One Rank Up

When Nobody’s Watching episode six went out last Wednesday. The guest is Dane Clackworthy, who spent more than 20 years in the Royal Marines and now runs UK and Ireland for an OT cyber security company. He’s also my other half. Full disclosure.

I wanted him on because every time someone talks about training that actually works, they point at the military. So I asked him what they actually do. Turns out a lot of it is stuff we could copy tomorrow, and one bit in particular applies to every incident response plan I’ve ever been shown.

In the Marines, everyone trains one rank up. Sometimes two.

Because the person in charge gets taken out. A corporal is expected to step into the sergeant’s job, and when you go on a command course they test you at the level ABOVE the one you’re at, and you either pass or you don’t. So when it happens, and it does happen, nobody is standing around going “well, Dave normally does this.”

Now… who runs incident response in your company? I don’t mean who’s named in the plan. I mean who actually knows how it works. In most (small) companies I’ve worked with it’s one person, and everybody else knows to ring them.

And I mean, nobody in your office is going to get shot. Hopefully. But people get ill. They burn out. They go to Spain for a fortnight and it kicks off on the Monday. Same problem, and we do absolutely nothing about it. I said this on the episode and I stand by it: “we struggle to get people to practice their own fucking role, never mind practicing other people’s.”

Dane had a mate who ran the response to a cyber attack that hit just before Christmas. He briefed the leadership team and, in his own head, he’d nailed it. Then someone rang him afterwards. “Are you all right? You look like absolute shit.” He’d been telling himself keep it together, keep it together. Everyone else could see it a mile off.

And that’s one person, a few days in. Incidents don’t finish on Friday evening. They run for weeks. The people making the calls have got kids to pick up and a life to go home to. So the Marines have a second in command AND a proper handover, and they practice the handover, because otherwise you’ve got one exhausted person making every decision and telling everyone they’re fine.

So how do you get a second person who can actually do it? Not by emailing them the plan.

Dane’s basic training was 32 weeks and none of it was sat down reading slides. Marines go to the Arctic, the jungle, the desert and out to sea, so on the Norway package you build snow holes and you do icebreaking drills. Into the freezing water. Find a way out. “You can’t read about it. You physically have to do it.”

I’ve got a running joke with him about the Marines being a load of blokes running round a field going bang, bang, bang. And we agreed. “The actual shooting bit isn’t the bit that you’re practicing.” What they’re practicing is who’s in command, who’s got the radio, which way the team goes. Everyone has a named job and everyone knows the job next to theirs. “That instinct of choosing the right thing at that devastating time is what makes the difference between good operators and really bad operators.”

And yes, the Marines have an annual test as well. I asked him what he thinks of it. “You’re not measuring yourself on doing one test a year. I mean, that’s pretty poor, to be honest.” All the actual preparation happens either side of it. So then I asked him the same thing about the annual module every company runs, the one that’s supposed to leave everyone more resilient. “Probably not.”

So here’s what I want you to do, and it’s small. Work out who your one person is. Then work out who’d have to do their job if they were off. Then run an exercise, a real one, and don’t let the first person in the room.

You’ll know within 20 minutes whether you’ve got a plan or you’ve got a person.

There’s a lot more in Dane’s episode: what the Marines do in the first three weeks before anyone touches a weapon, how a two-year officer gets told “Boss, I don’t see what you’re trying to do here” and that’s fine, and our Fix It in 60 round, where we handed him a training email marked “third and final reminder” and gave him 60 seconds to fix it.