Abuser Stories:What shouldn't the software do?

The general tendency of the requirements document has predominantly focused on what the software should do. In project charters and scope control documents, sometimes we also write what features will be out of scope. The UML diagrams and use cases discuss how the classes should interface, and modules should interoperate, for instance. The agile paradigm discusses persona approaches drilling down DEEP property for describing backlog features and INVEST principle elaborating on the characteristics of a user story. Even test cases that focus on negative testing use a requirement traceability matrix to the requirements limitedly testing the functionality of what a system shouldn't do.

But, when a system is hacked or inappropriately accessed, the loopholes rests on the inefficiencies in how the system was designed to allow such loopholes to exist. So, how do you avoid these vulnerabilities so that the hacker doesn't exploit these "working as designed" gaps?

While volunteering at the Agile 2015 conference, I chose to attend a section on Abuser stories by Judy Neher from Celebrity Technical Services. It was a great session introducing the concept that a persona of a hacker or disgruntled employee could potentially have a malicious intent to deliberately break the system. The speaker suggested describing user stories that specifically could break the system or expose the system for malicious intent. The participants in an activity gave examples for a simple user authentication such as the stringent password recycle policy, the use of a double password and picture identification, the use of external devices such as phone, email, or mobile texting to use tokens for validation within a short timeframe before the account is locked, the creation alerts for maintenance for incorrect and frequent access to multiple accounts, the enforcement of HR exit policies on employment dates before the role based access can be authenticated, the validation of human versus robot logging by tracking the speed of password entry, etc. Imagine having such stories to bulletproof the system against malicious attacks on standard user stories and have automation capabilities to constantly check for these loopholes.

I am sure one would say that this would add more time to the scheduled release or limit the stories written per iteration/sprint. Of course, like non-functional stories that add some time, the abuser stories also will add time. The need to develop hunches on the type of regulations in the industry, the type of technical platforms used, the time to market considerations, etc. However, the question shouldn't be whether to do them or not but when to do them. If we fail to do them, we are increasing the technical debt. A couple of alternatives are to dedicate a sprint or a portion of every sprint to address these abuser stories.

I really think this is an important component of combined technical and product ownership to ensure we see the persona of other types of users and see the system from that view. As good project managers turn assumptions into risks and control quality, the technical and product owners should be accountable for products that preclude vulnerabilities by design. Abuser stories are a great start. Don't you think so? Share your thoughts.

References

Neher, J. (2015). Abuser Persona. Agile 2015 Conference. 

Attention or Time Management

Flying over India returning from Mumbai to Chennai, I was browsing the Jet Airways magazine. Often filled with travel recommendations and shopping suggestions, these in-flight magazines have only created a browsing pleasure. But this magazine had a topic on achieving more with less perking my interest to explore.

It was an interesting read as the article began discussing how  time management pretty much shouldn't be the focus of smart managers. Instead, the article focused on attention management. Based on the time of the day, people can manage difficult tasks that require deep thinking, strategy, etc. when their attention to detail is at its peak. Then, as the energy winds down, their attention takes a deep dive. This time should be used for tasks that require less critical thinking.  Between these extremes is the reactive attention seeking time zone that should be used for other tasks that require a balance of the two.

I agree that it is a good idea and that tasks require different levels of thinking. For instance, planning for the project, evaluating strategies to grow accounts, or grooming the product backlog with new features based on the market and reactions from customers and users require thinking different from task or resource management.

However, the article said the urgency of the tasks shouldn't be a criterion for attention management.  This begs some thinking as depending upon the role of an individual manager, the urgency of the task, such as a grieving customer on the phone, an infrastructure deficiency leading to business continuity management, or a delayed or poor-quality work impacting deployment readiness of a project is not something that can be ignored.

The earlier approach on using Scrumban to think a couple of steps ahead and plan can be combined with attention management to better compartmentalize take at hand and energy/attention requirements to better manage productivity.

Thoughts?

Choosing between agile versus plan driven approach

Increasingly, I keep hearing references like the challenges and benefits to waterfall approach versus agile approach to software development. Whether these are software developers, testers, technical operations, project management, or sales & marketing professionals, the underlying theme is that software development life cycle (SDLC) has become synonymous with waterfall development but agile is not. Focusing on the core principles of agile, primarily ‘working software versus comprehensive documentation’, isn’t agile approach also developing a software? Aren’t the concepts of planning at various layers, such as daily, iteration or sprint, and release, to iteratively develop incremental software enhancements part of a life cycle for software development? So, where is the huge disconnect?

The challenge is not in the approaches but in people’s incorrect assumptions in thinking what the original SDLC proposition was and equating it to waterfall. In fact, in a recent meeting that I attended in PMI Mass chapter, many participants didn’t relate to the original author of SDLC, Winston Royce’s seminal proposition in 1970 who himself related to the challenges promoting incremental and iterative approach and the increasing involvement from project management in software development. Practitioners therefore created a non-existent and non-functional theory of waterfall embedded with the assumptions below that are challenged by my scholarly publication (Rajagopalan, 2014). 

1.       Linear approach to software development with no feedback
2.       Big upfront requirements gathering
3.       Gathering requirements upfront saves cost
4.       Analysis follows requirements followed by design
5.       Project Management is not part of software development
6.       High degree of documentation needed before starting work
7.       Customer sees work after all the work is developed and tested
8.       Testers need not be involved early

Therefore, I will deviate from using the word, “waterfall” or “traditional” approach and recommend using the “plan driven development” using the rapid application development and fundamental project management principles. Basically, the requirements for the choice of agile or plan driven approach to software development lies in the problem being solved. 

If the challenge is to build a mission critical application controlling the amount of x-ray radiation that will be discharged by a software application, then, a plan driven approach may be a better fit because of the certainty in requirements that can be reasonably predicted, and the amount risk involved in doing it incorrectly without impacting the profit margin. On the other hand, if the requirements are not certain and the complexity is not high where the functionality is possible to release in an iterative fashion such as a new mobile application or responsive website for student enrollment in a college, then, agile may be a better candidate. 

So, instead of choosing the methodology and solving the problem using the methodology, the methodology must be chosen based on the problem solved!

Thoughts? 

References

Rajagopalan, S. (2014). Review of the myths on original software development model. International Journal of Software Engineering & Applications, 5(16), 103-111. Retrieved from http://airccse.org/journal/ijsea/papers/5614ijsea07.pdf

Role Mergers: Is middle management – product, account, program, and project - learning from failure?

Based on the interactions I have had with attending various webinars, seminars, networking events, and conferences and bringing them to practical work, I always ponder over a question. Is middle management – product, account, program, and project - learning from failure? I share my viewpoints on the role mergers and how many are not rising up to the requirements leading to inefficiency. 

Traditional project management roles defined frequent lessons learned or post-mortem sessions and agile development practices recommended a retrospective after iterations so that inefficiencies can be addressed. With so many different types of projects, multi-project program initiatives, products developed, and accounts managed across multiple industries, have we incorporated the lessons from our failures and most importantly other people’s experiences of failures!

My definition of failure is that if we have not learned from our failure and success, then, we have a failure. If we have learned from our failure to adjust our processes to avoid repeating the same mistake, then, we have turned failure inside out. By that definition, we can’t agree that we have benefitted from the rich experiences of failure and success entirely.

In one of the Account Management seminars that I recently attended, I heard that one of the fundamental reasons for account management failure is the lack of understanding about the products and services to provide strategic direction towards solving the customer problems. Digging deeper, Kim Zoller and Kerry Preston in their book on Enhancing executive edge relate the account management operating from a quarter-to-quarter or similar frequency on their accounts (called opportunistic) will only derail even the best project management to fail unless the account management becomes relationship based and customer focused.

But is the relationship only with the client? If we say customer focused, are we not treating employees and internal teams as customers? Think about it! Relationships with internal teams are equally important as they are the ones that deliver!  Our clients watch these things too because if you fall for everything and yield to everything the client asks then you stand for nothing, losing credibility with the client and the team.

Interestingly, Schultz and Doerr (2014) from RAIN group called out in their strategic management failure white paper that the strategic account management roles will be coming with the backgrounds of relationship lead, entrepreneur, innovator, collaborator, consultant, researcher, project manager, and skeptic. In their attempt to describe this interaction as connect, convince, and collaborate, this was an interesting finding because it brought the characteristics of a product manager or product owner of how they collaborated with the client and team grooming the backlog but also playing the devil’s advocate from both the client and the value for performing organization. It also integrated how the account manager roles need to understand the foundational project management thinking that also looks for risks, schedule, scope, cost, quality, integration, and stakeholders. Even agile teams are introducing the acceptance and behavior driven testing where additional test cycles will be added to ensure that the business team performs the acceptance testing before products and projects are released to customers.

Woven deeply in these observations is the skill/task alignment required! Technology is so pervasive today but how much technical understanding is today’s middle management exposed to! Like the saying goes in the “Die Hard” movie, “you are the wrong man in the wrong place at the wrong time!” Businesses allow many reasons to continue having unskilled or untrained resources and expect a miracle instantly! Mike Schultz and John Doerr further relate to this in “Wrong People, Wrong Roles” in mandating a minimum of three skills – leading relationships, finding innovative ways to create value, and driving your (performing) organization and (client) team to get things done. As you can see these mean that no longer are the businesses requiring skilled personnel in one area but multiple skills in other areas.

These findings resonate in the fundamental Agile principle of self-organized team! If the team depends on others to initiate, route, and manage the tasks, then agile in such cases will fail! This is also the reason why Scrum didn’t even have a “Project Manager” role in their roles merging this role with either one of the three roles depending upon the multitude of skills in the project manager – account and product management knowledge.

Keane, a consulting organization in their “Productivity Management” book recommended that productivity comes when business teams, customers, and developers are all brought into one training event to hear various sides of the productivity spoilers and address them through processes. Once these processes are addressed, the onus shits to the people! Projects predominantly fail because of people and not because of processes! Extending these thoughts even from a sales perspective, Pink (2012) recommends the new adage of attunement, buoyancy, and clarity where the sales need to engage in problem-solving more! 

Even educational institutions are not an exception and recognizing this need. In one of my recent exchanges with a University in their Visual Arts and Animation curriculum review and design, the school professors were reiterating how the expansion of cultural diversity requires learner's understanding of the target markets and industry expectations of multitude of diverse skills in the graduating learners as part of the experiential learning approach. An example is having the narrators be able to write scripts, graphic artist to know and introduce animation, public relations communication member to modify the approach impromptu when the target market for the same product has changed.

So, there is a revolution happening! Customer service is no longer one department, and it sits with every person in every department. Roles are merging in the middle management because businesses are flattening the layers and going lean in their model. So, the middle management need to wake up and smell the completion and brush up on their knowledge to be multi-faceted ready to wear many hats. If not, failures are designed to repeat!

Thoughts?

References

Pink, D.H. (2012). To sell is Human: The surprising truth about moving others. New York, NY: Riverhead Books. 

Plummer, D.H. (1995). Productivity Management: Keane’s Project Management Approach for Systems Development. Boston, MA: Keane. 

Schults, M. and Doerr, J. (2014). Insight Selling: Surprising Research on what sales winners do differently. Hoboken, NJ: Wiley & Sons. 

Differences between Kanban and Scrum

Recently when attending the 5-day Agile 2014 conference in Orlando, Florida, I had an opportunity to discuss various agile implementations. Some of the discussions centered on selecting the right type of agile methodology to consider for software implementations from extremely regulated medical devices industry and government projects where Scrum was considered prevalent. Then, when I found in my network of work and friends, there were questions that revolved around using Kanban because Scrum wasn’t working.

Having used Kanban and Scrum, I wondered why there is still confusion among the early adopters of Agile and why Kanban would be considered as a substitute for Scrum. Unclear understanding of agile concepts may lead to failure just like how people created a non-existent theory of waterfall based on inaccurate practices (Rajagopalan, 2014). So, I focus below on a comparative study of the basic premises between Kanban and Scrum. I hope this article captures the essence of these approaches demystifying the confusion and helping in the selection of the right approach for the challenge at hand.

One of the primary differences is that Kanban is a method that can be used independently or along with other approaches like Scrum. This is why we even have derivative approaches like the Scrumban.

Concept	Kanban	Scrum
Management focus	Maximize resource usage avoiding delay and enhancing accountability to support flow.	Consistent delivery in the cadence of execution, as the features in the product backlog is delivered.
Operating rhythm	No time-boxed iterative development exists.	Time-boxed iterative development – usually two to four weeks.
Granularity of work	Focus is at the task level for which the scope of work is generally known.	Focus is at the user story level for which the scope may not always be known, requiring it to be estimated before tasks can be identified and taken up by the team.
Agile Estimation & Planning	Estimation is generally not done. There is little to no ambiguity on the task that any member of that team should be able to take on the next available task and execute it.	User stories are estimated. Then, they are prioritized, and risk adjusted so that these are included in the release and iteration planning.
Value Delivery	Every task completion may not necessarily add minimally marketable value to the customer. Task identification and dependency require careful coordination.	The cadence of release and iteration planning focuses on adding minimally marketable feature through the scrum cycle. The self-organized team determines the task identification and dependency.
Progress Tracking	Flow of items throughout the lifecycle limiting delay. This is why the focus is on limiting “Work in progress (WIP)” is promoted through “Don’t Repeat Yourself (DRY)” focuses on maximizing work not done	Focus is on tracking the velocity measuring the user stories done and delivered to customer in an iteration
Utility value	Better for managing workload and resource management. E.g.: How many projects of different combinations can be taken up by a project?	Better for managing products, programs, and projects.
Thoughts to consider in software development	Use of Kanban for software development may impede flow if all the units don’t consume the work produced at the same speed. Therefore, additional processes must be in place to support Kanban. E.g.: QA not having capacity to test code developed by engineering team. If QA’s capacity comes from the fact that more defects are found in the build, then, more granularity in tasks to ensure proper code review, unit testing, and documentation are processes that the organizations must have in place.	Implementing Scrum doesn’t mean the ability to write user stories and avoiding documentation completely! This requires a management shift to ensure critical thinking on the product, program, and projects. If iterative delivery is not understood by the management and client, then, Scrum is not an option to consider.

In summary, Kanban and Scrum are both light-weight approaches, but the operating philosophy is different. Scrum focuses on the work being delivered to customers through multiple iterative deliveries of minimally marketable value by assembling a cross-functional, skilled, and self-organizing team or team of teams. Kanban, on the other hand, is a pull-based system and focuses on the visualized workflow where flow is maximized by limiting what gets worked on by the team. Although both approaches require prioritization in the items represented in the backlog, Scrum team can’t pull an item outside of the Sprint backlog when they have capacity. Kanban team can pull the next priority item from the backlog. So, depending on what product, service, or result the team is delivering, or the benefit being sustained in operations, Scrum, Kanban or Scrumban may work. Select the right tool for the right job!

Thoughts?

RACI: An important tool to manage project outcome and stakeholder expectations

A few years back in a 2-day workshop on organizational strategy to structure, I saw the facilitator came up with the RACI chart and fumble on the RACI explanation confusing “A” in RACI to “Aid.” In a different situation, the vice president of a client management group was referring to giving copyrights to his manager for coming up with the RACI model. Recently, when I saw the RACI matrix for a process map on a sales-to-execution role definition, I saw processes where the same owner was both responsible and accountable and some areas where there was no person was identified as accountable.  The more I am in management, the more I am feeling that key important stakeholders should become trained on fundamentals of project management, such as the tools associated with Project Management, so that they can position the projects for success and even inadvertently don’t derail the projects.

There are several reasons why a RACI chart is required. The most common ones include when the organization is large enough that simple project communication tools alone would not eliminate role ambiguities efficiently controlling costs to the organization. The subtle reason for requiring a RACI becomes essential when the organization is siloed where several members are working on similar tasks creating waste and not making the organization lean. From a project, program, product, & portfolio management perspective, this RACI tool surfaces to the top of managing risks to these strategic initiatives as middle management wonders if they have the authority to implement their job or projects experience schedule slippage, scope creep, cost overrun, and escaped defects.

So, how does this manage strategic initiative from project to portfolio management?  Now that we realize the importance of the tool, let us ground our thoughts here in relating this tool to stakeholder and risk management. Here are my thoughts!

Role	Description	Stakeholder
Responsible	The individual performing an activity.	This person does the work. It may be a developer, tester, data analyst, or network administrator in software development or a project manager in a project.  In the Power-Interest grid, the R members are mapped to the "Keep Informed" (Low Power, High interest) quadrant for the most part.
Accountable	The individual ultimately accountable.	This person is answerable to the management in managing the client and the project’s profitability. An account manager, product manager, project manager, executive sponsor, functional manager are all examples. This person should also use the risk register effectively by mapping the risk owner to the RACI. In the Power-Interest grid, the A members are mapped to the "Manage Closely" (High Power, High interest) quadrant for the most part.
Consulted	The individual required to offer input and contribute to the activity.	This person offers 2-way communication and is a domain expert. This person should hold both “Responsible” and “Accountable” person in check if only they consult. This person alternative risk management techniques like the root cause analysis, force field analysist, and SWIFT (Structured What If Thinking) promoting thoughts that may otherwise be missed impeding flow. May be able to roll up the sleeves to do what these above roles should do. Can take on the roles of Director, Proposition Manager, Business Architect, Project Manager, etc. In the Power-Interest grid, the C members are mapped to the "Keep Satisfied" (High Power, Low interest) quadrant for the most part. But they could also come from any other quadrant.
Informed	The individual that needs to be informed of the decision and its impact.	These are the people that PMBOK calls as stakeholders that can be positively or negatively impacted by the project’s outcome. These stakeholders must be managed so that unnecessary escalation and project derailment does not happen.  The “Informed” is not limited to organizational employees and business units but customers, vendors, partners, and end-users depending upon projects or product’s goals. In the Power-Interest grid, the C members are mapped to the "Monitor Marginally" (Low Power, Low interest) quadrant for the most part. But they could also come from any other quadrant.

Every tool in the Project Management Book of Knowledge is so critical that it has its place in managing the project’s outcome. Understanding its purpose and utilizing it appropriately is critical to any organization’s job. RACI is an important asset to any management to eliminate waste, increase efficiency, and enhance stability.

Now, how do you foresee its use in your organization, business unit, and product or project management? Share your thoughts!

References

Project Management Institute (2013). Project Management Book of Knowledge. Fifth Edition. New Town Square, PA: Project Management Institute.

Value of Product Governance & Portfolio Management in Agile Product Development

In a networking event on effective agile transformation, a question came up from a few learners in terms of the practices of project governance in capital project selection was agile or traditional development practice. The same question manifested differently in a PMI-ACP class I was facilitating where a learner expressed the challenges with not doing some proactive requirements gathering exercise around the extent of data exchange methods from the application service provider as part of the Agile approach to favor customer collaboration over contract negotiation. The learner reasoned that the later negotiations to add these requirements only hurt the organization with increased costs, reduced speed to market, and decreased customer satisfaction and organizational profitability.

There seems to be a common pattern that I think is evolving where practitioners of agile are forgetting the importance of Agile Manifesto. While Agile Manifesto was prohibiting extensive upfront requirements gathering for software product development keeping working software as a measure of progress, the Agile manifesto never eliminated documentation requirements. In fact, the stage-gate approaches promoted by Dr. Robert Cooper from the Product Development Institute (Cohn, 2010) takes product development from discover to post-launch review through the stage gates of idea development, business case development, development, testing, validation, and launch introduces multiple stage gates. Each stage gate becomes a major milestone serving as a go/no-go decision-making point.

A formal product selection criterion, also advanced by Project Management Institute’s Program and Portfolio Management Processes, for the organization to evaluate the key performance indicators to measure the return on investment (ROI) and use financial measures likes Internal Rate of Return (IRR), Net Present Value (NPV), & payback period to evaluate the profit potential, operating expenses, resource requirements is not prohibited by Agile Manifesto. Some product development where specialized expertise is outsourced to be competitive in the market, dependencies on external vendors that handle testing or audit procedures, use of distributed agile teams, or adherence to high quality management practices like CMMI may mandate that the standard operating procedure (SOP) is clearly outlined so that the teams productively work towards product development and are not burning unnecessary cycle times with delays and external dependencies. Not considering these things in advance by using Agile Manifesto as the shield to avoid “Contract Negotiation” or “Comprehensive Documentation” is not the failure of Agile.

Mike Cohn (2010), a pioneering contributor to the Agile Manifesto, recommends that any document or artifact required to achieve compliance be part of the product backlog and use of agile project management tool and practices for products in the regulated industries demanding compliance requirements. In a white paper submitted by Primavera, Oracle (2011) recommends the combination of Agile and Enterprise Project Portfolio Management (PPM) systems mitigates the risk in pharmaceutical and financial services industry (p. 3) increasing visibility of projects, resources, schedules and business value for the entire organization (p. 6).

It is therefore evident that our own understanding of Agile framework’s core principles may have to evolve when we apply agile in different industries. But, putting down project governance, product selection, and product portfolio management techniques as ineffective practices promoted by Agile is choosing to ignore the best practices. It is no wonder that topics of scaling agile are evolving leading to the latest description of Scaled Agile Framework (2013) for implementing scaled lean and hybrid agile framework in enterprises.

References

Cohn, M. (2010). Succeeding with Agile: Software development with Scrum. Boston, MA: Addison Wesley

Description of the Scaled Agile Framework (2013). Retrieved October 26, 2013, from http://scaledagileframework.com/purpose/

Oracle (2011). The Yin and Yang of Enterprise Project Portfolio Management and Agile Software Development: Combining Creativity and Governance. Retrieved October 27, 2013, from http://www.oracle.com/us/products/applications/primavera/primavera-eppm-agile-wp-453028.pdf