A BEST PRACTICE FOR BOSSES

One of the more difficult aspects of working for a boss is learning the boss’s communication and decision styles. Considering that the single most significant factor in determining your job satisfaction is your relationship with your boss, it pays to pay attention to that. In turn, when you’re the boss, you should communicate your personal style clearly.

(Dilbert's Pointy-haired Boss, inspired by my PM professor)

Here’s one technique I learned early in my project management “bossing” career from a mentor.

Create a list of guidelines for your team. Its purpose is to communicate the ground rules for interaction. This was one of my early lists.

1. I strongly believe in trust and dependability. If somebody says that they’ll do something, they should. If some unforeseen circumstance interferes, that person has the responsibility of notifying all that will be affected. If s/he wasn’t able to do that before the event, s/he must do it with an apology and explanation as soon as possible. And, may I add, to not do this repeatedly.
2. I will treat you professionally and I expect the same.
3. Refrain from accepting or committing to changes to the project unless you have that authority. All changes must go through the change control process. All requests, regardless of the medium it was sent in (e.g., email) must be transcribed to the official change request form.
4. Email headings. Maximize the use of the subject line. Identify the nature of the message according to its content. An email for action should be labeled ACTION. An FYI should be labeled FYI. Incidentally, I can’t think of any other type of email besides a Call for Action or an FYI. If I missed a category, please advise me.
5. Email headings again. Break the chain! At some point, it becomes silly to continue receiving and sending emails with the same heading over and over again. Here's what I mean: ACTION ----> re: ACTION ----> re: re: ACTION ----> re: re: re: ACTION ----> re: re: re: re: ACTION. Please break the chain!
   
6. Email length. Keep it to several paragraphs if possible. Longer content should be created as a separate document (e.g., Word or Excel) and attached to the email.
7. Email legalese. Our employer can legally monitor all email sent through its facilities. This includes your personal emails.
8. Email ccs and bccs. Refrain from carbon copying (that’s what “cc” stands for) and blind carbon copying (“bcc”) persons who do not need to know. CC-ing me to protect your rear may work but it may also lead me to form an incorrect impression about you.
9. Presentations. We’ve all heard of “death by PowerPoint.” If the expression is unfamiliar, please Google it. Learn how to make effective presentations.
10. Start and end meetings on time. Unless circumstances dictate otherwise, distribute the agenda at least 18 hours before the meeting.
11. It is sometimes easier to seek forgiveness than to ask permission. If you have to make a decision and, for whatever reason, you aren’t able to contact me or another manager, decide in the best interests of the company. You can do it.
12. I enjoy receiving most surprise presents from my family. I do not enjoy most surprises that come from stakeholders, customers, and fellow employees. Please advise me if you see something that should be brought to my attention.
13. Grammar and spelling. There are checkers in MS Word. Please use them. Typos and bad grammar annoy me especially if customers will read them.

PRIVATE KEY CRYPTOGRAPHY

This is not your father's cryptography!

Traditional cryptography systems work under the condition that both the sender and recipient each have a copy of the cipher key. The sender sends an email that was encrypted using his copy of the cipher key. Once received, the recipient decrypts it using her copy of the same cipher key. This system works because each party has a copy of the same cipher key.

But what if the recipient did not have a copy of the cipher key?

PUBLIC & PRIVATE KEYS

Cryptographers came up with several ingenious solutions. The one most widely used employs a public and a private key. Only the recipient needs to create these keys. It works like this:

• The recipient sends her public key to the sender.
• The sender uses her public key to encrypt the message and then sends the encrypted message to her.
• The recipient uses her private key to decrypt the message.

Notice the following:

• The public key is given to anybody who wants to send encrypted mail to the recipient.
• The private key is the only key that can decrypt any message that was encrypted with its partner public key.

This method, called Public-Key Encryption, has one major weakness. That weakness arises from the public key. A third party could create its own private & public pair and send its public key to the sender. The public key is sent under the guise that it came from the recipient. If the sender uses the bogus public key and sends the encrypted message and that message is intercepted by the third party, the latter will be able to decrypt the message using the private key it generated.

This weakness can be avoided in two ways:

• the public key is personally handed to the sender; or
• have an independent and trusted third party, called a Certificate Authority (CA), authenticate the recipient's identity and, thus, the authenticity of her public key. Authentication is done through a digital certificate.

The recipient and the CA are the two primary parts that form what is called the Public Key Infrastructure (PKI). Numerous articles explain this so you may click here to read an explanation of the process.

CASUAL USERS

What about casual users? Is there a simpler way to exchange encrypted emails? There is and it's as simple as sending the cipher key to the recipient in one email and then following it up with a second email that contains the encrypted message.

This is a weak system but it's adequate for casual users.

IS THIS A BETTER SYSTEM?

I had a discussion about cryptography with an information security specialist recently. He described a method that uses private keys and doesn't involve a third party. He had no name for it but it works! Each party has a private key that never leaves the owner's possession.

The method solves the conundrum (raised at the beginning of this article) of sending an encrypted message to a recipient who doesn't have a copy of the cipher key.

First, the sender encrypts his message using his private key. He then sends it.

Second, the receipient receives his encrypted message and then proceeds to encrypt it again using her private key. She then sends the double-encrypted message back to him.

Third, the sender decrypts his message. His message is now in clear text. He sends it back to her.

Finally, she decrypts the email using her private key and reads the clear text message.

Take note of the following. Each party has a private key. And there is no third party. I can't see any discernible flaws, can you?

It does require one thing and that's cryptographic software that can encrypt and decrypt a message that's already been encrypted without damaging it. I have not had the opportunity to investigate and find one yet. If you know of any, please contact me.