When it comes to cybersecurity, many users don't know about the basic nature of viruses. In a series of lectures in the 1940s, mathematician John von Neumann speculated if it would be possible for a "mechanical" organism such as a computer code to damage machines, copy itself and infect new hosts, just like a biological virus. Over the last 60 years, computer viruses have abounded, yet what was once cyber vandalism has turned into cybercrime.

Users should know about the basic nature of viruses

<ul><li>The Creeper Program is often regarded as the first virus. It was created in 1971 by Bob Thomas of BBN as a security test to see if a self-replicating program was possible.</li><li>The Rabbit (or Wabbit) virus was developed in 1974. It made multiple copies of itself, severely reducing system performance and eventually crashing the machine.</li><li>The First Trojan, called ANIMAL, was a game developed by computer programmer John Walker in 1975. To improve the game, Walker created PERVADE, which installed itself along with ANIMAL, examined all computer directories and copied ANIMAL in directories.</li></ul>

The first computer viruses from the 1970s

Brain was the first PC virus and infected 5.2" floppy disks in 1986. Two brothers, Basit and Amjad Farooq Alvi, were tired of customers making illegal copies of their software, so they developed a virus that replaced the boot sector of a floppy disk. This was the first stealth virus and contained a hidden copyright message. It did not corrupt data.

The Brain Boot Sector Virus

The introduction of reliable, speedy broadband networks allowed malware to spread via email, popular websites or directly over the internet. Malware is an umbrella term for malicious software such as viruses, worms and Trojans. The LoveLetter appeared on May 4, 2000. Unlike the macro viruses that dominated the threat landscape since 1995, it came as a VBS file. The subject line was "I Love You," and the email contained an attachment, "LOVE-LETTER-FOR-YOU-TXT.vbs." Onel de Guzman designed his worm to overwrite existing files and replace them with copies of itself.

The LoveLetter Virus

The Code Red worm existed only in memory and did not attempt to infect files on the system. It took advantage of a weakness in the Microsoft Internet Information Server and manipulated the protocols that allow computers to communicate. It spread globally in a few hours.

The Code Red Virus

Heartbleed came out in 2014 and put servers across the Internet at risk. Heartbleed took advantage of a vulnerability in OpenSSL, a general-purpose, open-source cryptographic library used by companies worldwide. It could access data such as user names, passwords and secure encryption keys.

Heartbleed

When it comes to cybersecurity, there are few terms with more name recognition than "computer viruses." Despite the prevalence of these threats and their wide-spread impact, however, many users don't know about the basic nature of viruses.&#160;

technologyandthefuture

Technology & The Future

cybersecurity

Cybersecurity

A Brief History of Computer Viruses & What the Future Holds

<ul><li>Companies are continuing to invest in technology to run their businesses.</li><li>Now, they are layering more systems into their IT networks to support remote work, enhance the customer experience, and generate value, all of which creates potential new vulnerabilities.</li><li>Even today's most sophisticated cybercontrols, no matter how effective, will soon be obsolete.</li><li>The solution is to reinforce their defenses by looking forward-anticipating the emerging cyber threats of the future and understanding the slew of new defensive capabilities that companies can use today.</li></ul>

Cybersecurity: A Never-Ending Race

Mobile platforms, remote work, and other shifts increasingly hinge on high-speed access to large data sets, increasing the likelihood of a breach
To execute these business models, companies need new technology platforms, including data lakes that can aggregate information

Growth of On-Demand Access to Ubiquitous Data/information Platforms

<ul>
<li>Today, cyberhacking is a multibillion-dollar enterprise, complete with institutional hierarchies and R&D budgets.</li>
<li>Attackers use advanced tools.</li>
<li>Ransomware as a service and cryptocurrencies have substantially reduced the cost of launching ransomware attacks, which have doubled each year since 2019.</li>
</ul>

Hackers Getting Smarter And Resourceful

Cyber risk management has not kept pace with the proliferation of digital and analytics transformations, and many companies are not sure how to identify and manage digital risks.
At the same time, companies face stiffer compliance requirements-a result of growing privacy concerns and high-profile breaches.

Increasing Regulations and Continued Gaps in Resources, Knowledge and Talent

Mitigating the cybersecurity risks of on-demand access to ubiquitous data requires four cybersecurity capabilities: zero-trust capabilities, behavioural analytics, elastic log monitoring, and homomorphic encryption.

Building Over-The-Horizon Defensive Capabilities

Shifts the focus of cyberdefense away from the static perimeters around physical networks and toward users, assets, and resources, thus mitigating the risk from decentralized data.

Zero-Trust Architecture (ZTA)

Behavioural analytics can monitor attributes such as access requests or the health of devices and establish a baseline to identify anomalous intentional or unintentional user behaviour or device activity.

Behavioural Analytics 

Elastic log monitoring for large data sets allows companies to pull log data from anywhere in the organization into a single location and then to search, analyze, and visualize the data in real-time.

Elastic Log Monitoring

Homomorphic encryption allows users to work with encrypted data without first decrypting to give third parties and internal collaborators safer access to larger data sets and meet more stringent data privacy requirements

Homomorphic Encryption

To counter more sophisticated attacks driven by AI and other advanced capabilities, organizations should take a risk-based approach to automation and automatic responses to attacks.
<ul>
<li>Automation should focus on defensive capabilities like security operations centre (SOC) countermeasures and labour-intensive activities.</li>
<li>Use of defensive AI and machine learning for cybersecurity.</li>
<li>Technical and organizational responses to ransomware.</li>
<li>The level of digitization accelerates, and organizations can use automation to handle lower-risk and rote processes, freeing up resources for higher-value activities.</li>
</ul>

Using Automation to Combat Increasingly Sophisticated Cyberattacks

<ul>
<li>Secure software development.</li>
<li>Have security and technology risk teams engage with developers at all times.</li>
<li>Software bill of materials.</li>
<li>Mitigate the administrative burden by formally detailing all components and supply chain relationships used in the software.</li>
<li>Take advantage of X as a service.</li>
<li>Infrastructure and security as code.</li>
<li>Standardizing and codifying infrastructure and control-engineering processes can simplify the management of hybrid and multi-cloud environments.</li>
</ul>

Embedding Security in Technology Capabilities

parenting

Parenting

computerscience

Computer Science

artificialintelligence

Artificial Intelligence

Cybersecurity trends: Looking over the horizon

Good digital hygiene really is its own form of civil defense.<ul><li>Ask yourself 3 questions when strange emails arrive, and the answer is supposed to be yes to all of them: Is it from someone I know? Is it what I was expecting? Is it in the format I was expecting?</li><li>Use the 3-2-1 plan for backups: Three copies of any essential data in two different formats or types of storage media, with one of them in a cloud.</li><li>Update the operating systems on your devices, or better yet, enable automatic updates. </li><li>Write down, screenshot or photograph essential street addresses and phone numbers, just in case.</li></ul>

Defending (and Duplicating) Your Data

<ul><li>Flashlights for every person in the house, fresh batteries every so often, candles and matches, solar-powered sources for small devices, portable power stations, and backup generators if you can afford and find one. Not letting your car’s gas tank sit at half-empty or below is always a good idea, too.</li><li>Setting aside a small pile of emergency cash makes sense only if you will remember where you put it. </li><li>Share the location with someone you trust.</li><li>A few jugs of water are never a bad idea.</li></ul>Stay calm. It’s easier to be calm if you’ve done a little bit of preparation.

Dealing With Disruption: Preparations For Lights-Out Aftermath

Russia’s attack may have you wondering what will happen if the conflict spills into cyberthreats beyond Ukraine’s borders. Here’s what you can do to ease your mind.

education

Learning & Education

A Paranoid Person’s Guide to Preparing for Digital Danger

Ransomware has hit new levels of sophistication, with demands for payment skyrocketing into the tens of millions of dollars. Vulnerabilities posed by pandemic-weary organiza­tions and workers logging in from unsecured home networks; others are highly complex, such as ever-increasing connectivity driven by advancing digitization. Rather than the “smash and grab” approach, hackers are now “dwelling” undetected within victims’ environments to better understand where the highest value data and information lies.

Sophisticated Ransomware Hacking

With the use of low-cost ransomware-as-a-service (RaaS) campaigns, this cyberthreat has surged beyond the quiet confines of the C-suite to where boards of directors, regulators, law enforcement, industry associations, insurance providers, and the cybersecurity vendor community all need to be a part of the solution.While governments, law enforcement, and regulators continue to grapple with ransomware issues such as transparency and oversight of cryptocurrencies, companies need to ensure they remain resilient by focusing on ransomware prevention, preparation, response, and recovery strategies.

The New Threat

To achieve a secure work environment, you need to know what technology you have, what and who it is talking to, and then watch it like a hawk. Vigilance is key. To get there, everyone from the board and C-suite to down the line must be on the same page and treat security as a continuous endeavour that balances technology with people and processes to ingrain security into an organization’s DNA.To achieve a secure work environment, you need to know what technology you have, what and who it is talking to, and then watch it like a hawk.

Prevention Of Ransomware Attacks

COVID-19 saw workforces shift to work from home—and home networks are often rife with poor security. Solid basic hygiene would include strong passwords, multi­factor authentication, software updates, restricted access, and network-level authentication.Multifactor authentication(MFA) for critical assets and high-risk users is strongly recommended. This tactic can be a strong barrier for attacks that leverage credential-based access or privilege escalation like ransomware.

The Tactics Companies Can Use: Securing Remote Desktop Protocol

Legacy systems, be it OT or IT, chug along on old software with security gaps. After RDP and phishing attacks, vulnerable software is the next largest attack vector, which is why securing communication channels and patching Windows operating system exploits remain vital.

Patch Management

Ransomware threat actors run free or low-cost software and scanning tools, searching for things like credential harvesting and internal unsecured port discovery from command-line prompts. If command-line capa­bilities end up disabled, the company becomes a more difficult target. Additionally, blocking port TCP 445 on external-facing infrastructure and internal firewalls also helps reduce the attack surface.

Disabling User-Level Command-Line Capabilities

Active Directory is a database and set of services that connects users with the network resources they need to get their work done. The database (or directory) contains critical information about your environment, including what users and computers there are and who’s allowed to do what.

Protect Active Directory

Cyber awareness training and education should be mandatory. You don’t need to be a highly trained and skilled cybersecurity professional, but basic changes in behavior and awareness of where and how threats can enter your organization can further reduce risks.

Education and training

The timing, urgency, and stress of an attack escalate when decision rights are unclear. Who will lead the response team? Is the CEO directly involved or deliberately removed from the tactical details of the response?Designate a person accountable for keeping the crisis response moving forward in a methodical and detailed manner and ensure decision trees end up aligned, from the chief information security officer (CISO) or chief security officer (CSO) to the CEO or response leader.

Preparing For An Attack: Know Your Decisions Right

Prior to experiencing a ransomware attack, the majority of companies say they will not pay a ransom. However, when nearly two out of three organizations ended up victimized by a ransomware attack over the past 12 months, over 80 percent paid the ransom demands, according to a 2021 report from ThycoticCentrify on the state of ransomware.Constraints can range from the level of insurance coverage to whether customers’ data are also at risk and premerger or pre-acquisition sensitivities. Given these will change over time, ensure this view is refreshed periodically.

Preparing For All Options and Understanding Negotiating Constraints

Generally, board members will want to help and bring issues to closure—the success of which all comes down to communication. That is why the board and executive leaders need to engage in a critical conversation detailing roles and how to activate them. This level of communication and advanced planning can facilitate faster decision making and collaboration. Resiliency becomes baked in when cybersecurity becomes a joint capability between the board and executives and through all levels of the organization.

Getting Your Board Up To Speed

Business continuity answers the question, “How do we operate this process if a particular technology or person is disrupted?” Whereas operational resilience targets the bigger question of, “How do we organize such that a particular event does not disrupt us?” Companies should have answers to both questions to prepare for cybersecurity attacks.

Enhancing Resilience

Approaching ransomware prevention and preparedness from a resilience perspective frames the requirements and outcomes differently:<ul><li>Know what assets are important (crown jewels, critical assets) and where they live.  </li><li>Know the backup process, which will help assess how feasible recovery is. It’s also good data hygiene to only keep what you need.</li><li>Recovery testing is always helpful. Testing in advance of disruption builds muscle memory, uncovers dependencies, and encourages creative thinking and problem solving.</li></ul>

Preparation: The Requirements

In a ransomware attack, time is of the essence, so collaboration and transparency prevail. When an organization becomes aware of a ransomware attack, it should not compartmentalize the challenges ahead. The CISO or CSO needs to ensure transparency and collaboration with internal stakeholders across the company, including the board, C-suite, affected business groups, compliance and risk, and legal and crisis communications teams.

Response

Your organization’s network of external stakeholders can provide valuable input and help expedite risk-based decision making.An organization’s first call should be to the FBI, or a regional and supervisory law-enforcement agency, for notification and disclosure. For very large financial institutions or <a href="https://www.mckinsey.com/business-functions/risk-and-resilience/our-insights/building-cyber-resilience-in-national-critical-infrastructure">companies managing and operating critical infrastructure</a>, there is a broad range of law-enforcement capabilities available.

Phone A Friend

The US Department of the Treasury’s guidance on ransomware payments requires organizations to consult with them if they need to pay the ransom. However, since ransom payments could violate sanctions against certain individuals or designated organizations, the Treasury’s Office of Foreign Assets Control and its Financial Crimes Enforcement Network say organizations could be held liable for ransom payments, even if they were unaware or unable to determine the recipient is on a prohibited list.

Proceed Carefully

External counsel, as well as insurers, are significant partners to have at the table. From discerning who to notify and when to working through the finer points of negotiation and possible implications and thinking through the legal requirements for customers and partners—especially third parties—these stakeholders bring practical benefits.

Seek Counsel and Check Insurance Policies

Some RaaS groups have call centers that will proactively reach out to down­stream customers and activist investors to put pressure on a victim to pay. Expect this and have a plan to engage stakeholders, whether proactively or in response to their queries.Your response leader can serve as “air traffic control” to manage the responsibilities of all parties involved.

Expect Pressure

Dig into forensics and intelligence. In the earliest stages of the attack, use intelligence to determine who is behind the attack and how they were able to gain access and maintain persistence and detonate the malware. This knowledge will aid in understanding how bad the attack is and assist in decryption and negotiation.Attempt to locate or access known unencrypted shadow copies of data or even a decryption key using member institution initiatives to determine if their information can be decrypted without paying.

Intelligence And Forensics

No matter what, recovery from a ransomware attack can be messy. If you decide to pay and get a decryption key—and if it works—there is usually a considerable amount of cleanup because the attackers shut down servers and databases not designed to shut down hard. If you don’t pay, rebuilding networks from backups is time consuming.Verify. For attackers, ransomware is a business, and they want to keep their reputations intact.Know what’s up for debate. For large and more mature institutions, forensic teams can generally figure out how to find or trigger the decryption key.

Recovery

Remember that you are collaborating with criminals, so the closer a company gets to pay the ransom, the more it needs proof that the attackers actually have what they say they have.Make no mistake about it, ransomware is ugly. But making your enterprise resilient by following prevention, preparation, response, and recovery strategies will allow a company to recover from attacks and not have to pay a huge ransom. Communication, advanced preparation, understanding and then minimizing risk is the best way to keep the operation up and running.

The Bottom Line

Ransomware has rapidly become one of the top cybersecurity nightmares. Strategies for prevention, preparation, response, and recovery can help.

problemsolving

Problem Solving

Ransomware prevention: How organizations can fight back

The digital transformation is great for many things, but it also creates a playground for cybercriminals, identity thieves and fraudsters. Cybercriminals are an invisible enemy that only needs a device and internet connection. Then they can make multiple attempts to defraud people or businesses.

Fraud in the digital age

It's easy for cyber fraudsters to steal or assume another's identity. Sometimes it's not even an individual but a ghost, auto-generated by a few lines of code. Photographic proof is easy as fraudsters give themselves a random human "face" using a facial composition app or by stealing a photograph from someone else's social media page.

Our identities are under attack

Individuals can put systems and protections in place to stop fraudsters at the source. Advancements such as zero-trust security and secure access service edge (SASE) models can ensure that security extends to the user and the device, regardless of where they are.

Securing the digital ecosystem

Companies and individuals need to take steps to protect themselves from fraud.

How Fraudsters Steal Your Data in the Digital Age

The product company partners with multiple teams, serve customers and end-users. As a result, disagreements are inevitable in a product manager's daily interactions. Effective collaboration can't take place if we don't deal with the conflicts that arise. However, knowing how to handle conflict can generate creativity and strengthen collaboration.

Effective collaboration is essential

The FBI's Crisis Negotiation Unit developed this method to change someone else's behaviour.<ol><li>Active listening: It's important to really listen to the person you're in conflict with.</li><li>Empathy: Try to understand the other person's perspective and needs.</li><li>Rapport: When people feel understood, they are more likely to trust, enabling us to build rapport.</li><li>Influence: The closer relationship created is a baseline to encourage someone to listen to our perspective.</li><li>Behaviour change: By following the first four steps, you're more likely to change someone's behaviour.</li></ol>

The behavioral change stairway model

We can train ourselves to be better listeners:<ul><li>Be fully present and listen with attention.</li><li>Keep an open mind and try not to judge.</li><li>Listen for what is being said, emotions that are present, and expressed needs.</li></ul>

Techniques for better listening

<ul><li>Speak and act with integrity.</li><li>Get to know people and allow them to get to know you.</li><li>Encourage others to share their ideas and/or concerns in product decisions.</li><li>Be supportive and offer help whenever appropriate.</li><li>Strengthen your product management expertise </li></ul>

Techniques for building trust

Best Practices to Align Stakeholders, Guide Development Teams, and Create Value Together

books

Books

teamwork

Teamwork

product

Product & Design

leadershipandmanagement

Leadership & Management

communication

Communication

Leading in Product Management 

Learn how to effectively handle conflict as a product manager (which can lead to better collaboration) from product management expert Roman Pichler.

How to deal with difficult stakeholders as a product manager

A lot has been said about avoiding the feature factory approach to product management. No one wants to work on a product as though they’re “sitting in a factory, cranking out features, and sending them down the line,” without knowing if they’re actually having any impact. It’s the definition of aimless busywork. It’s jumping straight from one project to the next, with no evaluation of whether past efforts made a difference. It’s a fixation over shipping features regardless of the actual outcomes they drive for your users and your business.

Avoiding The Factory Approach

Objectives And Key Results (OKRs) are credited for the rise and dominance of companies like Intel and Google, where it has helped them move mountains while maintaining alignment and agility at scale. And it’s been employed by thousands of smaller organisations that are plenty agile, yet looking to focus their scattershot efforts on one clear strategy. The logic behind OKRs is intuitive, time-tested, and universal to defining good objectives in general.

Defining Objectives And Key Results For Your Product Team

OKRs provide a flexible hierarchy of objectives that cascade down through every team and individual. Everyone knows what to focus on. Everyone’s objectives are aligned.
Objectives are inspirational (qualitative) goals that communicate the business outcomes you’re looking to reach. They’re timebound, most often to a quarter, or sometimes to a year.
Key results are the 3-5 indicators (often quantitative goals/KPIs) associated with each objective that help you track your progress and ultimately determine whether the objective has been met.

OKRs Explained

The key results at the organisational level can become objectives for the next level down — whether that’s division, department, or team (depending on the size of your organisation). The further down you go, the more specific and tactical the objectives become.

The Pyramid

A company’s highest objective is stated in its mission statement, but when discussing top-level objectives, we typically mean the goals the company aims to reach in the next quarter, half-year, or year. Company objective: Expand our impact by selling to the enterprise (by end of quarter)— KR: Win 20 new enterprise deals— KR: Grow sales-touched revenue by 20%— KR: Grow ARPA by 15%— KR: Launch major product initiative Y

Company OKRs

The product team’s objectives are often especially closely aligned with the organisation’s at large. Even at larger organisations like Google where objectives exist at the parent company, company, division, subdivision, function, team, and individual level, a company-wide objective (e.g. Increase market share within segment Z) may skip multiple levels to be assigned to an individual team! What a thrill to have the entire company rallied behind your success, but quite some pressure too.

Product Team OKRs

If you’re a product manager, your objectives will likely address a handful of user needs or business goals. Key results may include the successful launch of major features and the indicators you use to measure desired outcomes. Objective: Help customers better categorise their data for rapid retrieval— KR: Ship tag management— KR: Ship advanced search— KR: 80% decrease in support tickets related to tags If you work at the director or VP level, or if you’re a product manager at a startup, you will likely own the objectives of your team of product managers, department, or division.

Individual OKRs

By choosing your own objectives and key results, you use the context you have from the frontlines to decide the best way you can generate value for your customers and your organisation. And in the mid-term, inputs that employees on the frontlines feedback to leadership can influence the top-level objectives set for future cycles.

Choosing Your Own OKRs

Don’t tell people what to do; tell them what you need accomplished, and you’ll be amazed at the results

The primary purpose of OKRs is not just to document, but galvanize. If OKRs are to be made sufficiently ambitious, they need to be kept separate from performance evaluations. Otherwise goals tend to be set too conservatively to do much good. This is especially true of moonshot OKRs. If you find moonshot OKRs are being met with close to a 100% success rate, you’re probably not setting ambitious enough targets.

Succeeding with OKRs

What gets measured gets managed

When setting key results, consider what negative outcomes they might incidentally incentivize. Aim to counterbalance these. Keep an eye out for blind spots! If you’re setting key results to validate whether users are getting value from a new feature, it’s likely not enough to verify that they configure it (adoption). You’ll also want to ensure that they’re coming back on a regular basis (engagement).

Counter-Balance Your Key Results

To get full value from OKRs, post them where you’ll see them every day, or adopt a dedicated OKR management solution and refer to it on a regular basis. Capture product OKRs in a product management solution like Productboard where you can use objectives to prioritise and plan supporting feature ideas. Score your key results to indicate your confidence that you’ll meet them and update regularly.

Don’t Forget Your OKRs

OKRs bring the promise of greater focus, alignment, and measurable progress toward exciting outcomes. They require an upfront investment and ongoing attention, but hopefully with the tips we’ve reviewed here you’ll be well on your way. As with all things, sometimes your best bet is to start small and just get started. You can take OKRs for a trial run and adjust as you go.

Life Beyond The Factory

Whether you’re new to objectives and key results (OKRs) or just brushing up, this stash aims to help you feel more confident about driving your product team toward clear, measurable outcomes in 2021

Whether you’re new to OKRs or just brushing up, our blog post aims to help you feel more confident about driving your product team toward clear, measurable outcomes in 2021.

personaldevelopment

Personal Development

Defining objectives and key results for your product team | Productboard

The issue: Users incorrectly used a new medical device that capture images of the human retina. Users didn't read the user manuals or watch the training videos. This could potentially cause a false diagnosis and possibly permanent blindness. The team had to re-train the medical staff but couldn't sustainably do this for every customer. The only solution was to improve the UX. Ultimately, the issue was lacking direction in designing for user understanding. Three biggest takeaways:<ul><li>Be bold</li><li>Exploit familiar analogies</li><li>Think beyond screens and wireframes.</li></ul>

Designing for user understanding

The product suffered from two key issues: <ul><li>Essential complexity: Essential complexity is directly caused by the problem you're trying to solve. It suggests removing less important functionalities.</li><li>The 80/20 rule - users only use 20% of your product 80% of the time. Anything beyond the 20% is adding to UX confusion.</li></ul>Solving the UX required dropping anything non-essential and simplifying the essential.

Preventing key issues

The complexity of a product and having a lot at stake can make it difficult to take risks. This makes it easier to fall prey to the 'focusing illusion." The focusing illusion is a bias that states that nothing in life is as important as you think while thinking about it. It can prevent you from being bold. The first step is to force yourself to err on the other extreme.

Be bold

Replace, not remove.Essential complexity can be simplified with familiar analogies. <ul><li>This can reduce the amount of learning for the user.</li><li>It eliminates any potential confusion a user may have.</li></ul> Progressive disclosure.This is the practice of only showing features that are immediately relevant to the user. Everything else is hidden from view. This is great for essential features that are rarely used.

Exploit familiar analogies, progressive disclosure

While working on a re-design, it's easy to become too focused on the UI. However, broadening your perspective and designing beyond screens or wireframes can solve a user's problem.

Think beyond screens and wireframes

This company built medical devices that captured images of the human retina. But the UX was complex, potentially causing errors. Using an iPhone helped them to tap into their network of accomplished app designers and ask for help. Apple noticed the device, and reached out and offered to help. This experience resulted in three key UX take-aways.

How Apple helped us prevent blindness through better design

The job profile of a product leader is akin to a CEO of a company.
A product leader is ultimately responsible for the success and failure of a product, and by extension, the company itself. This raises the question of what makes a true product leader.
We find out the traits of a model product leader and the product team in this book.

The Product Leader

More and more organisations are moving away from a traditional top-down approach, whereby senior management determines ‘upstream’ what people ‘downstream’ should be doing. 
Companies like Spotify have been very successful in creating autonomous and cross-functional teams. The success of this approach doesn’t only come from the cross-functional and collaborative nature of Spotify teams; people within these teams are also very close to the customer. The People in the company are the product.

Employees Are Paramount

The primary focus has to be on the problems faced by customers. Instead of features, one can opt to provide themes, based on what the customer wants and what problem is solved.
Themes are a promise to solve problems not to build features. Once you’ve truly understood customer problems, you can start prioritising. Prioritisation is best done through the lens of the core product management principles: first, is it valuable; second, is it usable and third, is it feasible?

Focusing On Customer Problems

Successful product teams do NOT require hard skills, such as engineering, design or even specific product management expertise. 
In contrast, with product managers, the focus is much more on soft skills.

A Successful Product Team

Experienced product people with strong soft skills are low in supply in most markets. One can derive the characteristics of good product leaders from the high level traits of a successful team. One key aspect in this respect is a product leader’s ability to align team members around a shared goal or vision.

How To Identify Product Leaders

Common characteristics of Successful Product Teams: <ul><li>Lifelong learning.</li><li>Strong communication.</li><li>Empathy.</li><li>Diversity.</li><li>Business savvy.</li><li>Cross-functional representation.</li><li>Collocation.</li><li>Autonomy.</li><li>Interdependence.</li><li>Accountability.</li></ul>

Product management and product leadership are people-first roles. Teams are made up of individuals who each bring their own personalities, perspective, and opinions. Understanding what makes people tick makes it easier to get the best out of them and identify when there is a problem.
Being an empathic product leader doesn’t mean you have to be all things to all people but you’re able to engage emphatically with others, even if they don’t have a lot in common with them.

Playing Well With Others

The kind of leader that needs constant recognition and praise is not likely to be the best person for this job. 
The top product leaders hardly ever get recognition for their hard work and dedication. Furthermore, they tend to turn any limelight they receive back on their teams.

The Team First Approach

Product leaders are typically comfortably wearing the hats of marketer, manager, technologist, customer advocate, and facilitator, to name a few. 
This doesn’t mean they are experts at each of these roles; rather, they are comfortable working across all areas as the role evolves or as the product demands.

Wearing Multiple Hats

Having a deep interest in learning, enthusiastically accepting new challenges, encouraging others to speak up, and listening to their perspectives are all actions driven by curiosity.

Curiosity

The ability to share information in a clear, concise manner is a necessary and desirable skill for a product leader. 
Whether they’re talking, listening, writing, planning, sharing, or facilitating, the goal is always to be understood.

Clear Communication Ability

This might be controversial, but when you consider what product leaders do each day, it’s no surprise that selling is one of the things to look out for in product leaders. 
To be clear, this is not the type of selling associated with business development; rather, it’s not the type that works to change minds and get buy-in from others.

Every Job Is A Sales Job

<ul>
<li>Equanimity.</li>
<li>Working with ease under pressures and deadlines.</li>
<li>Having an understanding that shipping products is a race against time.</li>
<li>Displaying grace even under fire.</li>
</ul>

Other Traits of A PL

Product Leaders and Product Teams: Management Basics

In today’s lightning-fast technology world, good product management is critical to maintaining a competitive advantage. Yet, managing human beings and navigating complex product roadmaps is no easy task, and it’s rare to find a product leader who can steward a digital product from concept to launch without a couple of major hiccups. Why do some product leaders succeed while others don’t? This insightful book presents interviews with nearly 100 leading product managers from all over the world. Authors Richard Banfield, Martin Eriksson, and Nate Walkingshaw draw on decades of experience in product design and development to capture the approaches, styles, insights, and techniques of successful product managers. If you want to understand what drives good product leaders, this book is an irreplaceable resource. In three parts, Product Leadership helps you explore: Themes and patterns of successful teams and their leaders, and ways to attain those characteristics Best approaches for guiding your product team through the startup, emerging, and enterprise stages of a company’s evolution Strategies and tactics for working with customers, agencies, partners, and external stakeholders