J.D. Meier's Blog : Work Tips

10 Years at patterns & practices

J.D. Meier — Fri, 02 Oct 2009 21:56:23 GMT

I never imagined I would invest 10 years on the patterns & practices team at Microsoft. Life is short and I always imagined I would spend it across so many more adventures. What surprised me is how much you can grow yourself, and grow the job in the process. While I sometimes wonder about the path not taken, there’s no doubt I’ve built a deep set of capabilities, achievements, and experiences as a direct result of investing my time in patterns & practices. I’ve shared some of my best lessons learned at patterns & practices, as well as my proven practices for individual contributors.

I think my biggest take away lesson is follow your heart, follow the growth, and invest in yourself (mind, heart, body, emotions, career, financial, relationships, and fun.)

Why patterns & practices?
There are lots of reasons why I chose patterns & practices. At the end of the day, it was the people, the values, and the mission.

Our Mission
While we’ve had various flavors of the mission, I like to think of it as …. “Customer success on the Microsoft platform” … or … “Proven practices for the platform.” I had the toughest time explaining to my Aunt what I do, until finally I said, “I help customers put the legos together.” She then said, “ahhh, I get it.”

Goals
In patterns & practices, the goals are simple:

Simplify the customer experience of building quality solutions on the Microsoft platform.
Improve the customer value of Microsoft products and technologies through customer connection and solution engineering.
Grow the professional knowledge and capability of the Microsoft development community.
Help customers and partners build their LOB (line-of-business) applications and services faster and more predictably than any platform in the world.

Values
In patterns & practices, we value:

Continuous learning, innovation and improvement - We have a bias toward action (over more planning) and customer engagement and feedback (over more analysis.)
Open, collaborative, relationships with customers, Microsoft field, partners, and Microsoft teams.
Execution - we take strategic bets, but we hold ourselves accountable for creating value, shipping early and often, and delivering results that have impact with customers and in Microsoft.
Explicit, transparent, and direct communication with customers and with our team and others in our company.
Quality over scope - no guidance is better than bad guidance.

Principles
We use the following principles to guide our work:

Start with the end in mind; think about end to end scenarios and how the products we produce fit in the solution architecture and into the patterns & practices catalog.
Help the customer succeed with their intent - the results they want to achieve, not just what they are trying to do.
Find the minimal solution required for a good result and ship it.
Our tools platforms are assets that expand the types of guidance we can express - use all of what they provide where it naturally fits the scenario.
Constructive tension between customer needs and Microsoft product and business strategy is expected - when we do our job well, this tension is healthy.

Capabilities, Achievements, and Experience
How do you measure the impact of the time you spend down a given career path? I’ve been looking for an effective lens, and I think it boils down to capabilities, achievements, and experience. It’s the simplest way that I can organize and reflect on where I am, based on where I’ve been. Capabilities are simply my skills. They are the things I’ve learned how to do, from soft skills to technical abilities. Achievements are my results. This includes my impact on Microsoft, the software industry, and customers. I lump my books, patents I filed, and the methodologies I’ve baked into the platform and tools here. In terms of experience, I think of the job roles and activities I’ve had along the way.

Key Themes
I think I can boil my impact and results down into 3 key themes:

Project management. I drive projects from pitch to ship. I’ve built dream teams that go on amazing adventures to change the world. I’ve consistently shipped projects on time and on budget year over year. I’ve mentored many project managers and PMs at Microsoft to share the best of the best of what I’ve learned about shipping, execution, impact and results in patterns & practices. I’ve had unique experiences here, especially since we adopted Agile practices early on, and I’ve lead distributed teams around the world since 2001. I’ve learned a lot in terms of managing innovation, delivering incremental value, fixing time, while flexing scope, and experience-driven development (my latest thinking on software development.) I think my biggest achievement here was helping shape the patterns & practices catalog, the programs, and the execution. See Writing Books on Time and On Budget.
Software engineering. I’ve invested the bulk of my time in application life cycle management, process improvement, quality attributes (security, performance, … etc), and application architecture. Most of my talks and writings have been focused on security, performance, and software architecture, but I’ve done a lot more behind the scenes. One of the big things I’ve focused on at Microsoft, is “solution engineering”, which is really about problem solving, while satisficing the user, business, and technology perspectives. I think my biggest achievements here were baking security and performance into the life cycle, and into Visual Studio Team Foundation Server.
Effectiveness. I’m a fan of continuous improvement. I’m not a productivity junkie though. I’m all about impact and results. I’ve learned from the best of the best around Microsoft. I’ve hunted and gathered patterns and practices for effectiveness over the span of several years. More importantly, I’ve bounced the ideas and techniques against reality to see what sticks. In the last few years, I’ve regularly carried 8 mentees. I’ve given talks to our X-Box team on productivity and results systems. Effectiveness is an art and science, and I’m trying to bridge the gap between state of the art and state of the practice. See 7 Habits of Highly Effective PMs and Effectiveness Post Roundup.

Years at a Glance
I think browsing by years is a healthy reality check against impact over time. Looking back is the simplest way for me to respond to the question, “if I had it to do over again, what would I do differently?” Where there answer is “nothing” – those are the sweet spots. Where the answer is “everything” – those are the lessons :)

Year	Results
2009	Books Application Architecture Guide 2.0 Projects Azure Security Guidance Project Core Systems Information Model Cloud Architecture Scenarios Customer-Connected Engineering Productivity coach for the Xbox team.
2008	Books Improving Web Services Security Projects Line-of-Business (LOB) Frame Catalog Sweep Visual Studio Add-In for Guidance Explorer
2007	Books Performance Testing Guidance for Web Applications Team Development with Visual Studio Team Foundation Server
2006	8 patents filed (Security, performance, and info models for software life cycles and application life cycle management.) Projects ASP.NET Security RI (Reference Implementation) Competitive Assessment for Security Engineering Defending Your Code Guidance Explorer PDL (Performance Development Life Cycle) Practices Checker Scenario Evaluation Framework Security Case Studies Security Code Examples Security Toolbar
2005	Books Security Engineering Explained Projects Security Engineering in VSTS Threat Modeling Web Applications Whidbey Security Guidance
2004	Books Improving .NET Application Performance and Scalability
2003	Books Improving Web Application Security
2002	Books Building Secure ASP.NET Applications

Books
My books at a glance:

Application Architecture Guide 2.0 (2009) (The Microsoft Playbook for the Application Platform)
Building Secure ASP.NET Applications (2002)
Improving .NET Application Performance and Scalability (2004)
Improving Web Application Security: Threats and Countermeasures (2003)
Improving Web Services Security Guide (2008)
Performance Testing Guidance for Web Applications (2007)
Security Engineering Explained (2005)
Team Development with Visual Studio Team Foundation Server (2007)

Pocket Guides
My pocket guides at a glance:

Agile Architecture Method Pocket Guide
Mobile Architecture Pocket Guide
Performance Pocket Guide
RIA Architecture Pocket Guide
Rich Client Architecture Pocket Guide
Security Pocket Guide
Service Architecture Pocket Guide
Web Architecture Pocket Guide

Projects
My projects at a glance:

Application Architecture Guide 2.0 – A guide, knowledge base, information model and methodologies for the Microsoft platform.
ASP.NET Security Reference Implementation - Sample application for ASP.NET 2.0.
Building Secure ASP.NET Applications – A guide for designing authentication and authorization and end-to-end applications scenarios.
Catalog Sweep – Information model for organizing the complete patterns & practices catalog of code and content assets.
Customer Connected Engineering – Methodology for engaging customers throughout the life cycle (“patterns & practices secret sauce.”)
Defending Your Code – An online knowledge base for software security.
Guidance Explorer – An online knowledge base for prescriptive guidance ("ITunes for knowledge.")
Improving .NET Application Performance and Scalability – A guide and methodology for baking performance into the life cycle.
Improving Web Application Security – A guide for threats, attacks, vulnerabilities and countermeasures for LOB applications.
Improving Web Services Security – A guide for threats, attacks, vulnerabilities and countermeasures for Web services.
Performance Testing Guidance for Web Applications – A guide and testing methodology for testing Web application performance.
PDL (Performance Development Life Cycle) – Methodology, activities and artifacts for baking performance into the life cycle.
Practices Checker – An application that checks software against patterns & practices recommendations.
Scenario Evaluation Framework – Assessment technique for design, implementation and deployment “building codes.”
Security Case Studies – A model and examples for sharing business impact from patterns & practices security guidance.
Security Code Examples – 60 security code examples in VB.NET / C#.
Security Engineering Explained – A guide and methodology for baking security into the life cycle.
Security Engineering in VSTS – Baked security engineering into VSTS / MSF.
Security Information Model – A unified model for Microsoft’s security guidance.
Security Toolbar – A toolbar for browsing patterns & practices guidance from Visual Studio.
Threat Modeling Web Applications – A technique to identify relevant threats and vulnerabilities for your scenario to help you shape your application's security design.
Visual Studio Add-In for Guidance Explorer – Find, create, and share prescriptive guidance inside Visual Studio.
Whidbey Security Guidance – A collection of guidelines, checklists, and step-by-step how tos for improving software security based on the .NET Framework 2.0.

Where do we go from here? You write your future a page at a time. If there’s one thing I’ve learned, it’s continue to reinvent yourself, reinvent your job, and make the most of what you’ve got.

My Related Posts

Sources of Insight is 6 Months Old

J.D. Meier — Wed, 18 Mar 2009 19:52:44 GMT

Sources of Insight is 6 Months Old. It's growing up fast. I'd like to say I have the perfect plan, and everything's gone as planned, but I don't and it hasn't. Life's funny like that. What I can say is that I've made the most of it along the way, and I continue to fail forward. Onward and upward.

Sources of Insight is my blog for sharing patterns and practices for skilled living. It's how I scale myself as I help others unleash their inner awesome. You can think of it as a collection of insight and action to get results for work and life.

Here's some key features on Sources of Insight:

Browse guest posts by best selling book authors
Download my Free eBook - The Zen of Results, a quick guide to getting your life back.
Browse my hand picked collection of top personal development books
Browse my hand picked collection of top personal productivity quotes
Browse my posts of insight and action to help you make the most of what you got.

People I've Worked with On Past Projects

J.D. Meier — Mon, 09 Feb 2009 10:00:06 GMT

One lesson I've learned time and again is that it's about the people. You can be on a lousy project with great people and still have a great time. The reverse is not always true. Of course, the ideal world is a great project with great people. I've been lucky enough to have enjoyed several adventures with great people while trying to change the world.

As part of mid-year review, I'm taking a stroll down memory lane. To do so, I created a snapshot of people I've worked with while writing books in patterns & practices over the years. Looking into the past always gives me insight into the future. I use it to find personal success patterns. It also helps me get a new vantage point for project analysis.

The first thing I learned by looking at the list of people I've worked with is how the right project can really grow your network. The other thing is how you can also predict a project's success largely by who's involved. The thing that really stands out for me is that the most successful projects were ones that created an intersection of the right problems, with the right people, with the right passions and strengths. That's what dream teams and compelling missions are made of. A simple test of whether you have the right team is whether you want to run towards or away from the problem.

Here's the snapshot I used for my analysis ...

Application Architecture Guide 2.0

Home Page: http://www.codeplex.com/AppArchGuide
Forewords: S. Somasegar, Scott Guthrie
Authors: J.D. Meier , Alex Homer, David Hill, Jason Taylor , Prashant Bansode , Lonnie Wall, Rob Boucher Jr, Akshay Bogawat
Test Team - Rohit Sharma, Praveen Rangarajan, Kashinath TR, Vijaya Jankiraman
Edit Team - Dennis Rea
External Contributors/Reviewers - Adwait Ullal; Andy Eunson; Brian Sletten; Christian Weyer; David Guimbellot; David Ing; David Weller; Derek Greer; Eduardo Jezierski; Evan Hoff; Gajapathi Kannan; Jeremy D. Miller; John Kordyback; Keith Pleas; Kent Corley; Mark Baker; Paul Ballard; Peter Oehlert; Norman Headlam; Ryan Plant; Sam Gentile; Sidney G Pinney; Ted Neward; Udi Dahan
Microsoft Contributors / Reviewers - Ade Miller; Amit Chopra; Anna Liu; Anoop Gupta; Bob Brumfield; Brad Abrams; Brian Cawelti; Bhushan Nene; Burley Kawasaki; Carl Perry; Chris Keyser; Chris Tavares; Clint Edmonson; Dan Reagan; Denny Dayton; Diego Dagum; Dmitri Martynov; Dmitri Ossipov; Don Smith; Dragos Manolescu; Elisa Flasko; Eric Fleck; Erwin van der Valk; Faisal Mohamood; Francis Cheung; Gary Lewis; Glenn Block; Gregory Leake; Ian Ellison-Taylor; Ilia Fortunov; J.R. Arredondo; Javed Sikander; John deVadoss; Joseph Hofstader; Koby Avital; Loke Uei Tan; Luke Nyswonger; Manish Prabhu; Meghan Perez; Mehran Nikoo; Michael Puleio; Mike Francis; Mike Walker; Mubarak Elamin; Nick Malik; Nobuyuki Akama; Ofer Ashkenazi; Pablo Castro; Pat Helland; Phil Haack; Rabi Satter; Reed Robison; Rob Tiffany; Ryno Rijnsburger; Scott Hanselman; Seema Ramchandani; Serena Yeoh; Simon Calvert; Srinath Vasireddy; Tom Hollander; Wojtek Kozaczynski

Improving Web Services Security

Home Page: http://www.codeplex.com/WCFSecurityGuide
Forewords: Nicholas Allen, Rockford Lhotka
Authors: J.D. Meier, Carlos Farre, Jason Taylor, Prashant Bansode, Steve Gregersen, Madhu Sundararajan, Rob Boucher
External Contributors/Reviewers: Andy Eunson; Anil John; Anu Rajendra; Brandon Bohling; Chaitanya Bijwe; Daniel Root; David P. Romig, Sr.; Dennis Rea; Kevin Lam; Michele Bustamante; Parameswaran Vaideeswaran; Rockford Lotka; Rudolph Araujo; Santosh Bejugam
Microsoft Contributors / Reviewers: Alik Levin; Brandon Blazer; Brent Schmaltz; Curt Smith ; Dmitri Ossipov; Don Smith; Jan Alexander; Jason Hogg; Jason Pang; John Steer; Marc Goodner; Mark Fussell; Martin Gudgin; Martin Petersen-Frey; Mike de Libero; Mohammad Al-Sabt; Nobuyuki Akama; Ralph Squillace; Richard Lewis; Rick Saling; Rohit Sharma; Scott Mason; Sidd Shenoy; Sidney Higa; Stuart Kwan; Suwat Chitphakdibodin; T.R. Vishwanath; Todd Kutzke; Todd West; Vijay Gajjala; Vittorio Bertocci; Wenlong Dong; Yann Christensen; Yavor Georgiev

Team Development with Visual Studio Team Foundation Server

Home Page: http://msdn.microsoft.com/en-us/library/bb668991.aspx
Forewords: Jeff Beehler, Rob Caron, Brian Harry
Authors: J.D. Meier, Jason Taylor, Prashant Bansode, Alex Mackman, Kevin Jones
External Contributors/Reviewers. David P. Romig, Sr; Dennis Rea; Eugene Zakhareyev; Leon Langleyben; Martin Woodward; Michael Rummier; Miguel Mendoza ; Mike Fourie; Quang Tran; Sarit Tamir; Tushar More; Vaughn Hughes
Microsoft Contributors / Reviewers. Aaron Hallberg; Ahmed Salijee; Ajay Sudan; Ajoy Krishnamoorthy; Alan Ridlehoover; Alik Levin; Ameya Bhatawdekar; Bijan Javidi; Bill Essary; Brett Keown; Brian Harry; Brian Moore; Brian Keller; Buck Hodges; Burt Harris; Conor Morrison; David Caufield; David Lemphers; Doug Neumann; Edward Jezierski; Eric Blanchet; Eric Charran; Graham Barry; Gregg Boer; Grigori Melnik; Janet Williams Hepler; Jeff Beehler; Jose Parra; Julie MacAller; Ken Perilman; Lenny Fenster; Marc Kuperstein; Mario Rodriguez; Matthew Mitrik; Michael Puleio; Nobuyuki Akama; Paul Goring; Pete Coupland; Peter Provost; Granville (Randy) Miller; Richard Berg; Rob Caron; Robert Horvick; Rohit Sharma; Ryley Taketa; Sajee Mathew; Siddharth Bhatia; Tom Hollander; Tom Marsh; Venky Veeraraghavan

Performance Testing Guidance

Home Page: http://msdn.microsoft.com/en-us/library/bb924375.aspx
Forewords: Alberto Savoia, Rico Mariani
Authors: J.D. Meier, Microsoft, Senior Program Manager, patterns & practices
Carlos Farre, Microsoft, Software Design Engineer Test, patterns & practices
Prashant Bansode, Infosys Technologies Ltd
Scott Barber, PerfTestPlus Inc, Chief Technologist
Dennis Rea, Wadeware LLC
Microsoft Contributors and Reviewers: Alan Ridlehoover; Clint Huffman; Edmund Wong; Ken Perilman; Larry Brader; Mark Tomlinson; Paul Williams; Pete Coupland; Rico Mariani
External Contributors and Reviewers: Alberto Savoia; Ben Simo; Cem Kaner; Chris Loosley; Corey Goldberg; Dawn Haynes; Derek Mead; Karen N. Johnson; Mike Bonar; Pradeep Soundararajan; Richard Leeke; Roland Stens; Ross Collard; Steven Woody

Security Engineering

Home Page: http://msdn.microsoft.com/en-us/library/ms998382.aspx
Authors: J.D. Meier, Alex Mackman, Blaine Wastell, Prashant Bansode, Jason Taylor, and Rudolph Araujo.
Test Team: Larry Brader, Microsoft Corporation; Nadupalli Venkata Surya Sateesh, Sivanthapatham Shanmugasundaram, Infosys Technologies Ltd.
Edit Team: Nelly Delgado, Microsoft Corporation
Release Management: Sanjeev Garg, Microsoft Corporation
External Contributors and Reviewers: Anil John, Johns Hopkins University – Applied Physics Laboratory; Frank Heidt; Keith Brown Pluralsight LLC; Mark Curphey, Foundstone Professional Services
Microsoft Services and PSS Contributors and Reviewers: Adam Semel, Denny Dayton, Gregor Noriskin, Kate Baroni, Tom Christian, Wade Mascia
Microsoft Product Group: Charlie Kaufman, Don Willits, Mike Downen, Rick Samona
Microsoft IT Contributors and Reviewers: Akshay Aggarwal, Irfan Chaudhry, Shawn Veney, Talhah Mir
MSDN Contributors and Reviewers: Kent Sharkey
Microsoft EEG: Corey Ladas, James Waletzky

Improving .NET Application Performance and Scalability

Home Page: http://msdn.microsoft.com/en-us/library/ms998530.aspx
Forewords: S. Somasegar, Rico Mariani, Brandon Bohling, Connie U. Smith, Scott Barber
Authors: J.D. Meier, Srinath Vasireddy, Ashish Babbar, Alex Mackman
Special thanks to key contributors: Anandha Murukan; Andy Eunson; Balan Jayaraman, Infosys Technologies Ltd; Christopher Brumme (CLR and COM interop); Connie U. Smith, Ph.D.; Curtis Krumel (SQL Server); David G. Brown (SQL Server); Denny Dayton; Don Willits ("Uber man"); Edward Jezierski; Ilia Fortunov; Jim O'Brien, Content Master Ltd; John Allen (ASP.NET); Matt Odhner (ACT); Prabhaker Potharaju (SQL Server); Rico Mariani (Performance Modeling, CLR, Code Review, Measuring); Ray Escamilla (Tuning); Scott Barber (Performance Modeling and Testing); Sharon Bjeletich (SQL Server)
Special thanks to key reviewers: Adam Nathan (Interop); Brad Abrams; Brandon Bohling, Intel Corporation; Carlos Farre, Solutions IQ; Chuck Delouis, Veritas Software (SQL Server); Cosmin Radu (Interop); Eddie Lau (ACE); Eric Morris (ACE); Erik Olsen (ASP.NET); Gerardo Bermudez (CLR, Performance Modeling); Gregor Noriskin; Ken Perilman; Jan Gray; John Hopkins (ACE); Joshua Lee; K.M. Lee (ACE TEAM); Mark Fussell (XML); Matt Tavis (Remoting); Nico Jansen (ACE Team); Pablo Castro (ADO.NET and SQL); Patrick Dussud (CLR); Riyaz Pishori (Enterprise Services); Richard Turner (Enterprise Services); Sonja Keserovic (Interop); Thomas Marquardt (ASP.NET); Tim Walton; Tom McDonald; Wade Mascia (ASP.NET threading, Web services, and Enterprise Services); Yasser Shohoud (Web services)
External Reviewers: Ajay Mungara, Intel Corporation; Bill Draven, Intel Corporation; Emil Lerch, Intel Corporation; Carlos Santos (Managed Code); Chris Mullins, Kiefer Consulting; Christopher Bowen, Monster.com; Chuck Cooper; Dan Sullivan; Dave Levine, Rockwell Software; Daniel Cazzulino, Lagash Systems SA; Diego Gonzalez, Lagash Systems SA (XML); Franco Ceruti; Fredrik Normen "N2", Barium AB (extensive review); Grant Fritchey; Greg Buskirk; Greg Kiefer, Kiefer Consulting; Ingo Rammer, IngoRammer.com; James Duff, Vertigo Software; Jason Masterman, Barracuda .NET (Remoting); Jeff Fiegel, Acres Gaming; Jeff Sukow, Rockwell Software; John Lam; John Vliet, Intel Corporation; Juval Lowy (COM interop); Kelly Summerlin, TetraData; Mats Lanner, Open Text Corporation; Matt Davey; Matthew Brealey; Mitch Denny, Monash.NET; Morten Abrahamsen (Performance and Transactions); Nick Wienholt, dotnetperformance.com; Norm Smith (Data Access and Performance Modeling); Pascal Tellier, prairieFyre Software Inc.; Paul Ballard, Rochester Consulting Partnership, Inc.; Per Larsen (Managed Code Performance); Scott Allen (Design Guidelines); Philippe Harry Leopold Frederix (Belgium); Scott Stanfield, Vertigo Software; Ted Pattison, Barracuda .NET (COM Interop); Thiru Thangarathinam; Tim Weaver, Monster.com; Vivek Chauhan (NIIT); Thiru Thangarathinam; Wat Hughes, Creative Data (SQL Server)
Microsoft Consulting Services and Product Support Services (PSS): Dan Grady; David Madrian; Eddie Clodfelter; Hugh Wade; Jackie Richards; Jacquelyn Schmidt; Jaime Rodriguez; James Dosch; Jeff Pflum; Jim Scurlock; Julian Gonzalez (Web services); Kenny Jones; Linnea Bennett; Matt Neerincx; Michael Parkes; Michael Royster; Michael Stuart; Nam Su Kang; Neil Leslie; Nobuyuki Akama; Pat Altimore; Paul Fallon; Scott Slater; Tom Sears; Tony Bray
Microsoft Product Group: Alexei Vopilov (Web services); Amrish Kumar; Arvindra Sehmi; Bill Evans; Brian Spanton; Keith Ballinger (WSE); Scot Gellock (Web services); Brian Grunkemeyer (CLR); Chris Eck; David Fields (NT); David Guimbellot; David Mortenson (CLR); Dax Hawkins; Dhananjay Mahajan (Enterprise Services); Dino Chiesa; Dmitry Robsman; Doug Rothaus (ADO.NET); Eddie Liu; Elena Kharitidi (Web services); Fabio Yeon; Harris Syed (Enterprise Services); Jason Zander; Jeffrey Cooperstein; Jim Radigan; Joe Long (Web services vs. ES vs. Remoting); Joshua Allen; Larry Buerk; Lubor Kollar (SQL Server); Maoni Stephens; Michael Coulson; Michael Fanning; Michael Murray (FxCop); Omri Gazitt; Patrick Ng (FX DEV); Peter Carlin (SQL Server); Rebecca Dias (WSE); Rick Vicik; Robin Maffeo (CLR Thread pool); Vance Morrison; Walter Stiers; Yann Christensen
patterns & practices members: Jason Hogg (ADO.NET and XML); Naveen Yajaman; Sandy Khaund; Scott Densmore; Tom Hollander; Wojtek Kozaczynski
Thanks to our test team: (Infosys Technologies Ltd): Austin Ajit Samuel Angel; Dhanyah T.S.K; Lakshmi; Prashant Bansode; Ramesh Revenipati; Ramprasad Gopalakrishnan; Ramprasad Ramamurthy; Terrence J. Cyril
Thanks to our editors for helping to ensure a quality experience for the reader: Sharon Smith; Tina Burden McGrayne, Entirenet; Susan Filkins, Entirenet; Tyson Nevil, Entirenet
product manager: Ron Jacobs
Finally, thanks to: Alex Lowe; Chris Sells; Jay Nanduri; Nitin Agrawal; Pat Filoteo; Patrick Conlan (SQL Server); Rajasi Saha; Sanjeev Garg (Satyam Computer Services); Todd Kutzke

Improving Web Application Security: Threats and Countermeasures

Home Page: http://msdn.microsoft.com/en-us/library/ms994921.aspx
Forewords: Mark Curphey, Erik Olson, Joel Scambrary, Michael Howard
Authors: J.D. Meier, Alex Mackman, Srinath Vasireddy, Michael Dunner, Ray Escamilla, Anandha Murukan
External Reviewers–Mark Curphey, Open Web Application Security Project and Watchfire; Andy Eunson (extensive review); Anil John (code access security and hosting scenarios); Paul Hudson and Stuart Bonell, Attenda Ltd. (extensive review of the Securing series); Scott Stanfield and James Walters, Vertigo Software; Lloyd Andrew Hubbard; Matthew Levine; Lakshmi Narasimhan Vyasarajan, Satyam Computer Services; Nick Smith, Senior Security Architect, American Airlines (extensive review of the Securing series); Ron Nelson; Senthil Rajan Alaguvel, Infosys Technologies Limited; Roger Abell, Engineering Technical Services, Arizona State University; and Doug Thews.
Microsoft Product Group–Michael Howard (Threat Modeling, Code Review, and Deployment Review); Matt Lyons (demystifying code access security); Caesar Samsi; Erik Olson (extensive validation and recommendations on ASP.NET); Andres De Vivanco (securing SQL Server); Riyaz Pishori (Enterprise Services); Alan Shi; Carlos Garcia Jurado Suarez; Raja Krishnaswamy, CLR Development Lead; Christopher Brown; Dennis Angeline; Ivan Medvedev (code access security); Jeffrey Cooperstein (Threat Modeling); Frank Swiderski; Manish Prabhu (.NET Remoting); Michael Edwards, MSDE; Pranish Kumar, (VC++ PM); Richard Waymire (SQL Security); Sebastian Lange; Greg Singleton; Thomas Deml (IIS Lead PM); Wade Hilmo (IIS); Steven Pratschner; Willis Johnson (SQL Server); and Girish Chander (SQL Server).
Microsoft Consulting Services and Product Support Services (PSS): Ilia Fortunov (Senior Architect) for providing continuous and diligent feedback; Aaron Margosis (extensive review, script injection, and SQL Injection); Jacquelyn Schmidt; Kenny Jones; Wade Mascia (Web Services and Enterprise services); Aaron Barth; Jackie Richards; Aaron Turner; Andy Erlandson (Director of PSS Security); Jayaprakasam Siddian Thirunavukkarasu (SQL Server security); Jeremy Bostron; Jerry Bryant; Mike Leuzinger; Robert Hensing (reviewing the Securing series); Gene Ferioli; David Lawler; Jon Wall (threat modeling); Martin Born; Michael Thomassy; Michael Royster; Phil McMillan; and Steven Ramirez.
Special Thanks To: Joel Scambray; Rich Benack; Alisson Sol; Tavi Siochi (IT Audit); Don Willits (raising the quality bar); Jay Nanduri (Microsoft.com) for reviewing and sharing real world experience; Devendra Tiwari and Peter Dampier, for extensive review and sharing best IT practices; Denny Dayton; Carlos Lyons; Eric Rachner; Justin Clarke; Shawn Welch (IT Audit); Rick DeJarnette; Kent Sharkey (Hosting scenarios); Andy Oakley; Lucas Lavarello; Vijay Rajagopalan (Dev Lead MS Operations); Gordon Ritchie, Content Master Ltd; Chase Carpenter (Threat Modeling); Matt Powell (for Web Services security); Joel Yoker; Juhan Lee [MSN Operations]; Lori Woehler; Mike Sherrill; Mike Kass; Nilesh Bhide; Rebecca Hulse; Rob Oikawa (Architect); Scott Greene; Shawn Nandi; Steve Riley; Mark Mortimore; Matt Priestley; and David Ross.
Editors: Sharon Smith; Kathleen Hartman (S&T OnSite); Tina Burden (Entirenet); Cindy Riskin (S&T OnSite); and Pat Collins (Entirenet) for helping to ensure a quality experience for the reader.
patterns & practices team members: Naveen Yajaman; Philip Teale; Scott Densmore; Ron Jacobs; Jason Hogg; Per Vonge Nielsen; Andrew Mason; Edward Jezierski; Michael Kropp; Sandy Khaund; Shaun Hayes; Mohammad Al–Sabt; Edward Lafferty; Ken Perilman; and Sanjeev Garg (Satyam Computer Services).

Building Secure ASP.NET Applications

Home Page: http://msdn.microsoft.com/en-us/library/aa302415.aspx
Authors: J.D. Meier, Alex Mackman, Michael Dunner, and Srinath Vasireddy
Contributors and reviewers: Manish Prabhu, Jesus Ruiz-Scougall, Jonathan Hawkins and Doug Purdy, Keith Ballinger, Yann Christensen and Alexei Vopilov, Laura Barsan, Greg Fee, Greg Singleton, Sebastian Lange, Tarik Soulami, Erik Olson, Caesar Samsi, Riyaz Pishori, Shannon Pahl, Ron Jacobs, Dave McPherson, Christopher Brown, John Banes, Joel Scambray, Girish Chander, William Zentmayer, Shantanu Sarkar, Carl Nolan, Samuel Melendez, Jacquelyn Schmidt, Steve Busby, Len Cardinal, Monica DeZulueta, Paula Paul, Ed Draper, Sean Finnegan, David Alberto, Kenny Jones, Doug Orange, Alexey Yeltsov, Martin Kohlleppel, Joel Yoker, Jay Nanduri, Ilia Fortunov, Aaron Margosis (MCS), Venkat Chilakala, John Allen, Jeremy Bostron, Martin Petersen-Frey, Karl Westerholm, Jayaprakasam Siddian Thirunavukkarasu, Wade Mascia, Ryan Kivett, Sarath Mallavarapu, Jerry Bryant, Peter Kyte, Philip Teale, Ram Sunkara, Shaun Hayes, Eric Schmidt, Michael Howard, Rich Benack, Carlos Lyons, Ted Kehl, Peter Dampier, Mike Sherrill, Devendra Tiwari, Tavi Siochi, Per Vonge Nielsen, Andrew Mason, Edward Jezierski, Sandy Khaund, Edward Lafferty, Peter M. Clift, John Munyon, Chris Sfanos, Mohammad Al-Sabt, Anandha Murukan (Satyam), Keith Brown (DevelopMentor), Andy Eunson, John Langley (KANA Software), Kurt Dillard, Christof Sprenger, J.K.Meadows, David Alberto, Bernard Chen (Sapient)

Precision Questions and Precision Answers

J.D. Meier — Wed, 14 Jan 2009 22:42:09 GMT

I shared my notes from Precision Questions and Precision Answers training on Sources of Insight. It's one of the most effective training sessions I've taken at Microsoft. My notes are bit old, so they're a bit rough, but you can get the main ideas. To summarize it, Precision Questions and Precision Answers, or PQ / PA for short, is a technique for improving your communication efficiency and critical thinking. It's especially important for exec reviews, but you can use it for any scenario where the complexity is high and you need to explore assumptions and test information. It works by using a structured approach to explore questions in 7 categories:

Go / NoGo
Clarification
Assumptions
Basic Critical Question
Causes
Effects
Action

It's not for scenarios where you want to brainstorm or build rapport, but it's incredibly effective for improving your thinking and improving your effectiveness at work.

3 Great Results for Today

J.D. Meier — Wed, 29 Oct 2008 18:59:24 GMT

What are 3 great results for today? That's the question I ask to bootstrap my day. As simple as it sounds, I find it's the most effective way to cut through the fog each day. There's a lot of things I can do and there's lots of activities I'll be doing, but what are 3 great outcomes for today. That's it.

Example
This is an example of my 3 great results for this past Monday:

Ship Beta 1 of App Arch
Beta 1 Post for App Arch
Draft of Designing Your Architecture

Great is relative.

Why 3 things? It forces me to prioritize among a sea of potential results. Also, I can remember 3 things without writing them down, so throughout my day, I know what I'm working towards. I can say it in the hall.

If you manage endless to do lists and work on a bunch of stuff but don't actually get anything done, try focusing on 3 great results each day. It works.

Tests for Success

J.D. Meier — Wed, 26 Mar 2008 17:28:52 GMT

How do you identify the bull's-eye among your stakeholders? Nothing's worse than finishing a project and missing the mark you didn't know was there. At patterns & practices, one of our effective project practices is to use "tests for success" to help avoid this scenario.

What are Tests for Success
"Tests for success" are the prioritized success criteria that the stakeholder's agree to. It's basically a set of test cases, that if the project passes, the project is perceived as a success. They help clarify outcomes and priorities.

Example Tests for Success
Here's an example of "tests for success" from one of my projects:

Single multi-dimensional information model?
Single unified perspective of the product model?
Single unified perspective of the content model?
Backlog is mapped to the information model?
Capability to do comparative analysis and produce “Consumer reports” view of the catalog and the proposed work? (e.g. What’s customer demand? ... What’s our coverage?)

Stakeholders for the project created and prioritized this list, with prompts from the project team. This exercise helped clarify a lot of ambiguity as well as do a level set for the team.

How Can You Use This
Whether it's a personal project or a project at work, you can create your own tests for success. I think a small list of the vital few works better than a laundry list. Phrasing the tests as one-liner questions makes them easy to create and use. Here's some prompts to trigger your own tests for success:

How will the world be a different place when the project is done?
How will we know we did a good job?
What's the most valuable outcomes for the project?
In order for the project to be successful, we need to .... ?

When you're in the thick of things, you'll appreciate having a small set of criteria to go back to and help keep you and everyone involved on track.

Turning Chickens into Pigs

J.D. Meier — Tue, 25 Mar 2008 18:49:05 GMT

Have you ever been on a project where key stakeholders don't have skin in the game, but they have a controlling vote? This is a bad situation. It's like multiple backseat drivers, except they won't be there if the car crashes. What's the solution? You turn chickens into pigs!

The Chicken and the Pig
You may have heard the story about the chicken and the pig. The chicken says to the pig, "We should should start a restaurant." The pig asks, "What would we serve?" The chicken responds, "Bacon and eggs!" The pig says, "No thanks!"

The point in the story is the pig's "committed" while the chicken's "involved."

The Solution
Recognizing the situation is more than half the battle. When you've identified that chickens have controlling votes over pigs, your options include:

Avoid the situation where chickens are controlling the votes for pigs.
Make sure the chickens don't have controlling votes and make it explicit.
Turn the chickens into pigs. You need to move them from involved to committed. Have them take commitments or dependencies (skin in the game and committed to your success.)

How To Differentiate

J.D. Meier — Mon, 24 Mar 2008 17:50:48 GMT

How can you differentiate what you do? This can be particularly difficult in problem spaces that seem over-crowded. It helps if you have a frame. One of my mentors gave me a useful lens for differentiating that helps solve this problem.

Problem, Approach, or Implementation
You can differentiate based on problem, approach or implementation:

Problem - What problem do you address?
Approach - What strategy do you use to solve the problem?
Implementation - How do you implement your solution?

If you differentiate at the problem you solve, it's good to be able to call that out. If you solve the same problem, but use a different approach, unless it produces a big difference in results, it's probably not worth it. If you differ only by implementation and the experience or results aren't valued by the customer, again, it's probably not worth it.

Using the Frame for Differentiation
First identify whether you differentiate at the problem, approach, or implementation. Next, determine whether the level at which you're differentiating is worth it. For example, consider safety among automobile makers. Volvo's approach to safety stands out. They work the same problem but differentiate by approach.

By having clarity around where you differentiate, it's easier to communicate your deltas in a meaningful way to others.

Example
At Microsoft, when I tackle a problem that's been "solved" before, I use the frame as a lens to quickly find the useful differentiation. For example, doing security reviews wasn't a new problem. However, changing the approach by using inspections and building a set of reusable criteria from a team of experts changed the game. By using criteria based on principles and patterns, and then organizing the criteria within a frame of actionable categories produced exponential results for all of our customers that adopted the approach. Old problem, new approach, great results.

Life Frame

J.D. Meier — Thu, 20 Mar 2008 19:53:00 GMT

What is your life frame? What are the key buckets in your life that you need to balance across? If you have a frame, you can balance your life through thick and through thin. If you have a life frame, you can more thoughtfully allocate your time and energy for maximum results. More importantly, when things aren't going well, you have a tool to help you spot where you are not investing enough.

Life Frame
This is a baseline of your personal portfolio of your most important assets:

Mind
Body
Emotions
Career
Financial
Relationships
Adventure

Note - if those buckets don't work for you, change them. It's a starter set.

I've been sharing this life frame with those I coach, and some colleagues and they've found it helpful, so now I'm sharing it more broadly. It's a great starting point when you're not getting what you want out of life.

Spread Your Energy and Time Across Your Buckets
Spread your energy and time across them. If your current investment's not working, turn up the dial on some. If your stuck in one area, then try turning up another. For example, if you're not getting the results you want at work, then crank up your relationships dial. Remember that with this portfolio, the sum is more than the parts. It's the net effect.

What Can Happen When You Don't Use the Frame
When I first got to Microsoft years ago, I didn't have this frame. Sure I knew about these areas of my life, but I didn't have the mental model of a portfolio. Instead, all I knew was that I would throw all my energy and hours at my career bucket. To put that in perspective, 80, 90, 100+ hours a week. The problem is I consistently got rated highly and produced results. But at what cost? Well, if you spend 100+ hours in one bucket, guess how much energy you're spending in others? Granted some buckets overlap, but I'm talking about when you really shine the spotlight on them.

Improve Your Approach Over Spend More Time
Time is a limited resources. So is your energy. Interestingly, while working on performance modeling, the light bulb went off. If I carve out a minimum for some buckets and a maximum for others, it would be a forcing function. What's the maximum I would throw at my career bucket? 60? 50? 40? Timeboxing my career bucket forced me to identify the real value of all my work and to heavily prioritize. It also forced me to find the most effective principles, patterns and practices for project management, personal productivity, running high-performance teams, ... etc. Which is better ... more time at the problem? ... or better techniques, more value, and a sustainable pace?

Set Boundaries (Minimums and Maximums)
The real lesson is that if you don't first set your boundaries, then you never really have a way to prioritize. For example, if you allocate fifty hours to your career bucket weekly, now you know how much to bite off at a time. Otherwise, you'll just work until everything's done, but there's always something more to do. Priorities, focus, and value are your friends.

As another example, I now continuously invest in my relationships bucket. For example, each week I have lunch with an old friend, and lunch with someone new. At Microsoft, and in life, it's what you know and who you know.

How To Use This
To get started, just put these categories on your whiteboard or a pad of paper. Take a look across your portfolio and figure out your current investments in time and energy. Look at your results. How well are you balancing? If you're on track, great. If not, try increasing your investment is some areas and lowering another. The goal is to improve the quality of your life. If you want to really put some focus in an area, try a 30 Day Improvement Sprint.

My Related Posts

Monthly Results

J.D. Meier — Mon, 21 Jan 2008 19:50:00 GMT

It’s mid-year at Microsoft. In the past it would take me a bit of work to figure out what I had accomplished and where I want to go. Not this time. For the past several months, I’ve been using a practice I’ll call Monthly Results. Each month, I create a short-list of results in a Wiki and send a link out to our management team as an FYI.

Benefits of Monthly Results
Creating a Monthly Results list has a few benefits for me:

At a glance, I can quickly see the forest from the trees.
It helps keep management in the loop on results.
It helps keep my teams focused on results over activity.
I can see interesting patterns.

Most importantly, it's my portfolio of results. If I don't like the portfolio, I can see at a glance where my time went and how I need to shift focus. Thinking in terms of a portfolio of results helps me quickly rationalize things like "Do I have my sure bets?" ... "Do I have a set of riskier projects to learn, grow and innovate with?" ... "Am I working on meaningful problems?" .... "Am I delivering value?" ... etc.

Example of Monthly Results
Here’s an example of my monthly results list. It doesn’t have to be fancy. In my case, I just create a Wiki page that lists results by month along with any relevant links:

NOV

Book: TFS Guide available on Amazon
Book: Perf Test Guide available on Amazon
Performance Testing Guide live on MSDN
TFS Guide live on MSDN
TFS Guidance Modules live on MSDN
TFS 2008 Fixes applied to guide (Ch 08 - Setting Up Continuous Integration with Team Build, Ch 09 - Setting Up Scheduled Builds with Team Build, Ch 16, Ch 17, Ch 18)
Scenario Frames for VSTS completed and shared
patterns & practices Web experiences ideas (see Wiki)

OCT

MSDN tree-view design for patterns & practices Catalog.
Testing Center launch features patterns & practices Widget
Project Practices documented (see Wiki)
Performance Test Scenario Frame published to CodePlex
Performance Test Scenario Frame for VSTS draft complete
Performance Testing Videos published to CodePlex (Video: What Is - The Core Activities of Performance Testing; Video: What Is - The Core Activities of Performance Testing in Agile Projects; Video: What Is - The Core Activities of Performance Testing in CMMI Projects; Video: What Is - The Distribution of Data for Performance Tests Results; Video: What Is - The Reporting Fundamentals for Performance Test Data; Video: What Is - The Success Criteria for Performance Test Projects; Video: What Is - The Mathematical and Statistical Principles for Performance Testing ; Video: What Is - Modeling Application Usage for Performance Testing.
Initial Catalog Sweep assessment
MSDN process improvement (TFS Guide experiment)

SEP

Software Inspections write up completed for Testing Center launch
TFS Guide to MS Press
Performance Testing Guide to MS Press
MSDN process improvement (Performance Testing Guide experiment)
Guidance Explorer Security Fixes implemented
Visual Studio Guidance Modules published to Guidance Library (Checklist Items: 257; Guidelines: 121; How Tos: 16; Explained: 10; Practices at a Glance: 129; Questions and Answers: 64)

Leadership Styles and Development Levels

J.D. Meier — Thu, 03 Jan 2008 19:27:32 GMT

One leadership style doesn't fit all. According to the Situational Leadership II model, the leadership style depends on the development levels within the team. Here's a summary:

Scenarios

If there's high competence and high commitment, use a "Delegating" style which is low support and low directive.
If there's high competence, but less commitment, then use a "Supporting" style, which means provide more support and encouragement.
If there's low competence and low commitment, then use a "Coaching" style, which provide more direction and support
If there’s low competence but high commitment, use a "Directing" style, which provides more direction, but less support.

Competence is knowledge and skill for the task. Confidence is motivation and self-confidence. I think competence breeds confidence which can help breed and sustain motivation.

The main point is that if somebody has a bunch of competence, get out of their way. If somebody needs more encouragement, support them. Ideally, you help somebody get to a high competence, high commitment development level.

Key Take Aways
While this might sound obvious, I think the important point is to be flexible in your style. Be able to vary your leadership style by situation (the context) and tailor it to the individual development levels within the team.

Another consideration is whether it's more effective to change your approach or change the situation to suit you (set yourself up for success.) There's mixed opinions on this and some interesting results, so I may post on this downstream.

Reward Yourself in the Moment

J.D. Meier — Tue, 01 Jan 2008 13:36:43 GMT

Happy New Year! It's a new year and many of you will be setting new goals for yourself as part of your New Year's resolutions. I want to give you an important nugget you can use when you implement your goals and start to face some potential discomfort or pain. This insight may be exactly what you need if you've ever failed at changing a habit or meeting your goals in the past.

Creating New Habits and Reducing Friction in Your Goals
I actually wasn't sure whether to title this post with "catch yourself in the act," "reward yourself in the moment", or "how to change a habit" but I think "reward yourself in the moment" is a simple enough rule to remember and it's more precise. The key point is to reward yourself in the moment. If you do so, you can actually rewire your associations of pleasure to a task you don't typically enjoy. It has to be "in the moment" when you are actually "feeling" the pain. The very precise point is that it's in the moment versus after the fact. "Timing" and "feeling" are the keys.

We're Creatures of Habits That "Feel" Good
How many habits do you have that you don't enjoy? I don't mean a habit that's not good for you. I mean, are your habits things that make you feel good or things that make you feel bad ... in the moment? I bet that most of your habits you have, make you feel good and you do them for exactly that reason. It's in the moment. (You might feel bad afterwards or you might "think" the habits are bad, but you "feel" good while you actually do them)

"Thinking" vs. "Feeling" Associations
When I was younger, I didn't understood why you had to catch the dog while they are in the act of making a mess, and not after the fact. I knew the rule, but I didn't get how important the timing was. It's because you have to associate negative in the exact moment of "feeling." It's also why immediately rewarding your dog with a snack when they show good behavior has a powerful effect. Unless your dog is Scooby Doo, it isn't going to reflect (think) on its behavior. They are simply responding to feelings from one moment to the next. They'll move toward pleasure and away from pain. If you punish or reward them after the act, it's too late.

Reward in the Moment, Not After the Fact
Here's an example I heard where this finally hit home for me. In this example, you want your kid to clean their room, but they want to go out and play. You tell them they can go out to play when they are done. However, they "feel" pain the entire time while they are cleaning their room. They internalize hating it. The promise of playing when they are done doesn't help. They still hate how it "feels." What happens when you step in and sincerely thank them *while they are doing it*? They "feel" good and now associate pleasure while cleaning their room (assuming you showed them appreciation in a way that resonates for them.)

How You Can Apply It
You can use this insight on a daily basis to reduce friction and find the joy in tasks you normally hate. The key is to find ways to enjoy how something "feels" when you normally don't, while it's in the moment, not after the fact. You'll get better at this, once you figure out your own reward patterns, so it's a skill that gets easier over time. Since it's a little bit of thoughtful work, don't overload yourself. Just pick a few things that hold you back the most and work on those first. The challenge with this is that you have to figure out your personal reward system. The upside is, your the best person to know what you like and don't.

You can actually game yourself to enjoy some things that you normally don't. Here's how I applied this to my workouts when I was "feeling" the pain. When I realized that the pain was growth, I suddenly "felt" differently about the "pain" and it became pleasure. I didn't just "think" differently; I "felt" differently about it (your thoughts create your feelings.) I also make it a habit to play my favorite music so I associate pleasure in the moment. This is an important distinction. It's why promises of rewards at the end of the month don't work. It's disconnected from "in the moment."

On the job, I try to catch people in the moment, and show appreciation "in the moment," particularly when they are performing a task they don't enjoy. A little appreciation, at the right time, goes a long way.

How Not to Reward Yourself
I'll use the principle of contrast to show how NOT to reward yourself. Let's say you want to drop 10 pounds this month. One way is to tell yourself you will reward yourself by going to your favorite restaurant when you are done. Well, you might give yourself motivation, but you haven't changed how you feel when you workout. If you don't find a way to enjoy your workout, then you may eventually give up.

Chunk It Down
Find a way to enjoy all the friction points you feel along the way. If you work out in the morning, this includes finding a way to enjoy getting out of bed. Sure this takes some thought and preparation up front, but eventually you'll not only get used to your routine, you will enjoy it. We're creatures of habit. In this case, you're building good habits that you'll keep up simply because you'll enjoy them. How many habits do you keep up that you really don't enjoy?

Best Wishes on Meeting Your Goals
Best wishes on meeting your goals and changing your habits in the New Year. I hope you find this nugget of insight helpful and use it as another tool for your personal effectiveness.

Rituals for Results

J.D. Meier — Thu, 27 Dec 2007 06:56:00 GMT

Routines help build efficiency and effectiveness. Consistent action over time is the key to real results. If you add continuous improvement or Kaizen to the picture, you have an unbeatable recipe for success. The following are some of my rituals for results:

Put in your hours. I heard that Hemingway wrote for two hours a day. The first hour he edited the day before. The next hour, he wrote new. My marathon runner friend says the key for her is putting in her hours.
Schedule It. If you schedule it, it happens. ("One of these days is none of these days.”)
Carve out time for what's important. You don't have time, you make time. "Work expands so as to fill the time available for its completion." - Parkinson's law. "Things which matter most, should never be at the mercy of things which matter least." - Goethe.
Model the best. Success leaves clues. Using reference examples can help you shave off tons of wasted time. Who can you learn from that will take your game to the next level?
Expand your toolset. When you only have a hammer, everything's a nail. Adding new tools to your toolbelt can exponentially improve your results.
Build a library of reference examples. Collect working examples to draw from.
Build feedback loops. I think feedback loops help us improve and keep us going. For me, I use a sounding board of people I trust.
Have a compelling "why." A compelling "why" is what will give you the energy and get you back on your horse, when you get knocked down.
Have a compelling "what." Your "what" should be a great manifestation of your "why." Use it to guide your course. This is your vision.
Check your ladder. Is it up against the right wall? Nothing's worse than climbing a ladder to find your destination was wrong.
Work backwards from the end in mind. Working backwards from where you want to be can help make you more resourceful. Look to working examples and reverse-engineer.
Stay flexible in your approach. Be flexible in the "how." If you have a compelling "what" and "why," you'll find the strategies. If something's not working, change your approach. Sanity check by asking yourself "is it effective?" See The Better Adapted You Are, the Less Adaptable You Tend to Be.
Think in terms of a portfolio of results. This means both producing results in different categories as well as having some results you count on and some that are risks. Diversify your results over having all your eggs in one basket.
Balance your buckets. Balance your results across your meaningful buckets. For me, I use a life frame (mind, body, emotion, career, financial, relationships) Within my career bucket, I make time for results, thinking, administration, improvement and relationships.
Establish a rhythm of results. Don't let the tail wag the dog. Factor your creation cycles from your release cycles. Your release rate should match absorption rate and demand. Your production rate doesn't need to be tightly bound to your release. For instance, you could write your eight blogs posts on Sunday, then trickle out over the week. See Drum-Buffer-Rope.
Deliver incremental value. Chunk it down. Focus on value-delivered over backlog burndown. It can be easy to be productive, but ineffective. Focusing on delivering value, keeps you asking the right questions and making the right calls on priorities. Remember that backlogs tend to suffer from rot over time. If you focus on value-delivered, you'll miss less windows of opportunity, or at least you're considering those windows when you prioritize. The other secret here is that focusing on value can be more energizing than tackling an overwhelming backlog, even if all you really changed is perspective ;)
Know the sum is better than the parts. Consistent action over time produces real results. Think about how much you've accomplished over the long run, just by showing up at work every day and doing your job. See How To Overcome Resistance.
Improve your network. Who you spend time with probably has the largest impact on getting results, personal growth, your quality of life ... etc. Tip - build a mind map of your personal and professional networks and see where you need to tune, prune or plant.
Play to your strengths. Improving your strengths can help you achieve more than improving your weaknesses. The exception is liabilities. Reduce the liabilities that hold you back.
Reduce your context switching. Context switching is one of the worst productivity killers. If you're spending more time switching than doing, it's a problem. Consider how you apply the following software patterns and practices: batching, remote facade, implicit lock, lazy load, coarse-grained lock, proxy, RI and FI, buffers, and Drum-Buffer-Rope.
Manage energy for results. Manage energy, not time for results. When you're "in the zone," you get results. How well do you get things done when you're emotionally or mentally drained? See Manage Energy, Not Time and The Secret of Time Management.
Use focus as your weapon for results. Focus is your friend. A batched and focused effort can produce amazing results. Few problems withstand sustained thinking or effort. 30 Day Improvement Sprints, Why 30 Day Improvement Sprints, Making 30 Day Improvement Sprints.
Reduce friction. Create streamlined execution paths. create a fast path for stuff you need to do frequently. There's probably a few scenarios where you have more friction in your process than you'd like. I use 30 Day Improvement Sprints for my perpetual friction points.
Use checklists. I'm a fan of using checklists. If the air force can use them to avoid task saturation and improve effectiveness, so can I. See Execution Checklists and How To Avoid Task Saturation.
Build a system of profound knowledge. See The Deming System of Profound Knowledge and Deming's System of Profound Knowledge This is about thinking of the system as a whole, knowing the impact of changes in the system, focusing on knowledge management, and taking into consideration the people-side of things. Remember that just because you might not be in a learning organization, doesn't mean that you can't set an example.
Do more, think less. I'm not advocating thoughtless actions. I'm countering actionless thoughts. Thoughtful actions produce results. If you're already acting on your ideas great, otherwise, action is the best oil for rusty results.

Try the ones you like. Experiment with the ones you don't. You might get surprised. As Tony would put it, "If you do what you've always done, you'll get what you've always gotten". Adopt a growth mind-set over a fixed mind-set. I'd be interested in hearing success stories or your favorite rituals for results -- what techniques have personally served you well?

Forcing Functions

J.D. Meier — Thu, 27 Dec 2007 02:42:00 GMT

Do you have a favorite set of forcing functions? In patterns & practices, one of our forcing functions is building a slide deck. Building a deck is a forcing function because it forces us to distill the points, close down on issues, identify what we know, don't know and need to know next in a fairly constrained way. It helps to balance our elaboration on certain issues.

I like to use blog posts as a forcing function. There's plenty of topics I could write books on, but I like using a post as a forcing function to chunk something down into a nugget of insight, or a collection of nuggets of insight.

Kaizen

J.D. Meier — Tue, 25 Dec 2007 07:48:00 GMT

Kaizen is a Japanese term for continuous improvement. A little Kaizen goes a long way over time. From a personal development standoint, it's key for overcoming resistance.