Begin with the end in mind

I have been traveling a lot the past couple of weeks and was catching up on my reading today, when I learned that Stephen R. Covey died on July 17, 2012.  Apparently, he had a bicycle accident back in April and died of complications from the accident.  I am sad to see him go.

Back in the late 80's, I started to get into time management in an effort to be more productive.  Like many people at the time, I began with a Franklin Planner and even took a course on how to use it.  The Franklin method made a big impact on me and helped me begin my decades-long relationship with productivity methods.  In the 90's, I discovered Covey's book, "The 7 Habits of Highly Effective People," which helped me re-frame why I did things and helped me more consciously work on more impactful activities.  This matrix is one I still think about as I plan what I want to work on:

From this book, I began to embrace the "Sharpen the Saw" concept and tried to spend more time in Quadrant 2, Important but Not Urgent.  I also learned the value of outcome-oriented thinking with his principle to "Begin With the End In Mind," and tried to create mutually beneficial results with his admonition to "Seek First To Understand."  Very powerful and motivating stuff.

Dr. Covey's work has influenced me quite a bit - in fact, my first post on this blog was a review of his book, "The 8th Habit."

I have since turned to other methods for the "how" part of productivity (such as David Allen's Getting Things Done, and my current favorite system, Michael Linenberger's Master Your Workday Now), but Stephen Covey's work is still my anchor for the "why" part of productivity.

Rest in peace, Dr. Covey - and congratulations on a fine legacy.

5 Ways Taking Classes Helps Improve My Skills

This week I was reminded of a great way to improve your skills:  hands on practice in a well-organized workshop or training program.  In my case, I took some "boot camp" courses in computer hacking at a security conference to brush up on my skills and learn about new tools.  I felt like I was getting rusty and wanted a refresher.  Boy, was it fun!  [Note: I don't hack things for malicious reasons - I help people secure things for a living, and a strong defense requires a deep knowledge of how the attackers will come at you.]

I try to keep up with things from online sources (blogs, discussion boards, etc.) but it is difficult to internalize some of this without sitting at the keyboard and trying some things.  In this regard, the workshops I was in had a few key advantages:

Access to experts who can help you learn

I am generally good at solving problems because I have a good mental process for figuring things out.  However, sometimes I know what questions to ask but not how to get the answers.  This happened a lot in my class.  

One of the instructors set the stage nicely for this by saying, "I won't tell you the answer, but if you ask me the right question I will tell you how to get the answer."  Essentially, he was testing for whether or not we grasped the concepts behind the problems we were trying to solve; if we understood well enough to formulate the right question, he would point us to the right tools, resources, or processes for us to research how to get the answer we were looking for.

Access to others with different approaches

Another aspect of the classes that I liked was how we compared solutions and approaches after each challenge.  Each student would independently solve the problems, then we'd talk through how we got to the solution at the end.  I learned a bunch of techniques from other people that helped me improve my own skills - in other words, when I saw a method that worked better than my approach I added it to my arsenal.

We also learned about tools and tricks to make things easier - typically leveraging a proven process, or automation, or resources we didn't know about before the classes.

A safe environment to try new things

We were all in the classes to learn new things, so there was no stigma attached to making mistakes, and no shame in asking for help.  

Also, the people who conducted the classes provided us with a fantastic assortment of systems to hack, each with different operating systems, different vulnerabilities, different kinds of target "prizes," etc.  This is very difficult to come by in the real world unless you have a pretty sophisticated lab setup. It felt kind of like a playground.

Competition fuels the fire

In a lot of classes, there are competitive exercises intermingled with the learning exercises.  My classes were no exception - we had several "capture the flag" scenarios that allowed us to compete with each other to see who could achieve the goal first.  This was a lot of fun, as it forced us to apply the things we'd been learning but put some time constraints on us.  That made it feel much more real, and not so academic.

Feed the thirst for knowledge

The other side effect?  I now want to learn even more about the topics I worked on in class.  I have a long list of things that I touched on in class, but want to research more deeply.  And I want to check out a few training classes that can help me get there faster.

There you have it - 5 ways classes helped me improve my skills.  There are other benefits (met some great people, got CPE credits, etc.) but these are the ones that will keep me coming back.  What about you?  Have you taken a course lately?  It might be a good way to get you into a new mode of learning and improve your skills.

Should you change your password?

There have been a lot of well-publicized data breaches in the news lately, and I always wonder if I've been affected by them.  When credit card data is affected, you get a letter from your bank or card issuer (I've gotten a few), but when it comes to web site hacks that go after passwords, you never know.  Or do you?

I'd like to share a couple of resources you can use to find out whether you should be concerned, as well as a couple of things to help you increase your password effectiveness in the future.

Find out if you've been a victim

A site called "ShouldIChangeMyPassword.com" has aggregated (as of this post) 11,802,026 compromised passwords from a large number of the publicly disclosed data breaches.  If you go to the site and enter your email address, it will tell you if your email shows up in the list of compromised accounts.  In my case, I've been breached at least once, as the graphic below shows.

My password was compromised in the Gawker Media breach but, fortunately, I used a unique password so my exposure is very limited.  I also changed my password the moment I found out (Gawker was very responsible in their notification, and I knew within a few days).

Other sites you can use to find out if your password's been compromised include:

• LinkedIn leaked password checker
• eHarmony leaked password checker

 Stronger passwords in the future

If you want to protect yourself better in the future, here are some tips that can help:

• Use different passwords for each site you visit
• Use complex passwords (mixture of upper & lower case, numbers, random characters that aren't in the dictionary, etc.)
• Don't write your passwords down

The challenge with this is that it makes it nearly impossible to remember what password belongs to which site.  To make it easier, I recommend using a "password vault" that can generate complex passwords for you and then help you remember them.  The best ones are multi-platform, never store your data in an unencrypted form, and allow you to share your password data securely across multiple devices.

I've tried quite a few of them and the one I like best is called "1Password."  It works on Mac, Windows, Android, iPhone, iPad, and I've been using it faithfully for a couple of years.  It stores an encrypted data file on your system (the makers of 1Password don't store your passwords on their own systems), and it easily shares your encrypted password data using Dropbox as the conduit.

1Password also has the ability to store other information such as credit card numbers, software license keys, and more.  It can also generate and stores secure passwords for you, which makes it easy to satisfy the tips I mention above.

If you want to take a more manual approach, there is a good "personal algorithm" method using Steve Gibson's "Password Haystacks" model, detailed on the Gibson Research Corp. site.  This is also a great educational site on how longer passwords offer exponentially more security.

Beeminder is keeping me on task

I'm roughly 100 days into my use of "Beeminder" and wanted to provide an update.  If you recall from my earlier post on Beeminder, it is a "put your money where your mouth is" kind of commitment tool.  I committed to blogging at least 4 times per month and, if I don't, I owe money.  Yep, cash money.

I got into this base purely on curiosity, but I am now a huge fan.  There is nothing like a commitment to someone else to keep you honest, and nothing like a commitment of money to get you to take things seriously. When I first found out about Beeminder, it was relatively unknown.  Last month, the Beeminder team (now located in lovely Portland, Oregon along with me) received some well-deserved publicity from LifeHacker.

Here is how my progress is going so far:

Basically, the yellow line is my "yellow brick road" and my goal is to stay above it - below it, I owe money.  This is a great system and I am growing addicted to it.

They do a great job of providing you with updates via an email from the Beeminder Bot.  You can provide updates via email or on the Beeminder site, and provide data to make your graph go, as mine has. Rumor has it they are working on even more mobile-friendly ways of updating your status.

Got a goal that could use some pressure / encouragement?  Head on over to Beeminder and give it a try.  You'll love it.

Effective metrics drive the results you want

This week I attended the Gartner Security & Risk Management Summit in Washington, D.C.  I attended a lot of very good sessions, but the one that left the biggest mark on me was a session called "Metrics That Matter," delivered by Jeffrey Wheatman.

I went to this session because I've had a lot of conversations with information security executives this year, and a common question is "What should I really be measuring?," or they make comments like "I report on a lot of things, but I am not sure what the top indicators are that I should roll up to my executive team."

My initial reason for attending this session was for my "day job" as the CTO of a tech company, but I feel like I can "generify" Wheatman's guidelines to apply to anything that needs to be measured & tracked.

1. Effective metrics must support the business's goals, and the connection to those goals should be clear.
2. Effective metrics must be controllable. (In other words, don't report on things that "just happen" - report on things you can drive up or down with your own, direct actions).
3. Effective metrics must be quantitative, not qualitative.  If you need to measure something "softer" like customer satisfaction, find a way to make it quantitative, such as with a method like Net Promoter Score.
4. Effective metrics must be easy to collect and analyze. (Wheatman says "If it takes 3 weeks to gather data that you report on monthly, you should find an easier metric to track.")
5. Effective metrics are subject to trending.  (Tracking progress and setting targets is vital to get people to pay attention)

This set of guidelines really resonated with me, and I am going to run my metrics through this regimen to make my own metrics better.  If you're a Gartner client, there is a detailed research report from Wheatman on this topic, and I suggest you grab a copy.

I've also learned that it helps to simplify how you report on metrics.  When dealing with executives, stick with small numbers and primary colors - and when you get senior enough, try to boil it down to up/down, happy/sad.

What about you - do you have any best practices to share around metrics?  Could you apply these to your own individual metrics or self-improvement goals?