Preparing for Surprise

It seems like a paradoxical request: how do you prepare for surprise? It's pretty teachable, as long as the teacher gets out of their own way. This post originally appeared on the Duha One substack.

Leadership Moment: Firing At the Student

Last week, police in Burlington, VT surprised students in a forensic class with a mock mass-shooting simulation. Unsurprisingly, students and parents were decidedly unamused with this event, which was poorly thought through (although the pedagogical goals are interesting: an aim to demonstrate to the students after the event how all of them would have slightly different memories of the incidents, which is an important learning in forensic science).

In an ideal world, how do we start to train people to deal with surprises in their daily life? Let’s start small.

Also last week, I attended a bat mitzvah – the celebration of a Jewish girl coming into adulthood. In the traditional/egalitarian movement, this means doing all of the things that only an adult can do in a religious service: leading the congregation in prayer, reading from the Torah and Haftarah, and delivering the d’var (sermon). There is a tradition in many communities that, as the new adult comes to the end of the prayer concluding the reading of the Haftarah, the congregation throws candy at them (don’t worry, we use soft gel candies that are not at all aerodynamic).

In addition to the sweetness of the moment (which the children in the congregation especially relish, as they race to collect candies), there is another purpose. As the concluding prayer is being read, the candies are being distributed. The congregation gets louder and louder, as the rustling of plastic wrappers combined with the murmur of voices makes it harder and harder for the prayer-reader to focus. They glance up. They try to restrain a smile. Maybe they drag out the prayer to delay the inevitable. But all of it? Preparation for future times, when they’re leading a group and a disturbance begins. We’re teaching them to keep their cool under surprising pressure.

Back to Burlington. Unfortunately, the pedagogical goal of the simulation (teach them about eyewitnesses) wasn’t aligned with what we’d generally prefer to happen (don’t just be an eyewitness to a potentially fatal event). Planners got in their own way.

One Minute Pro Tip: Stifle Your Own Coolness

Years (decades) ago, I used to write live-action roleplaying games, under the auspices of the MIT Assassins Guild. One piece of guidance, given by a long-time game writer, was “Game Master coolness is inversely proportional to player coolness.” Basically: the more enamored you are of how you’ve scripted a game, the less you’re enabling the participants to do something interesting.

As you’re teaching people, this often comes into play. Leaders and educators often become so enamored of the cleverness they’re showing in creating a development event that they don’t stop and consider how the event will engage the audience. Will they feel empowered, or will they feel like an audience to your own coolness? By considering the various ways they might react, we can forecast when our coolness makes our event decidedly uncool.

Appearances

Recent

June 4, CISO Series Podcast: I’m Rewarding Your Successful Use of the Security Budget by Giving You Less of It

June 11, CISO Series Podcast: Who You Gonna Call? LEGAL COUNSEL!

TODAY: I’m really excited to have contributed to Cycode ’s Code Resilience in the Age of ASPM, along with brilliant folks like Dor Atias??????? , Shawn M Bowen , Erik Bloch , James Berthoty , Bryant Chae , Roland Cloutier , Sam Curry , Daniel Fishkov , Alexander Flowers , Bobby Ford , Heather Hinton , Ash Hunt , V.Jay LaRosa , Tomás Maldonado , Kayra Otaner , Helen Patton , Jerry Perullo , Ronen Slavin , and Justin Somaini . (Link takes you to the ebook, with an opportunity to get a limited edition hardcopy) #aspm #applicationsecurity #codesecurity #ebook #newrelease

Upcoming

June 18: Vulcan Cyber, a Tenable Company 's Cyber Risk Summit

June 25, 1330 IL: Cyber Week TLV Main Plenary: The Immeasurable Challenges of Risk Measurement

July 16, NYC: CISO Dinner with Valence Security and Aim Security

Aug 5-8: (tentative) Black Hat

September 24: HOU.SEC.CON

Leadership Q&A: Balancing Your Failure Budget

Leader O asks, You talk about minimizing Ineffectiveness as a key leadership principle. Some of our team are security researchers, and a lot of research ends with no positive output. How do I balance allowing them to fail with minimizing ineffectiveness?

The nuances of the English language bite me again, O.

This post continues on the Duha One substack.