 |
 |
 |
Hack Social Engineering to Build Effective Teams
(Interview with Olivia Liddell, Amazon Web Services, Technical Curriculum Developer)
Building an effective engineering team is a challenge for every manager. No matter how great a job you do as an engineering manager, there is always more you could do to improve your team.
The idea of social engineering is mostly used in information security by the attackers. But good guys can use social engineering as well—in this case, to improve your engineering team.
Olivia Liddell from Amazon Web Services reveals how to utilize social engineering tactics to make your team more effective. Enjoy these valuable insights thanks to our lovely host, Karolina Toth.
You will learn:
- What makes a strong engineering team
- Indicators
- How to measure the strength of an engineering team
- The questions to ask
- Psychological safety
- The process to make your team stronger
- Incremental gains
- Constant reflection
- The definition of social engineering
- The process of using social engineering to build your team
- Observe
- Make a plan
- Start small
- Keep observing and adjust
- What's in it for them?
- Let go of your expectations
- Example of social engineering in a positive context
- Common mistakes when using social engineering in management
- Judging too quickly
- Assuming you have nothing to learn
- How to start using social engineering with a brand new team
- Real life example
- Possible conflicts when using social engineering tactics on your team
- Problem: People may think you're spying on them
- Solution: Be transparent
- The timeframe you need to successfully use social engineering
- Observe for at least a few weeks
- Be aware of the timing
About Olivia Liddell
Olivia Liddell is a technical curriculum developer at Amazon Web Services working on training materials for people who are looking for various AWS certifications. She started her career as a teacher in middle school. She’s currently using this experience in the tech industry to help people become better at mentoring, communication and team building.
What makes a strong engineering team?
Set realistic goals
Don’t think that a strong team is the same as a perfect team. I often see managers shoot for perfection without realizing how strong and capable their teams are.
Indicators of a strong team
In my experience, the strongest teams have a few qualities they focus on, like the following:
- Being open to change.
- Incorporating regular reflection as part of their processes.
- Empowering team members to initiate changes.
This way initiatives can come from any team member. This is usually one of the best indicators of a strong team.
How do you measure the strength of an engineering team?
It’s hard to measure because different teams have different makeups, purposes and goals. Let’s start with a general example of figuring out how strong a team is at a given moment.
You should ask these questions:
- How well does communication work in my team?
- Are there things we don't want to talk about?
- Are people open to receiving and sharing feedback?
- How efficiently can my team get things done?
- How often do new initiatives come up against roadblocks?
When you ask these questions, you can back up the answers with data, which gives you a way to assess your team. Then you can come up with a strategy to move forward.
Click here to learn about creating an open feedback culture like GitHub's!
Look at psychological safety
Psychological safety and trust at Amazon are part of our leadership principles we call “earn trust.” It comes up as early as the hiring process, during on-boarding and when new hires start working with their teams. For us to be able to work together, you have to earn trust, and a big part of that involves psychological safety.
Imagine that you need to ask someone in your team for help. Before you go to ask that person, do you start to wonder if you can trust them? Do you feel that they'll hear you out and help, or do you feel that they're going to judge you or criticise you?
This is why psychological safety matters.
If you're part of a team that doesn’t foster psychological safety, you can end up with team members who need help but feel like they can’t ask for it. Then your team is in a bad place.
Click here to learn more about psychological safety from this interview! (Podcast + Blog post)
What is the process to make an engineering team stronger?
Aim for incremental gains
The best strategy I can recommend is to make small, incremental changes rather than trying to change everything at once. The changes should be backed with data, so if you aim to improve your team, use metrics to measure it against, to see if your efforts are successful.
Always reflect and refine
While carrying out your action plan, always reflect and refine. When you pair incremental changes with leaving room for course-corrections, you can repeat what works and improve what doesn’t as you move forward.
For example, in project management processes, you can benefit a lot with small changes. There is a temptation to change everything at once, but slow and steady wins the race.
How do you define social engineering in the context of managing an engineering team?
The definition of social engineering
The definition of social engineering is any act that influences a person to take an action that may or may not be in their best interest.
You often see examples of this in information security.
An example of social engineering is when a person is trying to get into a physical building by manipulating the receptionist to get past the front desk, or calling tech support to get them to give out information they shouldn’t.
I was learning about social engineering, and developing an idea for a team building conference talk, when I realized that the two work well together.
Use social engineering for good
Many parts of social engineering can be applied in a positive context. People look at it as being manipulated into doing things they didn't choose. What makes social engineering a powerful tool in security is exactly why it should be leveraged to make improvements within your team.
Click here to learn about managing your team to maximize happiness!
How to use social engineering tactics to build a stronger developer team?
Observe carefully
The first part is to observe.
Many trying to improve their team fall short in this, because they assume they already know everything about their team. So, why take time to look and see?
Before social engineers try to execute their plan, they sit back and watch. They look for patterns.
Once you've figured out the patterns of your team, you can see what needs improvement.
Make a plan
You might see a communication issue within your team. Let’s say the senior members of your team aren’t sharing knowledge with the juniors. First, you need to develop a plan.
Start small
Start with quick wins. Don't try to change everything at once, but in the case of social engineering, start with small goals. Even if you don’t get what you want every time, you make progress, which can lead to bigger wins.
Observe continuously and resolve conflicts
Keep observing to see how and why your team members respond to change. If conflicts arise, use what you’ve learned about your people to get them to buy into the changes.
Click here to learn more about handling conflicts in your engineering team! (Podcast + Blog post)
What’s in it for them?
Think less about why you want a change and more about what's in it for your team members. Why should they do what you want?
A lot of it comes down to empathy, as you need to be able to see things from another person's perspective.
Let go of your expectations
To observe well, you need to take a step back and really see how your team members interact. Understand what motivates them to do their job well, and how this might change.
A possible issue may be that some people observe something once and assume it will always be like that, regardless of context.
For example, I see John volunteered in a meeting today, so I conclude that he'll always volunteer. Maybe he will, but I should observe him in other settings too. Maybe John volunteers when he's working with immediate team members, but in a larger team, he’s less open to volunteering.
Just imagine, if you’re an attacker and want to get valuable information, you’ll take your time, even if you know a lot about your “target.” This is the key to success in social engineering.
It’s the same for managers who want the best for their teams. This is the most difficult part of the process, because you may feel like you already know everything about your team. There is value in having experience with them, but take your time, take a step back, and let go of your expectations.
Do you have examples for social engineering in a positive context?
Here is one from a previous job.
I used to work in higher education as a learning technologist with online courses for universities. I was on a team with 12 different program directors from areas like accounting and healthcare. I needed all program directors to give me information to get their courses up and running.
I had communication issues
Some directors gave me what I needed right away, but I had to track others down and work hard to get them to give me what I needed. As you might imagine, this resulted in delays, and I had no idea why they made it hard for me.
Then I looked at it from the social engineering perspective. I started thinking about why these different directors would want to give me what I needed.
I tried speaking their language
The director of the accounting program was always difficult. I knew from my experience with her that her mindset was very analytical. Next time, when I needed to follow up with her to get the information I needed, I included a few data points.
I told her we were working with a hundred different course sections, and so on. I was appealing to the way she thought and what she needed. Once I gave her all that data, I was speaking her language, and she gave me what I needed.
If I had done the same with the special education program director, I would have missed the target. She was all about the caring side of education and learning. To appeal to her, I emphasized that getting me the information earlier gives me more time to provide hands-on assistance to the people who need it.
Understanding and appealing to their interests worked like a charm.
It’s the same approach as a cyber attacker.
Attackers think the same way
Let’s say I want to get somebody’s password, and I know they’re into bicycling. Then I can talk about cycling, send them links to cater for them in that regard, but I get their password in the process.
The only way you can cater to your people is by making observations, and realizing that they're different. It takes extra time and effort compared to using the same approach on everyone.
I could send out one email or make one announcement. Some people will do what I ask, but others may not buy into it. So, when you bring in new initiatives, keep in mind what motivates your people, and how you can get them to feel good about a decision.
Show them that your reasons relate to their motivations.
What are the common mistakes when using social engineering tactics in management?
Judging too quickly
Don't make an assumption based on a single observation. Always give your people the benefit of the doubt. You might catch someone on an off-day.
A person may not be as open to sharing feedback when working on their own project with full focus. If you look at them that day, you may think "They never want to talk to anyone, that's the problem! I need to fix that.” Remember, it's a single day, so keep looking for patterns and trends.
Assuming you have nothing to learn
Another big mistake is assuming you already know everything about your team. Take a step back and look at it from another angle anyway.
How to use social engineering tactics when managing a new team?
When I was going to my teacher training mentor program, it was me, another teacher in training and our mentor. The three of us were teaching classes together.
I really appreciated that my mentor teacher sat all three of us down at the start of the year, and we talked about our preferred working styles and discussed questions like:
- “What do you enjoy most about our team and your role in it?”
- “What motivates you?”
- “How do you prefer to be communicated with?”
- “How do you prefer to handle conflicts?”
These group discussions help to normalize things. Everyone can share what they're comfortable with.
So, it isn’t just the one person who doesn’t fit who needs to be asked what they need. The benefit of a sit-down conversation like this is that others take notes, and then you have a baseline before your observations.
Here are some examples
For example, “Mary told me that she's motivated by facing technical challenges. I've noticed that the project she's worked on recently has been easy for her, so she may lose interest. What can we do to fix that?”
The key is to do this before you have a conflict, because then the dynamic of the team will be tense. This is a way to build trust and to create psychological safety.
Another example is that if a big change is coming up, I prefer to have a heads up before the meeting, so I can think about it and process it. Others like to learn everything on the meeting, so they don’t add another stress factor to their busy schedule and spend extra time preparing.
The only way to learn these differences early is to ask.
You can't accommodate everyone with every preference, especially if you have a large team. It still helps to create trust and psychological safety for team members to know that their manager cares enough to ask.
Small things like this mean a lot.
What are the common conflicts caused by social engineering?
Problem: Some may think you’re spying on them
If a social engineering approach to team building is not handled well and with good intentions, you can end up making your team members feel like you're spying on them. It’s a fine line to walk, so you may want to include them and establish what you're doing and why.
Solution: Be transparent
Say something like, "Hey, everyone! I just want to let you know, I’ll be looking to see how we interact with each other so I find specific things that we can work on improving.”
When you make your reasons clear, your team will trust you more. If your team sees you scrutinizing their work and micromanaging without taking actions for improvement, you’ll lose trust quickly.
What timeframe do you recommend when trying the social engineering approach?
It depends on what you’re trying to change.
If you want to try social engineering tactics, don't pull issues out of thin air and say, "I want to fix this!" Instead, ask yourself what your gut tells you about what could be improved in your team.
Take a couple of weeks at least
Let’s say you feel like knowledge transmission could be better. Start with an idea in mind and tailor your observations based on that. Take a couple of weeks at minimum to observe and watch, especially if your people work remotely.
For example, someone may be talkative when it comes to being in a chatroom, but when it comes to voice calls, they're quiet. This isn’t right or wrong, but what are you noticing there? In cases like this, give yourself a couple of opportunities to see this happen under different circumstances.
Make observations at less stressful periods
Also be aware of the timing. You’re likely better off making these observations during less stressful times.
Team members may put themselves on their best behaviour because you tell them you’re watching. Others may make a mistake or two. Others may want to change their behavior, and this push was all they needed. That’s a win-win!
The longer you observe, the more likely you can tell what behaviour is regular. This is why it’s important to make sure you get multiple data points before acting on anything.
Bonus advice
The only other thing I’d add is to have fun with it. I hope anyone who decides to try social engineering tactics sees this as a helpful approach for the improvement of their engineering team.
What You Should Do Now
👉 If you are serious about becoming a great engineering manager, you should subscribe to our newsletter or download the state of software development 2020 report.
🚀 Need developers for your team or project? Hire our experienced Angular or Node.js developers! Click here for a FREE consultation.
About the author:
Gabor Zold is a content marketer and tech writer, focusing on software development technologies and engineering management. He has extensive knowledge about engineering management-related topics and has been doing interviews with accomplished tech leaders for years. He is the audio wizard of the Level-up Engineering podcast.