The debates around working from home from employers is fairly odd. You want to recruit and retain productive and happy teammates. The responsibility is on the employer to provide that environment. Employees should have choices of in person, remote, or hybrid whenever possible.
It feels some of this stems from measuring employees by hours instead of productivity. It’s certainly not always easy but hours as a crutch is misleading. It’s important to drive accountability between individual contributors and supervisors and trust their choices.
At @DragosInc we were a hybrid and remote work environment before the pandemic and will remain so after. It’s worked very well and allowed us to recruit amazing people from all over. It’s a competitive advantage for us. It also provides a more flexible/happier environment
One thing we realized was we needed more office locations but smaller spaces coming out of the pandemic while being more flexible. As an example, we have a small group of employees in Perth, Australia. So our main office in AUS is Melbourne but we got some flexible space in Perth
The business benefited by not having a larger rented space which also reduces office space options. It also benefited by having reduced office costs. The employees got to work from home when they want but also have some smaller collaboration space when they wanted it.
Being fully in person can certainly have some benefits and not every job can do remote work (e.g. electric lineworker doesn’t get that luxury) but where possible we’ve found the overall benefits to far out weigh the costs. It is important to adapt the culture though
As an example, simple things like having cameras on during Zoom meetings whenever possible, real photos vs avatars in Slack profiles, multiple company onsites a year to fly folks in that want to, more transparent communication from leadership, etc. but these have great benefits.
Anyway, whenever I see employers complaining about adapting to the new normal, especially tech companies, my cynical side says: well, that whole “innovate or fail” y’all like saying so much - better get to innovating. Your employees have.

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Robert M. Lee

Robert M. Lee Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @RobertMLee

10 May
I’m scheduled to join @jimsciutto on @CNN at 10am Eastern to talk about ransomware and intrusions into our industrial infrastructure in context of the Colonial Pipeline incident. Join me if you can and thanks for tuning in.
In my opinion there’s some bad takes out there but overall it’s completely reasonable that folks are paying attention. This is the most disruptive incident we’ve seen on US energy infrastructure from cyber intrusions. Colonial Pipeline is the victim and has done a lot right.
They contacted a top tier incident response firm (FireEye/Mandiant) for the enterprise compromise (only IT impacted it seems) to lead the response. They informed the USG who had great folks from CISA/FBI/DOE supporting. They focused on safety and took operations down proactively.
Read 14 tweets
28 Mar
To the security professionals facing difficulties getting an entry level job, being properly resourced, facing internal policy issues, being beaten down by competing frameworks/guidance/advice even from USG...the “if NSA could monitor your networks we’d fix it” is insulting.
I really do like the NSA; having served there I know the amazing work they do. I’m also a privacy advocate as many there are. There’s real roles and responsibilities for government to help private sector. More surveillance isn’t the answer. Actually there is no one answer.
When you’re in USG (NSA/DHS/DOD/etc.) you hear that people need help. You have insights and training. You want to help. It’s awesome. But the problems aren’t that simple. You also see rising threats but don’t see the closure that happens inside those companies. It creates angst
Read 11 tweets
1 Mar
There’s a new @nytimes article out on a @RecordedFuture report coming out tomorrow ok potential Chinese activity targeting Indian electric sites. I’ll hold broad thoughts for the report to drop where I can dig in but a few initial thoughts: nytimes.com/2021/02/28/us/…
First, it’d be no surprise to find that between two states that have conflict (and with some skirmishes bordering on going larger) that there would be targeting of critical national infrastructure such as the electric system (power grid). So the claim seems very reasonable
Interestingly, the NYT writes: “Now, a new study lends weight to the idea that those two events may well have been connected” referring to a power outage last year in India. But what’s interesting is the RF analysts don’t seem to say that noting instead a link is unsubstantiated
Read 17 tweets
17 Feb
A quick thread on intelligence analysis in the context of cyber threat intelligence. I see a number of CTI analysts get into near analysis paralysis phases for over thinking their assessments or over obsessing about if they might be wrong. (1/x)
Consider this scenario. A CTI analyst identifies new intrusions and based on the collection available and their expertise note that the victims are all banks. Their consumer wants to know when threats specifically target banks (not just that banks are victims).
The CTI analyst has, from their collection, at this time, and based on their expertise enough to make an activity group (leveraging the Diamond Model in this example) that meet's the requirement of their consumer. So what's the problem?
Read 14 tweets
11 Feb
Yesterday in the Congressional hearing on homeland cybersecurity @C_C_Krebs and @DAlperovitch very kindly called out @DragosInc as a good example/company to work with in ICS/OT. Not “buy Dragos stuff” but “here’s a good example of an approach” and I just want to say thanks
We’ve been afforded a really cool place in the community to be allowed to focus on ICS/OT and have a ton of support from around the community.

What mostly stood out to me on this topic is that both recognized the unique approach required for ICS (Dragos or not)
Enterprise security is very important. And there’s lots to learn from them for ICS. But ICS security is different especially when dealing with physical systems. Understanding the unique risks, systems, etc all matter but most important is understanding the mission and priorities
Read 5 tweets
11 Feb
The fact that so many are focusing on the water plant using Windows 7, which had nothing to do with how the attack was done, is interesting. Folks have an obsession with vulnerabilities and while they can matter a lot it is a fundamentally different value prop in ICS.
The attack took advantage of TeamViewer. In this instance the OS didn’t matter. The TeamViewer application was Internet facing and available. The attack took advantage of the HMI, that’s not a software vuln issue, they just did what operators could do on the system natively
There’s a lot of “insecure by design” systems in ICS. Meaning most of the things you want to do you don’t need a vulnerability or exploit to do.

Also a lot of IT security is system or data security, protect the system don’t let folks get root, encrypt the data, etc. ICS is not
Read 9 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!

Follow Us on Twitter!

:(