NOWHERETOHIDE.ORG

16.03.2015 cyber crime, cyber security, employee engagement, insider threat, leadership, management, security threats Comments Off on Seven types of leadership styles that help to develop rogue employees

Seven types of leadership styles that help to develop rogue employees

A short time ago, I authored a post describing how executives are contributing to the development of “rogue” employees; you can read it here:

7 warning signs you’re creating rogue employees.

One reader commented on my post and asked if I would balance the conversation by creating a corollary list that identifies what leaders (and executives) do to create toxic working environments that contribute to the development of rogue employees.

So, I penned the following list of seven caustic categories of leaders that I feel help to create these environments:

1. The reluctant leader: They really didn’t want to be in-charge of people, through words or behaviors, they give you the feeling that they’d rather be back doing “real-work” than being a leader. They will care very little about training and development, innovation, or accountability, and will shun any activities that will cause them to act as a leader.
   • How this develops rogue behavior: Without leadership support, people will begin to act on their own, circumventing security policy and controls to get the job done. In the absence of real leadership many will take the lead, making decisions that are not necessarily in the best interests of the organization.
     
2. The self-centered leader: They are more concerned about their own achievements, and are always worrying about how bad you will make THEM look if you don’t perform well. You’ll hear them talk about the job they want rather than working the one they have. They will have no time for staff that isn’t helping them to look good.
   • How this develops rogue behavior: This demoralizes staff and may lead them to sabotage organizational efforts, especially if senior managers don’t intervene on behalf of the staff. This can result in lost productivity, lost loyalty for the organization, and ultimately loss of good employees.
     
3. The gloom and doom leader: They are negative about everything – we don’t have enough money, our company/agency sucks, management is worthless, just be glad you get a paycheck. They are also the ones who poo-poo on any ideas their staff may offer – “don’t rock the boat, we don’t have the time, we already tried that” – rather than being supportive, they do their best maintain the status quo.
   • How this develops rogue behavior: This too demoralizes the staff and may lead them to hurt the organization. Disheartened staff might also seek external interactions and opportunities that could be exploited by others who want to hurt the organization.
     
4. The sociopath leader: They are quick to tell you how “lucky” you are to have a job, and how important they are to YOUR success. Rarely will they apologize for being wrong, nor will they be concerned about the consequences of their actions, and they will be also the ones to take personal credit for staff accomplishments. They will also be the ones to force polices and rules on their staff that they won’t apply to themselves.
   • How this develops rogue behavior: People working for this type of leader may take on characteristics of the sociopath. In an effort to “win over” the boss, they will take shortcuts, bend the rules, and abuse or hurt other people in the organization. They too will have little regard for security policies, especially ones that they perceive will prevent them from making the boss happy.
     
5. The absent leader: They seem to be busy all the time; with what, no one knows. They are never in their office and never seem to have time for their staff. When they are cornered, they defer you to someone else: “Got a pay problem? Go see HR” or “Looking for advice? Talk to (fill in the blank); just don’t bother me” – no one can nail them down for anything.
   • How this develops rogue behavior: Working under the absent leader is very frustrating, and over time, can lead to people in the organization to simply no longer care. People may try to do their best, but even with best effort, mistakes will be made, and eventually people will get fed up and either leave or take revenge against the leader. Either way, the organization will suffer.
     
6. The interfering leader: They are the micromanagers, distrusting of the abilities of their staff. They love to control every aspect of their organization, believing that they their staff cannot perform as well as they do. If they do delegate work, they will in your knickers every day, questioning staff actions and decisions. Rather than developing their staff, they are more likely to move or remove staff that don’t perform up to their standards.
   • How this develops rogue behavior: Opposite of the absent leader, this one just loves being in control. However, the results will be the same. After a while, people will just give-in to the leader, try to effect revenge on his/her actions, or will pack up and leave, possibly taking organizational information with them.
     
7. The minimalist leader: They just want to do the “absolute minimum” that needs to be done to “check the boxes.” Most likely they have been there for a long time and are quick to warn you not to stick your neck out as it will get cut-off. They will be the ones to tell you “we’re not responsible for that” or “just go back to your cubicle and do your job.” They stomp on any creative or innovative ideas, and suck the life out of their staff.
   • How this develops rogue behavior: Similar to the absent leader, this one actually prevents people from doing the right thing. Over time, this can lead to the same results as many of the other types of leaders described above.

I honestly don’t think that preventing ‘rogue” employees is rocket-science. If you take the time to be genuinely interested in your people’s lives, give them opportunities to grow and be creative, along with the opportunity to contribute to higher organizational goals, and thank them once in a while, they will be much less likely to want to go “rogue” and hurt you or your organization.

But, do the opposite – treat them like furniture, ignore their needs, stomp on their personal goals for growth and development, and yes, they will be pissed off. And, if you piss them off long enough they will:

• Leave your organization (with your proprietary/sensitive information); or
• Do something to sabotage your organization’s success; or even worse
  
• They may just stay-on, get promoted, and be there to piss off everyone else you place beneath them.

I hope this is useful…let me know what you think…

Thanks…r/Chuck

30.10.2013 computer security, cyber crime, cyber security, information security, insider threat, leadership, security threats Comments Off on Message to the Board: Why YOU are the reason for insider threats.

Message to the Board: Why YOU are the reason for insider threats.

Enjoy a 20 minute presentation on why executives are the cause for many to most insider threat cases…

 

14.09.2013 counterintelligence, cyber crime, cyber security, Economic espionage, espionage, information security, INSA, insider threat, Risk assessment, security, security threats Comments Off on Message to Government and Private Sector: YOU are the reason for insider threats

Message to Government and Private Sector: YOU are the reason for insider threats

Everyone is missing the boat on the insider threat issue – INSA too…to paraphrase James Carville, “It’s leadership stupid.”

Government and private sector organizations are the primary reason for insider threats – senior leaders and the boardroom grow them internally.

With very minor exception, NO ONE COMES TO WORK FOR YOU ON DAY ONE WITH THE INTENT TO HURT YOU, steal your secrets, or sell your intellectual property.

It’s how you treat them, over time, that turns them into insider threats.

• You put them in the wrong jobs;
• You fail to trust them;
• You make it hard for them to do their jobs;
• You put asshole/untrained managers over them;
• You treat them like furniture;
• You , threaten their existence in your companies and agencies;
• You kill their spirit; and
• Then, you wonder why they decide to hurt you.

Want to reduce/eliminate the insider threat? Treat you staff the way you did on day one:

• Welcome them as a human being;
• Be aware of how they are cared for in your organization;
• Show them you care about them and their families;
• Give them a future;
• Put r-e-a-l leaders over them;
• Give them a voice; and
• Pay them well.

In other words, treat them as you would want to be treated.

Now, why is that so hard?

And, why do NONE of the plans I have seen for combatting the insider threat even mention poor leadership as a factor?

INSAonline.org | 9.12.13 Assessing Insider Threat Programs of U.S. Private Sector http://www.insaonline.org/i/f/pr/9.12.13_InsiderThreat_WP.aspx

 

11.10.2012 computer security, counterintelligence, cyber crime, cyber security, Economic espionage, espionage, information security, insider threat, leadership, security, security threats Comments Off on Why can’t Johnny be good? The making of an insider threat

Why can’t Johnny be good? The making of an insider threat

“When Johnny reports to work for you on Day 1, they DO NOT intend to do you or your organization’s information systems any harm; something happens to them, either in their personal or work life that changes this – the CEO’s or Agency Head must be held responsible for making sure they know what’s going on with all of the Johnnys (and Janes) in their organization to prevent the good people they hired from becoming insider threats.”

While most of the world is focusing on “technology” as a solution to preventing insider threat attacks to organization/agency information and systems, hardly anyone is focused on leadership’s responsibility to create and sustain a work environment that minimizes the chance for an employee to turn into an insider threat.

On October 21, 2012, I had the chance to speak on this issue at the 2012 International Cyber Threat Task Force (ICTTF) Cyber Threat Summit in Dublin, Ireland a few weeks ago; here is a video recording of my presentation, I hope you find it informative and useful.

r/Chuck