Revolutionizing Cybersecurity

Good afternoon. I'm really excited and humbled to be speaking to you again today. Thanks for that. I hope you're all enjoying yourselves. I know I have.

We'll be talking about revolutionizing cybersecurity, or at least the approach that we took within NXP. Before we start, this will not be a technical talk about cybersecurity. So whoever thought that this would be technical, it's a good time to leave, but you're more than welcome to stay.

My name is Saki. I work as portfolio manager within NXP Cybersecurity, within the IT department, which basically means that I lead all the IT projects that we do that are cybersecurity-based.

NXP is a company that creates semiconductors. Semiconductors are typically the microchips that you find in a lot of devices, practically all of the devices. We are, in principle, focusing on four markets. The first is automotive: think of the radars that you have on cars, braking systems, airbags, everything that is basically electronic in your car. There is a very big chance that we produced a chip that's in it.

Second, we are very big in industrial and IoT: robots, sensors, and similar technology. Third, and maybe much closer to ourselves, we create a lot of microchips for end consumers and mobile: mobile payments, wearables, passports, payments, smart thermostats, smart lighting. The last market is communication infrastructure. The most recognizable is 5G; we are a major player in 5G antennas and also in 4G and so on.

I want to break this talk into three major pieces. First I'll sketch a bit of context. Then we'll go into how we retrained our champions. The last is a gift from myself to you, because you're the best audience ever, obviously. The sooner I stop, the more room we have for Q&A.

First, context. What are some of the words we think of whenever we think of high tech? NXP works in the high-tech industry. Nobody shouts? Let me do it for you. High tech is high-paced, focused on the future, lots of innovation, lots of highly skilled engineers, lots of money, and lots of secrecy because stakes are high. We have lots of IP to protect.

High tech is also an industry focused on the future. It will bring us AI, IoT in our houses, self-driving cars in the near future, and so on. But there is also a lot of mystery because it is behind closed doors, and there is a very valid reason for that. It is also very high-paced because the pace at which technology is moving is incredible.

Having said that, we are not immune to reality. We are shifting generations: Gen Z and millennials are coming our way, and top-down Leadership 1.0 does not work anymore. You cannot shout to Gen Z and say, "Because I am at a certain position, you need to do X, Y, and Z." That does not work.

We want to enable champions, the engineers who work today for NXP. We want to enable them to do their best job without burdening them in all kinds of administrative tasks. They should do what they do, in which they excel. We also do not want to install a rigid framework. We should create a framework that allows our champions to excel, and then it is our problem how we get the data out and consolidate it.

We are seeing that factory-like setups as we knew them are gone. Leadership 1.0, where someone screams because he has a certain position, is also gone. We are trying to get rid of silos. Silos do not work anymore. That means we need to retrain our managers and leaders. Not only managers and leaders: we need to retrain the entire company. We start small and tightly; we start tying the knots and progressing.

Let me move to retraining our champions. Does anyone recognize this guy? No? This is Chuck Yeager. In 1947, scientists said the sound barrier could not be broken, and they said they had hard data to prove it. They said that if you tried to break the sound barrier, either the pilot would dissolve, the airplane would dissolve, he would lose his voice, or other crazy things that were believed at the time.

Chuck set out on a mission to prove them wrong. In 1947 he broke the sound barrier for the first time. A couple of weeks later, he did it again. Six years later, he flew Mach 2.4, 2.4 times the speed of sound. When they asked him how the flight was, he said it was actually a disappointment, because the faster he went, the smoother the flight. There was actually no hard barrier. The only barrier was in our minds. The same holds for this new way of working and cultural shift. We have mental barriers that we need to overcome.

How do you overcome them? We have three options: fight, flight, or freeze. Freeze is not a good option whenever there is a tiger approaching you. Fight is the best option, and flight can be if you're a good runner. We opted for fight. Fight means action. How do you get people to fight and take action? You communicate very well. You talk to people because you need to know intrinsically what motivates people to get them moving. You need to communicate your purpose and work on that.

To communicate purpose, you need to work on your self-awareness as a team. What are we actually trying to accomplish as a team? Not because some manager says so, but because the team actually says so. At a certain point, we had several internal meetings and offsites where we said, "Let's look at what we did in the past." We drew a line in the sand and said, "No more of this. No more negativity, no more complaining, no more 'this doesn't work,' no more 'we tried it before but we are a special company.'" We stopped with that and started with a fresh sheet.

Important to remember is that whenever we are talking change, all change is emotional. Everyone says people do not like change, but I bet everyone in this room likes change. Nobody has a phone with a cord anymore at home. Everyone uses smartwatches, smartphones, and whatever. Everyone likes the change that they actually like. Nobody likes to be told that they need to change, but everyone likes change if they like it themselves. People want to change. They do not want to be changed. That is the difference.

Where does this change come from? It comes from introspection, listening, and setting a path together as a team. The first part is introspection. We need to figure out what we actually want to do as a team.

A lot of times people focus on what needs to happen and how it needs to happen, and they forget the who part. The what and the how are pretty easy because we will figure them out, especially with technology. But if we do not have people on board, we will fail. We will eventually fail.

This is Mr. Taylor. He lived in the 1800s, but he is still influencing our work today. He worked together with Mr. Ford to define the factory-like setup and many management rules that, strangely but truly, still hold today. He has a famous quote that I do not agree with at all: "In the past, the man has been first. In the future, the system will be first." That is totally opposite to anything I believe today and anything we are seeing today.

What I believe is that knowing yourself is the beginning of all wisdom. We need to start working on culture. Culture is not something we can plan. Culture is something that emerges. We can set out the framework and set up certain milestones, but we cannot say that by a certain date we will have achieved a certain level of culture. Not possible.

How do you build culture, and what is culture? There are a lot of definitions. If you ask ten people what DevOps is, you will get ten answers. If you ask ten people what culture is, you will get ten different definitions. I found a nice one by Seth Godin: "People like us do things like this." I like it.

As a team, we need to become self-aware. We need to be honest and candid about our strengths and weaknesses. Everyone has something to offer, but we need to be honest about what we have to offer. We need to be conscious of weaknesses while doubling down on strengths instead of focusing on weaknesses and trying to improve them. It starts with us.

Once we have figured ourselves out, the next step is to define a route. We need to know where we are going, the Northern Star we are aiming for with the team. We need to be super clear on our ambitions, values, and principles. We worked a lot, honestly a lot, on making our values and principles as crystal clear as we could.

Together with that, we established a backbone of rituals that would help us keep the momentum going. We need to become more proactive and get out of reactive mode. Reactive means we are always reacting to whatever reality brings us, while we want to be in a position where we can work on important stuff and not urgent stuff. If you leave anything long enough, it will become urgent by default, and that is not what we want.

Together with the team, about 20 people, we drew a blank sheet and asked how we should be organized. We reorganized the teams, but everyone had influence in that. We now have three major pillars and one horizontal that is cross-team. We removed unnecessary chains of command: no more asking a manager for approval, going up and down, and losing time waiting for someone to approve something. If it makes sense, we just do it.

Our teams are empowered to do, and that is incredible for speed because it also puts accountability with the teams. Accountability is not with the managers anymore; we put accountability where it should be, spread around in the team itself. We know things will go wrong and break, and we anticipate that. When something breaks, we expect teams to come up, be honest, explain what happened, why it happened, that they investigated it, know the root cause, fixed it, apologize, learn, and move on.

By instilling accountability within teams, they also have a desire to experiment, learn, and get out of their safe harbor. We see teams putting in hard work and avoiding blame, and that combination is magical. We are getting explicit about our principles and how we want to work. It is clear why we make certain choices, where in the past it was not always clear. Now it is documented, clear, and there. We need to start with figuring ourselves out as a team, what we value. We need to focus on the who, not the what and the how.

This is one of my favorite slides because it talks about skills that I believe will be tremendously important going forward. Speaking about Leadership 1.0, this is Leadership 2.0. Leadership 1.0 was paternal: "I'm the big boss on the hill." This is maternal, softer, what we call soft skills, but I believe they will be life skills going forward. We have empathy, self-awareness, and perspective.

You need to figure yourself out, not only as a team but also as a person. What do I actually want to do? You need to develop a level of empathy and connection with the person you are interacting with; otherwise there will be no change. You also need perspective. You need to put yourself in someone else's shoes and see the world from their view. That is not something many people, and certainly not leaders, do.

As leaders, we need to create safety for people, and we need to create liminal space: a space for teams to experiment. With liminal space, I mean this is what we have today, this is where we want to go, and in the space between, we should allow teams to experiment, not according to your rules, but according to whatever the team comes up with.

When we have empathy, self-awareness, and perspective, and we connect on a real level, then we have trust. Trust is not something you can enforce. I cannot say, "Trust me, I know what I'm doing," because you will say, "I don't know you. We have never connected." Connection is not something you can put a date on. Connection needs to develop by talking to people, actually caring about people, and putting marbles in a jar in that emotional bank account.

What should leaders do to create trust? First, they should listen, and really listen. There is a difference between listening and listening. We should listen to employees and ask questions because employees mostly have the answer to what needs to happen next. They are there with their feet on the ground and know what is happening on the floor. But we need to be willing to hear the answer. The answer will not always be nice for leaders and managers, but it is what it is.

Second, we need to step out of our ivory tower. Even as leaders and managers, we need to put our feet on the ground. We need to be wherever the employees are, wherever the customers are, wherever the real stuff is hitting the fan. We do not need to micromanage; there is a big difference.

Third is meritocracy: give your best people the ability to shine. Promote your best people faster than other people. Do not make your best people leave because you are not acting on what they achieve. The last is ownership: live with your decisions. If you make a mistake, great, learn from it and move on. There is no point in dwelling; just move on.

How do you know as a leader that you are doing okay? An audience member says the product gets built well, and the people invested in that product want to support it going forward. Exactly. And the missing part is when you are not there. You know it is going as it should when everything is going, but you are not there; when the team is living and building on the culture when you are not there. That is when the team is living the culture. That is one of the biggest rewards you can get as a leader: you can move away and see the team being successful.

As leaders, we need to enable teams to do their best work. We need to remove barriers and let the team live up to their potential. Ultimately it is about speed. We build this culture to generate speed. Speed is one of the biggest variables, especially today and in the high-tech industry. You build speed by enabling teams and avoiding negativity, politics, and all that stuff. Politics is one of the biggest poisons within teams because people become afraid to speak up and afraid of meetings with certain people. Cut it out; the sooner we cut it out, the better.

We build great culture as leaders by talking to people. We need to know from everyone what motivates them every day. People may say they have 30 or 100 people reporting to them. That is great; it means 100 lunches planned, and we know what people think. Not everyone cares about the same stuff.

This is a slide by Dame Minouche. She said that in the past, jobs were about muscle; now they are about brains; and in the future, they will be about the heart. I think the future is here. Not a lot of people see it yet, but we are actually living it. Not everyone sees it because many managers and leaders focus on the short term and quick gains. If you take a step back and focus on the long game, it is already here. This is something we can do today.

Legacy matters. What we give to the team matters if we know what we want to accomplish, if we are self-aware. Behavior matters. Intent matters. Positivity matters. Optimism matters. How we treat other people matters. We need to keep going. We need to create more space and safety for teams. We need to create more of that backbone. We need to enable the teams, and we need to stop comparing ourselves with others. It is a human trait: my neighbor has this, so I want this; Company X did it like this, so we should also do it like this; Company X adopted framework Y, so if we do it, we will achieve the same. Bullshit. We will never do the same. We need to compare ourselves to where we were yesterday and make sure we are progressing.

How do we create a culture that gets better and more resilient every day? Through one-on-one engagements with our team, active listening, collecting the data we actually want, and making decisions based on that. That's it.

An audience member asks about documentation when moving fast, and how to encourage people who might hate writing things up and documenting their thought processes. Saki says it depends how you define documentation. NXP has the same issue: there is a difference between going very fast and making sure everything is documented. They got rid of a lot of documentation because much of it was legacy and did not make sense anymore. They are also writing in a much more condensed way. They are not all the way there and not everything is up to date, but they have processes in place to regularly review documentation. Teams are accountable for processes and documentation. Cybersecurity does spot checks, but does not enforce it.

Another audience member asks how to balance DevOps speed with security not leaving giant holes. Saki says they do it in two ways. First, they automate a lot of controls so controls are automatically there from the beginning. Second, as a cybersecurity department, they play a consultancy role, with people deployed throughout the company. Whenever there are big projects, security is one of the mandatory checks. Security approval is one of the mandatory checks. They have enforced themselves to be there from beginning to end. Even if people think security is cumbersome or a pain, it needs to happen and needs to be part of the process.

Saki then shares the gift. Once upon a time, there was a king who had a habit of giving his people a gift on his birthday. In a special year, he was turning 50, and he asked the wise people, philosophers, scientists, and others to collect all the wisdom of the world so he could give his people the gift of knowledge. They went around the world and came back after eight weeks with a room full of books, papers, and data. The king said it was too much to hand to his people, so he asked them to summarize it into two pages. They did. The king said it was fantastic, gold, but still too much. He asked them to summarize it in one sentence, in ten words of two letters.

Saki asks whether anyone knows those ten two-letter words. He has it on his wrist and asks Isaac to come up. Isaac reads: "If it is to be, it is up to me." Saki repeats: "If it is to be, it is up to me."

What Saki wants to say is that if you take all the lessons learned so far, everything you learn today and in the future, and do nothing with it, this was the biggest waste of time. If we want something to happen, it is up to us to make it happen. We need to action. If we want to change the culture in a company, we need to step up and make it happen. If you take what you learn today and act upon it, you have a chance of changing it. That's it, and that's my gift to you.