We all wind up selling a little bit of our soul to get through college. Some take out loans. Some have part time jobs. Some have scholarships requiring them to maintain a certain GPA. Some have to play sports effectively to maintain their funding. Me, I did Army ROTC. When people ask me what I think about my Army experience, I always have the same response: I wouldn't trade it for the world, but I sure a hell wouldn't do it again. I say that because I learned a ton about people, leadership, and organization. That's why I wouldn't trade it for the world. I sure as hell wouldn't do it again because many of those lessons I learned the hard way. One of those lessons was to always make sure you put your eyes on the objective. That lesson applies to us as information security and risk leaders.
As leaders and managers we have a tendency to get distracted with documentation, checklists, and politics. We become task oriented focusing mostly on crossing things off our list and meeting the objectives our bosses set for us. Delegation becomes a critical survival skill in this scenario. And for me at least, this can lead me to forget the lesson of getting my eyes on the objective. This oversight recently resulted in some lost sleep. It would have resulted in heartburn too if it weren't for that modern medical miracle called Prilosec.
Getting your eyes on the objective means seeing the target of attack with your own two eyes. You can delegate the recon work to someone on your team, but it will never be the same as seeing it first hand. Get out there and look at your problems first hand. Go visit the point of sale devices. Talk to the people executing the administrative controls you've implemented. Go see the physical security controls at your data center.
As a leader or manager you must delegate to be successful. Don't stop trusting your folks to execute smartly and effectively. But, for you to understand the situations properly and ask the right questions, you need to seed the important stuff with your own eyes. Leadership requires it.
Getting my eyes on the objective was one of the most important lessons I learned in ROTC. That, and to open your ambush with your greatest casualty producing weapon.