Laying blame when things are going wrong

I need to rant. Specifically I need to rant about last week's little Internet worm problem . . . . Here we had a vulnerability that many argue should not have existed in the first place, that was identified and a patch generated, that the world was told about and still, months later, some 500,000 machines on the 'Net got bombed by a worm that exploited that same vulnerability. This is crazy!

Or is it?

If you read the commentaries in all the serious IT journals you'll see the usual roundup of suspects: Microsoft for leading us down the path of unrighteousness and making us use their products, the sysadmins who neglected to apply the patch, the 'Net for fostering the environment where this could happen . . . blah, blah, blah.

To continue reading, register here and become an Insider. You'll get free access to premium content from CIO, Computerworld, CSO, InfoWorld, and Network World. See more Insider content or sign in.

I need to rant. Specifically I need to rant about last week's little Internet worm problem . . . . Here we had a vulnerability that many argue should not have existed in the first place, that was identified and a patch generated, that the world was told about and still, months later, some 500,000 machines on the 'Net got bombed by a worm that exploited that same vulnerability. This is crazy!

Or is it?

If you read the commentaries in all the serious IT journals you'll see the usual roundup of suspects: Microsoft for leading us down the path of unrighteousness and making us use their products, the sysadmins who neglected to apply the patch, the 'Net for fostering the environment where this could happen . . . blah, blah, blah.

You know whose fault it is? Ours.

We insist on spending the least amount of money to buy products; we don't demand high enough standards of vendors; we don't invest enough on testing and integration; we don't pay IT staff enough or give them enough time to make sure the implementation is sound and at the same time insist on and expect perfection. What's more, the IT staff doesn't make enough stink about poor practices and decision making.

Are we all nuts?

Let's be clear: Every decision has a price. The more off-the-cuff the decision, the greater the risk. The more considered the decision, the more cost involved. Everyone who has been in business for more than a few months knows these are true statements and they know that the art of business is about finding a balance between risk and cost that is acceptable.

The rub

But there's a small problem.

The small problem is that we all, techies and suits, consistently underestimate the risk. We think we're bold, that we're tough and ready to deal with come what may.

This is not a good stance. It is not good because if we really were that bold and tough we'd stop being surprised every time things went wrong and we'd stop whining about it being someone's fault.

You know what we'd do if we were bold and tough? We'd laugh. We'd shake our heads and say, "How about that?" We'd see it as a lesson learned and we'd modify our behavior accordingly. We'd profit from adversity.

So what are we going to do about it?

I'll bet nothing is the answer. By now everyone who got sideswiped will have finished with the headless chicken routine, had the inquest, punished the innocent and patted the guilty on the back. Then we went back to business as usual because, despite all the furor that the press made, no one died and no one suffered (at least, no one who mattered).

You know what we should do?

Slow down. Stop believing our own press and stop trusting everyone else's press. We need to get tough and get thorough. We need to make sure that if the knee bone is supposed to be connected to the thigh bone then it dang well is. And if we find out later that we only thought it was connected but it wasn't really, then we don't need to whine about it and look for someone to blame. We need to make sure it doesn't happen again.