My daughter is in Grade 7 and is a member of her school orchestra. During the school’s music week, parents were invited to attend music lessons. I attended the orchestra lesson and observed several valuable lessons that are worth sharing.

Be passionate

The kids start their orchestra lessons at 6:30 am, an hour before school starts. They are so passionate about their craft that they are happy to wake up early to attend lessons. You must love what you do.

Embrace the chaos

For the first 20 minutes, the kids were free to do what they needed to do. They used the time to set up, get their own chairs and sheet music stands. Although it felt chaotic, the kids were self-organizing and sorting themselves out.

Self organise, with a little direction

While the kids did self-organise, when they were finally set up, the chairs were spaced a little too far apart. The music teacher only asked them to get in a little closer.

Sitting closer together can help to improve communication and coordination among the different sections of the orchestra. When musicians are sitting close to one another, they are better able to hear and respond to each other’s playing, which can help to create a more cohesive and unified sound.

They all then skootched in a little tighter.

The teacher did not tell the kids where to sit, merely to sit closer to each other.

Having a shared vision and some direction is key in business. It aligns people on the “What” but not the “How”.

Tune your instrument

During this time, the kids also needed to tune their instruments. The orchestra teacher assisted all the students with tuning and was versatile enough to help tune all the instruments.  This took some time, but it needed to be done. Playing with an untuned instrument will not yield the right results.

At work, we, too, have to have to tune our instruments. As knowledge workers, our primary instrument is our brain, and we have to take some time to tune it to unleash creativity and focus. Meditating a few minutes a day is a great way to tune your brain and help it achieve higher levels of performance.

Know your role

In the orchestra, each musician had to listen to the music and find their section that needed to be played. They then clapped the tune for their section, highlighting the importance of knowing one’s role.

This concept is crucial in any team setting, where understanding each other’s roles and expectations is necessary for success. One useful exercise to achieve this is to write down each team member’s role on a piece of paper and ask others to write down their expectations for that role. This process goes around the team until it reaches the person who wrote the role, who then clarifies any statements by agreeing, disagreeing, or adapting them for better understanding.

Personal Mastery

While all the orchestra players come together to play music, each of the musicians has their own music teacher, who teaches them how to play music individually. One can’t arrive and expect to learn how to play an instrument in an orchestra.

Peter Senge, in his book the fifth discipline, looks at this from two of the five disciplines of organisational learning, that being “Personal Mastery” and “Team Learning”.

According to Senge, personal mastery refers to the continuous process of self-improvement and self-discovery, with the aim of achieving one’s highest potential. Just like the music teacher, a coach or mentor is an important facet to help achieve personal mastery. A coach can provide guidance, support, and feedback as you work to develop your skills and abilities and can help you identify areas for growth and improvement.

Start slow and gradually get faster

As the orchestra practiced, the teacher set the tempo with two wooden batons. He started out with a slower tempo, getting the kids to understand the notes to play. They gradually increased the tempo until they reached the right speed.

In organsiations, we often hit the ground running with expectations to deliver. Going too fast, too early slows down learning. We can make more mistakes, and the unintended consequence is that sometimes it takes longer to get things done. When doing new things, we have to accept that we have to go slow to begin. As we learn and improve, we will get faster.

Servant leadership

There was another teacher in the room who played the piano. This teacher was incredibly quiet and barely said a word. She listened to the orchestra teacher and played the piano, setting the right tone, pace, tempo and providing guidance for the rest of the orchestra.

She did not have the limelight, she sat on the side, behind the piano. She was measured, listened, and supportive.

A servant leader is a good listener and is able to provide a safe and supportive space for their team to create.

A servant leader has humility, and puts the needs of others before their own. They are not driven by a desire for personal power and recognition.

A servant leader is committed to building strong relationships with their teams and works collaboratively to achieve a shared vision.

A servant leader empowers their team members by providing them with the resources, support and guidance they need to achieve their full potential.

A servant leader has compassion and is committed to creating a supportive and nurturing environment.

Have fun

It so happened that, at the time, the Head of Junior School was having a meeting in the room next door. The teacher said to the kids in a softer-than-normal voice. “The Head of Junior School is having a very important meeting in the room next door, so today, if the kids can, they must play as LOUD and as beautifully as possible”, emphasizing the word loud, very loudly. The girls smiled and found it funny, as they thought the teacher was going to ask them to play more softly.

The kids felt happy, engaged, and encouraged. We must have more fun at work. Serious play allows increased creativity, improved synthesis of ideas, helps us connect the dots, and makes us better problem-solvers. Additionally, play reduces our stress levels while making the workplace a little happier.

These lessons from the school orchestra are valuable for anyone looking to improve their personal and professional development. Being passionate, embracing the chaos, self-organizing with direction, tuning your instrument, knowing your role, personal mastery, starting slow and gradually getting faster, servant leadership, and having fun are all essential aspects of achieving success and fulfilment.

The nature of cyber security is undergoing rapid evolution. Cyber-attacks are becoming more frequent, violent, and sophisticated. The threats continue to come in fast and furious.

We’ve seen severe business outages in every sector. Whether you’re in finance, infrastructure, or healthcare does not matter. If you’re making money, you can expect an attack. Cyber security teams continue scrambling to respond to these attacks as cybercriminals continually evolve their tools and techniques.

The massive growth in technology adoption, with many businesses embracing digital transformation, has necessitated a vastly different approach to cybersecurity. The need to be more innovative in cybersecurity is becoming increasingly necessary.

With this context in mind, an illustrious group of industry leaders gathered to dialogue and share perspectives about cybersecurity. They respectively shared how they have been looking at the future of security.

We highlight some of these perspectives:

On the shifting landscape of cybersecurity:

Threats continue to evolve. As businesses continue to adopt and move toward digital transformation, it requires a commensurate investment in cybersecurity. Cybercriminals continue to evolve their tools, leveraging new technologies faster than traditional businesses that need to justify their investment and spending.

For example, attackers are using AI to create “deep fake” videos of company leaders sharing a story and sending it to businesses to trick employees into clicking on a malicious link.  

The channels of security threats also continue to evolve. Previously, threats were easier to manage, as they came through email and on a PC or laptop. With the introduction of mobile technologies, remote working, and different communication and social platforms, such as WhatsApp, Slack, and Discord, adopted for work, particularly by the younger generation, it is becoming increasingly difficult to manage and manage and protect these channels. Hackers can now use emojis to deliver and exploit people.

Given the shifting nature of security, it is increasingly important to create a culture of risk and security and utilise new technologies to augment security capabilities.

On Cybersecurity skills

Skills remain a massive challenge, particularly good cybersecurity skills are difficult to come by. Diversity, including gender diversity in cybersecurity, also remains a challenge.

Companies are struggling to hire these skills and capabilities. Hiring practices are not adaptable enough. Businesses have stringent policies requiring X years of experience with Masters degrees and information security certifications. Without these, one is not even invited to the interview. Yet, Uber was recently hacked, and the attacker was a 17/18-year-old affiliated with a hacking group called Lapsus$, whose members are mostly teenagers and which has recently targeted several technology companies.

 Another challenge is that Red team hackers often play in the “grey zone”. Red teams are simulated adversaries, attempting to identify and exploit potential weaknesses within the organisation’s cyber defences and identifying the attack path that breaches the organisation’s security defence through real-world attack techniques. For these attacks to be simulated as close to the real world as possible, they have to use sophisticated tools that real attackers would ordinarily use. This means that these individuals, while not malicious by nature, may be flagged by organisations’ integrity checks and completely overlooked by the hiring organisation.

A rethink of how we hire, particularly in cybersecurity, will help improve innovation within the field. As an industry, we need to consider more innovative approaches to hiring. Adopting an approach of “Trespassers will be recruited”, may be a more effective way of hiring individuals to improve the overall security posture.

On Localisation:

Localisation remains important. As South Africans, we must embrace our differences and not rely on purely international companies to develop solutions for us. We have different languages and cultures to which we must tailor our security efforts. Making content locally relevant will improve overall adoption.

This is also true of the rest of Africa. In these regions, digital and technology adoption is very different. There is a lower spend on security, the government more highly regulates cloud adoption, and regulation is not friendly towards technology. In these instances, we must constrain our thinking to innovate and effectively improve security in these environments.

On Third-Party Risks:

Third parties are challenging to manage, and yet, to improve innovation, we have to rely on a broader eco-system strategy. Using Third parties is necessary; however, as a business, the ultimate accountability for any data breaches lies with the business as the custodian of the data. A breach brings disrepute to your company and not that of the 3^rd party.

In some instances, third parties are not only technology third parties but general service providers, such as in the supply chain space. If third parties are not managed more effectively, it may be the weak link that breaks the chain.

Ideally, third parties should be treated like internal employees; however, taking responsibility for third-party security could mean increased licensing costs, cyber assessment costs, and training costs.

On Audit:

Moving away from an audit approach to a combined assurance approach has proved to be valuable where this has been successful.

Audit cannot be a tick-in-the-box function that uses its findings as a stick against security. There needs to be mutual respect with audit must be seen as a partner, helping achieve the same goals.

We must be careful that auditors do not set the security agenda. Money often chases the audit findings, yet auditors don’t take accountability when something goes wrong. It is crucial that we bring auditors along with us on the cyber journey and ensure that findings are relevant and add value.

On the changing role of the CISO:

The role of the CISO has fundamentally changed. A CISO of businesses today has to wear many hats. CISOs not only manage risk, protect data, and oversee the protection of critical infrastructure, but they need business and strategy skills to articulate the value and importance of information security. They need to lead large groups of very technical people, be people-oriented to create an inclusive culture of security, and be ethical beyond measure, as they hold the keys to the company data. They also need to be innovators, always looking for new ways to improve the security posture while balancing risk.

On enabling innovation in business:

Innovation and security are often seen as water and oil. They don’t mix well. Getting it right is a tricky balancing act. In one instance, the security team looked at the code for the winning innovation apps in a major bank. While these apps were innovative, they lacked the basic security measures that needed to be implemented, especially when dealing with sensitive information.

When innovating, it was suggested that this is the first date, and not a marriage. However, the challenge is that if a relationship is not built on solid foundations, the marriage may crumble. Finding the balance to bake in security from the onset is necessary to innovate and avoid any security technical debt.

Dev teams must embrace a security mindset and security must play a bigger role in ensuring security is baked into the solution as it scales.

There is no doubt that this is a tricky balancing act. Businesses must innovate to keep up to pace with disruptive entrants, and security cannot hold back this innovation. At the same time, we need to create a culture of DevSecOps, where security is considered early in the innovation process. This is especially difficult in businesses that have capacity and skill constraints.

Building solutions that have strong security can be a competitive advantage and is more likely to be adopted than those technologies that aren’t secure.

Capacitating your teams, embedding security in the business and changing the culture are all needed to improve overall innovation capabilities.

On “Attack surface reduction”:

An attack surface is essentially the entire external-facing area of the business. As we digitise, cloud-up and connect, our attack surface is broadening, and so are our attack vectors and vulnerabilities. As security professionals, we need to understand our network, reduce these attack surfaces, and strive for a smaller blast radius. We should leverage new technologies such as Machine Learning models and tools to help augment our security capabilities and improve our mean time to detect and respond so that the blast radius is minimised.

In closing:

Cyber Security is complex. There are a lot of moving parts. Changing our mindsets is incredibly important. The quality of the answer is dependent on the quality of the question. We need to start asking different and better questions, which often lead to better answers and ultimately improve security and innovation.  

To use the analogy of a car, the better the brakes, the faster we can drive, but let’s not make security the handbrake of innovation.

By Nilesh Makan

Nilesh Makan is a technologist with a keen passion for cybersecurity, strategy, innovation and business agility.

In an unpredictable and uncertain world, plans often need to change.

As of writing this:

Two years ago, we were all locked down in our homes, adjusting to working remotely and not being able to see our family and friends.

Two months ago, Russia had not yet invaded Ukraine.

Two weeks ago, Will Smith was revered and had not yet smacked Chris Rock unnecessarily, causing worldwide outrage.

So much has changed in such a short space of time.

In terms of large scale change, globally, we have had more one-in-hundred year events on a more frequent basis. Whether it may be climate events, wars, or pandemics, they continue to happen at an increasing rate.

Given this increasing uncertainty, what is our plan in such a volatile world?

Dwight D. Eisenhower was quoted as saying, “Plans are useless, but planning is indispensable”.

Why is this such a profound concept? When you have a plan, ideally, you try to stick to the plan. It becomes the thing to follow, to be reported on and becomes a check in the box exercise that is task-driven. A plan does not take change into consideration, albeit through a little bit of slack often built-in. A plan remains largely static and assumes everything is known up-front.

When projects don’t go to plan or companies suffer significant project failures, the first step is often to tighten up formal project management practices. Gantt charts are updated, Project Managers are often more committed to following up on assigned tasks, and checks are often done irrespective of whether it adds value or not.

The value of the plan does not reside on paper or within the technology where the plan is captured. The value lies in the ongoing dialogue and actions that comprise the planning process itself. Continuous planning is necessary to reflect on the current state, understand the changes in the environment, consider what the future holds, and adapt based on those changes.

Planning does however, require some level of direction. Direction is often manifested through the vision. This vision is the Crux – The set of stars in the Southern Hemisphere that direct you towards the True South. It aligns individuals and teams on where to focus effort, allowing the teams to figure out the “How” of getting there. The teams then consider those stepping-stones that are needed to progress towards the vision.

Planning is also about managing risk for uncertainty. We need to consider the assumptions and then run experiments to either confirm or reject those assumptions, continually reducing the uncertainty as solutions progress.

In summary, continuous planning considers the need to listen to different perspectives, anticipate what the future holds, check current realities, innovate new products and practices that will allow you to complete in this emerging future, and through constant feedback, iterate through continuous planning, towards a shared vision. The better we do this, the more resilient we become when plans change.

In photography, the Depth of Field is the distance between the nearest and farthest objects that are in sharp focus of an image. To clarify, this means that when you see a photograph where the subject is in focus with the rest of the image blurred out, there is a very narrow depth of field. Conversely, when you see a picture where the background is clearer and in sharper focus, there is a larger depth of field.

Short-termism is when we tend to place more emphasis and focus on those events that are closer in nature. In the analogy described above, we can say that we have a narrower depth of field. We picture a world-view with mental models that are a few weeks or a few months out.  Daily thoughts and mental models that are further in the future – say a few years out – tend to be blurry.

When we place an over-emphasis on short-term thinking, it may result in sub-optimal decisions for the longer term. It can force us to focus on quarterly profits, prioritise short term investments, remove accountability for sustainable practices, and may result in businesses that are not future fit.

Richard Fischer, recently wrote an article in the MIT technology review that “Human thinking becomes more blinkered in times of turmoil and more expansive in periods of prosperity and calm”. With the pandemic upon us, this blinkered view of the world is particularly extreme at the moment.

For some, including myself, it can be challenging times. While we’re stuck at home, isolated, looking at little boxes on the screen the entire day, it can be hard to see beyond our current situation. In South Africa, at the time of writing this, we have begun our first days of another two-week government-directed lock-down because of the rising Covid cases, well into our third wave. This isolation may cause increased brain fog, and the blur starts to permeate, and the long term vision becomes less clear.

Short-termism can also induce anxiety, as volatility may seem more pronounced. Higher volatility may lead us to make bad decisions in the longer term. Let’s take the example of investing in a stock. If we focus on the short term and look at the share price daily, we may see massive fluctuations, up ~3% one day, down ~2% the next day, up another ~4% the day after, and down ~4% the day after that. When we look at a share on a more frequent basis, we may be tempted to trade on a whim. If, however, we stepped back and decided to take a longer-term view, we may notice that there has been a steady gain over a more extended period. The data line flattens out as we increase the time.

This short-termism is often associated with the availability heuristic in behavioural economics. A heuristic is a mental shortcut that humans have developed to solve problems and make decisions quickly. While this can be necessary at times, it can often be misleading. The availably heuristic suggests that the information we use to make decisions is usually based on more recent information that we have on hand. It may also be based on information that we see more frequently, say in the news or social media, or even more information that is more vivid. We tend to place our attention on that which is immediately apparent to us without giving sufficient thought to the bigger picture.

To have a future-based mindset, we need to look further out, consider scenarios in the future and look for possibilities and opportunities. We then start by taking action, even at the most basic level, to close the gap while keeping an eye on blind spots.

One way to increase our depth of field is to have a vision and a shared purpose. A clear vision can help to align the team with the longer-term ambitions. It shifts the conversation from the now to a conversation about the future.

A fascinating example of long-termism and increasing our depth of field comes from the Egyptians. When Alexander the Great died, his empire was divvied up. Egypt was given to Ptolemy, a General, astronomer and mathematician who lived in the city of Alexandria, named after the great king. Ptolemy, for some reason, enjoyed building light-houses and hired an architect, Sostratus, to help design the lighthouse in Alexandria. Sostratus did such phenomenal work in the design of the lighthouse; it was named one of the seven wonders of the ancient world.

At the time, Sostratus knew that his design was a noteworthy achievement and wanted his design and work recognised by inscribing his name at the lighthouse base. Ptolemy thought differently and also wanted recognition. He insisted that his name is inscribed on the base to get the requisite credit.

Increasing his depth-of-field, Sostratus gracefully accepted the request and inscribed Ptolemy’s name in beautiful lettering with pure craftmanship onto plaster, which was then added on the base of the lighthouse. What Sostratus failed to mention was that, at the same time, he had his own name deeply etched into the granite, hidden underneath the plaster.

Sostratus understood that the continuous battering of the Agean Sea against the lighthouse would eventually, over a long time, erode the weaker plaster with Ptolemy’s name and uncover the name of Sostratus.

In volatile and challenging times, we must remind ourselves to look beyond the present, lessen our aperture, look to the distance, and decrease the circle of confusion for a clearer vision of where we want to go.

In time travel movies, the story’s premise is often about someone who goes back in time and alters the past, which creates a very different present reality. We have an opportunity now, in the present, to make decisions that create the future we want.

 Increasing our depth of field can help us create a brighter future for all.