective on helping the team get out of forming and into subsequent phases and the same goes when you see strategies and subsequent uh phases so please keep that in mind uh success criteria so this may not apply but i'll just give you an example if it's true that this project must be done by november 1st if that's true some companies do operate that way but just as an example if that's true well you want to know about that now right not a month from now or two months now or three months from now so you want to know uh sort of what the high level success criteria or the requirements are

as early as possible it's okay for the details to come out later which is very typical but any high level uh requirements or success criteria as early as possible and because of our time i'm going to move on and that brings us to storming and dr tuchman says that regardless of the title which kind of strikes a lot of people is negative it's very normal and very typical and with that you have a visual that really matches that people can have a level of storming or frustration and it's often based on differences opinions keep in mind the project is very early on and dr tuchman and other researchers there's no time requirement for the respective phases

in some mature highly functioning teams particularly where it's the same people or mostly the same people working again and again together they can get through storming so quickly that it's a blip and it almost or it's almost not a blip i should say it almost seems like from an outsider point of view that there's really almost no storming at all however been alerted to the point uh from some prior presentations of earlier versions of this talk that sometimes based on the description which i'm about to delve into that it's entirely possible for the team to be in storming for the almost the entire life of the project and that's certainly not the goal right nobody

would consciously want to be in the stormy face but the literature is clear about storming occurring typically after forming and here's what happens there can be resistance and a lack of participation based on differences of opinions regardless of job titles regardless of job titles there can be sort of jockeying for position in terms of contribution and perhaps it's not a conscious but it's people trying to figure out how they're going to make the contribution within this this endeavor this project this sprinter iteration whatever it's called compared with other phases emotions are relatively high this phase in general tends to be a sort of a higher amplitude and duration when you have a team working on

something that they've never worked on before and or team members that have never worked together before or sort of a combination of those that's sort of what the literature hints at in terms of what's typically seen but the good news is regardless of your particular situation here's what you can do so somebody again that person a cyber security manager lead a project manager a scrum master whoever that person is requesting and encouraging feedback here's what's meant by that specifically though because who wouldn't i mean that seems like a good idea for all projects and all phases here's what's meant by that whether it's uh in person or it's virtual so the particulars will vary based on those sort of situations

somebody is is saying you know if you come across any questions or concerns including small ones please let me know and then maybe give two or three ways that they can uh with as low as lowest level of friction as possible can make this can surface a concern or a question you know email me or chat or hop on a zoom call or pop in my office or you know give several ways and it's not a one-time invitation it's a recurring invitation for feedback the point here is according to the literature and my own experience is that you know often the larger issues and problems impediments whatever they're called are sort of self-revealing and everybody

knows about them rather quickly sometimes it's the smaller issues that especially in aggregate can be a bit of a drag in terms of the performance and happiness of the team and so by requesting encouraging feedback on a continuous basis and having the right tone right in terms of your invitation for feedback and responding with appreciation you're able to identify these issues that otherwise wouldn't come out or might possibly come out at the very end of the project when you do a review so very very important and please keep that in mind according to the literature and i want to jump to the last bullet point certainly there have been lots of great talks and books

plenty about trust as it relates to this conversation though people are extremely complicated projects are extremely complex here's what can be done however according to the literature and my own experience let's say you have an agile team you don't have to but let's just say for this example you have an agile team and let's say it's scrum and let's say that every uh work day from 9 to 9 15 local time in person or virtually the team is going to get together and you know typically it's you know what did you do since the last meeting what are you going to do in the new work day and any issues or impediments the the format of it isn't important

those are just what's typically asked in most organizations and let's say you're going to do that every workday now listen things happen so maybe a meeting gets canceled that's not what i'm about to address but let's say three of them get cancelled in a row or four get cancelled in a row especially at the beginning of the project well not only are you not honoring commitments you're eroding trust and so anyways it's by honoring commitments as simple as it might sound you could goes a real long ways in terms of building trust and that brings us to the norming phase as you see as you can see from the graph above it's the second highest level of

performance in terms of productivity and happiness for the team here a very different visual not a hierarchy but rather showing the interconnectivity compared with forming and storming and here compared with railroad phases the goals and the purpose of the project are much more well understood and with that translates in most people a higher level of confidence and improved engagement and the second to the last bullet point here talks about relief or lowered anxiety so if there is anxiety during storming which is perfectly normal according to dr tuchman and others it is lowered or eliminated during the norming phase and then that last bullet point really speaks more to the visual and that would be the team is

starting to develop cohesion um in terms of how they interact with each other relative to the forming and storming phases earlier and here's what you can do to get the team grow in advance which in this case means move on to phase four performing which is the highest level of performance you do a time check here and that would be this not waiting to the end of the project but along the way recognizing both individual and the collective team efforts and accomplishments if it's um something that can be done in your organization learning opportunities along the way some organization this may not this may or may not make sense uh it's typically done in agile organizations but not

exclusively and that is a little degree of cross-training in terms of dev and qa for example being able to step into the other roles and make a contribution if necessary so there can be a little bit of sort of cross-training or cross-learning um for the team um to the extent that it makes sense that's what that third second bullet point speaks to here compared with earlier faces the team is in this in the second highest level performance so that person the scrum master project manager info security lead whoever that person is sort of pulling back and only getting involved if and when necessary so at speaking to the energy monitoring the energy of the team very different from earlier on

and yet brings us to the highest level of performance which by the way correlates with happiness and that is performing and here are very different visuals showing really the inner connectivity i think it's the last bullet point here yes demonstrations of interdependence and self-management sometimes called self-organization um and somewhere in some circles i should say so here you have compared with your earlier phases pretty high level of motivation trust and empathy where if there's questions or concerns that individuals on the team typically will defer to the larger team needs when questions come up and certainly they're producing their deliverables and the performance is very consistent so this is what's happening during performing so just keep a mental picture of this

compared with forming storming and norming and you can see this is the highest level of performance but this is an open active phase the project's not done yet so this is really more about these strategies here about keeping the momentum going on the team here are some more to remarks i made earlier minimal intervention uh getting involved only when necessary celebrating successes and here this last bull point is the main thing that separates uh you know the norming from the performing and that is where the team is engaged in collective decision making and problem solving which is again reflected really by that diagram also or the the visual the team at left and here uh the leader is encouraging the

team to do so uh if they're not and if they are to continue doing so so that's what can be done here and then that brings us to a journey so a very different visual it's really sort of the maybe the flip side of forming it's a journey and it is misunderstood one of the top um misunderstandings of a journey is that the people never worked you know they go away and they never work together again for example in a agile scrum just because you're at the end of the sprint doesn't mean that your team won't work together again so it doesn't force people to stop working together it just means that the combination of the people

and the scope has been fulfilled so a journey that's really what a journey meets more on that here so i do want to say up front that we're not upfront this is almost the end that dr tuckman introduced four phases in 1965 forming stormy norming and performing however he and a colleague of his marianne jensen found that a journey was so important that dr tuchman with the help of marianne jensen updated his own model in 1977 to include a journey so if you were to google for example some of the keywords that have been discussed here maybe dr tuckman or team development and similar uh phrases and terms uh unfortunately about half of the results will say there are four faces

it's not true uh there are five because dr tuchman updated his own model so if anyone says there are four they're referring to the 1965 model but in 1977 it was updated so geez it's been 45 years i think people would be on board but maybe they need another 45 to understand there are five phases because there's a lot of misunderstanding about that um also it is called a journey and because so many people call it transitioning or mourning i want to call that out that it's often called that but it's not it's a journey the reason it's not transitioning or morning because it may not it may or may not be transitional morning so why call it that

here i'll jump to the morning example in the interest of time picture uh it doesn't have to be this scenario but picture it's a big team and it's a hundred people including info security of course uh i would say it's a big info security endeavor actually and it's 100 people cross-functional people from legal and marketing and web dev and everybody right and it was a year-long project it was a phenomenal success all the goals were achieved of the project and now it's time for people outside of info security to return to their regularly assigned responsibilities to go back to legal to go back to marketing and so on well believe it or not the literature is very

clear on this some people can actually experience uh uh sort of a simultaneous conflicting emotions of um satisfaction from the success of the work the hard work and diligence of the project at the same time sadness that it's all over and because that's a possibility uh it could be viewed as the morning phase but it isn't necessarily so let's just call it a journey because that's what dr tuckman called it um here i'm going to jump to in the interest of time the strategies to help the team grow really this should be um because i'm keeping the font large right i if i had more room i would say strategies to help the individuals on

the team and the team and the company grow because the project is done at this point right and that is firstly as as it relates particularly to potential sadness or potential mourning or just a good practice recognizing change might be quite obvious that everything is over and people need to return to their uh regularly assigned responsibilities if that's the case but just to call it out the project manager the info security lead whoever is that person an executive in the organization uh relating that clearly can go a real long ways ways in terms of helping people understand that they made a big contribution on this project and now it's time to go on to the next project or return to

the department or whatever the whatever the situation calls for in your organization for that unique uh project uh here is an opportunity for what some people call lessons learned retrospectives post project reviews postmortems it doesn't really matter what the labels are the questions that are often asked are well and well what didn't go well what would we change you can ask any question you'd like those are the ones that are often asked and the idea here is that when you ask these questions you solicit the feedback you are likely to hear things that would not come up on their own particularly at the end of the project and if the company is able to capture

these lessons learned and implement them into the organization it has a competitive advantage the next time it does a project that's even partially similar to this project next time around so there's a big benefit for everyone to do that uh in here i want to jump to the last bullet point celebrating the team's accomplishments the literature is very clear on this this has a big impact the part that surprised me the most and it may or may not surprise you is the following certainly the individuals on the team when the team as a whole benefit from somebody whoever's the right person in your organization it's the ceo it's the head of info security whoever this person is is to

uh whether it's in person in a meeting whether it's over an email whether it's on a zoom call whatever the delivery mechanism is to express appreciation for the hard work diligence and contribution of the team it goes a real long ways here's the part though that surprised me that's very clear in the literature and you have to let me know later if this surprised you and that's this the benefit to doing that that is having a party or an after-party right uh is not just the individuals on the team and the team as a whole it's also those people who had nothing to do with the project at all but are in the company and

the reason for that according to the research is that it is reinforcing to everyone including those who weren't even involved in the project how the company really appreciates the hard work and diligence and value that the team teams of this type bring to the organization and so with that i'm going to move on in the interest of time and say that you know i gave examples of typical questions that people asked at the retrospective or the post-project review at the end and you can ask anything you'd like and it might even be a good idea to experiment and try asking different questions but i do want to share with you two through experimentation and testing i

have found to be extremely powerful this is for me not from the literature uh for the last few years here's one question for the team to ask and answer how can we the team make an even bigger positive impact on the company it's a very different question than asking what went well what didn't go well and the answers might surprise you uh big and small in terms of sort of category of responses and another one to consider is for the team to ask and answer how can we the team achieve even greater ease of work and you'll be surprised likewise of the kinds of answers to come back from asking this kind of a question

and so those are the highlights of the five phases of team development i do want to say uh that one of the frequent questions i get so i'll just kind of address it right now briefly is that the direction is typically or almost always i don't have an exact percent for you because it varies by organization but as we'll just say well it's a lot it's going from left to right you know foreign performing a journey here would be an example where the direction might go in the opposite direction depending on the situation let's say the team is been looking for a month and they're clearly in the performing phase and two people leave the team unexpectedly and

two people join the team the team not that it's sort of a conscious thing but in terms of how they're behaving right the characteristics they're probably going to be back in the forming phase this is the typical situation where uh the team is in one phase and then they're moving in an opposite direction but the good news is if they were already in the performing phase they it's even quicker to get back there than the first time around and you have the proven strategies for for moving through the faces so that's there and so with that i want to move to a quick wrap up here and say that forming stormy norming performing and adjourning

are all according to dr tuckman and other researchers necessary and inevitable for teams to grow and deliver results in this presentation introduce the five phases and if you were already familiar with i'm hoping that maybe you still got some fresh ideas and if you this was new to you i hope it's a good overview of the five phases of team development where we cover the characteristics of each phase and then most importantly the strategies for navigating uh the team from start to finish through the different phases and as promised i realize you can't see the detail here there's a bibliography it has 65 items such as microsoft google and so on the ones you saw in the visual

and also the main speaking of visuals the main image that we navigated i put together as a two page high resolution pdf uh for you so if you're interested it's available at t dot up this is lowercase should say that b i t dot l y forward slash v b c dash seven and if you want to scan it there's the code you do a time check here okay and um because this url this link is also on one or two subsequent slides i'm going to move forward onto the next slide here and say that based on prior experience many questions relate directly or indirectly to the visual so i'm going to see if this works for us

if it's possible to have one of the moderators from the conference if there's any comments or questions if they're able to verbalize them while i have the screen up that would be ideal and if not i can go to plan b but are there any comments or questions um that we have that we can um yeah right yeah we've we've got uh we've got one here uh so is it possible for different team members to be at different stages for example if you have a performing team but hire someone new who is trying to find their place on the team does that mean that the whole team drops back to storming or norming well it's so it's

the thank you for that and all questions and i have to tell you first time i've heard that question but here's what the literature says and my own experience what we're talking about here is the overall uh assessment of the team for example let's just say you are in the performing phase well that doesn't mean that there aren't problems bumps on the road issues risks materialize into issues right in the team can get through them it's sort of like the pervasive overall phase and so it is possible to have somebody on the team have the team sort of overall be in the performing face but an example in the real world in my experience and

from the literature that speaks to the question or the scenario my understanding of the question and the scenario is if somebody is joining the team while the team is already in flight let's say the team isn't performing this would be a typical example of the situation where maybe one person is exhibiting storming well what you can do is you can help that person you can really focus attention on them and help sort of onboard them for lack of a better term onto the project as as quickly as possible and help navigate them into the performing phase so the more people exhibiting the behavior the better but it is speaking to the overarching uh you know uh assessment of the team's

performance and obviously people are unique and different so some people will exhibit it to a more or lesser degree but it's overall how is the team behaving any other questions or comments some people say that there are four phases of team development others say there are five is it four or five thank you this is a peeve of mine and i shouldn't uh say it's a peace of mind but it is there are there are five it's forming stormy normally performing in the journey and the reason is dr tuckman with his colleague updated his own model in 1977 to add a journey and if people think there are four i don't blame them because there's so much

content out there that says that but i take my responsibility seriously and by the way in the bibliography i've got you know the information that speaks to dr tuchman studies and many of the other studies so if you're curious for more information later this is why i put it together in a bibliography for you any other questions or comments we've got one more here are there any provable proven usable strategies which can be leveraged to advance the team's productivity happiness and success yeah well that's kind of a really sort of the abstract for this talk really and that was really the goal what i wanted to do among other things to make this talk unique because the model doctor

technical research is not unique in the sense that it was published in 1965 when there have been tons of talks at all kinds of venues about his model but i take that what dr techman said very seriously in that for example there are five phases not four and i sifted through all of the studies the scientific papers and the like to extract just that from that question the provable usable strategies in plain language as much as possible that we can use rather than just say it's a small it's a great model and that's nice to know that people think that um or that it sort of validates that but it's more important uh to understand exactly how

you can use the model uh for your benefit and the benefit of the team and with that because i'm keeping an eye on the time i'm going to move to this slide here and say that you know post project reviews or retrospectives aren't just for projects they're also for talks and one way that i improve this talk is to understand if it's working for you if it's resonating with you and along those lines i wanted to have something that's very seamless and easy so i have a google form and it asks your name your email is optional and what do you think and that's it and so it's at lowercase b i t dot l y

forward slash y e s seven and there's the code that you can scan if you'd like and um if you uh are able to fill in the survey i want to thank you in advance for doing so i really appreciate your feedback it really helps tremendously and when you hit the submit button on the google form i have a very short thank you message with lots of links to my linkedin and my facebook and my twitter and my website and so on so sometimes people have questions after talks after conferences actually it's quite normal and so i welcome them so your question your feedback is not limited to this live presentation if you have a question

or a comment later that's one of many ways which you can reach out to me also if you do download the two page high resolution pdf in the footer of it there's a link to my website in my twitter and so on so that's another way you can reach out to me afterwards if you'd like to do so and with that i hope they were able to leverage these proven strategies to help the teams and frankly your own happiness productivity and success thank you everyone thanks a lot scott and that wraps up uh i guess monday at b-sides so thanks everyone for attending we're gonna be killing the broadcast uh in a few seconds here and we'll see you all back

again tomorrow

you