Reddit reviews The Field Guide to Understanding Human Error

I've thought about this a lot, and from both sides of the coin. Here's kind of where my mindset is at the moment...

Some regulation is absolutely necessary in certain segments of the industry.

There is a very good (but very hard to read) book called Risk Society written by Ulrich Beck that caused something of a paradigm shift in the engineering mindset in the 90s.

To oversimplify, society (and the world it exists in) has become complex to the point that you can not engineer risk out of the equation.

This idea is supported by the findings of people like Sidney Dekker in The Field Guide to Understanding Human Failure, who performs what could be considered root cause analysis of surgical and aeronautical accidents. The systems that he deals with are now complex to the point where there is no single root cause, because failure is an inherent operational condition of the environment. In other words, asking why something failed is exactly like asking why something didn't fail - it was the end result of an impossibly complex web of interrelationships, all of which culminated in the eventual success (or failure) of the system.

There are a lot of scenarios where the tasks undertaken by system administrators do have life or death consequences, and in order to architect those infrastructures with adequate resiliency, a lot of education is necessary.

The path of a lot of system administrators from amateur to professional resembles that of a child who is exceptionally gifted at building erector sets being hired to construct a pedestrian bridge. Then, if the bridge doesn't fall, the kid gets to build bridges designed to handle interstate traffic.

I don't write this to disparage the upwardly mobile system administrator who has learned on the job, acquired a high skill level, and is successful in the systems that they engineer. Someone who does that should be justly proud.

When you start considering the potential loss of human life in such a system, however, you start to realize that "best effort" learning isn't enough, particularly when there is no test to establish a safe knowledge level.

Why should you require a degree in civil engineering to design and implement a traffic control system, then not require the slightest test of the people who administer the IT infrastructure that it runs on?

No, I anticipate that in the future, "critical infrastructure" administrators will have certain requirements laid on them for the benefit of everyone who uses the system. The difficult decision will be where to draw the line.

What are your thoughts?

You're right in the first line, but you don't go far enough with the last line. Current safety engineering best practices will not accept 'human error' as an end-state in the search for why things failed. See The Field Guide to Understanding Human Error by Sidney Dekker for an introduction to the field.

Why would companies learn by firing their employees? Companies think they've resolved the situation when they fire an employee. See every CISO officer being fired after a breach ever - and nothing changes.

Nobody goes into work to make a mistake. I'd bet given the training they had, both of those people thought they were doing the right thing, and that anyone else who'd been through the same training with no IT background would have agreed. the book The Field Guide to Understanding Human Error is very good on this topic.

If you fire someone every time they make a mistake, nobody will ever learn. Only when someone who's already made a mistake comes up against the same situation again and does it right can you be sure you've improved as an organisation. If you don't change anything else and just fire people you haven't resolved anything and it's just a matter of time until it happens again.