My G+ Profile
« October 10, 2002 | Main | October 14, 2002 »
October 11, 2002
Virtuoso Performance as a Measure of Organizational Maturity
Mary Shaw of Carnegie Mellon University talked about "virtuoso performances" in the engineering world about ten years ago in an effort to define what she meant by engineering. The idea is this: engineering is a system of processes and procedures where normal people can perform quality work. Without engineering, you're left to rely on virtuoso performers to accomplish the task. The problem obviously is that there are a lot fewer virtuoso performers that normal folk.
Think of it in terms of building a bridge. Hundreds of years ago, building a bridge was an art practiced by people who did a good job of building bridges but couldn't really tell you how they did it. Now, we can teach almost any bright person (who has a few math skills) how to design a bridge that won't fall down. That is engineering.
As we strive for high availability in our computing services and greater reliability in our process, we will have to build processes that reduce the number heroic measures undertaken by virtuosos. In fact, I think you could measure the virtuoso performances and heroic feats in an organization and come up with a good feel for the organizations maturity: they're inversely proportional.
Organizations with immature processes rely almost exclusively on heroic measures to achieve their goals and keep their customers happy. The problem is that its almost impossible to sustain: there just aren't enough virtuoso performers and they get burnt out. What's worse, organizations come to rely on rewards to the virtuoso performers as a means of trying to solve problems. Mature organizations, on the other hand, reply on processes that allow almost any intelligent person to be trained to deliver excellent results reliably.
I've got nothing against virtuoso performers or rewarding them for their efforts. We need them and their talent. I just think we ask too much when we rely on them to sustain our systems in the face of ad hoc procedures and processes. Its not fair to them and it doesn't keep customers happy.
Ask yourself how many times your organization has relied on heroic measures in the last three months to keep its clients and customers happy. What do you think could be done to change the situation and come to rely on a mature process instead?
01:23 PM | Recommend This | Print This
Digital Identity: Where are the People?
At the conclusion of several days of immersion in the world of digital identity, I would ask the question: where are the people? Here's what I mean:
Most of the companies at Digital ID World don't seem to really care about linking identity to people. That is, they are content to have an identity with the appropriate attributes attached to it. Let me give an example: when you present your credentials to a web site to purchase something, they don't care about the meat attached to that identity, only that it has a proper credit card number and an address to which to ship the goods. The same is true for digital rights management (or, as Doc says: "digital restrictions for monopolies"). Digital rights management is about anything but people.
For most applications, the question of tying identity to people is relegated to a question of security. I want my identity secured, so that only I can use it. That's not an identity problem, its a security problem. Technology like passwords, smart cards, and biometrics are used to protect identities, which comes down to tying the identity to a particular person.
Now, consider some applications where we do want to tie identity to a body. Suppose, for example, that you want to set up a system to serve people with court documents online. Another example would be closing an online mortgage. Most of the examples I can come up with have a legal aspect. We want to tie the identity to a body because later we may need to take that body to court or arrest it on the basis of something that that body did with its identity.
Notice, as an aside, that digital certificates work very well in these kinds of scenarios, as long as the digital certificate has been carefully issued and protected (neither of which are great assumptions).
My most extreme thought in this direction is that the courts, at least criminal ones, are, in the abstract, a system for tying identity to a particular body. If you think of the attributes surrounding a perpetrator as an identity, courts are used to link that identity to a suspect (or body) so that they can be put in jail. Put that way, linking identity to a body is a very time consuming, expensive, and imperfect proposition in many cases.
That leads me to a conclusion that I've stated before: government has to be and will be in the identity business. Governments care more than most about tying identities to bodies than most and will act to ensure that its possible...eventually. Just don't hold your breath.