Geek Productivity Tough To Measure

Measuring productivity is difficult when it comes to IT security professionals and, in general, most IT geeks. It's not as bad as trying to measure the return on investment (ROI) for security products, but it can be difficult if you focus on the number of hours worked as opposed to employee output.A couple of things brought this to surface recently, but Ax0n's recent blog entry sums it up best (see "Open Letter from Geeks to IT Recruiters and Hiring Managers").

The first point in his blog is what I mentioned above: Try to measure productivity in terms of output, not hours. Ax0n's examples are that geeks automate, script, compile, and "summon computing power to get things done quickly on their behalf." This goes for all geeks, whether or not they're in security, but it's very important for security professionals. I don't know a single security pro who doesn't feel like there aren't enough hours in the day.

How do we as security geeks address the issue? We streamline and multitask as much as possible through the use of technology. I've found that to stay on top of security news and research, I had to take all the blogs and sites I've been reading and put them on my iPod Touch where I can read them on the bus, waiting in line, or feeding one of my babies. I do the same thing with podcasts.

In terms of getting jobs and projects completed, our programmer, Jim, scripts and programs more useful tools than anyone I've ever met. In the beginning, I questioned the amount of time he spent in the front-end of a project putting together a particular toolset, only to be amazed when I realized how much time it would save us not only on that project, but on several others. It's amazing what he has done for our team.

Ax0n's blog makes several other points besides productivity. One that hits home most in my experience: Assign tasks to the geeks who are most interested in them, not the ones with the most experience. It's a good read and could be eye-opening to you managers out there. Kudos to Ax0n for putting into words what many of us have felt for a long time.

John H. Sawyer is a senior security engineer on the IT Security Team at the University of Florida. The views and opinions expressed in this blog are his own and do not represent the views and opinions of the UF IT Security Team or the University of Florida. When John's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading.