 |
Why do software projects fail? |
For some reason, July and the first half of August in Israel is one of the busiest times of the year. Q2 is typically a soft sales quarter and you would have thought that July and August would be vacation time where things are slowing down - but Israelis smell the holidays in September and pack in as much as possible before Aug 15th when the country really shuts down.
We're working on several software security assessment projects in parallel and I'm reminded again that risk assessment goes way beyond technical countermeasures.
The work is pretty intense and while the organizations are totally different - one is a large technology manufacturer, one is a small embedded software developer and another is a large government corporation.
If you remember TOC ( Theory of Constraints, invented by Dr. Eli Goldratt about 40 years ago) there is only 1 key constraint that limits system (or company) performance to achieve it's goal.
So - what is that 1 key constraint for risk assessments?
The CEO
In case 1, the lead security analyst who worked for the company left - the management waited until the last minute so we're wading through documentation and reconstructing an understanding of the systems and scope before we even start our first piece of threat analysis.
In case 2, the mushroom theory of management is being employed. Lots of unknowns because the executive staff did, could or would not reveal all their cards in a particularly critical development project. After 6 weeks - we sort of think we have most of the cards on the table. But - I'm still not sure. We are making great progress because fortunately - the engineering staff are doing a great job and using open source so everything is pretty accessible.
In case 3, a new CEO came on board after the initial vulnerability assessment and things came to a standstill as the executive staff started getting used to the new boss.
Without management cooperation - it's tough to do an effective risk assessment - I suspect this may be a common experience.
The methodologies about assume unlimited, frictionless cooperation from the customer. Maybe not.
