What Andrew Luck’s retirement can teach infosec leaders

Information security is a team sport. We need to work with our fellow players and coaches to advance organizational objectives and defend against risks by using a series of schemes on both the offensive and defensive ends. Football is the best sports analogue we have found. We believe that engagement on all levels to address customer needs is paramount.

Information security is looked at differently than other teams. We have higher expectations of trust, customer service, engagement and service delivery due to the sensitivity of our jobs. We are under a magnifying glass compared to other teams because of the wide-ranging effects of our work. We need to help others set the example and lead, even indirectly, because of that. We are offense, defense and special teams, and we help the coaches set the schemes. We also need to make sure we are a team that can be approached by anyone and trusted, without customers worrying about any bias. If our customers think we are biased, they won’t approach us, and we will have failed our primary mission of helping reduce risk.

We need to be doing this because our patients and team members put significant trust in our team. We don’t deal with many of them on good days. We have to help them through significant times in their lives. This includes having to personally counsel team members on what to do when they are victims of identity theft, data breaches, or system compromises. It’s not an easy job, and one we take very seriously. Our customers depend on us to guide them through mitigating risk in the business and in their lives, and we respect that immensely.

However, the reward of contributing to a great organization and helping them move forward while observing the mission and values makes it worth it. When we have an example from football that we can use to illustrate how to manage to our mission and values, we’re going to take the opportunity to do so.

Andrew Luck and his retirement

Andrew Luck is a legend in Indianapolis. In addition to being a great NFL quarterback that succeeded Peyton Manning as the leader of the Colts, he has done a significant amount for the community. His most impactful work has been with Riley Children’s Health, which is part of Indiana University Health. Not only has he been an active sponsor, he’s been part of Change the Play, where he partnered with Riley Children’s Health to show kids how to exercise and eat healthy. He has also been the face of many fundraising campaigns. Like Peyton Manning, he’s done a significant amount for the children of Indiana.

His retirement at the age of 29 shocked many people. According to the Washington Post, he suffered a myriad of injuries, including missing the entire 2017 season because of shoulder surgery. The tipping point was a calf and ankle problem that hadn’t fully healed. What had started as something fun became something else, and the cycle of injuries caused him to want to walk away. He made the decision several weeks before his announcement. He walked away from potentially hundreds of millions of dollars of future income from playing and endorsements.

Numerous former NFL players spoke out for and against his decision. Troy Aikman, who is most famous for leading the Dallas Cowboys to three Super Bowl victories, tore apart Fox Sports 1 commentator Doug Gottlieb for his calling Luck’s retirement “The Most Millennial Thing Ever”. If there is any quarterback that understands what Luck went through, it’s Aikman. He suffered ten concussions during his career and numerous other injuries including back injuries that contributed to his retirement.

While he enjoyed one of the best supporting casts in NFL history due to the Herschel Walker trade with the Minnesota Vikings, and an offensive line that also ranks as one of the best, he still took a lot of hits for those victories. He called Gottlieb out, asking him “What qualifies you to decide how someone should live their life?”

Steve Beuerlein, a former NFL quarterback who played with Troy Aikman and the Cowboys among several other teams, and who has admitted having 19 surgeries during his 14-year NFL career, considered his decision “not right”. He also said that he let his teammates, fans and the entire NFL down with it. This opinion was not shared by the vast majority of NFL players, including six-time Super Bowl champion Tom Brady.

What our team discussed

This was a point of discussion with my team, as this came up during a talk we had. One of our team members, who spent many years as a radiology tech before moving into information security, discussed several contributing factors. She indicated, along with other members of the team, that the former Colts general manager, Ryan Grigson, had not invested in an offensive line to protect him, and allowed him to get hit more than any other quarterback. One of our other team members also concurred. This is the opinion shared by many people in Indy, and especially on sports talk radio here.

She also brought up how he probably didn’t want to be forty years old and not able to move around without pain. After Luck’s retirement announcement, numerous stories came out in the news media about former NFL players who are suffering immensely from injuries and conditions from their playing days. This led to a discussion about how there have been numerous cases of former NFL players taking large amounts of painkillers, specifically Brett Favre, due to their suffering.

4 key lessons

What lessons can we learn in information security from these issues?  We have four here we can discuss that his retirement brings up. First, we have someone who walked away from doing something they loved because their heart wasn’t in it. We can also discuss the importance of having a good protective supporting cast for our team members, avoiding burnout and providing good career development and making sure that we avoid stressors that can cause people to disengage and cause issues with their personal lives.

1. Sometimes a change is the best thing

Sometimes the best thing we can do as a leader is to realize that no matter what we do, we can’t fix it when someone’s heart or mind is not on the work and they want a change. Sometimes people just want to walk away. Sometimes it isn’t a good fit between the team member and the rest of the team. People change, evolve and grow. Their interests, needs and wants are different than before. That isn’t something to be looked down upon. Exhortations to stick it out or to conform aren’t going to fix the situation all the time. We need to realize and understand when there’s an issue, and respectfully address it for everyone. Team members deserve respect as people, even when there’s differences. The most respectful action we can take is to help someone positively make a change, rather than demonize them for it like Steve Beuerlein did. Actions like his cause fear and further disengagement, and can destroy a team, which is counter to the intent.

2. Build a good supporting team

We can help address the issue of someone’s heart by making sure we have a good supporting team. We need to make sure we have team members that are appropriately managed, understand their role and are able to contribute. We need to defensively structure our teams so that we have roles that protect each other, not just do tasks. Ultimately, we are not judged on what metrics we meet, but how we accomplish our tasks to meet the mission and values of the organization.

We have a guiding statement, which is to address information risk management as part of standard business, and to support the mission and values of the organization in doing so. We incorporate that into every decisioning process. Having a good supporting team means that everyone understands this, and that we build our teams to not only support each other, but the rest of the organization.

If you build to support one area or specialty without that focus, you will cause imbalances, which will lead to further issues. It’s critical to keep that focus. One item senior leadership will always ask is whether or not the decisions you make improve the organization and adhere to the mission and values. Having a good team that supports each other helps.

3. Avoiding burnout and developing your team

To keep that team, you need to make sure you don’t give work to the point of burnout, set realistic expectations, and set realistic expectations of leadership of what can be done. Being the type of manager who sets deadlines or makes decisions without speaking with all stakeholders means you shouldn’t be one. There are too many managers that set arbitrary deadlines or take actions to make themselves look good. If you don’t manage to reality, you’re not managing to the mission or team. When you do that, you’re going to lose them and lose their hearts.

You also need to constantly communicate with your team. Career development isn’t just sending someone to a class or a program to learn something. It’s about making sure everyone has a series of positive experiences that help them build knowledge and the ability to do better. While classes are a quantitative method of doing so, you need to defensively structure and provide opportunities for learning and development as part of that.

If you don’t talk with your team, you’re not going to be able to develop them. If you don’t give them experiences to help them improve, they’re going to lose heart, and you’re going to lose your team. Communication isn’t about exhorting them to sacrifice themselves for the good of the organization despite personal suffering. It’s about listening and making sure that they are (not feel) supported. If they are supported, they’re engaged. Perception or feelings do not matter. You either do it or you don’t.

4. Avoiding stressors and sacrifices

A major part of that is helping avoid stressors that cause disengagement. The workplace is tough by nature. We have many competing priorities. We have to deal with a wealth of opportunities and limited resources to achieve success. There are much more vulgar terms involving fitting items into five-pound bags, but we’re not going to go there. We need to actively manage the stressors that others either voluntarily or inadvertently introduce.

Situations do not work themselves out. We need to understand and accept that. The more we allow stressors in the environment and don’t actively fight them, the more we cause issues for our teams that lead to disengagement and potential issues with their personal lives. You should not be thinking about how much you can get away with, but how you can manage the work you have to allow it to get done in alignment with mission and values without causing disengagement in the process.

Don’t allow people to sacrifice themselves or their personal lives to meet a goal someone set. Don’t allow your team members to hurt themselves to look good or make you look good. Show them there’s a better way. Be the better way. Don’t set goals you know people won’t reach so they do more to meet your expectations. You’re going to cause cascading issues in people’s lives that are going to be much more damaging than just engagement in the job if you do this. Andrew Luck sacrificed his health and well-being, and it caused him to not be engaged, and leave the sport he loved.

Good…luck?

Andrew Luck exposed divides in both the NFL and management. There are many people who understand the gravity of his decision and why he did it. There are also others who think that he let others down by retiring and did not comprehend that he was disengaged after years of injuries. Wearing injuries and sacrificing your well-being to say you did something isn’t something to aspire to. It can cause cascading issues outside of the workplace. The former NFL players who need help to complete basic life tasks are an extreme example.

Setting an example of expecting teams to continually work or hustle far beyond anything acceptable is going to lead to eventual disengagement and walking away. Andrew Luck succeeded despite being hit more than any other quarterback, and through injuries that would have left most of the peanut gallery that booed him on the floor in pain.

We need to learn from him to set the right expectations, build and manage our teams, meet our mission and values, plan well, constantly communicate, constantly develop, remove stressors whenever possible, and don’t allow others to hurt themselves to make yourself or someone else look good. We also need to learn that sometimes people change and walk away, and that it’s not something to disparage, but to understand and respect.