Synergies Between Regulatory Compliance and DevSecOps

After 15+ years building medical device software, I've learned something counterintuitive: FDA regulations don't slow down secure development—they accelerate it. For as long as I've been a Software Engineer, I've thought about the things that can and will go wrong in software, and what the security implications could be.

The modern view of this is called "DevSecOps". This is short for Development, Security, and Operations, a software engineering culture and practice that integrates security into all phases of the software development lifecycle, promoting a culture of shared responsibility for security.

If you think about how this point-of-view maps to the world of regulatory compliance for medical devices and software, there are fundamentals that are key for both. For instance, ISO62304 and the DevSecOps are concerned with Hazard Analysis and Threat Modeling respectively, as well as requiring traceability and auditing capabilities as foundational for risk management. The emergence of DevSecOps has driven a welcome "left shift" of cybersecurity into the software development cycle, making security part of requirement and design. This is getting teams to think about security earlier and not consider it a "bolt-on" activity. The regulatory requirements actually enhance DevSecOps. 

For Instance: Paying attention to the software manifests and SBOM from the start can help drive conversations such as "Do we really need that library?", "What vulnerabilities does the library have?" and “Do we really need 47 dependencies for one feature?”.  If you have to answer these questions at deployment, without having given them prior consideration, it is a painful, rushed and more error-prone process than it needs to be. An SBOM that meets FDA guidelines is going to support good vulnerability management practices.

Lastly, the testing required for medical devices usually exceeds the scope and depth of testing done solely for cybersecurity. It's not a question of either/or but both for a successful deployment/release.

 

Colorful

Use words and phrases that create pictures and carry emotion.

How do you add color to a presentation? Must every presentation send you scurrying to the thesaurus looking for adjectives to create those vivid, emotive images? Will you torture yourself trying to create similes "with all the colors of a peacock’s tail"? No.

No? Then how? One word:

Stories

Storytelling is a powerful tool for communication - not mere entertainment, but to carry powerful messages down through the ages. Look at the bible and the teachings of almost all religions. Key precepts, ideas and commands have been passed down over millennia, all through the power of stories.

Think of storytelling in every presentation - even otherwise dry technical talks will benefit from the color of stories. 

If you spend the time, searching, wracking your brain, and struggling to find the stories behind what you are speaking about, you'll gain the color needed to breathe life into your speech. Stories are a proven way to create pictures in the listeners mind. Add color and life without resorting to tortured, overly adjective-laden, purple prose. In addition, a good story, which pits your protagonist against obstacles which need to be overcome - creates natural emotion through tension and release. The story involves the listener in the presentation.

Right about now you are saying to yourself -"yeah right... if it were that easy I'd be doing it all the time". Don't give up on me yet, here come some ideas on finding the stories, which for many are elusive.

Finding your stories

First, ask questions. Look at the who, what and why. Who needs (or needed) to know about what you are talking about? What would happen if someone didn't know about what you are going to talk about? Why would these things happen?

A good story has a main character, the main character has a problem, and the main character works to overcome the problem, the main character overcomes the problem or meets a tragic defeat. If there is a defeat, there had better be a good moral or lesson in the story! 

As an engineer I was asked to give a demonstration to a few hundred sales and support folks. I started to approach the outline of the speech as a simple how-to recipe - first the customer dials into the system, then the system responds with a prompt asking for either a claim number or customer id and then one of two things can happen... and so on. I described the system, flawlessly, but I was terminally bored on first reading. I wanted the audience to want me to stay not wait breathlessly to leave. Then I remembered that the point of the software being demonstrated was to connect a customer and customer service effectively and efficiently. There are people, characters involved. And I already knew that something happens! So, I recast my "how-to" as a story - I presented the customer making the call, the software system and the customer service agent all through role-playing and dialogue. I would step to a different part of the stage for each "character" and made most of the speech dialogue and "stage directions".  With each shift in posture and tone, the audience wasn't just hearing about the system; they were in the call, feeling the customer's anxiety and the agent's empathy. All while telling the story of how the underlying software had made the transaction more seamless and effective by ensuring the call was routed to the correct agent, that fully capable in solving the customers problem.

Second, remember. If this is a technical or how-to speech, look back at when you were learning about what you are speaking about, what difficulties did you overcome to achieve mastery, where did you make mistakes and have triumphs? In essence, make your self the main character.

Along the same lines, if you are going to make an appearance in a story, think about what prompted you to select your topic for the speech you are giving? Were you mad about something? Are you confused or maybe even just quizzical? The answer allows for you to bring a person into your speech, to solve a problem - in short, a story.

I urge you: Don't just present data; breathe life into it. Don't just deliver information; weave a tapestry of stories that will resonate long after the last slide fades. For in the realm of communication, it's not the facts that linger, but the feelings they evoke. Go forth and tell your tales!

Aim Higher

The post "Having Trouble Finding a Job? Aim Higher" really struck a chord with me. The author (Oztech) makes the case that you should lift your sights for a very practical and pragmatic reason - to look for jobs which require more of the worker and are ideally offer fewer competitors. This is reasonable advice.

But, buried more deeply in the post is the message that you need to aim higher in all things - improve your skills to expand your aspirations, work to present yourself better and to take advantage of opportunities and challenges that expand your horizons.

C.A.L.M. when speaking

You strive to be calm when speaking in public, right? Here's why - you want to be:
C.A.L.M.when speaking.

Colorful
Articulate
Lively
Modulated

Yes, it's an acronym, a mnemonic (Professional hazard as I am an engineer by trade and mien.)

An oft-overlooked skill - taking meeting minutes

From Lockergnome, Diana Huggins presents Meeting Minutes 101. This points things to do in preparation for a meeting that make it easier to take good notes and minutes.

I reccomend reading it as she offers helpful points on taking effective meeting minutes - a task frequently done poorly.

I think the article is missing one important point - always be ready to take meeting minutes.

I'm guilty of the "if I ignore it, it'll go away" syndrome. You are too, I'll wager.

I have worked myself into the state of dreading having to take minutes - thus I do everything to be unprepared to do so - all in the hope that I won't have to, someone else will, they won't be needed, etc. and etc. Generally a bad plan - an approach to fail.

Rethinking this approach and instead taking these tips to heart is much more realistic. Here's a way to look at it:

• If I'm going to spend my time in a meeting, then I'm probably going to take notes, since the act of taking notes helps fix the discussions, the issues and my thoughts firmly in my mind.
• Now, if I'm going to take notes, there's really not a lot of difference between the preparations and techniques for me as a simple note-taking participant as compared to a "scribe" (minutes-taker). These tips are in the article by Diana.
• So, my thinking goes, I'm actually ready to "take minutes" for most any meeting I attend.

So where Diana suggests:

"If you find yourself having to take meeting minutes, here are a few pointers"...

Instead, read that as "Since you're always prepared to take good meeting notes and minutes, here are a few pointers..."

It's "Democratic"

And I quote GW Bush (aka #43 or POTUS) from the State of the Union address

"and I congratulate the Democrat majority."

Remember this is an example of the exactitude and detail some speeches merit. This one phrase was commented on extensively and noted as an insult and a slam and a jab. And this offers
some in-kind names such as "Republicant".

But all this is a digression of function over form.

It was a grammatical blunder - which is simply poor form. "Democrat" is a noun, "Democratic" is an adjective.

If the president gets raked over the coals for it, do you expect to escape in any better shape?

Geek + Blog = Glog?

Haloscan commenting and trackback have been added to this blog.

Sure I'd like a standing ovation....

My biggest problem with "How to get a standing ovation" lies in the first point:

Have something interesting to say. This is 80% of the battle. If you have
something interesting to say, then it's much easier to give a great speech.
If you have nothing to say, you should not speak.

This is interesting a quandry in Toastmasters, since you have to speak. Thus you must wrack your brain and think, think, think for someting interesting to say. It's there, you must just find it or invent it. Note point 7. People love stories and if you think about your life, your week, your day you'll have a story.

Ideas and tips for opening your speeches. I like the idea of "Make points that people agree on first". This is also an effective, if not over-used, sales technique "get them saying yes". If you can do this humorously, all the better.

One of the hardest things when speaking is to remain calm. Now personally, I believe in the "Fake til you Make it" school of thought - act calm and you will become calm. But how do you "act calm"? Try to control and concentrate on those things you can control, such as your breathing, expression and gestures. Do not forget about your voice . Work at starting at a lower pitch than normal to give yourself some room to go higher as your excitement and passion crescendo. This also helps to present a calm facade.

Write to speak

Have you noticed how many good speakers are also writers? Doesn't it seem that many of the greatest speeches were given with few or no notes. Was there no formal preparation? Was the speaking was extemporaneous?

No. There was written preparation by great speakers for great speeches. Additionally, there was a body of writing done by the speaker that helped them build their ideas and formed the foundation for speaking.

Consider Winston Churchill - an inspiring speaker and author with a large body of work. Martin Luther King Jr. - he left behind voluminous writings both public and private. Abraham Lincoln - an Attorney, the schooling for and practice of consists largely of writing.

Look around, you'll find the people that are the best speakers have a background in writing, a habit of writing. I know many lawyers. I've seen lawyers trained and seen the changes that training causes. Lawyers write, a lot. It's a key element of their schooling and their practice. When they speak, it's well organized and purposeful. They learned by rote, through practice - writing.

In short, this had led me to the conclusion that I need to write more.

Thinking ahead

How often do you open your mouth, start talking, and then, after a few effortless sentences escape, hear what you said and realize that it is almost total gibberish? Meaningless. Vacuous and content-free.

I have noticed occasions of that recently. Today I recovered from babbling episode using a technique that rarely works. I kept talking. Normally this only exaggerates the babbling but - I was able to focus and come up with an organization. I made much more sense the second time around. And it was much more succinct.

In extemporaneous speech - talking off the top of your head - you need a plan. Not a complicated one - but a plan nonetheless. You need to know where you are going in order to get there. It is much more interesting for the listener that way.

Think of a joke. The destination is the punch line. If you don't make it to the punch line, the joke is dead.

I reorganized today's verbal diarrhea to follow a timeline. And I knew where the timeline ended-up. I wanted to describe how a program I was testing was working and also tell how I got into the not working state.

Version one:
"On my machine the website gives an error, even though I tried resetting the config files and that is a different problem than what Steve is having after we used a clean build on his system and we've checked for other differences."

Version two:
"On my system and Steve's we reset the config files. We did a clean build on Steve's system. We didn't find any differences. We get different website errors on both systems."

So version two isn't scintillating reading, but it was much more effective and communicating what was going on. I simply organized my thoughts to follow the list of things we did, making sure the punch line was "We get different errors on both systems". When the organization came to me I felt that even I understood things better.

So, come up with the punch line first then map out an organization for getting there.

For the record...

I've been practicing recently for various speeches and even some phone calls. When I don't have anyone to evaluate me, I have to be my own worst enemy and drag out an audio or video recorder then proceed to evaluate myself.

It's painful. The voice that I think has a somewhat sonorous tone is nasal and high. The smooth and flowing hand gesture is quick and jerky.

Always very educational. The second and third takes are significantly better as a result of review. Try it. You might not like it, but whomsoever listens to you afterwards will.

Not brain surgery, but effective nonetheless.

Icebreaker Redux

This was my first speech to this Toastmasters Club (SpeakEasier). It's a second Icebreaker, given about 13 years after earning my CTM (Competent Toast Master). I wanted to 'wow' the audience, enrich them and engage them.

However, the best and first goal for an Icebreaker is to introduce yourself. Simply introduce yourself. Let the listeners know you as a person.

The result? Somewhere amidst the eleven (11!) "ahhs" and "umms", I managed to cram in three speeches. In 7+ minutes. Needless to say, it gave short shrift to introducing me. Whoops.

I tried to accomplish too much in such a short speech. I felt hurried doing it and I should've known. I also worked hard on the opening - memorizing it and refining it - and I pitched overboard, starting completely differently.

At least one of the positive comments I received was that I had managed "to organize and fit so much into such a short speech".

Unfortunately, I think this left most of the content spilling over onto the floor as I overworked the retentive capabilities of my listeners. Sigh.

Speaking Today - My Ice Breaker

I am speaking today at lunch. I have five to seven minutes to introduce myself as part of my CTM #1 exercise in Toastmasters. The CTM #1 is the first speaking exercise in the Competent Toastmaster Manual of the Toastmasters International training. Its called the "The Ice Breaker" and the purpose is to introduce myself as well as 3 or 4 interesting aspects of me and my life.

I am looking forward to it. I will speak, I will be evaluated - getting valuable feedback on how I can improve. My Evaluator has a rubric to use, noting things such as:

• What strong points does the speaker already have?
• How well did the audience get to know the speaker?
• Did the speech reflect adequate preparation?
• What are one or two specific suggestions you can make to help the speaker improve?

There are more, but you should get the idea.

I'm going to try to give as well as get during this speech, so I am presenting some listening tips as part of my speech... and then presenting a "quiz" to check their listening. It will be fun. More on the structure and results later.

This (Toastmasters) is the best program around, as I belabored in The Speakers Silver Bullet .

Inventing Answers

You are asked a question, basically given a topic upon which to discourse. Except it's not a question that has a ready answer. The "Turn knob B and push the start button" sort of instruction won't cut it. Think in terms of the "tell me about yourself" or "why do you think we should do X" sort of landmine-ridden question.

What do you do?

Instantly there are perhaps dozens of things to talk about and paralysis sets in as you try to connect these into a coherent whole. In short, what will you say?

As it happens, the study of Rhetoric has developed to answer just that question. One of the canons of rhetoric is "inventio" and it concerns finding something to say. Inventio or "invention" provides tools for picking out what to say. A key guide is the topoi (literally "places to find things") also known as topics of invention. The topics are categories of relationships between ideas which help you discover things to say about a topic.

Grab one of the topics (some of which you should have stored away in memory in case of an "extemporaneous emergency"), and use it to quickly guide you in organizing and creating your ideas on a given topic.

One of the topics is "Antecetedent and Consequence": Given a certain situation (the antecedent), what is likely to follow (the consequence)? This often takes the form of an "if...then" structure.

Given the "why do you think we should do X" sort of question, you can grab onto the antecedent easily and work down, layer by layer with this structure. "If we do X, then Y will happen. If Y happens then our world will be good because of Z. Z is what will cause revenue to increase since..." etc.

The topics are questions you can ask of your topic, to dissect it and reconstruct it as a speech.

Right now, this same invention is at work. Given that I wanted to introduce the inventio, what answers does it provide?

Well, if you do not have a ready answer to a question, then you need some ready tools for discovering an answer. As such, you can rely on the ideas of rhetoricians past to help discover it.

Silva Rhetoricae is an excellent source for rhetorical tools, including the Topoi. If you have never researched the value of Rhetoric in your speaking, give this site a view. Take a look at the topoi and see how they will help the invention of your next speech.

How to Say it - Structure your speaking

Let's look at why and how you should structure your speech to best achieve your goals.

When you are speaking, just as when you are writing, you need to drop your thoughts, advice, ideas and observations into a structure - an order - that allows your listener to understand what you are saying and aids remembering what you said.

When you write, the structure starts as an outline. You take your main point and all of the bits and pieces that support it, order them, organize them and reorganize them - until you have fashioned a skeleton off of which you'll hang the rich fullness of your ideas and words. Ideally, your reader will use this skeleton to remember your words and ideas.

With speaking - particularly extemporaneously - you need a structure even more. The structure is a map to your thoughts and a filing system for the listener.

Important points about structuring your speaking:

The structure of spoken communication is different than written communication. Even if you aren't working from a prepared speech, you need to have a structure, for the benefit of your listeners. With the written word, you can use a list and won't need to repeat it, since readers can just look back at it. In a speech or conversation, there usually isn't a replay button, so you'd need to present and repeat the list as you go, to keep the listener up to date.

You also need a structure to help yourself as a speaker. When you are writing, you can review your words to make sure you have achieved your goal by the end. If you stray off your path, you can edit to fix this. No such luck with the spoken word. If you forget your goal and stray off the beaten path, you lose both yourself and your listeners. Your structure helps you to remember where you are and where you are going as a speaker

These differences between the written and spoken word means the structure of a great speech will make sure that the listeners won't need a replay button, and you won't walk away having missed your goal.

So much for why to structure your speech. How to do it is straightforward. I have learned a simple structure for speaking, which allows avoiding the pitfalls discussed a moment ago.

Here's the structure:

1. Tell them what you are going to tell them.
2. Tell them.
3. Tell them what you told them.

Start your comments by telling your listeners what you are going to be talking about. Summarize the goal you're headed for. Tell them what you are going to tell them.

Once you have warned your listeners where you are all going, take them on the ride, tell them what you have to say. This is the meat of your remarks. Tell them.

To finish review the goal and summarize how you reached it. Tell them what you told them.

This structure is simple, easy to remember and applicable to entire speeches, sections within speeches, short remarks - just about anything, including written words like these.

This organization allows you to repeat yourself, without repeating yourself. You take the outline or list of important points along with you through the whole speech, so that the listener can remember it without reviewing it. You give the listener advance warning of what is coming so that they can better understand what you are saying while you are saying it.

And you as a speaker have a much better idea of where you are and where you are heading as you speak.

I think that I have used many of these points in this very article. I tried to tell you up front that this is about how to structure your speech and why. Then I told you, using some repetition so that you wouldn't need to go backwards. And now I'm summarizing - telling you that the simple: Tell 'em what you're going to tell them; Tell 'em; Tell 'em what you've told them structure - is a key tool for effective speaking.

Persuasive Listening

Listening well is as powerful a means of communication and influence as to talk
well. - John Marshall

Most people think that sales is simply a process of talking until you persuade the listener to take action. Effective salespeople however, know to stop talking and simply listen. The best salespeople will listen and help you sell to yourself.

This skill needn't be used simply for the successful completion of a commercial transaction - it adds enormous value to all of the encounters you have during the day and makes for a better life. It's also an acquired habit.

How can you improve your listening? First, by admitting even the slightest possibility that you might not always listen with absolute effectiveness. So there is some room for improvement, however small. Commit to improving.

When you are serious about listening to someone, first be sure you turn to them and look at them. And look into the windows of their soul - their eyes. Remembering (and working) to look a speaker in the eyes requires you to focus your attention on the speaker.

Next is that little voice in your head, that can take you to where the speaker is heading or it can take you in a thousand divergent directions. Don't quash the little voice, the thoughts in your head, but focus them as you have focused your gaze - on the speaker. Get that little voice to work towards effective listening. Use it to remember your questions and organize the speaker's words for you.

Very often, I don't hear the questions about what other person has said, until after the conversation is over. This is what I like to call the "Columbo syndrome" (yes, after the TV detective). Usually, I was thinking ahead of the speaker or I was thinking about myself and missed thinking about and acting on the questions I was accumulating.

An example, me in the eternal quest of supremacy over the office copier - I'm currently losing:

My Little Voice (MLV): I really need to get this copied - I have to distribute it before people go home. &#%@!

Me: "%#@*! Jammed! Hey, Amy, how do you clear this?"

Coworker Amy: "You need to open the side of the copier and then it..."

MLV: I know you have to open the side in addition to the front, I've already looked for the jammed paper....

Me (interrupting): "Yeah, I've gotten the side open and flipped open levers A, B, C but I didn't see the paper."

Coworker Amy: "and then it tells you where it's jammed with either a red L.E.D. or on the display panel."

MLV: Why didn't I see any paper jam - is there another problem it could be having? It didn't tell me where it was jammed, so there must be another problem.

Me: "uh huh" I say as I poke more levers inside the evil contraption.

Coworker Amy: "See ya"

MLV: It tells you where it's jammed? Where?

Me: "Bye"

MLV: She's gone, how are you going to figure out where it's jammed? You could've asked Amy...

Me: "Grrrr"

In this little vignette, I hope you see that if I'd just focused on Amy, I would've heard her completely and asked the obvious question. The fact I interrupted her should've told me that I wasn't paying attention!

I should've pulled my hands out of the machine, looked at Amy and concentrated on organizing her thoughts in my brain, putting them in the places I needed to keep them organized. I needed to be "in the moment".

Other ways to focus on the other person:

• Reflect what you have heard - put the other person's message in your own words and check with the speaker that you have it clear.
• Check on your emotions - what do you feel right now? Does this go along with the speakers words? If not, you should probably acknowledge it, and in the flow of the the communication let the other person in on it as well. Remember that these emotions are playing across your face and in your body language - probably long before your little voice spoke up to you.
• Remember your questions as they come up and see if you get the answer without asking. If not, when it's a good time, ask!
• Think in terms of the other person. Above, Amy is thinking about trying to tell you how to clear the machine. She is not thinking about why I have to have these copies in five minutes. Remember that her goal is helping you unjam the copier - since that is what you asked.

In short: Remember to Turn, Look, and Listen.

This is a lifelong process, but the results can be immediate. People can tell when you're listening.

What?

The value of questions is endless. They can keep you looking smart and capable - as previously discussed - they can also make you more capable and smarter. Asking questions doesn't just provide new insights, ideas and facts from others, but can provide direction to your own thoughts as well.

When you communicate, somewhere, somehow you reach a decision that you need to say something. Getting to that decision is where questions - to yourself - provide enormous benefit.

Learn to ask yourself the fundamental question: "What do I want?"

This simple act is a tool for achievement, happiness, and direction in life. And it's not selfish to ask yourself this. Unless it's the only question you ask...

You have a reason for saying something, what is it? Do you want to learn, flatter someone, console someone, teach something, make people laugh, get a refund, avoid a conflict, or simply pass the time getting to know someone? What do you want?

Know why you are communicating, so you're better at answering the question of "How should I communicate this?" Write it, whisper it, send flowers, yell, grovel, or hold your tongue? How depends on what and why. Which you won't know, if you haven't asked!

One of the biggest advantages to writing over speaking is that it forces you to ask these questions. I knew that I wanted to share how important asking yourself questions can be. The tone and organization of this little monograph flowed from that answer. Once you've given this much conscious thought to what you want to communicate, you have fixed in your mind a goal and direction.

Moving that mind-set over to speaking is no easy task. If you don't already have a habit of asking yourself the "What do I want?" question regularly, well, it's an acquired taste. My brain seems wired to ask "how" questions and not the "what" and "why" types. In every arena of life, questions are more and more valuable and worth the time invested in making them work for you.

Remember:

• What do I want?
• What do I want to say?
• Why?
• How do I want to say it?
• When?
• Where?

When your life depends on effective communication

This is a link very much worth checking out. Dealing with the interpersonal communications skills of police and military, it provides insight to the importance of just how you communicate.

Listen here

As a speaker, you spend a lot of time thinking about the listener. But, how much time to you spend thinking about listening? How good a listener are you?