Richard J. Bocchinfuso

Discussion Post

Discuss how an attacker looks at the system.

Sorry for the late post, having too much fun at the ServiceNow Knowledge18 CreatorCon (ServiceNow, 2018) this week; heads down “hacking” some Javascript and Groovy for the past three days and just coming up for air.

What is a hacker? In the context of this class, at least thus far a “hacker” is probably best defined as a person who uses computers to gain unauthorized access.
In his 2004 essay “The Word ‘Hacker’,” Paul Graham states that the word “‘hacker’ connotes mastery in the most literal sense: someone who can make a computer do what he wants—whether the computer wants to or not.” I much prefer this definition.

Before I begin to dig into this weeks post, I want to say how much I love Open Source and the community, but every now and again I am reminded how important vigilance is. Earlier this week, there was an article about a Python library called “ssh-decorate” luckily I make extensive use of “Paramiko” (Paramiko, 2018) and not ssh-decorate, but I could have just as easily used the “ssh-decorate” library, and my ssh creds could be sitting on some server with a .cf domain. (Cimpanu, 2018)
Open Source has created this model where people (developers like me) grab a library; they grab a Docker container, etc. from the community and they build and roll to production. The backdoors metastasize so quickly because a library like “ssh-decorate” is embedded into millions of applications.

Before I get into the research on how an attacker looks at a system, let me say that I see a system like as the best puzzle game on the planet, one that enraptures me. These puzzles can hold my attention for sleepless days fueled by heavy metal and coffee with the only goal being to solve the puzzle. I consider myself a hacker, a builder, a creator, a developer, an instigator and quite often an agitator. For as long as I can remember I loved taking things apart, learning how they work, making something new from something old and accessing systems which I had no explicit permission to access. I am obsessive (apparently a common trait) and I like to think of myself as a digital explorer and everything from RF hacking to hardware hacking interests me. It’s a great day when you’re sitting on your lawn and have control of your neighbor’s wirelessly controlled devices, like their garage door, car, etc. I like to think of myself as the neighborhood watch, teaching people about the danger that lurks around them. 🙂
If you have never seen an RF hack this is a pretty good video: https://www.youtube.com/watch?v=oGfRAbJ0u0Y
Incredibly easy to execute with the right device, the HackRF One SDR (Software Defined Radio).

Subjectively I believe that hackers regardless of motivation look at systems like a puzzle. Regardless of objectives like financial gain, espionage, FIG (fun, ideology, and grudge), other (errors, glitches, etc.) (calyptix, 2018) I don’t believe a hacker can successfully execute unless their motivation is far more intrinsic, a motivation where the journey is far more interesting than the destination. A McAfee blog (McAfee, 2018) lists seven types of hacker motivations, I agree with these as the motivation for a hack, but I think the motivation of the hacker is far more ubiquitous and foundational. Deep down the separation between a whitehat hacker and blackhat hacker is not that great, one found a legal way to satiate their desire, and one is a bit more mischevious, but the underlying motivation is the same.

In “Understanding the hacker psyche” Steve Gold states that early hackers were motivated by “beating the system”, the next generation of hackers become more destructive and finally the 21st hacker who became cyber-criminals looking for focused on financial gain. (Gold, 2011)

“Hackers have a compulsion to analyze, to explore and to be curious to the point of obsession.” (Kropko, 2015) I agree! This quote conveys who hackers are, and they look at systems as the only puzzle capable of satiating their compulsion.

References

calyptix. (2018, March 19). What Motivates Hackers? Money, Secrets, and Fun. Retrieved March 09, 2018, from https://www.calyptix.com/top-threats/motivates-hackers-money-secrets-fun/

Cimpanu, C. (2018, May 09). Backdoored Python Library Caught Stealing SSH Credentials. Retrieved May 09, 2018, from https://www.bleepingcomputer.com/news/security/backdoored-python-library-caught-stealing-ssh-credentials/

Kropko, M. (2015, April 16). How Hackers Think: Researcher studies the hacker mind | think:blog. Retrieved from http://blog.case.edu/think/2015/04/16/how_hackers_think_researcher_studies_the_hacker_mind

Gold, S. (2011). Understanding the hacker psyche. Network Security, 2011(12), 15-17. doi:10.1016/S1353-4858(11)70130-1

Graham, P. (2004, April). The Word “Hacker”. Retrieved May 09, 2018, from http://www.paulgraham.com/gba.html

McAfee. (2018, March 16). 7 Types of Hacker Motivations. Retrieved May 09, 2018, from https://securingtomorrow.mcafee.com/consumer/family-safety/7-types-of-hacker-motivations/

Paramiko. (2018, April 19). Paramiko/paramiko. Retrieved May 09, 2018, from https://github.com/paramiko/paramiko

ServiceNow. (2018, March 09). Find Your Happy Place At Knowledge18. Retrieved from https://knowledge.servicenow.com/sessions/creator-con.html

Discussion Response 1

I like how you framed the perspective in which an attacker looks at the system, by stating that “an attacker looks at the system through its most vulnerable entry point.”  I think this was a tricky question because of the nuance between how someone looks at something vs. how some sees or perceives something.  I think both perspective and what attacker sees (perception) once the information is processed is are critical details.  I liked your opening because it got me thinking that different attackers will look at the system differently, their perspective and how they see the system will vary based on who they are.  Some attackers may be more adept at social engineering while others prefer writing malware.  Today we think about attackers as human beings, but this may not be the case in the future, with projects like Deephack (https://www.youtube.com/watch?v=wbRx18VZlYA) and other AI-driven attacks frameworks are adopted.  WIth AI the attacker likely looks at the target based on their motivation, like curiosity, criminal activity, etc… and then just targets the AI-driven attack.

Discussion Response 2

I enjoyed reading your post. Do you think the primary motivation of attackers (aka hackers) is malicious intent?  Or do we just tend to only hear about the attackers who have conducted malicious activity?  I suppose the word attacker may imply a blackhat hacker with malicious intent, but I believe that the number of hackers who are more focused on curiosity dwarf the number of hackers with malicious intent.

Maybe the answer here lies in not using the words attacker and hacker synonymously.  Paul Graham’s 2004 essay The Word “Haker” is a great read.  Great innovators have been called hackers, but they attacked nothing more than a problem no one else had or could solve.  Steven Levy’s book “Hackers: Heroes of the Computer Revolution” chronicles hackers such as Bill Gates, Mark Zuckerberg, Richard Stallman and Steve Wozniak.  OK, maybe Zuckerberg attacked our privacy. 🙂

Discussion Response 3

I liked your mention of pre-prod, unit and functional testing.  Based on your description doesn’t sound like you are yet doing continuous delivery and blue-green deployments?  You’ll enjoy this read:  http://blog.christianposta.com/deploy/blue-green-deployments-a-b-testing-and-canary-releases/

Regardless, when it comes to security in a world increasingly dominated by developers (“The New Kingmakers“, another great read) the vulnerabilities are entering the system really early, like this weeks issue you with the ssh-decorate Python library, how many developers were leveraging that library, how many apps were impacted, a lot.

References

Cimpanu, C. (2018, May 09). Backdoored Python Library Caught Stealing SSH Credentials. Retrieved May 09, 2018, from https://www.bleepingcomputer.com/news/security/backdoored-python-library-caught-stealing-ssh-credentials/

Discussion Response 4

Very interesting perspective.  It would be interesting to contrast hacker demographics with drug lord demographics (E.g. – Gary McKinnon vs. Pablo Escobar). I haven’t done the research, but I suspect a comparison of hackers and drug lords night reveal some motivations that might provide some insight into how the wealth created through cybercrime might look different than the wealth created by the drug trade. It is my hypothesis that the primary motivations differ, curiosity being the hallmark of the hacker and survival being the hallmark of the drug lord, again I don’t have the data so just hypothesizing. With that said there’s the case of Kim Dotcom and Mega, which supports your argument. 🙂
Kim Dotcom, The Good Life: https://youtu.be/oDiili2Gs-0

Time will tell, it’s likely that the computing power and human intellect will deliver a combinatorial explosion of both good and evil.  Let’s hope there’s more good than evil.

Discussion Response 5

Sharing – good read based on last weeks strong password discussion
Hacker Kevin Mitnick shows how to bypass 2FA

Hacker Kevin Mitnick shows how to bypass 2FA

Essay Assignment

What are the vulnerabilities in the boot process? What can an attacker exploit?

[google-drive-embed url=”https://docs.google.com/document/d/1BX5ki_Yx06w_OmGfr0WQIMywXShzeZ3ucf9C0x464AY/preview?usp=drivesdk” title=”Bocchinfuso – FIT – MGT5156 – Week 2 – Assignment 1″ icon=”https://drive-thirdparty.googleusercontent.com/16/type/application/vnd.google-apps.document” width=”100%” height=”400″ style=”embed”]

Boot Process Module Assignment

[google-drive-embed url=”https://docs.google.com/document/d/1RAwapIthRL__Pv_dglQmq-4kKvJymzoAbN5PS-j3mYs/preview?usp=drivesdk” title=”Bocchinfuso – FIT – MGT5156 – Week 2 – Assignment 2″ icon=”https://drive-thirdparty.googleusercontent.com/16/type/application/vnd.google-apps.document” width=”100%” height=”400″ style=”embed”]

Discussion Post

What are the implications of Shannon’s work on security?

Claude E. Shannon is referred to as the founder of information theory, a scientist responsible for classical information theory. Shannon’s paper focuses on communication referencing PCM (pulse code modulation) and PPM (pulse position modulation). In the paper, Shannon explores topics which we are all familiar with today, topics such as bandwidth and SNR (signal-to-noise ratio).

When people think about digital security in today’s world they then to think about internet security, internet security is really about the protocols, operating systems, and applications which make up the internet. As I looked at Fig. 1 – Schematic diagram of a general communication system (Shannon, 2001, p. 4), I couldn’t help but think about TCP/IP and a simple topological representation as [HOST] <-> [ROUTER] <-> [ROUTER] <-> [HOST].

All the constructs that Shannon discusses in his 1948 paper, like source and destination (host), the transmitter (router, switch, etc…), and channel (wireless TDMA, CDMA, GSM, 802.11, etc…) all still exist and continue to evolve. Shannon talks about the messages having meaning and being correlated to some system (Shannon, 2001, p. 1), TCP/IP are the protocols that run the internet, moving information using packets. These packets are given meaning using IP (Internet Protocol) header information which contains detail about the source and destination, and a TCP (Transmission Control Protocol) header which includes information that allows data to be segmented, delivered out-of-order and reassembled. This TCP/IP header information is what allows the payload (the actual data we care about) to move between source and destination.

We can surmise that Shannon’s work had a significant impact on the TCP/IP protocols that interconnect us all today. When Bob Kahn and Vint Cert wrote the paper “A Protocol for Packet Network Intercommunication” (Cerf & Kahn, 1974) in 1974, defining the protocols that would become the platform from which the internet would blossom their concepts for a packet communication network were likely rooted in the work of Shannon.

In 1945 Shannon wrote a paper entitled “A Mathematical Theory of Cryptography.” (Shannon, 1945). This paper pre-dates “A mathematical theory of communication” by four years, the cryptography paper was initially a classified document, downgraded three years later, an abridged version was published and followed by the publication of the full article after being declassified twelve years later. Shannon’s paper on cryptography introduces an unbreakable a key-based encryption scheme known as “The Vernam Cipher”. Key-based encryption (“plaintext + key = ciphertext ⇒ ciphertext + key = plaintext”) is widely used today to encrypt and decrypt data at the source and destination, ensuring it’s confidentiality and integrity while in-flight on public networks like the internet. Cryptography is pervasive, from simple applications like MD5 hashing binaries to guarantee their integrity, to PGP public and private key encryption to SSL encryption (What is SSL, TLS and HTTPS?, n.d.). With 3.9 billion (Internet Users, n.d.) people on the internet and pervasive use of SSL and HTTPS, it’s fair to say that > 50% of the world population has benefited from Shannon’s work on communications and security.

References

Cerf, V., & Kahn, R. (1974). A protocol for packet network intercommunication. IEEE Transactions on Communications, 22(5), 637-648. doi:10.1109/TCOM.1974.1092259

Collins, G. P. (2002, October 14). Claude E. Shannon: Founder of Information Theory. Retrieved May 02, 2018, from https://www.scientificamerican.com/article/claude-e-shannon-founder/

Internet Users. (n.d.). Retrieved May 2, 2018, from http://www.internetlivestats.com/internet-users/

PGP, Public and Private Keys, and How PGP Encryption Works. (n.d.). Retrieved May 02, 2018, from http://accc.uic.edu/service/pgp/how-encryption-works

Shannon, C. (2001). A mathematical theory of communication. ACM SIGMOBILE Mobile Computing and Communications Review, 5(1), 3-55. doi:10.1145/584091.584093

Shannon, C. E. (1945). A Mathematical Theory of Cryptography – Case 20878. Alcatel-Lucent. Retrieved from https://www.iacr.org/museum/shannon/shannon45.pdf

The Vernam Cipher. (n.d.). Retrieved May 02, 2018, from http://www.cryptomuseum.com/crypto/vernam.htm

What is SSL, TLS and HTTPS? (n.d.). Retrieved May 02, 2018, from https://www.websecurity.symantec.com/security-topics/what-is-ssl-tls-https

Discussion Response 1

The computational power of RISC based processors like GPUs, TPUs, FPGAs and other ASICs being applied to password cracking has changed the game. Massive hacks and the dictionaries of passwords which have been aggregated and shared all over the internet as a result (e.g., https://wiki.skullsecurity.org/Passwords) along with available and accessible computational power to conduct brute-force attacks has made even strong passwords vulnerable. A 12 character alphanumeric with special characters password is not as hard to crack as many people think (http://www.netmux.com/blog/cracking-12-character-above-passwords). Provision a boatload of GPU capacity from AWS for a week and you would be surprised by the number of hashes per second you can churn out.

Then there is the application of deep learning to hacking. Projects like deephack (https://www.youtube.com/watch?v=Ybyg8WL0F4o) are starting to apply algorithmic thinking and build neural networks to hack systems.

Here is a little demo I put in this weeks assignment, where I used hashcat (https://hashcat.net/hashcat/) to crack five MD5 hashed passwords: https://asciinema.org/a/R4XnaVL0hKPLLrdF04NGQaO0p

Depending on your perspective I may seem like the only crazy person with a 6 x GPU machine. My wife would live if I only hade a single 6 x GPU rig, but the rig I used for the password crack is one of my four GPU rigs. The applicability of GPUs to cryptocurrency mining and machine learning have lots of people with lots of GPU power available either on their rigs or in the cloud.
I ran the password crack demo in the video above on my latest build which I am doing burn-in on in my home office before being added to the farm: https://photos.app.goo.gl/dKKWgB2pENIbTIm33
The interesting part about building GPU rigs for machine learning, mining, password cracking, etc… requires some caution because they pull a lot of power, the components get hot, and many of them are sourced by people like me direct from low-cost component manufacturers. Without exercising caution, you can have a meltdown aka a fire.

Strong passwords are good, but I would highly encourage the use of multi-factor authentication.

Discussion Response 2

Ahhhhh… Analog, my younger years as a phone phreak with my TRS-80 and acoustic coupler were the best. 🙂  Long live John Draper aka Cap’n Crunch.
The blue box and black box were a thing of beauty, enable by the simplicity of the analog system.  Let’s face it if you were online in the early 80s and knew how to build a black box you built one because who could afford all those local exchange costs, let alone long distance costs.  Then you had the device (don’t remember what it was called but I remember building it and putting inline between the modem and the wall jack) which ran the analog line through a potentiometer, some resistors and capacitors to clean up the line for you 110 baud acoustic coupler to give you a little more bandwidth, the good old days.
To this day I am still a loyal subscriber to 2600 Magazine and lister of Offf The Hook, I’ve even hit some clandestine 2600 meetups in faraway lands, that’s a treat.

If you are into some leisure (true story) reading about this era I suggest a book called “Ghost in the Wires: My Adventures as the World’s Most Wanted Hacker”.
And of course, you have to get yourself a “Free Kevin” t-shirt. 🙂

Terminology Module Assignment

[google-drive-embed url=”https://docs.google.com/document/d/1pKPwMQ5lpFAaJBq2D_mxz18CNaZDFf5tFKJQ5_E5GVQ/preview?usp=drivesdk” title=”Bocchinfuso – FIT – MGT5156 – Week 1 – Assignment 1″ icon=”https://drive-thirdparty.googleusercontent.com/16/type/application/vnd.google-apps.document” width=”100%” height=”400″ style=”embed”]

Grade: 100%

Discussion Post

Please post at least three (3) issues which you have learned or are taking away from this course.

Culture, culture, culture. I have always believed that “fit” is critical. The coursework helped me to formulate more in-depth thoughts on this topic. Focusing on creating a “best-fit” scenario always has been and will continue to be a focus of mine. In all honesty, I am struggling with the juxtaposition of Simon Sinek’s idea that conveys the organization as a family where leadership is like parenting (Sinek, n.d.) vs. Reed Hastings view of an organization as a professional sports team (Hastings, 2009, p. 24). These are concepts I have been thinking about a lot, and I suspect it is something that I will continue to think about for a very long time. My thought after reviewing the Netflix culture deck in the context of parenting, is that Reed Hastings believes in tough love, he parents, but does it from a place of very high expectations.

Bolster and protect the culture with best-fit scenarios (Robbins & Judge, 2018 p. 81). Use scientific tools like the Myers-Briggs Type Indicator (MBTI) or other personality-assessment instruments, as well as discussions with peers and management to assess prospective candidates and better the probability of a best-fit scenario.

Motivation. Understanding motivation is critical to creating high-performance cultures. I experienced a deep sense of personal enlightenment Herzberg’s Motivation-Hygiene (Two-Factor) Theory (Robbins & Judge, 2018, p. 102), I loved the correlation between influencers (hygiene factors) and sentiment. I am big on sentiment analysis, I love using big data and machine learning to determine sentiment so this really appealed to me.  I have quoted McClelland’s statement “that high achievers perform best when they perceive the probability of success to be 50/50”. (Robbins & Judge, 2018 p. 103) at least ten times already.

It should be no secret at this point that I love the “RSA ANIMATE: Drive: The surprising truth about what motivates us” video and pretty much anything authored by Simon Sinek.

Communication. I related to the idea of an organization as communication. This concept made sense to me because I believe my ability to communicate and the ability for people to communicate with each other is what shapes an organization. The organization is just a manifestation of how we communicate with each other, how communication shapes the culture and how people perceive the organization. Our ability to effectively communicate will have a profound impact on our organization’s culture, successes, and failures.

References

Hastings, R. (2009, August 01). Culture. Retrieved March 18, 2018, from https://www.slideshare.net/reed2001/culture-1798664

Koschmann, M. (2012, May 08). What is Organizational Communication? Retrieved April 15, 2018, from https://youtu.be/e5oXygLGMuY

Robbins, S. P., & Judge, T. (2018). Essentials of organizational behavior. New York, NY: Pearson.

RSA ANIMATE: Drive: The surprising truth about what motivates us. (2010, April 01). Retrieved March 16, 2018, from https://youtu.be/u6XAPnuFjJc

Sinek, S. (n.d.). Why good leaders make you feel safe. Retrieved April 27, 2018, from https://www.ted.com/talks/simon_sinek_why_good_leaders_make_you_feel_safe

Discussion Post

Considering the art and science of leadership, how have the readings, lectures, and discussions in this course better prepared you for the role of a leader vs. a manager? 

Classmates, sorry for my late post this week, I was in Ireland all week.  It was a busy week, further complicated by the timezone delta and a seemingly endless flow of Guinness. I know, poor me. 🙂  Spent the week in Naas, Ireland working most of the time, but did have some time to hit the Punchestown festival and enjoy some horse racing and Guinness, lots of Guinness.  If you have never seen horse racing in Ireland, it’s very different than the flat track races we are used to in the United State.
Video (click on the video for sound):  https://photos.app.goo.gl/W94B8VQVQP7udXQCA
Photo of me trackside: https://photos.app.goo.gl/ogadFoFg6oM1WGDL8

What I learned is that I have a real interest in both the art and science of leadership. I was familiar with many of the concepts presented in the class, but the level of research which I had to undertake during the course certainly provided me with a deeper understanding of the science. The coursework and research even led me to do some leadership leisure reading. For instance, I read the book “Leadership is hell: How to manage well – and escape with your soul” which was referenced somewhere along the way in my research.  Not only did I enjoy the book, I felt like it helped me better understand a few people who I manage. In particular, this excerpt from the book shed light on a situation I have been dealing with for years.

“If you’re a people-pleaser, you’ll find it impossible to be content merely expressing yourself. You won’t even know what that looks like. You’ve been too busy sensing what would impress other people, then seeking to do that to the exclusion of everything else.” (Asghar, 2014, Kindle Locations 1430-1432)

I plan to leverage some of my new found knowledge to try to better coach the individuals who I believe are afflicted by the people-pleaser scenario above and my hope is that I will be able to help them elevate themselves.

I try to spend my life in a state of objective reality, rather than subjective reality. Not being subjective is something I have to consciously focus on because I am a passionate and committed person and I often expect others to see things my way, and when they don’t, I become very frustrated. I like to believe I have a vision, and that my execution strategy supports this vision. What I have learned about myself over the years is that I have a tendency to expect others to see my vision as clearly as I do, to execute with the same motivations and rigor that I do and this is often not the case. I have always believed that leadership is a way of life, it’s not something that you do from 9 to 5, leaders don’t get time off from the principles and actions that make them leaders. Leaders always “eat last” (Sinek, n.d.), there is no time when a leader can eat first. I enjoyed the topics which focused on job satisfaction, motivation, values and culture, other sections of the course were interesting, but I find these things intrinsically linked.

As a manager, I feel better armed to live my personal goal of objective reality. I have always been anti-negotiation, feeling that negotiation was always a short-term fix, there are still situations where I think this way, but I also recognize that negotiation can be a way to motivate, it’s doesn’t always have to threaten the culture. As a result of things I have learned in this class, I recognize how important fit is, I am more committed to the value of culture, and I realize that I need work on better understanding the motivations of other and increase my focus on communication because communication is what shapes the organization. I now realize that many of my frustrations probably come from a lack of communication, expectations I have which have not been communicated, motivations I possess which are driven by a vision, but I have not effectively communicated my vision to others yet place expectations on them. Improving communication is probably my biggest takeaway.

References

Asghar, R. (2014). Leadership is hell: How to manage well – and escape with your soul. Los Angeles, CA: Figueroa Press.

Sinek, S. (n.d.). Why good leaders make you feel safe. Retrieved April 27, 2018, from https://www.ted.com/talks/simon_sinek_why_good_leaders_make_you_feel_safe

Research Consultant Paper

This research paper allows you to showcase what you have learned from the course and the application within an organization of your choice. Also, it a chance to use theories gained from the course work and how to apply these to an organization to improve effectiveness.

You are to consider yourself a consultant that was just hired by organizational (does not matter if it is nonprofit or public) leadership to assist with a lingering problem that has impacted the organization’s effectiveness. This problem can be related to an area that you want to research and interests you; i.e., employees upset over anticipated change, performance evaluations being over-inflated, unethical practices, leadership not considering personal choices in the decision-making process, or any other similar type problems. Once you identify the organizational problem, you should develop a plan to address the problem, identify reasons why you feel the problem occurred, label reasons you feel the problem is persistent, and develop a means to overcome the problem. Also, integrate a long-term plan to ensure this problem does not happen again or at least is minimized.

You should consider all the main topics, readings, and discussions you have encountered throughout the course. This paper is a critical part of the class and should not be last minute developed.

[google-drive-embed url=”https://drive.google.com/file/d/1J0JbR8EHuQCqVhO7dtdx_KNcpCpOOPSl/preview?usp=drivesdk” title=”Bocchinfuso_FIT-MGT5013-Week7_Research-Paper_20180422.pdf” icon=”https://drive-thirdparty.googleusercontent.com/16/type/application/pdf” width=”100%” height=”400″ style=”embed”]

Grade: 98%

Discussion Post

Define organizational culture and ways culture can be transmitted to employees? What are the various way it can be displayed? Discuss and provide examples for each. Considering an organization you know well, have any of these examples surfaced as more important than the others?

The text defines organizational culture as the system of shared meaning held by members that distinguish the organization from other organizations. (Robbins & Judge, 2018, p. 266) This definition strikes me as a bit ethereal.

I like the definition of organizational behavior as “a pattern of basic assumptions—invented, discovered, or developed by a given group as it learns to cope with its problems of external adaptation and internal integration—that has worked well enough to be considered … the correct way to perceive, think, and feel in relation to those problems.” (Martinez, Beaulieu, Gibbons, Pronovost & Wang, 2015, p. 1)

This week I visited a customer, I won’t mention their name (at least not yet), but a picture (https://photos.app.goo.gl/ZsStfaEFkYXXJmH93) from my visit might be a good indicator. If you still have no idea, hint, the company is the most popular gaming company in the world at the moment, packing stadiums around the globe for Esports events. The company has an incredibly strong culture and identity, employees are proud of the culture, and they shepherd it, they are players above all else. One of the things they outlined was an organizational culture expectation; they like many other high-performing cultures have a mindset that places an employee fit and aptitude over discrete skill and the ability to execute.

A quick look at the Amazon Leadership principles reveals things like “Customer Obsession,” “Invent and Simplify,” “Are Right, A Lot,” “Learn and Be Curious,” “Hire and Develop the Best,” “Insist on the Highest Standards,” and “Think Big.” (Amazon’s global career site, n.d.)  Amazon’s culture is everywhere from the published leadership principles tot he domain name relentless.com which Bezos’ registered in the early days as a potential name for the company before deciding on amazon.com.  relentless.com continues to live on as an important aspect of the Amazon story and redirect to amazon.com, but most of all it represents a something known by few about Amazon’s organizational climate.

The well documented NetFlix culture will reveal principles like “People over Process,” “Freedom & Responsibility,” “High Performance,” “Context, not Control,” “Highly Aligned, Loosely Coupled,” and “Promotions & Development.” These principles are guided by values like judgment, communication, impact, curiosity, innovation, courage, passion, honesty, and selflessness. (Culture At Netflix | Netflix Jobs, n.d.)

The company I visited earlier this week defines the culture in a manifesto which has five tenents: “Player Experience First,” “Challenge Convention,” “Focus on Talent and Team,” “Take Play Seriously,” and “Stay Hungry; Stay Humble.” (Who We Are, n.d.)

I love what Reed Hastings says about values “Values are what we Value” (Hastings, 2009, p. 4) and what we value is, in my opinion, is a big determining factor of the organizational climate. (Robbins & Judge, 2018, p. 269)

People are the culture, values define the culture, and if the people do not buy into the values, then the culture begins to become fractured and weak.

The common thread you will find across all these cultures is they protect the culture, and they have a maniacal focus on hiring for fit. Each of these organizations has a rigorous interview process designed to protect the culture.  They all gate the hiring process in one way or another to ensure a cultural best-fit situation.

Amazon uses the “bar-raiser” to gate the hiring process. (Steward, 2016) It is the job of the bar raiser to protect Amazon strong culture, ensuring that Amazon’s core values will be “intensely held and widely shared.” (Robbins & Judge, 2018, p. 268)

NetFlix and Riot Games are not bashful about stating that they have different requirements for contractors vs. employees. Contractors can be incredible executors, they may have a work specialization (Robbins & Judge, 2018, p. 246 – 247) that makes them highly effective within a specific domain, but maybe they don’t possess the intangibles that would allow them to make them a cultural fit. In Netflix’s case this would be “Freedom & Responsibility,” in Amazon’s case maybe this is “Think Big” and in Riot Games case maybe your not a gamer and you can’t be a Rioter because can never embody “Player First.” Netflix and many others are overt in stating that they hold salaried, hourly and contract employees to different standards.

Organizational culture is actively on display and transmitted to employees in a myriad of ways. The organizations I mentioned above intently focus on hiring stewards of their culture, who believe deeply and passionately the values and mission of their respective organizations which makes them cultural evangelists. Riot Games being a gaming company has an immersive cultural experience. An aerial view of Riot Games campus in West Lost Angeles will reveal that it is laid out like the League of Legends game board, each area of the office is named and themed like an area (city-state) within the game, and conference rooms are named after characters from the game. Rioters play LoL in a PC Bang; this is where players in South Korea play the game and if you know anything about gaming you know South Korea is the mecca of gaming. I love this line from their website “…creative people making cool shit faster than a Hadron Collider that’s been chugging energy drinks all day. We think you’ll prolly like it, too.” (The New L.A. Campus, n.d.)

More and more I think we see immersive examples of organizational culture. The Riot Games example was fresh in my mind because I spent time there this week, but there are plenty of other examples like the Lamborghini that sits in Alibaba’s lobby in Hangzhou, China. Two men sourced all the parts for the Lamborghini through Alibaba and assembled the car over a one year period just to prove you could buy anything on Alibaba’s massive online marketplace, and now the car sits in the lobby of Alibaba’s corporate headquarters. (Soper, 2015)

References

Amazon’s global career site. (n.d.). Retrieved April 20, 2018, from https://www.amazon.jobs/principles

Culture At Netflix | Netflix Jobs. (n.d.). Retrieved April 20, 2018, from https://jobs.netflix.com/culture

Hastings, R. (2009, August 01). Culture. Retrieved April 20, 2018, from https://www.slideshare.net/reed2001/culture-1798664

Martinez, E. A., Beaulieu, N., Gibbons, R., Pronovost, P., & Wang, T. (2015). Organizational culture and performance. The American Economic Review, 105(5), 331-335. doi:10.1257/aer.p20151001

Robbins, S. P., & Judge, T. (2018). Essentials of organizational behavior. New York, NY: Pearson.

Soper, T. (2015, November 11). Inside Alibaba: Photos from the Chinese technology giant’s headquarters. Retrieved from https://www.geekwire.com/2015/inside-alibaba-photos-from-the-chinese-technology-giants-headquarters/

Steward, A. (2016, October 27). Former Amazon ‘bar raiser’ offers insight into hiring process: What job seekers, companies can learn. Retrieved April 20, 2018, from https://www.bizjournals.com/seattle/blog/techflash/2016/10/former-amazon-bar-raiser-offers-insight-into.html

The New L.A. Campus. (n.d.). Retrieved from https://www.riotgames.com/en/work-with-us/offices/los-angeles/the-new-la-campus

Who We Are. (n.d.). Retrieved April 20, 2018, from https://www.riotgames.com/en/who-we-are

Response Post

Scott, insightful and personalized read as usual. I remember being nineteen and joining a fraternity, learning to say the Greek Alphabet with my pledge brothers, forward, backward and in unison before the match stick which was held upside down burned your fingers was not an easy task, but the idea was to be one. The question always was “how many pledges are there?” The answer was always, “one.” Well, not always because when you said 27 the brother who asked the question would say no “one” and when you said “one” the brother who asked the question would say “can’t you count, there is 27 of you”. Anyway, the entire overarching theme was to assimilate you. During hell week we would have an event called jell-o night, where all the pledges would march to the cafeteria at 4 PM (when it opened). Anyone who has ever been to a cafeteria knows they never run out of jell-o, pudding, cottage cheese and whatever else they put in that area of the buffet (been a while), but hey I was nineteen. The idea was that pledge number 27 would eat first, as much as they could in X amount of time, then pledge 26, etc… etc… The idea was you didn’t want to leave the anchor with all the work. I was the treasurer, so I ate 3rd to last and a guy named Brett, he was a beast, was the president of my pledge class and well deserving because over twelve weeks I watched that guy suck up so much slack in support of others, a true leader. Simon Sinek says “leaders eat last” and this guy ate last for twelve weeks and he ate his share, and the share everyone else couldn’t eat, he put the best interest of others above his interest, because his interest was the success of the team, this is leadership.

When asked by people who didn’t know me at 19, who are usually shocked that I was in a fraternity if I would do it again my answer is, absolutely. It’s not the military, for sure, but I did develop a bond with those 27 guys, we struggled together, and we succeeded or failed together without exception. The strong picked up the slack for the weak and everyone had their opportunity to pull their weight in different areas. Getting through without teamwork wasn’t an option and looking a back on it, while there were some crazy and stupid things that were done, there were a few valuable lessons I walked away with.

Side note I have an uncle who is an enlisted veteran with 37 years in the Marine Corp with a rank of Sergeant Major, he’s a pretty hardcore individual. He’s been out now for quite a few years, and he struggled to assimilate into civilian life, so he did what felt natural, went to work as a civilian contractor at Camp Lejeune. 🙂

Probably a topic for a different forum (like around the fire with a six pack), but cultures with extreme assimilation typically aren’t very good at adapting to diversity. With a world that is becoming increasingly diverse, I wonder how these cultures will adapt, feels like we are only at the beginning.

Discussion Post

“Organizational structure defines how job tasks are formally divided, grouped, and coordinated.” (Robbins & Judge, 2018, p. 246) There are seven key factors which influence organizational structure:

Work Specialization: The division of activities into small, distinct, specialized tasks. The assembly line is an ideal example of work specialization, where a worker performs a specialized and repetitive task. (Robbins & Judge, 2018, p. 246 – 247) The text provides the auto assembly line example; another example would be an Amazon warehouse packer who repeatedly packs boxes.

Departmentalization: Groupings of jobs by function, product or service, geography or process. Functional departmentalization would include grouping by departments like sales, human resources, engineering, etc… Grouping by geography would be something like sales regions. (Robbins & Judge, 2018, p. 247 – 248) I’ll stick with the Amazon example, well Whole Foods. Whole Foods stores stock different items based on regionalization; this is an example of departmentalization by geography or territory. Departmentalizing by geography allows Whole Foods to make decisions within a region that appeals to the preferences of consumers with a region.

Chain of Command: The flow of ascribed authority within an organization. (Robbins & Judge, 2018, p. 248 – 249) Chain of command naturally or unnaturally organizes the reporting structure of an organization; superiors direct the work of subordinates and subordinates execute the work at the direction of their superiors. Chain of command created a clear demarcation between those creating direction and those executing tasks.

Span of Control: The number of subordinates a superior can manage, or I’ll say the number of mentees a mentor can mentor. Flat organizations tend to have few managers with a larger span of control while hierarchical organizations tend to have a narrower span of control. (Robbins & Judge, 2018, p. 249 – 250) Both models have pluses and minuses. I prefer a flat organization where management’s has a larger span of control, but there are cases where a narrower span of control is required. I believe that when a narrow span of control is needed a hierarchal structure with additional management is not always required, the mentor and mentee approach with team leads can be an effective way to maintain a flat organizational structure while addressing the need for a narrower span of control.

Centralization and Decentralization: Where power resides in the organization and how decisions are made. (Robbins & Judge, 2018, p. 250 – 251) I think forms of governments provide an excellent example of this. I grew up in Pennsylvania, and as young adult things auto registration and driver license issuance had to be couriered by a private sector company (Best Auto Tag is the one I remember) to Harrisburg, PA, this was the pinnacle of inefficiency. When I moved to New Jersey, I thought the decentralized DMV, where each county had a DMV and could issue auto tags and licenses were incredible and efficient. It’s all relative, who likes the DMV, but after living the centralized Pennsylvania system, New Jersey was a dream.

Formalization: How standardized and rigid is the job role? (Robbins & Judge, 2018, p. 251) A highly formalized job means the position is standardized and the employee is given no latitude to make subjective or objective decisions. Formalization values the job over the individual, execution of the standardized process is valued over innovation and free thought.

Boundry Spanning: The crossover of an individual or individuals between organizational groups. (Robbins & Judge, 2018, p. 251 – 252) Cross-functional teams are often assembled to ensure that initiatives which impact the entire organization, consider critical stakeholders and are positioned for adoption and success by the broader organization. An example of this is an ERP system roll-out. Because an ERP system will impact every group within the organization the assembly of a cross-functional team consisting of representatives from finance, sales, engineering, HR and IT would be an approach to encourage interaction, develop cross-functional consensus, define product requirements and prioritize initiatives. These individuals then become subject matter experts and evangelists within their respective organization and increase the probability of success of the project.

The factors discussed above are the influencers of organizational structure. By mapping adherence to the seven factors, an organization can be classified as having specific structure types, such as simple structure, a bureaucracy or a matrix structure.

As I researched the factors which influence organizational structure I was intrigued by a peer-reviewed article which discussed the impact of work specialization and departmentalization on job satisfaction. Not hard to see the benefits and drawbacks of job specialization, while small, simple tasks may increase proficiency and lower training costs the finite nature of the job can lead to boredom, job dissatisfaction, which can result in absenteeism and low-quality deliverables. The article also drew a correlation between departmentalization and chain of command, stating that functional departmentalization provided a clear reporting structure, while this seems apparent it highlights that while there are seven factors, they are entwined in such a way that one dominant factor is likely to influence other factors. (Adeyoyin, Agbeze-Unazi, Oyewunmi, Adegun & Ayodele, 2015)

References

Adeyoyin, S. O., Agbeze-Unazi, F., Oyewunmi, O. O., Adegun, A. I., & Ayodele, R. O. (2015). Effects of job specialization and departmentalization on job satisfaction among the staff of a nigerian university library. Library Philosophy and Practice, , 1.

Robbins, S. P., & Judge, T. (2018). Essentials of organizational behavior. New York, NY: Pearson.

Response Post

Logan, good explanation of each organizational structure. I’ve seen organizations use a combination of structures, where one division of the organization might be bureaucracy while another follows a matrix structure. One of my first jobs was in big pharma, and the organization was split into two major groups, corporate and R&D. The corporate side of the business was a bureaucracy, and the R&D side of the business was a much flatter matrix structure. These model make sense when you think about the flow of the drug pipeline, the R&D (drug discovery) business is comprised of researchers looking for compounds that will attack viruses, bacteria, diseases, etc., this area of the organization favors velocity and innovation with a fail fast mentality. Once a compound shows promise it moves to drug development, still in R&D but rules get a little tighter as they convert the drug from a compound into a drug (a pill) they can send to the corporate side of the business for clinical trials. Once the drug moves into clinical trials the bureaucracy kicks in, the focus is now on standardization, methodology, and documentation, if the drug passes clinical trials, then it’s on to FDA submissions and if the documentation is not pristine all the dollars invested in the previous phases could be lost.

Both of these models make sense in the context I described above, overall though pharmaceutical companies are bureaucracies, and from what I understand this has gotten worse in the twenty years I have out of this business.

I have heard the argument the text outlines between the production manager, R&D manager, marketing executive and the accounting manager more than a few times. (Robbins & Judge, 2018, p. 253)

References

Robbins, S. P., & Judge, T. (2018). Essentials of organizational behavior. New York, NY: Pearson.

Case Study II (Organizational Communication)

This is an opportunity for you to apply what you have learned in the course, readings, discussions, and personal experiences into a well-developed analysis. There is no specific right or wrong answer with these cases, just a means to demonstrate your mastery of the knowledge.

Review the video in this week What is Organizational Communication? and consider the various details associated with the theories they support. After examining all the data, consider an organization you know well and implement some of these ideas to increase the communication process within your organization. Consider how the organizational culture impacts these, how receptive leadership will be, and how employees will accept these changes.

[google-drive-embed url=”https://drive.google.com/file/d/1FZYDpmetmZieyrl_Sqtbt6i8Td98HC0-/preview?usp=drivesdk” title=”Bocchinfuso_FIT-MGT5013-Week6-Assignment_CS2_20180415.pdf” icon=”https://drive-thirdparty.googleusercontent.com/16/type/application/pdf” width=”100%” height=”400″ style=”embed”]

Grade: 97%

Discussion Post

Analyzing an organization you know well, observe the negotiations that take place around you at work. Focus on one negotiation that appears typical for your organization. Utilizing the terms and concepts from this chapter, describe your assessment of the effectiveness of both negotiators, their negotiating styles, and provide suggestions for improvement of each person’s negotiation skills, as well as negotiation steps used. Provide an example to illustrate your answer. Do not use real names of individuals within your organization.

Life is one giant negotiation! At least my life seems to be. 🙂 I spend my days negotiating internally within my organization, externally with customers and prospects, with my children, etc… I wrote a blog (Bocchinfuso, 2017, http://bit.ly/2vbmhDZ) last year on how I leverage empirical data and analytics to aid in decisions and negotiations I face every day, the negotiation of how to keep various stakeholders satisfied knowing that my time is finite and the motivation of stakeholders is often self-serving.  Regardless of the stakeholder’s motivation for me to meet my objectives, I can’t afford to alienate them, I have to manage them, and this requires negotiation. The more educated I am on the topic (preparation and planning), the stronger my platform and reasoning become and my negotiating position improves (my ability to define ground rules rooted in empirical data, my analysis, and justification). I like to use the data to support my position in a negotiation, in negotiations I tend to avoid subjective opinion and focus on objective fact.  I have a process which aligns perfectly with the negotiation process depicted in by exhibit 14-6 in the text. (Robbins & Judge, 2018, p. 237)

A couple of negotiations I am involved in daily include:

• Pricing negotiations, this is a simple one, I inform the other parties involved in the negotiation of the “Triple Constraint” rule.  “The Triple Constraint says that cost is a function of scope and time or that cost, time and scope are related so that if one changes, then another must also change in a defined and predictable way.” (Baratta, 2006) I expanded on the traditional triple constraint rule by explaining “The Value Triple Constraint” which introduces the idea of value provided.  For instance, while reducing scope and delivery time might imply a lower cost, the value delivered may still be high and the cost reduction may not be linear or not exist at all. (Baratta, 2006)
• Opportunity cost negotiations, this is a tough one, but with stakeholders regularly focused on their objectives which often are tactical initiatives it can be a challenge to metric the opportunity cost of changing direction to focus on the tactical at the expense of the strategic.  Staying focused takes a strong will and a belief that the strategy will deliver a more significant outcome than the immediate gratification of engaging in tactical tasks, this is not without risks which need to be absorbed by a leader. There is also an aspect of negotiation here which calls for influence, the more a leader can inspire others to see the vision the more they can focus on execution rather than negotiation.

So often negotiations can personify the exchange influence tactic, where the negation becomes all about a quid pro quo.  I promise X if you deliver Y, “ll gladly pay you Tuesday for a hamburger today” (J. Wellington Wimpy), I’ll wash your back if you wash mine, etc…  I have a general rule, I don’t negotiate to a place where the relationship is no longer logical of mutually beneficial, consistent and sustained transparency and always doing what I say (flawless execution of closure and implementation) are my best friend. (Robbins & Judge, 2018, p. 237) I know the car dealer needs to make money, I know that they are not selling me the car “below their cost”, it’s a blatant misrepresentation of the facts because the car dealer would be out of business.  The goal of negotiation should be for both people to leave happier than they were before they entered into the negotiation. The text mentions that balancing ethics and the velocity with which an agreement is reached is essential. I agree, the values of an organization should always be in the forefront, concessions which disrupt these values may satiate a tactical need, but strategically they disrupt the entire organization. Distributive bargaining, in my experience, delivers perceived wins, but the intelligent loser in these situations knows they have a short-term issue that needs to be solved, but once the issue is addressed the astute loser will look to address the situation, long-term this is often a loss for the supposed winner. (Robbins & Judge, 2018, p. 235)  Personally, I don’t believe in distributive bargaining; it’s a surface level win/loss scenario, there is always an unrealized loss to the so-called winner. For example, horrible customer service because there’s a note on your service record at the car dealer that you extracted every last dollar during the purchase of the vehicle. We live in the information age, every decision you make, every tweet you tweet impacts how others interact with you, these are facts. Furthermore, who knows what the “fixed pie” (Robbins & Judge, 2018, p. 236) is, car dealers have volume discounts, they have dealership incentives, etc… the same car from two different dealers can have wildly different margin profiles. Apply “The Value Triple Constraint” and the equation “value = f(scope, capability” and the perspective on a car purchase negotiation changes. Sticking with the car dealer example, which is a good negotiation use case, I think traditionally the model has looked like this:

• consumer <–> distributive bargaining <–> auto dealer <–> integrative bargaining <–> manufacturer

But the information age has changed this; individuals place more value on the relationship, they want a fair price, the ease of comparison shopping has caused market consolidation, errored margins, and created value proposition parity.  I believe the more and more people are interested in integrative bargaining. The text outlines that integrative bargaining is preferred because it builds long-term relationships (Robbins & Judge, 2018, p. 237), I think that today more than ever organization and individuals are looking for a balance that satisfies the organizational needs and the needs of the individuals who make up this organization.  This complex balance has moved us towards an integrative bargaining model, it’s not to say that distributive bargaining doesn’t happen, it does, but it rarely delivers long-term sustainable results and desired outcomes.

References

Bocchinfuso, R. (2017, August 31). I’m a skeptic, satiated by large raw data sets, analysis & inference. Retrieved April 13, 2018, from http://gotitsolutions.org/2017/08/31/im-a-skeptic-satiated-by-large-raw-data-sets-analysis-inference/

Robbins, S. P., & Judge, T. (2018). Essentials of organizational behavior. New York, NY: Pearson.

Baratta, A. (2006). The triple constraint: a triple illusion. Paper presented at PMI® Global Congress 2006—North America, Seattle, WA. Newtown Square, PA: Project Management Institute.

Response Post

Andrew, I can certainly relate to the comment “for ‘free’ because a project is strategic and prioritized.” I frequently face this battle as well, the questions of should we allocate resource to a project or opportunity, should these resources be internal or external resources, what’s the opportunity costs, is there a quid pro quo, etc., are consistent debate/negotiation topics.

Power is a funny thing; it’s a delicate balancing act. I find your comment on the “pool of ‘free’ resources” interesting. Is there such a thing as free? Are the “free” resources underutilized resources? I have always struggled with this concepts, struggled to grasp the idea of underutilized that is. There is so much to do an learn, and things are changing so quickly that while a resource may not be billable, I don’t like to think of them as underutilized. IMO making the general assumption that an unbillable resource is always better off billable is a short-term view, where decisions are made using “flat earth thinking.” Interested in who is making the plea in your scenario? Are these internal stakeholders, are they salespeople looking for resources for customer projects or some other stakeholder? In my case, they are typically salespeople looking to “help” our customer for “free.” Salespeople are shrewd negotiators; they speak using terms like “our customer” intentionally because they feel it is more persuasive than the term “their customer.” The plea is always “this an opportunity to demonstrate our value”; my initial response is “if it’s free what tangible value does it have?” The answer is almost always a desire to create a quid pro quo. Sometimes I say, yes, if I feel there is upside opportunity, but more often than not I think free is a synonym for valueless, and I say, no.

Whimp Junction (http://bit.ly/2EMV8a3) is a critical crossroads. (Bellington, 2010, p. 12)

Like you, I need to maintain relationships, salespeople need me, and I need them, we need each other to be successful, so I try to remain sympathetic, offer alternatives and find solutions that address our mutual needs without being self-serving to either party. I always make my expectations clear; if there is a quid pro quo, it’s essential that the sale person know I will expect to see the quid pro quo materialize. I demand accountability for commitments, I execute and then track the other parties execution, because, without the ability to deliver on our mutual commitments we lack trust (Robbin & Judge, 2018, p. 202) and without trust, there is no way we can develop or sustain a relationship. I suspect that if I were to conduct a Big Five Personality test on salespeople, many of them would not rate high on equity sensitivity (aka benevolence).

References

Bellington, A. (2010, April 22). Wimp Junction Presentation For Sandler Sales Training. Retrieved April 15, 2018, from https://www.slideshare.net/SalesCoachAB/wimp-junction-presentation-for-sandler-sales-training-3823266

Lee, E. (2007). The effects of equity sensitivity and personality on transformational leadership behavior

Robbins, S. P., & Judge, T. (2018). Essentials of organizational behavior. New York, NY: Pearson.