Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: Cyber Security Awareness Month - Day 21 - Impossible Requests from the Boss - Internet Security | DShield SANS ISC InfoSec Forums


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Cyber Security Awareness Month - Day 21 - Impossible Requests from the Boss

When I saw the topic I was given for this month, I immediately burst out laughing as I have (while never violating an NDA) shared more than a few horror stories, complaints and tales of woe (from the perspective of both employee, and boss) with my fellow Handlers.  In retrospect, some were not as bad as they seemed at the time, and some are far worse.  In the end, as someone who has held positions from helpdesk to CISO of a global company I have a broad range of experiences to draw from in giving you my opinions on how to handle those impossible requests.

A few caveats before we begin:

This information is more suited for being used to deal with North American Style managers.  Business culture in other areas is often different and these opinions may not be appropriate for those environments.

Please understand that I speak in generalizations as there are far too many variables to be specific.

This information is not meant to be used for legal or ethical issues.  These are separate topics that have their own set of rules to follow.

We've all had a boss who makes impossible requests or demands.

When we get together either in the same physical room or virtually, through email, IM, chat rooms or the like, we trade war stories that, much like the fish who got away, seem to grow bigger every time the tale is told.

We pride ourselves on creative ways that we fulfilled or skirted the request, and at least once have imagined ourselves as the person who printed a day's worth of firewall logs on bright orange paper and dumped 600 pages on the boss' desk in response to a request for what we do all day.

When all is said and done, at the end of the day, the reality of the situation is still there and the impossible request still exists.

My personal belief is that impossible requests are often a sign of a manager who needs help with their management or technical skills.  Especially in areas such as ours where promotion through technical excellence is common, people promoted into management often don't have the tools needed to make sure they, and their staff are not put into an impossible situation. This is not their fault.  Similarly people who are trained in the art of management may not fully understand the technical aspect of the request and why it is, to you, impossible.  Again, this is not their fault.

For the most part, it's not about you. Don't make the mistake of taking it personally and thinking your boss has it in for you or is trying to make you quit.  if  If a manager is intentionally making your life miserable you'll know it because truly impossible requests will only be part of the problem.

When you receive that impossible request, finding the reason for the request will prepare you for appropriate action.  But you don't always have the time or the ability to gather this information and often need to react in a very short time period if not immediately.

What do you do?

The first thing is to make sure the request really is impossible.  Many times even a brief examination of the task shows it's not.  Take some time to cool down if you had an immediate negative emotional response.

After some analysis you will be in one of three different positions.

The task still seems impossible.

It's too close to tell.

It maybe possible after all.

Communication with your boss is crucial at this point and how you say what you need to say has more influence on the eventual outcome than you may know. Don't respond immediately with an email or by phone if at all possible.  While either may be more comfortable, you really want face-to-face communication.

Regardless of the outcome of your analysis, ask your boss (face to face) for a meeting and discuss the request.  Hopefully you know your boss well enough to know how to talk to him or her.

If you don't or you don't know what I'm talking about, Google 'personality types communication' and look at articles on identifying and communicating with the four basic personality types.  If you can't find anything, feel free to contact me off-line and I'll point you to some specific resources.

During the meeting, be calm.  Speaking loudly in a rushed manner with excited or worse yet, angry tones will do little more than raise your blood pressure and your manager's and may in fact make the situation worse.  Finishing his or her sentences is also a bad idea.

Give your manager time to talk and wait a moment to compose your response.  This is not the place for ready, fire, aim.

It has been said that you can say just about anything you want as long as you say it with a smile.  Smile.

Now that you're in the meeting, you are calm and otherwise prepared, if the task is possible have a rough plan prepared outlining the solution.  Problem solved, end of issue and you may even score some points if this isn't your typical behavior.

If the task still seems impossible you have two options.

One option is to tell to your boss straight out why the request can't be fulfilled.  In my experience it is a rare manager that will listen to the blunt truth with little to no sugar-coating.  Why?  I'm not sure exactly because this is what I ask of my staff.  Give me the facts as they exist.  If you do receive an impossible request from a manager who wants the blunt truth, chances are the manager isn't very technical or may be technical but not particularly knowledgeable in your field.  A calm discussion of the facts and providing a workable solution is usually enough to dispel whatever misunderstandings or misconceptions the manager had when making the impossible request, providing he or she has control of it.

If you don't have a manager that responds well to this direct communication style then make sure to use positive wording.  For example, "I would certainly be able to do this if I had ..."  Just make sure what you're asking for is reasonable and will allow you to get the job done.  If you come back later saying you need more of whatever you had better have a very good explanation as to why.

Speaking so directly to this sort of manager is a bad idea.  You are often seen as being confrontational or worse yet, you are seen as challenging your boss' authority.  Even if you win, you've lost.  While you may have shown off your leet technical skills and immense knowledge you made the relationship between you and your boss worse.

Asking for help understanding the bigger picture during this meeting is always a good idea as it may give you additional information.  Hopefully your manager will see your point and give you the resources needed.

Why do we get these requests?

It could be that the action was dictated by the business or it could be a "request" from your manager's boss.  Most likely his hands are tied, and so are yours.

Maybe your manager is trying to make him- or herself look good for any one of a number of reasons.  Help him or her.  Explain the issue and a realistic solution.  Your boss won't look good if the task truly can't be done, and they know it.  Some people go so far as to imagine that another entry in their job description is "Make my boss look good"

Another possibility is that your boss is new to management and hasn't learned about mutiny.  Explain (gently) to your boss that you want to get the job done but there are certain obstacles that are out of your control.  Ask him or her to help you clear those obstacles.  While stroking a manager's ego may seem unpalatable, sometimes it's the only way.

It may be that your manager is trying to show you (or someone else) that they are in control.  This is a big problem.  The chances of this boss acting on your concerns after a reasonable discussion are whatever comes just after zero. Document the request and your meeting and file it away somewhere safe so when you are called out for failing to complete the task you at least have a record showing that you knew the task would fail and communicated that to your boss but were ordered to do it anyway.  It's not much, but it's something.

At this point it may be a tempting option to go over his or her head.  Do you see that little red light blinking in the corner of your eye?  That's your career dissipation light and it just went into overdrive.

Nobody likes to be run over like that. Trust me when I say that your working life at that company will be miserable until you leave.

Going to your Human Resources office is only marginally better.  Your hostile workplace complaint will be taken, and your manager informed.  Don't expect your boss to be nice and sweet and remove the impossible task from your shoulders.

At the end of the day unless you convince your boss otherwise, you need to fulfill that impossible request to the best of your ability and document the situation.

If this becomes the norm then maybe it's time to find a new position.  Yes, times are tough but being miserable in a job you've come to hate is a terrible way to live.  Life is too short to be that miserable.

I hope this has helped you learn at least a bit about dealing with (what seems like) an impossible request.

If you have any techniques you are particularly fond of, send them in and I'll post them.

I leave you with a quote to ponder which I firmly believe and have seen attributed to many different people.

"Nothing is impossible, it just hasn't been done yet."

Christopher Carboni - Handler On Duty

isc dot chris at gmail dot com

Chris

140 Posts
Good article and pretty much spot on. Give them the initial feedback, gather additional details needed to further define the problem and solutions, tell them you will look into how to solve or work around any problems, and then come back and tell them what your stoppers are if they exist. Also, explain what other tasks might get delayed while you are working on this task.
Anonymous
At my first serious job interview the interviewing manager asked me almost exactly that. I told him I'd try to explain why the task couldn't be done as formulated, and try to offer workable alternatives. He nodded and pushed on: "What if your boss insists you do it just like that?" My reply (ad.lit.) - "I document everything and do exactly what he wants, give him all the rope he wants to hang himself."

I was hired despite that, and found out later that the questions were plot-relevant foreshadowing on his part.
Anonymous
When I get an impossible request, I usually find that it is because the boss has over-specified the task (getting into the technical details when they shouldn't). I then try to get them to just describe the business function that is trying to be achieved and tell them to let me figure out the technical details myself.
Skip Carter

4 Posts
In my experience over the decades, I have encountered a few cases where the impossible request was because the boss was literally insane. While admittedly rare, something to keep in mind.

In one case, the president of the company apparently found the wiring unsightly, so he cut off all the cables in the PBX & server room with hedge shears. He demanded we (IT) get the phones and computers working again, but without "all those nasty wires." After some debate, and with trepidation, my immediate boss called the chairman of the board. That's about as go over your boss' head as you can get. While the chairman was doubtful, he did call the president, followed by a call to the police to take the former president into custody. Later, we discovered the president had ordered the janitorial staff to sweep the parking lot to "get rid of the ants before they got inside," and had made some bizarre requests of engineering, but no one had the courage to do anything about them.

In another instance, the CFO demanded we "fix the database," since it showed the wrong balances, as they did not match his financial reports. As we discovered, he had been spending money based on his own projections, not the actual amount the company had received. That one I was able to report to the CEO's secretary.

Sometimes you have to deal at a higher level of responsibility than the chain of command.
Rastech

18 Posts
In my experience over the decades, I have encountered a few cases where the impossible request was because the boss was literally insane. While admittedly rare, something to keep in mind.

In one case, the president of the company apparently found the wiring unsightly, so he cut off all the cables in the PBX & server room with hedge shears. He demanded we (IT) get the phones and computers working again, but without "all those nasty wires." After some debate, and with trepidation, my immediate boss called the chairman of the board. That's about as go over your boss' head as you can get. While the chairman was doubtful, he did call the president, followed by a call to the police to take the former president into custody. Later, we discovered the president had ordered the janitorial staff to sweep the parking lot to "get rid of the ants before they got inside," and had made some bizarre requests of engineering, but no one had the courage to do anything about them.

In another instance, the CFO demanded we "fix the database," since it showed the wrong balances, as they did not match his financial reports. As we discovered, he had been spending money based on his own projections, not the actual amount the company had received. That one I was able to report to the CEO's secretary.

Sometimes you have to deal at a higher level of responsibility than the chain of command.
Rastech

18 Posts
For the more normal impossible requests, the advice to think twice before responding is excellent. I have lost at least one role from a too quick response, which, on further thought, I could have handled better.

I have generally had success by incorporating a back-of-the-envelope ROI calculation with documentation of both the risks and benefits inherent in it, with a meeting to discuss and then a request to sign off on those aspects that are beyond my authority level. I have gotten resistance to that in some cases, but I then file the request further up the chain of command with a request to discuss. While that could have negative repercussions, I've never actually encountered any from the higher ups. As long as I express myself as trying to fulfill the business goals, with some concerns, I have been accepted at that level. I may be ordered to do the task anyways, but that's alright - I made my concerns known. If I succeed that's great, and if I fail, then I'll do a post-mortem with the boss on why it failed. I always stay civil, polite, smile and try to make the project into a joint effort to solve the impossible task, whether it fails or succeeds.

Since I had a trial-by-fire wherein one of my staff was physically assaulted by a manager for attempting to do his job correctly, I refuse to kowtow to anyone, and, due to my earlier experience as noted above, I am willing to escalate matters as far as needed. Doing it with civility is key.
Rastech

18 Posts

Sign Up for Free or Log In to start participating in the conversation!