Quality and Security – Same Song, Different Verse

by Ioana Justus

In April of this year, I was assigned to lead a Quality program for all of IT at my company.  Meaning, I and my team are supposed to significantly improve the quality of IT’s deliverables in the next couple of years.  This improvement in quality is supposed to reduce support costs, reduce incidents and downtime, speed delivery through the creation of reusable materials, ensure we have proper testing environments, etc.  Of course a lot of this implies the need for training and behavior changes, which opens up the people change management can of worms.  It still makes my head spin when I think about our scope.

I also still ask myself, why me?  Why is an InfoSec Manager with expertise in identity and access management being asked to make changes that impact the worlds of (just to name a few) project managers, testing, delivery, operations, and support?  What do I know about these things?

When I asked the leadership this initially, the responses I got were things like, I have a good perspective on customer service, I’m familiar with the support and infrastructure teams, and I have a reputation for getting things done.  OK, I buy that.  I think they also wanted an impartial outsider – since I’m not part of any of the organizations impacted by the work, I’m more likely to be impartial.  I buy that, too.

What I really wonder is if they realized just how much my InfoSec background really plays into this new role – am I slow in discovering what they’ve known all these months, or is it just an interesting coincidence?  The reality is, it’s SCARY how similar quality and security are.  I was reading a Gartner presentation on aligning InfoSec with the business a few days ago, and realized somewhere in the middle that I could replace the word “security” for the word “quality” in the entire presentation and the statements would be just as true.

Think about it:  what is security?  Security is the set of practices, processes, and technologies that for the most part no one wants to deal with.  They’re often viewed as extra work.  Most people buy into security only because it’s required and because if they don’t, bad things happen.  But what happens when you do good security?  Nothing.  No denial of service attacks, no lost data, no hacks, no unexpected downtime, no firedrills, no audit findings, no… you get the picture.

And what is quality?  Quality is the set of practices, processes and technologies that for the most part no one wants to deal with.  They’re often viewed as extra work.  Most people don’t buy into quality because it’s not required but when they don’t do it, bad things happen.  And what happens when you do good quality?  Nothing.  No unexpected downtime, no rework on designs, no missed requirements, no customer complaints, no 3am support calls…  See what I mean?

In one way, security is easier than quality because there are legal requirements for it.  But quality is easier than security in that the consequences of bad quality are much more visible and easy to understand than the consequences of bad security.

So now what?  In my last blog post, I pointed out that the unintended consequence of rewarding too much speed is getting not enough quality.  Interestingly, when it comes to something like project delivery, customers continue to reward speed at the expense of quality even after having numerous bad experiences.  Why?  Well, for one thing, speed equals money and it’s hard to argue with that.  We’re also very much an instant gratification culture – “wait” is a four-letter word.  But the key issue is that the customer experience is negative.  Remember – it’s the positive experiences that drive the behavior, not the negative ones (this is very true in InfoSec, too).  This brings us back to Nothing.  Once we can demonstrate to the customer base that good quality leads to Nothing, they will reward Nothing, which will in turn encourage quality.

It would seem that my job is once again to sell everyone on the virtues and benefits of Nothing – in a bad economy no less.  *sigh*

Then again, Seinfeld made a lot of money on Nothing, so maybe I’m sitting on a gold mine and just don’t know it yet. 🙂