My friend, Elinor Slomba, and I will be on a panel titled: Cultural Self-Inventory for Distributed Agile Teams over at Sococo. We’re going to be talking about distributed teams, prioritizing people and their needs over tools and processes, and how being in a distributed team does align with the principles of the Agile Manifesto.

Elinor gave a presentation a short while ago and wrote this wonderful accompanying blog post addressing how the 12 principles of the Agile Manifesto can support distributed teams – its about how you go about doing it. My favorite excerpt from her post:

Keynote Craig Larman had reviewed with us his fourth “law of organizational behavior:” Culture Follows Structure. If this is indeed the case, and Larman points to evidence gathered by another thought leader to suggest that it does, then choices made about how to support the structure of distributed Agile teams represent a unique opportunity.

Might it not be possible, in fact, to work backward, selecting structures which prioritize individuals and their interactions over tools and processes?  Can distributed configurations be set up primarily to address a team’s social needs in line with Agile cultural values?

–Elinor Slomba, Distributed Culture Self-Inventory

I wholeheartedly agree! How people interact offline and online should be consistent, and you use appropriate tools to enable that. Distributed teams work a little differently, but they are still based on relationships, trust, and clear and consistent communication.

Distributed teams and Agile can go together like chocolate and peanut butter – we’ll be talking more about that on Tuesday.

Thanks, Elinor, for including me in this event. I’m so excited!!

Readers – I hope you can make it on Tuesday at 11am PT/2pm ET!

Before I forget: I’m guest blogging on her site – the first piece explores Agile Principle #1 (Our highest priority is to satisfy the customer
 through early and continuous delivery
of valuable software.) for distributed/virtual teams and soon in the future, I’ll be writing about Agile Principle #5 (Build projects around motivated individuals.).

After working on Principle #1, I know way too much about the term “valuable software!” 

There was a neighborhood street with 5 boulders in it of varying sizes and a lot of sand. The residents couldn't drive down the street in their cars or bikes. The sand was too deep and prevented a bike from working properly on it; cars were too large to maneuver around the boulders. 

The residents had to walk around on the grass; there was so much sand that the street was like a beach. And that sand started coming into their lawns. It was just a mess.

The residents had a meeting to do something about this problem. And they came to 2 solutions:

1. Sweep the street so they could ride their bikes on it and park their cars on the neighboring streets. At least with this plan they could get to their cars!
2. Remove the boulders that they could do on their own for now, then sweep. They would then collect money to remove the boulders that were too big – hire a crane and removal team. Then the street would be clear and they wouldn't need to keep sweeping the street; wind and rain would take care of the sand.

The second solution seemed to require too much commitment, so they decided to go with option 1. All of the residents had to do their part and sweep the street every day, but new sand seemed to come from everywhere. And there was always sand under the boulders. It was like the boulders created sand!

The work never seemed to end.

After a couple of weeks, option 2 seemed to make more sense. With a little team work, they removed the boulders they could, took turns sweeping away the sand, and generally most of the sand was gone and didn't return. There were two boulders left on the street, but they could maneuver their cars around them to park in their garages and driveways rather than their neighbors' homes (some were relatives of Homer Simpson).

It was suddenly easy to ride a bike and walk in the street. 

They then collected funds each month to move the boulders. While doing this, they learned that the town they lived in had a program to remove boulders from streets – and they qualified for funding.

They removed the final two boulders and didn't have to worry about street maintenance again.

In some ways, this is the same story could be used for your app or site. Boulders are usability issues – and some of us work on apps that have massive ones. A cranky database that delivers data after a few minutes rather than seconds. A horrible navigation approach that makes maneuvering around the site impossible. The sand represents the little things that are just not quite right – colors, fonts, buttons. Sure, those things make navigating the app painful and difficult, but cleaning that up won't fix the boulder problem. If anything, you may find additional small issues.

(Making you feel like the sand won't go away.)

You need to remove the boulders – fix the big things to remove the sand. If you remove the big app challenges, the little things may go away on their own with those repairs. When you redo the navigation, you may update that part of the style sheet and make the navigation look better. Or while fixing the error messaging, you may be updating the forms and reduce usability issues on that page by 90% (no more sand!). Fix the database and you may decide to fix the front-end display to make it easier to scan.

In the meantime, you may find money for the larger issues from other groups or the corporate team (the town and beyond). There may be a larger organizational initiative that could fund your project. Or if people see how your app is more successful with some of the larger "boulders" remove, you may get more money to generate even better results. 

To sum it up: To clean the street, remove the boulders and stop sweeping the sand. 

If thoughts about keeping your devices secure from hackers and malware gets you on edge to the point where you don't like to think about it, ignore the problem, and know that by avoiding solving the problem you are creating a worse problem, try this: 

Free Cyber Security Course for Beginners from Heimdal Security

I'm into day 10 and so far, the course is great! It's sent to you daily for 21 days. It offers great advice and guidance for keeping your computer and devices secure – and it includes guidance for backups in case someone does take your device (and use the passwords and information on it).

I've been learning a bunch and am getting a refresher into what makes a secure system.

They present insights into how hackers do their thing – what they look for, how they think and what they do. It's great knowledge to have, especially at a time when pretty much any device that is connected to the Internet can be hackable (this is why the Internet of Things movement is so scary to many technologists – there are a number of devices out there that don't have any security support and are based on older technology that has many weaknesses to exploit. The healthcare industry is most at risk for this.).

But Security Still Has a User Component…

The biggest challenge I keep seeing with security is validating someone's identity online. This is difficult not just online – but offline – and I'm not sure will be resolved any time soon. Here's a longer piece where I discuss identity indepth.

We can't even validate someone's identity today offline today when we travel (ID cards don't count. They are really nothing more than a key or combination for a lock). There really isn't a model we can use, except:

• Biometrics, which comes with its own risks (who owns that data)
• Voice, which needs work
• Gestures, which also needs a lot of work
• (And maybe more – technology is getting more intriguing every day!)

Maintaining passwords for security is where security truly collapses and has one of the biggest holes. Hackers look for weaknesses – either in the code of a site itself or through access. Randomizers help with breaking into accounts – so the more complex a password, the safer you account is assumed to be. However, we are still depending on users to provide this.

Good security is based on someone having different passwords for different systems, but most of us can barely keep track of a single password, nevermind a different password per system. In come the stickies on the computer or a notebook of passwords.

These passwords may be secure online, but not secure if you happen to lose that piece of paper.

Given the number of devices we have today, the number of apps we use, and types of accounts we have, this practice can be overwhelming.

From a UX perspective, there has to be a better way.

We keep coming back to establishing identity online. Once we do that, many of these security issues will be resolved and based on software rather than the concept of a key – which has been a flawed security approach since it's first use.

But until then, prioritize security over usability (a good security UX in this case is keeping your info secure at all costs. The technology needs to get there).

Keep a complex password in mind for your systems that uses letters, numbers, and special characters, use virus protection.

Oh yeah, and take that course! It's awesome!

Last year was the year attackers “went corporate” by changing their tactics to focus on businesses rather than consumers, exploiting middle management overload of information sharing, and trading off attack volume for sophistication. Human behavior, not simply system or software vulnerabilities, has significant implications on enterprise security.

Key findings include:

• Every organization clicks. On average, users click one of every 25 malicious messages delivered. No organization observed was able to eliminate clicking on malicious links.

• Middle management is a bigger target. Representing a marked change from 2013 when managers were less frequently targeted by malicious emails, in 2014 managers effectively doubled their click rates compared to the previous year. Additionally, managers and staff clicked on links in malicious messages two times more frequently than executives.

• Sales, Finance and Procurement are the worst offenders. Sales, Finance and Procurement (Supply Chain) were the worst offenders when it came to clicking links in malicious messages, clicking on links in malicious messages 50-80 percent more frequently than the average departmental click rate.

…The most popular email lures in 2014 included: e-fax and voicemails notifications, and corporate and personal financial alerts…

–“How attackers exploit end-users’ psychology” Help Net Security

To sum this up, the key offenders who click on these phishing emails fit into a distinct profile:

• People overloaded with emails
• People who respond quickly to urgent messages by skimming (not reading)
• People who’s main work focus isn’t IT (so they don’t really notice the nuances and patterns of the phishing emails or the urls in the links)

We all know what these phishing emails look like.

• Poorly designed and written email messages
• The subject matter usually informs you that your account has been overdrawn from a bank you have never heard of
• Or you hear about an account you never had in another country
• Or someone from Nigeria or another African country is informing you of winnings

…and the list continues.

However, these guys are starting to adopt UX and marketing principles to get clicks. They know that we are onto them and won’t fall for those scams that they did in the past. They are improving their game.

I have noticed a trend of these emails more closely matching the corporate templates they are trying to copy and leveraging similar language. It’s becoming more difficult to identify these emails by skimming alone (the urls are always a giveaway with a rollover).

Here’s an example of “American Express”-styled phishing. The subject line definitely got my attention: Member Suspension Notice.

After reading the subject line, I FREAKED OUT!

The thoughts that raced through my head:

• Why would my account be suspended?
• What did I do wrong?
• What’s going on?
• OH MY GOD!!
• Why did AMEX cut off my account?

…and I spiraled downwards into a mental abyss from there.

Of course, I opened the email and I read something about my phone number being updated, which didn’t make a heck of a lot of sense in relation to the subject line, but I didn’t care because I was too panicked by the subject line. I kept looking for a reason for the account suspension. I initially read this on my phone, so I didn’t get the full effect of the odd formatting and the weird account number display to know right away it was from a phishing expedition.

I was close to calling AMEX or using the AMEX app on my phone to learn more about why my account was suspended. I was rational enough to have had good sense NOT to click on the link in the email. There was no reason for it.

When I saw this email on my computer at home later that day, I had to admit that the formatting wasn’t bad. (I mean, it’s not great, but these phishing emails have come a long way! At least there is formatting consistent with the brand.).

It wasn’t until I rolled over the link to see that the URL didn’t go to AMEX – it pointed to some crazy, and most likely infected, site. (Unfortunately, you don’t get to experience that on the phone – so maintain caution when you tap!)

How are these phisher-men getting smarter?

• Their emails are copying the simple, system email templates these companies use. I almost want to say, about time. It’s not a hard thing to do. And a basic systems template doesn’t take a lot of work to replicate. In general, they are making their emails look better and more convincing.

• Marketing 101 – they rely on your emotional response to click. It’s not great, but they are leveraging panic for you to open an email. They will also get you to feel excitement to open an email about a potential, yet bogus, LinkedIn connection. And it’s through curiosity that you would click on a link to that bogus connection or click a link to some bogus site to accept the stranger’s invite.

• They are experimenting with social media. I’m not kidding – the Nigerian scam has reached LinkedIn. I got an invite from a “banker” from Nigeria, some nicely dressed older woman. Not even two minutes after accepting her invite, I got an email inquiry about a deal. I immediately un-linked from her and was more careful about who I accept an invitation from on LinkedIn.
• The urls to go to are getting better. For this email:

The PayPal Web address is: pypl.com. Yes – it’s not that far off from paypal.com. For someone who is not tech savvy, this seems like a reasonable URL to go to. Only people in IT and related professions know that PayPal only will use a derivative of PayPal.com (meaning, paypal.com will be in the first part of the url). Most people don’t really think about this – and fall victim because of it.

Knowing that phisher-men are incorporating modern UX design and communication principles into their tactics, you need to be a little more defensive in your email scans.

A few things you always need to be aware of when you get a strange email:

• If a subject line is about very unexpected news (like an account closing) – phishing alert! Don’t open it. (Most companies communicate that through a letter, anyway.)

• If the formatting seems a little unprofessional, the email probably is not originating from that corporation. Corporations monitor email formatting to the pixel. Everything is aligned. This isn’t always 100% true for a phishing email.

• If an email and its links seems suspect, don’t click on them. If you have a question about its legitimacy, go to the company’s app or Web site directly to sort it out. Stop using email links. (The same information in the email will be on the site.)

• The URLs for the links in an email for a proper company will be a derivative of its formal url. Not something like pypl. Always rollover the link of any suspicious email to confirm where it is going. I have seen that too – respectable companies sending a suspicious email with a real link. Sometimes, a company will be off their game. It happens.

• But the rule to rule them all – if in doubt – visit the original Web site or app. The Web site or app has the your most current, accurate account information. If an invitation is legitimate, then the info will be available at the site. If it isn’t, you dodged a virus or malware attack.

Please be safe – don’t click on suspicious links!

I'm curious about people's perspectives on computing security. From what I have been reading about this, there isn't a whole ton of research completed on the subject (and most of what I have read alludes to holding the user accountable for their own security. I'm not sure I agree with that.). If there is more research on the subject, please pass along and send me a comment.

I wanted to get your thoughts and opinions about computing security and the like. 

If you have a few minutes, feel free to take the survey.

https://www.surveymonkey.com/s/securitysample

I'll be writing a blog post about this next week.

Enjoy! 

The Agile 2014 conference in Orlando was great! I learned a lot, got introduced to some new ideas, revisited some old ones, and learned how Agile is moving to the next level – mainly, how Agile methodologies are changing the way business happens. 

I also met a lot of cool people working on interesting projects! It was very inspiring!

I will be writing about my observations, insights and experiences soon! Last week I was in Palo Alto for HP work and learning more about the current reorg. I totally lost track of time! And then this week, I was so glad to be in my home in Dallas, I forgot about most everything else.

More coming! 

I am a Customer Experience strategist and implementation expert. I have helped companies get results from their Web sites, Web/mobile apps, customer service organizations, lead generation systems and phone lines for over 20 years.  I was thinking about Customer Experience long before the term existed.

My approach is unique because, although I agree that a vision needs to exist, I strongly believe in the power of Agile and incremental change. Moving to a final state vision NOW may be the desired result, but I have seen time and time again that doing that can be a huge mistake. Spending more than a few months on a project can sometimes miss a market opportunity with the team’s focus on being “perfect” rather than “better than what we have today.” Sometimes, a change will happen by force and you get scope creep. After a few months of that, your project is lagging and you are now behind in the industry. And to catch up, you change scope. And the project NEVER ends. Nothing launches. And you are spending millions for no gain.

And without visualizations in the process – magnify the confusion by five.

To me, products and functionality are living like people. We are influenced by our experiences every day – as projects should be. This is why short sprints for implementations work better.

With customer feedback nothing can stop you. Talk to your customers frequently to find out what they want and incorporate that feedback. Your customers will notice. 

How do you know that I know what I’m doing?

• For a number of years I was a project and team manager – specializing in working with virtual teams. I have worked with teams as small as 2-3 people in a room and up to 65 people in 4+ locations worldwide. And they all delivered on-time and within budget.
• I have worked with creatives, technologists, QA experts, other project managers – I have managed people in a number of roles. Except financial types – just not my thing
• I have worked on projects of all sizes for companies of all sizes. I have worked on an incremental page changes, redesigns, vendor selections, technology implementations. No project is too large or small.  
• My work has helped companies achieve some amazing results. I need to update my cases studies to illustrate this better, but I have helped many companies achieve their customer goals in short timeframes, using an iterative approach.

​Or read my CV.

With Balmer going out, maybe Microsoft will recover and make a bang. There may be hope (like with Leila of Star Wars to overtake the Empire)! 

I read this artcile about the demise of Microsoft. And yes – they consistently missed the technology direction the world was going towards – even beyond what the article points out. They initially missed the Internet and if I remember right, Billy Gates poo-poo'd it as a trend. They have been laggards all along – except with X Box. X Box was and is a true innovation. It shows there are some real talented technologists and designers there.

But back to the business and the history….

Long long ago, in the dawn of the public Internet, it was predicted that all a computer/device would need is a browser and all apps would work from it for a fee, like a rental. The world of dumb terminals would be resurrected, but with a better GUI, higher usability and more functionality. Google has managed to achieve this vision with Chrome; Microsoft is still chugging along with a bloated OS and crazy interface design that has set the standard for computer usage by default (their partnership model with PC manufacturers made it the ONLY way to work and sadly, their only way to make money). The benefit was the birth of smaller chips and the rise of Intel, but that only made way for these mobile devices (tablet, phone, and who knows what else). And with the death of the PC and rise of the mobile devices, Microsoft is in quite a pickle.

Now, Windows 8 isn't half bad. It's kinda nice actually, and fun to use on an Envy with the touch screen and keyboard. It's like the setup I always wanted – if your mouse is acting funky, just hit the screen. However, Windows still needs a device rather than a just a browser like the Chromebook (which has the opposite problem and needs a touch screen, but I digress). 

I can't wait to read the remainder of the article tomorrow to see how Microsoft can save itself. I think getting away from MBAs trying to be technology guys is a start. And getting away from Basic derivatives. And seeing the future of computing being integrated in daily life. And seeing beyond profit coming from highly structured partnerships. I think you get the picture….