Wednesday, September 3, 2014

Will You Throw Up When Your Security Incident Hits The Evening News?

Reporting Security Breaches: Back in 2003 and Now.  What's  changed?


By Ed Higgins

In 2003, an article was posted that presented a hypothetical university security incident in which hundreds of thousands of historic student records and payment card information was compromised. The systems were in place (although nothing is 100%), the personnel were trained, but the study suggested that the university was not prepared to address the public when the story broke on the 6pm Evening News.

So, what has changed? Have laws and regulations been prescriptive enough to educate businesses, universities, and other establishments on their requirements to disclose the incident to the public?

Do entities know what to do when "it" happens? How to notify the victims? Do you notify the victims? You can't really hide it from the public it and keep it private, can you?  Did you know that for several years United States laws, such as California SB-1386, mandate disclosure of a security breach to potentially affected victims. No more head in the sand....


The depth and speed at which cyber crimes occur has significantly changed.  Formerly a form of crash-and-dash, today's cyber criminals operate more stealthy with better tools performing significant reconnaissance before they strike. No longer about fame [the notoriety of spray-painting a web page], these criminals carry out well planned, focused and financially motivated attacks, striking at the perfect moment.


The key to adequate incident response today is speed to identify, stop, and address the situation often using outside private investigators for independence as well as competence in the subject matter. This all has to happen much much much much faster than in the past. Bureaucratic organizations move aside!

Based on studying the incident response processes and situations during real-life actual incident investigations with hundreds of clients, I would suggest that we have a lot of work to do. We kinda need to reinvent our incident detection and response processes.


I hope you enjoyed this article, and I hope it was helpful.  


Until next time, "Watch Out For Yourself".

Ed




Friday, August 29, 2014

DCIM: Strategic and Intrinsic Value

The Role of DCIM Coupled with ITIL/ITSM 


By Ed Higgins


As a rule of thumb, the more integral your Data Center Infrastructure Management (DCIM) solution is to your existing critical management processes , the more strategic and successful your DCIM investment will be. The more flexible and integration-worthy the DCIM solution is, the larger the population of DCIM users (stakeholders) will be. When many stakeholders with diverse disciplines utilize DCIM to its fullest, by enabling those individual stakeholders to "work and think within their own disciple" yet share the work they do transparently to the other business stakeholders, the greater the consequential financial benefits will be from the DCIM for your enterprise business.

DCIM is a relatively new category of IT management and unfortunately it has many interpretations depending on which vendor you are talking to. By generally accepted researcher definitions, DCIM is defined as the integration of information technology (IT) and facility management disciplines to centralize monitoring, management and intelligent capacity planning of a data center’s critical systems.

Achieved through the implementation of specialized software, DCIM enables a common, real-time monitoring and management framework for bringing together formerly disparate management systems spanning the entirety of the IT and Facility infrastructures.

Analysts’ definitions vary and in general are very broadly defined which has created an atmosphere where new vendors are arriving every day with their own interpretation. Power strip manufacturers are claiming a stake in the DCIM market. So are diesel generator manufacturers. These are point-solutions and should be properly reconciled by the Analysts.  The DCIM market promised great growth. Couple this with the fact that the big power equipment providers and a few well-funded startups pay tens of millions of dollars per year to these analysts. Now you might see why there is so much confusion and conflict among the DCIM market.

Many potential DCIM customers start their research and investigation of available DCIM solutions in a very hands-on tactical mode. DCIM comes in all shapes and sizes, and in fact includes everything from sensors and power monitoring, to life cycle management suites. Each potential customer looks at the pieces that appear to have the most relevance to their management goals today. They start their DCIM journey looking for solutions that fit into their existing ways of doing business. New tools applied to obsolete approaches is a waste of your time and money.

Fortunately for astute customers, they are beginning to see the much greater opportunity and their former tactical thinking is quickly transitioning towards strategic value, wider audiences, and having broader impact on the entire picture in alignment with the requirements of the business.  We've seen a similar positive transformation in the storage market where tiered storage concepts are considered. The same transformation and cost-to-value appreciation is represented in the hot, cloud market.

Even the role of the CIO has transformed from a "deliver ALL services at ANY cost" approach to a cost-to-value approach, provide the right level of service, based on VALUE to the enterprise, where cost tolerance, resilience, reliability, longevity, growth and/or reduction are now vital criteria.

DCIM Becomes a Strategic Investment When Connected to ITIL/ITSM

We are beginning to see a fundamental shift in discipline and accountability. Everyone wants to look forward rather than backward, and relatively few are defending their previous methods. ITIL-like approaches (anything that enables discipline and accountability) are much more the operational standards in this new climate.  It is within these transformational shifts that DCIM thrives. DCIM solutions must complement and integrate with existing management applications and DCIM vendors cannot force their preconceived methodology upon any established enterprise.  Some DCIM solutions boast workflow and ticket management processes, which should infuriate the DCIM customer.  While most DCIM vendors can bring a lot of best-practices to customers, many have become so enthralled with their own ideals they make claims that they cannot back up.

IT Service Management or ITSM is the process-based practices intended to align the delivery of information technology services with the business needs of the enterprise.

DCIM when implemented strategically marries the physical infrastructure required to ITSM.

When DCIM is aligned closely with ITSM, it becomes embedded with change management.

When the role of DCIM is successful, then the gaps between facilities, IT and the business will radically close, the determination of "who pays the power/utility bill" will be self-evident, previously hidden areas for cost reduction become clear, planning and deployment operations become transparent,

DCIM directly supports optimization and transformation, which is already occurring across your IT structure whether you are part of the equation or not.

I hope you enjoyed this article, and I hope it was helpful.

Until next time,

Ed

Sunday, September 30, 2012

Who is Rackwise? And, what do we do?

Rackwise DCiM X is Enterprise-Class in DCIM Software


By Ed Higgins

Be forewarned, this is a commercial. 

Rackwise  DCiM enables complete Visualization of your entire data center infrastructure from all of your the data center locations world-wide to power and cooling equipment to all of the racks to the devices (and modules/components inside each device) and full cable management (power and network).  Rackwise  extends this visualization strategy into Cloud and Virtualized environments. Extensive Documentation capabilities are built into the solution for comprehensively managing today’s complex and globally disparate data center environments. Modeling, and unlimited “what if” scenarios as well as capacity analytics are core components of our solution (superior to all other solutions). Rackwise  provides you the ability to analyze data in tabular and rich graphical formats. Make informed decisions, enable day to day efficiencies, distribute compute services using global options for "best-cost" services, and efficient operations necessary for proactive Management of tomorrow's data centers, TODAY, with Rackwise .

Intelligent Placement, a powerful capability found inside Rackwise since 2005, is facilitated by Rackwise‘s revolutionary product functionality to identify the “best place” to deploy an asset based on available capacity for power, current, cooling, weight, contiguous rack units (RU), available power and network ports, and other criteria based on the business requirements needed for a given asset.  This dramatically helps data center managers put critical assets where resilience, capacity, and redundancy are optimal, similar to the industry methods leveraged in the tiered data storage space where you put your critical data where the resilience is greatest and your less critical data on less costly infrastructure.  Rackwise helps customer identify these opportunities and optimize their equipment based on the needs of the business customer.

Rich Visualization provides a dashboard display for a high level view of the data center.  Selectable layers can be added to display power consumption, heat generation, current, and either power or signal port availability. Additional layers can be added to display door swings, hot cold aisles, location and density of perforated tiles, etc., to create truly customized displays. Users can drill through to greater detail, from the data center, to the rack, to the device, and components, including: blades, power supplies, drives, etc.

Detailed Documentation provides clear and descriptive reporting on the IT infrastructure. Powerful Modeling allows the user to perform unlimited “What if” scenarios. Rackwise  quickly determines the impact of data center consolidations, or the resource consumption associated with new data centers. The user can make detailed comparisons of proposed equipment upgrades versus the current environment. Trend and historical reporting provides crystal clear visibility into where resources are being consumed over time, and when they’re likely to be exhausted.

Comprehensive Analysis provides instant access to critical information and enables decision making capability on key data center issues. Direct access to information such as availability of space, power, heat and cooling, port availability, and remaining weight capacity in racks, allows the user to make critical decisions with confidence. Rackwise Advanced Power Management provides the ability to explore the power system, understand the redundancy levels of critical servers, and other equipment. Rackwise advanced power also provides full understanding of the impact of power source, UPS, or PDU shutdowns. Further the system determines if the remaining power infrastructure will be over taxed in the event of an outage, resulting in a cascading failure situation.

With over 100 standard out-of-the-box Reports, who needs to custom reports?  Rackwise Standard Reports range from assembly report that provides step by step instructions to assemble and cable a solution, to connectivity reports, to simulating a cascading power or equipment failure to improve resilience, to delivering weekly or daily power consumption reports, environmental reports, and asset management reports. If you want custom reports, we also include an enterprise-grade reporting engine to easily create sophisticated reports designed for your unique business model. If you don't have time or resources to make any customizations to your reports, then Rackwise can do it for you.

Sophisticated Management capabilities allow the user to deploy and decommission devices quickly and easily. Track equipment through receiving, staging, commissioning, decommissioning, and storage. In addition, Rackwise tracks changes to the data center infrastructure at the data center, rack, and device levels. Custom properties can be used to map applications or other information to devices, providing a clear understanding of what impact the shutdown or failure of the device will have. Planning for new equipment is greatly simplified with Rackwise ability to locate and reserve space, power, cooling, ports, and weight load availability. Additionally, advanced searching is made easy to help you locate physical infrastructure components based on your search criteria.

Don't you owe it to your CEO to explore Rackwise today?  Rackwise can help you save at least 20% on your power costs, and reduce your costs in many other areas.  If you spend over a million $$ on your annual power bill, then that's a ton of immediate bottom-line value - and that's just the start.



I hope you enjoyed this article, and I hope it was helpful.  

Until next time,

Ed

Saturday, July 21, 2012

Data Center Infrastructure Management (DCIM)

Three Realities in the Data Center


By Ed Higgins


The data center is the critical nerve center that ensures optimal conditions, security, and reliable power are always available for a business's IT infrastructures.  Data center businesses that sell customers computer hosting, collocation, and managed cloud services, all live or die by touting close to zero downtime and by operating efficiently to create a profit out of highly competitive and commodit-ized  services.  Failure is not an option for those in the data center infrastructure business.  The following are some of the most common realities that lead to capacity, efficiency, and business challenges for those that operate data centers as a business or for their corporate enterprise.

1) Data centers commonly over-provision because they can't predict when demand will increase or when their available capacity for power, cooling, CPU, and rack space will run out. As the need for faster compute service provisioning increases, there exists an imperative prerequisite for visualization of available assets, and predicting capacity run-out, and removing equipment that is no longer in use.

2) Underutilized equipment including servers, blades, virtual servers, switches, power distribution, battery backup, and other forms of data center equipment left powered on wastes enormous amounts of power, rack space, and cooling. This can be avoided by powering off the unused equipment. The problem is that data center managers don't have the tools they need to visualize what is being utilized, what's not, and how much capacity is available. Thus, they can't perform accurate "what-if analysis" to identify opportunities to save space, conserve energy, and decrease their cooling costs.  Furthermore, nearly 95% of all data centers use spreadsheets to manage their business which is an ineffective method for dynamic resource management.

3) Data center managers have difficulty with locating physical assets placed in racks throughout their data centers. Over time, many data centers lose track of where equipment is located and have little or no knowledge about the network and power cabling for the equipment or its physical change history.  They even have difficulty determining the business impact if they shut off a server.  In fact, some data center managers simply refuse to power off equipment because they don't know how the shutdown may impact other equipment, services or customers.

The solution for these and many other problems is to implement a Data Center Infrastructure Management (DCIM) solution.

1) DCIM will help identify and eliminate wasted power and cooling, reclaim rack space, improve asset management and visualization, increase operational efficiency, and lower your carbon footprint. All of these can produce recurring savings of $1M USD or more per year for most large enterprise data centers.

2) There are a many companies who claim to be DCIM. However, most of these companies just skim the surface of DCIM and/or do not provide data center managers with the information or capabilities they need to manage and visualize their assets, identify power and cooling savings, effectively manage their power and cable plants, audit their asset inventory immediate, or produce meaningful reports necessary to run their business.

3) Top-gun DCIM vendors, such as my company, Rackwise, fully understand these critical challenges and provides data center executives and technical personnel the vision, strategy, framework and the tools they need to save money immediately and operate more efficiently towards Green Data Center status. 

Rackwise was an undisputed pioneer and thought leader in data center infrastructure management tools, long before researchers including Gartner, 451 Group, and IDC created the DCIM product category.  Rackwise DCiM is an enterprise-class DCIM Suite that provides everything right out of the box including an ROI in just a few short months, consistently helps customers save 20% or more in their power bill, and enables them to radically improve their data center management practices.



I hope you enjoyed this article, and I hope it was helpful.  
Until next time,

Ed

Thursday, September 17, 2009

DigitaIDWorld 2009 - Looking out at the Crowd

By Ed Higgins


I just returned home from the Digital ID World 2009 #DIDW conference in Las Vegas where I presented a couple of breakout sessions focused on Identity Management and was a panelist in the conference grand finale discussion.  What an honor and a treat!  This, just after returning from an emergency trip to Dubai, UAE and Pretoria, South Africa. 

The breakouts, written on the 27 hour plane rides, were aimed at providing guidance for integrating best practices into IDM initiatives, and presenting a perspective that employee awareness was among the most important keys to success and return on investment.  There were many great breakouts and keynotes that I would have loved to attend them, had I not been presenting myself. I mean, I wanted to be a student rather than the teacher. Some topics that greatly interested me involved the identity impact of cloud, legal implications, facebook as an identity tool, and several others sessions - all very interesting and compelling.

The finale of the conference was a panel discussion entitled "Conversational Crystal Ball Look into the Future of Identity Management". I was most humbled and privileged to have been invited as member of this panel along side noted celebrity security gurus like Jeff Jonas and Doc Searls, and moderated by Bob Bragdon, Editor of CSO Magazine.  I was immensely flattering to have been asked participate with such a prestigious group of gentlemen in the finale panel, a much anticipated and talked about event during the conference.    I owe my gratitude to dear friend and professional colleague Lafe Low, without who's generous invitation and introduction this would not have been possible.

With R.E.M's Radio Free Europe blaring as the intro song, and hundreds of attendees filing into the hall, anyone in my fortunate shoes mightn't help but to feel a bit of a "celebrity moment", especially following the aforementioned three exceptionally bright gentlemen onto the stage...

I had a blast, and I think we visualized the future of Identity and Identity Management Pretty well.

Anyway, enough for now...

Until next time, "Watch Out For Yourself".

~e

Friday, November 2, 2007

Recognition is nice, but not the motivation

Hi All,

I am so honored to having been highlighted in CIOTimes for my contributions to Information Security practices serving the global outsourcing community for Affiliated Computer Services

We have an incredible team and I am fortunate to be surrounded by 150 of the industry's best people.   

I had a disruptive vision to embed information security services into all new outsourcing contracts, especially at a time when no other outsourcers were doing that.  None of them... I knew there was something better, something more progressive and proactive that would ensure protections for our customers and their employees.  We were winning "your mess for less" agreements where InfoSec was an after-thought (or not even a thought at all).  So we convinced our CEO to underwrite a corporate security policy that required a minimum baseline security standard across all outsourcing contracts - this to serve as a significant differentiation over our competition who were afraid to raise that bar or disrupt their deals.  So, I did, as did our entire team.    The CEO signed the policy that I wrote.  

Then, we used that very baseline standard, as a means to go back to every single outsourcing customer to upsell them on the new services we created.  This worked perfectly - we became a profit center as opposed to a cost center, and we immediately began to see every IT outsourcer started to mimic what we were doing.  The outsourcing services space was finally transformed; our business was thriving and agreements from here forward would include security as an important part of the business. 

So thank you to CIOTIMES for recognizing me and our incredible team and thank you to our leadership for allowing us to change this one part of our business for the better. 

Until next time, be safe out there.

Ed















Saturday, January 27, 1996

Is Your Workplace a Toxic Workplace?

Is Your Workplace the Model of "the Toxic Workplace"?


By Ed Higgins

Does your employer confront aggressive employees or managers about inappropriate behaviors? Does it warn bullies about dealing fairly with others and following company values? Does it investigate charges of backstabbing and manipulation?

If so, consider yourself fortunate. You are in a healthy workplace, with people in power who will support you in your fight with a bully.

On the other hand, does your employer turn a blind eye on bad behaviors? Do they encourage or reward aggressive (or bullying behaviors)? Does the company bully usually get his way? Is bullying behavior the norm rather than the exception?

If this is more the case, then you work in a toxic workplace. Even if you aren’t directly bullied, the toxic fumes will get you. You may even conclude that quitting and finding a new job is the only viable solution.

This article will help you determine whether your workplace is toxic.

The dominant culture of your workplace has a huge impact on your ability to effectively deal with a workplace bully. Don’t even think about fighting the toxic workplace until you get a handle on the larger corporate mantra.

Signs of a toxic workplace

In a toxic workplace, dysfunctional attitudes and emotions seem to permeate the atmosphere.
Typical signs of a toxic workplace include the following:
  1. Widespread anger and frustration
  2. Workplace bully is admired, even defended by those he/she bullies
  3. Scapegoats are always blamed, rationalizations made
  4. Dysfunctional processes
  5. Dysfunctional relationships
  6. Dysfunctional meetings, planning to plan (as they say)
  7. Obvious hypocrisy
  8. Overly restrictive systems
  9. Guarded communications, don't talk to him or her without seeing me first
  10. Incompetent or powerless HR manager

1. Widespread anger and frustration

Are co-workers frequently in a foul mood? Are anger and frustration widespread? Do disenchanted employees outnumber enthusiastic ones? These are clear signs that your company’s atmosphere is toxic.

In this situation, nothing realistic is being done to improve morale. Any efforts to make your company a better place to work seem superficial, even ironic (like having the workplace bully head up the committee to improve morale).

Turnover is usually high in a toxic workplace, with the most talented people quitting. This can be turned to your benefit: by focusing on developing friendships with your co-workers, you will soon know many people at other companies--an excellent way to find your next job. In this surreal situation, it’s better to focus on keeping up with ex-employees rather than worrying about the executives who think they control your future.

2. Workplace bully is admired

Is the company culture to admire the winners, regardless of their tactics? Is the bully widely respected, despite his inappropriate behavior, as an aggressive, competitive leader? When a bully loses control of his temper or intentionally embarrasses a subordinate, do others justify his actions as strong management, or even dismiss them as irrelevant?

These are still more signs of a toxic workplace.

3. Scapegoats are found and assigned the blame

Does blaming others seem like a blood sport in your company?

In a toxic workplace, a bully “explains” a mistake by castigating someone else. He thus dodges any responsibility for his actions (although he may acknowledge he used poor judgment in hiring the scapegoat).

A bully’s habit of blaming others can cause serious, persistent problems. By not acknowledging his role in causing mistakes, he finds no answers that can prevent mistakes in the future. And by blaming the innocent, he causes valuable employees to quit. This, in turn, overburdens the remaining personnel, resulting in more failures.

Over time, high turnover allows the bully to blame a whole new set of scapegoats. Just listen for him to judge an entire class or generation of workers, comparing them to his superior intelligence or work ethic. “What’s wrong with young people these days?” he may lament, ignoring the fact that other supervisors don’t seem to have problems with their subordinates.

Scapegoats may continue to be blamed long after they’ve left the company. He can use two or three ex-employees to explain a whole host of problems, since they are no longer around to explain how the bully was actually at fault.

If most of your co-workers believe that the bully’s scapegoats are responsible for failures in his department, your workplace is probably toxic.

4. Dysfunctional processes

In a toxic company, processes tend to be dysfunctional, particularly if a workplace bully helps create them.

In this situation, company procedures don’t make sense, making it difficult to get things done. Management reviews are an unnecessary burden, with many reports that don’t have any meaning. For any given task, the established process appears illogical. You hear “That’s the way we’ve always done it” rather than “There’s always room for improvement.”
Vague objectives and arbitrary deadlines
There are no clear objectives, so it becomes impossible to know what’s important and what isn’t. At times, you find yourself buried with work that appears to be completely unnecessary. It is never clear how and why things are done around the company.

Your boss routinely makes decisions that impact you without seeking your input. Deadlines are never established based on logical scheduling of larger goals, but instead appear arbitrary. No matter how often his subordinates complain, your boss never extends unrealistic deadlines, adding to the general frustration.
Meaningless solutions from ineffective management
In order to create the impression that personnel issues are being addressed, upper management sets up a committee to investigate specific problems and suggest solutions. But the results are based on the premise that the employees aren’t very sophisticated and can be easily appeased. Input from employees is discounted or ignored and clueless managers rely on their own misapprehensions. Because the process is dysfunctional, the results are meaningless.

Let’s say, for example, that a committee is formed to investigate low morale and declining productivity. But since the workplace is toxic, the committee won’t have the authority to investigate the bully. Even worse, a bully may be on the committee. Or the committee must first report to a high level executive who is one of the bullies (“Well, our surprising conclusion is that you are the cause of declining morale.” No, I can’t see that happening either.)

Since they must ignore the impact of bullying on morale, they instead turn to “creative” ideas. Perhaps they find some popular solution to “make employees feel better about themselves.” This could include a patronizing “Extra Special Person” award, meaningless interdepartmental competitions or irrelevant offsite training seminars (“As soon as everyone learns proper time-management techniques,” they tell one another, “productivity and morale will go way up. We’ll even give them free planning notebooks.”)
Unintended consequence: worsening morale
In the end, these solutions tend to be counterproductive. Not only do they fail to deal with the bully, but the premise--employees don’t realize the real problem--is fatally flawed. By pushing a meaningless, ineffective solution to morale, employees feel they are being treated like children, or as second-class citizens. Morale deteriorates even further, and high employee turnover is often the result.

On the other hand, after most employees leave and are replaced with fresh faces, morale will be good once again. That is until bullying again takes its toll and a new dysfunctional committee is appointed and again ignores the real cause of the problem (one symptom of a company run by a bully).

5. Dysfunctional relationships

How do employees relate to one another at your company? In a toxic workplace, everyone seems to struggle with relationships. Misunderstandings are common, leading to frustration, anger and inefficiency. Gossip and criticism are the norm, and cliques lead to favoritism and feuding.

Noticeably absent in a toxic workplace are clear and straightforward conversations. You rarely see a quick resolution of relationship issues, and bad feelings may linger for months, or even years.

6. Dysfunctional meetings

Do meetings at your company feel like a waste of time? Are they dominated by dull monologues and meaningless reports? Do they provide workplace bullies a forum to rant, rave and manipulate the meeting? Are reasonable and competent people intimidated into silence?

If so, you are experiencing the classic "living hell of the dysfunctional meeting".
Topics are meaningless
In a toxic workplace, those who dominate meetings seem to prefer to discuss vague platitudes instead of underlying problems. They focus on theory rather than dealing with reality. By ignoring the real problems facing the company, they fail to accomplish anything of substance. The main impact of meetings is the loss of productive time from your day. Your dominant thought as you leave tends to be “There’s an hour of my life I’ll never get back.”
Bully is allowed to dominate meetings
A workplace bully tends to dominate meetings through his aggressive conversational style, including giving monologues, arguing, criticizing, interrupting and raising his voice. He uses generalizations, innuendo and presuppositions without being challenged. He stifles open discussions and prevents any progress, except to further his own agenda. He may even use a meeting to embarrass, ridicule and humiliate his opponents.

In a toxic workplace, any complaints about the bully’s domination of meetings will likely fall upon deaf ears. In fact, his aggressive tactics are more likely to be admired by upper management.

7. Obvious hypocrisy in the company

A toxic workplace nearly always includes widespread hypocrisy. Executives are unlikely to acknowledge the serious problems plaguing their company, instead promoting the fiction of a healthy work environment run by enlightened management. Bullies are euphemistically described as highly competitive individuals who are becoming strong leaders.
Management fads
Executives in a toxic company often overcompensate by adopting faddish management approaches, as if propaganda is an effective tool to overcome reality. The result may be aggressively promoted company values that don’t seem to match day-to-day events.
For example, clear communication is preached in elaborate seminars while poor communication continues to be the norm. Valuing and respecting others is publicized in the company mission statement, or on framed motivational posters in the break room, but undermining and belittling others seems pervasive. Everyone is told to make company goals their first priority and adopt a spirit of teamwork, but internal competition dominates. Worst of all, the most consistent violators of company values are the most highly rewarded.
Bully as preacher
A workplace bully can be quite outspoken in preaching company values, pressuring others to modify their behavior even as he consistently violates those values. Rather than being punished for his violations, the bully is rewarded for his outward image of leadership. In the rare event he is reprimanded for breaking company values, it is ineffective and ultimately meaningless. In this manner, upper management’s hypocritical attempts to improve the work environment are exploited by a clever bully, leading to further deterioration of morale.
Clueless or evil management
Even when the hypocrisy seems obvious to everyone, upper management seems unaware of the contradictions between what is said and what is done. Maybe they want you to guess whether they are hopelessly unaware or utterly lacking in integrity.

8. Overly restrictive systems for controlling people

A workplace bully usually thrives by controlling others. He prefers a workplace with dehumanizing systems, offering him more opportunities to tightly control their behavior.

Companies fall into this mode of operation by designing and implementing overly detailed operational systems. These include overly detailed policies, procedures and job descriptions and performance evaluations.
Toxic vs. enlightened workplace
In a toxic workplace, employees are criticized and punished for failing to meet established criteria, regardless of whether the item makes any sense. Common sense is not considered as a meaningful factor.

In a more enlightened environment, the emphasis is on training employees to achieve excellence, and on providing them with appropriate techniques and tools. In effect, the systems are subordinated to the employees. In a toxic workplace, it is the other way around: the employees are subordinated to the systems, based on the premise that people can’t be trusted to think for themselves, and they can’t learn to do their job skillfully and reliably.
Bully as a superior being
A bully also feels justified in creating and implementing highly detailed systems due to his advanced intellect and superior judgment. The systems allow him to control the actions of others, thus overcoming their inferiority and incompetence.

In accordance with his character, a bully uses the operational system as an excuse to badger his subordinates and control his peers. Ultimately, this becomes another weapon in his arsenal of intimidation, adding to his power in the company.
Initiative-killers
Once operational systems are in place, employees are criticized for taking any initiative, such as modifying the approach or eliminating unnecessary tasks. It doesn’t seem to matter that these changes would make the company operate more efficiently--if the bully doesn’t originate the idea, it isn’t even considered.
Arguments for totalitarian controls
When challenged by more enlightened executives, a bully adamantly defends this approach. He explains that operational systems are absolutely necessary to maintain discipline, productivity and quality control. He complains that without these systems, employees would not be held accountable for their actions. He may launch into a long-winded description of a former employer that used these systems, or refers to sophisticated management studies, offering quotes and statistics to prove his point.

During his monologue, he conveniently omits the fact that his approach goes far beyond common-sense management concepts, such as thorough work plans and checklists, and into the realm of totalitarian control, with harsh penalties for trivial non-compliance. By converting intelligent methods into dogmatic approaches, he bastardizes the purpose of management systems.
In this toxic situation, only mindless task-oriented workers are rewarded. And if they learn to be completely submissive to the bully, they are praised as model employees.

9. Guarded communications: don't talk to him/her without seeing me first

The bully, who may also be a manager of people, will systematically destroy any trust that employees hold with the company by controlling who they talk to, monitoring their phone call, or even stooping to reading their emails. Stifling of employee's attempts to interact with (please assume, productively) other employees is a common behavior of the bully.  

The bully will behave in a paranoid and controlling manner. Why? Because that's what they do. Their own insecurity and lack of self-worth in their own ability or contributions simply compels them to close off (or very tightly censor) all interactions between employees and any other person, group, location, or business unit. The bully effectively becomes the sole face of the team, taking all credit and ideas for themselves, and preventing anyone from the outside from "piercing the veil" they have so cleverly created.  

This results in good employs who become fed up of that nonsense and they quit. In some cases, they may offer information on their exist interview, but in many cases they leave with a bitter taste of the company because "the company should have known of this and fixed it". But, more often than not, the company may not even realize this until a significant number of workforce quits for the same reason. 

The company is as toxic as the bully when it fails to remove the bully after the veil has been pierced and the bully outed.  The company could also be a victim of this same charade, where it "can't imagine that our star player (aka, the bully) would ever do this. But this all changes when enough people raise the issue out of genuine concern.  These people should be applauded for speaking up.  In a good company, they are.  In a toxic workplace, they are ignored. 

10. Incompetent or powerless human resource manager

In a toxic workplace, human resource (“HR”) managers are either unable or unwilling to deal with rampant workplace bullying.

Signs of an incompetent or powerless (with respect to bullying) HR manager include an inability to respond effectively to bullying incidents, refusal to treat complaints as valid and significant, or criticizing the complainer without understanding the situation. The HR manager would rather not confront the bully, so instead asks you to change your behavior to accommodate the bully.
Failure to recognize or address the problem
An incompetent HR manager treats the problem as caused equally by bully and complainer, with no recognition of the bully’s intentionally destructive behavior. In an attempt to rationalize an unpleasant situation, the HR manager dismisses overly aggressive behavior as "mood swings,” or labels bullying as an “ordinary personality conflict.” It is up to you to resolve the situation.
And if bullying is acknowledged, there is no follow-up on requests for a bully to modify his behavior--perhaps because the primary goal is to pacify the complainer, not change the bully.
HR manipulated by a skilled bully
How can these highly trained professionals fail to deal with workplace bullying?

In some cases, inexperienced HR managers lack familiarity with bullying and its negative impact on employees and productivity. An HR manager may misinterpret the situation, failing to properly research and evaluate the circumstances. Or he may be misled by a bully’s guile.

Let’s say a target complains about a series of bullying incidents. A skilled bully can convince a naive HR manager that his bullying behaviors were fully justified by circumstances, or by the failings of the complainer. In the end, the target of bullying gets blamed, either as the instigator or as a whiner.
After two or three incidents, the HR manager will perceive the target as a chronic complainer. After that, all future bullying of that target, even when obvious and severe, is likely to be ignored. In this manner, an HR manager can contribute to the toxicity of a workplace.
HR intimidated by an entrenched bully
An HR manager may honor a bully’s leadership in the company. If a bully is clearly respected by upper management, confronting him carries huge risks. It makes more sense to side with the bully, blaming the target.

For example, let's say a bully convinces the company’s president that his department will deliver an enormous increase in profits, but it requires a “tough management” approach. If the president is commmitted to the bully, the HR manager will probably avoid interfering.

When the HR manager believes his own job would be at risk if he makes an enemy of a powerful bully, you probably won’t see any meaningful action to address the underlying problem.

Signs that management encourages bullying

In a toxic workplace, upper management has unknowingly displayed attitudes and imposed policies that have created an environment favorable to bullies and hostile to everyone else.
Management encourages bullying:
  1. Remote from employees
  2. Bully is part of management “club”
  3. Seems to deal with bully
  4. Bullying is rewarded
  5. Effort to appease a workplace bully

1. Remote from employees

In smaller companies, workplace bullies often thrive when the owner isn’t involved in day-to-day operations. His remoteness from employees gives free reign to a bully.

In larger companies, a rigid hierarchy may create a similar degree of remoteness, particularly when the hierarchy restricts communication in an upward direction. Even if executives brag about an open-door policy, they are probably unreceptive to complaints about bullying. And if you corner them about the problem, they may label you as a troublemaker.
Isolated, uncaring and short-sighted
In a toxic workplace, top executives may have been isolated for so long that they stopped caring about their employees’ well-being. These executives fail to see the big picture. It isn’t rational to ignore the morale of people upon whom the company’s profitability depends.

Even a purely selfish executive, upon careful consideration, would recognize the significant long-term benefits of dealing with the issue of bullying. He would understand the positive impacts of improving morale, including decreased turnover and increased productivity. The potential for increased profits alone should motivate him to action.

Then it would become a priority to treat rank-and-file employees with respect. The rational executive would eagerly listen to their complaints, perform a full investigation and ultimately get rid of the workplace bullies.

2. Workplace bully is part of a management “club”

Does a workplace bully seem to have unwavering support from your company’s top executives? Then perhaps they consider him a member of their management “club.”

Many top executives rise to their position by bullying others. When they see others using the same tactics, they are impressed. They welcome the bully as one of their own kind. They admire his many “qualities,” such as shrewdly exploiting employees to generate more income for executive bonuses.

Once a bully becomes part of this management group, it takes a near disaster to weaken his power. If anyone threatens the bully, they close ranks. If you complain about the bullying, they treat you as the problem. You may be called “disruptive” or a “troublemaker.” If you continue to fight back, they allow the bully to discredit you. Ultimately, they find a reason to fire you, rather than let you educate others as to the toxic nature of the company.

If it is any consolation, workplace bullies eventually turn on each other in their endless quest for more power and money.

3. False appearance of dealing with a workplace bully

When low morale becomes an issue, upper management addresses the symptoms rather than the underlying problem (the behavior of a workplace bully). Their objective is to satisfy employees that they are dealing with morale issues, but without causing the bully to leave the company (and thus reduce their future bonuses).

However, it is counterproductive for executives to attempt to raise morale without reigning in the bully, such as by announcing that “valuing our employees is a top priority” and distributing a new mission statement. When employees are aware of rampant bullying, they quickly spot hypocrisy. Instead of improved morale, the company ends up with increasingly cynical employees.
Understating the problem
At the same time, executives discount the severity of a bully’s behavior. They call his overly aggressive or manipulative behaviors a “minor problem,” or say “he lacks maturity, but will grow into the job.” Even when they acknowledge his destructive behaviors towards others, they rationalize that “over time he will develop his interpersonal skills.”

Furthermore, executives acknowledge only one or two incidents of bullying behavior and ignore the overall destructive pattern. Or they mislabel behaviors with euphemisms: manipulation is called persuasion, backstabbing is called posturing, gossiping is called bonding.
The only true sin
Even in a highly toxic workplace, there is one exception to this support of bullying: in the rare case that a power-hungry bully acts aggressively towards a top executive, he will be dealt with quickly and permanently.

4. Bullying is rewarded

Does a workplace bully in your company have the unwavering support of upper management? Does management allow mistreatment of employees because it results in greater profits?

Greed can be a very strong motivator. People with lots of money usually want more, often with a single-minded focus (maybe that’s how they became wealthy in the first place). When a company treats profits as sacred, ethics and values usually suffer. In this environment, bullying behavior is tolerated--or even praised--if it appears likely to lead to higher profits. Even worse, the bully is rewarded for his harsh methods as long as he produces short-term financial gains.
Bullies exploit management’s greed
A skilled bully can adroitly take advantage of this situation. As long as he continues to expand business, with the expectation of increased profits for the company, he feels free to engage in highly aggressive and manipulative behaviors. He knows that upper management is focused on the bottom line, causing them to overlook employee complaints or other morale issues. In effect, there are no restraints on the bully’s aggressive behaviors.

But even though a bully can increase profits in the short term, over several years low morale and high turnover usually produce the opposite result. Sophisticated executives will recognize this, though they may be temporarily blinded by a bully’s promises. In a sense, they allow themselves to become victims--at least temporarily--of a master manipulator. And if they allow the bully to run their company into the ground, they may become permanent victims.
Cooking the books
A bully’s manipulation may extend to financial reporting as well. For example, he inflates his department’s revenues through excessive billings, though he knows most of his billings will never be collected. He receives a large year-end bonus as a result. By the time his clients discover the over-billing and refuse to pay their invoices, the bully has gained enough power in the company to survive the sudden drop in his department’s billings.

Or if the bully is particularly clever, he discredits the non-paying clients, then starts playing the same game with other clients. By maintaining artificially high “revenue” for two or three years, a skilled bully can suck out a substantial compensation. He may cripple the company as a result, particularly if his increased billings trigger increased hiring and capital outlays. The bully then buys a new house, a new car and then runs on to a new job where the parasite bites another victim, claiming tremendous success at the company he nearly bankrupted.
Greed is punished
Ultimately, company executives and owners suffer from their decision to allow a bully to have his way. Insolvency, bankruptcy, partnership disintegration and lawsuits are common in the wake of a bully's exploitation. All because of short-sighted pursuit of easy profits at the expense of their employees' well-being.

Just once, wouldn’t you like to hear one of these executive's acknowledge that he doesn’t really care how his employees are treated, as long as they make him wealthy? Then you could at least admire his honesty.

5. Effort to appease a workplace bully

Greedy owners and executives who are afraid of losing a profit-generating bully may try to appease him. For example, they increase his compensation and allocate him additional company resources, or even terminate one of his peers. With weak or naive executives, the bully may even manipulate and exploit the situation until he gains control of the company.

As in politics, appeasement is a dangerous approach to dealing with a bully. Even a strong, profitable company can fail after several years of having its values and integrity gutted by a skilled bully.

A toxic work environment usually begins at the top, either through negligence or lack of character and integrity, usually stemming from a naive discounting of the importance of how employees are treated.

Workplace bullying is invisible

Are you surprised that no one can see widespread bullying but you? In this distorted reality, all common sense seems displaced by the almost magical power of a charismatic workplace bully.
When you point out his subtle manipulations, no one takes you seriously. When you report his mistreatment of you, people assume you misunderstood the situation. Even worse, they accuse you of doing something that justified his outburst (“You should be more careful not to trigger him”). When your co-workers have become unwitting accomplices to his devious tactics, you know you are in a toxic workplace.

A skilled workplace bully can adapt to the company culture in a way that makes his destructive behaviors virtually undetectable to bystanders. Perhaps over time he will bully enough people to widely expose his true character, but it is more likely that he will cause the termination of anyone who speaks up, leaving only a trail of disgruntled ex-employees.

If you are in a toxic workplace, don’t fool yourself into thinking you can accomplish much by fighting the bully. You will probably be better off just acknowledging that the people in charge have limited mental capacity and go find a healthier, happier place to work.

till next time,

~e