Lessons from Teaching Cybersecurity: Week 7

As I had mentioned previously, this year, I’m going back to school. Not to take classes, but to teach a course at my alma mater, Fanshawe College. I did this about a decade ago and thought it was interesting, so I was excited to give it another go. Additionally, after a friend mentioned that their kid wanted to learn Python, I developed an Intro to Python aimed at high school students that I’m teaching weekly. I thought that this would be good fodder for the State of Security. So, whenever I have something interesting to discuss, expect to find it here.

This week was mid-term week, so grades were due and exams were happening. It was also the start of reviews here at Tripwire, so the pairing of the two got me thinking about effective feedback. Feedback is such an important part of growth, but for some reason most of us hate giving it and even more of us hate receiving it. If I’m being honest, negative feedback makes me angry. I know it’s a part of life, but I don’t handle it well. I think the same is true for those I’ve worked with, those I’ve managed, and those I’ve taught. Negative feedback never goes over well.

Self-Evaluation

When someone receives negative feedback, they can feel backed into a corner and get defensive, arguing their position or justifying their behavior. I happen to be a very blunt person, I’m not big on flowery words or sugar coating the truth. I spent years getting the same feedback in my reviews year after year. “If you ever want to manage people, you need to learn to communicate better.” “You have a bad reputation because of how harsh your criticisms are.” I shrugged them off. My reasoning: “Don’t make mistakes if you don’t want to be criticized.” Oh to be in my mid-20s again. After all, I only heard this once a year… why should I care? As I’ve grown older (and hopefully wiser), I’ve also taken a number of management and leadership courses that always preach effective feedback and open communication. The problem is that no matter how effective feedback is, no one ever teaches feedback acceptance. It took me a long time to get to the point where I accepted feedback from others and I’m still not happy when it happens.

Starting at the Beginning

I think that the problem with accepting feedback starts before we enter the workforce, before we even enter the post-secondary education system. Parents insulate their children from any negativity. I’ve heard all sorts of horror stories over the years. Parents that accompany adult children to interviews or call the company when they don’t get a job. Parents who call the high school, or worse, the college, when their kids don’t get the grade they want. Parents who prevent teachers from failing their kids and force them to pass them on to the next grade. Anything negative directed at students and their parents, complete with suits of armor, come rushing to their aid. We should consider correcting this behavior before correcting our negative feedback responses. It isn’t the end of the world if a child fails and it isn’t a parent’s place to ensure they succeed, just be there to support them.

Getting off the Soapbox

Where am I going with this? I was a little disappointed when submitting my students’ grades. Students above 60% simply get an ‘S’ for Satisfactory while others get a ‘U’ for Unsatisfactory. My sister called while I was submitting grades and when I told her the format, she asked if I was teaching kindergarten. I’m sure some psychologist or education expert decided that this was the best approach, but I wonder if that individual knew what these students would encounter when they graduated. A real world with real feedback. Not only were my only grade options a U or an S, but I was allowed to choose from about 10 predetermined single line comments that were ultimately attaboy/attagirl or “book a meeting with me.” It wasn’t particularly valuable feedback.

At the start of the year, I had to define program outcomes (objectives) for the course. At Tripwire, we, like many companies, set objectives for ourselves that we discuss with our managers. We are then measured against those objectives and our core corporate values. I can’t help but wonder how much more beneficial it would be to students if the same thing was done. What if students had to define their own objectives for the course and professors provided the values (or concepts) they wanted to communicate? What if instead of an ‘S’ or ‘U’, students were graded against those defined objectives and concepts? It would be a lot more work for faculty, but I think it could prove invaluable to students. Imagine how much better prepared for feedback in their careers these graduates would be.

Connecting the Dots

When I started working, I spent 6 months in IT without any feedback. At that point, I took a job with VERT and performance reviews happened after I’d been around for roughly 4 months. My review was, “Well you haven’t been here that long, good job so far.” It would be 16 months on the job before I got my first real performance review. At Tripwire today, employees have 90 and 180 day reviews and regular one on ones. We have a culture driven by feedback. While performance reviews and feedback processes can always be improved, the process I experience now is significantly better than when I started. However, even when I started, I feel I was getting better feedback than students get today.

So, like all of my articles, here’s my list of asks… this time as an actual list:

Parents: Leave your kids to their own devices after high school. If they are mature enough, do the same in high school. If a teacher ever suggests they be held back a year, listen… they know education.
Students: Be open to a performance review. Ask your professor if they would be willing to give you one. You may need to figure out what that looks like, but not everything is about getting the highest grade. Also, be prepared for negative feedback when you enter the workforce, expect people to be polite but critical, especially when you’re just starting out.
Post-Secondary Institutions: Consider better preparing your students for feedback, so they are better prepared for life after school.
Professors: Consider implementing performance reviews, realize that grades alone may not be enough.
Employers: Remember that you are encountering employees who haven’t had proper feedback before, who haven’t had their performance evaluated. Ensure that you have the supports to both provide and help handle feedback.

Final thoughts

When I proposed this series, I expected to write about cybersecurity interactions with my students. Cool things that I taught them and cool things that they learned and, in turn, taught me. It turns out that the technical side is pretty straight-forward and I’m sure the State of Security editors are questioning why they decided to publish it, but I want to say how happy I am that they are and how happy I am to keep going until the end of the semester. It turns out, the more that I talk to my students, that they aren’t struggling with the technical, they’re struggling with everything else.

In college, I had a series of classes that were called “Management” and the goal was to teach “soft skills.” Since those classes had nothing to do with my focus, I did what I had to and that was it. I think, instead of teaching those soft skills in specific classes, students would be better served to have those concepts incorporated into all classes. When I think about those skill sets now, I think about how better served I would have been in the early years of my career if I knew then what I know now. Not everything can be taught, but we can definitely make it better and, in part, I’m hoping this series contributes to that.