BriefingsDirect Transcripts

Unified Data and AI: Elevating Telecom Customer Experiences

2025-08-22T10:22:00.004-04:00

Welcome to the Data Cloud Podcast. The next episode features an interview with Soren Marklund, Vice President of Global Services Technology Consulting and AI Data Strategy at Ericsson, hosted by Dana Gardner, Principal Analyst at Interarbor Solutions. They explore how Ericsson leverages modern data architectures to enhance customer interactions and drive business benefits.

The discussion covers the importance of a unified data operating model, challenges faced with data silos, and the role of AI and machine learning in improving customer service. So please enjoy this interview between Soren and Marklund and your host, Dana Gardner.

Dana Gardner: Welcome to the Data Cloud Podcast, Soren. We're delighted to have you with us.

Soren Marklund: Thank you for having me.

Dana Gardner: You know, few functions are more integral to an enterprise success than effective and efficient customer service and support. And over the past few decades, the means -- not just the ends -- of sophisticated customer services have proven beneficial to businesses in many ways by capturing all the information that it requires to deliver such customer support.

For example, companies coalesce and structure their essential knowledge and free it from silos by capturing and structuring all the feedback that they receive from what clients and customers tell them about how their products and services are working in use. This attains priceless insights into making products and services better to maintain and how to improve the next iterations.

Clearly a focus on managing and exploiting all the data and information around the service and support function pays huge dividends. And that was true even before we applied machine learning and artificial intelligence (AI) tools into the mix.

In today's discussion, we'll explore how multinational networking and telecommunications powerhouse Ericsson has employed modern data architectures to further innovate around customer interactions for multiple valuable business benefits.

Soren, tell us why it's so important to get the data architecture right in order to pursue better customer service through greater use of AI.

Soren Marklund: It is a very relevant question. And, of course, it’s been on our minds for quite a few years. We have, as a company, wanted to be data driven in everything we do -- whether it's in services, products, interaction with customers, and what have you.

The journey began with how to drive such intelligence. We realized very quickly that the data fabric, the data foundation, and the data operating model are instrumental in making this happen. We began the journey of looking at data as an asset within the company. Prior, we dealt with data as the input-output of different processes. We have been a very process-focused company for many years.

When we started a data journey, we realized that the process itself is what drives information and efficiency. But the importance of data is equally important. Managing data and the lifecycle of data -- and having a unified way of working with data -- is pivotal to making this happen.

You could argue that we have been operating in silos around data. And naturally that means that everyone within the company -- or even on the customer side – does not necessarily have within their reach a view of all the data that they should.

The opportunity is probably the biggest that I have ever seen in the industry right now. It's breaking down these silos, working in a data operating model, and then unifying it. And for Ericsson, being an international company, it's very important that we have unified ways of working with data across the world.

Dana Gardner: And it's important for this data to be trusted to be valuable. It's the old adage of, “Garbage in, garbage out.” You want to have that high-quality, trusted, and secure data.

What has Ericsson done to pursue not only gathering as much data as possible, but adding a qualitative value and trust benefit as well?

Soren Marklund: Yes, as we put the data operating model in place, we realized that we need to work in two dimensions. One is the digital capabilities that we need to embrace and innovate around. The other is a more horizontal aspect across the company. We needed to have a data operating model. We actually assign data managers to operate and take care of the assets as a data asset.

The two dimensions, Dana, the horizontal being the data operating model and the vertical being the digital capabilities. You then need to look at that and say, “How do you trust the data?” Because when we started the journey, you could argue we had many sources of truth.

Whomever wanted to use data only trusted what they had within their own reach. Yet we collected a lot of data in multiple instances across the company. So now, with the data operating model in place, we are harnessing common sources of truth so that we have one ownership and one drive to ensure that the data is of the high quality it needs to be to ensure that it has the freshness it needs, and also to make sure that we have the metadata needed behind the data to really put it in the context of the user.

Dana Gardner: Network devices are notorious for delivering reams of data. There's so much log data, for example. What were some of the challenges that you've been facing to not get overwhelmed, but to find the jewels within all of that vast volume of data from your devices in the field and across entire networks?

Soren Marklund: Yes, to your point, if you look at the mass of data that we have, it's easy to get trapped in the noise because there is just so much. You have to have the context of what you're trying to look for. This is where the opportunity comes in for the service organization.

This is where we have put a lot of emphasis within our Ericsson units, to embrace and embed service knowledge into this process. That domain expertise allows us to be more focused on the data that we need to capture, but also to understand what is symptomatic in the data versus cause-and-effect in the data.

If we can drive to the true insights that we need to fully understand -- whether it's performance of our products in the network, customer experiences, or just looking at correlation points – we try to understand what more could we innovate around.

Dana Gardner: I'm really interested to hear more about how you've gone about this unified data structure and what you can do with it when you have it in place. But tell us first a little bit about yourself, your role at Ericsson, background, and why taking on these challenges is important and valuable to you in your career and as an individual.

Soren Marklund: I have had the opportunity and the fortune to be working for a company that allowed me to work in many different roles over the years. I have been on the product side, in sales, and in operations. In all of these dimensions, I've been able to see across the company what drives our customers’ experiences.

I have been very much focused with a passion around how do we transform to be more customer-centric and data-driven across the company. The journey started, as I mentioned, around driving intelligence into everything we do.

I then realized that my passion is around driving the strategies for the data and the intelligent transformation around everything we do. I've taken a strong role over the last two years to do what I can do to further and accelerate the company and this uptake.

Dana Gardner: Soren, why do you think this is an exciting time in the evolution of technology to bring about the realization of your passion? Is this a unique inflection point? Are there things that we can do now that we couldn't before?

Soren Marklund: Absolutely. When you look back at the journey of, for example, the AI machine learning activities, it was very much driven by expertise and teams of expertise within the company. It required such deep data science expertise or data engineering expertise that it wasn't accessible to everyone. We have been on that journey for many years and with the expertise we have developed some very smart and intelligent use cases around it.

But the emergence of generative AI -- and now agentic AI and multi-agentic AI is -- taking this to an accelerated pace than in the past. This is what's opening up the opportunity across the company. Now we can work in natural language. We can work in no code scenarios. We can data mine and explore the data and in many other ways than just relying on a top-of-the-pyramid expertise to guide us.

This is democratizing things within the company. We're going to accelerate that path. When you look at the GenAI models and the LLM models behind it, they're to a great extent pre-trained. We need to just add our models to make it context-aware into what we are trying to do. But it's accelerating so much faster nowadays with the advancements in technology.

Dana Gardner: Please describe Ericsson's federated operating model, particularly within a hybrid cloud setup. How do you characterize and describe what's come to be the best and most up-to-date approach?

Soren Marklund: We had, as I mentioned, been working in silos. To a great extent, you could argue that we still do in many ways. Not only silos on our side between units and such, but also in silos between us and our customers. The opportunity is unifying a data architecture that embraces more collaboration across all of Ericson and across our customers.

We’re implementing and driving forward a more unified, federated operating model. And by that we mean we can work in the context of different countries, different regions, and work better with our customers in those regions.

At the same time, based on assuring the sensitivity and the privacy, we can harmonize the data on a global level to attain full insights of what's happening all across our customers -- and for all of the products and the behaviors of our products.

And, again, in this context, we can embed the instrumental services knowledge. We can converge a federated operating model and embed the service knowledge into this process to gain, in the end, more insights by having information at the fingertips in discussions and enhancing the experience with our customers.

Dana Gardner: And what have you looked for particularly in the providers, the vendors, the suppliers of the infrastructure behind this federated approach? What's important in order for you to get what you need to get this done?

Soren Marklund: In the past, we used to move the data to the intelligence processing. That meant we were relying on having data transferred in many instances around the world to a home where the applications were. The beauty now with a more federated model is that we can move the intelligence and the logic to the data.

This allows us to innovate at a much greater extent than in the past. And not only can we innovate more, but we can then engage in more partnerships. And this is what has probably unlocked the biggest opportunity for us as we move forward.

That’s due to working with data in a partnership within the overall ecosystem between partners and us – and also between partners on the customer side and the customers themselves. So having the federated operating model around the data architecture is going to further open up a whole new span of innovation, we believe.

Dana Gardner: What do you consider some of the key technologies that are endowing you with this ability to break out of those silos -- and at the same time, manage the trusted, secure, comprehensive data fabrics?

Soren Marklund: We know that the mission of just consolidating things to a common data warehouse, or a common data storage, is almost an impossible journey. We realize we need to be in a hybrid mode across the company, but we also realize that we need to be able to take advantage of the data in a more unified way.

This is how the data fabric plays a critical role due to the multiple databases across the company and by interacting with partners and customers. As we look forward now, for example, the [Apache] Iceberg standardsaround how we work in a hybrid mode is going to make a difference for us as we look at the harmonization of different architectures across the world.

And then we will see what makes sense to consolidate the support of this journey. But the first step is to make sure that we can operate in a more unified way. That includes managing the analytics, the insights, and building the generative AI context [on top of Iceberg] in a more unified way. That is the real societal-level innovation we are looking for. The data aspect is the enabler to make that reality in an accelerated way.

Dana Gardner: And, of course, doing this isn't just an academic activity. There are some huge business benefits. Let's look at some of the takeaways from the business outcomes perspective, customer experience, and personalized services.

For example, how has your unified data foundation and fabric contributed to the business benefits around the customer experience and services?

Soren Marklund: When you operate in silos, you don't always have access to the view of each vendor. In that context, operators and their customers operate on their side, and we operate on our side.

The beauty now with converging the silos is we can be much more in a digital collaborative experience. That is the path forward, even to accelerate from where we are today. We see great opportunities in enhancing the customer experience. When we have more unified data at hand, we can correlate that data across our company, the customers, and with partners.

By taking advantage of and correlating across the marketplace, a plethora of different vendors capabilities, and all of the reuse, we gain new insights that lift the customer experience. There is so much hidden within the data that in the past we have not been able to use.

Dana Gardner: And I suppose the foundational description of productivity is doing more and better with less. Is there a way of using this data to optimize networks or improve energy consumption and performance? How were you able to translate the data investment into solid returns when it comes to network efficiency?

Soren Marklund: A very good and relevant question. We are exploring this in all contexts. When we look at the energy efficiency, we already have a number of contracts with our customers around the world to work with different power consumption schemas. There are, for example, low traffic times in the network, in different pockets of the network, and we can optimize the usage of energy in that context.

But we also look at what might cause anomalies in consumption of energy in the network. And that is also an insight we can bring to our customers through the data that we can gather and then deliver those insights back to our customers. That explainability helps the customers, and we can guide the customer on what they can do. We can even drive certain things in an autonomous way.

We are increasingly driving data as being a part of our journey to intent-based services and intent-based networks because that is ultimately how we reach maturity of autonomous networks and services.

Dana Gardner: And another facet of better data analysis and access is moving beyond extrapolation to true predictive analytics. Being able to analyze for strategic advantage, particularly against your competitors who may not be doing this same diligence when it comes to data.

How are you able to get that intelligence benefit on a predictive decision-making basis?

Soren Marklund: Yes, this all relies on having our targeted information around the data, right? Because if you take all the data with our global customers, the data volume is petabytes every day.

That is too much. What can you do with that? It's really noise to begin with. We need to understand what to look for that correlates into insights that will help the customer. We try to lift more and more, as I say, experience KPIs in working with our customers to make that reality possible.

We are trying to embed the service knowledge in capturing the right data at the right time to make a difference in the end for determining the experience that our customers are having. And we have done this to some extent already. We applied a number of different activities and technologies in elevating anomaly understanding.

By lifting that data insight perspective, we can begin to understand more and more what is happening in our customer's network, and how can we correlate the information that we may have on the Ericsson side with the customer's data to drive more insights back to the customer.

Dana Gardner: It's fascinating how when you develop this language of data value -- when you extend that out to your supply chain or the ecosystem that you operate in or directly to your customers -- there's this mutual benefit. And that means even more sharing takes place, and therefore more opportunity to use different data sets in different ways.

Do you see this data modernization and advantage as a way of binding organizations together? The silos are not just internal, but you're breaking down external ones, cultural ones as well even.

Soren Marklund: Yes, exactly. And I used to say that you don't know what you don't know. Because when you have limited visibility to what you could do with the data, you really don't have a full perspective of what is within the data scope that I could know.

I could say, “Decipher the right data points out of this.” So, we have been very focused on trying to understand how we can lift certain aspects of the data for making an impact on the customer. And that data could be in many contexts, right? It could be efficiency, experience, innovation, automation, and what have you.

The data in the end is fundamental to all of these aspects. When you start this discussion, it's often, “Why do you want my data?” That kind of discussion. So, it is important, of course, that this is a collaborative perspective because there needs to be an impact and a benefit back. Otherwise, collaboration does not happen.

We need to contribute; we need to embed our knowledge and expertise into the ways of working. Our customers can then embed their knowledge and expertise. Together we drive more insights from the data. And then we both benefit from evolving the advancements in all of our technologies that ultimately, again, helps our customers.

Dana Gardner: We're starting to see actual productization of data and analytics themselves. So even though you might be a networking and telecommunications company -- where your bread and butter is hardware, software, networking devices.

But when you take advantage of the insights that you can gain through those devices and relationships, you might be able to actually productize the analytics and sell that back and monetize as an actual additional profit and loss center. More emphasis on the profit.

Are you starting to do that? Are you seeing that your data and analytics themselves become another product for Ericsson?

Soren Marklund: Yes, absolutely. We have seen this as three steps on a ladder. One, the first step, is to attain data insights from our products. What is the behavior, what is the configuration, and how do our products perform in the network? So that's the product-level dimension.

But then if you step up a level and say, “Okay, what is happening on more of an ecosystem or broader network level?” You then begin to see what is happening network-wide. You can enrich the data points from that perspective, and that drives new insights.

Above that, thirdly, you look at the industry verticals that ride on the network. And then you have new data insights that you can enrich that with. You build an incremental step of enrichments from the data to the network, and then to the industry-specific view.

And that, ultimately, we will drive even more insights. Because in the end, when you sit there in a vertical industry, you need to understand, “Well, what is the behavior of the network and what is the behavior of the product?”

On the flip side, applying a product to the network and driving the adoption of that also needs to have an understanding. How does it behave in the industry perspective -- whether it's in manufacturing, the automative industries, public safety, or whatever it might be? That full dimension is important.

Dana Gardner: Yes. And having an advantage because of your perspective and doing the proper data modernization you’re in a unique position to then create AI agents, and constellations of agents, that are trained in specific ways through that perspective. And so those agents become not just general-purpose, but specific to what you can do as a company in a vertical industry.

Are you seeing that as an opportunity, too? And how far along on the agentic AI journey are you?

Soren Marklund: This is probably the most exciting part of our journey now moving forward. And to your question, when you look at the adoption of GenAI or AI in general, the first question is what is the precision and accuracy of this model? When do you begin to trust the model’s execution? When do you begin to trust that this is an autonomous perspective, with the relevant recommendations and actions?

And we have seen this as a journey because many models -- especially untrained models -- have not been more accurate than maybe a 50, 60, or 70 percent accurate, and that may not be enough.

For a customer to make a decision or take an action on the network could have huge effects. So, we really want to make sure that we have the right precision and accuracy in the models that we recommend.

This is why ability has been a key component in the ways of working from data and the services that play a critical role there. How do we lift explainability in working with our customers? How do we drive trustworthiness in the models as we move this forward?

This is why agentic AI will play a significant role because we can use agentic AI to streamline and improve the precision. You can begin to have agent models interact with each other to improve the position before you ultimately make a change.

Dana Gardner: Part of the way that we want people to understand this better is not just to talk about it abstractly, but to look at specific examples and use cases. So, Soren, do you have any specific examples on tactical or strategic benefits in some of these feedback loops that you've been describing?

Are there some concrete ways that we can describe how this is working in practice?

Soren Marklund: Yes, we have been in the chatbot business for many years. And we all see chatbots as just a very initial starting phase on this journey. Every one of us who have been working in our personal lives with chatbots realize that it's not always working as well as we think it should.

But when we now move this into GenAI and more intelligent means, it's surprising how smart the different processes can become. For example, we have a number of pilots and proof of concepts already with our customers around the world. Ultimately, this drives the journey toward intent-based setups. What is the intent that the user wants to achieve, and how do we ensure that we have the right agents to ensure that that intent is being delivered?

Having the right data and the right logic to deliver on that intent -- but doing so in a way that drives explainability. That means whoever the user is, whomever is intended to control this, can understand what is really happening in the network. What is happening in different context of actions being taken?

It's not an autonomous activity living in its own life. Rather it's an augmented world where we as people around the processes are more resource managers or managing agentic processes to ensure they do the right thing and ensuring that the explainability is there to do the right actions based on what they know.

But we began this journey only a few years back, applying GenAI. Our ambition around this is to evolve it into three different dimensions. One is what we refer to as “talk to the data,” and this is deep diving into data in whatever context that the user wants and leveraging GenAI in that context. So, talk to data is the first step.

Then, secondly, we, “talk to the digital twin.” We want to also be able to simulate different scenarios using GenAI and agentic AI. The data behind it explores scenarios in a simulated mode and we call that “talk to the digital twin.”

And then the ultimate view, which where we also have had a number of exploratory pilots already in place, is to “talk to the network.” Because ultimately that's where we want to be.

This is the biggest transformation that we are on together with our customers. Because for the last 50 years we have been very reactive in the way of working around our customers. We look at alarms, at configurations, and then we act and react accordingly.

But now with the emergence of these technologies, we can begin to explore in a natural language what is the performance of certain products in the network, what anomaly might be there, and do so in a natural language format.

And this is a huge transformation compared to having the expertise to deep dive into the databases and the data context and filter through the noise across all of what we do. We can bring that into a natural language interaction, empowered by adjunct AI.

All with the right data at the right time, of course, to make sure that you can bring the trustworthiness to the results.

Dana Gardner: Well, it truly sounds like you've expanded the notion of customer service and support more into a fuller relationship with your customer – with the data itself being a third leg on the stool. There's you, your customer, and the data. And then the analytics benefits that you can enjoy by working together.

What does the future portend, what do you see coming next in elevating this relationship? How are you changing the relationship beyond just being reactive, as you say?

Soren Marklund: In the past, when we were more in the reactive mode, we were more in a holding pattern waiting for the customers and their products to break, fail or drift off in some way. And only then we jumped in and began to reactively address those issues with our customers.

Now, the journey in front of us -- and to a great extent we already embarked on -- is using the data that we can gather, the data insights that our customers can share with us, allowing us to understand the performance of our products in a much more proactive way.

We have started a practice called customer success transformation. And this is probably also one of the key aspects of the journey ahead. When we have the data, when we have the intelligence, how do we really now ensure that we make the greatest impact possible on our customer's processes?

That is the customer success transformation that we have embarked on. So that entails working with our customers, breaking down the silos, understanding what success from the customer’s perspective is. What is helpful for them? How could we help our customers in their processes, their models without force, without being intrusive to what they do and how they do things?

By understanding the data points, we take advantage of and guide our customers to certain customer success objectives. How do we contribute through more data-driven processes, more customer-centric processes to ensure we are part of that journey and make the greatest impact that we can?

In the past, we have developed a lot of intelligent capabilities over the years, but often we develop them and then we go to the customer and say, “Will this apply to you? Look what we can do. These are the insights we can bring to you if you adopt this product or this service.”

Now, with a customer success transformation perspective, it's really looking at it the other way around. What is the customer trying to achieve? What are the bottlenecks in front of them? What data are they not utilizing? What insights do we have to help?

That can bring about a big difference for the customer in their journey. So, this customer success transformation is the overreaching umbrella over everything we're trying to do around the data and the intelligent activities.

Dana Gardner: Wow. Well, you can't get more strategic than that: Helping your customers at the highest level to anticipate their future and then providing them what they need -- perhaps before they know it themselves. That's the ultimate business support value.

Thank you so much to our latest Data Cloud Podcast guest, Soren Marklund, Vice President of Global Services Technology Consulting and AI Data Strategy at Ericsson. We so much appreciate you sharing your thoughts, expertise, and experience, Soren.

Soren Marklund: Thank you for having me. I really enjoyed it.

Dana Gardner: My pleasure.

Sponsor: Snowflake.

The AI-Driven Enterprise Advantage with Teresa Tung, Global Data Capabilities Lead at Accenture

2025-08-22T10:20:00.001-04:00

Welcome to the Data Cloud Podcast. The next episode features an interview with Teresa Tung, Global Data Capabilities Lead at Accenture, hosted by Dana Gardner, Principal Analyst at Interarbor Solutions. They discuss how enterprises can accelerate and broaden the application of data to attain more business value through agentic AI, the pivotal role of proprietary data as a competitive advantage, and the need for data practitioners to adapt to new responsibilities involving data quality and AI agent interaction.

So please enjoy this interview between Teresa Tung and your host, Dana Gardner.

Dana Gardner: Welcome to the Data Cloud Podcast, Teresa. We're delighted to have you with us.

Teresa Tung: Thanks for having me, Dana.

Dana Gardner: Enterprises clearly want to accelerate how they attain more business value from their comprehensive data. Not only do they want to get that value faster, they also want to apply it more broadly to more people and across more business functions.

As we enter the era of agentic AI, global integrators like Accenture are uniquely positioned to optimize and orchestrate all the many parts of what constitutes the AI first enterprise.

As the Global Data Capabilities Lead at Accenture, Teresa, you're able to see how vast data resources from all angles can be marshaled to enable AI agents as they mature and take on more assignments and become effectively teammates to the lines of business.

For the leadership of the global 2000 enterprises that you work with, what should they expect from these latest AI capabilities, and how should they best measure the business outcome success from the many years of investments and toil that they've put in to get us to where we are?

Teresa Tung: Thanks, Dana. Again, with this generation of AI, it's still the same -- that proprietary data is a company's competitive advantage. I think sometimes people think with this generation, somehow the rules have changed, but we're still continued to be measured by business outcomes.

The great news is that the promise is easier to unlock, and the scale is more disruptive than ever. We're seeing this generation of AI not only impact productivity but impact the end business outcomes, whether this is through improved customer satisfaction, increased sales, improved on time in full in supply chain, and reduced waste.

We should measure the business outcomes of this generation of AI, just like we look at any other business outcome. I think that's number one. The great news that I started with, again, is a company's proprietary data is their competitive advantage. And what this means is that you have to invest in getting that data right so that this generation of AI can do things that mean is meaningful for your company.

Because these large language models, they seem magical. There's something that a smart college intern who knows a little bit about everything might be. Just like that smart intern who comes to your company, you have to teach them, right? You have to teach them about what's right for your business and what's the secret sauce there.

By bringing those things together, you get to unlock this really disruptive age of AI. But again, you have to start with your data.

Dana Gardner: Teresa, before we go further into how the data is so strategic and important, tell us about yourself, your role, and your organization within Accenture.

Teresa Tung: I lead our Global Data Capability. What that means is I'm really looking at the vision as to what it means to do data. And I've been pretty busy the last two years, as you can imagine, because how we as a data industry have practiced data, it has been completely disrupted. The things that we got really good at, we got good at thinking about data as a product, right?

We started looking at data supply chains and looking at data governance. And I think, again, the industry leaders, we knew what good dominant design looked like. And with generative AI, it's changed. It's changed in two ways. I think one most exciting change is that data is now more strategic than ever.

We are not just talking to data engineers, data scientists, software engineers. It's not CIO- andCTO-type discussions. This is elevating those roles. Your Chief Data Officers or your data engineers, they need to be part of an overall business strategy. It is something that the CEO and the board of directors needs to think about.

Do I have my competitive data to be able to see across the business? So I think that's one. The second one is really around the different ways to do data. Not only is it more important, you still need to think about trusted data. I think that's what we're still trying to get to, but the types of data -- it's not just your structured data, supply chain, things in a tabular form, which we are really good at – but also how do you secure and govern it all.

But now thinking about things like unstructured data -- things like documents and code, podcasts and videos and voice -- it's bringing all those to bear in a way that now you can have trusted data across all these different data types.

Dana Gardner: The more data the better, but the more data, the more likely that there could be some issues about that trust or compliance or whether you are retaining the competitive advantage and not spilling it to areas where it shouldn't be.

And getting to all the data has been a hurdle. What are we trying to overcome in order to get to that nirvana of the right data to all the people to make it like oxygen available to all people to consume safely?

Teresa Tung: I think there's two things that have changed. Again, very much like the practice of data, I think data has really been thought of more. I mentioned as an industry; we're looking at data as a product. That's been a trend that we've been looking at the last five or some years. Before that, we've been looking at data more as projects. Again, as a data practice, companies would have an idea.

You might stand up a system and you might interview and find people in the company who had the data. You get access to the data, then you talk to the domain experts about what that data is. You create something and then you may publish it in a dashboard.

And sometimes you just have the insight and you stop. That whole process can take months of time. And it took all these people that I mentioned, both the tech experts as well as the domain experts. And after that insight was given, we as a practice didn't actually document a lot of that. It wasn't really thought of for reuse.

So, over the last five years. We've been looking at the pivot of data as a product, and we've seen this change with software, right? When people write software developers of today, they start with what's on open source and microservices, and that's where they start building. So data products are almost the same thing.

Can I have package data? Where I know it's been trusted in governed. So here's my sales data, my finance data, my marketing data. So that now if I want to bring together the data to see what's new, the new campaign, I don't need to spend that first cycle looking for the data and trying to understand both the technology to access it and what it means.

I think that practice is really key. In the beginning I mentioned that. The types of data are different now than before. So again, we've done this again the last five years, more in structured data for analytics and sometimes for operations. What's really different now, again, is the types of data we need to think about, but also the promise that AI can bring to actually make some of our jobs easier as data practitioners.

Dana Gardner: It seems that in the past, as you've been describing, you had to be proactive to go get the data, query the data, package the data so that you could consume it or deliver it. But we're getting to the point now where the data is going to be where you need it to be without you're asking for it.

There’s the agency within the ability of the data to deliver itself in the right format, to embed itself in a process to make itself digestible to more people in more lines of business. That's where we're getting to. What's the hurdle that we need to overcome to get to that level?

Teresa Tung: I think one is the practice itself, right? So that pivot in terms of the project to the product pivot really requires the business to take accountability. At the end of the day, in everything I described as technologists, we can get so far right. We could get the systems to capture, we could get the systems to process and to transform and to analyze and even the systems to consume.

But at the end of the day, we really need to put this in the users’ hands. When you were talking about some self-service and democratization, we need to get the data in the hands of the true end user, those true experts who are going to know two things.

One is they're going to know, given a business process that they're running, they're going to know what's the data generated from that process, what it actually means. And then also they're going to know what data do I need to actually accelerate and be more meaningful to make a better decision in that process itself and even automate it altogether.

So, we really need to get that part of the business and those folks to democratize in the data journey, right in the data product. Ownership and creation. At the end of the day, those are your end users and those are the owners, and, and we need them to be accountable. We need them to be part of that product creation. We need to be measuring value on how they're using this data and, and what they need.

Dana Gardner: And as I mentioned earlier about agents, we have agents that can take more of a role in getting the data to the people in the right place at the right time.

But also, we have agents that allow the people to access the information and the analytics in ways that don't require a lot of SQL knowledge or experience. So where do you see that interface and availability from agents increasing and benefiting those outcomes that we talked about earlier, those lines of business productivity outcomes?

Teresa Tung: I think you just touched on a really great one, not needing to know SQL. Every company has team standup for doing business intelligence (BI), and these teams are doing a lot of that manual work that I mentioned before. They're real experts as knowing the data sources, how do you bring it together and to get insights.

And they could be so optimized and efficient. But the point is they're still doing a lot of that manual work, and they're not likely those ultimate and experts that we talked about. And so rather than doing sort of this BI work, you could use AI for BI. So, this means equipping that expert rather than needing to write SQL queries with a conversational agent so that they can ask any questions about the data.

This isn't to say that you're going to get rid of dashboards altogether. I love a good dashboard. However, a good dashboard is really the key. We find that across companies, maybe 30 to 40 percent of dashboards are used possibly once, if at all. So there's a big opportunity to say, “There are a lot of dashboards, but they're not being used.”

They're being used almost as a different type of data access tool. There are people doing ETL within the BI dashboard, which is really not the point of it. And really they're trying to just ask any question. So I think one is we are finding the ability to actually use AI and that agent, that conversational agent, so that any expert who knows the domain can ask any question, and then there's another set that can be taken away with.

Not needing to ask any questions. Maybe I don't even need to ask a question because this data is going to be used to make a decision, right? It's going to create an action. So I could use agents to automate that whole thing, right? So thinking about that opportunity, that's a great opportunity.

Dana Gardner: It brings to mind the notion too, that you don't always want to be in front of a computer calling up a dashboard or creating queries. A lot of the people who will get the most use out of the data outputs and the analytics and the AI are in the field, and they're perhaps maybe on a phone or they're at the edge, so to speak.

Are we seeing more of the ability to get these data benefits to more types of people that aren't necessarily sitting in front of a computer, for example?

Teresa Tung: I definitely think so, and all the way through to the automation within a warehouse, right? We could imagine robotic systems, and these robots need to do things, but how do you get the actions?

Well, they're going to need to understand what's happening. That's a call to data. And then based off of that, they're going to need to figure out what, what should they be doing. So that's an agent, right? Between the data and the agent, it certainly even have a person. At the edge in the warehouse asking these questions, but it's even more necessary if we have all machines.

So not designed for just human access, but for machine access in a way to do something about it.

Dana Gardner: Are there any particular vertical industries or early adopters that Accenture works with that you're familiar with that might give us a bellwether as to where these things are going?

I hope we're not talking hypothetically. I hope that these are things that are happening in the real world. Where are they happening first, and what perhaps are the benefits that people are seeing from being able to make you yourself an AI first organization that's pervasive as we're discussing?

Teresa Tung: Let me use Accenture first as our own credential here. So we are using data and AI agents to disrupt our own business, and I'll give you two examples that have nothing to do with it or technology. I think that's a common use case. I'll talk about one within our marketing function. We're using AI and agents to be able to create and run smarter campaigns.

If you think about a campaign, we're going to create a new brand campaign. What do I need to do? I need to see the elements that I have. I need to see some of the materials that I know are true about how we talk about certain topics like AI and data and agents.

I might want to see what our competition says. I might want to see my budget and my finance and what my team could possibly deliver against that budget. So, all of these things would be something that a human with their expertise and we design processes as to how do you make that decision and run.

So instead of taking that traditional process and just making it faster along each specific step, we took agents that took everything I just said. So you're still going to run through all those checks, like still have to see if I have the budget, still have to find my campaign materials. I still need to find what my competition is saying, but I could have these agents work together to gather that information and to do initial first couple of passes as to what that campaign could be.

And by doing things like this, we are looking at a 25 to 35 percent reduction in manual steps. We are looking at a 6 percent cost savings. To achieve this all with a 25 to 55 percent increase in speed to market. So, these measures are not just about getting the data faster or about doing one step of the process faster, it's changing the process because that human is not doing all those steps by themselves.

The agents have done those checks for them, and so we're really reviewing some of the proposals that these teams of agents have co-created with me as the he.

Dana Gardner: It sounds like what we expected, digital transformation, digital business transformation to accomplish, and those are great metrics. But as you're drinking your own champagne, so to speak, what are you using to uncork the bottle?

What do you see as some of the underlying infrastructure that's important that's enabling you at Accenture to get these sorts of business benefits?

Teresa Tung: Well, the infrastructure, as I mentioned, is still key. It goes back to the data. So being able to have trusted data, and I would say that we've done over 2,300 different GenAI projects in the last year, and even within, we find that about one of every two cannot scale due to data readiness.

Because you might have the ambition to do something, but then when you look at your data for the purposes that we mentioned you don't have that ready. It's not trusted. You might have lots of data, and that's kind of where many companies are. It's not that they don't have any, it's just they don't trust it.

They don't know the quality; they don't know the lineage. They don't know if can I use it or not. We don't have common definitions for certain terms, so all of that makes it hard to use by itself.

So some of the things that we're able to do is create the data products and having what we were talking about, the data supply chain tooling, underneath to be able to get data products faster.

This is something that we worked on together with Snowflake, to be able to take some of what we've done -- we've done a lot of different data connectors into different content systems. We need to bring this over with the right security controls, right? So if you couldn't access the data in the system before, we want to make sure that you have those same protections going forward.

But then using something as an example, like Snowflake, you have your Cortex Search for retrieval-augmented generation (RAG) and being able to use that to be able to bring in my data. Take also any sort of external or third-party data and then you, you handle a lot of the beginning it ready for gen AI for me. So things like handling them, betting, the vectorization, the indexing, making the search semantics so that when I'm searching for something, it's against some of the business terms.

It's my products that it's indexing against as opposed to generic products that exist. Those things you want to train that smart college intern to know about your business.

So these are things that we're able to work together, to make it easier for companies to focus on their data and their use cases rather than focusing on the tools and tech for gen AI and data.

Dana Gardner: Sure, it's one thing to have a race car and that's great, but you need to have the right fuel. You need to have the pit crew. You need to be able to keep that thing going. Fuel it as it were consistently and ongoing.

Alright, so you mentioned Accenture and your use case in marketing. Are there any outside organizations or clients, for example, that certain use cases come to mind that are making great use of these same technologies and capabilities?

Teresa Tung: Yes, another one that I spoke about briefly was around supply chain and manufacturing, being able to use your data around your supply chain to be able to optimize that. But then ultimately to be able to push that into automation, right? So it's not just making data decisions, but to push it into being able to more engineering designs and, and so that's something that we've also been looking at working to create 50 percent faster designs.

If you're going to create an engineering design, what do you need to do? Well, it's kind of a data problem, right? You need to understand the scenario. I need to get all the data about my scenario. I might look at past designs and what works well and what works less well. I might look at certain regulations that are always popping up all the time.

These are human data work that is very much the long pole in the tent. So now if I'm going to use GenAI to be able to help me find that data specifically for the design that I'm working on, and then to be able to help me elevate, these are the best practices, these are the laws that you should consider, how you should factor them in.

These are the things that don't work well, so make sure you don't design for these. So not only is the design faster, but I might even have it in a reduction, right? In cycle time. The ability to actually create a design and see does it work or not, and then to come back around, right? So this would be another sort of case that we're really using data to help our clients deliver.

Dana Gardner: Okay, so the folks up in the C-suite that are looking for their business returns and are looking for the productivity benefits. They're looking at these types of use cases and seeing the business outcomes, and that's great and you can start to measure it. You can use AI to measure it better.

But what about the folks that are in the trenches, the people in the line of business, the domain owners down closer to the customers and the problems that they're working to solve?

What, in addition to the tools that we've been describing, has to happen in terms of the relationship to the data, these agents, and to the generative AI capabilities? Is there a shift that needs to happen in thinking there?

Teresa Tung: Definitely. Ultimately, this is to help the human worker, right? So, we're not saying that these agents are going to automate entire functions or parts of the business. This is very much about taking all that mundane work that you couldn't do. Or to give you superpowers in whatever you're doing. I couldn't have researched every possibility or know all the options that's available for me, right?

So these agents are pulling the data and looking at that proactively so that I don't have to, or that I possibly couldn't do. So this does mean a change for, for people, right? It means that every worker now, if you have agents giving you superpowers, is now a data user. So whether you knew it or not, you are doing some version of data quality and you are working with agents.

Whether you were in the supply chain in a manufacturing line, and you might be looking at a line, part of your job is data quality, right? So your job isn't just to make sure that line is working. You might be adjusting a camera angle, so you get the right camera of data coming in. You might be labeling based off of the AI that says these are defects or not.

You might be labeling it says, actually, you were wrong. That wasn't a defect and here's why. Or, that is a defect. You didn't catch it, and here's why. Or your next best action that the agent might recommend to you why it was wrong or, or here's why it's correct. I'm going to give a thumbs up. That was exactly what I wanted, right?

So this sort of work, we in data used to call it things like data governance, data quality, and data stewardship. We would look at labeling. Everybody needs to learn a little bit of that. Everybody's a data steward. Everybody's going to be a data user and working with agents. And so in the same ways, you also need to know what could go wrong.

We need to learn about hallucinations, we need to learn about how do you ask the right questions, and also how do you evaluate that response so that you don't just take it and then apply it without validating that on your own. Right? So, these are new tools and new responsibilities that we didn't have before.

Dana Gardner: The best of what humans do in terms of critical thinking and the best of what the machines do in terms of dealing with scale and complexity and automation. You put those two together, you get some very powerful outcomes.

I suppose this is also great for people's careers. If you can put next to your title data steward, for example, this is going to be really good for you. So people should be thinking about data in terms of how to improve their marketability of themselves as individuals.

Teresa Tung: A hundred percent. We do find there's a lot of hunger to learn. The workforce is knowing that this is coming. This technology was so exciting because it started with the consumerization, right?

It was something our parents would be talking to us about. When ChatGPT launched, they're like, “Oh, look how cool this is,” right? So this is pretty amazing, and so this sooner that people can learn, there's a lot of hunger to learn and to adopt. I think having programs so that people can learn how to use it and how to use it safely is really, really key.

Dana Gardner: Now we've been talking about this hypothetically, we've been talking about this in terms of actual real world use cases and outcomes that people are enjoying. But where are we, in your opinion, on this journey?

If we were to put this in terms of a baseball game, for example, a nine innings get you to the end when you win the big prize, what inning are we in when it comes to bringing that best of what humans do with critical thinking and out of the box thinking and creativity? To what the machines and the agents can do. How far further can we go with this? You know, where are we in the ball game?

Teresa Tung: Dana, we're just at the start. I was thinking the third inning. I'm not a baseball fan, so I don't know exactly what that means, but you know, it's definitely not just the beginning, right? It's not the first inning because we already know the promise and people are excited.

I think we've already played the opening inning where everybody was thinking about engineering and we as an industry were so excited about that. And then I think the second inning, we are kind of at the end of that because that's the agentic AI inning. People have now seen agents, they see the promise, we see it being adopted into a lot of the major software platforms.

There's a promise to create agents across the board. So even if you're not creating your own, your software ecosystem's going to do it for you. Right? So, that's second.

I think we're at the start of the third, right? Start of the third inning. What does that mean? I don't know. I didn't know agents was coming as fast as it did either, but it could be many of the things we talked about today.

So further democratization. What does that mean? Further move to the edge and to even automation and robotics and what could that mean. Possibly different multi-party compute, because we just said data's so important. So, agents and data typically right now, a lot of that motion in the second inning has happened within particular stacks.

You're doing it. You're doing it with a partner where they're handling the full stack app. What does it mean when you're now having different agents work across different platforms to be able to make a decision?

I don't know exactly how the third inning is going to play out. I guess you have to play the game to know what happens, but that's kind of why I think it's the third, early inning in this game.

Dana Gardner: Okay. We're in the third inning, and let's say we have Accenture as our coach, the manager, and the bullpen’s ready to bring out the next best players.

What is Accenture doing now that you think is going to get us into a very powerful fourth and fifth inning? Tell us about what Accenture has in the pipeline that's going to enable some of the things we've talked about and further the benefits of some of those early adopters that you identified.

Teresa Tung: We have a secret weapon in that we're using AI to also power ourselves and transform what we're doing in data. I guess Moneyball, right? The movie proved that it is definitely a data-, and an AI-driven game.

So if we think about that analogy now, apply to the data space, we are using GenAI and agents and everything we spoke about here to do things like data migration, data modernization. So let's say we're migrating from Teradata to Snowflake, as an example. Well, traditionally, sometimes you couldn't do that because you didn't have the budget for then, or it was something that was very hard to do just because of time.

It would take possibly many years to get all of that done or you didn't have the expertise. A lot of this is using GenAI and agents to also disrupt what we're doing. So, using agents to make that faster. Right? We work with Snowconvert to have agents automate quite a lot of that process. So things like the code conversion, as an example, some of that code conversion can be accelerated upward of 90 percent.

In terms of the efficiency there, does it mean the whole project is 90 percent faster? No, because you're doing other things besides converting code. So let me tamper it with that. But that promise is amazing.

If you think about code conversion, data validation, data, quality rules generation – there are so many things that we are going to apply GenAI and agents to in how we practice data. That's going to also make things a lot more efficient than what we could do before.

Dana Gardner: And that really is a great definition of the AI-first enterprise, which is where we started. Thank you so much.

We've been here with our latest Data Cloud podcast guest, Teresa Tung, Global Data Capabilities Lead at Accenture. We so much appreciate you sharing your thoughts, expertise, and experience along the way.

Teresa Tung: Thanks, Dana, and thanks for having me.

Sponsor: Snowflake.

AI and the Future of Finance: Decoding Earnings Calls with S&P Global Market Intelligence

2025-08-22T10:14:00.005-04:00

Welcome to the Data Cloud Podcast. The next episode features an interview with Liam Hynes, Global Head of New Product Development at S&P Global Market Intelligence, hosted by Dana Gardner, Principal Analyst at Interarbor Solutions. They discuss how S&P Global Market Intelligence uses AI to analyze corporate earnings calls to guide and improve financial reporting.

These insights help businesses enhance communication, refine executive performance, and predict market outcomes. The conversation also highlights the use of Snowflake's Cortex AI platform, and the importance of data-driven decision making in the financial sector. So please enjoy this interview between Liam Hines and your host, Dana Gardner.

Dana Gardner: Welcome to the Data Cloud podcast, Liam. We're delighted to have you with us.

Liam Hynes: Thank you, Dana. It’s a pleasure. Looking forward to it.

Dana Gardner: It's a very interesting use case. You know, among the most promising ways that data science and business intersect is when an entirely new service or use cases can emerge.

And you've been able at S&P Global Market Intelligence to identify an underutilized data resource of the legacy transcripts of corporate results reports to financial analysts and create new insights for business leaders. These new services show innovative ways that AI and human behavior can reinforce each other for multiple benefits.

Tell us how you're using technology to improve how people communicate.

Liam Hynes: Well, that's a great question, Dana. So how do people better communicate? The genesis of all this started around 25 years ago when we were analyzing the Enron case study. Analysts on the earnings call with Enron were asking the executives questions.

In particular, they were asking Kenneth Lay, the CEO at the time, questions about write-downs. Now everyone knows about the write-downs now, but back then it was just emerging news. Kenneth Lay didn't discuss write-downs in the presentation on the earnings calls, but there were six questions from analysts about write-downs in the Q&A section.

That showcased to us that Kenneth Lay was being reactive rather than proactive on that topic. Kenneth Lay didn't go and preemptively tell the market in that earnings call presentation about write-downs. He was being entirely reactive with the market on those. And then when he answered questions about the write-downs, he was being evasive.

He didn't actually answer the question about write-downs. He was pivoting, entirely off topic. So, there's two behaviors there that we identified from Enron. One was being proactive or reactive with information, and the second one was a very straightforward behavioral characteristic. When I answer a question, do I remain on topic to the question asked or do I go off topic?

And in finance, you know, both of those behavioral characteristics are important, and we've showcased in the research why they're important. That was the genesis of trying to identify these two behavioral characteristics from executive's calls at S&P Global Market Intelligence.

We have a product called Machine Readable Transcripts. That has earnings call transcripts going back almost 20 years, to 2006. It's approximately 250,000 machine-readable earnings calls.

So, we thought, “Okay, is there a way that we can systematically identify these two behaviors from executives across this massive corpus of earnings calls?”

And it turns out we were able to identify those two behavioral characteristics: proactiveness and being on-topic. And it turns out that when you look at them, proactive executives who voluntarily give information to the market -- rather than being asked about it -- outperform their reactive peers.

And on-topic executives – those executives who simply answer the question and remain on-topic to the question -- outperform their off-topic peers.

Dana Gardner: That's a very powerful result from an existing data set. You've been able to exercise new analysis on archives. And perhaps we'll get into this a little later, you can then help reinforce a good behavior from a bad behavior.

Tell us about S&P Global Market Intelligence and how you're using data science to create business services like this. And what's your role there?

Liam Hynes: S&P Market Intelligence is essentially the data and analytical service provider to financial institutions, academics, government institutions, and corporations.

We sell data and analytical tools. I sit on a team called Quantitative Research and Solutions (QRS) that sits within market intelligence. And we're the closest thing you can get to a client at S&P Marketing Intelligence.

We look across the vast array of data sets that we have. We essentially try and extract the value from those data sets, and then we articulate that value to our clients through research reports, to coding notebooks, coding blueprints, or to derived data products. So that's how we extract the value from our data and then pass it on.

Dana Gardner: And why is now an important and interesting time? What's coming together in terms of the technology, the price points of acquiring and using the technology, and the availability of the data? Why are we in a unique position to start offering new services like you've been describing?

Liam Hynes: We're in an inflection period when it comes to technological innovation, right?

Large language models (LLMs) have come into the fray over the past couple of years. We now have this new, shiny, amazing tool that we can point to all of our textual data, and essentially that's why there's been such an uptick in interest in these LLMs like ChatGPT and Llama.

They have trained themselves on all publicly available texts on the internet. But if you think about it, that's just the first level of analysis that the LLMs can do. I can go onto ChatGPT and do a multitude of things that save me time versus, let's say, jumping straight onto the internet.

But the next wave is textual information that's behind a paywall or is very difficult to collect. As an example, if I wanted to point a LLM to analyze those 250,000 earnings calls I was talking about, the LLM would have to go and first find all of the transcripts for each of those calls.

It would have to identify what was the presentation section, what was the question-and-answer section. At S&P Global Marketing Intelligence we have an agent, a machine-readable transcript product with all of the metadata associated with it.

So, I know the executives that are speaking. I know the analysts asking questions on the call. I can map the analysts back to their recommendations. I can map the company back to its financials. So, now we can unleash these LLMs on financial text to analyze the words that the executives and the analysts articulated on the call and identify if there are any signals embedded in this financial projection information.

It's opened up a whole box of really interesting research that you can do around financial information to determine if there's any alpha signals in there that we can bring back to our clients and say, “Here's how you go and calculate around these behaviors.”

We can containerize them and deliver the signals directly to our clients. Or we can actually just drop a coding notebook on them and say, “Here you go. Here's how you can do it yourself.” So, it’s a very interesting time to be in.

Dana Gardner: Yes. And you're looking at this through both structured and unstructured information. You're looking at the core data and the metadata, and you're also comparing it to other data sources in order to say, “Well, what differences can we discern between how a behavior took place in an earnings call, and then how the company performed over a period of time.”

When we do this right, when we can take advantage of these LLMs and data sources across both structured and unstructured sources, what sort of paybacks have you been able to get? What's the bottom line, so to speak?

Liam Hynes: Yeah, that's a good point, Dana. You have transcripts sitting in one corner. You have pricing information for the company sitting in another. You have the financials of the company sitting in another area.

So, one of the benefits of using Snowflake for this analysis is that all of S&P Global Market Intelligence data sets are available on the Snowflake Data Cloud. First, you have all of these very important company-specific data points in one place. I can go in and use the LLM to analyze the text, but I know then that this text was from an earnings call that was on April 1, 2025. I also have the pricing information from April 1, 2025. I also have the company's first quarter results.

So, you're able to create this data infrastructure where you have all of the important information in one place. And if I derive a signal from a LLM, I can then map that back to the company's financials and I can map it back to the company's points.

I'm able to understand if there's any behaviors or signals that the executive has spoken out on the call. I can then see if that correlates with an increase or a decrease in the price movement.

Dana Gardner: And what have you found when you do this comparison? What sort of results are you getting in terms of saying, “Ah, we now see something we didn't see before?”

Liam Hynes: When we look at the two behavioral characteristics that we identified -- and, again, I can go into the weeds later on on how we built those two signals -- we look at a specific executive. Essentially, we come up with a score on whether or not the executive is a proactive executive, or whether or not they're a reactive executive.

Let's say I have an earnings call that happens on March 15. I now have a score that says, “Okay, this executive was proactive.” Let's say there's another call that happens on April 15, and it's an executive who is reactive.

What we do at the end of every month is we identify every executive that had an earnings call in that month. If the executives were proactive on that earnings call and if they were in the top 20 percent of proactive executives, we build a long portfolio of those companies. And then on the short side, we would build a short portfolio of executives who are reactive.

Let's say it's the S&P 500 at the end of April, we have 100 executives who are proactive and 100 executives who are reactive, 20 percent of each. And we hold that long portfolio until the next month and then we re-sample it. And the same with the short portfolio.

When you do that over a 17-year period, rebalancing at the end of every month, proactive executives, or firms with proactive executives, outperform the reactive peers. They generate something like 250 or 300 basis points of pure alpha per year.

Now, that's one signal that we identified. The second signal that we identified was an on-topic alignment. So, when the executive answers a question and they remain on topic. Again, we go long. The top 20 percent of on-topic executives, and we short the bottom 20 percent. Again, that generates around 350 basis points of alpha per year.

So, without even looking at financials, without even analyzing any other information about the companies, just by using those two signals you're able to identify companies that outperform and underperform.

Dana Gardner: That's fascinating and very valuable. You can make inferences about how a company will perform based on how these executives themselves perform.

But it seems to me that over time you're also creating essentially a score for trust and credibility from the interview performance. And when you are able to then return this information in a feedback loop to those executives, they perhaps can improve how they communicate.

And that's where we started our conversation. Have we gotten to the point where we are able to take this analysis, using this great data across multiple sources, and apply them to bring it back to the person and say, “Aha, AI is going to help you be a better executive.”

Liam Hynes: Absolutely. If you think about it, there's multiple use cases, but the two main use cases here are for asset managers who want new signals to be able to identify companies that are outperforming or underperforming to build stock portfolios.

But then there's also corporates, right? So, if I'm a CEO of a corporation, I now have some valuable information. I know that if the market is looking for some information, it benefits me to be proactive with that information and give it to the market, rather for them look for it.

And the second component, very straightforward. If I'm an executive and I don't answer a question or remain on topic, I'm penalized for it. So, we already have a piece of software that we've built for investor relations departments at S&P Global Market Intelligence where they can pipe in their prepared remarks and we export the scores to them.

So even before an earnings call happens, executives are now prepping themselves and making sure that they're ready and that they're proactive. They're able to look at analyst questions that have happened, or they know that there's going to be certain analysts that on the call and they look at previous calls and see that they're asking about certain topics.

That means that, “Okay, if I'm an executive and I see last week one of my CEO peers was asked five questions around tariffs, for instance, I know that I probably have to be proactive with my information around tariffs on that call and proactively give that information to the market.”

I know that I'll be rewarded for that. And the second component is I can now prep myself specifically for those questions. The idea with the earnings calls is that the pre-prepared remarks are heavily scripted.

The CEO writes that script, but it is a heavily vetted document that the investor relations department, communications department, marketing, and legal all react to. Essentially the CEO is an actor. They're neutral, they're reading a script, and they're giving a presentation. What's in that presentation clearly matters.

So, executives are definitely spending a lot more time making sure that that presentation is the best that it can be. And then the second component is that they're also prepping themselves to be much more well prepared for the Q-and-A section.

More and more we see executives now going in to identify the analyst questions that were asked on previous calls and prepping and making sure that they are able to remain on topic to those questions that they're being asked.

Dana Gardner: And I should think that on the flip side, the people who are asking the questions, if they could avail themselves of this research, they might be able to come up with better questions or, or put them forward in such a way that they'll get more reliable results in terms of how this company's going to perform in the future.

And so that strikes me, Liam, as a very valuable process. Almost any company right now that's trying to grapple with how to monetize and benefit from AI, they can look for existing data and ways to share that data with people that will help them in their jobs, and then monetize that as a service.

It seems to me that that's a rinse-and-repeat sort of benefit that AI has with direct, demonstrable, and significant business benefits.

Liam Hynes: Absolutely. If you think about it, we've shown in the research that firms are rewarded and have higher stock prices if their executives are proactive and on topic, versus they're being reactive and off topic.

So now, you know there's a tool now that essentially can up the game for the executives, right? Executives know that they need to be much more transparent. They know that there are algorithms that are watching and listening to the call and identifying if they're going off topic. So essentially, it's raised the bar for executives across the globe are going to have to up their game when it comes to proactiveness and being on topic.

Dana Gardner: And they don't have to guess. They have data and they have inference, and they have science behind that saying, “Here's how you should behave. Here's how you go about these questions, and here's how you're going to get the best results.” So, less gut instinct and much more of a data-driven approach.

Liam Hynes: Yes, absolutely. And one of the things about that software that I mentioned earlier is it helps the executives write their presentation, right? And so, it not only scores them on proactiveness, but it also scores them on language complexity. Like am I using overly complex language?

Some previous research that we've done identified managers who use overly complex language underperform managers who use much more straightforward and simple language. You can also look at things like numerical transparency. When an executive is issuing a statement, if they accompany that statement with numerical facts, it has a lot more weight than a statement without numerical facts.

And another analogy I like to use is if I'm a football manager and I'm getting analyzed by a reporter at the end of the game, and let's say football manager is asked about their striker, and he says, “When our striker plays more than average games per season, he has the highest kilometers run on the pitch and scores more than average goals per game.”

And the second manager says, “You know, our striker is in the 97 percentiles for time on the pitch, and on average runs 11 kilometers and scores 1.2 goals per game.” The second statement holds a lot more weight than the first statement because it's accompanied by facts. So there are these other components that can aid the executives in their prep to make sure that they're delivering concise and succinct messages to the audience.

And one other thing about that software as well, we haven't embedded it into it yet, but phase two is where we're going to say, “How do we prep them for the Q&A?” What we're going to do is we're going to feed all of the previous analyst questions from that company and that company's peers into the LLM.

And then we're going to ask it to come up with hypothetical questions for the executives based on previous questions of its peers. So, it's almost like they'll be able to prep for the Q&A on the fly with relevant information.

Dana Gardner: Sure. The tool will be able to predict most likely the types of questions. And that way you can advance your preparations even more so.

And while this works for finance and perhaps sports, it seems to me that this is a function that you can take to almost any instance where you have important communications that you want to refine and improve. You have the data; you have the science to analyze it.

Let's dig into the science a bit, Liam, what is it underneath the covers? What's the secret sauce that's allowing you to do this? And what is the partnerships, the stack, and the underlying infrastructure that's come together at this auspicious time to enable you to do this fairly quickly and straightforwardly?

Liam Hynes: Sure. I'll start with the second bit first. We use Snowflake Cortex AI platform. All of S&P Global Market Intelligence data sets are available on Snowflake. And the reason we wanted to use that infrastructure was you can essentially pick LLM APIs off a shelf from Snowflake, and there's other vector embedding tools and summarization tools that you can use in Snowflake.

The fact that we had all of that data sets that I was talking about earlier -- the textual data, the pricing data, and the financial data -- all available on Snowflake and then the easy ability forvector embeddings, LLMs, summarization tools. It just meant that we had a one-stop shop to be able to do this analysis. So that's one component that was quite powerful.

The tech stack that we used was, let's start with how do you identify if somebody's answered a question and remained on topic? Well, if they remain on topic, they're going to use similar concepts. Topics and language that was used in the question. It means that we have to look at the question, at the language, in the question. We have to look at language in the answer, and we have to compare them to see if they're using similar concepts and similar topics.

And we do that by taking the question and taking the answer pair. And we use a LLM vector embeddings to turn that textual data in the question and answer into numerical data. So, think about vector embeddings as just a zip code or a post code for text. And so now that we've got numerical data to the question and answer, we can now compare that numerical data.

And if you remember, high school trigonometry or secondary school trigonometry, when I look at two vectors, if I get the co-sign of those vectors, I can determine if they're similar or not. If I have two vectors that are exactly the same, the angle between them is going to be zero, and the co-sign of zero is one.

If I have a vector that is the exact same, it's going to have a co-sign score of one. So as an example, the only time you get a co-sign of score of one in a Q&A pair is if an analyst said, what's your guidance for the fourth quarter? And the CEO said, did you say what is our guidance for the fourth quarter?

That's when you've got a perfect match. You know, that rarely happens and when it does happen, you know, we fold that Q&A pair into the next Q&A pair to combine the two of them. What happens is that when you calculate a co-sign symbol score for the question vector and the answer vector, a manager that is on topic will have a high cosign score close to one, and a manager or an executive who is off topic will have a lower score.

We can essentially now have a score, a ratio, anywhere between zero and one. And what we do then is we just go long short that score, so managers with a high score, we're on topic and we build long portfolios from them. Managers with a low score are off topic and we build short portfolios.

Dana Gardner: Well, I can certainly see where a chief executive or a financial officer that had this tool available to them would want to take advantage of it and certainly be thinking that if my competition is doing this and I'm not, then I'm at a significant disadvantage. So, seems like it's a no brainer that you'd want to avail yourself of these services

Liam Hynes: Absolutely. If you, if you want to be ahead of the game, then you need to be a CEO that analyzes their own language and how they articulate results and the operations of the company, too.

But for measuring the proactiveness, it's a bit more technical. Essentially what we have to do is we have to identify the topics that the analysts are asking in their questions, and we have to determine were those topics mentioned in the pre-prepared remarks. Now, there's an old school natural language processing way that you can do that by, you know, counting up and identifying the topics in the question, seeing if it during the remarks, and coming up with a scoring mechanism.

But we trained an LLM or through prompt engineering to pretend it was an executive on an earnings call. And what we did is we fed that LLM executive the analyst questions, and we asked it, we said, “Pretend you're an executive on an earnings call and answer these insight analyst questions.”

Now the difference is that we rig fenced the LLM to only to be able to answer the questions from the pre hurdle mark, right? So that meant the LLM answered the question, the analyst question, but only use the text from the pre remarks to be able to answer that question. And then we did the same process, right?

We take the LLM answer, the original analyst question, and we compare them. We run the cosign similarities. So, if the LLM was on topic, it meant that topic must have been covered in the preprepared remarks, meaning that the executive was proactive, and if the LLM was off topic, it meant that it couldn't answer questions.

So that topic wasn't covered in the pre-prepared remarks. Meaning that the executives being reactive when they were answering that question

Dana Gardner: If this happened in real time, then these analysts asking questions could get that red flag and say, “Oh, I need to drill down on that question. The LLM says that this is a potential area for a deeper dive.”

Liam Hynes: Yes. If you had a sell-side analyst who was waiting on the call to answer their question, and they had something that was in real time to tell them that this topic wasn't covered in the pre-prepared remarks and might be important, they could potentially use their air time to ask that question as well.

Dana Gardner: It's fascinating how you can take this in different tangents. What comes next? You mentioned Snowflake Cortex. We see more and more agents coming on board these days as we have more agentic AI capabilities. Where might this lead to? Is this just scratching the surface, Liam?

Liam Hynes: Well, you know, there's an opportunity there for executives probably to set up some kind of sell-side analyst agent, LLM agent, right? You know, they would train that sell-side analyst to look at all questions that analysts have asked previously on their earnings calls. They could look at questions that analysts have asked on that company's peers and competitors.

And then they could essentially input all of those questions into an LLM. And then that LLMcould come up with hypothetical questions, potentially even based on their presentation. Like a real life agent to help them prep for earnings calls to make sure they're sharp, concise, and on topic on earnings calls.

Dana Gardner: So, the equivalent of an AI sparring partner that you could get in the ring with and have a go few rounds before you get out into the real world?

Liam Hynes: That's it. Yep, exactly. Prep yourself for those four calls a year. Very interesting. And I want to note as well the benefits of Snowflake Cortex when we did this work. I think we processed 192,000 earnings call transcripts, and there's approximately 20 to 30 analyst questions in each transcript.

That's 2.2 million questions. We gave 2.2 million questions to the LLM to answer. And then the LLM spells out 2.2 billion answers. So, to be able to systematically do that was a great benefit. And the fact that when you look at that much of a corpus of earnings calls to show that systematically proactiveness and on-topicness matter, there's statistical significance there that showcases that this isn't just random.

Proactive managers outperform reactive managers. On-topic managers outperform their off-topic peers. But interesting enough, we also tested those two signals mutually. We asked, “Okay, what happens when you have an executive that exhibits both of those characteristics?”

We came up with four communication styles. The first one was proactive and on-topic. These are executives who give the market what they want. They're proactive with information, and when the analysts ask questions, they're on-topic. We then had proactive and off-topic, reactive and on-topic.

And the flip side was reactive and off-topic managers. This is where communication is totally broken down. So, they're being reactive, and the analysts aren't getting the information they want in the presentation. And when executives are quizzed for that information, they're going off-topic.

It's almost like a double whammy. Executives aren't putting it in, maybe they're avoiding thesubject of the topic. And when they're pressed on that topic, they're again being evasive and they're avoiding it. What we've noticed is in the research, reactive and off-topic executives are significantly penalized versus their proactive and on-topic peers.

When you combine the two signals together, it actually is a much more powerful signal.

Dana Gardner: Well, it certainly sounds like a must-have tool for the busy executive who can move markets with their words -- or lack of words. A very interesting use case that opens up a whole new era of different types of tools across all sorts of different types of communication.

And, Liam, you're going to be presenting more detail about this at the Snowflake Summit this June at San Francisco. I'm sure that will be a well-attended event.

Liam Hynes: Yes, absolutely. We're really looking forward to that. So, I'm presenting on Monday, June 2. I have a 45-minute presentation. I'll be getting into the weeds on the economic rationale and how we constructed the signals and some of the back test results.

And then on Thursday, we have a hands-on lab. So if you think about it, I'm handling the theory on the Monday, and then there's a 19-minute hands-on lab on Thursday for any data scientists really want to get into the weeds and replicate our work.

Dana Gardner: I'm afraid we'll have to leave it there. Thanks so much to our latest Data Cloud Podcast guest, Liam Hynes, Global Head of New Product Development at S&P Global Market Intelligence. We really appreciate your sharing your thoughts and experience in this fascinating use case, Liam.

Liam Hynes: My pleasure, Dana. Thanks a million.

Sponsor: Snowflake.

How The Open Group Portfolio of Digital Open Standards Supports Your Digital Business Transformation Journey

2024-08-04T11:20:00.009-04:00

Transcript of a discussion on how a digital portfolio of standards and methods instructs innovation internally to match the demands of a rapidly changing, increasingly competitive, and analytics intensive global marketplace.

Listen to the podcast. Find it on iTunes. Download the transcript. Sponsor: The Open Group.

Dana Gardner: Hi, this is Dana Gardner, Principal Analyst at Interarbor Solutions, and you’re listening to BriefingsDirect. Our next enterprise architecture (EA) discussion explores how a comprehensive portfolio of open standards and associated best practices powerfully supports digital business transformation.

Gardner

As companies chart a critical course to adopt agility using artificial intelligence (AI)-driven benefits, they need proven and actionable structure to help deepen customer relationships, improve internal processes, and heighten business value outcomes.

Stay with us now as we explore how The Open Group Portfolio of Digital Open Standards instructs innovation internally to match the demands of a rapidly changing, increasingly competitive, and analytics intensive global marketplace.

Here to explore how to strategically architect for ongoing disruption and innovation is our expert guest. Please join me in welcoming Sonia Gonzalez, Digital Portfolio Product Manager at The Open Group. Welcome, Sonia.

Sonia Gonzalez: Thank you very much, Dana, for having me here. I’m really happy to talk about this exciting topic.

Gardner: Yes, it’s a very interesting time. There are lots of interesting and relevant topics to dig into. Sonia, what are the latest trends and catalysts propelling the need for a full portfolio of standards to better attain digital transformation?

Gonzalez

Gonzalez: Digital transformation is something that can completely change your company. It’s a process, a journey. But to do that, you need to start from the top. Meaning from a strategy; you need to have a digital strategy. Because you must change your business and operational models, you need to build new capabilities – and not just technical resources or technologies, but also the people. You need to train your people to pursue innovation and to create your business around customer centricity.

Of course, you need to take advantage of new technologies and trends, such as AI, the metaverse, cybersecurity and cybercrime, which are threats right now. You also must leverage the new power of computing in data processing, data analytics, and machine learning (ML).

If you don’t take advantage of all of that, then you’re going to be left behind. That’s why, a few years ago, we started this journey to conform the Portfolio of Digital Open Standards as a collection of practices that will allow any company to start the process, either if they are new to this (starters), or to maintain and especially sustain an already existing digital transformation process and effort.

That’s the reason we need the portfolio. We need different perspectives. It’s not only the technology, not only the people -- but it’s also everything that surrounds your company.

Gardner: Sure. And, I suppose, we used to look for silos within an organization with areas of expertise and would develop standards that might pertain specifically to them. But nowadays it’s important to have cross-pollination, if you will, and to look at standards not only in an isolated part of a company, but across them. We seek ways for them to better support each other.

Please explain why it is so important to seek a full portfolio of standards that are, if not integrated, complementary.

Digital change demands diversification

Gonzalez: Yes. The key words here are synergy, cross-collaboration, and consistency. All of our standards are very powerful on their own. For example, we have the TOGAF® Standard, which is one of the major recognized standards for Enterprise Architecture (EA). We have The Open Agile Architecture™, a Standard of The Open Group, for agility, you have the Digital Practitioner Body of Knowledge™ (DPBoK™) for digital; we have the ArchiMate® Standard for modeling in EA, we have theIT4IT™ standard for the IT processing and digital products.

But if all of them are used together in a consistent way, they become more powerful. They are greater than the sum of their parts. They provide a full and more systemic view of your issues.

For example, to make digital transformation possible, you need EA because you need to know and understand your capabilities, your landscape, and your actual measured capabilities to identify the gaps. But you also need to be able to manage digital products. And for that we have the IT4IT™ standard.

We need to pursue more agility, not only in the development or in the technical processes, but on the business as a whole. You need to become an agile enterprise.

We need to pursue more agility, not only in the development or in the technical processes, but in the business as a whole. So, you need to become an agile enterprise, and for that we need the Open Agile Architecture standard. Also, the TOGAF standard in which you will have guidance about agility.

If you want to have more customer-centricity and a learning progression toward digital, we have the DPBoK™ that precisely helps you understand how we can start very small and then continue evolving your capabilities, determine what you’re learning in the process, and how you can be evolving all those capabilities.

Those are the main aspects to understand and the benefit of having this portfolio. It’s not only that the content is in there in the same channel, which is completely HTML, you can cross navigate between the standards, you can make searches where you will find content from the different standards. We have also added some graphics icons in there, because as you know, people need very rapid solutions to the problems now.

Last April in Edinburgh as part of our summit, we released a new version of the Portfolio of Digital Open Standards. If you click, for example, in agile practice, immediately you will see content from the Open Agile Architecture. But from there you can navigate to the TOGAF Standard, and you can navigate to the IT4IT Standard for example. So that’s a way that you can, as a user, you learn from different practices because at the end of the day, it doesn’t matter if you are using the TOGAF Standard or the Open Agile Architecture or the DPBoK™. What you want and what you need is a solution to your problem. And you find that through this synergy that is found in the portfolio.

Gardner: The Open Group is a long and venerated organization going back to the standardization around the UNIX® platform back in the day. We don’t need to go that far back, but I would like to put a little context around how the whole concept of a digital portfolio working as a concerted effort among different disparate parts came about. Can you give us some background and history as to how the digital portfolio came about and where it is now?

How we got here

Gonzalez: Actually, that’s an interesting story. I started back around 2015. I remember that I was at one of the events and I remember being in an internal meeting, where there were some people from a few member companies who started this activity. At the moment, I was the Architecture Forum Director but as you know, architecture is closely connected with digital. The first name of this workgroup was not Digital Portfolio Workgroup as it is right now, but it was something related, such as digital business and customer experience working group. It was a very long name, and the idea was to combine digital with customer centricity.

So, we started working on that. In the beginning it was a very close, small group of members. Then a decision was made to make it a work group in order to allow members from different Forums such as Architecture, ArchiMate, IT4IT to engage. We started to grow and grow. We delivered a couple of white papers that have been published and are very good. Eventually, we decided to change the name from Digital Practitioner Workgroup. At a certain point, it was also led by a subgroup of platinum members at the board level, that happened around four or five years ago. They said, okay, we need to move this forward. So besides having content that is related to digital, we need to start to provide this content as a digital product.

So, we started the process to deliver standards as code. That’s why this small group of members started this work initiative, like I mentioned--it was led by one of our staff members. The idea was to start taking all this content, put it in an open source platform called GitLab, and produce the output in another open source platform called Antora, that allows you to generate from different GitLab repositories using markup language (AsciiDoc) , HTML-based output, which is designed to cross navigate between content, which is one of the main principles of the portfolio. And they also started building the first graphics icons and the photographic interfaces.

At that moment, it was a work activity led by members. Eventually, around two years ago, it was decided that it become part of the staff activity, to be maintained by members in the Digital Practitioner Workgroup. I moved from Architecture Forum space, and I was named the Digital Product Manager for the portfolio. We decided to change the name to Digital Portfolio Workgroup because we didn’t maintain only the DPBoK™ Standard anymore. We maintained the entire environment. We pursued cross collaboration. We tried to engage members from different forums.

The idea was to start taking all this content and put it in an open source platform. ... designed to cross navigate to deliver operating standards.

The task now has three main components. One is the content, which is provided for our members. The second is the platform that we have in which we are producing or delivering our standards as digital products. And the third one is delivering standards as code using also GitLab and Antora, facilitating a more agile DevOps oriented way of delivering standards into the market, which I believe is something innovative. I don’t believe any other standard organization is going that deeply into standards as code. It might be the case, but we are the ones who are starting with this activity.

The story is that we went from being a very small work group that then became more active, and then it became something that was driven by staff and with the collaboration of members in the work group.

At the moment, we have already delivered four different releases. The first one was in Edinburgh, in October 2022. Since then, we have had several releases. We have been adding new standards into the portfolio. We have been adding new guides because the portfolio is meant to have standards, snapshots, and guides. We started improving the landing pages and creating new landing pages. For example, we added the ArchiMate specification along with the landing page in the release in October 2023 in Houston.

For the one that we had this year in Edinburgh, we improved the landing page for the IT4IT™ Standard, which is called the Life cycle, and it also has some links to the DPBoK™ We made some improvements to the general user interface and very importantly, we received some feedback from members saying we need case studies, we need more than how, we have guides, we have standards, but how other people have made this work in a practical way. So, we start talking with members of the Government EA Group and the ArchiMate Standard, because the ArchiMate standard they are the ones that have also several case studies.

So, we constructed another instance in GitLab and Antora called the case study collection. This case study collection is meant to have case studies from different verticals, and it is connected with the portfolio. So, in the most recent release, I gave a demo in which you can click on one of the icons in the portfolio and you will be directed to the second instance where the case studies live. From there, you can go to categories such as government, healthcare, or banking and finance.

Also, you can go to physical items such as mechanical constructions and things like that where we have related case studies available. At the moment, we have migrated five case studies, two case studies from ArchiMate®, the ArchiSurance and ArchiMetal, and the other case studies are from the Government EA Work Group. At the moment, we have a very long queue for requests for more content to be added, more guides, more case studies.

Also, at the moment, the connection with the TOGAF Standard is through the TOGAF Standard 10th Edition. We have started the migration to also add the whole set of the TOGAF Standard into the portfolio, which is the highest priority for the rest of the year. Our objective is to have an incremental, ongoing improvement of the portfolio. So that’s where we are right now.

Gardner: Wonderful. Thank you for that comprehensive overview. Let’s go up a few thousand feet and start to talk about why this is so important. Everybody agrees that digital transformation is essential and integral to their success, but not very many people agree on how to go about it. As organizations are facing the need to transform and consider more of the benefits from ML and other analytics technologies, what are the challenges? What prevents people from being able to transform and innovate in their organizations as quickly and as powerfully as they’d like?

Where to develop your digital strategy

Gonzalez: I think one of the main challenges is to know where you are, you know, that’s why EA is such an important pillar in this. If you don’t know what you have, it is impossible to have a feasible path ahead to becoming digital. You need to understand your current state. Do you have a digital strategy? Do you have a strategy at all? And is it clear? Has it been shared? When you have your strategy, you start having a digital strategy. You start considering, okay, I already have these processes, I have this business lines, I have this product. It doesn’t matter if you are a company that is completely in the digital product business, it can be applicable to all companies. We had a very interesting case, last week in Edinburgh, about banking in Turkey. For that digital transformation, first they identified their current state, and then they identified again following the EA principles. So, start small and grow incrementally

Identify an area that is less difficult to digitize and digitalize and transform and deliver the first outcome, and then you can continue to iterate incrementally. For example, if you are a company that is having issues with the supply chain, you go and make a value stream assessment and a value chain assessment and start identifying what you need to digitize in there. To digitize is to put your information in digital format.

And sometimes people, companies, they don’t even have that. They may have perhaps information in digital format, but it’s not consolidated. So, data analytics and data transformation are one of the steps. After you have digitized that, you need to start making the digital transformation with your processes and your capabilities. Meaning your people, your applications, your infrastructure. You need to make an assessment of that.

When you talk about digital transformation, it's not a one-time effort, it's a continuous and ongoing journey. You start doing it incrementally.

For example, you need to ask yourself: Do I have the right capabilities for this? If I need to start having a manual process become completely automated and put it in one of our channels to become more customer facing, I need to improve the process. I need to train the people, probably hire new people. I need to automate, and I need to build a new channel for that, which of course comes with application and infrastructure layers. It’s a step-by-step process that starts with identifying where you are, where you want to be, and how to get there incrementally.

That’s why when you talk about digital transformation, it’s not a one-time effort, it’s a continuous and ongoing process. It’s a journey. You need to start doing it incrementally. In this case of the bank mentioned before, they started first by putting the data in order. They selected a critical process and improved it, and then they started improving the channels and then they started doing more things in digital and then started taking advantage of other technologies, such as AI, in their channels in the later stage. You need to start first with the simpler things that you need to do, because otherwise, if you start just changing things without connection and alignment without the impact assessment, the systemic view, you will be lost and the transformation effort will fail.

For example, people believe that, okay, there’s a new technology coming, I will implement it. They don’t take into consideration the current infrastructure, the current applications, the current capabilities of the people they have, whether they have legacy systems, if they have people trained. If they implement this new technology for the sake of implementing, it creates technical debt and unnecessary risks and even potential security breaches.

That’s why again, risk assessment is another key component of this. If you are transforming, but you are not aware of the risk, then you are creating another issue for your company. So, it’s a step-by-step process that you need to take. That’s why I always say that it’s very similar to EA, only in this case the customer is at the center and considering going digital. That’s the difference.

Gardner: Right. And certainly, undertakings to do digital transformation can swiftly become very complex and unwieldy. But when you apply structure, pragmatism, documentation, making sure that everyone is on the same page and collaborating accordingly, that complexity becomes much more managed. So as organizations use such things as the Open Group Digital Portfolio, what are some of the salient and most important benefits of that they’ll start to see?

Things that are perhaps a little intangible, difficult to measure, but nonetheless very important. What do you get when you do this right?

Measure your processes’ progress

Gonzalez: I think measurement is perhaps one of the more difficult things. For example, one thing that could be measurable is if you are delivering a product in a certain amount of time. You improve and digitize and digitalize to make your process better. You used to spend two hours on that; now you spend an hour and a half. That’s a metric. The other one is how efficient your people are becoming because one of the conditions for becoming digital is to transform your organizational structure.

If you have a structure that is too hierarchical with a lot of levels and people don’t have the freedom to act, it is very difficult to become agile or to become digital. But when you have autonomous teams, and each one of them has ownership of a specific part of the company or a product or a line of product and you have a cross-collaboration between them such as multidisciplinary autonomous teams and you give them ownership, you can start measuring what they are doing.

If you have a structure that is too hierarchical with a lot of levels and people don't have the freedom to act, it is difficult to become agile or digital. When you have autonomous teams, you can measure what they are doing.

Similar to the earlier scenario, you might have a one, two or three-day cycle and then you make a retrospective review and you re-measure, that’s what you need to do to start. For example, it would not be a good approach to make it three months and not measure what you’re doing. It should be shorter, smaller cycles. And again, you need to create these autonomous teams. In the O-AA™ Standard, there’s a lot of very good content about autonomous team and the fact that sometimes we organize our capabilities for physical or human resources following the same structure of the company.

So, they become very silo-oriented and very functional. The moment that you start seeing for example, how to deliver a new product into the market. Let’s say it’s a financial product, a new kind of loan or whatever. I need the person that manages loans. I need the person that manages legal aspects. I need the person that will handle the insurance policies that are related to that loan.

Of course, I need IT people, and I need data people. So, when I take this group of people together and they become autonomous, with a certain level of control of course, then they should be able to deliver this product to the final line easier and faster than if you have a very hierarchical structure in which you need permits and in which every area only owns and sees their own piece of work and not the whole thing. You need to own your process. You need to own your product if you really want to succeed at this.

Gardner: And of course, the proof of the pudding is in the eating, and you mentioned earlier that you’re now focusing on some case studies, which I imagine illustrate the important use cases. It’s another way of understanding the benefits of a digital portfolio and EA and a strategic approach to transformation. You don’t have to go into too much detail because I’m sure people will be able to access and review these case studies on their own, but maybe you could go through a few of the new case studies and why these use cases were so salient to begin with.

Case-by-case connections

Gonzalez: I think they are important. Some of them, especially the ones from the Government EA such address actions taken by the Indian government. They took on a project to improve certain areas in the government in order to offer better services to citizens. They started to improve the processes and applications around them. In the end, they started measuring the from the start, state A, and where they were at the end in terms of citizen satisfaction. There was a measure for that.

There was another very interesting one, but we haven’t migrated that yet. It is use of digitalization and digital information to improve the COVID vaccination process. At the beginning it was very messy. As you know, it was a health issue related to people’s lives. It was critical. It began with some initial automation. Then they created a portal in which people were able to create an appointment for their vaccinations with details such as how to get there, how to get their vaccine, how to access and update their medical records.

If they had COVID before, what were the symptoms? Which dose might they need? The process made it around different areas of the country by starting small and then growing and growing. In the end, even though the COVID emergency is somewhat lessened now, they decided to keep the project going in different stages and use it in other parts of the healthcare system, because healthcare is one of the sectors that needs this more.

You know, sometimes healthcare systems are inefficient because they are not connected. You don’t connect your medical supplies with your patients or with your healthcare centers. Sometimes some health centers will have medicine, but some others will not have it, and that’s also another case study that may be coming soon, probably in the next month, into the healthcare-related section of the portfolio.

As you know, we have a Healthcare Forum in The Open Group. They maintain a Reference Architecture which is into improvement, and we have a case study from a hospital. And they are working on how to better connect the different elements in their value chains, such as healthcare centers, providers either for medicine or medical equipment, patients, patients’ records, and all that. This content might be incorporated into the portfolio later this year.

Sometimes healthcare systems are inefficient because they are not connected. Now they are working to better connect different elements throughout their value chains.

In another case study, they implemented an Enterprise Service Bus (ESB) to be able to improve their processes. They had a process that was not really reused in the services, so they improved that ESB to be able to provide better service to their citizenship.

As I said, all of the case studies are on our website, and I invite you to look it over. All of them are very interesting and they describe the benefits of using The Open Group standards. They also mention other practices because we cannot pretend like we, as The Open Group, hold all the responses. There are other standards in the market that are valuable and important. That’s why whenever we refer to a third party in our standards for publications, we always ask for legal permission. But those case studies also have that connection to external sources, and they are completely reachable through the case studies.

Gardner: Right. And so, looking to the future, digital transformation now is perhaps under pressure as organizations adjust to more AI and analytics, and data driven decision-making. It seems that there’s pressure on organizations to move quickly. If their competitors do AI perhaps better than they do, they could find themselves at a disadvantage.

As we look to the future of how digital transformation unfolds and how the digital portfolio can be very instrumental and accelerate their objectives and success, how is AI impacting this equation? What should we expect over the next several years in terms of how organizations can make AI a friend rather than a foe?

Put AI into the proper context

Gonzalez: Yes. That’s a very good question. Actually, that was one of the main themes at our event in Edinburgh. We had very good presentations there. I think AI has two different edges, like you said. It has the good one, which is that it could be very powerful if used properly but you need to be aware that it’s not magic. If you have acquired an AI tool or have partnered with someone that provided you with that tool, you need to be aware that first you need to have the right data for it, the right information to inject into that tool. You need to give that tool training because there are some patterns that they have. You need to do programming to be able to really have the AI give you the right response. The tool also needs the right context for the data you are feeding into it to receive a consistent output

You need to make a special request, and you need to give some training, invest some time, and feed data and training into it so that this AI activity can serve you for several purposes. It can be just for cognitive analysis which is useful on its own. It can be very helpful for giving you decision-making support and it can be the other side of that, which is generative AI where it is generating new content from your input.

So, you put that text or images or content in whatever form and it should be able to create a video, to create a story, to create a summary, to create a report, to create whatever kind of output that you need. But in order to do that, of course, there are some very critical capabilities that you need to build and that’s why again, if you are in the middle of your digital transformation and you want to include AI, you need to be sure that you have that capability.

For example, critical questions to ask are: Do I have the right data to feed into that AI tool? Do I have the right texts, images, and content because you need to give context. Even a simple ChatGPT that you use in your phone, if you ask a question and you don’t give the context, it will provide a very inadequate response. You need to give context. Sometimes the same AI will ask you “I need more context”. So, you need to provide the context.

You need to have an algorithm in that AI tool that is able to interpret the data you’re giving it to predict because they learn from experience and to act on that and you need to be able also to address your output.

The output could be a success, but it could be a failure. It’s not like because AI told me this, I’m going to use it. And also, you need to be adjusting the algorithm that it uses, the learning process, the outcomes, analytics.

The other thing that is very important is to understand that there are different components around AI, we have ML, we have a neural network, which is the way that this information is processed and when it is able to learn from the past experience.

Of course, there’s another one called natural language processing (NLP) and learning, which, by the way, is one of the more active working groups in The Open Group. Of course, they need cognitive computing, so we need to be aware that you need resources, infrastructure for this.

And now that we are thinking about sustainability, AI is going to become one of the threats in terms of sustainability.

We had another very good workshop in Edinburgh about the carbon footprint and even though AI is good, as all technology could be good, its footprint is actually going to become exponential because AI requires a lot of technical resources and power consumption. It needs a lot of computing processes to be able to generate the output, especially if you’re going to generate complex things such as a video or song or any other kind of generative content.

We're already seeing evidence of jurisdictions looking at the increasing power and water demand ... so they can understand the implications on utilities and infrastructure of these new AI workloads.

And of course you need to have a vision. Why do I need AI in the first place? Is it really that I need it or because it’s in fashion, because everybody is talking about it. You need to have the right capabilities for that. For example, you have to have an AI policy. We already have an AI policy at The Open Group that we have shared with our members. For example, confidentiality is one factor. You should be very careful if you put some critical information in an AI tool. If that AI tool is behind a locked, closed door, where it’s not public, then probably you’re fine. But if you take a public tool and you put private data in there, then there can be cybersecurity threats. Cybercriminals are already using it.

Another important aspect for the AI policy is legal considerations. Legal needs to be involved in the policy. You need to also make a risk assessment before implementing it and of course you need to be sure that you have the technical critical capabilities.

And there’s another important one. You need to teach your people. I think everybody talks about AI and it’s an interesting topic, but we all need to learn more about it. I know people that are already experts, but we need to learn more about it before using it in the company because it can become a threat

You may have already heard in the news that there are already criminals using AI to generate fake calls. You receive a call and it’s your son’s voice telling you that he has been kidnapped. So how would you react to that? Or there are artists and singers that have been making demands and lawsuits because someone has imitated their voice. They’re singing using AI.

It can be used very well or very poorly depending on the programming which is also a little scary. For example, you can use, and it’s already being done, you can use drones or small robots in a war zone just to see if there are people that are alive who need to get medical care, but you can also use it to kill people.

It’s a double edge. I think it’s excellent to take advantage of what humans can do with technology, but it can be used -- it should be used very carefully, and it should be used knowing that you have the right capabilities and especially can respond to the critical questions--Why do I need AI? How am I going to implement and what am I going to do with it? That is my advice in that regard.

Gardner: Great. Well, it sounds like not only is the digital portfolio very important for making your journey to digital transformation smoother and faster, but it certainly also sounds like it’s very important to mitigate the risk when it comes to adopting AI and similar technology. So that’s very exciting for the future and I hope you get a chance to talk about that more.

Before we close out, Sonia, please help our readers and listeners understand how they can become more actively involved with The Open Group in terms of events, certifications, resources and specifically how they can start to avail themselves of the digital portfolio.

The Open Group support and opportunities

Gonzales: Okay, thank you for that. First of all, I invite our listeners to go to our website. On there, you will find important information about all of our standards. On the main page, you have to scroll down a little bit. You will find something called the Portfolio Digital Open Standards.

In there, you can read what it is. You can click and you will know more about it. There’s a video from our co-chair and you can click and actually you can experiment with the thing live. It’s completely live now and you can start navigating in there, trying it. You can make searches. You can go to the case study collection.

More importantly, please give us your feedback. There’s a small icon in the top right of the screen, which you can click on and send us your feedback. It’s completely private. That feedback is only seen by The Open Group staff. So don’t be shy about putting your email in there because it’s something that we treat very carefully.

Also, in our website, we have information about certification. Also in certification, we are going into a learning progression. Those of you that are familiar with the TOGAF certification program, it has gone now into this badge program in which you become certified in level 1 and 2 in the TOGAF standard.

But then you can become specialized in business architecture, risk and security, agile, digital. We had to couple that precisely to give this more agility and we are going to follow a similar one for the DPBoK™ Certification. There’s already plans to restructure the DPBoK and to also restructure their certification program.

More importantly, if you want to contribute with us besides giving us feedback, you can become a member of The Open Group. It has a lot of advantages. You can go to our website. You will find information how to become a member. You will see the cost for a silver, gold, or platinum member. You will see a little bit about the benefits. You can ask for more information, reach out to our business team.

Also, you can send me an email. Please contact me, drop me an email and I’ll be more than happy to help you through the portfolio. You don’t have to be a member to have some kind of an onboarding session with me. I can give you at any moment on onboarding session and explain to you what we are doing even if you want to just know the portfolio, or you want to become a member. We can also engage with our business team for them to give you more explanation about the process of becoming a member.

If you want to become certified and you’re not sure of the process, you can also reach out to me. If you are a tool vendor and you want to certify your tool, you can also go to The Open Group and you can reach me, and I can lead you to our certification team people and they should be able to serve you.

Also, please go to our social media. We have our YouTube channel in there. You will see a lot of videos, The Toolkit Tuesday, testimonials, The Open Group Blogs. We recently published a blog about the digital portfolio. We are soon going to publish a survey. It’s going to be sent to our social media probably LinkedIn, so be aware of that. Also, we have our podcast like this one, our blogs. Use our social media. You will find a lot of information in there.

And in terms of proceedings, especially if you attended the session, you could go to the proceeding and see what we discussed last week in our Edinburgh about AI. Ecosystem Architecture is another topic that we are taking very seriously at The Open Group. Sustainability is another one like I mentioned. Sometimes there’s a trade-off between technology and the environment which is becoming more and more relevant now.

Reach us through our social media, through email, or through our web page and we will be more than happy to give you more information.

Gardner: Well, great. I’m afraid we have to leave it there. You’ve been listening to a sponsored Briefings Direct discussion on how a comprehensive portfolio with open standards and associated best practices powerfully supports analytics-rich digital business transformation.

And we’ve learned how The Open Group’s latest digital portfolio of standards and methods instructs innovation internally to match the demands of a rapidly changing, increasingly competitive and analytics-intensive global marketplace.

So, a big thank you to our expert guest. We have been here with welcoming Sonia Gonzalez, Digital Portfolio Product Manager at The Open Group. Thank you so much, Sonia.

Gonzales: Thank you very much, Dana, again for having me and thank you to our listeners for listening to your podcast and providing feedback. Thank you.

Gardner: Yes, a big thank you to our audience for joining this Briefings Direct strategic enterprise architecture discussion. I’m Dana Gardner, Principal Analyst at Interarbor Solutions, your host throughout this series of insightful discussions sponsored by The Open Group.

Thanks again for listening. Please pass this along to your enterprise architecture and business agility communities and do come back next time.

Listen to the podcast. Find it on iTunes. Download the transcript. Sponsor: The Open Group.

Make AI Adoption a Strategic, ROI-Focused, Fit-for-Purpose and Sustainable Transformation, Says HPE

2024-05-15T10:05:00.018-04:00

Transcript of a discussion on how energy use and resources management have emerged as key ingredients of artificial intelligence adoption success -- or failure.

Listen to the podcast. Subscribe to the podcast. Download the transcript. Sponsor: Hewlett Packard Enterprise.

Dana Gardner: Hello, and welcome to the next edition of the BriefingsDirect podcast series. I’m Dana Gardner, Principal Analyst at Interarbor Solutions, your host and moderator for this ongoing discussion on best practices for deploying artificial intelligence (AI) with a focus on sustainability and strategic business benefits.

Gardner

As AI rises as an imperative that impacts companies at nearly all levels, proper concern for efficiency around energy use and resources management has emerged as a key ingredient of success -- or failure. It’s becoming increasingly evident that AI deployments will demand vast resources, energy, water, skills, and upgraded or wholly new data center and electrical grid infrastructures.

Stay with us now as we examine why factoring the full and long-term benefits — accurately weighed against the actual costs — is essential to assuring the desired business outcomes from AI implementations. Only by calculating the true and total expected costs in the fullest sense can businesses predict the proper fit-for-purpose use for large deployments of AI systems.

Here to share the latest findings and best planning practices for sustainable AI is John Frey, Director and Chief Technologist of Sustainable Transformation at Hewlett Packard Enterprise (HPE). Welcome, John.

John Frey: Thank you. It’s great to be here.

Gardner: It’s good to have you back.

John, AI capabilities have moved outside the traditional boundaries of technology, data science, and analytics. AI has become a rapidly growing imperative for business leaders -- and it’s impacting the daily life of more and more workers. Generative AI, and more generally large language models, for example, are now widely sought for broad and varied uses.

While energy efficiency has long been sought for general IT and high-performance computing (HPC), AI appears to dramatically up the game on the need to factor and manage the required resources.

John, how much of sea change is the impact of AI having on all that’s needed to support these complex systems?

AI impact adds up everywhere

Frey

Frey: Well, AI certainly is an additional load on resources. AI training, for example, is power-intensive. AI inferencing acts similarly, and obviously is used again and again and again if users use the tools as designed for a long period of time.

It remains to be seen how much and how quickly, but there’s a lot of research out there that suggests that AI use is going to rapidly grow in terms of overall technology demand.

Gardner: And, you know, we need to home in on how powerful and useful AI is. Nearly everyone seems confident that there’s going to be really important new use cases and very powerful benefits. But we also need to focus on what it takes to get those results, and I think some people may have skipped over that part.

Frey: Yes, absolutely. A lot of businesses are still trying to figure out the best uses of AI, and the types of solutions within their infrastructure that either add business value, or speed up their processes, or that save some money.

Gardner: And this explosive growth isn’t replacing a traditional IT. We still need to have the data centers that we’re running now performing what they’re performing. This is not a rip and replace by any stretch. This is an add-on and perhaps even a different type of infrastructure requirement given the high energy density, total power, and resulting heat requirements.

Frey: Absolutely. In fact, we constantly have customers coming to us asking both how does this supplement the existing technology workloads that they are already running, and what do they need to change in terms of the infrastructure to run these new workloads in the future?

Gardner: John, we’re seeing different countries approach these questions in different ways. We do not have a clean room approach to deploying AI. We have it going into the existing public infrastructure that serves cities, countries, and rural localities.

And so, how important is it to consider the impact -- not just from an AI capabilities requirement -- but from a societal and country-by-country specific set of infrastructure requirements?

Frey: That’s a great question. We’re already seeing evidence of jurisdictions looking at the increasing power demand, and also water demand. Some are either slowing down the implementation or even pausing the implementation for a period of time so that they can truly understand the implications on the utilities and infrastructure that these new AI workloads are going to have.

Gardner: And, of course, the some countries and regulatory agencies are examining how sustainable our overall economy is, given the amount of carbon and record-breaking levels still being delivered into the atmosphere.

Rethink Sustainability

As a Productivity Catalyst

Frey: Absolutely, and that has been a constant focus. Certainly, technology like AI brings that front and center from both a power and water perspective, but also from a social good perspective.

If you think in the broadest use of the term sustainability, that’s what those jurisdictions are looking at. And so, we’re going to see new permitting processes, I predict. We’re also going to see more regulatory action.

Gardner: John, there’s been creep over the years as to what AI entails and includes -- from traditional analytics and data crunching, to machine learning (ML), and now the newer large language models and their ongoing inference demands. We’re also looking at tremendous amounts of data, and the requirement for more data, as another important element of the burgeoning demand for more resources.

How important is it for organizations to examine the massive data gathering, processing, and storing requirements -- in addition to the AI modeling aspects -- as they seek resources for sustainability.

Data efficiency for effectiveness

Frey: It’s vital. In fact, when we think about how HPE looks at sustainable IT broadly, data efficiency is the first place we suggest users think about improvement. From an AI perspective, it’s increasingly about minimizing the training sets of data used to train the models.

For example, if you’re using off-the-shelf data sets, like from crawls of the entire internet around the globe, and if your solutions are only going to operate in English, you can instantly discard the data that have been collected that aren’t in the English language. If, for example, you’re building a large language model, you don’t need the HTML and other programming code that a crawler probably grabbed as well.

Getting the data pull right in the first place, before you do the training, is a key part of sustainable AI, and then you can use only your customer’s specific data as you tune that model as well.

By starting first with data efficiency -- and getting that data population as concise as it can be from the early stages of the process -- then you’re driving efficiency all the way through.

Gardner: So being wise with your data choices is an important first step for any AI activity. Do you have any data points on how big of an impact data and associated infrastructure demands for AI can have?

Frey: Yes, for the latest large language models that many people are using or familiar with, such as GPT-4, there’s been research looking at the reported infrastructure stack that was needed to train that. They’ve estimated more than 50 gigawatt hours of energy were consumed during the training process. And that training process, by the way, was believed to be somewhere on the order of about 95 days.

Now to put that level of power in perspective, that is about the same power that 2,700 U.S. homes consume for a year using the US Environmental Protection Agency’s (EPA’s) equivalency model. So, there’s a tremendous amount of energy that goes into the training process. And remember, that’s only in the first 95 days of training for that model. Then the model can be used for multiple years with people running inference problems against it.

In the same way, we can look at the water consumption involved. There are often millions of gallons of water used in the cooling during such a training run. Researchers also predicted that running a single 5- to 20-variable problem, or doing inference with 5- to 20-variables, results in a water consumption for each inference run of about 500 milliliters, or a 16-ounce bottle of water, as part of the needed cooling. If you have millions of users running millions of problems that each require an inference run, that’s a significant amount of water in a short period of time.

Gardner: These impacts then are on some of our most precious and valuable commodities: carbon, water, and electricity. How is the infrastructure needed to support these massive AI undertakings different from past data centers? Do such things as energy density per server rack or going to water instead of air cooling need to be re-examined in the new era of AI?

Get a handle on AI workloads

Frey: It’s a great question. Part of the challenge, and why it comes up so much, is as we think about these new AI workloads, the question becomes, “Can our existing infrastructure and existing data centers handle that?”

Several things that we think are pushing us to consider either new facilities or new co-location sites are such issues as rack density going up. Global surveys look at rack densities and the most commonly reported rack density today is about four to six kilowatts per rack. Yet we know with AI training systems, and even inference systems, that those rack densities may be up in the 20, 30, to all the way up to 50 kilowatts per rack.

Many existing IT facilities aren’t made to handle that power density at all. The other thing we know is many of the existing facilities continue to be air-cooled. They’re taking in outside air, cooling it down and then providing that to the IT equipment to remove the heat. We know that when you start getting above 20 kilowatts per rack or so, air cooling is less effective against some of those high-heat-producing workloads. You really may need to make a shift to direct liquid cooling.

And again, what we find is so many data centers that exist today, whether they’re privately owned or in a co-location space, don’t have the capability for the liquid cooling that’s required. So that’s going to be another needed change.

We have higher densities, higher heat generation, and so need more effective cooling. These are driving a need for our infrastructure to change in the future.

And then the third thing here is the workloads are running both the training and the inference and so often they have accelerators in them. We’re seeing the critical temperature that those accelerators -- along with the central processing units (CPUs) – run at have to be kept below certain thresholds to run most effectively, and that is actually dropping.

At the same time, we have higher densities, higher heat generation, and therefore, need for more effective cooling. The required critical temperature of the most critical devices is dropping. These three elements put together are really what’s driving a tremendous amount of the data that calls for our infrastructure to change in the future.

Gardner: And this is not going to just impact your typical global 2000 enterprise’s on-premises data centers. This is going to impact co-location providers, various IT service providers, and the entire ecosystem of IT infrastructure-as-a-service (IaaS) providers.

Frey: Yes, absolutely. I will say that many of these providers have already started the transition for their normal, non-AI workloads as server efficiency has dramatically improved, particularly in terms of performance per watt and as rack densities have grown.

One of the ways that co-location providers charge their customers is by space used, and another way is by power consumption. So, if you’re trying to do as much work as possible for the same watt of power -- and you’re trying to do it in the smallest footprint possible -- you naturally will raise rack densities.

So, this trend has already started, but AI accelerates the trend dramatically.

Gardner: It occurs to me, John, that for 30 or more years, there was a vast amount of wind in the sails of IT and its evolution in the form of Moore’s law. That benefit of the processor design improving its efficiency, capability, and to scale rapidly over time was often taken for granted in the economics of IT in general. And then, for the last 5 to 10 years, we’ve had advances in virtualization and soaring server utilization improvements. Then massive improvements in data storage capacities and management efficiencies were added.

But it now seems that even with all of that efficiency and improved IT capabilities, that we’re going in reverse. We face such high demands and higher costs because of AI workloads that the cost against value is rapidly rising and demands more of our most expensive and precious resources.

Do we kiss goodbye any notion of Moore’s law? How long can true escalating costs continue for these newer compute environments?

Time to move on from Moore’s Law?

Frey: Those of us who are technologists, of course, we love to find technology solutions to challenges. And as we’ve pushed on energy efficiency and performance per watt, we have seen and predicted in many cases an end to Moore’s law.

But then we find new ways to develop higher functioning processors with even better performance. We haven’t hit thresholds there that have stopped us yet. And I think that’s going to continue, we will grow performance per watt. And that’s what all of the processor vendors are pushing for, on improving that performance per watt equation.

That trajectory is going to continue into the near future, at least. At the same time, though, when we think more broadly, we have to focus on energy efficiency, so we literally consume less power per device.

But as you look at human behavior over the past two decades, every time we’ve been able to save energy in one place, it doesn’t mean that overall demand drops. It means that people get another device that they can’t live without.

Empowering Sustainable IT

Through Data Efficiency

For example, we all now have cell phones in our pockets, which two decades ago we didn’t even know we needed. And now, we have tablets and laptop computers and the internet and all of the things that we have come to not be able to live without.

It’s gotten to the point that every time we drive these power efficiencies, there are new uses for technology -- many of which, by the way, decarbonize other processes. So, there’s a definite benefit there. But we always have to weigh that.

Is a technology solution always the right way to solve a challenge? And what are the societal and environmental impacts of that new technology solution so that we can factor and make the best decisions?

Gardner: In addition to this evolution of AI technology toward productivity and per watt efficiency, there are also market factors involved. If the total costs are too high, then the marketplace won’t sustain the AI solution on a cost-benefit basis. And so, as a business, if you’re able to reduce cost as the only way to make solutions viable, that’s going to be what the market demands, and what your competitors are going to force on you, too.

The second market forces pillar is the compliance and regulatory factor. In fact, in May of 2024, the European Union Energy Efficiency Directive kicks in. And so, there are powerful forces around total costs of AI supply and consumption that we don’t have much choice over, that are compelling facts of life.

Frey: Absolutely. In fact, one of the things we’re seeing in the market is a tremendous amount of money being spent to develop some AI technologies. That comes with really hard questions about what’s a proper return on investment (ROI) for that initial money spent to build and train the models. And then, can we further prove out the ROI over the long-term?

Our customers are now wisely asking those very questions. We’re also, from an HPE perspective, making sure that customers think about the ethical and societal consequences of these AI solutions. We don’t want customers bringing AI solutions to market and having an unintended consequence from a bias that’s discovered, or some other aspect around privacy and cybersecurity that they had not considered when they built the solution.

And, to your point, there is also increasing interest in how to contend with regulatory constraints for AI solutions as well.

Gardner: So, one way or another, you’re going to be seeking a fit-for-purpose approach to AI implementations -- whether you want to or not. And so, you might as well start on that earlier than later.

Let’s move now toward ways that we can accomplish what we’ve been describing in terms of keeping the AI services costs down, the energy demand down, and making sure that the business benefits outweigh the total and real costs.

What are some ways that HPE -- through your research, product development, and customer experiences -- is driving toward general business sustainability and transformation? How can HPE be leveraged to improve and reduce risk specifically around the AI transformation journey?

Five levers for moving sustainably

Frey: One of the things that we’ve learned in 22 years or so of working with customers specifically on sustainable technology broadly is we’ve discovered five levers. And we intentionally call them “levers” because we believe that all of them apply to every customer, whether they have their IT workloads in the public cloud, a hybrid or private cloud, a bare-metal environment, or whether they are on-premises, co-location, or even out on the edge.

We know that they can drive efficiencies if customers consider these levers. And those five are first data efficiency, which we’ve talked about a little bit already. From the AI context, it’s first about making sure that the data sets that you’re using are optimized before running the training.

When we process a bit of data in a training environment, for example, do we avoid processing it again if we can? And how do we make sure that any data that we’re going to train for, or derive from an inference, actually has a use? Does that data provide a business value?

From the AI context,data efficiency is about optimizing the data sets you're using to make sure it provides a business value. Making the right decisions on storage and data flows down through the other aspects of sustainability.

Next, if we’re going to collect data, how do we make sure that we make an intentional decision on the front end about how long we’re going to store that data, and how we’re going to store it? What types of storage? Is it something they will need instantaneously? And we can choose from high availability storage or go all the way down to tape storage if it’s more of an archival or regulatory requirement to keep that data for a long period of time. So, data efficiency is where we suggest we start, because making the right decisions there flows down through all of the other aspects.

The second lever is software efficiency and this, from a broader technology perspective, is focused on writing more efficient software applications. How do we reduce the carbon intensity of software applications? And how do we use software to drive efficiency?

From an AI perspective, this gets into model development. How do we develop more efficient models? How do we design these models, or leverage existing models, to be as efficient as possible and to use the least amount of compute capability, storage capability, and networking capability to operate most efficiently?

Software efficiency even includes things such as the efficiency of the coding. Can it be in a compiled language versus a non-compiled language, and so it takes less power and CPU capability to run that software as well? And HPE brings many tools to the market in that environment.

Next, how do we use software to drive efficiency? Some of the things we’re seeing lots of interest in with AI are things like predictive maintenance and digital twins, where we can actually use software tools to predict things like maintenance cycles or failures, even things like inferring operating and buying behaviors. We see these used in terms of the design of data centers. How do we shift workloads for most efficient and lowest carbon operation? All of those aspects are in software efficiency.

And then we move to the hardware stack and that means equipment efficiency. When you have a piece of technology equipment, can you have it do the most amount of work? We know from global industry surveys that technology equipment is often very underutilized. For a variety of reasons, there’s redundancy and resiliency built into the solutions.

But as we begin moving more into AI, we tend to look at hardware and software solutions that deliver high levels of availability across the equipment infrastructure. On one hand, by its very nature, AI is designed to run this equipment at higher levels of utilization. And there is huge demand, particularly in terms of training, on single large workloads that run across a variety of devices as well. But equipment efficiency is all about attaining the highest levels of utilization.

Then, we move to energy efficiency. And this is about how to do the most amount of work per input watt of power so that the devices are as high performing as possible. We tend to call that being energy effective. Can you do the most amount of work with the same input of energy?

And, from an AI perspective, it’s so critical because these systems consume so much power that often we’re able to easily demonstrate the benefits for an input watt of power or volume of water that we’re using from a cooling perspective.

And finally, resource efficiency, and that’s about how do we run technology solutions so that they need the least number of various resources. Those include auxiliary cooling or power conversions, or even the human resources that it takes to run these solutions.

So, from an AI context, again, we’ve talked about raising power densities and how we can shift directly from air to water. Cooling is going to be so critical. And it turns out that as you move to direct liquid cooling, that has a much lower power percentage compared to some of our air-cooled infrastructure. You can drop your power consumption dramatically by moving to direct liquid cooling.

How Digital Transformation Benefits

From Energy Efficiency

It's the same way from a staffing perspective. As you begin having analytics that allow you to monitor all these variables across your technology solutions -- which is so common in an AI solution – you need fewer staff to run those solutions. You also gain higher levels of employee satisfaction because they can see how the infrastructure is doing and a lot of the mundane tasks, such as constant tuning, are being made more efficient.

Gardner: Well, this drive for sustainability is clearly a non-trivial undertaking. Obviously, when planning out efficiencies across entire data centers, it continues over many years, even decades.

It occurs to me, John, that smaller companies that may want to do AI deployments themselves -- to customize their models and their data sets for particular uses – and so to develop proprietary and advantage-based operations, they are going to be challenged when it comes to achieving AI efficiently.

At the same time, the large hyperscalers, which are very good at building out efficient data center complexes around the globe, may not have the capability to build AI models at the granular level needed for the vertical-industry customization required of smaller companies.

So, it seems to me that an ecosystem approach is going to shake out where these efficiencies are going to need to manifest. But it’s not all going to happen at the company-by-company level. And it can’t necessarily happen at the cloud provider-by-cloud provider level either.

Do you have any sense of how we should expect an AI services ecosystem – one that reaches a balance between needed customization and needed efficiency at scale – will emerge that can take advantage of these essential efficiency levers you described?

An AI ecosystem evolves

Frey: Yes, exactly what you describe is what we see happening. We have some customers that want to make the investments in high-performance computing and in the development and training of their own AI solutions. But those customers are very few that want to make that type of investment.

Other customers want to access an AI capability and either have some of that expertise themselves or they want to leverage a vendor such as HPE’s expertise from a data science perspective, from a model development perspective, and from a data efficiency perspective. We certainly see a lot more customers that are interested in that.

And then there’s a level above that. Customers that want to take a pre-trained model and just tune it using their own specific data sets. And we think that segment of the population is even broader because so many highly valuable uses of AI still require training on task-specific or organization-specific data.

And finally, we see a large range of customers that want to take advantage of pre-trained, pre-tuned AI solutions that are applicable across an entire industry or segment of some kind. One of the things that HPE has found over the years as we’ve built all portions of that stack and then partnered with companies is that having that whole portfolio, and having the expertise across them, allows us to look both downstream and upstream to what the customer is looking at. It allows us to help them make the most efficient decisions because we look across the hardware, software, and that entire ecosystem of partners as well.

It does, in our mind, allow us to leverage decades worth of experience to help customers attain the most efficient and most effective solutions when they’re implementing AI.

Gardner: John, are there any leading use cases or examples that we can look to that illustrate how such efficiency makes an impactful difference?

Examples of increased AI productivity

Frey: Yes. I’ll give you just a couple of examples. Obviously, an early adopter of some types of AI systems have been in healthcare. A great example is x-rays and looking at x-rays. It turns out, with ML, you can actually do a pretty good job of having an ML system look at x-rays, do scanning, and make a decision. “Is that a bone fracture or not?” for example. And if it’s unsure, pass that to a radiologist who can take a deeper look. You can tune the system very, very well.

There’s a large population of x-ray imagery that creates some very clear examples of something that is a fracture or something that is not, for example. There have been lots of studies looking at how these systems perform against the single radiologist looking at these x-rays as well.

We want to train tools that can answer basic customer questions or allow the customer to interact from a voice perspective. In some cases we can give the right answer in both voice and typed speech.

Particularly, when a radiologist spends their day going from x-ray to x-ray to x-ray, there can be some fatigue associated with that, so their diagnostic capabilities get better when the system does a first-level screen and then passes the more specific cases to the radiologist for a deeper analysis. If there is something that’s not really clear one way or the other, it lets the radiologist spend more time on it. So, that’s a great one.

We’re seeing a lot of interest in manufacturing processes as well. How do we look at something using video and video analytics to examine parts or final assemblies coming off of an assembly line and say, “Does this appear the way it’s supposed to from a quality perspective?” “Are there any additional components or are there any components missing,” for example.

It turns out those use cases actually do a really good job from a power performance perspective and from a ROI perspective. If you dive deeper, into natural language processing (NLP), we want to train tools that can answer basic customer questions or allow the customer to interact from a voice perspective with a service tool that can provide low-level diagnostics for a customer or route, for example. In some cases, it can even give them the right answer in both voice and typed speech.

In fact, you’re now seeing some of those come out in very popular software applications that a variety of people around the world use. We’re seeing AI systems that predict the next couple words in a sentence, for example, or allow for a higher level of productivity. I think those again are still proving their case.

In some cases, users see them as a barrier, not as an assistant, but I think the time will come, as those start getting more and more accurate, when they’re going to be really useful tools.

Gardner: Well, it certainly seems that given the costs and the impacts on carbon load, on infrastructure, on the demand for skills to support it, that it’s incumbent on companies big and small to be quite choosy about which AI use cases and problems they seem to solve first. This just can’t be a solution in search of a problem. You need to have a very good problem that will deliver very good business results.

It seems to me that businesses should carefully evaluate where they devote resources and use these intelligence capabilities to the fullest effect and pick those highly productive use cases and tasks earlier rather than later.

Define a sustainable IT strategy

Frey: Yes, absolutely. Let’s not have a solution in search of a problem. Let’s find the best business challenges and opportunities to solve, and then look at what the right strategic approaches to solving them. What’s the ROI for each of those solutions? What are some of the unintended consequences, like a privacy issue or a bias issue, that you want to prevent? And then, how do we learn from others that have implemented those tools and partner with vendors that have a lot of historical competencies in those topics and have had many customers bring those solutions to market.

So, it’s really finding the best solution for the business challenge and being able to quantify that benefit. One of the things that we did really early on as we were developing our sustainable IT approach is to recognize that so many customers didn’t know how to get started.

We offered a free workbook for the customers called, Six Steps for Developing a Sustainable IT Strategy. Well, one of the things that it says -- and this is in the majority of AI conversations as well – is that the customer couldn’t measure the impact of what they had today because they didn’t have a baseline. So, they implemented a technology solution and then said, “That must be much better because we’re using technology.” But without measuring the baseline, they weren’t able to quantify the financial, environmental, and carbon implications of the new solution.

We help customers along this journey by helping them think about this strategically, to get all the appropriate organizations within their company that need to be part of making a decision about these solutions together. For example, if you’re worried about cybersecurity implications, make sure the cybersecurity team is part of this project team. If you’re worried about bias implications, make sure that your legal teams are involved and anyone else it’s looking at employee or customer privacy. If you’re thinking about solutions that are going to decarbonize or save power, for example, make sure you have your global workplace teams involved and help quantify that, and your sustainability teams if you’re going to talk about carbon mitigation as part of all of this.

It’s about having the right organizations involved, looking at all the issues that can help make the decisions, and examine if the solution really is sustainable. Does it have both a financial and an environmental ROI that makes sense?

Gardner: It sure seems that emphasizing AI sustainability should be coming from the very top of the organization, any organization, and in very loud and impressive terms. Because as AI becomes a core competency -- whether you source it or do it in-house -- it is going to be an essential business differentiator. If you’re going to do AI successfully, you’re going to need to do it sustainably. And so, AI sustainability seems to be a pillar of getting to an AI outcome that works long-term for the organization.

As we move to the end of our very interesting discussion, John, what are some resources that people can go to? How can they start to consider what they’ve been doing around sustainability and extending that into AI, or examine what they’re doing with AI and make sure that it conforms to the concepts around sustainability and the all-important objectives of efficiency?

Frey: The first one, which we’ve already talked about, is make sure you have a sustainable IT strategy. It’s part of your overarching technology strategy. And now that it includes AI, it really gets accelerated by AI workloads.

Part of that strategy is getting stakeholders together so that folks can help look for the blind spots and help quantify the implications and the opportunities. And then, look across the entire environment -- from public cloud to edge, hybrid cloud, and private cloud in the middle -- and look to those five levers of efficiency that we talked about. In particular, emphasize data efficiency and software efficiency from an AI perspective.

And then, look at it all across the lifecycle, from the design of those products to the return and the end-of-life processes. Because when we think about IT lifecycles, we need to consider all of the aspects in the middle.

Six Steps for Developing

A Sustainable IT Strategy

That drives such things as how do you procure the most efficient hardware in the first place and provide the most efficient solutions? How do you think about tech refresh cycles and why are tech refresh cycles different for compute, storage, networking, and with AI? How do all those pieces interconnect to impact tech refresh cycles?

And from an HPE perspective, one of the things that we’ve done is published a whole series of resources for customers. We mentioned the Six Steps for Developing a Sustainable IT Strategy workbook. But we also have specific white papers as well on software efficiency, data efficiency, energy efficiency, equipment efficiency, and resource efficiency.

We make those freely available on HPE’s website. So, use the resources that exist, partner with vendors that have core capability and core expertise across all of these areas of efficiency, and spend a fair amount of time in the development process trying to ensure that that ROI both financially and from a sustainability perspective are as positive as possible when implementing these solutions.

Gardner: I’m afraid we’ll have to leave it there. We’ve been exploring how AI deployments will demand vast resources -- energy, water, skills, and upgraded or wholly new data center and electrical grid infrastructures.

And we’ve learned that not only by calculating the true and total expected costs in the fullest sense can businesses predict the proper fit-for-purpose use in deployments of AI but doing it in a most efficient manner might be the only way to go about successful AI deployments.

And so, please join me in thanking our guest, John Frey, Director and Chief Technologist for Sustainable Transformation at HPE. Thank you so much, John.

Frey: Thank you for letting me come on and share this expertise.

Gardner: You bet. And thanks as well to our audience for joining this sponsored BriefingsDirect discussion on the best path to sustainable AI.

I’m Dana Gardner, Principal Analyst at Interarbor Solutions, your host for this ongoing series of HPE-sponsored discussions. Thanks again for listening. Please pass this along to your IT community and do come back next time.

Listen to the podcast. Subscribe to the podcast. Download the transcript. Sponsor: Hewlett Packard Enterprise.

Transcript of a discussion on how energy use and resources management have emerged as key ingredients of artificial intelligence adoption success -- or failure. Copyright Interarbor Solutions, LLC, 2005-2024. All rights reserved.

How a Minnesota Law Firm Brings Mission Critical Security to Myriad Mobile Devices

2024-02-12T12:48:00.006-05:00

Transcript of a discussion on how a privacy-sensitive law firm puts the power of diverse mobility to widespread use while keeping confidential and regulated data under strict control.

Listen to the podcast. Find it on iTunes. Download the transcript. Sponsor: Bitdefender.

Dana Gardner: Welcome to the next edition of the BriefingsDirect podcast series. I’m Dana Gardner, Principal Analyst at Interarbor Solutions, your host and moderator.

Gardner

Today’s BriefingsDirect mobile devices security and privacy discussion examines how a new balance needs to be struck between giving users at the remote edge all the productivity they want, while protecting the most sensitive information.

Stay with us now as we learn how a Minnesota law firm puts the power of diverse mobility to widespread use and keeps confidential and regulated data under strict control. Here to share his story of how to guide small and medium-sized businesses (SMBs) to the edge and back safely is our guest.

Please join me in welcoming, Mark Hatfield, IT Director at Jeff Anderson & Associates, and IT Infrastructure and Security Consultant at Hatfield Engineering Corp., both in St. Paul, Minnesota. Welcome, Mark.

Mark Hatfield: Thank you. Glad to be here today.

Gardner: Mark, what are some of the major business and productivity trends that have pushed the demand for all kinds of mobile devices in the field?

Tame the Wild West of mixed devices

Hatfield: For the first time, we’re living in a world where both company data and documents are accessible from anywhere. Before, it was primarily email. Also, we’re seeing more and more mobile -- advanced mobile devices, such as the iPad Pro, capable of a lot more than your smartphones. We need to make sure that these mobile devices are as secure as possible.

Hatfield

In the past, what we had to secure them were mobile device management (MDM) solutions, but those are not security solutions by themselves. They did have some basic security settings, but what was missing from these new endpoints in their advanced state -- accessing sensitive corporate data -- was that we didn’t have a full-blown security client such as Bitdefender, which we now have on our workstations, servers, and laptops, all reporting back to me in real time what’s happening.

Gardner: In order for the productivity to take place and for the security to be accommodated, have you had to do some jerry-rigging or, are these off-the-shelf solutions? How do you even approach a solution at the edge such as you’re describing?

Hatfield: Well, if you take a look at the world of MDM, it’s very much a roll-your-own solution. I mean that in the broadest sense. So, you try to put controls on there and you try to say, “Hey, your phone has to be up to date. You have to have a passcode to unlock it. If it’s jailbroken or hacked, we’re not going to allow it.” You can even do things and say, “Well, since we only have iPhones, we’re only going to allow iPhones to connect.”

That’s all well and good, but that does not stop, for example, malware. It doesn’t give you the capability to filter the content in the web filtering, and it certainly doesn’t give you the visibility to view inside of the web traffic that the users are browsing to on these mobile devices.

Gardner: So, you start out with the Wild West, but you have to bring it under law and order. Let’s learn why that’s so important. Tell us about Jeff Anderson & Associates and why it is so important that the privacy and management of this critical data is controlled, managed, and secured.

Hatfield: Jeff Anderson is the premier law firm in the United States for survivors of sexual abuse. Jeff Anderson is one of the key pioneers in the field. For the survivors that we represent, that data is extremely confidential and sensitive both from a personal and a legal standpoint.

In the past, you would have individuals accessing just email, but now we have people that need to access sensitive legal documents from their mobile devices. I needed to add an extra layer of security.

As I mentioned before, in the past, you would have individuals accessing just email, but now we have people that need to access sensitive legal documents from their mobile devices. I needed to add an extra layer of security that MDM was missing.

Gardner: And, of course, these are law firms, so there’s active discovery going on. They’re out in the field, they’re interviewing people, they’re taking pictures of evidence. There’s myriad types of media modes and structured and unstructured data. This is no small task -- to give them safely the full purview of what they want to do their jobs.

Confidential in the cloud

Hatfield: Also, since we’re shifting everything to the cloud, it means that all of our legal documents are available in the cloud.

Literally, if we allow it, a mobile device can access any of our legal documents from anywhere. It would be disastrous for an unauthorized individual to gain access to those legal documents, both from a personal traumatic point of view for the survivors and also from a legal point of view. We are required to keep those documents safe. They contain sensitive information we need to keep secure.

Gardner: And as you mentioned, a lot of this is going up to the cloud, so we’re hop, skipping and jumping over various networks. And so, the in between, the edge, and the cloud all need to be considered as well.

Hatfield: That’s the other thing that’s changed, too. In the past, you had users that were going to access more sensitive corporate data such as documents and applications. They were required to connect to our private, secured corporate Wi-Fi. But now, with the mobile devices, they’re out everywhere. They’re in a coffee shop where there’s public Wi-Fi.

We don’t get to control where these mobile edge devices connect from, so we have to make sure that even if they’re connected to a public Wi-Fi spot and making it all the way back to our cloud to access sensitive documents, that they remain secure all the way there and all the way back.

Also, we need to make sure that those phones are free from infection. There could literally be something on the phone that’s snooping on what the end user is looking at on those mobile devices.

Gardner: Right. While we’re using Jeff Anderson and Associates as our use case today, and we’ll be digging more into how that solution came about, this applies to lots of other SMBs, enterprises, or even departments or divisions within enterprises.

As a consultant, are you seeing these demands across the board -- or only in a handful of industries? Other than Jeff Anderson & Associates, where are the use cases in verticals that this demand for mobile security is cropping up?

Hatfield: I also consult for Baldwin Supply in Minneapolis. They supply industrial parts. They do customized conveyor belts for large agricultural, industrial applications. They don’t have legal documents that users out in the field need to access, but they need to access their main company applications that have sensitive information such as sales figures and customer data.

Companies need to access their main company applications out in the world. They need to be able to access data anywhere -- all through their mobile devices. And that information has to be kept secure.

They need to be out in the world as a field representative. When they’re in a factory, they need to be able to access that data anywhere, and they need to be able to add data, and even get the client an “on-site,” all through their mobile device. Maybe it’s not the same level of sensitivity and security that a law firm requires, but that information still has to be kept secure.

Gardner: I imagine that the mobile edge is pervasive across almost all business now. There’s not too many that wouldn’t want to have the capability to do mobile device security and compliance in the best way possible.

Hatfield: Yes. It used to be for you to get that kind of access on a mobile device, you had to do some type of expensive third-party implementation. For example, Microsoft 365, out of the box even for a small business, they give you access to Word, Excel, SharePoint, OneDrive, not just Outlook accessing your email. So, every single business is going to get that access and regardless of what business you’re in, you still want to keep your data secure.

BYOD means keeping work data separate

Gardner: Now, it wasn’t that long ago when people had to decide: Do we allow Bring Your Own Device, (BYOD) or not? It seems to me that we don’t even concern ourselves anymore whether it’s your device or their device as long as it’s a device. So, we have to secure all the devices, not just a handful of certain standardized ones, for example.

Hatfield: Correct. That obviously makes it more complicated. In the world of MDM, you basically end up creating two basic scenarios: One for the corporate-owned devices, the other one for BYOD.

The BYOD devices, I’m not concerned about their personal information, but any apps that I deployed to them that are corporate apps that access corporate data, I need to ensure that piece of it on the BYOD device is secure. Also, if need be, we need to be able to wipe that piece of the data off of their device without touching the rest of the data on the device.

With a corporate device, we can just say erase the whole thing if we need to. We don’t want to erase people’s photos of their children and things like that. They would get really upset. It’s not really within our purview to do that. But, we do need to keep that corporate data separate and secure and make sure we have the capability to delete it if necessary.

Gardner: Best practices for security always include onboarding and offboarding people properly That’s also probably more complex on the device edge.

Hatfield: Yes, it is. If you spend a lot of time properly implementing an MDM solution, you can automate a lot of that with the two different scenarios. It’s no easy task. Once you get it all working, it’s really great.

I’m going to take that same approach with the Bitdefender Mobile. Meaning, just like at on premise, I have different policies for laptops versus workstations versus servers. I’m going to end up with customized policies. One that applies to corporate MDM devices and another policy that applies to BYOD devices at a high level.

We’ll probably need to break that down a little bit between Android and Apple, right? The differences are a little bit more subtle, but at the high level, I’m going to end up with two policies that are very dialed-in to provide the needed security while also allowing the user to properly use their device.

Gardner: Let’s dig into the Jeff Anderson & Associates use case a bit more. Tell us how you developed your security posture at the mobile edge and how you brought it to full execution in this particular organization?

Hatfield: Typically, in the past, we had just put email on people’s mobile devices, and we’ve always had a mix of corporate-owned and BYOD. So that’s where we started, where many people did, and then we added MDM Then we started giving them access to more things such as Word and Excel, so they could open up attachments.

As we shifted our documents to the cloud, Microsoft was providing a SharePoint client for your mobile devices. But I said "We need more here."

But then, as we shifted our documents to the cloud, Microsoft was providing a SharePoint client for your mobile device, and the end user could access all that data. At that point, I said, “We need more here.” In my mind, these MDMs have almost become full-fledged user endpoints like a laptop. They can access the same data, they can perform the same functionality, but what are they missing?

They don’t have a security client like Bitdefender, right? We managed our on-premises devices with a group policy and we managed our mobile devices with MDM. I don’t just rely on group policy to secure my endpoints on-premises, I also have to have that security client. I take that same philosophy and extend it out to the mobile devices because, if you take a look at the iPad Pro, it is essentially a laptop.

Gardner: It’s a fat client for sure, right? That’s not a thin client, that’s a fat client.

Hatfield: Right. It can do everything the laptop can do.

Gardner: Yes. And one of the ways to protect a laptop would be to make it a virtual client at the edge. Everything is really just going back to the cloud. Is that the solution for mobile devices, too?

Hatfield: No. I used to do a ton of remote desktop. On-premises, it works extremely well. If you’re going to say, for example, I’m going to create a whole virtual desktop that’s either hosted in the cloud or on-premises for an end user, how well that performs is based on how good their connectivity speed is, and the latency. You could control that on-premises or on your corporate controlled Wi-Fi. But when end users are wherever, the problem is no one knows what the quality of their connection is going to be.

Yes, it’s enough to surf the internet and get email, but if they’re trying to access an entire virtual desktop in the cloud or even one that’s hosted on-premises, they’re not going to have a good experience. I very much have shifted to that we’re focused on the clients or on the endpoints, but all the data is in the cloud.

Also more and more, we’re seeing where Microsoft and others are starting to shift the actual client to a web browser. So, it doesn’t make as much sense as it used to, to create a virtual desktop if the users are accessing most of their apps in a web browser, and that’s all optimized.

Gardner: You find yourself wanting more security for more types of apps and uses at the edge, you didn’t know of anything off-the-shelf you could easily drop in. You had to do some customization. Tell us about that mobile security pilot, or proof of concept journey, and where you are with it right now.

Secure success on all endpoints

Hatfield: The mobile device solution that we utilize is Microsoft Intune. We’re very heavy into Office 365. It seemed like a natural fit, for the integration. Then, we were looking for an additional security client that can handle malware and those types of scenarios. I was very intrigued by Bitdefender. If you have Intune, the Bitdefender technology and security client that gets installed on the mobile device endpoint adds even more functionality. It ties into Intune.

I’m kind of marrying the two worlds together. In addition to that, I’ve been extremely impressed with Bitdefender for all of our other needs -- our servers, our workstations, and laptops. They’ve been extremely helpful. They’ve kept us extremely safe. The other thing that differentiates Bitdefender from many of the vendors I’ve worked with, is that they listen to your suggestions and they actually act on them.

I view it as a partnership that has worked out fantastic for doing all of our traditional endpoints. Now I’m looking to add that to the mobile device, plus, it’s going to integrate with our MDM solution bringing us even more power.

Gardner: How does that remote agent on the mobile device process work? Are you in control of that? Do you feel like the user experience is okay? Are they oblivious to it? Is there any degradation of functionality at the edge when you deploy and use an agent like that for security and management?

Hatfield: That’s where the testing comes in. Anytime you’re going to deploy something new, you have to start with some test devices and really, really fine tune it because you cannot inconvenience the user much. You can’t slow down their performance. They’re basically not going to tolerate it. They’ll go to upper management. Upper management isn’t going to tolerate it. They’ll say, “Hey, security is nice, but if we can’t do our job, then security doesn’t mean anything.”

Anytime you deploy something new, you have to start with test devices and really fine tune it. But you cannot inconvenience the user or slow them down. They won't tolerate it.

They have a good point. So, if you do all of your fine tuning and you make it as secure as possible while at the same time making it so the user almost doesn’t even notice, then your acceptance from the users is going to be much better than if you try to force something on them that’s inconvenient and that gives them a negative performance experience.

Gardner: When you’ve crossed that hurdle and you have a good agent that’s helping you with security, you’re going to deliver that analysis and data somewhere. Have you started using any security operations centers (SOCs) in the cloud or other services so that you can automate or at least streamline the process of analyzing and getting any threat reports in as near real time as possible?

Keeping track of all the data

Hatfield: Bitdefender recently added Endpoint Detection and Response (EDR), to their product line and that is pulling lots of extra data from the client and compiling it and making it easy to look at.

It not only understands what’s going on in the endpoint, but they also have call agents that reach into Office 365 so it knows about Azure authentication, it knows about SharePoint and OneDrive documents. And it’s compiling all of that for us so that if there is something to look at, it’s very, very easy in that reporting center to dial in to what you want it to see, complete with graphs and flows.

Let’s say there is something that maybe caught your eye and didn’t look right. I cannot just click on it and say, “Well, scan it. Is it a virus or not?” I can actually go in because of EDR and I can see, “Oh, this application talked to this, and it went up to this web site. Yes, it’s okay, it’s valid, I can whitelist it right now.”

I’m not going to get that alert anymore. Without that EDR component, we would have had to dig through logs for hours and hours, if we could have found the time to do that.

I was very happy to learn that the EDR component in Bitdefender will be available to extend the mobile device endpoints. I’m thinking that that EDR component is going to also be tying into Intune and feeding it more data.

We also do quite a bit of security in Microsoft’s own realm in the Azure cloud. You’re marrying it all together so that all of your data is coming together in an interface where it’s very easy for you to clearly see what is happening.

Gardner: That ease of security management, if you will, is super important in the SMBs, because more often than not in those organizations, the IT director is also the security chief. And that’s the case with you as well.

How important is it for you to be able to get what you need quickly and easily, with as much automation and streamlining as possible?

Hatfield: It’s extremely important. Yes, I’m the IT Director, I’m the head of security. I was a security auditor as a consultant for years before that. I was also a Microsoft Certified Systems Engineer, so I do a lot of the 365 engineering. I wear a lot of hats. We don’t have a lot of time.

The technology keeps getting more and more complex and coming at us faster and faster, and the users’ expectations keep growing too, as they’re handed this new technology. So, there’s no way that we could investigate and feel as secure as we do without that type of EDR solution in place.

Gardner: Let’s go back and revisit the experiences of those folks at Jeff Anderson & Associates -- super sensitive information, all sorts of in-the-field activities probably often in a courtroom setting where time is of the essence when you’re doing discovery of reaction to witnesses or other reports. What’s been the result? How have you been able to quantify or qualify your capability to secure that edge and give them the productivity and security and compliance and privacy that they want?

Secure documents in the courtroom

Hatfield: So far, it’s worked out really well. We’ve added a whole other layer of security. I worked very hard to make sure that the settings that we were applying were not hindering their performance in a noticeable fashion. Perhaps we did have to “bother the user” for a minute just to get it set up initially and make sure it was working. But since then, we haven’t had to bother them at all.

Wi-Fi is available everywhere, even in the courtroom. If the lawyers need a document in our cloud, they are accessing it on an iPad, or a phone in a pinch. They have to have access to that document.

Wi-Fi is available everywhere, even the courtroom. If they don’t have a document that they copied to their laptop locally or they need an additional document. It’s in our cloud, whether they’re accessing that on an iPad, or even on a phone in a pinch, they have access to that document. So, I think it’s worked out very well.

Gardner: Do you have any metrics or key performance indicators (KPIs) that are important for you to measure how you’re doing your job or how your suppliers are performing their jobs? What do you look for when you say, “I’m getting my money’s worth here?”

Hatfield: The first thing is we’re not getting any infections. Secondly, it tells you what it’s blocking, too. When we go up there, I don’t have anything new whitelisted when I roll it out.

I’m seeing everything that it blocks and looks at. So, those are kind of my metrics -- is it looking at everything? Is it reading inside of the HTTPS web surfing that the end users are doing? Check, it does that.

Is it looking at when a user pulls a document down from SharePoint? Is it scanning it for anti-malware? Yes, it is. On the EDR side, is it looking at things such as a user who is pulling down thousands of documents, which would be out of place for a mobile device, and that sets off an alert? I’ll even do scenarios that maybe a common attacker would use to see that I get those alerts. Those are the metrics I use.

Gardner: It’s also important for SMBs where there’s a jack of all IT trades such as yourself that you’re getting support and the sense of partnership from the supplier. Has Bitdefender been a good fit in that regard?

Bitdefender: Partner in problem solving

Hatfield: They’ve been amazing. It’s an unfortunate trend in our industry where you see company consolidation and they’ve taken a hatchet to the support staff. They’ve outsourced a lot of it. So, support is not immediately available. You’re starting with somebody that’s too low-level for the problem you’re working on -- and a lot of times they’re almost no help at all.

That is not the experience with Bitdefender. They will either immediately or very quickly get you to the person you need that can help you solve the problem. They are real engineers that understand the product and you can go through it with them.

There’s been a few rare situations where they’ve remarked, “Wow, you’ve stumbled onto a scenario here where there might be a bug.” They’ll actually bring it to development to have them confirm it. I’ve had one or two situations where they did confirm and then they provided an immediate fix, and the turnaround time was days. That doesn’t happen with any other companies I have worked with, and I have worked with just about all of them.

Gardner: Let’s look to the future. Mark, what would you like to see happening on the mobile security front over the next few years? Do you have any ideals in terms of the service, the variety of coverage, the amount of automation or even intelligence brought to bear? What would you like to see in your wish list for the future on the mobile edge?

Hatfield: On the mobile edge, of course, I want to see all aspects of it covered. But what I think you’re going to need to have it do too is artificial intelligence (AI), where because of EDR, it is pulling an immense amount of detailed information from the mobile devices and your other endpoints about the applications and which executable talks to which web site, and it’s analyzing the entire behavior set.

But I don’t have time to look through all of that. So, you’re going to need something that can, in an intelligent fashion, look at that gigantic amount of data and come to some conclusions.

If the good actors are relying on AI to help increase safety and productivity, unfortunately the malicious actors are going to be using AI for nefarious purposes, too. It's going to take a new level of sophistication to keep us safe in the future.

Initially, it would be alerts sent to you, but what I want to see is if scenario A, B, or C happens, it can go ahead and disable the user’s account automatically. Some of this is available in parts of Bitdefender, where you can configure it to take automated actions on your behalf. I don’t have to get a notification; I don’t have to look at it because I’m not going to have time.

If the good actors are relying on AI to help increase safety and productivity, unfortunately the malicious actors are going to be using AI for nefarious purposes, too. Without that automation piece and without it being intelligent, and without its capability to take actions on your behalf when needed, you will not have time to respond. It’s going to take that level of sophistication to keep us safe in the future.

Gardner: I’m afraid we’ll have to leave it there. You’ve been listening to a sponsored BriefingsDirect discussion on how a new balance is being struck between giving users at the remote edge all the productivity they want while protecting the most sensitive information.

And we’ve learned how the power of diverse mobility can boost innovation and productivity while keeping confidential and regulated data under strict control.

So join me now in thanking our guest, Mark Hatfield, IT Director at Jeff Anderson & Associates, and IT Infrastructure and Security Consultant at Hatfield Engineering Corp., both in St. Paul, Minnesota. Thank you so much, Mark.

Hatfield: Thank you. It was great to be here.

And a big thank you as well to our audience for joining. Pass this on to your IT and security communities, and do come back next time.

Listen to the podcast. Find it on iTunes. Download the transcript. Sponsor: Bitdefender.

Transcript of a discussion on how a privacy-sensitive law firm puts the power of diverse mobility to widespread use while keeping confidential and regulated data under strict control. Copyright Interarbor Solutions, LLC, 2005-2024. All rights reserved.

How IT Security Teams Do More With Less When Economies Rapidly Change

2024-01-18T13:03:00.006-05:00

Transcript of a discussion on how a large, distributed workforce can be best supported by IT -- even as conditions change and budget requirements lead to consolidation.

Listen to the podcast. Find it on iTunes. Download the transcript. Sponsor: Bitdefender.

Dana Gardner: Welcome to the next edition of the BriefingsDirect podcast series. I’m Dana Gardner, Principal Analyst at Interarbor Solutions, your host and moderator.

Gardner

Today’s BriefingsDirect IT security best practices discussion examines how a leading German home builder has adjusted to a major economic market disruption. While not long ago surging, Germany’s home building demand has recently reversed, putting pressure on builders to reduce IT costs while remaining secure.

Stay with us now as we learn how a large, distributed workforce can be best supported by IT even as conditions change, and budget requirements lead to consolidation.

Here to share his story of how an efficient security team rapidly shifts from managing surging growth to optimizing around necessary contraction is our guest, Johannes Hammen, Information Security Officer at DFH Gruppe in Simmern, Rheinland-Pfalz, Germany. Welcome Johannes.

Johannes Hammen: Hello, thanks for having me here.

Gardner: DFH Gruppe is a major maker of prefab homes. How has the market contraction in the real estate construction business there changed your business?

Hammen: DFH Gruppe is the largest maker of prefab houses in Germany. In 2021, we created more than 3,200 houses. We have more than 1,300 employees in Germany and the Czech Republic who help us build houses.

Hammen

We had quite a high level of throughput. But as you may have learned from the news, there were changes in the past months that triggered changes inside our company. From our customers’ perspective, to get a mortgage for a house, there’s an increase in the requirements, such as higher equity, higher interest rates, and fewer subsidies by the state. On the other hand, material costs were rising, and the politics were shifting toward multi-family housing.

So, this changed a lot for us. We had to react. We had many years of with very high growth, up to a rate of 3,200 houses per year. But we needed to consolidate and adapt to the new situation. Of course, this also affects IT and security spending.

Gardner: How has your business and IT adjusted to the need for doing more with less?

Take advantage of downturns to adjust

Hammen: During a period of very high growth, there were other priorities than security and structuring processes in such a way that they are very efficient and very stable. You have to keep pace with the throughput in the company and you have to implement systems and fix issues so that new houses can be constructed.

Now, we have an opportunity to do consolidation, to breathe again, and take a step back. We can look at our processes, increase the efficiency, and implement new tools, which we did not have time to do before.

Gardner: Many times, in the past when we’ve had disruptions either from growth or rapid changes or interaction, we try to work smart and use some technology to its best advantage.

How have you been able to do that, given you have a large, distributed workforce in the field. You work with many partners, and you have a large supply chain?

Hammen: As you said, we have quite a distributed workforce. We are focused on the German market, but that doesn’t mean that we are doing everything in-house. You can imagine that to design and construct a house is quite a large process that needs to involve a lot of experts.

For example, we have more than 650 sales contractors spread across Germany, who are working independently. They guide our customers in the process of buying and building a home.

We need to coordinate and manage all of these contract partners across the whole process. Every external partner has different rules, policies, mindsets, and backgrounds. It's really hard to keep everyone on the same page.

We also have many different types of skilled handymen who construct houses. We have more than 260 partners of all sizes, from small companies, with two or three handymen and someone in the back office, to very large companies with 500 to 1,000 employees who support us on different steps in the house-building process -- such as heating, electricity, and so on.

We need to coordinate and manage all of these contract partners across the whole process. Every external partner has different rules, different policies, a different mindset, and a different background. So, it’s really hard to keep everyone on the same page, especially with respect to security.

Gardner: It sounds as though there’s a great diversity, particularly among the types of IT, as well as the workforce style and culture. That means that you’re the hub on a multi-spoked wheel. How can you impose security without alienating or slowing people down? That must be a difficult balance.

Hammen: It is. We try to consider everyone’s needs and requirements in the whole process. Also, we see it more as an opportunity for everyone, not as a slow-down mechanism as some people view it.

Security is a door opener for so much process optimization and so many innovative ideas. If, for example, you try to implement security in part of a process, you have the chance to remodel the process to be more efficient in general -- or to create a new business model out of it.

This is the story that we want to tell everyone. We try to not spend too much time on the complicated things, and to hide those things from our users and our partners. We want to build a platform, a solution that everyone can use.

Why should a sales expert, for example, have to think about IT security topics? We in IT just implement a solution and provide it as a service to our internal customers and to our employees. It’s a good tradeoff between having a high level of security and also not slowing down the business.

Gardner: You are re-engineering processes by taking advantage of technology. What was it about the technology you were using before that made it difficult to achieve your goals?

Hammen: Everyone knows that there have been lot of huge technology advancements in the past months and years regarding artificial intelligence (AI) and all that. But even before that, our focus during our high-growth phase was not on security; not on getting the latest, most innovative technology. We had just enough security and IT infrastructure that was working fine and was fulfilling the needs of the business.

But in the last one to two years, we looked to the IT and security vendors for new concepts. There were a lot of transformations, especially with respect to security, such as getting to zero trust, for example. This is quite a new concept and we needed to rethink a lot of our past decisions.

Gardner: Part of the ability to control security means getting more data about systems, which you can also use to then be more productive. Is your IT organization using security improvements as an accelerator to better productivity overall?

Collecting security data is good business

Hammen: We are currently working on this and on getting transparency for this larger aspect of security. What we have achieved already is that security is a good vehicle to transport the key performance indicator (KPI) approach into other departments and areas of the company.

In security, and also in IT, we try to measure everything. We try to measure up-time, we try to measure incidents, and so on. You can transform or adapt these concepts to more business-related processes.

I think this is a huge advantage that we are currently trying to transport and market to our colleagues. We have seen this in software development, but in IT in general, some concepts such as how to do projects, how to achieve high quality in very complex environments -- these are very good concepts in IT that we can adapt to business.

Gardner: Yes. The productivity isn’t just about technology and IT productivity, but overall business productivity, which is so important when you’re trying to do more with less.

By being more data-driven and KPI-oriented, by measuring, testing, and verifying the results, what do you need to put in place to do that? How do you get the information and also protect it?

Hammen: It’s very important. We are implementing an information security management system (ISMS). The main concept of this system is that everything should be risk-oriented. And to measure for risk accurately, you need the data.

You need the performance indicators so that you can determine whether one risk is higher than another, or to know the trends and direction of risks. Let’s say 1,000 incidents happened, but in the other one, only 20 have happened. This is why we need the data.

We have used a lot of tools that were doing the job, but they came from an earlier age of IT. The KPI-driven approach had not yet been implemented. It was hard to get the data.

We have used a lot of tools that were doing the job quite well, but they came from an earlier age of IT. This performance indicator or KPI-driven approach had not been implemented. So, it was very hard to get any data out of it in an aggregated way.

Currently, for all new solutions and concepts that we are implementing, we are also considering what data can we get out of it and how can we use this data to drive further decisions.

Gardner: To make those prioritizations, you also need to become more predictive and be able to get out in front of these trends.

Have you been able to, in a sense, reduce the amount of time that it takes to react so that you’re not doing a backward-looking analysis, but doing forward-looking implementation of fixes and improvements?

Hammen: Yes. It is part of ISMS to also consolidate and streamline these processes. For example, in the past we were spending a lot of time on day-to-day activities, such as rolling out an endpoint security solution or rolling out an update of an endpoint security solution to a client.

This was using up a lot of our time in IT. After streamlining all of these very basic tasks, it shouldn’t require an investment of more than a few minutes, in my opinion. Streamlining all of these tasks creates a lot of new time in the budget that we can implement in looking for new solutions, looking for optimizations for already-existing products, looking for integrations between products that we already have, and between processes that we already have. Currently, this is our main focus.

Gardner: When you have a limited budget for new hiring -- and skills are hard to come by in the best of times -- you want to look to the technology to take the repetitive tasks away from the people so that they can focus more on the analytics, on the innovation, on the business-level productivity.

Do you see in the use of security technology now that capability to offload some tasks and free up human capital to do what it does best?

Hammen: Yes. Based on AI, there are a lot of tasks that we can shift toward automation or to automate in some way. Another example is if you take an average endpoint security solution from today, every solution has a cloud sandbox or something like it, with automatic execution and analysis of a suspicious file.

In the past, one expert from our company or from a contractor had to invest the time to analyze this suspicious file to be sure that it is not harmful. Now it’s just happening in the background. At some time you get the feedback on how it’s malicious or not and that’s all.

But you save a lot of time and money by automating this stuff now and even more in the future. There are a lot of other topics, such as network detection response and so on, which is just building. It’s only the start of what we can do with security automation. Also, it’s not only that we do not have the personnel anymore, but also, we want to have high quality results at the end.

Gardner: Going back to the fact that you have a large, distributed workforce, they’re out at these sites putting these homes together. They’re organizing with many contractors from many different destinations. If you can make their jobs easier, they’re of course going to be happy to work with you and adopt your approaches. Security can be seen not as, “Oh, we have to go through these arduous tasks in order to be secure,” but that in fact you’re helping them.

Do you find that the user buy-in is shifting? Are you getting a sense that when you do this well, when security becomes an accelerator to productivity, and that you get people’s cooperation and even eagerness to adopt your tools and processes?

Security is much more than passwords

Hammen: Yes. We have one advantage now that we didn’t have, maybe three or five years ago, because a lot of people are used to some security measures, such as multifactor authentication. Everyone knows this from their personal accounts at online shops, at different vendors and so on.

So, there is some base work that has already been done in the consumer market. I think a lot of companies were affected by cyber attacks that caused business disruptions. A lot of people were also feeling the result of not investing in security, not collaborating with security.

A lot of companies were affected by cyber attacks that caused business disruptions. A lot of people were feeling the result of not investing in security, of not collaborating with security.

That’s a good starting point. Also, we have to get this distributed workforce, with very different levels of understanding and backgrounds regarding IT and security, invested in this topic and also have them participate. But on the other hand, my colleagues and I also have to make sure that we take their opinions and their special needs into consideration in all of our decisions.

We cannot consider every requirement, of course. Some people just want to make it easy, easy, so no password, nothing. We still have to try to consider that different people use different mechanics or have different working habits.

Gardner: We’ve been putting this just through the lens of security, but there’s also requirements for compliance, privacy, documentation, auditing, etc. General Data Protection Regulation (GDPR), of course, comes to mind.

We all have to do things that we might think are difficult or put more of a burden on people. Have you able to bring this sense of productivity, automation, and intelligence to your requirements around compliance as well?

Hammen: On the one hand, it’s easier to show others that you are being compliant if you get all the metrics out of the software. If you have transparency in the technical and business processes, then you can easily show everyone who is interested.

We can show what we are doing. With respect to this documentation, every worker understands what we are doing and whether it’s compliant or not. I think in the past, it was more like a black box. So, I think this is a very good thing in the end.

Gardner: It sounds like there’s a multiplier effect. If you do the due diligence for security, then you get the means to adhere to the compliance requirements, which then leads you to be able to further automate and take the load off of the humans, which then leads back to more technology.

Is there an adoption virtuous cycle? Is that something you’re already seeing?

Hammen: Yes, and this is also what we try to enforce. If this positive cycle is started, it’s easy to keep it alive and keep it running. This is what we try to achieve.

Gardner: In order to get that cycle ramped up, you want to have proof points and metrics. So, are there any ways that you measure how you’re improving security and therefore also improving business productivity that will cut costs and improve and optimize the business results? Any measurements or examples that you can provide how this is helping your organization?

The proof is in the productivity

Hammen: We do not have absolute numbers that we can share. But there are a lot of what I call soft metrics, gathered from different conversations with colleagues.

For example, we are doing the total risk management process being part of an ISMS and, in this whole process, there are a lot of results coming out that at least have the possibility to help the business to run more efficiently, the chance to do more with less.

Currently, we are trying to measure it and also build up a KPI framework for measuring all of these things. But it’s very, very complex, especially when you have a distributed company and workforce.

Gardner: Are there any what we would call low-lying fruit indicators, perhaps a number of calls to your help desk, trouble tickets, less time on security administration, anything like that that you can point to and say, “Aha, we are getting payback on our investments, and we are achieving higher productivity while remaining secure”?

Hammen: Yes, there’s two KPIs I can share. One is our endpoint security solution that we switched to at the beginning of last year. With the new solution, we estimated that about 40 percent less time was spent on the security administration tasks such as this roll out, the patch management of this solution and so on.

Two, there’s been around 90 percent fewer security-related trouble inquiries since we have implemented this solution, because now we have one dashboard. It’s very easy for us to react to false positives if there are any and drag them down and do the follow-up steps to clean them up and not trigger them again in the future.

Gardner: Johannes, how in the future do you expect to be able to further this analysis, this positive feedback improvement cycle?

Do you think that having more analytics in the cloud, and using outside suppliers as a security operations center (SOC), is in the works? What do you foresee in the next three to five years regarding how security can continue to be an accelerant to productivity?

Hammen: One thing that we need to consider is it’s still quite hard to get skilled IT and security personnel.

If you are a security expert, you probably want to work for the very large companies with large SOCs, and maybe not for a construction company. There is very high level of competition in the job market.

In the next years, in order to achieve a higher-level of security while also maintaining this current level of security, we need to focus on what we can do with the workforce that we have, with our partner network, and with our internal colleagues. We need to get the best out of what we can do from the inside and also from well-thought-through outsourcing.

Using a managed detection and response (MDR) service or a managed SOC ... This is something a lot of companies still need to adapt to. ... You need to open up to these new concepts.

As you mentioned, for example, using a managed detection and response (MDR) service or a managed SOC. So, everything that you can’t do perfectly in-house because you don’t have the resources, or the workforce, you can outsource, but control it well and have good visibility into it.

This is something a lot of companies still need to adapt to. Yet some of the companies we work with have been very, let’s say, on-premises and very protective. But they have to open up.

A lot of vendors are driving toward cloud and cloud-only, of course. As a company, you need to open up to these new concepts, for new collaboration between your internal workforce or internal experts, and also to the external experts for specific topics, such as the SOC.

Gardner: That changes the nature of your supplier from vendor to services partner, right?

Hammen: Correct, long-term partner.

Gardner: I’m afraid we’ll have to leave it there. You’ve been listening to a sponsored BriefingsDirect discussion on how a leading German homebuilder has adjusted to a major economic market disruption.

And we’ve learned how an efficient IT security team can rapidly shift for managing surging growth to optimizing around necessary contraction, but at higher productivity.

So, please join me now in thanking our guest, Johannes Hammen, Information Security Officer at DFH Gruppe in Simmern, Rheinland-Pfalz, Germany. Thank you so much.

Hammen: Thank you.

And a big thank you as well to our audience for joining. Pass this on to your IT and security communities, and do come back next time.

Listen to the podcast. Find it on iTunes. Download the transcript. Sponsor: Bitdefender.

Transcript of a discussion on how a large, distributed workforce can be best supported by IT -- even as conditions change, and budget requirements lead to consolidation. Copyright Interarbor Solutions, LLC, 2005-2024. All rights reserved.

How Accounts Payable Automation and Agility Drive Long-Term Business Productivity

2023-11-13T14:07:00.008-05:00

Transcript of a discussion on why business leaders need to prepare now to optimize and automate accounts payable functions to elevate overall financial situational awareness.

Listen to the podcast. Find it on iTunes. Download the transcript. Sponsor: Basware.

Dana Gardner: Welcome to the next edition of the BriefingsDirect podcast series. I’m Dana Gardner, Principal Analyst at Interarbor Solutions, your host and moderator.

Gardner

Today’s discussion focuses on how optimizing and automating accounts payable (AP) functions gives businesses the insights and levers to better transform. We’ll examine how improved control and management over cash flow, payables, and related fiduciary functions elevate overall financial situational awareness.

Stay with us now as we explore how adoption of intelligent automation joins the expected consolidation and convergence of financial operations and applications in the office of the Chief Financial Officer (CFO).

Soon, we may well see more shifts in the required skills and streamlined organization within financial operations at companies. So, leaders need to prepare now.

Here to share his insights as a business operations efficiency veteran and expert is our guest, Jason Kurtz, Chief Executive Officer (CEO) at Basware. Welcome, Jason.

Jason Kurtz: Glad to be here. Thanks for having me.

Gardner: Jason, before we begin, let’s put some context around our discussion. What are some of the major trends shaping the need for better accounts payable automation, and why is there an imperative to add intelligence and automation to overall back-office business operations?

Global change: Taking it all into account

Kurtz: The imperative is we’re dealing in truly unchartered waters here for a lot of CFOs. If you think about what’s going on in our world, if you think about the macro-environment, we have potential recessions in some areas of the world. We have higher inflation rates, higher interest rates, and all that affects us in our businesses in various ways. If you think about supply chains, for example, we still -- believe it or not -- haven’t fully recovered from supply-chain disruptions from the pandemic.

Kurtz

These trends impact CFOs, and what’s going on in our world. We still have people working in hybrid or remote environments. We still have companies that can’t fill the jobs they have open, including in AP. Then we also have countries such as France, Germany, Poland, and Spain that are adding regulatory requirements for how you should send and receive an invoice. Countries like Mexico and Brazil are changing their regulations on a regular basis.

Never before have we seen so many things impacting CFOs at the same time. You think about people like me, I’m in my mid-50s, I’ve never worked in an environment where there’s a recession plus high interest rates, plus inflation. You throw that in, and we’ve never seen this before. For many of us in these roles, it’s a unique time in history -- and in our careers -- that we’re dealing with so many challenges at once.

Gardner: Because there’s so much that’s unprecedented happening at once, it’s hard to look at the historic record and say, “Okay, I know what’s going to happen next.” There’s very little clear visibility as to what we’re going to be dealing with in terms of our top-line and needed constraints on spending over the next six to 12 months.

Kurtz: That’s 100 percent right. We are living with uncertainty right now. Few companies have great data and information to help them navigate such uncertainty. But one of the key documents, key pieces of information and data, is the invoice. If you can get that right, and gather great data from your invoices, man, that makes your job as a CFO a lot easier.

Gardner: To get that look at the full record and all of the data, that usually means more intelligence and automation around vital business processes. So, on the micro-level, what are the challenges facing businesses to gain more tactical and strategic control over their finance operations?

Kurtz: There are some really interesting challenges that you wouldn’t believe are still challenges. For a lot of businesses, we want to improve profitability in uncertain times. We want to unlock working capital. What’s one of the biggest barriers to that? Over 90 percent of companies say they can’t pay an invoice on time because they don’t have it approved in time.

You need automation and tools that can embed your policies and procedures into your workflow and your processes. You can't do that in a manual world. This is the reality for a lot of the companies we deal with.

Because they have bad data, because they haven’t enabled their suppliers, and because they’re often dealing with scanning and optical character recognition (OCR) documents of poor quality -- and it takes time to manage difficult exceptions – those are all critical hurdles. So, it’s important to solve these to unlock lots of hidden value.

Another challenge we talked about; companies don’t have a full staff in AP -- sometimes people are working remotely. How do you make sure those new people are trained, are more efficient, and effective? How do you know they’re following the policies and procedures for your company? How do you quality check the work they’re doing via remote work?

Because you want to do more with newer and fewer employees, you need automation and tools that can embed your policies and procedures into your workflow and your processes. You can’t do that in a manual world. So those are just a couple of examples, but this is the reality for a lot of the companies we deal with. From an AP perspective, they need improvements because these really are barriers to their success right now.

Gardner: Jason, both you and I have been in this business long enough to have seen wave upon wave of new technologies and approaches. And that was great, to use the best-of-breed solutions as they came online. But it has left many organizations with a scattered and disruptive mix of apps and silos that come from different eras.

Invoice intervention imperative

Kurtz: Yes, without question. We joke a lot about an earlier era of scanning paper docs using OCR, right? That’s just one example of what you’re talking about. For a lot of companies, scanning and OCR checked the box on adopting electronic invoicing. “We’ve done it.” But you and I know that that’s not really the case, right? You don’t get any good data out of that.

You have to have manual intervention. It slows your processes down. It’s like using a pay phone, right? Or a fax machine. And no one uses those anymore. But there are still lots of people who have that as their e-invoicing solution, which is crazy.

Keep up with global compliance requirements using this interactive map.

And, to your point, lots of companies have layered different technologies onto their environment over time. Maybe it was a procurement solution, or a sourcing solution, or their enterprise resource planning (ERP) suites, and they’re trying to figure out, at least in AP, “How do I make all of that work? My invoices come and originate in different places.”

They ask, “How do I put something on top of that that is modern, usable, and purpose-built for me in that kind of an environment that’s very fragmented and has lots of different offerings and capabilities?” They need something that sits on top of that to make it all more efficient and effective for the AP department. So, again, you hit the nail on the head. There’s a lot of complexity in the companies that we work with.

Gardner: Part of the good news, as you alluded to earlier, is that the modern invoice has a beneficial role to play. When you go fully digital, you can layer into that resource lots of metadata, you can bring added processes to bear, and you can use that asset as a powerful tool to usher in benefits across other applications, data, and processes. When you do this right, and you unlock the superpowers with your invoice workflows, how does that set off cascading benefits?

Invoice data insights reap rewards

Kurtz: One that we haven’t talked about yet, when you get that invoicing data right and you have good data from across your suppliers, that gives you aggregate insights into what you bought from whom, how much you paid, and what the commerce trends are. That gives you the basis for accurate spend analytics.

In the current uncertain macro-economic environment, we’re trying to save money and use that money to fund growth where we can find it, or put it away in the bank for profitability, then spend analytics is a great place to start to optimize, right? But you have to have that invoice data first to fully understand what it is you bought from whom, the pricing, and all the added details. So that’s one.

Two, the other part of the invoice data goodness, comes from unlocking working capital. Many companies now discount payment terms so the buyer receives a two percent discount on the net invoice amount if they pay within 10 days. Otherwise, the full invoice amount is due within 30 days. But, if they can’t pay something in 10 days, they can’t get the benefit.

But imagine if we could unlock literally billions of dollars in potential early-payment discounts or working-capital benefits that we could then use to invest in our growth or direct to areas where our acute business needs are. But, again, you must have a working invoice with good data, well-structured and in a timely manner, to be able to handle that management of working capital optimization. Yet, lots of companies still can’t do that.

I think those are a couple of examples where the modern invoice can unlock a lot of economic benefits for companies in these uncertain times.

Gardner: It has only gotten more important to best manage cash flow now that we’re up to five percent or more on overnight interest rates. The imperative to get fast and detailed cash flow data, and bring that organizational efficiency and agility to bear in real time, is higher than at any time in at least the last 15 years, right?

Kurtz: That’s 100 percent correct, and so intelligence is more valuable for us as an organization, and for our large customers. That’s because, in many cases, they have billions of dollars in spend, so that they can unlock millions – even hundreds of millions -- in working-capital dollars due to those higher interest rates.

Such intelligence is also important for our customers' suppliers because their cost of capital is going up, too. When supply chains are still disrupted, who gets what when and at what terms?

But that intelligence is also important for their suppliers because their cost of capital is going up as well. In this world, where we still have some limited supply chains, suppliers can’t always deliver 100 percent of what they did three years ago. They may still be at only 85 or 90 percent.

Who then gets what when and at what terms? Who gets that 85 or 90 percent instead of the requested 100 percent? I would hypothesize -- and our customers are telling us this -- those good payers, the people who pay on time for timely delivery, become the customers of choice. If there’s a limited supply, they may get more of their fair share. There are a lot of benefits for doing this well, being able to pay when you and your suppliers want to pay for the right reasons.

Gardner: You’re teeing up some of the changes needed in CFO-required skills. Whereas due diligence, operational integrity, and process efficiency may have been top of mind when it came to bringing new people into the office of CFO, now you’re talking about more analytical, entrepreneurial, and innovative skills. We need a different kind of person in these strategic thinking and data analysis roles, right?

CFO role encompasses more analytics

Kurtz: Yes, absolutely. In almost every role in the finance department now, comfort with data and analytics is becoming more critical. Those are the skills that help with automation and gaining insight into how you best manage your resources and capital. Those two skill sets -- comfort with technology and proficiency with data and analytics -- are probably two of the most important.

The other thing we’re seeing is the office of the CFO is broadening its responsibilities, too. They’re taking on more operational responsibilities and further impacting their organizations. So, that means being consultative and being good influencers and educators. Those are all part of the skill sets that a good finance organization has to have right now.

Gardner: There is no closing the door to the back office and then only coming out once a quarter with an audit or report anymore, right?

Kurtz: That’s right, you can’t do that. You just can’t do that.

Gardner: Let’s put some meat around some of these solutions in practical terms. How are these AP automation solutions paying off in brass tacks?

Productivity, processing, profits -- all up

Kurtz: We’re seeing incredible benefits. When we see automation in the AP function, you go from a company on average processing maybe 5,000 to 7,000 invoices per full-time annual employee equivalent (FTE) to companies processing, 30,000 to even 50,000 invoices a year per FTE. So, that’s a massive productivity benefit. You see the level of electronic invoices from your suppliers going from, on-average for most companies at 34 percent to some of Basware’s best-in-class customers attaining 99 to nearly 100 percent.

OCR is no longer the answer to processing PDF invoices, but AI-powered solutions are.

So, again, that plays into the benefits of accessing great structured data around an invoice. If, for example, you examine invoice processing time, most companies average around 11 days for AP functions. But Basware’s best-in-class AP customers are looking at hours or minutes, certainly less than a day, for processing. And that’s part of what you need to do to unlock the working-capital benefits. And you see companies with 20 to 30 percent of their invoices being touchless -- meaning you never physically have to manually have an intervention into an invoice from receipt through payment – are up from formerly around 21 percent. But again, Basware best-in-class customers are gaining with more than 90 percent being touchless.

These are the kind of metrics and value that AP automation solutions, and in particular Basware, customers are able to achieve.

Gardner: Can you apply these tactical metrics to also measure improvement in overall business productivity and financial returns?

Kurtz: Sure. Take a look at a customer of ours like Heineken. They implemented Basware’s AP automation solution. It streamlined invoice processing, reduced manual efforts, and improved data accuracy and efficiency. All of that resulted in greater than 40 percent reduction in their cost to process invoices within their function as a whole. So more than 40 percent reduction in overall AP team and organization costs by implementing an AP automation solution.

We can be really impactful. The same kind of thing happened at Toyota Industrial, another customer of ours, where they saw similar benefits from streamlining the invoice processing, reducing manual work, and getting suppliers to send invoices electronically. They attained better data, but also significantly reduced cycle times and earned invoice processing time savings. And that lead to better spend visibility and access for a well more than 50 percent reduction in the cost of processing within accounts payable as a whole.

Those are some of the benefits. I think the order of magnitudes are really incredible and transformational. We’re talking about literally millions of savings in hard dollar savings and then tens of millions of dollars in potentially in working-capital benefits as well.

Gardner: You can’t define productivity much better than that, right?

Kurtz: I like to think so.

Gardner: Okay, we have those direct, hard number AP improvement benefits. But as we alluded to earlier, there are some burgeoning types of benefits that come from having the data analytics and capability to innovate on larger strategies for buying, spending, and paying. Let’s talk a little bit about some of the ancillary benefits that come when you automate, when you go truly digital, and when you explore innovations around how the business itself operates.

Tech-savvy, budget-aware people thrive

Kurtz: Yes, there are a bunch of benefits. Let’s not underestimate the people benefits, right? So many of us are working in hybrid working patterns and remote working environments. I think one of the real benefits is to be able to onboard our people faster and have better productivity from them that much faster than you can in a non-automated world. So that’s one.

Two, you can attract a higher level of quality of candidate, particularly -- not to stereotype -- younger generations who are attracted to the technology that we need to incorporate into finance functions over time. They’re attracted to great technology and purpose-built technology. So, that’s another interesting example of ancillary human capital benefits of modernizing AP operations.

So many of us are working in hybrid working patterns and remote work. A real benefit now is to be able to onboard people faster and gain better productivity from them much faster by being in an automated environment.

Another one is clearly the savings visibility, right? And we have customers who are using that spend data that you get from invoices that we talked about to identify tens of millions of dollars in savings from having better data associated with invoices.

Toyota, again, is a good example. If you think about the overall finance function, one of the things they use our AP solution for and can gain from improved invoices data is the capability to rapidly monitor budgets. By improving their budget awareness, and having better conversations sooner in their fiscal quarters, they get a head start on performance metrics to know where they stand relative to budgets -- and being able to then act swiftly. They tell us that’s one of the really big benefits.

Again, that fits in with the overall CFO theme of being more consultative, being more of a business partner. That comes in large part from being able to see data, gain insights, track trends – all much earlier in the process. You simply can’t do that if it takes you 11 days to process an invoice, or you retain only 50 percent of the data, or you get garbage for data because it’s scanned, and then you have to go back and manually figure out what it is.

All of those are some of the ancillary yet impactful benefits that we’re seeing.

Gardner: Given the ongoing tight labor market, it sounds like the role of the finance people can now better help innovate for other parts of the organization, such as human resources. Better tracking payments and processes can help exploit a gig economy of contractors or use different forms of labor while tracking the costs in full.

So, is there an elevation that we should expect to see in terms of the status and impact that the finance office can have across the business?

CFO: From counter to consultant

Kurtz: Without question that’s the case. Here at Basware, our CFO is becoming more of a consultant, business partner, and adviser to other functions within the organization. That is a very common trend and theme we’re seeing as CFOs have broad influence and more operational span of control. They are changing from being the counter to being the financial consultant.

These new types of CFOs are bringing the insights from all of that data that we’ve talked about and helping the whole business operate better and deliver on expectations of profitability, growth, or whatever it is that that function is focused on.

Move from manual ways of working to the most automation AP processes possible.

And then, if we want to be really provocative about where this leads, you might have AP organizations that become profit centers. Because of the cost-reduction elements that they can take out, the working-capital benefits that they can unlock, and the ability to attract more supply -- all of those things help with investment, innovation, and growth. We might someday be looking at finance functions that are profit centers instead of cost centers.

Gardner: Interesting! Well, that’s a good segue to the last part of our discussion, which is what can we expect next? What’s in the future when we exercise true and pervasive AP automation? When will we be able to further avail ourselves of tools like machine learning (ML), artificial intelligence (AI), and instill an analytics culture within our businesses? What does your crystal ball show you coming for the modern accounts payable impact when we do it right?

Kurtz: We’re going to see a world in the not-too-distant future where in 95 percent-plus of the time, an AP person won’t ever have to touch an invoice. We will have better data from an invoice. Using AI, we will gain the capability to match and handle nearly all exceptions. We already have this today, but it’s going to keep getting better and better.

Soon more than 95 percent of the time an AP person won't ever have to touch an invoice. And we will have better data from that invoice. Using AI, we'll handle nearly all exceptions ASAP.

And you’re going to see these AP teams become much less, “How do I manage this exception? How do I go track down who the buyer was; what happened?” and all of that, to more of, “Hey, now I can think about what’s the best way to deploy my working capital. How do I take this data that we’re getting and spot impactful trends in it?”

As we become more touchless and automated, it’s going to free up value-added time to enable CFOs to be the business optimization partners, to spot trends, to understand better what’s happening in the business, and to bring ideas, solutions, and creativity to the rest of the organization. That will, in turn, fund the innovation that we want, fund the growth that need, and not just be a cost of doing business that we’ve been in the past.

Gardner: Yes, no better way to get a sign-off on something then when you can tell them it’s going to pay for itself, right?

Kurtz: That’s right. That’s exactly right.

Gardner: Jason, where can people go to learn more about these trends and solutions? Where do you look for good analysis and information about these trends, markets, and solutions?

Kurtz: At Basware, we do our best to be educational and share what we see happening in the industry as well as track industry trends and benchmarks. You can go to Basware.com to see that or follow us on LinkedIn. We post a lot of content on our LinkedIn page.

I like to read a lot of the industry analyst content that comes out. I think there is some really good stuff. I know recently I’ve done some good reading on benchmarks from Ardent Partners. They’d done some really interesting studies. Forrester has interesting studies that I’ve been reading about as late. So, those are two great examples.

Basware is also a founder and innovator around EESPA, one of the leading associations of invoice and AP automation providers across Europe. We’re constantly working together to bring forth ideas and innovation on how to bring more automation to the industry.

See how your organization stacks up on the top AP metrics comparisons.

And then frankly, Dana, most folks joke about me being a Chief LinkedIn Officer, and I’m a LinkedIn addict. I think there’s all kinds of great data that I find around LinkedIn and I’m constantly looking on there and finding interesting articles and information. So, just a few thoughts on where we can find some interesting insights.

Gardner: I’m afraid we’ll have to leave it there. You’ve been listening to a sponsored BriefingsDirect discussion on how optimizing and automating AP functions gives businesses the insights and levers to better transform.

And we’ve learned how improved control and management over cash flow, payables, and related functions elevates the overall financial situational awareness and sets the stage for better shaping the office of the CFO for the future.

So, please join me in thanking our guest, Jason Kurtz, CEO at Basware. Thanks so much, Jason.

Kurtz: Thank you, Dana.

Gardner: I’m Dana Gardner, principal analyst at Interarbor Solutions, your moderator for this ongoing series of BriefingsDirect discussions. A big thank you to our sponsor Basware for supporting these presentations.

And a big thank you as well to you, our audience, for joining. Please pass this on to your business communities. LinkedIn is an excellent way to do it, as Jason pointed out, and do come back next time.

Listen to the podcast. Find it on iTunes. Download the transcript. Sponsor: Basware.

Transcript of a discussion on why business leaders need to prepare now to optimize and automate accounts payable functions to elevate overall financial situational awareness. Copyright Interarbor Solutions, LLC, 2005-2023. All rights reserved.

How Dashboard Analytics Bolster Security and Risk Management Insights Across IT Supply Chains

2023-09-28T10:49:00.006-04:00

Transcript of a discussion on how Bruce Auto Group gains deep insights into their systems, apps, and data to manage and reduce risks across their entire IT and services supply chain.

Listen to the podcast. Find it on iTunes. Read a full transcript or Download a copy. Sponsor: Bitdefender.

Dana Gardner: Welcome to the next edition of the BriefingsDirect podcast series. I’m Dana Gardner, Principal Analyst at Interarbor Solutions, your host and moderator.

Gardner

This security enhancement discussion examines how innovative managers are increasingly benefiting from interactive dashboard analytics. The resulting actionable knowledge elevates security situation awareness to the higher order value of overall business risk assessment and mitigation.

Stay with us to learn how Bruce Auto Group has gained such deep insights -- not only into how its distributed apps, systems, and data are secured, but also into the hidden risks that can develop across entire IT and data services supply chains.

Here to share his story on how to elevate IT security to a mission-critical value of comprehensive risk mitigation and overall business resiliency is our guest, Paul Jobson, Director of Marketing and IT Strategy at Bruce Auto Group in Wolfville, Nova Scotia, Canada. Welcome, Paul.

Paul Jobson: Good morning, Dana. It’s very nice to be here.

Gardner: We’re delighted to have you with us. Tell us about Bruce Auto Group and your role there.

Jobson: Like many auto dealerships, Bruce Auto Group started off as a family-owned business. I bring that up because when it’s a dealership of one store, IT security tends to be an afterthought. But if we roll back the tapes to 15 years ago, we were lucky to have had someone related to the family who took an interest in the IT and secured us before it was in vogue. It was probably overkill at that time.

Jobson

Like most automotive retailers, everyone has been going through consolidation. We began from humble roots in 1927. Until the last decade or so, we were one or two stores. Now, we’ve expanded to 10 dealerships, spread across close to 200 miles, with head office consolidation, and, of course, a lot of remote workers. So, the IT security part has really gained prominence in the past couple of years.

Gardner: Like most expanding organizations, it’s not only what goes on inside your business, you need to also keep track of the many tendrils that extend out to your service providers. That includes online interactions, as well as emails and communications. We’re all now part of a complex, rich ecosystem, and risks sometimes pop up between the cracks among these organizations.

Security as diverse as each buyer

Jobson: Yes, and car dealerships are unique in the sense that although our businesses may appear similar, each of the original equipment manufacturers (OEMs) – such as Hyundai, Ford, GM -- they all have their own niches. They all have their own way of doing business. Of course, our integrations with them are critical to the way we do business.

As a result, we don’t get to scale as easily as some other businesses do. It’s as if with each IT solution, we start with customization and then find a way to make it more standardized across the group.

Gardner: And, of course, the car business is really the transportation services business. So, the way you communicate and gather financial data from your customers, not just your suppliers, is essential. Therefore, you need to be especially secure and resilient. No one in the ecosystem wants to think that communicating with their automotive transportation provider is a risk.

Jobson: That’s right. What we’ve learned is that security is synonymous with privacy. When people apply for a car loan, they’re providing us critical information. There’s an ongoing relationship because we continue to service these people. We want to do everything we can to protect their information.

There's a lot of hard work to do in the IT world, but by focusing on making us secure, we actually help to make the client secure as well.

There’s a lot of hard work to do in the IT world, but one of the nice synergies is that by focusing on making us secure, we actually help to make the client secure as well. So, we really appreciate the importance of that part.

Gardner: You are the digital man in the middle, right? You’re in between all of those suppliers for parts, for OEM cars, and for financial services. You have a panoply of financial organizations – from credit to insurance to government agencies -- and that all leads back to the customer and their data.

By being in the digital middle, you’ve had to move beyond mere IT security and into risk management.

Jobson: Well, that’s right. Keep in mind, too, that a lot of times your biggest risk is people. You have a new employee, and it takes time to onboard and orient them. You must build systems that consider where people are, and not put them at risk. We’re the first line of defense to make sure we’re protecting both our security and the private information of our customers.

Gardner: That requires both education and awareness, which brings us back to the need for visibility -- not just inside your own systems, but as far and wide as possible. How have you developed such extended enterprise risk management (ERM)?

Risk management at root of protection

Jobson: That’s a great question, and it’s been really interesting. My background is in digital marketing and enterprise software. Security has always been an aspect of that, so I’m comfortable working with cloud applications and setting up service integrations. It’s second nature. So, it became logical as we expanded that this would fall under my domain.

The challenge was, coming from a marketing background, we have a lot of people to help us with security, but it’s more about putting together an operational plan. How do you put the day-to-day activities all together? That was a challenge. We needed a way to communicate that to the executive team.

To adopt such a risk management strategy, we worked with Bitdefender because we really liked their people. On a quarterly basis, we’d get together, and they’d give us a rundown of what they had been seeing in the field and across our businesses.

That’s how we came across their dashboard with the executive summary. The second I saw that, I knew I had my tool to manage our day-to-day progress on securing the enterprise.

It’s funny, when you come from the outside, your first perception is it’s the people and the passwords that are going to be the highest risks. And when you know your risks, you can manage them. For us, the first ground zero for IT security was making sure we understood these risks.

So, we put in endpoint security across the organization. We run about 300 desktops. Installing that on every single one of them was a logistical feat. But everyone understood why, and we did it. Once we did, we started to get all these signals back to our Bitdefender GravityZone executive summary dashboard.

For the very first time we got a score. I wish I could say differently, but when we first got our score, the risk was high. It indicated a high level of risk, and that made all of us very uncomfortable. We immediately began to determine what our risks were. We found some real surprises.

Our top category was misconfigurations, and those misconfigurations could be anything from a printer that has not been updated to a traditional user of computer services. The first reflex is to think about your laptops and desktops. You don’t always think about the printers, but it’s a computer in the same sense as your desktop endpoint is.

Once we began to understand the true risks, we looked at security very differently. We realized that every connected device was potentially a risk that we needed to pay attention to. We liked the Bitdefender dashboard because it told us where we were on a score of 100, and it broke that down into three categories: misconfigurations, app vulnerabilities, and human risk.

We were quickly able to target the high-risk areas in each one of those categories. We put weekly plans into place for the IT team to say, “Okay, this week we need to address this.” And it was much more fun and so there was more engagement from the IT team because we were proactively setting the agenda.

Once we began to understand the true risks, we looked at security very differently. We realized that every connected device was potentially a risk that we needed to pay attention to.

It wasn’t just the typical, general red flag alert: There’s something wrong with a computer. It moved us from firefighting to fire prevention. And I have to tell you, we got hooked. That’s the way my team wants to work. They can collaborate together. They’re excited to come back and say, “We worked on 40 endpoints and got the risk from high to medium.” That’s instant reward and you get gratitude for protecting the whole organization.

There wasn’t a measurable way to go back to the team and say, “You did well,” until we had this dashboard. We all saw the risk score coming down in real-time, in front of our eyes, and it just transformed the way that we work as a team.

Gardner: It gives you a whole new sense of knowledge about your situation, and to what degree you can be in control over your destiny. But also having those scores gives you some ammunition you can take to other people in terms of, “Here’s what we’re accomplishing. Here’s why we can get cyber insurance if we want to. Here’s how we can increase the knowledge across our workforce about how to be better prepared or to modify behaviors.”

It certainly sounds like you’ve crossed the Rubicon, if you will, of not being a deer the headlights, unaware of what’s coming next, and instead being in charge of your destiny and having the tools to further reduce risk.

Deal with risk consciously, confidently

Jobson: That’s right. There’s a matrix where you’re unconsciously unaware, and then you get conscious on risks. I’d say we’re now consciously competent. Although some days we roll back, we’re more and more in the consciously competent part. The IT team is more comfortable approaching big tasks because, again, we can be proactive. We’re ahead of the curve. We’re not waiting until there is a situation. We’re dealing with it before it’s a problem.

For example, in just six months we have effectively accomplished an agenda that had hovered around for three to four years. I attribute that to having a score. Anyone out there who’s wondering what the first step is: First, I would say, is read the Cybersecurity Framework by NIST. It’s an overwhelming document at first, but it’s an unbelievable document because it gives you context. Once you’ve read through it, and then you match it up with a scorecard – such as we’re getting right now with the Bitdfender executive summary -- you’re able to put a game plan in place for everything you need to do.

Gardner: Let’s drill into the executive dashboard. While you’re getting a top-level view, because there are agents and technologies to bring you all the information you need, you are able to drill in and find out more information. But it doesn’t flood you like a fire hose with too much information.

How confident are you that you’re attaining a comprehensive view when you drill into the level of detail that’s possible?

Jobson: The dashboard and the sensors -- you could think of your whole network as sensors – are giving us information much faster than we could realize from our own logs and audits. For example, we have a Voice over Internet Protocol (VoIP) system that a threat recently emerged in rather quickly. It was developing literally by the hour, and the dashboard was the first one to bring it to our attention.

Incidentally, twice a day, I look at the IT news and it was only in the second half of the day that this threat started to emerge in the news. But our GravityZone program served that up to us first thing in the morning. We were already ahead of the threat. That allowed me to reach out to the suppliers earlier. I wasn’t waiting in line saying, “Okay, what’s the best way?” We still needed to function as a business. Right away we were able to mitigate the situation quickly. And to our knowledge, we mitigated a rather large risk with very little disruption to our staff -- and more importantly, no privacy breaches.

Gardner: With that sense of accomplishment, you’re able to reduce the overall stress on your IT and security staff. That’s important these days because it’s hard to find and hold onto qualified people. If you can give them an environment where they feel like they’re making a difference, they have the tools to attack these problems early -- and do it so they’re not in a fire drill -- that must make for a good labor environment.

Move beyond reacting to assessing

Jobson: Yes, that’s a really good way to say it, Dana. When you’re reacting, you’re just reacting. You haven’t had time to read through the different mitigations, the plans A and B. Now, most of the time, we don’t have to react with intensity. We still need to act, but we have different mitigations in place. The team can talk about what’s the best approach. We can do a store by store and kind of learn from each store as we apply the process. We can do a quick follow-up with the team and say, “Okay, great. What problems did you encounter? Were there any dependencies that were affected?” So, it’s the way to go if you want to come out of this and be able to go home and sleep well at night.

Gardner: Right. And it’s interesting, too, Paul, because you are not trained as an IT person, but you’ve been able to get into this at a higher risk assessment and mitigation level. By having the right technology, you have crossed a barrier from when only a techie could do this to now, when somebody who can use the tools well is managing rather than struggling.

Jobson: One of the interesting side-effects of having a dashboard like this is you can focus on the people element. At the end of the day, for me, I wish IT stood for innovation and team, because we’re using the tools to help people be more productive. We’re assisting the team with solutions that work for them and allow them to function better and better.

The second we see the dashboard alert and look at the affected devices ... we tighten our policies. People are more understanding because we share the insights that we get from the security system.

What’s nice about having a tool like this is that you’re actually able to share the information with the users. Sometimes we’ve had to reach out to users and say, “You know what? Sorry to interrupt you, but our system has flagged you. You have an app or configuration that’s been flagged as high-risk. We need to deal with it immediately.”

By just seeing the words “high-risk,” our users deescalate. They do not wonder, “Okay, do you need me to do this? Do you really need to touch my computer right now while I’m at work?”

They may be with a customer, but the second we see the dashboard alert and look at the affected devices, we say, “Hey, sorry, but you’re one of them.” As we tighten our policies, people are more understanding because we share the insights that we get from the security system.

We can say, “Listen, it’s not that we want to block you on this photo app, or it’s not that we don’t want you to be able to put your favorite picture on the desktop background. But there is a greater agenda that we have, and these are some of the ways we’ve been told to mitigate it,” whether it’s from signals from our security system or from looking to the NIST Cybersecurity Framework.

Gardner: We would be remiss in talking about your security posture if we didn’t bring up email. It is still one of the leading threat vectors -- after all these years. Tell us how you deal with email security. I’m sure you have it coming in all different directions. Is there a way in which you’re managing your email issues and leveraging this dashboard at the same time?

Successful email security systems

Jobson: Yes, email security is the single most important vector of any security program because it’s where the rubber meets the road for most users. That’s where we get the most outside influences.

We have a three-tiered approach to how we do things. First, we make sure to protect all the endpoints. Second, we secure the network using an XDR solution. But last, and we did it last because it’s the most involved, we have an email security process in place. And when I say it’s the most involved, it’s because if you are truly trying to achieve email security, you are going to put in rules and guidelines that are going to be restrictive.

So, on a typical day, we probably quarantine about 800 emails that get reviewed quickly by the IT team. They are assessed for their risk and then forwarded on. But what’s nice is we’re able to quickly see patterns. We’re also able to call people and say, “What are you sending? You’re sending an encrypted, password-protected thing. We have no idea what’s in there. Is there a way we can make a change, or is there another way we can get the information, like can we get it off a web link?”

We find a way to reduce the risk. And when we’re sharing with our suppliers, some are rigid. They can’t make the changes, but we have had some that said there is another way to deliver the service.

Combined, that all reduces the risk from email. But something else amazed us initially. When I said we were quarantining about 800 a day, we get about 2,000 that are genuine spam. They’re not all evil, if you will. Some of them are just people promoting themselves. But when you have 300 users a day using their computers, there will be risks in the spam. By putting in this frontline of defense, we have not had any significant scares, and I attribute it to our processes.

The email security feature I like the most: Every single link in an email, when it is clicked, goes through a secure scanner first. So, we don’t have to count on a person who’s a day or two in who doesn’t know if they’re receiving a legitimate link from one of the manufacturers or not. The system has their back on that. We’ll scan it for them.

And we do get some angry calls every now and then from someone saying, “I was trying to do this. I’m blocked.” But it changes very quickly when we go back to them and say, “Hey, you know what? Are you aware that was a malicious site? Did you know that site was trying to take your credentials and our system blocked you and protected you?”

The business team is just so much more supportive of additional initiatives once they’ve gone through that process. You don’t know what you need until the need comes up. So, once they’ve gone through that process, we just find they’re so much more willing to help secure the business.

Gardner: And again, with email -- like some of your other services you mentioned earlier -- it’s the knowledge about what’s going on that brings you to that higher-order discussion about how to be risk-averse rather than how to be unproductive. And so, that’s the key, I think, is you’re able to get people’s buy-in rather than have it just seem like they’re being naughty.

Jobson: That’s right. But I will say to anybody implementing it, there is a transition period. The first day you turn it on, be prepared. One of the things we’re learning is communication is critical. We do a style of management that’s all about cascading messages to employees and we found that, you know what? I think the perception of the IT team sometimes is, “Oh, does anybody notice what we do?” The answer is yes. On a grand scale, they notice what we do.

Communication is critical. We do a style of management that's all about cascading messages to employees. They notice what we do.

When we make small changes, users are affected, and they communicate back to us. So, good messaging helped us get through it. We had a tuning process that we did and we were grateful to our user’s patience while we did it. But today, everybody’s confident that we’re much more secure because of these measures that we put in place and it’s worth the inconvenience or sometimes having to wait an extra hour for a flagged email to pass through the gates.

Gardner: The alternative might be that your business is down for three or four days -- and talk about aggravation.

Jobson: That’s right, and the reality is we just can’t monitor the volume. You need to leverage a system to monitor that for you.

Gardner: IT and security people are dealing with so many different tools. There’s a new tool coming out every week for some other new aspect of security issues. What’s your philosophy about how to handle that sprawl, to get the most out of the tools but without being overwhelmed by them? Is the dashboard part of that ability to get the right balance?

Plan ahead to prevent tool sprawl

Jobson: That’s a great question. You need a plan on how you’re going to implement these things. For us, in looking at the dashboard, we love the information that we get back. It scans a lot of the network, but there were some limitations on endpoint security.

That led us to the next path, which the NIST Cybersecurity Framework also hinted at, and that’s the internet of things (IoT). And for us that meant raising our awareness about how much priority and privilege each device should get. We started to think about segmented network security, which is what you can do with XDR. So, we’d have networks for IoT, networks for our guests, networks for our main enterprise business, network for staff devices, and we’re able to reduce the risk by going into these specific lanes for each category.

When you get a signal back from the dashboard, the solution isn’t always an IT thing. Sometimes the solution could be sending a memo saying, “Please don’t install any unapproved apps unless you reach out to the IT department first.” Or it might be going further, as we’ve done, and put some clamps down on what can or cannot be installed on people’s PCs.

So, we have used education, restructuring the network, calling the manufacturers, and further isolating some devices. We have some suppliers that have devices that they never update. It’s not our property. No problem, we’ll put that on a network outside of our regular network to keep us safe. So, each one is a problem to solve. How you solve it is really up to you.

Gardner: Right. But the key is that you have that knowledge and insight that the risk is there.

Jobson: Absolutely.

Gardner: Before we close out, Paul, let’s look to the future. How do you expect to leverage automation more? You said you can’t do this all manually, and even using intelligence to gain a larger view of risk. Do you look to the dashboard to help you attain more automation and intelligence?

Embrace expertise to manage threats

Jobson: The dashboard is one of the tools we’re using, along with Bitdefender GravityZone. There is a series of tools we use to manage things. One thing we really like is like the Bitdefender Threats Xplorer. A lot of people’s notion of security is just an antivirus scanner on the PCs. Scarily, for a lot of businesses, that is their level of understanding. But the threats are becoming more sophisticated. You can either ignore that or you can work with partners that have more experience.

As we look to the future, XDR has been an area where we’re paying more attention. It gives us greater insights on the devices that aren’t PCs and it watches our whole network. But it’s also giving us in real time a description of the threats as they’re happening.

For example, we recently had an incident. It was from a remote software that we use to support people. The supplier made a change in their software, and the change had a piece of software that was associated with malignant code. That malicious software was attacking businesses, and we were in a meeting at the time, the whole IT team, and our system started to shut down users.

By the fourth or fifth person being shut down, someone knocked on the glass and pulled us out of the meeting, and said, “You know, there’s four or five PCs shut down.” We were nervous that this was a virus. In fact, what it was our system operating in real time. When it saw a threat, it turned that PC off and isolated it. When it did that, the software, the remote software would go to the next node and try to scan the network. And, so, it would be shut off, too.

In a very short amount of time, it shut off the five offending PCs. If that had been a real risk … What’s so great is my team cannot be on alert all of the time. We are relying on the automation and technology to take care of things and let us to do the analysis after-the-fact. If you’re not leveraging these tools that can do that for you, you might be creating a lot of risk for yourself.

Gardner: Any recommendations to those listening?

Jobson: In IT, you have so many choices. I mean, you just have to run any popular program, PC optimization program, and it’ll tell you 1,700 fixes you can do to fix your PC. You scale that over a large organization, and you can literally have hundreds of thousands of choices.

For us here at Bruce, the tech team, it was critical that we had something that prioritized it from a risk point of view -- from mildly inconvenient to threatening your business. Once we had that prioritization, and the whole team understood what it meant, that’s when we started to gain enormous traction on long-standing issues with how we were managing our PCs.

In order to have a game plan, you need to know what the objectives are. Our Bitdefender scorecard helps us identify the highest priority objectives.

Gardner: I’m afraid we’ll have to leave it there. You’ve been listening to a sponsored BriefingsDirect discussion on how Bruce Auto Group gained deep insights not only to how their systems, apps, and data are secured -- but also how risks can be averted across its entire IT and services supply chain.

And we’ve learned how innovative managers like Paul have elevated IT security to a mission-critical value of comprehensive risk mitigation and overall business resiliency. Please join me now in thanking our guest, Paul Jobson, Director of Marketing and IT Strategy at Bruce Auto Group in Nova Scotia. Thank you so much, Paul.

Jobson: Thanks again, Dana. Have a great day.

Gardner: I’m Dana Gardner, Principal Analyst at Interarbor Solutions. Your host and moderator for this ongoing series of BriefingsDirect discussions. A big thank you to our sponsor, Bitdefender, for supporting these presentations. And a big thank you as well to our audience for joining. Pass this on to your IT and security communities, and do come back next time.

Listen to the podcast. Find it on iTunes. Read a full transcript or Download a copy. Sponsor: Bitdefender.

Transcript of a discussion on how Bruce Auto Group gains deep insights into their systems, apps, and data to manage and reduce risks across their entire IT and services supply chain. Copyright Interarbor Solutions, LLC, 2005-2023. All rights reserved.

How WFH Accelerated IT and Security Transformation at Global Publisher HBG

2023-07-11T12:00:00.007-04:00

Transcript of a discussion on how the rapid shift to remote work accelerated the digital transformation of a New York-based publishing organization to reduce risk while preserving a highly creative and distributed culture.

Listen to the podcast. Find it on iTunes. Download the transcript. Sponsor: Bitdefender.

Dana Gardner: Welcome to the next edition of the BriefingsDirect podcast series. I’m Dana Gardner, Principal Analyst at Interarbor Solutions, your host and moderator.

Gardner

Our next security innovations discussion examines how the rapid shift to remote work has accelerated a rethinking of security and IT processes at a New York-based publishing organization.

Rearchitecting the security posture of a business means adjusting work patterns and IT in ways that both reduce risk and heighten performance. But the trick is to do so without alienating workers -- wherever they may be -- and maintaining strong productivity.

Here to share her story on how to digitally transform a traditional business structure, reduce risk factors, and preserve a highly creative culture is Heidi Holmes, Senior Director of Information Technology Services at Hachette Book Group (HBG) in New York. Welcome, Heidi.

Heidi Holmes: Thank you. It’s nice to be here and I’m looking forward to this.

Gardner: Let’s start by having you tell us about HBG and why you needed to significantly adjust your security objectives over the past couple of years.

Holmes: HBG is one of the world’s largest publishers. The United States branch is part of a larger global Hachette, and we have some very, very big authors, such as James Patterson and David Baldacci.

Holmes

We literally print almost every kind of book you can think of. So, our company is highly creative, and very intelligent. On a personal note, it amuses me because at other IT organizations I’ve been with, I could send out an email and never think twice about it. But here, you send out an email and you’re going to be critiqued from every editor across the board. It’s amazing. Even the CEO, he spots things that aren’t quite in the right order. It’s awesome.

So, Hachette: We’re a pretty amazing company. I’ve been here since 2019. I came into a very different IT organization. The leadership in place was great, but around some of the security practices, we really had to mature, to grow our business, and to grow how we monitor, maintain, and secure everything -- from the PC all the way to the edge.

Gardner: It sounds like – being global and dealing with so many authors, editors, and artists – that you were already a fairly distributed organization. And then we all had the move to more remote work in 2020. How did that rapid shift impact your digital transformation journey?

Diversity strengthens security strategies

Holmes: In such a diverse organization, no two sets of tools are the same. Just in the IT organization, every group is unique. And we’re talking five to 20 people. We are an amalgamation because we’ve acquired many different companies over time.

For example, Orbit, which is our science-fiction department. They are amazing, but they operate in one way, whereas Little, Brown Books for Young Readers, which is all of our young readers’ literature, operates completely differently. It’s almost as though it’s IT for a ton of small businesses that operate within a large business structure. It’s pretty interesting.

Once people began working from home, then all their data lived in their laptops. How do you manage and secure that? This is where our new challenges arose.

So, they were diversified to begin with. But when more people began working from home, supporting them all became even more critical. The traditional IT model was moat and castle. We had to protect ourselves by using the best firewalls. You can protect anything, but once you’re outside the castle, everything is looser.

Once people began working from home, then all of their data lived in their laptops. How do you manage and secure that? What do you do to get your arms around that? This is where our new challenges arose. If you’re used to the castle technology, you have to create high-speed connections to and from every office to access all of your data for home workers.

Gardner: So, you had constellations of different businesses and cultures – as well as legacies of different IT. To corral that together, you almost have to be a managed service provider (MSP) as an IT organization. Is that fair?

Holmes: I do manage the help desk infrastructure. We also serve up all of the data, all the data center services, and the cloud data management, as well as cybersecurity. From my position, we are set up to service different groups on different platforms and support a wide range of tools across the larger IT organization.

It’s amazing. We’ve taken those requirements and built the tools to service the overall organization. And some of them are complex. Then we come back in with the security and managing compliance around how users access data inside of the tools and how it’s all unique across each of those separate publishing entities. It’s fascinating.

Gardner: In addition to a focus on endpoint security to support a distributed and remote work force, you’ve also had to look at transforming IT.

A lot of times, people have architected their IT -- and then they add on security. Did you try to simultaneous engineer for security and IT productivity and digital transformation? Is there a new way of doing security from your vantage point given your responsibilities?

Security as speed bump, not roadblock

Holmes: Yes, there is a new way of doing security. When I entered, security was a bolt-on, after-the-fact approach. For example, they may have already built a tool. But have they tested it? Or an application. What has been done with them?

We were at the ground floor, as new projects were coming up, on security. The teams were coming to us from a cybersecurity standpoint and saying, “What’s the best way for us to secure this? How about outside software-as-a-service (SaaS) providers?” Things like that.

We needed to make sure that they filled out the security forms to make sure that their architecture and best practices matched with what we were looking for with security. But we found out early in the game that they weren’t compliant. They didn’t have security as their first thought.

It’s more about balancing risks and building in security. As I tell everybody here, cybersecurity is about being a speed bump -- and not a roadblock. Everything we do should be about slowing down, so you don’t bottom-out your car. You want to keep going, not come to a full stop. There’s no productivity if we have to come to a complete stop. We need to keep moving. We’re getting there.

Gardner: Of course, if you have a security breach, that’s one way of coming to a full stop. You need to have a balance between reducing risk, but also maintaining productivity and creativity.

What have you learned the past couple years about those balances? Has it changed with the remote work? How does digital transformation give you the tools to have the insights to reach that balance better?

Holmes: One of the tools we use, and why I’m here, is Bitdefender. We’re looking at their dashboards all the time. We can see what’s commonly going on. The [endpoint detection and response (EDR)] tools are great for our digital transformation because they’re on every one of our computers, on all of our servers, monitoring and automatically blocking risks.

If Bitdefender sees lateral movements on the network, it will block and halt those or delete certain files. It’s really given us an advantage. It gives us the capability to look at what’s going on. Because if we see a large increase, then we can look into our other tools that complement Bitdefender and say, “What are we seeing on our firewalls? What are we seeing in our security information management (SIM) tool? What are we seeing on our email filtering? Do we see a coordinated attack or is this just a run-of-the-mill type of attack?”

If Bitdefender sees lateral movements on the network, it will block and halt those or delete certain files. It's really given us an advantage. ... Bitdefender helps us be proactive on what's going on. For us, it's been great.

Bitdefender helps us be proactive on what’s going on. For us, it’s been great.

Gardner: And being proactive means you want to react swiftly. Is there a way that you’ve adjusted to the remote workforce -- all of those laptops and home desktops -- rather than being inside the moat? Is there a way for you to take the information you’re getting from your Bitdefender dashboards and be more actionable with it?

Holmes: Absolutely. If we see a large number of attacks, even if they’ve stopped, we can open up a help desk security ticket and reach out to the user. If the incursion seems to be trying to install something or to attack others in the environment, we can remotely deactivate that device. We just have them ship their laptop to us so we can take a closer look, and we ship them out a new one.

We don’t play games with anything in our environment. It’s better to stop it at the source and move on. But, yes, the tools give us the capability to get out ahead of it all. And we’ve developed a team that is constantly monitoring, seven days a week. Our dashboards look for any correlation, anything ahead, and then work with us to automate or alert us if something needs to be acted on more quickly.

Gardner: And, Heidi, how does your background as a network engineer help in your digital transformation and with security concerns? Have you been able to bring more of an architect’s perspective to how you’re modernizing your IT and security?

Architecting for change

Holmes: Yes, I have. For the past 20-plus years, I’ve worked as an architect, network engineer, and network security engineer. The biggest thing I’ve learned is to go back to the business risk. We understand what the business risk is, and how to mitigate or isolate that risk. But that also means understanding the business you’re working with.

Part of an architecture isn’t designing the fanciest, most secure tooling -- because that’s how you get the balance versus the speed bumps. You have to learn the business, learn about the people, know where their risks are, and then architect around that to say, “Okay, stage one is where we see in our transformation the need to move certain things to the cloud.”

Or, “Our most vulnerable systems need to be isolated because some of them might be near end-of-life and we can’t do certain things with them anymore. We’re going to move them over to something such as a different layer or to firewall them with intrusion prevention and monitor it that way. Maybe some of our websites are older and we need to do something with that.”

We might put some sort of a web application firewall (WAF) in front of it. But you have to lay it all out in stages. And the easiest way to architect and build is to know what the business needs. And then you start designing to have the least productivity impact while giving the most security. So, the biggest bang for your buck: “Let’s start there, let’s hit the quick wins while we’re still planning out the other things.”

And part of architecture is understanding that when you build a process and a project that it changes. It’s a constant re-evaluation. What are the latest tools? The tools from 2019 are not the same tools that I’m working in at this point. Because every year, every six months, every month, something else is out there offering a better way to do things.

For example, a zero-trust architecture was at first a little bit nebulous. Trust nobody and everybody’s like, “Why can’t we trust people?” That’s like, “Well, not everyone’s your friend and even the computer next to you isn’t your friend necessarily either.”

Gardner: Well, that’s a perfect transition to my next question. In an organization like Hachette Book Group, the goal is for people to communicate, collaborate, be creative, and be open.

When you come to them with a security mentality of, “You need to be very suspicious and zero trust-oriented,” that creates potentially a cultural conflict. How have you been able to get people’s buy-in on what you need? Behavior is such an important part of security. At the same time, you want to allow them to be as open as possible and share ideas as they are used to.

Make wide, yet light, security footprints

Holmes: The right mentality is to have the least visible footprint in the things that you’re communicating on, on any given computer. But you also have to trust the communication tools. The things that you use such as Zoom or Teams or something like that. Those are commonly known ports and IP addresses.

We don’t have to overthink it like 15 or 20 years ago, when I needed to know every port that the teams used and qualify that. Our security tools will automatically understand, and part of the artificial intelligence (AI) built into them, knows that these are okay communication methods and it’s fine for us to continue to communicate that way.

So, there’s an openness with video communication and collaboration with a level of security and staying away from custom-built tools to communicate. That will protect you because inherently, custom-built tools usually need extra updating and the people who develop them don’t always keep them up to date. That also will protect you in a zero-trust environment.

But honestly, it’s gotten so much easier with zero trust … because Bitdefender is fantastic for that. It’s always monitoring. The AI is telling us as it’s looking at patterns instead of always at a specific port where you can lock people down and isolate them. So, it can see a lot of the lateral movements, you can see different firewall rules that are not industry-standard and as attacks try to pass through. It’s the only real way to go.

Gardner: You’re describing what people have come to think of as what a security operations center (SOC) as a service could be. Is that how you’re starting to view something like Bitdefender? Or is that a place you’d like to see it go, of where you have a SOC as a service benefit all the time and everywhere?

Holmes: Well, that would be fantastic. And we have spoken to Bitdefender about this. From my past experience, I’ve worked with SOCs, did a little bit of management of SOCs, and brought that into a new organization.

What you see a lot of times is they give you a lot of data. And traditionally, any SOC will overwhelm you with 3,000 alerts and events in a day. And you have a team of three and you’re hiring a SOC to help you. But instead, your team of three needs to remediate all of these things, otherwise they’ll keep showing up, and the SOC’s going to keep reporting and then it becomes completely useless to you.

Bitdefender is using more AI to filter out the things that are less meaningful. It's no longer every single thing that comes across your dashboard. That helps you dive in quicker when there's a problem.

The modern SOCs, and a lot of what I understood from the Bitdefender side is, they’re using more AI to filter out the things that are less meaningful. It’s no longer every single thing that comes across your dashboard. That helps you dive in quicker when there’s a bigger problem. A SOC can become a benefit instead of a hindrance to a small team because the teams are always already trying to remediate their problems. They only need to know about the things that are brand new major holes because patching everything else should take care of the rest.

Another thing I wanted to mention on SOCs: Back to our transformation, when I mentioned the SIM tools, and having the different dashboards, it takes a while to bring a security team up to speed on what they should be watching for. That’s about identifying what’s meaningful to you. And then to fix the problems they’re finding from doing the scans. The last few years, we’ve been training security staff to do just that. When a SOC comes into play now is when the team is already expert at security and then everything is meaningful. Sometimes you can take the jump to a SOC too fast.

Gardner: A lot of what we hear in the marketplace now is that people are resisting tool sprawl. Too many security tools are not a good thing. They also want tools that will integrate, that play well together.

How are you looking at that balance between having the right number of tools, but also tools that are integrated well in advance?

Just say ‘no’ to tool sprawl

Holmes: I literally just said “no” this week to a couple of security tools because it was just more sprawl. We need to use our tools right. Tools should be useful. They should give you information you don’t already know, or they should coordinate multiple things into one tool so that you can easily discern where a problem is.

So, if a tool doesn’t have multiple uses and it’s not cost-effective, then we don’t want it. There has to be a very specific reason to look at it. Also, every tool needs to be easy to use because we can’t send somebody to three weeks of training. We can’t train a second person for when the first person goes on vacation.

And it has to be automated, it has to be able to page us if it hits certain thresholds. All of that needs to be set up very quickly. Because when we take holidays, there are always less eyes on dashboards. And we still need to know if something’s going on. We need to get paged, woken up, and brought back to the dashboard.

So that’s what we’re looking for. The tool sprawl: Everybody has a tool that they want to sell you -- everybody. It needs to work for on-premises, and it also needs to work in the cloud. It needs to give us all of the information we need. It needs to work in your home to tell me what’s going on in your laptop there. That’s what we need from our security tools.

Gardner: Whenever you ask folks to qualify and quantify how their security is working, the number one response is, “Well we’re not getting hacked, so that’s good.” But because you’re involved with not just security but IT and digital transformation, there’s probably more ways that you can measure the effectiveness of your security approach in terms of productivity, team collaboration, and how your IT support group is able to please your end-users.

Do you have specific ways of looking back and saying, “We made good choices, and we can prove it by blank?” How do you measure your success in digital transformation and security?

Holmes: As far as the users go with collaboration, the easiest way for us to tell is the number of help desk tickets we get. If the users aren’t calling us because they can’t work on their computer -- either because they’ve had an attack or because they just can’t use it because it’s still in lock down -- that’s a good measure.

And if we’re not seeing a proliferation of viruses and malware in our environment then those metrics are great for us, too. We’re constantly watching them, we’re updating them, and we’re reporting all those metrics to our senior leadership in the company. So, it’s been amazing.

Gardner: Let’s briefly look at costs. We’re also seeing many organizations that need to do more with less. Is there a way for you to balance the economic side of the equation with these metrics of success?

Holmes: With the metrics for success, if we purchase tools that help us get ahead of a problem and we don’t have any downtime or a loss of productivity, that is our number one way of evaluating that. So, know your risk, your way of knowledge, and the tools. Tools must do multiple things, be easy to use, and be cost effective.

That’s huge for us because I don’t have to hire extra people, which is cost. I don’t have to have extremely skilled people. I can weigh the cost and the amount that we’re spending in our security and IT budgets and say, “We are doing the right things for our people with the right level of protection and our downtime is in individual users -- not systems.”

That’s how we measure it. Productivity; not lost time. The ability to shift if there is a problem. And that gets back to the training. For example, we recently had a security incident. It turned out to be something from something very old, more than 10 years old, that was transferred to our environment, and we found it with our tools. We shut down a portion of the network and -- because of the training – we only lost about two hours while we investigated it.

A couple years ago, we would have had vice presidents down our throats saying, “Why can’t we do this?” But because we’ve trained our team so well, it was literally, “Okay, let us know when it’s available again. We want to support you. We’ll work on something else.” It was great.

So, it’s all about having the tools, the costs managed, and being able to measure all of our training and practices around the knowledge and people that are behind us. They want a secure environment, and they’re willing to pause if they need to for a little bit while we look at things.

Gardner: You had a speed bump, not a car crash. So that’s a really good indicator.

Holmes: Yes, it was great.

Gardner: Before we end, let’s look to the future. I’ve heard a few words from you, Heidi, like “automation,” “AI,” and “SOC as a service.” What new challenges do you foresee, and what are the best tools or approaches for you to meet them proactively?

Detection advances to patterns

Holmes: The problem is, we don’t know what we don’t know or what the next security problem will be. You need to be prepared for everything. You need to stay ahead as a leader in this field and just listen, watch the articles, and be prepared to pivot when things happen.

The AI and the new tools are great because they are looking for patterns. It’s not like the old days where I would just look for a signature. So, somebody would do something that applies a specific signature, and it could only catch that. It’s now looking for the pattern and then correlating the pattern. As a result, we’re getting many less false positives because it doesn’t look for just one minor anomaly. It looks for a pattern of anomalies, and then it might immediately block it.

There may still be some false positives because of the old applications out there.

We love the tools we use, such as the Bitdefender console. It delves into so many things. I personally look at the executive dashboard on a regular timeframe because out of all of our tools, it is one of the best and easiest to drill into.

We love the tools that we use, such as the Bitdefender console. It delves into so many things. I personally look at the executive dashboard on a regular timeframe because out of all of our tools, it is one of the best and the easiest to drill into. I can say, “Wait, there’s a spike in viruses.” I click on it even though they’re blocked. It shows right there on the line if any of them got through. Then we can raise the flag, even though it’s already been blocked. But who is affected and where? I can click, and it shows me the actual machines, and it shows me what it was trying to do.

That’s the best way to stay ahead. That is part of the automation; it is automatically blocking. So, our firewalls automatically block, or quarantine, or do whatever needs to be done. We get automated alerts that ring our cellphones, that send us messages depending on what it is, and we have bridges. We also have automated [processes] where we can automate traditional patching or fight zero days [attacks] or anything that comes up. We have that all scheduled to go. So, that’s not a manual process anymore.

Gardner: Heidi, before we sign off, for those who are also going on a journey where they want to change the way they’ve done security, where it becomes simultaneous to and maybe even in advance of IT decision-making or IT architecting, what advice do you have for them now that you’ve gone through this? What words of advice do you have for people who can make security part-and-parcel with their digital transformation activities?

Start where you are, then dig deeper

Holmes: Get to know your business. Learn. Learn what your business is doing. Then, while you’re learning, start with the fundamentals. What are you doing well in your business right now or in your security?

Do you have good malware protection? Firewalls on your laptops? Things like that. Start with your servers, with your laptops, every device in your environment. That’s an easy place to start. Make sure your patching is up to date.

And then you can start looking a little bit deeper. Vendors -- understand what your vendors are doing. Just because it’s in the cloud doesn’t mean it’s secure. It is not the same thing. You need to understand where you’re putting your data, and what your people are doing. And that goes back to learning the business.

Lastly, shadow IT. Because everything can go to the cloud, every business is going to try, and every department is going to try, to find their own tool in the cloud. But they won’t necessarily vet it the way your IT security organization will.

So, get to know the business, gain their trust, and help them by giving them speed bumps and not roadblocks. That’s my advice.

Gardner: Well, I’m afraid we’ll have to leave it there. You’ve been listening to a sponsored BriefingsDirect discussion on how the rapid shift to remote work accelerated a rethinking of security and IT processes at a New York-based publishing organization.

And we’ve learned how Hachette Book Group digitally transformed a traditional business structure successfully, reduced risk factors, and preserved a highly creative culture.

So, please join me now in thanking our guest, Heidi Holmes, Senior Director of Information Technology Services at Hachette Book Group. Thanks again.

Holmes: Thank you. It’s been great talking with you.

Gardner: I’m Dana Gardner, Principal Analyst at Interarbor Solutions, your host and moderator for this ongoing series of BriefingsDirect discussions. A big thank you to our sponsor, Bitdefender, for supporting these presentations.

Also, a big thank you to our audience for joining us. Please pass this on to your IT and security communities, and do come back next time.

Listen to the podcast. Find it on iTunes. Download the transcript. Sponsor: Bitdefender.

Why today’s hybrid IT complexity makes 'as a service' security essential

2023-04-24T10:43:00.012-04:00

Transcript of a discussion on why more automation, integration, and acquiring security services “as a service” are in hot demand amid rapidly growing IT security costs and the added complexity of protecting distributed workforces.

Listen to the podcast. Find it on iTunes. Download the transcript. Sponsor: Bitdefender.

Dana Gardner: Welcome to the next edition of the BriefingsDirect podcast series. I’m Dana Gardner, Principal Analyst at Interarbor Solutions, your host and moderator.

Gardner

Amid rapidly growing IT security costs and the added complexity of distributed workforces, the challenges facing IT services providers are clearly outrunning past practices. That’s why more automation, integration, and acquiring security “as a service” are in hot demand.

Stay with us now as the next BriefingsDirect security innovations discussion examines how Heartland Business Systems is seeking new ways and new partners to ensure that security incidents are kept in check across a variety of hybrid IT services and scenarios.

Here to share his story of increasingly embracing security-as-a-service is our guest, Jason Nuss, Vice President of Cloud Services at Heartland Business Systems (HBS) in Little Chute, Wisconsin. Welcome, Jason.

Jason Nuss: Dana, thanks for having me.

Gardner: Jason, what are some of the top trends driving the need to do things differently when it comes to risk management and endpoint security?

Nuss: Endpoint security is getting more important and broader every day. Cyber insurance definitely has had a huge influence over the last several years. I can remember when cyber insurance applications were just a couple of questions. Now, in some cases, they’re a dozen pages long.

Nuss

That’s urging more requirements to tighten up security practices. At the same time, the hackers are getting smarter, and they’re moving to new techniques. You know, we’re starting to see more extortion as opposed to just encryption scams, which really has a much greater effect on not only on a specific customer, but sometimes that customer’s clients as well.

During the last few years of the pandemic, we’ve also seen a migration to a more mobile workforce. Some of the companies we work with have closed their office doors. They aren’t going back to physical offices, which has brought in other challenges when it comes to making sure their environments are secure.

Gardner: And how about the current hybrid IT environment? How is that forcing you to do things differently?

Data is everywhere, but is it secure?

Nuss: Data is now everywhere -- as is your staff. We used to be able to secure inside of your walls and you didn’t have to worry so much about external trends. But now we have people working from home and accessing home networks, which makes those endpoints even more vulnerable to more security threats than the ones behind your corporate firewall.

You also have more cloud data and cloud services applications. You need to make sure those are secure as well, which plays a huge new factor. One of the common misconceptions we see is that everything from the cloud is perfect.

A lot of people think that cloud-based software-as-a-service (SaaS) applications include everything and that they are fully secure and fully redundant. But that’s just not the case. People need to take more time to look at the services that we’re adopting and make sure the providers are on the up-and-up. Do they have all the proper security tools, backups, and disaster recovery? Should they have an outage, how will that impact our businesses as well?

Gardner: Right, we have to evaluate the security robustness, if you will, of our entire technology supply chains.

Nuss: Absolutely.

Gardner: How about rising costs, such as for labor? How is that affecting your ability to deliver security effectively?

Nuss: Security costs over the last several years have gone up quite a bit. I often tell customers that security costs have gone up 500 to 600 percent from what they were five years ago.

I’ve been around this industry almost 30 years now. Before, you only had to worry about an antivirus product and a modem for connectivity to the Internet. Then it moved into buying firewalls. But now you have things like endpoint detection and response (EDR), managed detection and response (MDR), and extended detection and response (XDR).

It’s very confusing. You have security information management (SIM), security operations centers (SOCs), privileged access management (PAM), and all these other new technologies that make the landscape very, very cloudy. No pun intended.

But you know, sometimes we have to right the ship for the customer to make sure that we’re looking at security from a proper rollout perspective. You’re starting with the most critical things, whether it be a backup or multi-factor authentication or endpoint security. And then maybe layering on some of the additional services. But it doesn’t make sense for our customers to start out with penetration testing if they haven’t secured their environment ahead of time. We’re going to find out holes, right?

Gardner: And why is SaaS and more automation generally attractive to folks like you as you’re specifying the next generation of security?

Expertise at scale

Nuss: Expertise at scale is very important -- and often overlooked. Just making sure you have a SOC, and maybe if it’s a guy or two, that is not good enough. You need to be able to react appropriately.

So having a larger staff, having a knowledge base behind that, is very important in solving the protection issues -- or even identifying the security issues quickly. Automation is critical to that. When you’re ingesting hundreds of thousands -- or millions -- of logs, you need to be able to comb through that data really quickly. So, automating that is critical. You’re starting to see more artificial intelligence (AI) and machine learning (ML) take over in that space. A lot of the more recent products are using those technologies to identify threats before an analyst would have caught them manually.

Gardner: As we mentioned before, we have to be concerned about our suppliers and partners --- perhaps more than ever. They can come under attack as well. How has that changed how you look at your suppliers?

Nuss: As far as our suppliers go, we’ve started to take a deeper look at the supply chain completely. There are a lot of smaller companies coming out with new technologies. As we look to vet things, not only are we betting on functionality, but we’re also vetting on security elements.

Just turning on an API isn't always a good thing. You want to make sure you're minimizing the impact should they have a breach and that it does not impact you as well. You have to look over the vendors and make sure they follow the best practices.

Just recently, we were looking at a product that would integrate into our customer resource management (CRM) tool to do better data mining out of Microsoft 365, Exchange, and Outlook. And, you know, we came to find out that, hey, that data is being stored overseas. They’re also injecting a bunch of email messages, and so we had concerns around those tools.

Just turning on an application programming interface (API) isn’t always a good thing. You want to make sure you’re minimizing the impact should they have a breach and that it does not impact you as well. You have to look over the vendors and make sure that they’re following best practices. If they’re not, I think it’s good to call them out and let them know. Such as, “Look, you don’t need access to all of these tables for the pieces that you’re trying to access. Let’s minimize the blast radius should you be compromised and so as to not affect us as well.”

Gardner: So, it’s services-subscriber beware, right?

Nuss: Absolutely. You know, with some of the other things that are playing into it as well, with the mobile workforce, you have to secure the edge and make sure you have good endpoint controls, firewalls, and other components.

That was one of the things where Bitdefender rose above the rest for us. They were able to store those things, looking at other cloud storage providers. You know, you also see shadow IT out there. I cringe when I hear people that don’t have corporate policy around cloud storage and where they’re putting up data using things such as Dropbox or Microsoft OneDrive. It’s okay to use those, but make sure you have a governance policy around them, such as a backup strategy and how you’re going to secure that data.

Gardner: We have seen a lot of cloud services use sprawl and ungoverned use, for sure. Eventually, you have to gain maturity about how you do that.

Let’s hear about Heartland Business Systems (HBS). Tell us about your company. What you do, and what do you think distinguishes you from other managed service providers (MSPs)?

Widespread, yet local service

Nuss: HBS is based in the Upper Midwest, we’re just south of Green Bay, Wisconsin. We’re now up to about 12 locations throughout Wisconsin, Minnesota, Illinois, Iowa, Nebraska, Missouri, Arkansas, and Arizona. We have been around since the 1990s, with around 650 total employees and about 350 technical service professionals across many specializations.

People often ask what sets us apart from the other guys in the industry. I think there are a couple of things. We have both breadth and scale. We also believe very heavily on having in-market expertise where we have a physical presence. We try to have expertise so that when our teams are going out on-site, we deliver a quality experience. We’re not always relying on engineers from the center of our company, so to speak, to roll that out.

Our expertise is widespread. So, we not only do the normal networking- and systems-type work -- with a robust Microsoft practice; we’re a gold partner in 16 of 18 different competencies -- we also have an enterprise security and risk management team. [They can also help when] you’re doing compliance audits, vulnerability assessments, and penetration testing. Just in December, we purchased another company, Pratum, that has a SOC-as-a-service offering. It will be interesting to see how that plays into our security offerings over the coming months.

Gardner: When you talk about breadth and scale, that sounds like you have to scale not just up but down and sideways, if you will. That means servicing a lot of different types of organizations across a lot of different industries. So how do you serve that variety? How do you scale up and down and remain efficient?

Nuss: It’s sometimes difficult to address all the different markets. Our total market is pretty much comprised equally and in thirds: of small-and-medium business (SMB), medium-to-large enterprises, and then the government and education spaces.

Sometimes those needs are very different. You have to have offerings that address the needs that they all want. In the SMB space, they typically don’t have security professionals, so we end up being the security professionals for them.

In the enterprise space, a lot of times it’s more of a co-managed solution set. You have to have solutions that address the needs of each of those different classes. For us, we have separate engineering teams in a lot of those spaces, where they focus on specific technology stacks for the specific market segment. They become more expert there, with a SMB-type engineering staff as well as an enterprise engineering staff. They focus on different manufacturers, in some cases, and more elaborate technology at the higher end of the spectrum.

Gardner: With a sizable public-sector business, and I have to assume quite a bit in education and schools, how is that a challenge for security?

Nuss: The biggest challenge in the public sector is often budget. A lot of times it is so focused on hardware migrations – the replacing of endpoints at the desktop, networking, or servers – that security gets overlooked, even though it’s more and more important.

On the IT side, we look at building best practices around policy. Everything starts with that policy, and then you can measure against that policy as you move forward.

Also, for them, they’re trying to solve physical security concerns in addition to IT security. So, we work with customers on things like video surveillance systems, ID badges, and access control systems.

On the IT security side, we look at building best practices around policy. Everything starts with that policy, and then you can measure against that policy as you move forward. They are also moving to devices that may have less susceptibility, such as Chromebooks where they’re not storing data locally. They’re storing it up in the cloud so they can better protect those cloud assets. They are then less worried about the endpoints, but you definitely have to begin with that comprehensive policy and then obtain the tool sets that goes with it.

Gardner: Is there a positive pay back when you automate more, go policy-driven, and use cloud and multi-tenancy to their full effects?

Multi-tenancy critical in the cloud

Nuss: Yes. For us, multi-tenancy is absolutely critical. I run our cloud services division, our data centers. We have two data centers. As we looked to security tools like endpoint security, it was absolutely critical that these things were multi-tenant. We had products before we found Bitdefender to support 20,000 endpoints through a single management console. To roll out that type of scale, you have to have consistency. There are a lot of great security tools in the marketplace, but if they don’t play into your operational processes at scale, they really don’t do you any good.

As we evaluated for endpoint security, and EDR specifically, we needed to make sure that number one, it was a good product. We looked at MITRE ATT&CK trends and things like that to see where they were playing within the Mitre framework. But number two is how did it work into our processes and into our tool sets?

Could I have a global policy that I could roll out to everyone, so they knew that I had consistency? It’s inefficient for me to go touch 600 different customers within that portal to make one change. I need to make it at a global level and have that be inherited down the chain. At the same time, we have more enterprise customers who want control of those policies themselves. We were looking for a tool that would allow us to give them the access rights to customize the policy or manage their portal as they saw fit. So, we really like those aspects of it specifically.

Gardner: When you try all kinds of new services and products, one of the challenges in security is the sprawl of having so many tools. What do you look for when you’re evaluating your security suppliers and services when it comes to how well they integrate services, in how well they combine tools and meet more requirements, so that you don’t have to?

Tools and services work well with others

Nuss: A lot of times we’re looking for integration. We’re a ConnectWise shop end-to-end so we’d like solutions that integrate into that tool set. Whether it be pushing the software out through ConnectWise Automate and those kinds of deployment tools, or whether it’s alerting within the tool set to let us know that there’s been a ticket that’s been created, or better yet, even closing out that ticket once it’s been remediated.

Those capabilities are very important to us. You can’t just use email anymore to notify people of issues that arise. It just becomes noise and we’ve consulted with customers where they have things like monitoring solutions.

You can’t have a better example than we had when a city government here locally had a ransomware attack. They had security tools that actually notified them the day before that the hacker was in the system, but because of all the noise, they didn’t have the alerts tuned enough and the processes well defined enough so that they missed the alert. The next day, they were hit with ransomware and encrypted across the entire environment. So, you know, lesson learned -- it’s not just about having the tools to block attacks. It’s also about having the processes in place to react when the chips are down, right?

Gardner: Yes, and it integrates into your processes as you pointed out in your help desk or SOC and your other systems that are already in place. You have to take advantage of what you put in when it comes to fast remediation, fast alerts, and email just doesn’t cut it.

Okay, let’s think about reporting and data and understanding what’s going on. It’s about having information to the right in the right ways. What do you look for when it comes to reports for that that single view, or one throat to choke, if you will?

Nuss: We need to be notified of the alert immediately. We’ve created mechanisms that if there is a critical alert, it’s sending a page out to people that are on call and setting off other alarm bells for us to react very quickly.

From our SOC services perspective, we outsource much of our MDR services. So, we create workflows with those vendors that are overseeing some of those security aspects on who should they call first, and how that escalates through our system so we make sure that those can be addressed quickly.

From our SOC services perspective, we outsource much of our MDR services. We create workflows with those vendors that are overseeing some of those security aspects on who should they call first and how that escalates through our system so they can be addressed quickly.

I tell this story to a lot of our prospects. It was the Friday before Fourth of July weekend, and I got a call from one of the SOC analysts telling us that we had someone in one of our client’s environments They were making some lateral movements and they were pretty convinced it was a hacker.

Had that gone on for another three days, who knows how they would be? Now, the good news to the story is it wasn’t actually a hacker. They were having a penetration test done within their environment over the weekend -- so no harm, no foul there. But, you know, had that been somebody that was in there, you hate to even guess how far they could have gotten throughout the environment, how pervasive that could have been without having someone notified quickly.

Many of our clients have seen that in one of their portals. Had they gone in there, they might have seen it in an email when they got to it, maybe the next week when they got back from vacation. But when it comes to security time is money.

Gardner: Let’s look at your security solutions choices. How was your journey in terms of solving these issues?

Nuss: There are two aspects to it. As we looked at endpoint security, we spent more than a year analyzing different platforms. We looked at all of the major vendors out there, the Microsoft Sentinels, the CrowdStrikes, the Sophos, you name it -- we looked at all of them. We narrowed them down from their “based-on” capabilities, based on some of the tools set integrations, based on their go-to market strategies, some competitive natures. Then we went in and started doing field trial tests, so we put them in place. We would kick the tires, tested integrated to our tools, to make sure those workflows came through, and then we moved forward from there, rolling that into our offerings.

It’s a pretty detailed process -- one that was probably more detailed than many of them out there. That’s a big aspect of making sure you’re not just jumping in and saying, “Well, this one’s rated really well. Let’s just take that and move forward with it.”

One of the competitors in that particular space that we looked at -- we really liked the product, but we also looked at financial capabilities of the company. You know, they should be profitable. They shouldn’t be hemorrhaging cash left and right. You need to make sure that they’re going to be in there for the long haul. Having been in the IT space for 30 years now, we’ve seen a lot of great vendors come and go. And so that’s almost as important -- their financial viability -- as is the technology.

Gardner: How much further do you have to go to get to where you need to be?

Operational maturity for success

Nuss: It’s always a constant evolution. With security changing so fast, we try to look at what is integrating more openly. Who has APIs to integrate into other tools?

Talking about Bitdefender, with this recent acquisition that we have had, they do a lot with Microsoft Azure Sentinel, so we’re working on an integration into Azure Sentinel so that we can have cross-platform capabilities and a layered approach.

We want to make sure the tools that we have can integrate with the overall platform so that we can pick and choose the right platform to deploy to our customers. The other piece of it is you really have to work closely with the customers to make sure they have proper operational maturity levels.

I look to five different levels of operational maturity, and you should move up and to the right in the levels. You should take that same approach with security. Make sure you’re starting with the core components to make sure that you have the big building blocks there first -- such as endpoint security, firewalls, advanced threat protection, on-site and off-site backup, and policy management -- before you move to some of the next-generation, such as SaaS technology, zero-touch network access, zero trust at the endpoint level, and DNS protection. You can go on and on and on.

Security awareness training is also key. For example, our enterprise security and risk management teams came up with a top 10 list that we present as a place to begin. And then we start to talk about where to go as your budget allows.

The other big thing is to get out in front of the process from a budgeting perspective with your clients. I tell them that security costs are probably five times what they were just five years ago, but we don’t necessarily see that in the budget. A lot of times, IT has a real struggle relaying the value of that to the business leadership.

Get out in front of the process from a budgeting perspective with your clients. Security costs are probably five times what they were just five years ago, but we don't necessarily see that in the budgets. IT has a struggle relaying that value to their business leadership.

I like to tell stories and relate things back to what I’ve seen in the past. For example, I was at a trade show and one of the security analysts was telling us about a letter he received the day before from one of his MSP clients. It was basically an extortion letter from a cyber attacker who said, “We’ve been in your business for the last 30 days. We have 300GB your files. Here’s the list of files we have. You can pick any three, and we’ll send a copy of the files just to prove that we have them.”

This was purely financial: “Here’s how much money we want. And by the way, if you don’t pay us, we’re going to start calling every one of your competitors and every one of your customers to tell that we have your data and then try to extort them in the same fashion.”

You tell that story to a business owner and it almost makes you sick. Those types of things are happening out there every day. A lot of times, I don’t think they’re very well publicized because people don’t want to know who has been hacked. But it’s real, and they need to react to it and take it seriously. By telling those stories, or if they know somebody who has been hit up for ransomware or extortion, whatever it may be, those stories make a big difference, too.

Gardner: On measuring that value, what are your most important key performance indicators (KPIs) to demonstrate to your leadership that you’re spending your money properly and wisely? When it comes to things like EDR and what Bitdefender is providing for you, how do you measure the value?

Nuss: That’s always a tough question. At the end of the day, we look at where we see threats and infections and the reactive support needs. We have an incidence response team here to help clients. And we try and track what’s happening there -- how many alerts, remediations, and things that are fixed on a monthly basis to prove value.

From an MSP perspective, we send out reports to our clients showing all the security events that we’ve seen. These are the things that have been blocked to make sure that they understand the value that’s there. Otherwise, the value is out-of-sight, out-of-mind, right? If they don’t have a problem, they don’t necessarily think that any problems ever existed because you’re blocking something. You’re doing a good thing, but they don’t always realize that.

Gardner: Of course, not being hacked or ransomed or extorted also factors pretty high up there.

Nuss: Yes, for sure.

Gardner: Okay, let’s look to the future. What comes next? What are you looking to do in the next three years?

Take down tool sprawl

Nuss: Some of the big things that we’ll look at include which tools are working better together and where we can consolidate reporting. So, combating tool sprawl. It’s a real problem out there, trying to bring reporting from the different tools together so we can show the overall, cohesive strategy. That is going to be more and more important.

We want to work with vendors that are really open. I would be surprised if we don’t see more of the security vendors adopt standards where they’re sharing things in a more cohesive fashion. Whether it’s endpoint security, DNS protection, or zero trust – ways that security threats can be more consistently delivered to reporting mechanisms to develop better overall dashboards.

You’ll start to see more API integrations, where you have reporting tools that now are able to work with vendors to block things. So maybe your endpoint security is integrated into your SOC services. You could, at the click of the button, have a disconnect or block of a particular event automatically -- or even manually -- when they see those issues without necessarily having to move into different tools.

That’s where you’ll see the automation components come in. And then they’ll start to create workflows that work with that, so if an event is triggered, they can use that to run scripts against things to start to shut things down or just connect them or remediate at inception to prevent it spreading. That’s where I think things will be headed more and more.

Gardner: I’m afraid we’ll have to leave it there. You have been listening to a sponsored BriefingsDirect discussion on how IT services providers are moving beyond past practices to seek out more automation, integration, and acquiring modern security solutions as a service.

And we’ve learned how Heartland Business Systems is seeking new ways and new partners to assure that security incidents are kept in check across a variety of hybrid IT services and scenarios.

So please join me now in thanking our guest, Jason Nuss, Vice-President of Cloud Services at Heartland Business Systems in Little Chute, Wisconsin. Thank you so much, Jason.

Nuss: Thanks for having me, Dana.

Also, a big thank you to our audience for joining us. Please pass this on to your IT and security communities, and do come back next time.

Listen to the podcast. Find it on iTunes. Download the transcript. Sponsor: Bitdefender.

For UK MSP, optimizing customer experience is key to successful security posture and productivity

2023-03-30T09:00:00.039-04:00

Transcript of a discussion on how Scottish MSP Grant McGregor takes the customer experience imperative to new heights, especially as its users move increasingly to hybrid IT models.

Listen to the podcast. Find it on iTunes. Download the transcript. Sponsor: Bitdefender.

Dana Gardner: Welcome to the next edition of the BriefingsDirect podcast series. I’m Dana Gardner, Principal Analyst at Interarbor Solutions, your host and moderator.

Gardner

For managed service providers (MSPs), making the IT infrastructure as invisible as possible isn’t just a “nice-to-have" — it's also elemental to delivering the best customer experience.

Securing IT for these tech services and support users is no different. The less complexity and interference with productivity from the underlying security apparatus — the better.

Today’s BriefingsDirect security innovations discussion examines how Scottish MSP Grant McGregor Ltd. has taken the customer experience imperative to new heights — even as its users move increasingly to hybrid IT models.

Here to share their story of better managing the security experience as a means of enhancing the overall IT services value are our guests, David Lawrence, Co-Founder and Director of IT Support Services and Advice at Grant McGregor in Edinburgh. Welcome, David.

David Lawrence: Thank you for having us.

Gardner: We are also joined by Paul Sinclair, Head of IT Service at Grant McGregor. Welcome, Paul.

Paul Sinclair: Hi, Dana. Many thanks for allowing us to have this opportunity to share our story.

Gardner: David, what are some of the top trends driving the need for MSPs like yourselves to provide risk management solutions that go beyond just endpoint security?

Lawrence: We typically talk about the threat landscape in the context of the threat actor. What we’ve seen over the last couple of years -- with the need for hybrid working – is really focusing now on keeping the honest, honest -- and the right, right. That’s the knowledge worker, the poor person in the organization who’s trying to do the best they can in a challenging environment.

Lawrence

We see organizations doubling down and asking for our advice on helping them stay right, and that’s through conditional-access policies to protect the organization while away from the central network and with security-awareness training that helps educate those people on best practices.

With cloud protection and cloud backup, a lot of organizations have made further grounds into the cloud landscape on how they can best protect their organizational data. Critically, people are more aware now of managed detection and response (MDR) and extended detection and response (XDR)

services. They feel that they want a security [blanket] on their organization wherever those people might be working.

Gardner: Tell us about Grant McGregor. What distinguishes you in your mind from other MSPs? How do you enhance your customer experience in particular?

Work safely with right tech support

Lawrence: With 20 years of experience in delivering world-class people support and technology services, we’ve now grown to 21 people who deliver support and advice to more than 1,500 customers and their endpoints.

We want our customers to thrive by creating better and safer places for them to work. And that’s critical. People want to be productive. They want to feel that they have an MSP like us watching out for them. Our service desk team delivers people-centric support, protecting the people themselves and their endpoints. We provide proactive support and administration -- just like an outsourced IT department would.

Our professional services team delivers what we consider a standard practice, but I’m amazed that sometimes it’s not. That’s the quarterly business reviews. Those are really important for providing the advice and guidance for our customers as they make and continue the journey to Microsoft Azure cloud – with security as a service (SECaaS), cloud as a service (CaaS). I think our strength is triage with all their other partners in that sort of technology ecosystem.

Gardner: Paul, how are your needs for securely delivering IT services and support different from three years ago? What are some of the trends driving your ability to adjust and improve to deliver the best possible experience for your customers?

Sinclair: Well, as you know, the world is a much different place than it was three years ago. We’ve had to adjust our own practices. We’ve had a pandemic; we have other crises in the world at the moment as well.

Sinclair

So, we’ve had to adjust as a business and learn how to work remotely, work in a hybrid model, but at the same time deliver that high-end, 100 percent world-class service that we too strive to do. Not only that, but we’ve also had to support our own client base and our client users with their hybrid and remote working needs by identifying and delivering the right security products that keep our customers safe – and their customers safe, as well.

Lawrence: It takes a layered approach. For example, only yesterday we had a threat actor maliciously trying to sneak through. So it requires a number of protection measures in place -- from email protection, to education, to security awareness training, and filtering, as well as using Bitdefender’s Managed Detection and Response (MDR).

And it was only at the last minute through the human firewall, of clicking on the link to remove that email, using Bitdefender, in this case, and the MDR service. It had our back and blocked it. So, again, we’re very focused on educating our customer base. No one size fits all. What we need is a layered approach to security.

Gardner: Because you’re servicing different regions of the UK and you’re servicing different-sized organizations, you need to readily scale up and scale down. How difficult is it to serve the biggest and smallest of your customers?

The future is co-management

Lawrence: There are some challenges. Our sweet spot is probably the 20- to 70-seat-sized organizations. And we’ve strategically made our people-centric services agile enough for those numbers.

The criticality of that is that we want strong partners and strong solutions. We need to know how those solutions work to gain the best out of them. Then all of our people can know what they’re meant to be doing. That’s always been a bit of a journey.

Where we are now is we’re very confident that in using providers like Bitdefender, Proofpoint, and N-Able that we are using leading-edge solutions. But critically, there needs to be a partnership, and that needs to come from our providers.

Our next growth is through co-managed IT services. That's a really great place to be over the next couple of years. We can take what we've learned, the tools we have, and our partnerships and deliver those at scale to help our customers.

Our next growth is through co-managed IT services. That’s a really great place to be over the next couple of years. That’s because we can take what we’ve learned, the tool sets we have, and our partnerships – such as we have with Bitdefender -- and deliver and scale those co-managed security services to help our customers’ stressed and time-strapped IT departments.

Gardner: What do those co-managed services typically consist of?

Lawrence: You’ve seen the data. It’s incredible in this day and age that a lot of organizations -- even still in the UK -- are not patching the way they should. You would think that would be the number-one priority for these IT departments, to patch with the latest Windows updates, and on the applications, too. But that still isn’t the case. We’re cyber essentials assessors, and we see that for our non-support customers.

So, we want to help them and allow them to focus on the strategic side of their organizations. We have the tool sets to enable them to patch their endpoint devices effectively and attain that very minimal first-level knowledge that they’re secure. And then we can work with them on the SECaaS value. That’s where we can add real value from the experiences we’ve learned from and from the partnerships that we have.

Gardner: Paul, how do you overcome the challenges your customers have with integrating security tools? So often security consists of many different tools, many different underlying technologies. How do you go about that making that all invisible to them?

Sinclair: When David and I first started out many years ago, you needed different applications from different vendors to secure all the threats that were out there. But it was a lot of work and took a lot of time and effort using different products. Over the years, Bitdefender has given us the capability to have a security suite of web protection, a firewall, endpoint protection, USB control, and other security options.

Having this one product as a cloud-based solution -- and that has the integration options with our professional services automation (PSA) and remote monitoring and management (RMM) system as well -- allows us to deploy basically one RMM agent that allows several different security controls to be deployed to any PC at any company very, very quickly. It makes the technical support of that extremely easy. It also makes the deployment and the onboarding of new customers very efficient.

Gardner: Yes, as more of us are more remote across organizations, that has hastened the movement to a remote control agent approach to security. Do you agree, Paul?

Sinclair: Absolutely, yes. It certainly makes it easier than back in the old days of running around to different PCs and asking users to give up their time during the day to allow us to do that. Now we can do that remotely, silently, and very effectively.

Lawrence: We have seen in our MSP peer group in Scotland, and in the UK, that they are cementing their processes and procedures around one or two key products, and in some cases the customer solution. I’m sure this is the same in the United States among mature MSPs. You can only support what you know. You can only train and certify on one key product and in one key area to be the master of one, but not necessarily the master of many.

With Bitdefender, and the other security partners we have, this allows us to focus -- but also put that known stack in place for customers, knowing that we have their backs. And sometimes there are awkward questions from the customers, saying, “Well, you know, I kind of prefer to do it this way” … or “Can I keep this or that security solution?”

Well, we learned from maturity and having the right security posture that the answer needs to be, “No, the answer is no. We’re putting our security stack in to best protect you. And you can hold us accountable, but it needs to be our technology, provided by our partners.”

Gardner: Even as so many organizations are moving to the cloud model, so much of security issues comes back to email. Especially in smaller organizations, email remains the source of a lot of security hiccups.

How important is picking the right email partner and tools in your overall security posture? What have you found as the right approach to a steady path of productivity given the inherent risks of email?

Lawrence: So, as recently as six years ago, we were probably spending about 60 percent of our day managing email security. You know, the false positives, the stuff that shouldn’t be getting through, and all of the headaches that come from malware and ransomware. It was causing us real pain points.

Manage email to educate users

Sinclair: There are global threats and new sophisticated ways that we’re seeing daily through which criminals are trying to harvest your data. You need the right email security solution that keeps up with the times. Those providers can figure out for you what the new threats are on the back end. Also, we’re no longer having to log on to the systems daily or weekly and tweaking the settings here and there like we used to.

Email security training for end users is a big must now, and we're promoting that to our clients. It only takes one lapse in concentration. Then before you know it, you can be in some serious bother. I'm a big champion of email security training.

One point I would emphasize as well is email security training for the end users. It’s a big must now, and we’re promoting that to our clients. It only takes one lapse in concentration when some of these busy workers remove a dodgy email from quarantine. Then, before you know it, you can be in some real serious bother. So, I’m a big champion of email security training as well as being on top of your security solution updates.

Gardner: Right. Even using the best technology, being successful at security reverts back to behavior. It’s an intangible aspect to all of this. Also, as providers of the best customer experience, you want to embed security measures, make them invisible. That means you need to have the instant visibility into what’s going on in order to react.

So, how well do your tools provide the insights needed to fully exploit the security technology?

Lawrence: There are two sides of the coin when it comes to visibility. One is the proactive nature of being able to look at the data in real time and to make assessments, and the other is to then feed that back to the client.

The reactive nature of the security tools is probably most important because you want to jump on that quickly and effectively to remove threats and then to communicate that to the customer -- what’s happening real time -- and how we’re helping them to quickly get back to a safe place.

We’re choosing solutions that are mature, are a good fit for us, and that also integrate into our PSA and RMM systems. And, you know, Bitdefender, Proofpoint, and other solutions that we use all have APIs (Application Programming Interfaces) that allow us then to interconnect services whereby we can build automation and remove the noise.

A lot of the time now, the artificial intelligence (AI) solves problems for us. Other times, we still need the technology support officers in our organization to see the threats and react quickly. Again, only yesterday we had an incident. Thankfully, the third layer of security jumped in -- and that was Bitdefender. We were all over it very quickly, and we could jump into the ConnectWise and other systems and say, “Yeah, we know exactly how that threat transpired and where it came from.”

The first gate was closed, but the user opened it. The second gate was closed, but the user decided to open that one, too. And lastly, the third gate was definitely shut and was definitely not opening. And that was Bitdefender MDR.

Everything in the world is so quick now, much quicker that it was 10 or 20 years ago. Everybody wants to be able to report data and jump on things quickly. So, yeah, it’s just the right tool set that integrates into our solutions.

Gardner: Paul, what do you look for when it comes to consoles and a management overview? Or even taking the next step to provide compliance and auditing requirements? How do those fit into your customer experience needs when it comes to visibility?

A single pane of transparent glass

Sinclair: We use a reporting service that hooks into our PSA and different security solutions. We send these reports automatically and directly from the product set to the clients on a monthly basis. It shows the non-human tickets, but it also demonstrates the trust in the security services because it shows items that have technically been blocked, deleted, or quarantined. As part of the AI process that David was talking about, these tickets are logged, the product has done the job, and then the ticket is closed.

For us, we’re showing the added value that the security solutions are providing for the client. So then, they have transparency of the tickets that we are doing -- and the security solutions that we’ve put in place as well. That’s automated so we are not using the time on the person’s device to do fault finding. And, for us, we found that is really valuable, these reports, and the clients certainly do as well. They look forward each month to receiving them, and we get feedback on them every month. It’s a great service and tool that we’ve built for that.

Gardner: David, you mentioned Bitdefender and the tools you’re using from them. Give us an overview of what you’re using and how they fit together to meet your needs as an MSP. I’m also wondering if you’re relying on the Bitdefender Security Operations Center (SOC).

Lawrence: We’ve been with Bitdefender for a number of years now. The irony is we were using malware solutions in the past that had a Bitdefender engine. The irony was the vendor just wasn’t just cutting it for us. So, we went to work with Bitdefender directly. We have the confidence that it’s a grown-up solution.

They have been around for many years, and they’re always at the forefront of the technology. The way Bitdefender works for us is we use Bitdefender GravityZone, so every one of our customers will have that standard stack. And then, on top of that, we use Bitdefender EDR and advanced threat technology to secure the endpoints. So, for us, that’s just a given. It’s got that great layer of protection.

The solution doesn't just reactively address threats. They do threat hunting for us. ... There have been so many occasions this year that Bitdefender has jumped onto alerts and challenges with endpoints. ... They really have delivered on the MDR service.

I think of those horrible words in our industry, the “single pane of glass” expression, but that’s what it provides. The Bitdefender GravityZone always evolves, changes, and develops. And, for us, that single pane of glass is a very good system to go in there and see what’s going on in that environment. Last year, we adopted the MDR service from Bitdefender and dipped our toes in that with a couple of our professional services customers.

The solution doesn’t just reactively address threats. They do threat hunting for us. We give them a lot of information on the customer. They look at domain names, their threat landscape, and provide that in a security center so that we can resell that to our customers. We were open to our customers about who ultimately was providing that, and we would work with that partner to have our customers’ back.

There have been so many occasions this year that Bitdefender has jumped onto alerts and challenges with endpoints. And then ultimately we’ve worked together, even saying, "That’s fine, let’s exclude that," or as was the case yesterday, they blocked that threat -- and that’s what we want. Sometimes when you hear technology providers say, “Here’s the service,” and they describe it, you think it’s too good to be true. And actually, that’s not been the case for Bitdefender. It really has worked, and they really have delivered on the MDR service.

Gardner: Paul, anything you’d like to add to your use of Bitdefender, and then also the SOC opportunity?

Sinclair: In terms of the SOC, once we are able to give the right information to Bitdefender, do you know what that allows us to do? It gives us the confidence that the user habits on the PCs are being monitored, and anything that’s unusual is being picked up on.

One of the first things I remember saying to David, once we started seeing the results coming through, was, “Do you know what? I can go to bed at night now and have that good night’s sleep that we never used to get.” You know, you had something niggling in the background. But now I go to bed at night – or on the weekends – with that confidence that user habits are being monitored and looked at and picked up on. And that’s whether that user is in the office, working late, or it’s irrelevant of whatever location in the world they’re in. We know it’s being monitored. For that, and what we did, it’s just second to none.

Gardner: A lot of the benefit that large, sophisticated enterprises had when it came to monitoring behavior and analyzing it didn’t translate down to the smaller organizations, of say 40 to 50 seats. But now with SOC-as-a-service, if you will, the very best of analysis and behavior tracking can be brought to just about anyone.

Sinclair: Absolutely, because when you go to smaller clients than that of 10, 20, or 25, where the user behavior is not necessarily at a company level, they’re still being monitored -- and they’re able to work elsewhere.

We had an example not long ago where an end user decided that they were going to go on holiday and still work, but not let the organization know that they were away. They couldn’t do anything because Bitdefender realized the PC was out of the country and was trying to connect through unsecured networks -- at hotels, restaurants, and things like that. It just blocked them from being able to do anything. So, we were approached by that user, and we were able to then pass that information back on to the client organization ourselves. We acted as the eyes and ears for them.

Lawrence: When we integrated our organization using the Bitdefender MDR service, they had the goal of securing and providing us a SOC capability to the smaller businesses.

Before that, a couple of years ago, there was a manual process between us and the team in the States. We were filling in a spreadsheet, giving them as much customer information -- with the customers’ support -- to understand their organization and ultimately the threat landscape.

Fast-forward a couple of years, and Bitdefender has given us the maturity and MDR foundation so that the process for us as an MSP is a lot easier to get our customers on board with that SOC service. Now we don’t need to spin up a spreadsheet and fill it in. We can jump into the single pane of glass that Bitdefender provides and put up that service straight away and provide them all the information to get those customers secure and enjoying that SOC center.

Gardner: I’d like to quantify some of what we’ve talked about. So, I’m looking for metrics of success. What ways do you measure the overall impact on your customers and their experience? How do you know you’re doing it right and whether your suppliers like Bitdefender are getting the job done?

For happy clients, take their temperature

Lawrence: As an organization, we’re really focused on customer experience, and we have a customer improvement board in our ConnectWise system. We’re consciously seeking that and adjusting feedback from our customers accordingly.

And what’s great with the right tool set in place is it’s so different from the noise that we were describing earlier, about having the wrong security product years ago, and all the wrong malware and ransomware protection in place. It really caused us headaches.

Years ago, our customer happiness was around 94 percent. But over the last 12 months, we've had a score of 97.8 percent. That's telling us we're doing as good of a job as we can. ... We're very happy.

Now, when we review our customer happiness factor, we use Customer Thermometer. And years ago, our customer happiness was probably around 94 percent. But over the last 12 months, we’ve had a customer happiness score of 97.8 percent. That’s telling us weekly, monthly, quarterly, and annually that we’re doing as good a job as we can.

We also survey the key contacts, our key client IT partners within the organization, every six months on the net promoter score (NPS). Again, that’s very positive compared to where it had been. We’re at 69 now, which I think is world class, and 75 percent of promoters. So again, we’re very happy.

And that’s not all just down to selecting the right security tools. That’s having all people that can communicate in English and set the right expectations. But again, so much of our frustrations -- and probably the industry’s frustrations -- come from the wrong tool set. We need the right tools to do our job. That’s critical.

Gardner: Paul, any favorite indicators that assure you of that good night sleep?

Sinclair: Absolutely. Looking at the numbers, we’re seeing a 47 percent decrease in malware infections between our clients from last year to this year. That’s a massive number in a single year.

And that’s not just malware numbers. That has knock-on numbers in terms of technical administration cost savings by using Bitdefender and effectively creating and closing tickets on our PSA system. That’s a 23 percent improvement so far from last year.

What it shows us is we are evolving, and Bitdefender and that technology is evolving with us in the right direction. As long as we see these numbers constantly where they need to be, then yeah, that’s amazing.

Lawrence: The old frustrations were sticking an antivirus malware protection tool on the machines and having the opposite effect for productivity. The wrong malware protection was dragging the poor machines down. I think Paul told me earlier that it was a 10 percent performance gain that we’ve had since using Bitdefender.

Sinclair: Just having that smaller footprint is a big improvement, isn’t it? That smaller footprint from three, four, or five different security products now wrapped down into one. Between the two of us, David and I have been working in this industry for 60 years. We’ve reviewed our security products so often over our 21 years at Grant McGregor from the start and across different technologies. But if the tools weren’t working for the customer, they won’t work for us.

So far with Bitdefender, we have confidence year after year. We’re no longer sitting down and reviewing the Bitdefender technology and stack. We just recommend them as our first product whenever we onboard a new client or user. Bitdefender is the first product that’s recommended and it’s the first product that goes in. Not one client ever has said no.

Gardner: Those are very impressive numbers, and I commend you for them. But, of course, we can’t rest on our laurels. We have to look for where we go next. For security, it’s never good enough, right?

So, what comes next for Grant McGregor? You mentioned co-managed services, for example. What solutions do you look to next, and how can your providers help you get there?

Keep the honest, honest

Lawrence: We’re in exciting times with exciting new technology. Without the distractions of what’s happening for us in Britain and in Europe, I think there are two trends.

As an organization, we’re focused on helping the end user stay right and honest -- and that means helping put in the right tool set. Those will be focused on data loss protection, enforcing policies for the endpoint, and education systems for security awareness.

Rather than focus – as the industry often does – on external threats, we want to keep the honest, honest. That’s, first off, an easier sell. Second of all, that means living up to our values. We are supporting the end users and the organization to navigate all the threats out there, but from internally and then outward.

The co-managed space is going to be huge. As an MSP – and there are a lot of us out there – maybe not all of us are doing the right things, but we’re all competing and trying to grab each other’s customers.

The natural direction is to the co-managed space, where we can pass on those years of experience with using the right tool sets. Unfortunately, soon in the UK, that will be to the cash-strapped IT department and the time-poor departments. They are going to need and want our expertise and advice so they can get on with doing the strategic work that they want to focus on. We’ll be providing to them the patching-as-a-service, the co-managed IT support-as-a-service (SaaS), the email-as-a-service (EaaS), and the backup-as-a-service (BaaS).

We’re already making traction in that space, and we’re excited about that. So, those two growth spots are there for us.

Gardner: David mentioned the unfortunate predictions across the globe for difficult economic times ahead. Doing more with less becomes the imperative across the board. So, that usually means higher productivity -- and that usually means working smarter, not necessarily harder.

What do you see in the next stages in terms of how you can help your customers do more with less from the MSP perspective?

Sinclair: It is all about being smarter, isn’t it? For us with the technology that David has touched on, I think we need to look a bit further into the future. And where does that take us? It takes us down that AI route and getting the users to try and help themselves along that route while we keep ourselves up to date with the latest technologies. It means watching for the new threats -- because they are constant. I see us soon taking on more AI and use more of that intelligence to keep the productivity levels where they need to be.

Lawrence: Digital transformation is a big space for customers to get their heads around -- and productivity is absolutely a must as they move to cloud services and platforms. Again, only recently Microsoft released more products and services. And, again, it’s our job as a technology provider to help educate our customers on that new landscape and to use tools such as business intelligence and to get the best from the Microsoft applications.

There’s a lot of new automation there that the customers can build upon, and I think their fear is just how they can get their heads around it. For us, it’s about partnering with the right people to pass on those skill sets to the smaller businesses.

Gardner: I’m afraid we’ll have to leave it there. You’ve been listening to a sponsored BriefingsDirect discussion on making the security infrastructure as invisible as possible as an essential ingredient to delivering the best overall IT customer experience.

We’ve learned how Scottish MSP Grant McGregor has taken the end users’ productivity and satisfaction to new heights, even as these customers increasingly move to hybrid IT models and face new forms of security risks.

So please join me in thanking our guests, David Lawrence, Co-founder and Director of IT Support Services and Advice at Grant McGregor. Thank you so much, David.

Lawrence: Thank you very much.

Gardner: And a big thank you to Paul Sinclair, Head of IT Service at Grant McGregor. Thank you, sir.

Sinclair: Thank you, Dana, it’s been an absolute pleasure.

Gardner: I’m Dana Gardner, Principal Analyst at Interarbor Solutions. Your host and moderator for this ongoing series of BriefingsDirect discussions. A big thank you as well to our sponsor, Bitdefender, for supporting these presentations.

I extend a thank you as well to our audience for joining. Please pass this on to your IT and security communities, and do come back next time.

Listen to the podcast. Find it on iTunes. Download the transcript. Sponsor: Bitdefender.

Transcript of a discussion on how Scottish MSP Grant McGregor takes the customer experience imperative to new heights, especially as its users move increasingly to hybrid IT models. Copyright Interarbor Solutions, LLC, 2005-2023. All rights reserved.

Defending the Perimeter Evolves into Securing the User Experience Bubble for UK Cancer Services Provider

2023-03-01T12:09:00.004-05:00

Transcript of a discussion on how Macmillan Cancer Support in the UK places confidence in -- and ease of use of -- overall security as both top IT and health services requirements.

Listen to the podcast. Find it on iTunes. Download the transcript. Sponsor: Bitdefender.

Dana Gardner: Welcome to the next edition of the BriefingsDirect podcast series. I’m Dana Gardner, Principal Analyst at Interarbor Solutions, your host and moderator.

Gardner

An underappreciated aspect of enhancing IT security is the impact on an end user’s comfort and trust in the services provided. In the case of health care services and support, making the patient feel welcome and safe can be a game-changer as they seek access to needed services and care.

The next BriefingsDirect security innovations discussion examines how Macmillan Cancer Support in the United Kingdom (UK) places the ease of use and sense of security in the services provided as a top IT -- and community service -- requirement.

Here to share their story on how to develop and deliver a cloud-ready security bubble around all users, their activities, and the sensitive data they share is our guest, Tim O’Neill, Head of Information Security at Macmillan Cancer Support in London. Welcome, Tim.

Tim O’Neill: Lovely to be here. Thanks for having me.

Gardner: We’re delighted to have you. Tim, tell us about Macmillan Cancer Support. It’s a very interesting and worthy organization. I’d also like to hear about your approach to securing a caring and trusted environment for your community.

For all who navigate a cancer journey

O’Neill: We have a unique organization in that when people think of a cancer charity, they often think about the medical side of it and about the pioneering of new treatments. Every day there’s something new in the media about how swallowing a leaf a day will keep a cancer away, and things like that.

But we deal with the actual effects of having cancer. We help anyone who is affected by cancer. That can be a person who’s just had a cancer diagnosis. That can be the family of someone who has a diagnosis, or their employer, or other employees. Anyone who is affected by cancer can come to us for help.

O'Neill

We don’t do a lot in the medical sphere, such as creating new treatments or testing or anything like that. We’re here to look after the impacts that cancer has on your life. We help with the patient’s pathway; we help you understand it and what the implications are – and what might happen next.

We will help you financially if you need help. We believe that nobody should be cold or hungry because of a cancer diagnosis. We provide the cancer nurses who exist in UK hospitals. We train them and we fund them. We have specialist care centers. Again, we fund those. Our psychological care is done through a third party as well. But we manage that, we fund it, we maintain it. We also have an arm that lobbies the government. So, for example, in the UK we had cancer reassigned as a disability.

This means that as soon as you have a cancer diagnosis, you are legally recognized as disabled, and you have all the benefits that go along with that. The reason for that is that once you’ve had a cancer diagnosis, it affects the rest of your life. It does not matter if it’s gone into remission. It will still affect you.

The treatments are invasive. They affect you. We work in many spheres, and we have a lot of influence. We work with a lot of partners. But the fundamental core of what we do is that you can contact Macmillan when you need help.

Gardner: And to foster that level of support, to provide that trusted environment across the full experience, having six levels of authentication to jump through -- or not seeing your e-mails delivered properly -- can stop the entire process.

O’Neill: Oh, absolutely. And we have to be realistic here. We are talking at times of people phoning us at the worst moment of their lives. They’ve just had something come out of the blue or the treatments have gone badly, or they’ve had to have that horrible conversation with their loved ones. And it’s at that very point when they need to talk to us.

We have to be accessible exactly when people need us. And in that instant, we can be the difference between them having a completely honest open, and frank conversation -- or having to sit and suffer in silence.

Asking them, “Oh, can you go and grab your mobile phone? Yeah, and stick your fingerprint on there, and now that password was not recognized. You need to change it. And by the way, sorry, that password didn’t have quite as many exclamation marks as we need. And so, now if you’d like to turn on your webcam and log in using a photo, then we’ll let you in.”

You can’t do that. We have to be accessible exactly when people need us. And in that instant, we can be the difference between them having a completely honest, open, and frank conversation -- or having to sit and suffer in silence.

Gardner: Well, I don’t envy you your position, Tim. On one hand, you have sensitive healthcare and patient data that you need to protect. On the other hand, you need to make this a seamless and worthwhile experience.

How do you reach that balance? What have been some of the challenges that you’ve faced in trying to provide that proper balance?

Keep everyone secure by managing risk

O’Neill: Everything is risk-based. We look at where you normally phone in from, or if you’re a first-time caller, or “Are you in a location that we trust?” “Are you in a number range that we trust?” Things like that. What’s the nature of the conversation you’re having with us?

There are a number of parameters. Not everything is a high-level risk if you are just phoning us, and you simply want to talk. If you don’t want to impart any special information or anything like that, then the risk is low. Everything is measured against risk, which is a mentality change in the organization.

And, you know, I’ve been in conversations where people say to me, “I don’t like that idea … I think somebody got it wrong” without quantifying the risk. It’s not good enough.

But if we understand exactly what the risks are, then we can understand what controls can mitigate those risks. We can choose the effective controls for mitigating the risks. And then we can take the actions and do the tasks to enable those controls.

For example, with multi-factor authentication (MFA), if your workforce is five people working from one office and you have no remote connections, that’s potentially the wrong security control. Your controls could be completely different. They will have the same effect, but they will have a more positive impact on the end-user experience.

That’s the narrative change that you have to have. One of the most challenging things, when I first came into the organization, is when we were transforming IT systems. We were starting to understand how people wanted to interact with us digitally.

Historically, our interactions had been very much face-to-face, or through phone calls as well. And with COVID, obviously, all of a sudden, all of our interactions changed. So, it became, “How do we make it so that the legacy IT systems, users, and accounts can be migrated to new, safe methods without getting rid of the history of conversations they wanted to keep?” We didn’t want to lose the knowledge that we had and the relationships we had created with these individuals.

If you’re sending emails out to people saying, “Oh, we need you to change your log-on credentials because we’ve moved to this new IT system, et cetera, et cetera.” … If that person is sadly deceased -- we’re talking about cancer here -- then potentially sending something like that to their family is not great. So, there are lots of things to consider.

Gardner: It sounds like you’re approaching this from a fit-for-purpose security approach and then grading the risk and response accordingly. That sounds very good in theory, but I suspect it’s more complicated in practice and execution. So how, with a small security team such as yours, are you able to accommodate that level of granularity and response technically?

O’Neill: Everything starts complex. Every concept that you have starts off with a million boxes on the screen and loads of lines drawn everywhere. And actually, when you come down to it, it becomes a lot simpler.

When we get to the bottom level of this: What are the risks that we are trying to mitigate here? We are trying to mitigate the fundamental risk that an individual’s information may end up with the wrong person. That’s the most important risk that we’re trying to manage.

Start off complex, and then bring it all down to the simplest level, and focus on the one thing that actually matters, which is the risk.

And bear in mind that people will tell us about their cancer diagnosis before they’ve even spoken to their family, friends, … anyone. And they will phone us at the darkest moments and talk about suicidal thoughts. Those are conversations that you do not want anyone else to have visibility into.

When we get to such a stage that we are entering into something problematic on privacy or risk, at that point, we will do extra validations. Again, it’s all based around the particular risk. You have your conditional access element risk whereby you’re looking at where people are coming from. You’re looking at historical interactions from that location and you’re extrapolating that information to have a choice made automatically based on it.

But then you’re also talking about training of individuals where they don’t need to go through vetting questions at the start of conversations but once they get to a point where the nature of it changes, and the data risk of that conversation changes, at that point controls need to be applied.

Start off complex, and then bring it all down to the simplest level, and focus on the one thing that actually matters, which is the risk.

Gardner: Well, at the same time as you’ve been embracing this model of risk-balancing, you’ve also faced a movement over the past several years to more cloud-ready, cloud-native environments. And that means that you can’t just rely on programmatic web application firewalls (WAFs) or creating a couple of filtering rules for your network.

So, how do we move securely toward such a cloud or mixed environment? How is that different from just building a security perimeter? Previously, you’ve mentioned to me a “security bubble.”

Remain flexible inside your security bubble

O’Neill: The new models are different in a number of ways. What’s historically happened with information security is somebody says, “I have this new system.” Then you ask, “What’s the system? What’s the risk? What are you doing with it? Where is the data going?”

And so, you designed the security around that system – but then you get a new system. Is that one okay? Well, then you design a new bit of security. You end up with a set of tools that you apply to each one. It’s slow, and it’s prone to failure because people design the system first and its uses change. It can also lock the organization in.

If we take an incredibly simple thing, which is the storage of data, an organization might say, “We’re an Amazon Web Services (AWS) cloud house.” Wherein it’s your house, but as we mature with these cloud strategies, people are going to start leveraging economy of cost of storage by moving their data dynamically to the less expensive storage locations. And when one cloud storage offering is cheaper than another, then your data will fly across to that.

We can’t work in the old way anymore within cyber security and information security. What we have to do is create this security bubble that we’ve been talking about. It allows the organization the flexibility to change the security strategy.

For example, every year or two, we suddenly go, “There’s a new threat. Here it comes.” Yet every threat works in fundamentally the same way: You have to get in, you have to get the rights to see what you’re doing, and you have to be able to move around. If you break it down to those basics, that’s what everything in security needs to do, really.

If we can start to move to this bubble, to say, “We know what our data is, we know who our users are, and we know who they’re going to interact with.” Then we can allow people and organizations the flexibility to do what they want and only block the high-risk events within that.

If your data leaves the bubble, and it’s just, “Hey, do you want a cup of tea?” kind of communication, obviously you’re not going to worry about that. If it’s something that contains risky data, then we’ll worry about that. We’ll block that.

But we have to stop thinking about application-level security and start thinking a lot bigger and more strategically about security. We may have to stop and ask the business, “Where are you going? What are you doing?” But they don’t know yet. And also, as COVID has shown us, sometimes nobody knows where we’re all going.

Gardner: Right. We need to be prepared for just about anything and also be able to react quickly, so you can’t be knee-jerk and react to every app or system differently. As you point out, you need to be strategic.

And so, part of being strategic, for an organization such as yours, because you’re supported by donations; you’re a non-profit -- you need to be cost-efficient as well. So again, it’s a balancing act between cost efficiency and being strategic about security. How is that something you’ve been able to manage?

A wise spend supports smart security

O’Neill: Well, I don’t believe they’re in conflict. If we look at organizations -- I won’t name them, that are huge and have very big budgets, who spend tens of millions on their cyber security – they have huge teams, and they still get breached. The amount that you spend doesn’t necessarily create a graph to greater security.

Spending intelligently does, and it all comes from focusing on risks. If you sit there and you say, “You know what we have to do, we have to go through the top 20 NIST or CIS methods or recommendations,” or whatever, “and we’re going to supply the best product on the market for each of those, and check the box.”

Firstly, you potentially throw a load of money away because in the end you don’t actually need it all. The spec says, “Oh, you need MFA and a WAF.” Well, actually, it’s not an MFA that you need, it’s not a WAF that you need.

What are the risks that those products are mitigating? And then, what is the best way to mitigate the product risks? It all comes down to that, when you sit back and you look at what we do for a living in information security.

We talk a lot about burnout in information security and wellness. It’s because people keep chasing their tails. Every day, there’s a new headline about a breach or a new zero day or a new technique -- or whatever it may be -- and everyone starts worrying about it. What do we do to protect against this?

But it’s about assessing the risk. And from a risk perspective, all the rest of it stays the same to a certain degree. It’s very rare that a new zero day fundamentally changes your risk.

Gardner: You bring up an interesting point. Not only are you concerned about the comfort and sense of security for your end users, but you also need to be thinking about your staff. The people that you just mentioned who are increasingly facing burnout.

Throwing another tool at them every three months or asking them to check off 16 more boxes every time a new system comes online, it’s going to be averse to your overall security posture. Is there something you look for on how you tackle this that’s also accommodating the needs of your security staff?

Monitor what matters

O’Neill: You’ll have to ask them -- but they all still have their hair. Yeah, organizations often talk about insider threats. I think it’s a terrible thing to be talking about because it’s such a small percentage. A lot of organizations treat their employees as part of the problem, or almost an enemy that needs to be monitored constantly. I don’t care if you’re on Facebook at all.

I care if you’re trying to download something malicious from Facebook or upload something like that to Facebook. But the fact that you’re on Facebook is a management issue, not a cybersecurity issue. We do not monitor things that we do not need to monitor.

For example, we were getting a weekly report from one of our security products. It was typically a 14-page report that basically patted itself on the back by saying how great it had been. “This is everything I’ve blocked,” it said. And a member of my team was spending pretty much a day going through that report. Why? What possible gain came from looking at that report?

I care if you're trying to download something malicious from Facebook. But the fact that you're on Facebook is a management issue, not a cybersecurity issue. We do not monitor things that we do not need to monitor.

The real question is … Once you read the report, what did you do with the information? “Nothing, it was interesting.” “But what did you do with the interesting part? “Well, nothing.” Then don’t do it. Everything has to have a purpose. Even to the smallest degree. I had a meeting this morning about policies. Our acceptable use policy document is, I think, 16 pages long.

Come on. It doesn’t need to be 16 pages long. I want two pages, tops. “Do this, don’t do that, or absolutely don’t do this.”

We have a mobile device policy that everyone has to sign up to. … We have a mobile device manager. You can’t connect to systems unless your operating system is up to date, all of this sort of stuff. So why have we got a policy that is seven pages long?

Say what you can and can’t do on mobile devices. Then all we need to say is, “You’ll have to adhere to the policies.” All of a sudden, we’re making everyone’s life easier. Not just the information security teams, but the normal end users as well.

It is all about working out what’s actually valid. We’re very good in information security of doing things because that’s what we’ve done instead of thinking.

Gardner: I’m hearing some basic common threads throughout our discussion. One is a fit-for-purpose approach, sort of a risk-arbitrage approach, simplicity whenever possible, and increasingly having the knobs to dial things up and down and find the proper balance.

To me, those increasingly require a high level of analysis and data, and a certain maturity in the way that your platforms and environment can react and provide you what you need.

Tell me a little bit about that now that we’ve understood your challenges. How did you go about a journey to finding the right solutions that can accommodate those security analysis and strategy requirements of granularity, fit-for-purpose, and automation?

Streamline your team’s efforts

O’Neill: When we go to market for a security product, usually we’re looking at a specific issue that we’re trying to fix and control. A lot of the products will do the job that you want them to do.

But there are a few other things we look for. Can my team log into it and very quickly see what is important? Can we go from seeing that to the action that needs to be taken? How quick is that journey?

When somebody is demonstrating the platform, for me, my question is always, “How do I get from seeing it to knowing that it’s actually something I need to do, to then being able to do something about it?” That journey is important. Loads of products are brilliant, and they have a pretty interface, but then they fall apart underneath that.

And, the other thing is, a lot of these platforms produce so much information, but they don’t give it to you. They focus on just one element. What value-add can I get that the product might not deliver as a core element, but that actually enables me to easily tick off my other boxes as well?

Gardner: Can you describe what you get when you do this right? When you find the right provider who’s giving you the information that you need in the manner you need it? Are there some metrics of success that you look for or some key performance indicators (KPIs) that show you’re on the right track?

O’Neill: It’s always a bit difficult to quantify. Somebody asked me recently how I knew that the product we were using was a good one. And I said, “Well, we haven’t been breached since using it.” That’s a pretty good metric to me, I think, but it’s also about my team. How much time do they have to spend on this solution? How long did it take to get what you needed?

We have an assumed-breach mentality, so I expect the first job of the day is to prove to me that we have not been breached. That’s job one. Next, how quickly can you tell me that from the time you turn your computer on? How much of the time do you end up looking at false positives? What can the product do every day that helps us get a bit better? How does that tool help us to know what to do?

Gardner: We began our discussion today by focusing on the end user being in a very difficult situation in life. Can we look to them, too, as a way of determining the metrics of success? Have you had any results from the user-experience perspective that validate your security philosophy and strategy?

Inspect end-user behavior, feedback

O’Neill: Yes. Obviously, we interact constantly with the people that we support and look after. It is the only reason we exist. If I do anything that is detrimental to their experience, then I’m not doing my job properly.

We go back and we do ask them. I personally have spent time on phone lines as well. I don’t sit within my little security bubble. I work across the organization. I’ve been on the streets with the bucket collecting donations.

We have very good relationships with people that we have supported and continue to support. We know because we ask them how it felt for them. What works for them, what doesn’t work for them? We are continually trying to improve our methods of interaction and how we do on that. And I’m constantly trying to see what we can do that makes that journey even easier.

We also look at user behavior analytics and the attack behavior analytics on our websites. How can we make the experience of the website even smoother by saying, “We’re pretty sure you are who you say you are.” Are they going to the same places? Are you changing your behavior?

And I can understand the behaviors and even how people type. People use their keyboards differently. Well, let’s look at that. What else can we do to make it so that we are sure we are interacting with you without you having to jump through a million hoops to make sure that that’s not the case?

Gardner: You mentioned behavior and analytics. How are you positioning yourself to better exploit analytics? What are some of your future goals? What are the new set of KPIs a few years from now that will make you even more strategic in your security posture?

Use analytics to lessen user interruptions

O’Neill: That’s a really good question. The analysis of user behavior linked to attack behavior – that and analysis of many other elements is going to become increasingly important for smoothing this out. We can’t keep using CAPTCHA, for example. We can’t keep asking people to identify fire hydrants that are within 30 centimeters of a dog’s leg. It’s absurd.

We have to find better ways of doing this to determine the true risk. Does it matter if you’re not who you say you are until we get to the point that it does? Because, actually, maybe you don’t want to be who you are for a period of a conversation. Maybe you actually want to be someone else, so you’re disassociating yourself from the reality of the situation. Maybe you don’t want to be identified. Do we have to validate all of the time?

I think these are questions we need to be asking. I think the KPIs are becoming a lot more difficult. You have to base them around, “Did we have any breaches?” And I think with breaches we separate our information governance from the information security, but they’re brothers from one another, aren’t they?

We have to find better ways to determine the true risk. Does it matter if you're not who you say you are until we get to the point that it does? Do we have to validate all of the time? These are questions we need to be asking.

The information governance leak shouldn’t happen with good information cyber security, so we should expect to see a lot fewer incidents and no near misses. With the best interaction KPIs, we should be seeing people get in touch with us a lot quicker, and people should be able to talk to the right people for the right reason a lot quicker.

Our third-party interaction is very important. As I said, we don’t offer any medical services ourselves, but we will pay for and put you in touch with organizations that do. We have strategic partnerships. To make that all as smooth as possible means you don’t need to worry who you’re talking to. Everything is assured and the flow is invisible. That kind of experience -- and the KPIs that matter the most for delivering that experience – provides well for the person who needs us.

Gardner: Any closing advice for those who are moving from a security perimeter perspective toward more of a security bubble concept? And by doing so, it enables them to have a better experience for their users, employees, and across their entire communities?

Dial down the panic for security success

O’Neill: Yes. This is going to sound a bit odd, but one of the most important things is to conceptualize, and to take the time, to challenge my team. What is the gold standard? What is the absolute? If we had all the money in the world and everything worked, what the perfect journey? Start from there and then bring it down to what’s achievable or what elements of it are achievable.

I know this sounds odd but stop panicking so much. None of us think well when we’re panicked. None of us think well when we’re stressed. Take the time for yourself. Allow your team to take the time for themselves. Allow their brains the freedom to flow and to think.

And we’ve got to do what we do better. And that means we have to do it differently. So, ask questions. Ask why do we have endpoint protection? I’ve got this, I’ve got that, I’ve got all these other things. Why have we got something on every endpoint, for example? Ask that question.

Because at least then you have validated what it is truly for and better know the amount of value it has, and therefore the proper amount of effort it needs. Stop doing things just by ticking off boxes. Because as an ex-hacker, let’s call it, I know the boxes that you tick. You tick all those boxes; I know how to bypass those boxes. So, yeah, just take time, think, conceptualize, and then move down to reality. Maybe.

Gardner: Be more realistic about the situation on the ground, rather than just doing things because that’s the way they’ve always been done?

O’Neill: Yes, absolutely. Understand your risk. Understand what you are actually having to support. The fortress approach doesn’t work anymore. The proliferation of software as a service (SaaS) application, the desire to allow everyone to perform to their best within and outside of an organization – that means allowing people flexibility to work in a way that best suits them. And you cannot do that with a fortress.

Gardner: I’m afraid we’ll have to leave it there. You’ve been listening to a sponsored BriefingsDirect discussion on how Macmillan Cancer Support in the UK places the ease of use and sense of security in the services provided as a top community service requirement.

And we’ve learned how this charitable health services organization delivers a cloud-ready security bubble around their users, activities, and the sensitive data they share.

So please join me now in thanking our guest, Tim O’Neill, Head of Information Security at Macmillan Cancer Support. Thank you so much, Tim.

O’Neill: Thank you very much for your time.

Gardner: I’m Dana Gardner, Principal Analyst at Interarbor Solutions, your host and moderator for these ongoing BriefingsDirect security discussions. A big thank you to our sponsor, Bitdefender, for supporting these presentations.

Our last big thank you goes out to our audience, that’s you, for joining us. Please pass this along to your community, and do come back next time.

Listen to the podcast. Find it on iTunes. Download the transcript. Sponsor: Bitdefender.

Transcript of a discussion on how Macmillan Cancer Support in the UK places confidence in -- and ease of use of -- overall security as both top IT and health services requirements. Copyright Interarbor Solutions, LLC, 2005-2023. All rights reserved.

How A-Core Concrete Sets a Solid Foundation for Preemptive Security

2023-01-25T13:19:00.006-05:00

Transcript of a discussion on how to best balance resilient security requirements with efficient use of human capital and resources in a highly dispersed organization.

Listen to the podcast. Find it on iTunes. Download the transcript. Sponsor: Bitdefender.

Dana Gardner: Welcome to the next edition of the BriefingsDirect podcast series. I’m Dana Gardner, Principal Analyst at Interarbor Solutions, your host and moderator.

Gardner

A special breed of company -- even though it has a relatively small number of employees -- does very big jobs with those lean and often distributed workforces. A perfect example of such a concentrated and efficient business is A-Core Concrete Specialists, which builds large and complex structures across the Western United States.

When it comes to managing IT, the lean-and-mean mantra also holds true. The jack-of-all-trades requirements means that the IT leadership of it is often the head of security. As a prime example, that’s another way that A-Core Concrete shines.

Today’s BriefingsDirect security innovations discussion examines how A-Core Concrete has created a security culture that relies on centralized administration, proactive insights, and rapid remediation to successfully assure that the whole company operates at peak performance.

Here to share the story of how to best balance resilient security with the efficient use of human capital and resources is Andy Black, Chief Information Officer (CIO) at A-Core Concrete Specialists Inc., in Salt Lake City. Welcome, Andy.

Andy Black: Hello. Thank you.

Gardner: How does your management and IT approach allow A-Core Concrete to best meet its security objectives?

Black: A-Core Concrete operates in seven different states within the Western United States. We have 13 offices throughout the Western U.S., and our main corporate headquarters is in Salt Lake City, Utah.

Black

From there, we run the majority of the businesses. Each division operates independently. There are some that operate branch sites in various states and others where we don’t actually have offices. So, we need to provide a lot of remote capabilities and access to IT at all of these various locations.

When I came aboard several years ago, I determined the best answer was not to have a central data center where all of our servers and applications were housed. That just made it more complex for every one of those locations to gain access to the main facility. Because we also were growing rapidly, I needed the ability to expand the business quickly and plug in a new location really fast.

If I had to establish a direct virtual private network (VPN) connection back to our main data center at the main corporate headquarters, it probably wasn’t going to work well. So, instead we decided to migrate all of our servers and the environment to the Microsoft Azure cloud and set up each office location with VPN connections up to that Azure cloud environment.

That’s enabled us to operate lean and more securely. Each office has a secure connection to our primary applications via remote access. And all of our people operating remotely on mobile devices and laptops are also able to gain access to our cloud-based environment.

That’s basically how we’ve configured our IT environment so every physical location -- as well as all of our remote workers – can have secure access into all of our cloud-based resources.

Gardner: Andy, we hear so much these days about remote work and whether that’s the right fit for the long-term. Seems to me what’s most important is gaining the flexibility and the agility to be location-independent. You can always get the work done regardless of where the people are.

What were some of the challenges you faced to maintain your security requirements, even with 13 offices – and more remote locations -- spread around the country?

Keep clients safe across the Western U.S.

Black: Well, a great example that comes to mind is we are currently working on one of the largest renovation projects in the country, the Church of Jesus Christ of Latter-day Saints temple renovation project in downtown Salt Lake City. That project involves a lot of very intense and technical work. We’re lifting the entire temple off of the ground to install earthquake prevention materials. Within the facility, we’re drilling holes down the sides of the temple. Of course, this is an historic landmark, so we have to retain and protect the facility.

But we’re working on that job site in conjunction with other companies. We are a subcontractor in partnership with the main host organization that is doing a lot of the construction. And so, we have our managers and our administrators working in the other companies’ offices and trailers. And so, we rely on those other companies’ internet connections for the majority of their work and yet our people still need to have access to our main company IT resources.

For them, for example, we have set up a VPN client that they load onto their individual computers, so they can simply rely on that internet connection and still tap into our Microsoft Azure cloud.

We're aware that there are a number of hacks and other issues out there where they take advantage of VPN and RDS-types of connections into remote access servers and cloud environs. We need to protect and secure those, too.

Now, for all of our other main office locations, we have firewalls in place, and each firewall is configured with that VPN client. But the way we’ve configured and built this out -- so that everything is cloud-based, while we can secure it with a VPN connection -- puts this in a tight spot because people are located all over the place. They might be using a cellphone as a mobile hotspot or an airport Wi-Fi network. And so, while they have that VPN connection to me, that still does not protect them 100 percent.

We’re aware that there are a number of hacks and other issues out there where they take advantage of VPN and even Remote Desktop Services (RDS)-types of connections into those remote access servers and cloud environments. And so, we have to be able to protect and secure those as well.

As a result, I rely on a lot of the services and support I get from Bitdefender for securing our computers and connections. They can be remote, in these other offices and shared with other companies, and we can still have secure access to all of our resources.

Gardner: The days of creating a fortress and moat perimeter that you can protect and beef up from time to time -- those days are gone. There is no perimeter. The perimeter is everywhere.

Given that, what are the top requirements for the endpoints to take advantage of your cloud use and remain secure and under control?

Protect all platforms, everywhere

Black: One of the main reasons I moved to Bitdefender in the first place was its high quality and reputation when it comes to ransomware protection. That was one of my primary goals as a result of an instance where we had an attack several years ago. The security solution we had at the time helped prevent the vast majority of attacks, yet we still had a couple of machines that were hit. I needed to find a good, solid solution.

At the time I did my research, Bitdefender came out on top of the list. By installing Bitdefender, we not only gained an endpoint protection solution that provided ransomware protection, it also gave us antivirus, anti-malware, and other resources to securely protect those local devices. Then, at the same time, because we still see so many attacks through email, we tapped into the Bitdefender email filtering solution as well.

We rely very heavily on that solution to handle the local desktops, the laptops, and all those devices -- as well as all of our communication through email -- to make sure that we protect ourselves as much as we possibly can.

We still have to train the users. The weakest point in any security system is still the users. They still click on things, and they can still open things. But by having the endpoint protection solution and the email filtering solution in place, we feel that gives us a really good perimeter, if you will, to try to protect us and keep us much more secure when it comes to managing all of these devices that are all over the place.

Gardner: As your security and other IT partners have also adopted cloud architectures, how has that impacted your ability to manage and secure all of those far-flung endpoints?

See, secure, and share the cloud

Black: That’s a really great question. Not only do we have our own primary servers in the cloud that we use for specific systems in our environment, but we also outsource many other vendor-related hosted services, including software as a service (SaaS), for many other applications. Most of those are also hosted on Amazon Web Services (AWS) or Azure, so they’re all cloud-hosted. We may have one type of connection on one location, but on that same computer we’re doing 10 other things and 10 other resources are going to other cloud-hosted services.

I have, through Bitdefender, a great console that we use for two purposes. The first purpose is so that on my main view I can see all of the connected devices, and I can see which devices have had things blocked -- whether it’s been blocked, quarantined, or deleted. In a snapshot, I can open it up and determine if I have any devices out there that are jumping out and saying, “Hey, something just happened. We need to look at this right now.”

I also receive notifications if somebody's machine has clicked on a wrong link. That primary console has been great. I can pull up each computer, and it makes recommendations for how to better secure that specific device. It will automatically make the adjustments for me and make that fix.

I also receive notifications if somebody’s machine has clicked on a wrong link. It gives me a notification, saying, “Hey, you need to go look at this particular computer.” That primary console has been great. Through that console, there are also links whereby I can pull up each individual computer, and it makes the recommendations for how to better secure that specific device. I can then click on some of those and it will automatically make the adjustment for me and make that fix. Then in others, it actually relates more to group policy kinds of changes that we can make on our network so each device within the entire company can be adjusted based on those particular recommendations. That’s all in the primary endpoint protection console that I use.

Then secondary to that is the email filtering console. And I dive into that on a regular basis, and I’m learning, “Okay, what’s getting blocked? What’s getting filtered? Should this really be going through? Should this not be going through? Is it virus-related? Is it malware? Is it simply a phishing scam? Is it marketing?”

I look at that on a regular basis to make sure that if something does get blocked, it really should. I can still, if needed, release it and get it right to our end users very quickly. These particular tools have been very, very helpful for me in trying to manage the endpoint protection and manage our communications through our email service.

Gardner: Andy, you’re the CIO, not the chief information security officer (CISO), so you’re juggling a lot of different priorities. One of the things that is hard for people to balance is getting too much – or too little – email information. Can you, through the management console and interface, tune it so that you don’t get overwhelmed, but can find the right balance?

Fine-tune filtering your email

Black: When we first implemented the Bitdefender email filtering solution a while ago, we weren’t really entirely certain how best to make it work. And so, we put specific settings in place, and it seemed like we were still blocking more than we really wanted to block. But we had the capability to very easily open the console and shift something here, do changes there, make an adjustment -- and then see how that all worked.

Ultimately, I got to a point where I reached out for help. I needed to get more assistance from Bitdefender specifically and I was assigned to an individual who then put me in contact with the more technical backend resources so that they could help me more specifically adjust and configure and change our parameters for the email filtering solution so that we could better get the things that needed to come through and block the things that didn’t need to come through.

One specific piece to that was the marketing component. People get all of the spam emails, all the time. There is in the email filter solution, three specific selections. You have a marketing low reputation, a medium reputation, and a high reputation.

Because we were getting so much spam, I decided that I wanted to block that medium reputation email as well and have that filtered out. And so, while it greatly reduced the amount of spam email that everybody got, we discovered about a month later that it was also blocking bid requests.

We have a number of our managers throughout the company in every state where we are who are subscribed to various resources that would automatically send these managers’ current job bid requests. They have a job that’s going on in such-and-such location. We need to know about this so we can provide a bid on that particular job.

Well, we discovered that many of those were also getting blocked because they were being treated as a marketing medium -- and that wasn’t the right answer. I made more adjustments and I talked to the managers and said, “Okay, well, if I adjust this so that we don’t miss these bids, you will continue to get all of these other marketing emails.” And they replied, “No, that’s fine. We’d rather get the marketing emails together with these bid requests than miss the bid requests and then miss out on a potential job that that we could get into.”

So, this is very customizable. There are a lot of adjustments we can make. Sometimes it’s just a tweak here and a tweak there. But what I found was very, very helpful was that I had the capability to tap into Bitdefender’s backend, and to talk to the right people, have them sit down, see my screen, and we could work through it together -- and they could teach me.

As you said, I’m not necessarily the security expert. I need to manage all of these environments and all the data and information that’s coming through. Having Bitdefender as a resource was also very helpful to configure and tune our system to make it work best for our needs.

Gardner: Sure, you want proactivity, you want the machine to do the work for you, anticipate some of the things, and offer analytics. When it comes to that proactive approach, is there something about the way that the interface and the data and the analytics come together that gives you a heightened sense of the security behind your security?

Get the whole picture to manage threats

Black: The display in the interface for the endpoint protection is very, very useful. In fact, in working with the same Bitdefender consultants, they helped me put the right quadrants in the right spots, to select which reporting features would be the most useful and would show me all the correct data.

We’re all visual people. A picture’s worth a thousand words. And so, rather than just looking at tables or lists of things that appear, it’s much easier to see it visually. One interesting thing about the dashboard is that I can click on a specific link or a specific dashboard icon and then it will take me to more information in greater depth and greater detail.

We're all visual people. A picture's worth a thousand words. Rather than looking at tables or lists, it's much easier to see it all visually. I can then click on a dashboard icon and it will take me to more information in greater depth and detail.

At a glance, that executive dashboard is very helpful first to see exactly where we are and what number of threats are coming through. I can quickly determine, “Are we seeing an uptick in an attack perimeter at the moment or not? What’s being hit?” If I want greater detail, I click on it, I pull it up and I can get more information that way.

That particular resource has been very helpful. Again, once it’s set up and I know it’s there, and I trust it, it is no longer something I have to go into every single day. I’m not tapping into this every day. That’s not really my role overall, but when I need to, or if there’s something that’s happening, I can tap into it very quickly, pull it right up, see what’s happening, talk to my team and say, “Let’s go attack these particular systems. This one’s questionable. We’re not sure what’s going on here, so jump on that one.” It’s just a great management tool from that perspective.

Gardner: It sure sounds as though it’s a fit-for-purpose management approach, which is so important when you’re in a lean-and-mean environment.

You mentioned earlier, Andy, that your end users and their behavior are such an important part of security. Is there something about the way that you’re getting information about what’s going on at your endpoints and in your network that you can take back to the users and reinforce the right kinds of behaviors? Is there a way that you can instill a security culture based on the information you have for your consoles and analytics and take that back to train, in a sense, your workers to be more diligent about their best practices?

Train your teams to spot spam

Black: A couple of years ago, we determined as the leadership team it will be very beneficial and helpful for us to meet on a weekly basis across the company and do training. I’ve trained on all sorts of different things within the organization, but one of the key things that I continue to bring up regularly is security. I will say, “Here are the most recent things that we’re dealing with. Here are the most recent attacks.”

Then every once in a while, something may come through our e-mail, because no solution is 100 percent perfect, and so I still have to rely on my users to know and be aware and look at what’s coming through to make sure that it’s still good or bad. And so, we have a phishing report link option. If something comes through and it looks fishy, they click the link, and it automatically sends it to my team. We see this e-mail and we can double check and verify whether or not it’s good or bad.

If it’s bad, we can obviously let the user know and thank them and congratulate them for being proactive and determining, “Yep, sure enough, that’s not the right thing.” And then depending on what’s coming through, sometimes I will take screenshots of that, and I will send out a communication across the company, saying, “Hey, everybody. These are certain things that are happening right now. This is bad, this is bad, this is bad,” so you don’t want to open these. Then, during these trainings that I have with the company, I can discuss with people, “What are you seeing? How do we look at and break down one of these messages in these e-mails to determine, is this really a valid e-mail, and if not, how do we recognize that? How do we determine it?”

By helping and working with all of the people throughout the company on a regular basis, having these conversations, showing them the examples, taking these screenshots and so on, it’s helped to create a greater security culture within the organization. A lot of the smarter user base can be more proactive on their own end and say, “Yeah, yeah. This is bad or I’m not really sure about this particular one, Andy. Let me send this to you and have you double check it for me just to be sure.”

The vast majority of the time, it’s worked very well. Now, people can still make a mistake. I had a user literally a week ago click on a link that said they needed to redo their e-mail password. I can’t remember what it was and sure enough, it took them to a spoofed site. They didn’t think fast enough. They entered their credentials and immediately thought, “Okay, that was probably bad. So, Andy help me.” The next thing you know, we helped them reset the password right away so that whatever just got compromised is no longer there.

But at least people are more aware. They’re thinking. Even if they clicked the button and afterward, they’re like, “Yeah, that probably was not the right answer. Let’s jump on. Let’s talk to Andy’s team and let’s see if we can get it fixed.”

Helping to create that security-aware culture makes a big difference. Because the people in IT can put all of the infrastructure in place. We can have the firewalls and the VPNs and the endpoint protection, the antivirus, and the anti-malware, all of that -- but at the end of the day, it still is up to the end user. They are the last point of protection, so they need to be aware. They need to be cognizant of what they’re dealing with. The more we can work with them, the better.

Gardner: That root-cause analysis and learning what’s been behind problems is one part of the solution, as you point out, and relating that to behavioral adjustments is another. But what about the ability to react as a security professional when something does go wrong?

Is there something about the way your security apparatus is designed that helps you so that when things do go wrong, to nip it in the bud?

Plan ahead for best problem-solving

Black: Using the console within Bitdefender, I can see the machines that have recently blocked something, or had a virus come through and then quarantined it, or whatever. I can then have my team go out and look at that specific computer and see if something got through.

But I will tell you that if Bitdefender says they blocked it, they blocked it, and it hasn’t really been an issue. But it also tells me who those users are, so I know if there’s a specific individual that we need to work with. We can say, “Okay, now it looks like six times in the last week you clicked on things. Let’s talk about this. What is going on? Let’s make sure you have figured that out.”

Now, again, looking at it from the leadership perspective, I can put all of the infrastructure in place, but I need to have the capability to recover should somebody do something that they shouldn’t have. I can focus on having all of my backups in place, my replications in place, whether it’s cloud-based or otherwise; having my resources, my applications, my files stored in different locations so it’s not all in one bucket, so that if something does happen to get through, it’s that one piece that might be affected, not the entire organization.

I can put all the infrastructure in place, but I need to have the capability to recover should somebody do something they shouldn't have. I can focus on having my backups in place in different places so it's not all in one bucket. Then if something happens, it's affecting that one piece, and not the entire organization.

It becomes more of a mindset of how I built out the infrastructure to support my company, specifically to meet our needs so that if one particular site has an issue or one particular application has an issue, it can be isolated to that specific component. We have the backups, the replications, all of the disaster recovery in place so that if the worst happens, we’re not going to be completely out of business.

Now, one last piece to that, it’s very important to have the communication ahead of time with the business leadership, the ownership, so that should something such as ransomware come through, it’s not just locking the computer. We can restore a computer, we can restore from backup, that’s fine. You might lose a day. It’s not going to kill us.

But, one of the biggest things with ransomware that’s happening today is not just an encryption of a computer but where the bad people will get in, pull data out first and hang onto your information and then they want to charge you a ransom because they’re going to threaten to release your information. They want you to pay the ransom to not release the data and then pay the ransom to also decrypt your devices and your systems.

And so, the issue is more with the information that they gather. If you can have a conversation and have that decision made ahead of time with the organization, you can let your leadership know, how you created your backups. Here’s how you got your encryption. Here’s how your data is being protected. And if somebody comes in and says, “We have your data, we will release it unless you pay a ransom.” Well, then you at least have a game plan and a decision process made ahead of time so that it’s not a response or knee-jerk reaction to just immediately pay the ransom.

Have those conversations in advance, have that plan in place already, so you’re ready to go if and when that occurs.

Gardner: Now you’re talking about operational resiliency -- to have those plans in place with the right steps to take when you need it. When you have the data at your disposal, you can act. That’s a huge part of a good, solid security culture. I commend you for that.

Before we sign off, let’s talk a little bit about the future. Where do things go next? Are you concerned about the number of different endpoints that you might be involved with? Do you feel as though you’re going to have to expand your horizon across more endpoints?

Meet and manage mobile-device risks

Black: The two fronts that don’t really keep me up at night per se, but they are in the back of my mind, are the mobile devices because we do have a lot of our applications accessible on cell phones, on tablets; iPads, for example. It’s more than just the desktop computer anymore, it’s not just a Windows or an Apple-based machine. It’s definitely those mobile devices.

More than two-thirds of our company, of our workforce, are field operators. They are the guys out in the field actually cutting the concrete, doing the freeway work, and so on. They rely entirely on a mobile device -- their cell phone, their tablet. I have to build and secure those devices as well. And the number of those devices is only going to grow. As our business continues to grow and as we expand, and we go to other locations, I’m going to have more people who are going to have those mobile devices. And so, that’s a huge front for me that I really need to make sure that I have protection services in place.

Now secondary to that is the impact of artificial intelligence (AI) and machine learning (ML). People can create millions of bots, and with those bots they can find new ways to hack in. The more intelligent AI and ML becomes, the stronger your own defenses need to be. And so the more we can incorporate our own AI and ML into our defense environments -- on the computers, on the mobile devices and in our endpoint protection -- the better we can prevent the bad guys who are also using those same tools to come at us. Right now, to me, those are my two biggest fronts going forward that I’m the most concerned about.

Gardner: Andy, any advice to organizations that like you are distributed, are lean, and have big jobs but a relatively small workforce -- and perhaps also a fairly lean-and-mean IT department? Any thoughts that you would impart to them as they try to improve their security posture?

Black: A lot of the smaller and mid-sized businesses, they all realize that computers and technology are required to keep them in business and to press forward. But they’re still not really willing to spend the money that it might take to bring in that level of protection. They try to play the risk game, saying, “How long can we go until we get hit? We’re not going to get hit. We are too small of a company. We’re not a target.”

Well, what we’re finding is that the biggest target is the small- to medium-sized businesses (SMBs) because they tend to not have invested into their security to protect themselves. And so, that’s where those weaknesses come in.

Again, those same organizations -- while they do the bare minimum, they might have an end-point protection solution on their computers -- they’re not necessarily securing their mobile devices. They’re not necessarily creating and working with their people to create that culture of security.

And so, it doesn’t take a lot. It’s not a huge investment in most cases. But if you will make that more of a priority it does make a world of difference to protect your business because it’s going to cost a lot more to recover than it would be to prevent in many of those issues.

Gardner: That’s great advice. I’m afraid we’ll have to leave it there. You’ve been listening to a sponsored BriefingsDirect discussion on how concentrated and efficient businesses like A-Core Concrete build security cultures that rely on centralized administration, proactive insights, and rapid remediation to move safely at the preferred and optimized speed of business. A big thank you to our guest, Andy Black, CIO at A-Core Concrete Specialists. Thank you so much.

Black: Thank you.

Gardner: I’m Dana Gardner, Principal Analyst at Interarbor Solutions, your host and moderator for this ongoing series of BriefingsDirect discussions. And a big thank you to our sponsor Bitdefender, as well, for supporting these presentations.

Our last big thank you goes out to our audience, that’s you, for joining us. Please pass this along to your community and do come back next time.

Listen to the podcast. Find it on iTunes. Download the transcript. Sponsor: Bitdefender.

Transcript of a discussion on how to best balance resilient security requirements with efficient use of human capital and resources in a highly dispersed organization. Copyright Interarbor Solutions, LLC, 2005-2023. All rights reserved.

Hybrid Work is the Future, and Innovative Technology Will Define It

2022-09-28T12:05:00.007-04:00

Transcript of a discussion on the drivers and opportunities to get the future of hybrid work right as soon as possible.

Listen to the podcast. Find it on iTunes. Download the transcript. Sponsor: Citrix.

Dana Gardner: Hi, this is Dana Gardner, Principal Analyst at Interarbor Solutions, and you’re listening to BriefingsDirect.

Gardner

We’re all now part of a massive worldwide experiment about the very definition of work. Remote, in-office — or tightrope walking along some sliding scale between the two? How each business and each worker finds the next new work-life balance remains an ongoing "work in progress."

In the post-rapid adoption of remote work world -- a full two and half years after the onset of COVID -- there’s no definitive answer on which approach to hybrid work works best. And the technology tools and solutions — many designed for an earlier in-office era — are not necessarily up to the task.

The perceptions and preferences of bosses and workers alike are in a seemingly unending transition. Nothing quite seems fit for the new, still-to-be-defined purpose.

So, what is the eventual end-state of hybrid work? Will the process of finding it provoke new forms of innovation, opportunity, and technological success? Or will productivity and work-life balance suffer amid a period of tension, power plays, and years of seesawing trial and error approaches to hybrid work?

Stay with us now as we explore the drivers and opportunities to get the future of hybrid work right -- perhaps sooner rather than later.

To learn more about what makes hybrid work move to an arc of opportunity, and not wallow in a trough of complexity and confusion, please join me now in welcoming Amy Haworth, Founder and CEO of Nobody Makes it Alone. Welcome back, Amy.

Amy Haworth: Thanks, Dana.

Gardner: We’re also here with Tim Minahan, Executive Vice President of Strategy at Citrix. Good to have you with us.

Tim Minahan: Thanks, Dana. I’m excited to be part of the dialogue.

Gardner: Amy, there seems to be an interminable debate nowadays about the future of work. The previous models don’t give us a lot to easily fall back on as precedent for hybrid models. Companies are struggling to find the best fit for them and their employees.

So, are most workers going to be fully remote? Mostly in the office in the nine-to-five, five-days-a-week model of yesteryear? Or will there be some yet-to-be-defined golden mean, or equilibrium, between the two sides of the equation?

Employees opt for hybrid-work

Haworth: I’m so glad we’re having this conversation because you’re right. Companies are struggling. We’re seeing that in headlines every day about which employees are being called back into the office full time as a reaction that’s becoming a top-down mandate.

Haworth

That’s been the trend. Companies are trying to figure this out. Do they work fully remote? If they do go hybrid, are they mandating a certain number of days in the office versus allowing employees the flexibility to choose?

And I love what you said about the “arc of opportunity” in comparison to a “trough of complexity.” It feels like that’s becoming the choice. Are companies going to hang on the arc of opportunity versus those that are returning to what they perceive as more certain, which really is the model of yesteryear.

Citrix recently did a global survey and the results to me are fascinating. They started by asking employees what they preferred. The data shows that 57 percent of employees prefer hybrid models that allow them to work remote or in the office. And 69 percent, that’s a big number, 69 percent said they’re going to leave their job if they aren’t given that option.

This tells us, from an employee point of view, that demand for flexibility is clearly there. And I hope companies realize, if they haven’t already, that to truly attract and retain talent for the long term, they’re going to have to figure out how to make this choice an option and make it a permanent part of their workforce strategy.

Gardner: Looking at some of the other findings, it seems that the hybrid work model – even as it was foisted on us -- does work well for many people. I see that 69 percent of the hybrid workers surveyed said they feel “productive,” compared to 64 percent of remote workers, and 59 percent of office employees.

So that flexibility is paying off from their perception. Also, nearly 70 percent of hybrid workers say they feel “engaged” compared to a much lesser degree, 55 percent of remote workers, and 51 percent of in-office employees.

So why is there ongoing tension? Why do we have this demand to return to the past when the current new hybrid state seems to be working for so many people?

Haworth: There’s an interesting dynamic I’m starting to sense. Typical human behavior is that in times of great uncertainty, the human brain tends to latch on to that which feels certain. And so even if we think about the macro environment outside of work, there’s still a lot of uncertainty.

The results from the Citrix survey show 70 percent of hybrid workers have a strong emotional connection to their organization and leadership, as compared to 60 percent of remote workers and 58 percent of in-office workers.

For example, we thought we had hit our uncertainty high during 2020 when COVID peaked. But what’s come at us is more and more uncertainty. One hypothesis is that this is an organizational reaction to try to control what feels uncontrollable.

But there’s a real risk because the impact on outcomes, results, and costs is driving outcomes and accountability within the ethos of an organizational culture. Going backwards -- to dictate how we work, almost like a parental order – is perceived as a top-down ruling. But the cost to workers is going to come in the form of a detriment to well-being, both physical and mental.

When we look at the results from the Citrix survey, 70 percent of hybrid workers say they have a strong emotional connection to their organization and leadership team. That’s compared to 60 percent of fully remote workers, and 58 percent of in-office employees. Similar numbers show up when it comes to well-being, with 70 percent of hybrid workers report good well-being, compared to 61 percent of fully remote workers, and 60 percent who are only in the office.

What struck me about all these numbers is in-office employees scored lower across all of these categories: productivity, engagement, emotional connection, and well-being. We really need to pay attention to both what’s not working and to also dive into what is working. Clearly something is working across all these domains for the hybrid worker. And that’s really important, because being inspired by our work, as we know, drives performance. It drives commitment, it drives loyalty. It drives innovation.

Organizations need to be asking the big question -- not necessarily which model is right, but which drives the best outcome for organizations and people. And from there, we can figure out how to make this work.

Gardner: Tim, given these findings, why are so many companies still resisting flexible and hybrid-work models? It seems as if what we saw over the past year and a half is backtracking. Why do you think that’s the case?

Trust is a must

Minahan: People like to label of a lot of things. It’s not a remote-work issue. It’s not a return-to-office issue. It’s not a quiet quitting issue. What we have here is a trust issue.

Minahan

Despite clear findings from countless studies -- from Citrix, from PwC, Journal of Economic Perspectives, and countless others -- showing that remote work yields measurable improvements in productivity and retention, leaders -- including those that tend to pride themselves on being “data driven” -- are just ignoring the facts by pushing employees to return to the office.

In fact, our latest research at Citrix finds that nearly half of managers, despite all the evidence and experience they had in their own companies during the pandemic, just don’t trust employees to get work done when they’re outside the office.

In a recent study we did, 48 percent of managers reported using tracking software on their employees’ machines to measure their keyboard time when working remotely. I know, Dana, we’ve had conversations before on best practices for hybrid work, and during those, I warned that the biggest risk to getting all the benefits that Amy talked about by embracing more of a hybrid-work model was creating policies and culture and a technology stack that gave employees all equitable access to the applications, the information, as well as career advancement opportunities -- regardless of where they work, in the office or remotely.

Unfortunately, some leaders are now valuing face time over business outcomes. And you know, researchers have labeled this dynamic as proximity bias, and at its core is really a lack of trust and outdated ways to measure employee contributions and engagement.

Gardner: Of course, Tim, trust is hard to measure in a data-driven world. Do you have any sense of how trust can be measured as a business success indicator?

Minahan: The orientation is all about productivity. For example, The Journal of Economic Perspectives researchers ran an experiment in which they selected an unnamed NASDAQ-listed company and they randomly assigned call center employees to work from home and had a control group working in the office.

They found that working from home not only resulted in a 13 percent increase in productivity -- those workers working remotely actually were more productive than those in the office -- but they had a 50 percent lower attrition rate. When you think about dynamics like that, especially in the tight labor market that we have right now, there are real business benefits and real ways to measure the benefit of embracing a much more flexible work environment.

Gardner: Amy, you’ve been coaching a lot of companies that are working to find the right work balance. What is top of mind for you when it comes to the keys to hybrid work success?

Connected work creates better outcomes

Haworth: Piggybacking on this idea of trust that Tim brought up, what I’m hearing is a needed emphasis on trust and connection. Sometimes what we’re going for and what we’re trying to explain -- and what my clients are trying to explain – revolves around connection or trust.

What is that secret sauce to attain that? If we step back, and think about our lives outside of work, what creates trust and connection between people? It far exceeds anything we’re doing organizationally, but it can absolutely be put into our organizational structures.

Think about that. Why do you decide to trust someone? Most likely, it’s because you found a place where you shared something, perhaps a vulnerability, and it’s been reciprocated and held in a safe and shared space. Or you connected because you found some sort of similarity.

I’m seeing organizations having a knee-jerk reaction because they’re sensing that this idea of connection, which is fuel for trust, is missing. And so, they’re putting the workplace as the proxy for building that. The challenge is that in the last couple of years, we’ve distributed our workforce. If we’re using workplace as the proxy for connection making, we are leaving out, in so many cases, people who are not in the office anymore. That is one of the challenges with hybrid.

If companies are mandating that employees who have the option to be in an office, come into the office a certain number of days, they’re actually going to start to find that unless they teach organizations how to create connections, that they’re fueling disparity. And they need to be focused across-the-board on new ways of creating connection. How do we make it okay to not have our meetings be all about getting things done? We know that this style of working drives productivity, but we also need to be thinking about how it can drive connection -- and not just for one group who has access to an office, but for everyone.

The key is to help organizations be successful by naming what is missing in their culture, and then to set up focused efforts to build that capability so that there is fairness, safety, belonging, and connection for everybody.

Minahan: Amy and I have had this discussion before. It really boils down to those companies that are most successfully leveraging this moment to create entirely new work models that benefit both their organizations and their employees. It means delivering meaningful work, giving employees the tools, information, and assignments needed to drive innovation and creativity and the business outcomes for the company.

Certainly, there is a value in bringing employees together, that connectivity that Amy mentions. The ability to do strategic planning, the ability to collaborate in certain ways, and the ability to meet with customers. It’s about creating social networks with your fellow employees, so you see them as humans rather than, you know, a bodyless face on a video call. All of that has value.

But for those companies that are figuring out the secret sauce, it boils down to providing meaningful work and purposeful office time.

Gardner: As we talk about meaning and trust, that strikes me as closer to a relationship than a transaction. Much of the technology has been developed around transactions. Technology is inherently transactional. It seems to me that we need to look differently at technology as a way to increase the richness and value of the relationship between the employee and the employer.

Amy, is that the case? Are we not using technology appropriately? Do we need to think differently about the use of technology to foster better relationships that lead to more trust that then can deliver higher productivity?

Technology enhances work interactions

Haworth: Technology has a huge opportunity to be a catalyst to help create better connections in the way we see and experience each other. At its core, it’s about human experience. People need to be seen and heard.

There are some exciting innovations when it comes to the tools, even in my world of the human resources (HR) stack. We’re starting to see an amplification of recognition tools, of coaching platforms, of new and exciting ways to learn that are leveraging mobility and looking at how people want to work and to meet them where they are, rather than saying, “Here’s the technology, learn how to use it.” It’s more about, “Hey, we’re learning how you want to work and we’re learning how you want to grow, and we’ll meet you there.” We’re really seeing an uptake in the HR tech space of tools that acknowledge the humaneness underneath the technology itself.

Minahan: During the pandemic, we introduced new tools to allow employees to execute work in the most efficient way possible and collaborate in a more virtual sense. I believe we’re now getting to the point where the metaverse is blending with the workplace.

When you think about tools that companies embraced during the pandemic out of necessity -- communication and collaboration platforms such as Slack, Teams, and Zoom – they were emulating the physical world and physical collaboration environments. That includes things like digital whiteboard tools, and content collaboration tools, for redlining and sharing, and all of that.

A top priority for IT executives everywhere is creating the optimal hybrid work stack. ... We're emulating the physical world and physical collaboration.

But right now, one of the top priorities for IT executives everywhere is creating the optimal hybrid work stack. And that stack has multiple layers. One certainly is the collaboration layer, as we talked about. How do I bring together all the collaboration tools necessary to allow employees to work effectively, execute work effectively, and collaborate effectively when working remotely or in a distributed way?

The second layer consists of the business applications we’ve come to know and love. Those include HR apps, business applications, supply chain applications, and financial applications, et cetera. Certainly, there is a major role in this distributed work environment for virtual application delivery and better security. We need to access those mission-critical apps remotely and have them perform the same way whether they’re virtual, local, or software as a service (SaaS) apps -- all through a trusted access security layer. And then finally we need a suitable device layer, ensuring that employees can work across any device and location.

In our experience at Citrix, in working to bring some of those virtual environments into the physical workspace, for example, we’re retrofitting all of our conference rooms to be team-centric. No matter where anyone is working, they are part of a teams-based collaboration activity because we recognize that in most cases our meetings are going to involve a hybrid model.

Some employees and stakeholders are remote, and some are physically in the office. We’ve therefore also retrofitted our environment with circular cameras so that everyone has an equal box on Teams, we put cameras on the whiteboard so that everyone can be included in every part of the conversation, and they all have equal access to the shared information. We’re not alone in that. A whole host of our customers are examining those environments too, including bringing that metaverse approach into the workplace.

Gardner: Amy, even with all things equal in getting the right technology in place, it seems to me that there’s another part to the equation. Some organizations just foist the technology on their people, and it remains the workers’ job to be the integrator, to find the right process mix among all the different applications.

I wonder if that’s the best way because this isn’t just about accommodating all remote or all in-office work tech; it’s also about the process innovation. Are there some lessons in your experience about how to better deliver technology as part of a business solution?

Are your clients recognizing that workers are not systems integrators and that just logging into umpteen disjointed SaaS apps isn’t going to work if you don’t provide some other ways to help people work with the technology -- rather than be overwhelmed by it?

Keep it simple, secure, accessible

Haworth: Yes, Dana, I see a new hybrid work stack emerging. It’s about unifying, simplifying, and securing the work without an employee needing to figure out how to make that happen. The last thing we want is for the employee to feel like they are part of the IT department.

Instead, we want to rely on our IT counterparts to do what they do best. And then the employees across the organization can focus on what they do best, which is to fulfill their roles using the skills they were hired for.

I believe employees are going to continue looking for what unifies the technology, so there aren’t 60 SaaS logins. How can they work securely without carrying that burden? We need to make sure the work is simplified, and -- where possible – employ machine learning (ML) or virtual assistance to augment what they’re capable of. It amounts to guiding and automating the work so that the employee is free from that tech friction or noise and can perform at their best.

Gardner: Tim, we’ve been talking about how this impacts employers and employees, but how does this impact the IT people? It seems to me, based on what Amy said, that there might need to be a rethinking of IT. It might be along the lines of instead of them being systems support, they’re actually work support, in that they’re in the business of helping people work.

Minahan: You summed it up, Dana. IT’s number-one priority should be creating an equitable, consistent, and secure work environment for their employees so that employers and employees have the luxury of testing out different and flexible work models. That includes allowing employees to have the flexibility to work remotely using new collaboration tools, new work execution tools, and new tools in the workplace, ones that provide a seamless experience and involve everyone across these distributed teams so they can collaborate and execute work efficiently.

And then the last part is a mission-critical need today, and that’s who does the work. Prior to the pandemic, we had a global shortage of medium- to highly skilled talent. In fact, McKinsey estimated that we had a shortage of 95 million such workers. And that was most acute in those most-in-demand-skills necessary to digitize, advance, and modernize your business.

Well, that hasn’t gone away. It’s only gotten worse. But smart companies, having proven the model of hybrid and remote work, are now using that as a platform to reconsider their workforce acquisition strategies. This includes being able to tap into distributed pools of talent, blending contractors who might have a unique expertise around things like multi-cloud, security or artificial intelligence (AI) and bringing them together with full-time employees in work groups that are connected by a hybrid work stack that IT is creating to optimize employee productivity, experience, and engagement.

Gardner: Amy, when we redefine the objective or the mission of IT and the business around getting work done in the best way -- fostering the best relationships and trust between the players -- it seems that where they’re doing this all becomes far less relevant. And yet we’re hung up on location or proximity bias, as Tim pointed out. Do we need to further shake the bush and ask people why they’re hung up on location instead of why they’re not focusing on the quality and a new definition of the most effective work?

Change is hard but necessary

Haworth: Absolutely. Dana, I think you’re getting at the big challenge we’re facing right now. And that is, are we asking the right questions? Are we solving for the right problems? Going back to your “arc of opportunity” statement, we need to be very realistic that massive disruption is going to continue across the world.

Companies are going to need to figure out how to strategize, plan, and implement ways to build agility and create new organizational and workforce structures -- as well as IT structures -- that not only allow them to respond quickly to change, but actually allow them to thrive when they do. At the heart of this is massive risk mitigation. Unless organizations are thinking about disruption as a potential risk, they’re going to miss the mark. Putting more structure around where people work is the opposite of agility.

We need to be thinking about how we leverage everything that we have learned in the last two to three years and make it a foundation to build upon -- versus taking everything that we have learned and then going back to 1992. We need to be planning, to be strategic, and to expect disruption.

Then we can build both the technology capability as well as the human capability to thrive during disruption -- and that means overall agility. As Tim said about who’s doing the work, that will continue to ebb and flow. How can we react in a way that makes how we work ongoing more dynamic? And we need to get away from trying to answer the wrong questions, quite honestly.

Gardner: Before we go to our crystal ball and predict how things are going to unfold, even in a very disruptive period over the next year or two, I’d like to look at this through a different lens. We’ve been talking about the softer metrics of productivity and trust, but there are also hard metrics around the underlying economics of hybrid work.

As organizations look at their total cost of employee ownership, if you will, that has to include big office buildings in very expensive cities. It involves hour-long commutes in each direction on public transportation that’s probably aging and inefficient, or sitting in a car in traffic.

Tim, are there some purely economic reasons why companies should be more open-minded when it comes to location of workers? It seems to me that there’s more than just productivity, that there’s actually a bottom-line indicator here that flexibility and hybrid work pays.

Minahan: Yes, absolutely, Dana. In fact, there were countless studies done during the pandemic indicating that there are real business benefits to remote work. You mentioned key ones around real estate reduction, despite companies looking to get employees back into the office in some cases.

Almost every employer is looking at right sizing their real estate needs in new ways, particularly in major metropolitan areas.

If you are working remotely, commuting costs savings certainly put benefits back into both the employers' and employees' pockets.And there are major sustainability benefits as companies look to reduce their carbon emissions.

Secondly, you mentioned commuting. Commuting costs certainly put benefits back into both employers and employee’s pockets, if they’re working remotely, even part of the time, especially in light of the current prices of energy. There are major sustainability benefits as companies look to reduce their CO2 emissions by adopting cloud, reducing their real estate footprint, and reducing the necessity for employees to do two-hour commutes every day.

But I don’t see the benefits around improved productivity and business outcomes that our employers are trying to achieve as soft at all. They should be accelerated and enhanced by embracing a much more flexible work model, including hiring those hard-to-find skills because you can reach them in a remote fashion.

A good example is a hospital network right here in the Boston area, Dana, that during the pandemic saw their telemedicine visits go up to over 200,000 per month from 9,000 per month or a 27-times increase.

Well, guess what? Coming out of the pandemic, they’re not rotating all the way back. They’re increasing their telemedicine experience. They recognize that they can use that same platform to find in-demand talent around things such as oncology and can staff them not in the Boston area where it’s highly competitive and highly costly to hire them, but remotely in the Midwest or elsewhere. These are the types of real business benefits that have come from people embracing much more flexible work models.

Gardner: Tim, how do you see things playing out in the year ahead? Are we going to continue to have this back-and-forth debate over remote work’s value, or is there a new end state or settlement of this discussion?

Expect demands for meaningful work

Minahan: I think natural market factors will balance it out. Employees, including those very top employees who want to do meaningful, creative, and innovative work -- but in a more self-serving flexible work model -- will vote with their feet. We’re already seeing it from the great resignation and the like. And despite the blustering at the top level around getting folks back into office, the reality is that companies are recognizing the critical importance of employee experience.

In fact, the study we just did of 10,000 IT leaders, 60 percent said they’re investing more in internal innovation projects to improve the employee experience. They said they are investing in digital workspace technology to support consistent and reliable access to the applications and information employee’s need across any device and location to ensure security.

And so, in short, after years of investing to digitize and enhance customer experience, companies are now giving some much needed and long overdue attention to enhancing the employee experience. Those are the people, after all, who are responsible for innovating, creating, and improving the customer satisfaction levels.

I think the market is going to balance itself out, with companies making these investments in order to appear more attractive to needed workers. And as part of that, it’s not just about the hybrid stack for technology for hybrid work, it’s also about the policies and cultural changes you’re going to need to make to support that hybrid work model to make you an attractive employer of choice.

Gardner: How does this new stack shape up, Tim? What are some of the major components that people should be looking for?

Minahan: We covered a good portion of that before, Dana. We see a number of layers to the stack. Certainly, the newest one that’s getting the most attention is the collaboration layer. The need to invest in new tools to foster greater work execution and collaboration in a distributed model. Those would be things like the communication collaboration tools that we use, like Teams and Slack and others.

There’ll be some of the new kind of turning physical work methods into digital work methods like a digital whiteboard such as Miro, etc. And bringing those into your stack where a few years ago they probably didn’t really exist or weren’t used at scale as they are now.

The second layer refines and modernizes your traditional business applications stack. All those tools you can use to run your business, your enterprise resource planning (ERP), your business applications, et cetera. So, employees in functional layers can execute the work they need to get done, can execute those transactions.

There is also the rising importance of ensuring that you have a virtual desktop and security layer in there, one that leverages those mission-critical applications and virtualizes them at scale to your employee base, whether they’re full-time employees or contractors in a very quick and efficient way, and then wrapping that in a zero trust security layer.

Finally, the last layer is around the devices, ensuring that employees can have equitable access to applications and information regardless of what device they’re using and regardless of what location they’re accessing from.

Gardner: Amy, what does your crystal ball tell you about how things are going to shape up in the coming year or two?

Haworth: There’s going to be a realization that we need to continue to learn and experiment. I would love to see organizations and employees both set that as the expectation. So rather than swing all one way at an enterprise level, that there are parcels, pieces, incubators for innovation when it comes to both technology and ways of working. These incubators are generating insights, and those insights are fueling future decision making.

So, a really important aspect of this is that we don’t give up too soon. We have come so far, and what is taking place is a continuation of transformation. Transformation inherently means ambiguity. Humans don’t love ambiguity, but rather than abandon and go back to where we felt “certain” back in 2019, we need to push forward and lean into these spaces of uncertainty. That way we can continue to experiment, learn, try new things, innovate, solve real problems, and mostly not give up.

Gardner: And you know, Amy, I always like to ask about examples and real-life results. When you look at the new hybrid work stack, as Tim described it, and from the number of organizations you’ve been working with, any early adopters? Has anyone understood the need for this new approach and put in place some of these improvements to foster trust and relationships? What’s working? And when you do this right, what do you get?

Learn, innovate, motivate

Haworth: I am seeing some new best practices, and I love that idea of leaning into the bright spots. So rather than target what’s not working, let’s talk about what is working. One organization in particular is investing in their manager layer.

Throughout the last two or three years, we’ve heard how much middle managers have taken the brunt off of supporting teams and people. And one organization in particular is investing in their managers at unprecedented levels because they understand that employee experience is dependent upon manager experience. And they’re seeing some really good results so far. They’re early in the game.

Organizations like startups are making choices both in technology and in workplace best practices. They're looking at how people are motivated today -- not only within the team but to their work and solutions overall.

Another place is in the startup community. Organizations that are building fresh right now are making choices both in the technology and in workplace best practices. There’s a lot of good learning to be had there because they’re looking at how are people motivated today. You know, it’s not, “We have to bring everyone into the office for a learning event.” What this organization is doing is thinking more about how much being in a work community and serving the community leads to feeling a sense of motivation and commitment -- not only to the team, but to their work and the solution overall.

So, they’re coming together in person with organizations in their community to do service together, versus coming together just for strategic planning. That is not to undermine strategic planning. It’s more about getting out and about seeing an impact in big ways is feeling a sense of loyalty and commitment as a result.

These are some non-traditional ways of stepping back and saying, “What do people need today? Where are we today?” It includes being willing to let go of the things that worked in the past in favor of something new and fresh.

Gardner: Tim, any examples of what the new hybrid work stack is capable of, particularly when companies recognize that it’s work that’s their mission and not about location?

Minahan: Yes, but I think it’s important to say that this stack isn’t just about enabling traditional work models. It’s about embracing new ones. And a very good example is Teleperformance SE. As one of the largest business-process outsourcers in the world, they are optimizing and focused on providing contact-center services for some of the world’s largest enterprises.

They recognized that this is a moment for them to be able to scale their business and to embrace new work models that simultaneously allow them to attract more talent and lower their costs. They’re using the hybrid work stack -- not just the collaboration tools we mentioned, but specialized tools related to call centers. They have been able to virtualize that as well as using their voice over Internet protocol (VOIP) services to enable a hybrid call-center model through which they can equally as well recruit remote workers, stay-at-home workers, to support contact center efforts as well as in their physical call centers. And that allows them flexibility.

Some of our customers are fully embracing the home-based force. They are able to, in this case, staff the call centers with the best talent possible anywhere and at the lowest cost. We have other customers who are saying, “Hey, no, I still want to have a physical call center in one of our major locations.” And they have the flexibility now to use hybrid models to deliver a higher level of service at a lower cost with a much more engaged and retained workforce than they could pre-pandemic.

Gardner: Tim, there’s so much new research and information. And people are thirsty for new insights dealing with these unprecedented issues. Where can they go to find out more to best continue their journey?

Minahan: I recommend they go to Citrix Fieldwork, our thought leadership platform where they can find much of the research that both Amy and I referenced today.

Gardner: Amy, how can Nobody Makes It Alone help? Where are your resources located? How can people learn more about finding the right path to a successful hybrid work?

Haworth: I’d love to connect with anyone on LinkedIn. I also author a newsletter on LinkedIn as well as the website, nobodymakesitalone.com and look forward to being a thought partner and helping to understand what’s going to make organizations successful no matter what happens in the world outside.

Gardner: I’m afraid we’ll have to leave it there. You’ve been listening to a sponsored BriefingsDirect discussion on finding the most productive approach to hybrid work. And we’ve learned how new forms of innovation, opportunity, and technology stack solutions can both empower workers and reward their employers with higher productivity, satisfaction, and innovation.

And so, a big thank you to our guests, Amy Haworth, Founder and CEO of Nobody Makes It Alone. Thank you so much, Amy.

Haworth: Thanks, Dana.

Gardner: And a big thank you as well to Tim Minahan, Executive Vice President of Strategy at Citrix. Thank you so much, Tim.

Minahan: Thanks, Dana. Looking forward to speaking again soon.

Gardner: And a big thank you to our audience as well for joining this BriefingsDirect future of hybrid work discussion. I’m Dana Gardner, Principal Analyst at Interarbor Solutions, your host throughout this series of Citrix-sponsored discussions.

Thanks again for listening. Please pass this along to your community and do come back next time.

Listen to the podcast. Find it on iTunes. Download the transcript. Sponsor: Citrix.

How Deep Observability Forms the Gift that Keeps Giving for Hybrid IT Security, Performance, and Agility

2022-09-13T14:41:00.008-04:00

Transcript of a discussion on gaining the best visibility into all aspects of the hybrid- and multi-cloud continuum to close the gap between daunting complexity and today’s performance and security requirements.

Listen to the podcast. Find it on iTunes. Download the transcript. View the video. Sponsor: Gigamon.

Dana Gardner: Hi, this is Dana Gardner, Principal Analyst at Interarbor Solutions, and you’re listening to BriefingsDirect.

Gardner

For those tasked with delivering unwavering performance of their apps and data, there have never been more unknowns to account for and manage. That’s because today’s hybrid clouds and mixed-network environments come with a multitude of dynamic variables -- and an unprecedented degree of complexity.

Yet modern digital business demands that the entire constellation of these far-flung cloud services, resources, and application constituent parts coalesce perfectly. The end result must be real-time and always-on user experiences that delight, and business transactions that are both highly secure and never fail.

Bridging the gap between such daunting complexity and awesome performance and security requirements means gaining the best visibility into all aspects of the hybrid- and multi-cloud continuum.

Stay with us now as we explore the ways that deep observability moves past the limitations of metrics, events, logs, and traces to deliver far richer and faster data-driven insights. By exploiting these new means of pervasive deep observability, the highest levels of security, performance, and agility can be attained by nearly any business and organization.

To learn how, please join me now in welcoming our guest, Bassam Khan, Vice-President of Product and Technical Marketing Engineering at Gigamon. Welcome, Bassam.

Bassam Khan: Hello, it’s good to be here. Thank you, Dana.

Gardner: Bassam, what are the main pain points you’re seeing for the cloud security operations (SecOps) and network operations (NetOps) teams as they strive to keep their environments performant, dynamic, and responsive -- given all of this difficulty and complexity?

Khan: Yes, it’s about being dynamic, performant, secure, and economical -- that’s the other aspect we keep hearing about. The pain for operations teams nowadays is to stay out of the way of progress, and to not get in the way of application development, business transformations, workload modernization, and application modernization. Progress can be defined truly as an organization’s ability to move fast by leveraging all of the applicable cutting-edge technologies out there today.

Khan

The pain is also about allowing developers to move very fast, without any involvement from IT groups -- particularly from operations -- unless something goes wrong. That could be when an application breaks, costs overrun, or the worst case -- some kind of security incident. The operations teams tend to be an afterthought -- until there is a problem.

Gardner: For those Ops teams then -- rather than there be a lag, rather than be reactive -- you want to be proactive and to get out in front of these potential problems as much as possible. That requires more visibility, more knowledge, and more understanding about what’s going on before the problems set in.

Khan: Exactly.

Gardner: What are some of the obstacles to getting to that forward-looking approach? How do you get out in front of security risks and be able to deliver a rapid remediation response?

Get out in front of risks early

Khan: One of the main obstacles is being able to get involved early. Development teams can move very fast using their own cloud platforms du jour, their favorite environment. Now, having visibility from an operations and security perspective into any infrastructure du jour is not easy. Every platform, preferred infrastructure, cloud container, and hyperconvergence environment has their own way of providing visibility. They all have a different methodology for accessing traffic information on how to scale up, or for seeing all the virtual machines (VMs) and containers as they pop in and out of existence. That’s the hard part -- because the orchestration and automation for every platform is different. That’s what makes it very, very challenging.

For example, in some environments you have simple things like virtual private cloud (VPC) mirroring to analyze all the packets coming in so I can get the visibility I need from a security perspective. Yet some environments -- let’s say Microsoft Azure -- don’t quite have such a packet mirroring capability. There are also other ways -- eBPF, Sidecar, and other technologies -- involved in container insights.

There is value that can be extracted from the IT and network infrastructure information. Accessing that is how the security, network, and IT ops teams can bring value back to the developers, DevOps, and CloudOps teams.

So, the best way that operations teams can get involved early is by showing and adding value that’s tangible and front-and-center for cloud developers, for DevOps, and for the cloud operations (CloudOps) teams. To this day, the development team, the cloud team, the DevOps team -- they tend to not look at the infrastructure. In fact, they don’t want to worry about the infrastructure. It’s something they’re built to not have to deal with. However, there is value that can be extracted from the IT and network infrastructure information. Accessing that is how the security, network, and IT operations teams can bring value back to the developers, DevOps, and CloudOps teams.

Gardner: Today we have a mixed bag of deployment options, each with many different variables in how to gather and share infrastructure information. But even that doesn’t necessarily give a complete picture. We also have a chasm between what the developers are doing and what is going to happen in hybrid operations, post-production.

How do we achieve the almost impossible – the end-to-end and full lifecycle levels of insights?

Khan: There are many different ways of seeing what’s going on in your environments, and ways of getting the data points from all of those insights. There’s something called MELT, which is metrics, events, logs, and traces. It consists of the most common ingestion telemetry and input data that all of the cloud tools operate with.

As you know, logs are quite informative and provide a very broad view, whether it’s from on-premises or cloud-type workloads. Logs are a good normalization mechanism. However, that’s not sufficient because logs only track the environment creating the log files. There could be more hosts out there, there could be communications not generating the level of log files needed from a security perspective.

We’re finding that -- while lot of people feel comfortable with the MELT data -- when we bring up the larger pool of telemetry-based communications happening between the hosts -- not just for managers, but for all hosts in the systems, and all the communications -- our customers say, “Wow, that is something that’s very cool, very helpful, and was never possible before.”

Gardner: How do we get past the MELT data and advance into deep observability? How do we excise that data and provide the fuller, richer, and faster view of what’s truly happening across all relevant activities?

Cooperate, collaborate for security’s sake

Khan: We have been talking to a lot of customers over many months and years about where the industry is headed. If you talk to IT industry analysts and other industry gurus, they describe where things are headed from a technology perspective.

But we took a different approach by doing research through more than 100 closed-door conversations, looking at our customer’s futures, by talking to our partner vendors, and based on other knowledge we have about the industry. Our approach evolved from a teams, tools, and telemetry perspective.

First, there are the people. What are their roles and responsibilities? In most of the cloud initiatives, there are different teams responsible for deploying and managing various workloads. You have developers on one end, all the way through to operations, and also all the way over to the NetOps side.

Now, these teams have tended to not be very cooperative or collaborative. The DevOps team is not pulling in the SecOps and NetOps as early as possible, as they should be. As a result, the SecOps team has to play catch-up. The NetOps team has to go into a mode of mean-time-to-innocence, to say, “Hey, this was not an infrastructure thing. This was some other application-related issue.”

What we have found, Dana, is these relationships are beginning to improve. People are starting to become more collaborative. It’s not overnight, but it’s getting better because of -- security. Security is the common denominator and common cause across all of these groups.

Nowadays, a DevOps person is much more conscious and spends more time working on security-related issues. The same thing with NetOps. Today, we find much better collaboration between networking and security.

Nowadays, a DevOps person is much more conscious and spends more time working on security-related issues. The same thing with NetOps. I joined Gigamon about four years ago, and I’ve had lots of conversations with NetOps teams and SecOps teams. There was a much deeper chasm between these two groups before.

But today, we find much better collaboration. It’s not perfect yet relationship-wise, but it’s better collaboration. You cannot be a network operator today and not spend at least half of your time working on security-related issues.

Now, as we said, security spans a lot of different areas. When we talked to customers, we talked to C-suite-level people in very large IT organizations. When it comes to detection, that’s not going to change; that’s going to stay a SecOps function and will stay in the security operations center (SOC), as far as we can tell.

However, when something is detected, like a breach or cyber threat activity, that’s when the other teams become involved in making the response, working on remediation, and then an even further, more-proactive stance around vulnerability mitigation. Detection and management -- that’s where all of the teams are involved working together.

Once you set down a zero trust approach, which is starting to pick up adoption as an architecture, the DevOps, NetOps, and SecOps teams are much more involved.

Now, the challenge has been that MELT consists of very powerful information. However, the tools that people use to leverage that information are siloed. They tend to be defined based on the ingestion data that they’re getting. So, when you look at metrics, events, logs, and traces, that’s the ingestion point for the tools that the developers are working with.

When you look at security-related tools, particularly data center security-related tools, which all of compliance is built on -- controls, knowledge base, all of that -- that tends to be more around packet-type information because that’s what you had in the data center. This chasm is causing a lot of problems. It prevents, for example, a DevOps person from doing security work because they’re missing out on endpoints that are not managed and don’t have an observability agent.

They’re not seeing the unmanaged traffic. There are not many security use cases that they can get to. That’s the chasm. That’s what we’re hoping the industry can address and we can help out with in the IT world.

Gardner: I completely agree that the security imperative provides a common denominator that joins disparate IT cultures, which is a good thing. If security drives a common purpose, an assimilation value, we need to get the right data to spur on that common security value proposition. How does the deep observability pipeline help get the right information to empower security as an imperative and then bring these groups together to take the proper action?

Visibility fabric sees past siloes

Khan: If the two worlds remain separate, even though a DevOps person wants to do security, they’re not able to. That’s true even using in-house observability tools based on Kibana and Grafana. These tools and the data ingestion approach is causing the groups to stay siloed, which is not ideal.

Instead, based on what we have seen over the years at Gigamon, and at other vendors as well, we have developed the notion of a visibility fabric.

Here’s why. The tools on the left-hand side cannot ingest network information, like packets and flow records, and do deep packet inspection. Yet that information is essential. We open up the packets, look at what’s inside, and create a bill of materials of what’s in the packets. We send that to the tools using such means as Kafka or JSON, depending on the tools.

Now, you’re able to use the observability tools to look for more security use cases, such as self-signed certificates, which are usually a red flag. Are there any old Secure Sockets Layer (SSL) ciphers out there in production today? That’s another vulnerability that needs to be flagged.

So, now the observability tools can be used for security functions, and not just for managed hosts, but unmanaged hosts as well.

Where the observability pipeline comes in, Dana, is something Gigamon has introduced quite recently. We have stretched the value out further so it’s not just security information, saying, for example, that Bassam is running cryptocurrency mining activity on some AWS instance. But we can also now say where Bassam downloaded an application, identify a command control communication, and determine how and where the crypto mining software was installed. All of this is packaged into a contextualized export -- a very targeted and small export -- that gets sent to an observability tool, such as New Relic, Datadog inventories, or even a security information and event management (SIEM) tool like a Sumo Logic, Splunk, or QRadar.

Based on the new level of network visibility, we can deliver much more contextualized data. The deep observability pipeline approach not only provides much stronger defenses in depth, which is what security wants, they are able to democratize a lot of the functions of security. That means they are much more efficient. A lot of the preventative and proactive vulnerability management can be done by other teams, very voluntarily. They are getting pulled into cloud projects earlier, and the DevOps people are very accepting of the security use cases.

They’re very open to it, and they’re very fast to deploy the security use cases because now they have that capability. And the vendors such as the New Relics and the Datadogs and others are now saying that the security use cases are their number one goal because there’s a lot of value.

Are they looking to move into the system-on-a-chip (SOC) and become a SOC tool? Probably not for a while. And they’ll tell you that if you talk to them. However, being able to do security functions is very important for the DevOps and the developer sides. So, they’re bringing in that capability.

The last point is kind of interesting. We’re now finding that the DevOps people don’t want to have to go into a deep observability pipeline and deploy tools that collect and aggregate network traffic. That’s infrastructure stuff.

Instead, they say, “Hey, Mr. or Ms. NetOps, can you please come over and help me deploy this because the metadata value that I’m getting out of that traffic is super useful to me.” So now the NetOps people teams are being called in early.

Based on a new level of network visibility, we deliver much more contextualized data. The deep observability pipeline approach provides much better defenses and democratizes a lot of the functions of security. That means they are much more efficient.

And here’s the side effect that we’re seeing. I’m going to date myself. I started my career in IT in the 1990s and for an investment company in Boston. We didn’t have a network team when I first joined. We had a telecoms team, and this team went through a transition throughout the 90s because they were wiring phones. But they’re also wiring network connections -- Ethernet cabling all over.

What we found is that over the years, there was a split within that group. Some of the group decided to stay in telephony and they ran the telephone systems and switches. But part of that group became the networking group -- network engineers and then ultimately architects and operators. We saw that split happen.

Now, some 20-odd years later, we’re seeing a similar kind of split happening because of this observability technology, which allows the NetOps teams to be much more involved in the cloud projects. We are seeing a split in careers as well. A lot of the network engineers are contributing and becoming much more involved -- and almost forward-looking -- with cloud initiatives. It’s kind of cool.

Gardner: Well, now you have raised another group that we should be addressing, the NetSecOps people.

Increase visibility in the cloud and network

Khan: Yes, NetSecOps becomes even more relevant because what they’re now able to do is provide a lot more value to the essential cloud operations, cloud applications, and application modernization efforts by getting more contextual information from the networks.

A lot of the cloud migration and the cloud mentality is, “Oh, I’m moving this to the cloud. It’s a cloud workload now. I don’t have to worry about the network.” And that’s true. The cloud service provider will guarantee your up-times, response rates, and bandwidth -- all of that is guaranteed. You don’t need to worry about that.

However, it’s a little bit like the baby with the bathwater, there is important information you can glean from network communications – and you don’t want to throw it all out. Now, we like to say, the network analytics data is less about gathering intelligence about the network. It’s much more about intelligence derived from the network -- and that’s where NetSecOps and even NetOps teams are playing bigger and bigger roles.

Gardner: All right, let’s unpack the packets, if you will. When we go to the network to get the intelligence, the data there can be overwhelming. Also, is there a performance hit from the tools and the analysis? What are some of the nuts and bolts, brass tacks, if you will, about practically accessing that crucial and more strategic data in a meaningful way from the networks and then sharing it in an impactful way?

Khan: You hit the nail on the head. If not done correctly, costs can overrun very quickly. I am talking about data and communication costs. The two use cases are packets, which are still very relevant in the cloud, we are finding. As people move closer to the cloud, they realize that, “Hey, we’re not able to have as much control over and visibility to the data that we need.”

For example, we recently had a conversation with Lockheed Martin about Cybersecurity Maturity Model Certification (CMMC) 2.0 compliance. As part of their requirement from a CMMC compliance perspective they need to inspect the packets -- even in the cloud workloads. The problem is you have multiple tools.

There are the CMMC compliance tools, a network detection response (NDR) tool, and more. So, you have three, four, five tools. The packets are flowing all over the place to the instances, where the tools are running in the VMs. The compliance reporting is running, and all of this can get pretty expensive. You’re paying for bandwidth over and over and over -- and not all tools need to see all the traffic.

If you take the entirety of your VM traffic, pull it all together, and send it over the wire, it’s going to get really expensive. This is where the cost-optimization comes in. It can find the tool and say, “You know what? This tool is only going to see this needed traffic.”

Not all of your monitoring tools -- or even security tools, for that matter -- need to look at all the kinds of traffic. If there’s a multi-GB Windows update, for example, not all tools need to see that traffic as well.

The deep observability pipeline approach allows customers to fine-tune -- from a packet perspective – both what types of protocols they want to see, and also, very specifically, what applications to exclude. That way we can get very, very efficient. That’s the packet inspection efficiency use case.

The second big efficiency use case is the notion of metadata, which is very important because of its capability to extract important elements from the traffic and send that off. If, for example, you have 1 gigabit per second of traffic, metadata exploitation will bring that down to less than 1 percent of the traffic coming in because it extracts intelligence about the traffic.

And, as we mentioned before, MELT data is great for a lot of purposes, particularly if there’s an agent running. If there’s an agent running on a host -- whether it’s an application, device, or a user machine or laptop endpoint -- it can get a lot of information. It can go deep into that host, find out how much CPU consumption is being taken, how much memory is left, and what are all the different services running on the machine.

However, what if there are certain data aspects it’s not able to deliver? What if that host does not have an agent? What if it doesn’t have the observability agent generating the needed level of visibility?

And there are security considerations, which are really important, particularly for our US federal agencies that use Gigamon, which is all 10 major agencies. What we hear over and over is network data is the ground truth. It’s something that’s been around for a very long time, and it’s still very true.

One of the first things a threat actor will do once it reaches the system is they’ll try to cover their footprints. The way they do that is by turning down logging levels, by hiding themselves from the logging.

Well, you can’t hide the fact that Bassam’s machine went out and talked to this command-and-control system or moved laterally. Just can’t hide that. And, so, the network data is immutable. Also, importantly, the network insights are passive in the sense that when you put an agent on a system, it’s going to impose some level of resource consumption and from a maintenance perspective. There’s patching, upgrading, and a certain level of work involved in that.

But when you’re listening to network traffic, it’s completely passive. There’s no impact on the hosts themselves, whether they are managed or unmanaged. It could be an Internet of things (IoT) device, a printer, a surveillance camera, a heart machine, or even a fish tank. There was a case of a breach in a fish tank a while ago. But the point here is that these are the two big different use cases, and the two come together to make what we call a deep observability pipeline.

Gardner: All right. Given how important this network traffic information is, let’s get deeper into what Gigamon does, specifically that is differentiated and brings this information out in such a way that it can be used across different personas, use cases, and by both the security and operations teams.

Deep observability pipeline to all the data

Khan: Our deep observability pipeline has four basic functions. The workload can run on any platform, any container, or on any physical endpoint, it doesn’t matter. We worry about the access mechanism, and we support every native data access mechanism so that our customers don’t have to worry about it. So rather than plugging in their 50 different tools that need access to network data or metadata, having to plug those tools into all of the different parts of infrastructure, we plug it in, they plug those tools on our port, either physical port or virtual port depending on whether it’s cloud or not.

We are responsible for accessing all the data. Then we can broker that out to any tool that wants packet data or metadata about the traffic. And that supports about 24 different – what we call GigaSMART applications -- where we’re cleaning up the traffic. Not all tools need to see all your traffic.

One of the most deployed functions that we have, for example, is called packet deduplication. When you have any kind of infrastructure you end up with duplicate packets because it’s an artifact of any complex type of infrastructure. And when you have duplicate packets, you’re flooding the tool with duplicate information. There’s absolutely no need for it. So, by deduplicating the duplicate packets, you’re saving a lot of traffic. A lot of organizations we go into have some 30, 40, or 50 percent duplicate packets, sometimes more. By deduping, you are instantly able to double the capacity of the tool because you’re not losing any fidelity of the data because the duplicate packets don’t do anything.

The 24 different traffic optimization and transmission capabilities come into any tool in any format that people may want. And we have been providing a lot more context around the data itself.

The 24 different traffic optimization and transmission capabilities come into any tool in any format that people want. As for Gigamon’s unique capabilities, a lot of these things are part of the visibility fabric that we talked about. The investigation part is something that’s unique where we’re contextualizing the data using our NDR technology that we have in providing a lot more context around the data itself.

Our integration with cloud-based observability tools is super unique. When you have a managed host, whether it’s running in the cloud or on physical devices, or hybrid IT, the cloud versions of the observability tools, of the SIEMs, need access to the data, and that comes in over an agent. For example, you install a Datadog agent to all of your managed hosts out there or whatever your observability tool of choice might be and you’re able to send it.

Gigamon’s GigaVUE V Series forms the intelligence, the brains, of another product. We get the traffic using our own tapping, or using native packet mirroring, if that’s available. Then using the same agent, we collect and send that data as events to the tools. It’s a completely different perspective that complements existing observability dashboards, in your queries, the alerts, and everything else your DevOps person has set up.

Again, this enables being able to do security use cases. Again, it’s not necessarily intelligence about the network -- it’s intelligence from the network. And it’s the entire network. It’s managed and unmanaged hosts. It’s hosts that are talking without any kind of agent running on them.

A simple use case: Let’s say your SIEM, your Splunk, is supposed to be tracking all of the activities of all the hosts running in your system. What our customers find, as soon as they bring in this level of visibility, is some things are missing. All the hosts are supposed to be tracked by your SIEM but there’s a delta. You’re not seeing all of the hosts. Some applications or APIs are running that are unsanctioned. Something weird is going on. They need to worry about that.

That is an example of a vulnerability, assessment, and management detection that’s now within the realm of a DevOps person who has never done that before. And in order to get this sorted out, typically, a NetOps person will come in and make sure that the agent is installed, and the V Series is running and sending the needed data over. The NetOps people get pulled in early because there’s a lot of value that the DevOps person, the right-hand side, is able to get from this and the use cases.

Gardner: We can’t do this just based on what the cloud provider has served us in terms of visibility. We can’t do this just from what we had inside our respective data centers because it doesn’t consider the entire hybrid cloud extensions of our workloads. And there may be unseen hosts. But we need to track it all.

To attain this new level of deep observability, what do people need to put in place to get there?

See all data in all the directions

Khan: The capabilities come in basically two different groups. One is the packet-type of capabilities. It is a better level of security from a NDR perspective, and from a compliance perspective.

For example, Five9, one of the largest cloud-based contact centers, needed PCI-compliance when needed they moved to a public cloud. You can’t do that without having this deep level of observability having your arms around all of the communications going on. Keep in mind this is not just for the edge, north-south communication is their public cloud. This is for east-west traffic as well, which includes VM-to-VM as well as container-to-container traffic.

For such, larger organizations with multiple on-premises and cloud workloads, the attack surface grows, which makes the need for this high visibility into packets foundational as a security requirement. The second big round-up bucket of benefits comes from the metadata.

I’ve talked a lot about the DevOps-ready pipeline. Let’s see what it looks like. As I mentioned, there are multiple partners we use. In this case, I shall go into New Relic. And what we’re seeing here is a dashboard that we have created.

We have the data coming into an agent and into the New Relic observability tool. This data is completely derived from network intelligence, from the deep observability pipeline. This is the first-ever capability of having this level of network intelligence. There will be some red flags going off. There’s SSL running in this environment, even if there’s one or two flows, one or two hosts talking SSL; that’s a big red flag. That should not be happening. Some weak cypher is running. This is the type of information that people find very valuable -- and even more so because this is being sent to a DevOps person.

Are there any Dynamic Host Configuration Protocols (DHCPs)? Are there any Domain Name Server (DNS) redirections going on? For example, I might have installed a browser plug-in, so if I type in Gigamon.com rather than just using the on-premises DNS name resolution, it’s going into a third party and that’s a big red flag. It’s just not an acceptable security practice.

I mentioned some security use cases, but they’re also performance use cases. What we can show, for example, is the HTTP response time. We also have a widget that shows the Transmission Control Protocol (TCP) response time. When data calls up and says, “Help, my application is running slow.” If the NetOps person or even the DevOps person in this case can see that TCP response time is trending flat, it hasn’t changed. But HTTP response time has spiked. That means guess what? It’s not a network connection issue, it’s an application issue because it’s at the TCP level, it’s an application-level issue. So, there is instant resolution for some of these troubleshooting types of issues.

We can also see, via simulated data, that BitTorrent is running. So peer-to-peer (P2P) traffic, which is the thing by the way. Side story, we went into one of our government agencies and when they turned on what we call this application intelligence capability, I said, “This is great. I can see all the applications. I can see what’s running.” But it’s not right because it says we have BitTorrent running in our environment, and this is a pretty secure environment. And then our sales engineer said, “No, that’s what it says and then their NetOps person looked into it like, “Come with me.” He just grabs our sales engineer’s laptop and drags him into their SOC, and says, “Guys, we have BitTorrent running.” And everybody in the room said, “No, that’s not possible.” But when they looked into it, sure enough, they had BitTorrent running. Somebody, somehow, installed that.

So even in a very safe environment, you will find unknown applications called rogue applications. Where it gets interesting is that these are sometimes crypto mining applications. There was a case a couple of years ago, where Tesla’s AWS infrastructure was compromised and rather than attacking using some direct attack onto Tesla’s applications, bringing down systems, the actor installed cryptocurrency mining called Monero, which is actually this MINEXMR, Monero, and they sat there for months and months just mining cryptocurrency.

A Google report came out about seven months ago. They looked at all of the breaches that happened in Google Cloud. They found that 86 percent of the time the attacker came in and installed cryptocurrency mining. The attackers did other things, that’s why the percentages can be over 100; they did other nefarious activities. People install cryptocurrency mining, why? Because this is the shortest route from point A to point B, which is monetization.

Gardner: How does this then relate to zero trust architectures? How does the deep observability pipeline relate to zero trust now that it’s being mandated in the public sector and it’s becoming a de facto standard in the private sector?

Gigamon at the core of the zero-trust

Khan: Yes, zero trust has been advancing in the federal space, where Gigamon has a strong presence. We’ve been going on that journey with our customers. And we’re starting to hear more about it in the enterprise business world as well.

One of the foundational approaches to zero trust is about policies. It’s about identities and segmentation. The policy engine input assumes that all of the communications are being captured. If you have blind spots, if you’re not looking at inspecting Transport Layer Security (TLS) traffic, encrypted traffic, you should be. If you’re not looking at east-west communications, container communications, that’s going to lead to blind spots, and zero trust assumes that there is visibility in all of the traffic in all of the communications that are going on.

That’s where Gigamon comes in. We provide the core foundation to what John Kindervag, a Forrester analyst, first wrote about around zero trust more than 12 years ago. He used to call it the DAN, the Data Access Network. The foundation to zero trust is being able to have access to all of the data, and that’s where Gigamon comes in.

We provide the needed telemetry, the visibility, and the blind spot elimination that are foundational for every zero-trust journey. So as a result, we’re baked into almost all of the federal organizations and federal department agency projects to build a zero-trust journey on. And we’re starting to see that happen more and more on the enterprise side.

Gardner: We’ve talked in general terms about the deep observability value, and it certainly sounds very compelling. It makes a great deal of sense given the hybrid and dispersed nature of workloads these days. Going to the network for the required insight is absolutely something that you can’t deny. But we haven’t talked about metrics, or public key infrastructures (PKIs). Do you have any demonstrative definitions, qualitative or quantitative, of when you do deep observability in these complex environments what you can get as security performance agility cost savings?

Khan: There are a number of ways our customers measure how efficiently Gigamon helps. By optimizing traffic, we are also helping all the other tools, too. So, people say, “Hey, you have this intrusion detection system (IDS) tool, you have this web application firewall (WAF), you have this application performance monitoring (APM) tool that we pay for. If I’m going to ask for additional budget to buy more of those tools, it is because I’m running this as efficiently as possible.” Gigamon shows how much traffic is coming into each tool and how much it’s been made efficient.

The first metric really is around return on investment (ROI). If you have a tool that does not need to look at, as I mentioned before, for example, Netflix traffic, they can say this is exactly what’s being excluded and this is how we’re running this tool very, very efficiently. We have six to nine months of ROI for our product itself, but then after that it’s all efficiency. And we have a very powerful ROI model that’s been used by over 200 customers. And in many of those cases we find the non-vendor spreadsheet model shows how efficiently their IT organizations are running. And a lot of our customers use that to justify additional budget.

When they put a proposal in to buy anything in the data center, we find they staple the model to the actual proposal to their finance group on why they need more equipment. That’s because we have visibility and all the data in motion to quantify the benefits from a cost-savings perspective, which is a big factor given all the budget uncertainty that’s happening right now.

Gardner: You mentioned deep observability as a force accelerator among the tools ecosystem. It frees the network data for use by many insights and analysis values. You work in an ecumenical orientation. What do your partners say to that?

Khan: Most of the new customers we work with are brought to us by partners, both technology and channel partners. We allow their deployments to be much more successful. We do that by eliminating blind spots. They need to see, for example, decrypted traffic to do their job, but they don’t need to see things that are not essential. Things like masking technologies that we provide allows a much safer way of decrypting with compliance and that allows tools to be much more efficient and effective.

The new category of deep observability pipeline and tools is where the real innovative work is happening. It’s an expansion of a DevOps person’s ability to look at 10 to 20 percent of an infrastructure that have agents running and opening their eyes to the entire 100 percent of the infrastructure by seeing all communications happening from a security and vulnerability perspective. That’s where we’re seeing a ton of traction and new partners coming to us saying, “Hey, I heard you do this. Let’s work together.”

Gardner: That’s exciting because oftentimes when you provide new capabilities into the field, people will be innovative and find creative new ways of using them that hadn’t been determined before. And it certainly sounds like we’re right on the cusp of some of that innovation using deep observability.

Khan: That’s right. Exactly.

Gardner: I’m afraid we’ll have to leave it there. You’ve been listening to a sponsored BriefingsDirect discussion on bridging the gap between daunting complexity and awesome performance requirements by getting the best visibility into all aspects of hybrid and multi-cloud continuum deployments.

And we learned how pervasive deep observability brings the highest levels of security, performance, and agility to nearly any business and organization. So, a big thank you to our guest, Bassam Khan, Vice President of Product and Technical Marketing Engineering at Gigamon. Thank you so much, Bassam.

Khan: Thank you. My pleasure, Dana.

Gardner: And a big thank you as well to our audience for joining this BriefingsDirect Cloud Complexity Risk Reduction discussion.

I’m Dana Gardner, Principal Analyst at Interarbor Solutions, your host for this Gigamon-sponsored interview. Thanks again for listening. Please pass this along to your CloudOps, SecOps, NetworkOps, and NetSecOps communities -- and do come back next time.

Listen to the podcast. Find it on iTunes. Download the transcript. View the video. Sponsor: Gigamon.

How Deep Observability Powers Strong Cybersecurity and Network Insights Across Complex Cloud Environments

2022-08-23T13:05:00.011-04:00

Transcript of a discussion on how new advances in deep observability provide powerful access and knowledge about multi-cloud and mixed-network behaviors.

Listen to the podcast. Find it on iTunes. Download the transcript. View the video. Sponsor: Gigamon.

Dana Gardner: Hi, this is Dana Gardner, Principal Analyst at Interarbor Solutions, and you’re listening to BriefingsDirect. The growing prevalence of complex multi- and hybrid-cloud environments has opened a Pandora’s Box of unseen risks around security and performance.

Gardner

But unlike when IT and network operators had the tools and access to track their own internal systems and data, the mixed-cloud model of today is much harder to know and secure. Pandora’s Box is open but observing what’s going on in and around it is cloaked by inadequate means to gain actionable insights amid all the distributed variables.

Enter deep observability and its capabilities, which are designed to provide rich access to multi-cloud and mixed-network behaviors. Such observations and data gathering can be analyzed to rapidly secure end-to-end applications and protect sensitive data.

Stay with us now as we explore the latest advances around deep observability and how a neutral deployment approach for observation technology spans more infrastructure and services to best protect and accelerate digital business success.

To learn how deep observability puts cloud chaos and hard-to-know risks back under control, please join me now in welcoming our guest, Shane Buckley, President and CEO of Gigamon. Welcome, Shane.

Shane Buckley: Thanks, it’s great to be here.

Gardner: Shane, what makes knowing and securing today’s complex cloud activities especially challenging?

Buckley: That’s a great opening question. We’ve seen over the last half of a decade or more the desire for organizations to be able to be flexible in terms of where they deploy their workloads. Traditionally workloads were deployed in the data center, with a hard perimeter, lots of security, and compliance needs were met within the organization.

Buckley

Then came the desire to create more flexible workloads, to run faster, to scale better, and also to reduce cost. The cloud model offered ways to gain these great advantages. But, as we often say here at Gigamon, the cloud is simple -- until it isn’t.

And so now organizations are looking at deploying more workloads in the public clouds as well as using colocation providers and within private cloud environments by leveraging technology such as VMware. We are also seeing the emergence of containers and Kubernetes as a technique to provide better automation, higher scalability, and lower cost.

The cloud conundrum

The great flexibility that the cloud provides is very positive to companies. It allows them to move faster. And that’s essential in the era of digital transformation because more organizations, driven by the COVID-19 pandemic, want their applications to flexibly reach more customers through remote access, handheld devices, mobile phones, and computers.

The snag is that the security footprint doesn’t track as straightforwardly as the workload boost when moving from the protected data center to a shared cloud environment. This is the conundrum companies face today. How do they make sure they can run their apps fast, stay secure, and innovate? These requirements are at loggerheads with each other. And that’s one of the major challenges that the Gigamon team’s solutions address.

Gardner: There are always trade-offs when adopting technology, of course, but when we’re forced to move quickly, the trade-offs can become riskier. When businesses could control their network perimeter, they knew what was coming and going. Now, we must take the good with the bad traffic. So, if you can’t control the perimeter, how can you at least moderate the risk?

Buckley: For many years technologies such as observability have been used for application performance monitoring. Observability, of course, is the technique of looking at an application’s performance remotely, leveraging things such as metrics, events, logs, and traces, which are commonly called MELT data, and have been very effective.

When you shift an application to the cloud, you don't have the same controls you enjoy when the application sits within your own infrastructure and you have control from the network layer right up to the app layer.

The issue though is one of security. And if you want to secure your applications, if you want to take a workload from a protected data center where you have layers and layers of security -- because security has always been about defense and depth -- and you want to shift that application into a cloud-based environment, you don’t have the same controls that you enjoy when the application sits within your own infrastructure and you get control from the network layer right up to the application layer.

So, the big question for chief information security officers (CISOs) and security professionals today is, “How do I secure the applications I have deployed to give the organization the flexibility, but maintain the security posture and compliance?” It’s become the number-one issue that CISOs face today as they try to support the business and the organization’s desire to run fast and innovate. The missing part is how to stay secure. It’s really, really complex.

Gardner: Now, ideally you should be able to attain the same level of control, visibility, and security in the cloud deployments that you had on-premises. Is that not ever going to be possible? Isn’t it simply a matter of putting the right technology in place?

Buckley: Traditionally, organizations have used layered defense tools such as firewalls, web application monitoring technologies, data leakage-prevention technologies, and the capability to encrypt and decrypt traffic streams. Yet more than 90 percent of the threats in organizations sit inside these encrypted traffic streams, which are largely bound to the tools.

As one moves to the cloud environment, this gets a lot more complicated because you don’t own the network. The network is owned by the cloud provider. And so how, in a public cloud environment specifically, or as one deploys via containers, can you see inside and see what’s happening?

Observe deeply to stay out of deep trouble

The emerging technology to fix this issue is deep observability. We refer to it as the deep observability pipeline. Deep observability is about taking the technique of observability to the applications by looking deeply inside the flow of the network traffic. Because logs and traces are mutable, they can be turned off.

And, in fact, in many environments where applications are compromised, the nefarious actor will either turn logging off or more perniciously they will overwrite the log. In that way, the security operation center (SOC) is fooled into thinking the application is performing as usual, because logs have been muted.

Network traffic is immutable. It cannot be changed. If you take a hard copy of traffic going to or from an application or server and you diagnose it, you know exactly what’s happening within that traffic flow. The ability to get to that level of granularity, that level of fidelity in terms of what’s happening inside the application -- and extract key information, which then you can send to the tools -- is really, really powerful.

It’s a technique that we at Gigamon have used for more than 15 years: The ability to extract network traffic insights and send them to advanced tools in a consistent way, same as we have done when the workload sits in a data center. Now, one can do the same with an application or workload in a data center, or move it inside a container, or inside the private cloud, or any public cloud. Anywhere across the hybrid-cloud continuum, we have a consistent approach in how we implement your security insights layer.

Gardner: It’s one thing to be able to capture and observe; it’s another thing to be able to deal with a fire hose of data. How, during the past 15 years, have we benefited from handling streaming in near-real-time these massive amounts of data in and around networks and cloud environments?

Buckley: You raise an interesting point. Networks are now operating faster and faster. More and more applications are talking to each other, particularly using technology like microservices where one application may make a call to multiple other applications -- often referred to as east-west traffic. That east-west traffic is not just traditionally inside the physical data center, this time it could be across multiple cloud service providers, or across multiple different domains; who knows?

How do you capture all the east-west traffic? Cyber professionals will tell you that lateral movement is how nefarious actors and hackers get access across the estate.You need to catch them from an east-west perspective.

As more of this traffic exists, how do you capture all the information about the traffic? Traditional firewalls, even cloud-based firewalls, typically capture north-south traffic. How do you capture all this east-west traffic, too, because as cyber professionals will tell you, lateral movement is how nefarious actors and hackers get across the estate. You need to catch them from an east-west perspective as well.

Secondarily, a lot of the key information happens on that east-west basis. It’s where you get the context of use. But trying to take all the traffic from all the applications all the time creates massive bloat. Typically, a customer’s security information and event management (SIEM) capability will fill with pretty useless information, and so it takes the SOC way too long to delve through the details and find that one needle in multiple haystacks.

The ability to instead extract only the relevant information, the metadata, from this traffic flow reduces the data volume by more than 90 percent, meaning you have a lot fewer haystacks to find that one needle in.

It also means that you can extract the data from public-cloud networks and reduce the cost of the deployment. You pay less in fees to the cloud providers as they take traffic in and out of the cloud environment to support custom or on-premises tools -- even though the application is sitting inside a public cloud. And that gives tremendous flexibility and tremendous consistency. It means that you can keep your security posture and ensure compliance is maintained across an organization.

Gardner: We want deep observability to also be extensible observability. It must observe across an end-to-end continuum of hybrid-cloud services and data flows. How difficult is it to get both deep and pervasive observability?

Buckley: It isn’t as difficult as it used to be. The technology now exists. Certainly, at Gigamon we’re providing what we call our deep observability pipeline to customers in addition to the traditional observability they get from many IT vendors. And by deep observability pipeline I mean the ability to look at the application workflows and the traffic that’s going to and from those workflows at the network level and extract the data. Typically, it’s metadata that’s extracted and creates the pipeline of actionable intelligence. That is then sent forward to the relevant tools, to SIEMs and other devices, which can then absorb or extract the information.

If you have a network detection and response tool, Gigamon provides high-fidelity traffic that has been optimized, via metadata extraction, to provide the best possible context behind that information. That’s in addition to the other observability infrastructure that you may have. Gigamon also has partnerships with many of the leading observability vendors, whereby we feed directly into their dashboards and systems the high-fidelity pipeline of deep observability information. Customers have the option of doing it multiple ways.

At the end of the day, security is about defense and depth. It’s important for organizations to ensure a consistent security posture regardless of where the workload sits. Nobody gets a hall pass if they move a workload from a protected environment such as a physical data center to a cloud environment where it’s less protected. That doesn’t make business sense. We have to make sure we provide the same level of protection as that application workload moves in a flexible way from on-premises to colocation or public-cloud models.

Gardner: I suppose all the players in this ecosystem benefit when they have access to the network data and observations. There’s no sense in trying to corner the market, if you will, or building a walled garden around the observations. It should be ecumenical observability data access in order to be the most useful and impactful, right?

Observability that’s neutral and scalable

Buckley: That’s 100 percent correct. You hit the nail on the head. We often describe Gigamon as being Switzerland; neutral, we don’t have a dog in the fight. Our job is to do the best possible job to take the most relevant information across all these different platforms and these different workloads and send it to whatever toolset that the customer is looking for -- whether you have one tool or whether you have 1,000 tools, it doesn’t matter to us.

We’ve always been neutral at Gigamon in providing the best contextual information to make the best possible decisions from a network, application performance, and security perspective. And the ability to provide deep observability pipeline information extends that now to all forms of cloud in a way that’s never been done before. We are completely egalitarian. We are completely open. We will send whatever information you want, to whatever tools you want.

Gardner: At Gigamon, you said that this deep observability technology has been in the works for 15 years, but this use case, this hybrid-cloud problem set, wasn’t evident 15 years ago. How has the background of Gigamon put you in a position to be able to deliver on these technologies and capabilities?

Buckley: If we rewind back a number of years, customers attached a toolset to a SPAN port or a switch to access the traffic. That, of course, becomes very unreliable because switches are not designed to ensure that every single packet of data on the SPAN port is transferred. There’s congestion inside the switch, too. When some anomaly happens in the network, oftentimes those packets and that information is lost, and so it’s just not fit for function.

Gigamon pioneered and invented the attack-and-aggregation technology that allows you to take a copy of traffic -- whether it’s north-south or east-west -- you can aggregate it together and send the traffic to the desired tools. Over the last 12 or so years, we’ve enhanced that to optimize the traffic, extract the metadata from the network, put application filtering rules in, and decrypt traffic at the center. As a result, we see the information uniquely across the entire infrastructure. You only do an encryption once; you don’t have to do it multiple times.

We have protected and supported the largest, most secure, most complex networks in the world. As these networks evolved to provide cloud, multi-cloud, and hybrid-cloud techniques, we have used the same architectural approach. It’s been tried and tested over the past 15 years. So instead of physical taps inside these physical networks, you have virtual taps or Open vSwitch (OVS) mirroring techniques in the cloud. We then have virtual aggregation versus physical aggregation. We have virtual optimization versus physical optimization.

The technique we use inside the cloud is the same textbook approach that we've provided to CISOs and organizations for many years, and they have relied and depended upon. Now we can scale this within cloud environments.

The technique we use inside the cloud is the same textbook approach that we’ve provided to CISOs and organizations for many years and that they’ve relied and depended upon. Now we’ve been able to transform this technology from an embedded solution inside a very high-performance hardware device to provide tremendous scalability -- scale up and scale out -- within cloud environments.

As a result, you get low overhead and very light touch. This can be built into the orchestration and automation systems that the customers have. Then it can be scaled up and scaled out, always providing the same level of protection as we used to do with our Gigamon hardware technologies that are famous within the biggest and the fastest data centers on the planet.

Gardner: If we have deep observability and it’s pervasive across cloud environments, we extract the metadata, which can be very valuable. We’ve talked about the security use case, but it seems to me that such observability provides intelligence in other areas, too.

Particularly nowadays, as the general cost of cloud use is going up, are there ways to extend observability value to help make the best use of your cloud spend? Perhaps to compare and contrast your cloud activities for the best minimum and viable fit?

Make the most of your cloud spend

Buckley: Super question, and, of course, the answer is, yes. The concept that one has to send everything to everywhere all the time is not scalable in today’s world. Whether you’re running 400 gigabits per second links to your physical data center or whether you’re running on the fastest cloud platforms in the world, it doesn’t matter.

There is a nearly infinite amount of data being sent across these very large networks on a daily basis. So, the capability to optimize the data flow, to eliminate the unnecessary data -- whether it’s duplicates of the data, whether it’s having the full payload that’s no longer required because the metadata is sufficient -- the ability to extract that information without losing the fidelity of information and reduce the quantity of information by over 90 percent saves companies and organizations tremendously.

Take, for example, the speed and the capacity of their firewalls, of their other security devices across the network, and their application performance tools. If you’re seeing a tenth of the traffic across the infrastructure, you need a tenth of the performance of the tools. This is beneficial to the customer because you end up saving money, and in a potentially recessionary environment, this is even a more important message.

But, in addition to that, because we also see all the east-west traffic, we can send more information to the tool, while it actually needs to process less. So instead of just seeing an onset of traffic, we can add that east-west dimension as well. We can also ensure that the traffic is decrypted so that all the bad stuff inside the encrypted stream is highlighted. In a very simple way, the blind spots are where the bad guys and gals hang out. We illuminate those blind spots, so we can know where they hang out. We do that in a way that sends less traffic to the network.

Gardner: What are some of the top cloud use cases for deep observability in practice? What are the benefits that organizations are getting in real terms? How does this help a CISO sleep better at night?

Migrate to cloud with good security

Buckley: Typically, a customer comes to us, and they have used Gigamon for a decade or more. We are the visibility analytics provider for their infrastructure. We have helped protect their infrastructure for a long time.

And now they have a cloud-migration project and so a requirement to move workloads. In many cases, financial institutions want to move workloads to a colocation provider or private-cloud environment. They often leverage a solution like VMware’s NSX to move an application or workload to a public-cloud provider, such as AWS, Microsoft Azure, or Google Cloud Platform, whatever. And they’re saying, “How do I do this in a way that ensures that I can get compliance approval and maintain my security posture?”

We’ll work with them usually on two types of migrations. One that’s a lift-and-shift, where you take the application as it is, which is the preponderance of applications within larger organizations. You pick it up, bring it across, and drop it inside the environment -- the container, private cloud, public cloud, or whatever. Then we reattach all the network, application forms, and the security tooling in a way that is similar to what they did before. You don’t lose anything, and you maintain everything that you had from a security and applications forms’ perspective.

The second type of application migration has the customer saying, “Hey, we’re modernizing this application to make sure it works more efficiently in a cloud environment, so it can scale up and scale out, and be in line with what the environment needs.”

That migration approach might require different tooling, but we use the very same technique. We ensure that we can capture all the traffic going to and from that application. We can process it and optimize it, as I just described, and then we work with the customer to determine the tooling for compliance and what the CISO needs to ensure the security posture of those business applications -- and then we put that all in place.

Also, now we’re seeing as many workloads move from the public clouds to a hybrid-cloud model as we’ve seen going the other way. Oftentimes customers say, “I tried an application in a public-cloud environment, but it doesn’t give me the performance and the cost savings that I expected -- and so I want to move it back.”

We enable that type of customer to have the flexibility to take the application and put it back where it was -- or put it somewhere else. Maybe they want to put it inside a private-cloud environment, or maybe they’re moving from a private-cloud environment to 100 percent public.

Whatever the customer wants to do, we will work with them to understand where it was, where it’s going, what the potential needs are. We will ensure they maintain the compliance and the security posture of that application, as well as the performance because that remains a very important component, too.

Gardner: We’re not just talking about deep observability for security and performance benefits, but you’re bringing up an important workload's portability capability. And any way to help move workloads among hybrid-cloud deployment options while maintaining security posture presents a huge digital business and economic benefit. Have people been able to share with you some of the cost benefits that I suspect are there?

Money-saving choices, app by app

Buckley: When we run the analysis with customers, we see a return on investment (ROI) in less than six months in terms of the cost associated with the Gigamon deployment and the savings that they’ll get on a go-forward basis. And that’s just direct costs. That doesn’t include operational costs and efficiencies that come with modernizing applications or moving them to a cloud framework to begin with. The multiple benefits are quite significant.

Incidentally, the latest research shows that the level of deployment to the public clouds is not as great as had been forecast. The forecast was that we should now be close to having 60 to 70 percent of applications moved to the public cloud. But we’re seeing a resurgence of the colocation model as people leverage container-based technologies and private-cloud technologies. As a result, we’re seeing the public-cloud providers themselves offering on-premises and/or colocation capabilities to leverage the flexibility and the ease-of-use of those data center-hosted application stacks.

And so, the visibility gained from deep observability to choose whatever is best on a per application basis is becoming very, very important. Regardless of what the enterprise does in terms of deployment options, they will ultimately be able to save money.

Gardner: Your heritage places you in the wheelhouse of a network operations executive or leader. But what you just described is something a bit higher, if you will, in the organization, at the architecture decision-making level. That means those making major decisions about deployment strategies. Do you need to make Gigamon’s value then known to a different persona, perhaps at the architect or Chief Technology Officer (CTO) level?

Buckley: I would say network operations executives and organizations have always been core to the success of our business. They saw uniquely the advantage of having a single platform or a fabric that gave flexibility of deployment, flexibility of scale, load balancing, and all the great advantages that our technology provides to customers.

From a deep observability perspective, most organizations have handed the responsibility of securing their hybrid cloud environment to the CISO. So now we have the opportunity to work with the app security and SecOps people, as well as the network security people.

For over half a decade now we’ve been working very closely with security groups as well -- from CISOs to security architects, security operations groups, etc. -- to understand their problems. In many ways, the value of our fabric has been tremendously well-received within security operations over half a decade.

From a persona perspective, whether you’re a network operations (NetOps) leader or a security operations (SecOps) leader, obviously we work very closely with both. From a deep observability perspective, most organizations have handed the responsibility of securing their hybrid-cloud environment to their CISO. Now, oftentimes within the CISO’s organization, which is becoming larger clearly, there are new sub-personas within that space. And so we have the opportunity to work with application security people as well as the traditional network security or security operations folks in addition to who we work with today.

The good news though is that they’re all super-connected. They have a lot of alignment between them.

Gardner: They should be.

Buckley: Yes, they should be. And so, we’re well-known. Gigamon is well-known as being inside these environments. It’s been the core platform to ensure that we provide that security footprint.

Certainly, we are spending a lot more time talking to business information security officers (BISOs), too, as well as the application security folks to help them understand how this technology can be leveraged within a hybrid-cloud environment.

Gardner: How about vertical use cases? Is there low-lying fruit? You mentioned finance. I imagine the regulatory issues there are pressing. But where does the rubber hit the road first and best for deep observability needs?

Zero trust everywhere

Buckley: Financial services obviously is a hotspot for organizations trying to secure their infrastructure, for obvious reasons. The other area that’s very important to us is our public sector business, on a global basis. The US federal government particularly has taken a very progressive view on security, with the recent executive order from President Biden for zero trust and the implementation of zero trust across federal organizations and contractors. We’re very close to that issue as well.

Security in hybrid-cloud uses many of the techniques that we leverage within zero trust. And within zero trust there are typically seven pillars, one of which is visibility and analytics. It’s considered foundational to have zero trust security, in that if you can’t see stuff, you can’t secure it. And all elements and the other pillars depend on the visibility and analytics pillar to operate.

Zero trust is not just sought by the governments; it’s of course being adopted and being used by organizations around the world. If you look at protecting critical infrastructure, for example, it’s a really big deal. So sometimes we get involved in conversations with operational technology (OT) and protecting OT devices, whether it’s healthcare, nuclear facilities, and other hardened and critical facilities for organizations, that becomes a really big deal for customers as well.

Within the hyperscalers and the software as a service (SaaS) vendors, many of the big SaaS vendors use Gigamon to provide that layer of protection to their applications because the customer often can’t secure it intrinsically themselves. So, you’ll find Gigamon’s approach or connection across many different verticals on a worldwide basis.

As we increasingly move to 5G, a core element of 5G is the capability to extract information from these ultrahigh speed networks and to provide correlation between the user plane and the control plane to provide the right traffic to the right tools at the right time.

In many of those networks, you see Gigamon is at the center of the ability to deploy the infrastructure as well. So, we’re present in a lot of these different verticals and ecosystems because it’s the same problem, but it’s just used in a slightly different way. And when you’re a fabric, which Gigamon is, you have the benefit of being able to deploy, whether it’s a software footprint or software/hardware footprint or any combination across all these different environments.

Gardner: We’ve used the word ecosystem quite a bit and that implies partners working together with other companies. Is there a channel and/or partnership benefit here? How does Gigamon and deep observability fit into a whole larger than the sum of the parts?

Buckley: As you would imagine, we work with some of the best and leading system integrators and value-added resellers and other partners on a worldwide basis. They have the ability to take all the piece-parts and bring them together. When Gigamon is deployed successfully, we’re a fabric. We provide this pipeline of actionable intelligence to customers and to tools. And then there are other tools to take advantage of that.

We're the heartbeat that makes the networks and applications run. We bring the whole value chain together. We can ensure that one plus one equals three -- or five or six.

The architectural design of the network is somewhat changed because we’re at the center. We’re the heartbeat that makes the networks and applications run. We work with a lot of the vendors to ensure that they bring the whole value chain together. They have the experience dealing with all of the security, application, performance, and networking tools so that they can interconnect it all in the appropriate way to optimize and protect the network traffic.

Partnerships within the channel and vendor community are super important. Many ecosystem vendors we work with include through joint marketing, jointly entering global markets with better capabilities, and via joint events. In doing so, we can ensure that one plus one equals three -- or five or six. We do that on a regular basis.

Gardner: Shane, in conversations I have in the field, we often talk about the most important imperatives facing organizations. Security, best use of the cloud, understanding and controlling your data, and being better able to understand your customers to provide a better experience are all among the top concerns.

And one of the salient common elements among all of these is having better intelligence about what’s going on, both in the business operations and the IT systems, and then how to constantly improve them. It seems to me that deep observability is an essential core constituent in supporting an intelligence drive within any organization.

Do you see machine learning (ML) and other analytics capabilities evolving from the benefits of deep observability and the metadata that you’re providing?

Eliminate blind spots, increase intelligence

Buckley: I agree a billion percent with what you just said. Having the right information at the right time is incredibly important for professionals, whether you’re in security or to make the appropriate decisions to protect the organization. How many times do people say, “If only I knew; if it was only possible for me to see. I had no idea that they lay inside this application or this part of my network when I was compromised.”

The ability to eliminate blind spots so that the security team has the best possible opportunity to protect the infrastructure is of prominent importance. Make no mistake, this is a cat and mouse game. In 2021, 68 percent of US organizations were hacked, and ransomware was demanded. Some 50 percent of those had to pay ransomware. And in the cat and mouse game, the mouse is winning, not the cat.

Our job is to make sure that we slow the mouse down and give the cat an opportunity to catch it faster and protect the infrastructure. But it will continue to be that cat and mouse game because as soon as we -- and I mean the whole ecosystem, not just Gigamon -- put our systems together better, the bad folks figure out ways to compromise it. That’s just the way it is.

But by streamlining the information, by optimizing the information, and ensuring that we can provide absolutely the right information -- actual intelligence -- to the right tools at the right time, we minimize the chance that the mouse gets away.

Gardner: I’m afraid we’ll have to leave it there. You’ve been listening to a sponsored BriefingsDirect discussion on how new advances in deep observability provide powerful access and knowledge about multi-cloud and mixed-network behaviors. And we’ve learned how a neutral deployment approach to observability that spans more infrastructure and services best protects and accelerates digital business value across nearly any cloud configuration.

A big thank you to our guest, Shane Buckley, President and CEO of Gigamon. Thank you, sir.

Buckley: Thank you very much, Dana.

Gardner: And a big thank you as well to our audience for joining this BriefingsDirect cloud complexity risk reduction discussion. I’m Dana Gardner, Principal Analyst at Interarbor Solutions, your host for this Gigamon-sponsored interview.

Thanks again for listening. Please pass this along to your IT operations and security communities, and do come back next time.

Listen to the podcast. Find it on iTunes. Download the transcript. View the video. Sponsor: Gigamon.

Transcript of a discussion on how new advances in deep observability provide powerful access and knowledge about multi-cloud and mixed-network behaviors. Copyright Interarbor Solutions, LLC, 2005-2022. All rights reserved.

HPE Accelerates its Sustainability Goals While Improving the Impact of IT on the Environment and Society

2022-06-22T07:54:00.008-04:00

Transcript of a discussion on how Hewlett Packard Enterprise has newly accelerated its many programs and initiatives to reduce its carbon emissions, conserve energy, and reduce waste.

Listen to the podcast. Find it on iTunes. Download the transcript. Sponsor: Hewlett Packard Enterprise.

Dana Gardner: Hello, and welcome to the next edition of the BriefingsDirect podcast series. I’m Dana Gardner, Principal Analyst at Interarbor Solutions, your host and moderator for this ongoing discussion on the impact of information technology (IT) on the environment and society.

Gardner

As businesses worldwide seek to maximize their value to their customers and communities, the total value equation has expanded to now include the impact on sustainability for the environment.

The ways that companies, along with their partners, suppliers, and employees best manage and govern their resources and assets speaks volumes about their place among peers. And it allows them to take a leadership position as stewards and protectors of the future. The sooner the world’s industries develop a commitment to reach a net-zero carbon emissions posture, for example, the better for everyone in gaining environmental sustainability.

Stay with us now as we examine how Hewlett Packard Enterprise (HPE) has newly accelerated its many programs and initiatives to reduce its carbon emissions, conserve energy, and reduce waste -- including far earlier net-zero dates and more impactful emission-reduction milestones. We’ll now learn how HPE’s newest living progress report provides a blueprint for other organizations in and outside of the HPE orbit to also hasten and improve their sustainability efforts.

Here to share the latest on HPE’s plans and goals for broad and lasting sustainability is John Frey, Chief Technologist, Sustainable Transformation at HPE. Welcome to BriefingsDirect, John.

John Frey: Thank you. It’s great to be here.

Gardner: How does HPE define ESG and how long has it been working toward improving its impacts across these goals?

Frey: To make sure everyone knows what we mean when we say ESG, that’s actually an acronym for environmental, social, and corporate governance. This is language that was first used by investors in the financial community, and now it’s used much more broadly to emphasize that when we discuss sustainability. We mean more than just the environmental aspects. We mean the social aspects as well.

Frey

From HPE’s perspective, we’ve named our ESG programs Living Progress, and that’s really our business strategy for creating sustainable and equitable technology solutions for a data-first world. These efforts are tied to our corporate strategy and our purpose, which is to advance the way people live and work.

Our programs go back many, many years. In fact, back in 1957 when our program started, the program was called Corporate Citizenship and it was based around how HPE would grow beyond the borders of the United States. We have a long history of leadership as Hewlett Packard. When Hewlett Packard and Hewlett Packard Enterprise became two separate companies, we adapted the best practices at that point in time and then built our LivingProgress programs around that.

Our programs today have three main elements -- driving a low carbon economy, investing in people, and operating with integrity. We have goals across that entire spectrum of sustainability and throughout the lifecycle of our products.

Gardner: It’s very impressive that you have been doing this for going on 65 years. How has the world changed more recently that has prompted you to accelerate, to even dig in deeper on your commitments here?

Frey: Climate change is one of the greatest threats to our common future. We recognize that we have limited resources and lots of impacts that are complex societal and environmental challenges. At HPE, we believe that addressing climate change is not only a moral imperative; it is also a business opportunity as we innovate technology to help our customers thrive in this carbon-constrained world.

Years ago, we set our goal to be net-zero by 2050, and it was backed up by science-based targets throughout our entire value chain. When we set this goal, it was clear leadership. However, the Intergovernmental Panel on Climate Change (IPCC)’s most recent reports indicate that going to net-zero by 2050 is not fast enough. We have to accelerate our goals.

HPE has committed to becoming a net-zero enterprise across our entire value chain by 2040. Our commitment is backed by our roadmap to net-zero, which consists of a science-based targets.

Therefore, HPE has committed to becoming a net-zero enterprise across our entire value chain by 2040. Our commitment is backed by our roadmap to net-zero, which consists of a new suite of science-based targets that are consistent with that one-and-a-half-degree pathway and approved by the Science Based Target Initiative.

We set those interim targets and longer-term targets. Our interim targets for 2030 include reducing our scope-one and scope-two emissions by 70 percent and reducing our absolute scope-three emissions by 42 percent, both off of a 2020 baseline. And that scope-three target includes the use of our products by our customers, upstream transportation and distribution, and scopes one and two supplier emissions. Our longer-term target for 2040 is to reduce the absolute scopes one, two and three emissions by 90 percent off of that 2020 baseline as well.

Getting to these targets will require a fundamental transformation in everything we do. Our leaders need to be accountable for driving this and we’ve tied key climate metrics to executive compensation. We will need to ‘walk the talk’ and procure 100 percent renewable energy for our own operations while at the same time helping our customers and suppliers bring new renewables to the grid where they operate.

And most importantly, we’ll enable our customers to meet their own net-zero ambitions. This is important, because about two-thirds of our climate impact on the globe occurs when our customers use our technology solutions. So HPE is putting our innovation engine into action to develop more sustainable IT solutions while working closely with our customers to help optimize their IT infrastructure so that they can meet their own net-zero goals.

Gardner: That’s very interesting when you say nearly two-thirds of the climate impacts happen in your customer base from the use of your solutions. Can you expand on that? What does that mean?

Sustainability demands change

Frey: When we think about our footprint across the company, a small single-digit percentage is because of our own operations, our buildings and our employees and employee travel and those sorts of things. Around a third of it then is our supply chain – when we bring products to the market and when we take those products back from customers at their end of life. But the bulk, nearly two-thirds of our climate impact on the globe is when our customers use our technology products.

Learn More About

HPE's Living Progress Initiatives.

For us to help our customers get to net-zero and for HPE to lower our own carbon emissions across our entire portfolio means that we really must help our customers use their technology more efficiently. So that really gets to things such as helping them right-size the amount of technology they have, increasing the performance they get from the technology for each watt. We have to help them continue to optimize in real time their technology so that it uses the lowest amount of energy and does the most work at the same time.

Gardner: It’s no exaggeration to say that it’s technology that’s going to come to our aid, but it’s technology that we need to, in a sense, solve.

Frey: Absolutely. In fact, we think of technology as a force multiplier for solving climate challenges. Technology really enables a lot of these solutions, and it also facilitates a lot of clean energy innovation as well.

Gardner: What are some of the major hurdles that need to be overcome to achieve this? It’s quite a bit to bite off and chew.

Frey: Yes, absolutely. Experts estimate that about half of the carbon reductions that the world needs to achieve net-zero emissions in the coming decade will come from technologies that don’t even exist yet. So that’s challenging. And in fact, if we look at just the companies that have made net-zero commitments already, we don’t have enough capability in terms of renewable energy and carbon offsets and things to even cover those commitments.

Technology can be an enabler here. HPE is spending a tremendous amount of effort innovating with solutions such as HPC technologies that are used by climate scientists and clean energy researchers.

So that is a huge challenge, but technology can be such an enabler there. HPE is spending a tremendous amount of effort innovating with solutions such as our high performance computing technologies that are used by climate scientists and by clean-energy researchers who are trying to find better ways to bring those solutions to market. With our customers, who are using our professional services and our technology services, instead of buying assets, we help them right-size the technology they need, we help them manage their technology from the edge to the cloud and optimize all the way through that.

Lots of opportunity. I prefer to think in terms of the positive, rather than the hurdles, which I think of as business opportunities. But what I can say from my experience working with our customers around the globe is many of our customers are really fixated on trying to help solve these challenges, many of our customers see great business opportunities in trying to help fix these challenges, and they’re all turning to technology as the enabler of that innovation.

Gardner: Yes. I’ve heard it said elsewhere. You can do quite well as a business by doing good for sustainability in the economy.

Frey: Absolutely. We fully agree with that.

Gardner: It seems like HPE has taken quite a lead here, but it involves more than just you the company. It affects your supply chains, as you’ve mentioned, your customers, your partners. So how do you characterize HPE’s role in that larger community? Are you an example to follow, maybe a facilitator, an educator accelerating growth of potential, or all of the above?

Our example: Fail fast, then innovate again

Frey: We really play all of those roles. In some cases, we are an example that others point to and say, “Hey, we’re not going down this path alone. HPE has gone down this path.” In many cases, we’re an educator and will share with customers this long sustainability journey that we’ve been on, the lessons we learned. Often, it’s better to learn from what someone who has been down the path said they would never do again, or what they learned from their journey. We so often focus as a sustainability community on the things that went well. Yet, there’s a lot of lessons learned, and we really try from an HPE perspective to take a ‘fail fast and then innovate again’ approach. We’re constantly learning, and that education has great value.

In many cases, there’s a need for a facilitator. We know that these challenges exist across many industries, but there isn’t a central body pulling together multiple stakeholders and multiple customers to help solve that challenge. A couple of examples of that are organizations such as the Responsible Business Alliance (RBA).That’s an organization that HPE helped found years ago. We realized when we were auditing factories in our supply chain that these factories were building products for other technology companies as well. So, the factories were following our expectations in the lines building HPE products but may not have been protecting workers adequately in some of the other lines. When we took a step back and said, “Well, why is that?” We were told, well, that other vendor doesn’t make us do these things, and we said, “Well, wait a minute. That’s actually not the right answer.”

If we’re really trying to make sure that workers in our supply chain are being treated fairly, paid a living wage, have their health and safety protected, and are protecting the environment that’s a non-competitive issue. So, we took a step back and formed what was then called the Electronic Industry Citizenship Coalition (EICC) and invited companies in our industry to come together to have a common set of expectations for our suppliers and then put in place assurance programs. Well, that was so successful, other industries came to us and said, “Could we adopt that same practice for our industry?” Today, the organization that does all of that is called the Responsible Business Alliance. And so, it’s having a huge impact on supply chains around the world, but all started because there was that need for a facilitator to bring companies together.

Another great example of that is the Clean Energy Buyers Alliance (CEBA). As more and more companies started making renewable energy commitments, we realized that to get the scale we needed in the pricing for renewable energy, we could do so much together as an alliance, have common procurement expectations and get better pricing.

Learn More About

HPE's Living Progress Initiatives.

One of the ways I talk about it is catalytic collaboration. How do we bring voices to the table that may not have been heard before? How do we think from an innovation and an accelerator perspective much broader than just for example, publicly traded companies coming together? How do we bring in the voice of stakeholders and customers and governments? So, in all of these ways, HPE plays a variety of roles trying to accelerate the world’s progress to solve these big challenges.

Gardner: John, it seems no matter where you live, you’re getting a steady stream of reminders about why this is important. It could be wildfires, hurricanes, permafrost melting, rising sea levels. But on the other hand, this has been a challenge for many of the rates of increase to be met or reduced. So, what are the risks for businesses if they don’t make sustainability a priority?

Ignore environmental impacts at your own risk

Frey: Well, there’s a variety of risks, but let’s start with the business risk. The missed market opportunities. Businesses cost more and they can lose customers. One of the things we know about sustainability is that in many cases it’s about preventing waste, and waste has a cost associated with it. At the same time, we find customers increasingly saying that they want to do business with companies who have strong reputations, who have strong social and environmental programs, and companies that have a purpose and assist in making the world a better place.

In all those ways from a business perspective, customers are watching what companies do, and they’re making purchase decisions based on the attributes of the companies that they want to do business with. Frankly, if you’re not being a sustainability leader or at least keeping up with your industry, you’re going to start missing many of those market opportunities.

Customers are watching what companies do, and they're making purchase decisions based on the attributes of the companies that they want to do business with. If you're not a sustainability leader, you're going to miss market opportunities.

Another one could be, and we hear this from many of our customers, in this increasingly difficult time that we live in, finding employees is very challenging. Employees want to work for a company where they can see how what they’re doing contributes to the company’s purpose. And so that’s another opportunity that they miss.

I’ll just give you a sense. We had International Data Corporation (IDC) do a survey for us last year. We asked technology executives across several countries why they were investing in and participating in sustainable IT and sustainability programs in their technology operations, and what they told us was really interesting. The digital leaders, those companies that are the innovators and the fast movers said that they were investing in sustainability programs to attract and retain institutional investors.

Now, the companies in the middle, the digital mainstream said they were doing it to attract and retain customers and the digital followers. Those companies that move a little slower are not quite as far in their own digital transformation said they were doing it to attract and retain employees. So, there’s a variety of business reasons to do this. Increasingly, there are regulatory reasons as governmental agencies start asking companies to talk about things that are either material from a financial perspective, such as we’re seeing here in the U.S. with the proposed Securities and Exchange Commission (SEC) regulations or other places around the world where there are regulatory reporting reasons to make sure that you have strong sustainability programs because you have to disclose data to a regulatory agency.

Gardner: Do you have any examples or use cases for how sustainability leadership moves beyond reputation to be a driver of business growth, which, as you said is one of the chief reasons to embrace sustainability fully?

Frey: There are a variety of opportunities. We’ve seen it ourselves. For example, in the last year, we’ve had over 1,400 customer inquiries asking HPE about our own sustainability and social and environmental programs whether it relates to our products or whether it relates to our business. That’s just one example of the way customers are paying attention and they’re asking increasingly in-depth questions. It used to be questions such as, “Do you have your own sustainability program, yes or no?” Then it moved into “Are you using some of the various standards that show us that you’re managing this as a process and as a system across your business?” Now, they’re asking us questions all the way down to “Tell us the carbon footprint of this product or solution that HPE is bringing to the market.”

Now, what we know is when we have good answers to that and we share expertise with customers, we tend to do much better from a business perspective as well, and customers want to do business with us. We certainly see on our own that there are lots of opportunities for additional value by having the strong programs.

Gardner: All right. Are there any even more specific examples of how HPE has helped customers to improve their businesses while also accelerating sustainability improvements? Do we have some concrete examples of how this works in practice?

Win-win: Great business and ESG results

Frey: Yes, I’ll give you just a few. Wibmo is India’s leading digital payment provider, and they use a variety of HPE technologies, but they wanted to consider moving to a much more flexible technology we call HPE Synergy, which is a composable infrastructure. What that really means is that you have compute, storage, and networking in a common chassis that shares power supplies and gives you great scalability. It gives you a pool of resources that the customer can tap from, and what Wibmo really wanted to do was move from a blade infrastructure to that Synergy infrastructure to increase their capability to respond very quickly to changing customer requirements. As we did that for them, to give them the same capability, reduced their IT capital expenditures by 80 percent, reduced their creation and delivery of new accounts from weeks to hours and it lowered their carbon footprint by 50 percent. So, we observed great business outcomes and great environmental outcomes coming from the work with that provider.

Now, another one was Nokia Software, and they’re an HPE GreenLake customer, which is our as-a-service offering. Nokia has always been progressive around their environmental objectives, and they wanted to strive for a carbon-negative data-center operation, and one of the things they wanted to do to achieve that was using a renewable energy source. They wanted to take water from a nearby Finnish lake to cool the data center. They wanted to move to liquid cooling and using renewable energy sources to power that data center. HPE was able to help them do that. One of the great things about HPE GreenLake is that because it’s consumption-based, we help customers tailor the infrastructure to their needs without additional equipment that is sitting there and not doing any work. We enable them to reduce their capital expenses and reduce their environmental footprint at the same time.

Gardner: Let’s talk next about one or two examples of how technology accelerates environmental change, not just from the IT perspective, but perhaps other views that are more data driven and offer the capability to exercise more efficiency, and more ways when you’ve got a data driven organization from edge to Cloud.

Learn More About

HPE's Living Progress Initiatives.

Frey: I’ll give you two quick examples. Purdue University is one, and we’re really partnering with Purdue on sustainable agriculture. One of the challenges we have as a global population is that we’re swelling to about nine-billion people by 2050. And, so, the world is going to have to double our agricultural output or have starvation challenges around the world. Purdue’s College of Agriculture partnered with us to do a variety of research around sustainable agriculture, increasing agricultural output in using edge technologies to allow farmers to really be able to tailor things such as irrigation and fertilization only to the places in their fields that they are absolutely needed. The ultimate goal of this, of course, is to drive more effective ways to grow nutritious, healthy, and abundant food for this growing planet. So that’s one great example and that research continues.

Another great example is Carnegie Clean Energy, and they’re an Australian wave, solar, and battery energy company. But they’re really focused on making wave power a reality. They’ve developed a wave energy technology called CETO that uses the wave energy off Western Australia’s Garden Island to power the country’s largest naval base.

Now, you may not realize that one of the big advantages of wave power is predictability. The sun stops shining at times, the wind stops blowing, but the ocean’s waves don’t stop flowing in. Wave forecasts can look out about a week in the future to figure out how the wave energy is going to be, and they only have about a 20 percent margin of error, which allows CETO to predict how much power is going to be generated looking into the future. It even allows them to tailor the effectiveness of CETO, based on how big or small they predict those waves are going to be. They can generate precise knowledge about the shape and the timing of upcoming waves so that they can make sure they get the maximum amount of energy from each wave that comes in.

Those are two examples of the way we’re using technology for social and environmental good.

Gardner: John, you mentioned, of course, about the long period that HPE has been involved with looking for sustainability and improvement and the impact on its communities, and you’ve just said, “Okay, we were on track, but we’re going to accelerate that. We’re going to move it forward.” How can other companies who might want to decide to accelerate what they’re doing get started? What’s a good way to think about a methodological or comprehensive way to get faster, better, and more impactful when it comes to sustainability?

Partner up for possibility

Frey: The first way we suggest is do a materiality assessment, and that’s talking to your customers, your stakeholders, and your employees about the things that are most relevant to your business and the things that you have the greatest ability to impact. So, figure out what’s most material and publish plans to solve those challenges. In fact, HPE gives an example every year in our Living Progress Report. We publish our own materiality assessment and then show how the initiatives we’re taking are driven straight from that materiality assessment.

Another thing that we would recommend is to learn from leaders. Don’t reinvent the wheel. Companies like HPE freely share this knowledge with our customers, stakeholders, and others in the broader community because we feel that not everybody needs to go back and develop their programs from scratch. Learn from those that have been doing it, learn those lessons and then use that to accelerate your progress.

Learn from the leaders, Don't reinvent the wheel. Companies like HPE freely share their knowledge with our customers, stakeholders, and others in the broader community because we feel that not everybody needs to go back and develop their own programs from scratch.

And finally, partner for success. You don’t have to go it alone. Leverage the expertise throughout your value chain. In HPE’s case, for example, we share our sustainable IT strategy, our white papers and our workbook that helps customers implement a sustainable IT strategy freely, and we put them out on the Internet so that anybody can have access to them and tap into those resources. So, look up and down your value chain and see where there are others that already have that expertise and learn from them.

Gardner: Before we close out, let’s take advantage of the fact that we must look to current and new technologies to solve these problems. What are some of the future opportunities? Even if we don’t know the how, perhaps we have a sense of the what. What is it that we can be doing in the future to bring these carbon net-zero realities right into our backyards?

Frey: We’ve talked a little bit previously about the fact that we don’t have all the low-carbon solutions we need. And one of the things that HPE did to help with that effort is we co-launched the Low Carbon Patent Pledge. HPE gathered with partners Meta, formerly Facebook, JPMorgan Chase, and Microsoft.

By putting those patents out there, making them freely available, we hope to accelerate the innovation opportunities out there. Perhaps it will be for things that we could have never imagined patents being used for, but some innovator will see a connection and be able to accelerate some new low-carbon solutions. I think there are other ways as well and that we’re seeing a shift from moving in technology from the general compute world to workload specific hardware and software solutions. We’re seeing advances in liquid cooling that are necessary as densities go up, and I think there’s a huge opportunity around software efficiency as well. This is a great untapped opportunity. Yet, some studies say that using a more effective software programming language, such as, for example, Rust, could reduce power consumption by the technology industry by up to 50 percent.

Learn More About

HPE's Living Progress Initiatives.

I think there are opportunities to have common platforms from the edge of the cloud so that we can all see across our technology operations, look at things such as utilization rates, power consumption, carbon emissions, and see those in a common way across that value chain and by being transparent, it highlights opportunities for improvement.

And finally, I think there’s a lot of opportunity that artificial intelligence (AI) and machine learning (ML) bring to optimization.

But we have to do that while paying attention to ethical AI principles as well, because these types of technologies can be misused if we’re not paying attention to the ethical implications. I feel that we have a strong need to not only use the ethical AI principles that are in place today but to continue to advance that thinking as well as more and more AI and ML solutions are brought to market.

Gardner: It’s been a fascinating discussion, but I’m afraid we’ll have to leave it there. We’ve been exploring how companies along with their partners, suppliers, and employees can best manage and govern the resources and assets for sustainability. And we’ve learned how HPE has newly accelerated its many programs and initiatives to reduce its carbon emissions, conserve energy, and reduce waste far earlier than its earlier net-zero days. So please join me now in thanking our guests. We’ve been here with John Frey, chief technologist, sustainable transformation at Hewlett Packard Enterprise. Thanks so much, John.

Frey: My pleasure. It was a delight to be with you today.

Gardner: And a big thank you as well to our audience for joining us for this sponsored BriefingsDirect discussion on the impact of information technology on the environment and society. I’m Dana Gardner, principal Analyst at Interarbor Solutions, your host for this ongoing series of HPE-supported discussions. Thanks again for listening. Please pass this along to your community and do come back next time.

Listen to the podcast. Find it on iTunes. Download the transcript. Sponsor: Hewlett Packard Enterprise.

Transcript of a discussion on how Hewlett Packard Enterprise has newly accelerated its many programs and initiatives to reduce its carbon emissions, conserve energy, and reduce waste. Copyright Interarbor Solutions, LLC, 2005-2022. All rights reserved.

It’s Official—Flexible and Remote Work are Here to Stay, Say Empowered Employees

2022-03-11T11:04:00.015-05:00

Transcript of a discussion on new research into how innovations such as contingent labor exchanges and intelligent workspaces are changing the future of work forever.

Listen to the podcast. Find it on iTunes. Download the transcript. Sponsor: Citrix.

Dana Gardner: Hi, this is Dana Gardner, Principal Analyst at Interarbor Solutions, and you’re listening to BriefingsDirect.

Gardner

The world’s office workers now have more clout and influence than ever over where and how they do their jobs. Those who have worked from home and want to continue are spurring on their employers to do more than embrace hybrid work. They’re seeking to reinvent the very nature of employment.

Stay with us now as we explore new research into how innovations such as contingent labor exchanges and intelligent workspaces are changing the future of work forever. To learn more about how flexible work models are the new normal for workers and businesses alike, please join me now in welcoming our guests. We’re here with Andrew Bartolini, Founder and Chief Research Officer at Ardent Partners in Boston. Welcome Andrew.

Andrew Bartolini: Hey, Dana, I’m glad to be here.

Gardner: Tim Minahan is also here, he’s the Executive Vice President of Business Strategy at Citrix, in Fort Lauderdale, Florida. Hey, Tim.

Tim Minahan: Hey, Dana. Glad to be back.

Gardner: Tim, COVID-19 or not, workers seem to have spoken adamantly when it comes to flexible work. What are they saying and why is flexible work here to stay?

Minahan: If you think about major historical moments throughout the ages that have kind of reset how we live and how we work, certainly the pandemic will go down in history as one of those. While no one would ever wish the pandemic to occur again, if there’s any iota of a silver lining, it’s this rapidly accelerated digital transformation which has caused employees and employers to dramatically rethink the way they work, where they work, how they work, and who does the work.

Minihan

We’ve been studying this dynamic for several years from an executive and IT perspective and the knowledge-worker perspective. The latest poll of 13,000 knowledge workers around the globe clearly indicated that folks are not going back to the office five days a week. They’ve proven that they can engage and be productive anywhere, and they’re not going back. In fact, nearly 90 percent of those who participated in the poll said they plan to work on flexible models in the year ahead, with the majority of them indicating that they plan to remain fully remote.

Gardner: Is there a back and forth in how companies have been responding to this? And, of course, it’s very hard to predict what’s going to happen in two weeks, never mind two months, but is this creating some confusion, some angst? Is that contributing to what some people are calling the Great Revelation of why workers are seeking something new?

Workers want out of the office

Minahan: Certainly, there’s a near-term part of it where companies haven’t even figured out how to get folks back safely in a condition that’s conducive to working. But more realistically, it’s been a major reset. We’ve talked about the Great Resignation but also, I have heard it defined differently as the Great Revelation.

In fact, a similar study of 1,500 knowledge workers across North America shows that as many as 50 percent of workers in the U.S. have left or plan to leave their jobs. There are several different reasons, but it really boils down to three things: burnout, opt-out, and time out.

Well over a third of knowledge workers surveyed said they left their jobs because they're burned out by the stress of working in this prolonged pandemic environment as well as over the demands in the workplace.

From a burnout perspective, well over a third said they left their jobs because they’re just burned out by the stress of working in this prolonged pandemic environment as well as over the demands in the workplace. From an opt-out part, a lot of folks either took time during the pandemic to retrain themselves, to get new skills, or they just wanted a new challenge. They’ve been working at their employer for a while and they’re looking for a promotion or they literally just want to take on a new challenge.

An interesting part of the study is a number of respondents said they ditched their jobs really to feel like they can get some control over their lives, which had somewhat gotten out of control. The last part of the study is time out, and you think about the dynamics of the workforce. We often forget, but if we can think back, unfortunately 48, 50 months ago we had a global talent shortage. McKinsey was estimating that we had a shortage of 95 million medium- to high-skilled workers, especially those with the most in-demand skills, such as cloud, artificial intelligence (AI), and security, skills needed to digitize and modernize your business. And guess what? That hasn’t gone away. So, these are the dynamics that are really causing a complete reset of the workplace.

Gardner: Andrew, it sounds as though workers have learned a few lessons through this whole experiment during the last couple of years. What’s working best for them when it comes to getting things done and how different is that from just two years ago?

Bartolini: Right. I mean this has been a dramatic, radical shift. Necessity is the mother of invention and at the core, people are resilient. They evolved when they had to. When we go back to March of 2020, there was no choice, but people found a way to keep working. Maybe they had a home office but more frequently, people were working from their kitchen tables and from their bedrooms.

Bartolini

How workers and teams were able to maintain productivity was amazing, but it wasn’t necessarily easy. Some part of our research focuses on the contingent workforce but also on the supply chain. I remember speaking to the number-two person for a Fortune 50 pharma company a couple of weeks after the shutdown. She was talking to me about how they were completely retooling several Asian factories to start manufacturing hand sanitizer because they clearly saw a huge demand or future demand coming.

We started to drill into the weeds, and I was talking about the challenges of the global supply chain. She paused and said, “The biggest challenge for us has been in dealing with the team working from home.” This was sort of at the height of uncertainty around the risks of COVID-19 and the impact there. And as someone who’s been generally working virtually for about 20 years now, I almost forgot that. I live in Boston where the rush-hour traffic is terrible because most people work in an office environment. Overnight, that changed.

It sounds odd, but the pandemic, because it helped minimize distractions -- you can’t go to a movie, you can’t go to a mall-- helped people focus on the work at hand. I think that the pandemic unified teams, I mean especially for those with family responsibilities. When you bring the office into your home, you erase the lines between work and home and things blend into each other, particularly for people with young children at home.

And so, I think the reaction to that was that team leaders and leaders of large organizations understood that they needed to instill greater levels of communication and collaboration. Really, as the leaders themselves, many chief procurement officers (CPOs) talked about having much better scheduling and interacting more with the people on their teams as well as their direct reports in a virtual environment than they had in the preceding years. So, I think it’s all part of having to learn on the fly. I think by and large, organizations were sort of able to get through the challenging time and are now settling into this period of greater uncertainty.

Gardner: Well, it seems as though the workers get it. The workers have found how to be productive and gain balance in their whole lives quickly, but employers seem to be still thinking we’re going back to the nine-to-five and the cubicles thing. Are employers lagging in their perceptions? Why haven’t they learned the same lessons of how this can work so well?

Mind the management-employee gap

Bartolini: Yes, I do think there’s always been a gap between sort of the workers and their views and management if you will. I don’t think that the gap, at least in our research, is necessarily related to the pandemic itself. When we were looking at it sort of pre-pandemic, maybe around 21 percent of the workforce was remote. We’re doing a study right now and the early indications are that post-pandemic, fewer than 10 percent maybe even fewer than 5 percent of all businesses plan to revert to the way things were, doing that nine-to-five thing.

Workers Speak: Remote Work is Here to Stay.

Now You Can Enable it in a Secure, Reliable Way.

So, I think that the gap is a larger, more general one. I mean, Great Resignation, Great Revelation right there. When you look at the shift in power from employer to employee over the past couple of years -- the McKinsey study that Tim just quoted being one great example -- we’re really dealing with the market where there’s this Great Resignation plus a huge demand for talent. There’s extremely low rates of unemployment and we’re really experiencing what we would call a talent revolution. It’s a revolution that’s hitting workers of all types. It’s hitting white collar, blue collar, and the contingents as well. It impacts their voice and what they’re looking for from an employer, whether that’s flexibility or a sort of greater alignment between the companies that you work for and the purpose of those companies.

There’s strong demand for engagement with corporate culture. This is really across the blended workforce. Look at the blue-collar workers seeking safer and better work conditions. Workers seek the intrinsic rewards, such as better pay, better benefits, but also the extrinsic benefits. There’s been that gap and employers have been slower to respond to that, but by necessity again, they’re going to need to start to craft engagement models and employment models that allow them to attract the best talent.

Gardner: Tim, what do these employees need to do to close this gap functionally even if they get it, even if they want to? What’s missing from a lot of employers in terms of making the accommodations to keep their employees happy, productive, and flexible?

Redefine where, who, and how talent works

Minahan: Now, the savvy employers recognize that this is an opportunity to drive greater innovation to recruit and retain the best skill set. They need to use a lot of the same tactics that they used out of necessity during the pandemic, such as allowing people to work more flexibly and remotely and arming them with more effective productivity and collaboration tools. They need to be able to rethink their workforce strategies. Whereas before they had to compete with folks down the street in major metropolitan areas such as San Francisco and New York, now they can hire the best talent by empowering the work wherever they want.

When they're doing thoughtful research, maybe it's time for them to be remote. When it comes to brainstorming and strategic planning, maybe its better for them to come together.

When you think about what this post-pandemic world of work is going to look like, there’s really three categories. One is what we’ve talked about and that you hear about in the press, which is where work gets done. It’s much more transcendent than just does Sam or Susie come back in the office three days a week, five days a week, or not at all? Really, it is about, “Gee, how do I create and maybe even rethink the role that the office plays? How do we create a work environment and a toolset that allows employees to perform the different types of work they do in the best way possible?” When they’re doing kind of thoughtful, meaningful research and other work, maybe it’s better for them to be remote. When it comes time for brainstorming, planning, strategic planning, that type of thing, maybe it’s better for them to come together.

Then you begin to look at your real-estate footprint. “Do we have a big office in a major metropolitan area, or do we downscale? Do we transform that office from one where everyone goes into the office, punches a virtual clock and closes the door into more of a collaboration space where they come together for very discrete moments and activities, or into a customer-experience space where we can invest more in those high-traffic metropolitan areas and create an engaging experience such as you might experience in an Apple store?” That’s the “where.”

Then, there’s the “who.” Smart companies recognize that they can use what they learn through the pandemic around remote work to go out and recruit new talent. In other areas, they’re not beholden to a commuting distance to one of their office hubs. Also, thinking about rebalancing the workforce where they might not be able to secure that developer or designer when competing with Amazon or Google on a full-time basis, there’s a whole host of very skilled and talented freelance workers and free agents who have that skill that are willing and interested in taking the projects that they want. So, you can get the top talent.

And then the last part is the “how they work.” Over the several past few decades, we’ve been amassed a massive amount of tech debt. We’ve deployed a whole host of individual devices and applications that on their own were designed to solve a particular business process whether that’s automating the procurement process or something else, right, Andrew?

Bartolini: Right.

Minahan: However, when you stack them all on top of each other, there’s a cacophony of technology now that disrupts an employee’s day. So, having a digital workspace allows an employee to have access to all the work resources they need in a very secure way, no matter where work gets done, and layers it with automation and productivity and collaboration tools that allow them to work at their best. It allows for more efficient work execution and collaboration across all of these systems so that they’re not being disrupted throughout the day, but they actually quickly can get work done, quickly find the information they need, and do their best most meaningful work.

Gardner: Andrew, Tim just laid out some interesting things around where and who and how but the “who” kind of jumps out at me. It seems to me that a full-time employee (FTE) isn’t the only option. You don’t always need to know where they are, but maybe you also don’t need an FTE for every type of process or productivity. So, what is the future of work exchange and how should we think about the types of labor categories differently while we’re re-examining everything else at the same time?

Flexible work here, there, and everywhere

Bartolini: Tim is exactly right, and I think your question is absolutely on point. So, the future of work exchange is a web site that our partners launched only last year. We’ve been tracking the growth and expansion of the contingent workforce since the start for the past 13 years. They’ve really focused on what we define as the future of work and we think about that as the strategic optimization of how work gets done through the evolution of talent engagement, the advent of new technology and innovative tools, and the transformation of business standards.

And the reason why we’ve invested greater resources in this area is because the growth and expansion of the contingent workforce, the extended workforce -- it’s called a lot of different things today-- has grown dramatically over the past decade. Our research shows that 47 percent of all workers working for a company today are not FTEs. So almost half of all workers are contingent workers. They’re the independent contractors and consultants.

A decade ago, that number was 25 percent, and we expect that number to climb above 50 percent. We expect there’s probably a natural ceiling that will be hit at some point in a world where talent continues to be a major differentiator. But as organizations start to be more focused on “how” work gets done, rather than “who” does it, there’s been a shift. We’ve erased many of the geographic constraints that companies have traditionally had when trying to staff projects and to find the best talent. That’s been removed by technology and the advent of digital marketplaces where people can find the talent and do matching.

Workers Are on the Move. Here Are Five Things

To Keep Your Business Moving With Them.

There’s been a shift in the way that organizations are thinking about what it is that they need to do to get their projects done, to get their work done, and it’s moved from the old view where the contingent worker was the temporary employee. Somebody’s going on vacation, somebody’s going out on maternity leave, we need to find somebody to fill a tactical position. Now, the expanded view of who we can bring in to do work and what that work is, much more strategic projects. It’s an evolving mindset that has been accelerated by the pandemic. It’s an interesting and exciting time for those working in procurement and HR to get their hands around what does their total workforce look like as they go forward.

Gardner: Tim, Ardent Partners reports that almost half of the workforce is no longer full-time. That means when they start working for a company, they’re not onboarded in the same way. They don’t get, “Here’s your 15 applications. Here’s your laptop. You have now 45 different sign-ons to deal with.” Now, you need to do all that on a more granular basis, maybe focused on a process or a project, not on an employee definition. How can technology support this interesting new mix of types of workers when it comes to getting things done?

Minahan: You’re absolutely right. That is something that companies had to grapple with throughout the pandemic. I’m thinking of some of our financial services customers that saw, as you might expect, a dramatic uptick in their remote financial advisory services.

One was telling me that they hired 3,000 new employees during the pandemic, and they needed to onboard them all remotely. They needed to get them technology very quickly, they needed to get them access to the applications and information they required and that was where they kind of really embraced a secure digital workspace strategy, leveraging in this case our desktop as a service offering to be able to quickly stand up a desktop that had a personalized workspace for that employee.

Thanks to virtual desktop-as-a-service, employees were able to get all the onboarding materials delivered in a reliable and secure manner so they could ensure the corporate information remained private and secure.

In some cases, they would send out a thin client device like a Chromebook to allow that employee to have access to a device. Or, in other cases, at least early on throughout the pandemic, they would allow them to use their home device. Because they had a virtual desktop-as-a-service offering, they were able to ensure that not only did their employee have reliable access to all the onboarding materials, all the applications, all the training, all the information needed, but also that it was delivered in a reliable and very secure way so they could ensure that their corporate information remained secure.

This is offering a whole new flexibility particularly as we look at who does the work. As we’ve transitioned virtual desktop delivery from on-premises to the cloud, it’s opened up and made desktop delivery much more turnkey and much more practical for a broader set of use cases. So, not just FTEs, but contingent workers, seasonal workers, temp labor, these freelancers that we’ve talked about, designers and the like, it’s allowed companies to stand up and empower and onboard these employees very quickly without putting their corporate resources at risk.

One great example of this is a customer and innovation partner of ours, Major League Baseball (MLB), which, throughout the pandemic in the full spotlight, had to grapple with how to put the season on, how to keep the players and employees safe, how to empower them. But at the same time, everyone was seeing rising incidents of cybersecurity threats. They were able to empower not just this employee base but also their supply chain with desktop services.

A lot of their supply chain partners are small partners and they needed to step up their security requirements and they just didn’t have a large IT department. So, MLB basically extended this desktop service to that supply chain so that they could be compliant, continue to deliver the high grade of innovative and quality services that MLB needed while meeting the stepped-up security requirements. And so, I think we’re going to see a massive shift if we believe that flexible work is here to stay. The only consistent place that an employee is going to work is going to be their digital workspace.

Gardner: Andrew, sometimes I think we get complacent about how important a role this technology is playing in allowing this all to happen. One of the ways for me to wrap my head around how essential and innovative and powerful the technology is, is to say, well, what if this pandemic hit 10 or even 15 years ago? If this had happened 10 or 15 years ago and we didn’t have cloud computing, we didn’t have desktop as a service, and virtualization was just starting out, where would we have been? It seems to me that we lucked out, right? We got just over the line on where this technology is capable enough to allow people to work remotely almost anywhere on the planet. This technology is, I think, underappreciated.

Tech enables transition to digital workspace

Bartolini: Yeah, I would say, no doubt. I mean, there’s been a long steady march towards driving improved communication whether that’s among teams and the capability to chat or among trading partners as well. I mean, that’s another piece. If you think about the growth of the global supply chain, that’s been a technology-enabled phenomenon as much as anything else, when it comes to the workers and to the workforce, right?

If this was 10 or 15 years ago, I’d like to think that we would have seen many of today’s innovations come along much sooner. But from a workforce management standpoint, when you’re dealing with a workforce that is not full-time, that is much more transient in how it engages and how you engage, your approach to that workforce necessarily has to change. From a technology standpoint, if you have your old HR playbook of how you onboard a traditional employee, you need that same playbook now for the freelancers, for the temps, and you need to have those things codified and smooth because there’s a war for talent that’s going on right now.

And so, it’s not just the FTEs that are picking and choosing when and how they engage. It’s the independents as well. It is this extended workforce. And so, you as an organization have to be at the ready. You have to be the employer of choice whether that’s a short-term project or the long-term employer of still 50 percent of the workforce.

So, yes, technology has been absolutely critical, and it is only going to play a greater role. When I speak to procurement leaders, CPOs and directors of sourcing, there’s been a shift that has happened and it’s going to continue to happen. As you see company offices and the investment in corporate real estate shrink, that money is redeployed to productivity tools, to technology that can create the digital workspaces that Tim has just been talking about. So, there is this transition, and the technology has absolutely played a key role.

Gardner: And Tim, we talked a little earlier about employers needing to close the gap between recognizing a flexible workforce future. It seems to me that this has forced them to appreciate how impactful the technology can be, and in many ways, we’re only scratching the surface of what the technology is capable of. So, is the silver lining here that we’ve created a catalyst to technology adoption and therefore also a catalyst to further technology development?

Minahan: Yes, Dana. I think it’s the combination. Certainly, the pandemic has expedited everything as folks are looking at accelerating their digital transformation and the shift to more flexible work models. That is causing companies to think not just about how to deliver all the work resources, all the applications, all the content, all the collaboration tools that employees need to be productive and do it securely so they can work anywhere, but also looking at, “Gee, how do I help them work better?”

At the top of the list for prioritized investments for IT are collaboration tools that foster more efficient work execution across all these distributed work environments.

If you look at any of the analyst studies out there, at the top of the list of prioritized investments for IT this year are collaboration tools. Tools that foster more efficient work execution and collaboration across these distributed work environments. Some of them are actual tools such as whiteboarding tools, project management tools. And some of them are actually, this role in robotic process automation (RPA) or automation providing a way for frontline business analysts and business users to knit together all of the source systems to complete a single business process so that employees can actually not be burdened by technology but can drive differentiated business processes. That’s a key opportunity as companies are looking at, “Gee, a lot of the stuff I invested in out of necessity during the pandemic is now allowing me to drive new business processes and innovation in my business that I couldn’t think through before.”

But all of this needs to be accompanied by changes in policy and ultimately culture. So, if you think about our experience during the pandemic including on this podcast here whether we’re using Zoom or Teams or whatever, it was really the great equalizer. We all have the same size box, we all have the same access to the same tools, the same information but as we rotate back to what a lot of folks are trying to work out as hybrid work, it opens up the opportunity to create a high level of inequity in the workplace where you have these battles between the office-first culture and the remote culture and how you run meetings.

Gardner: We used to call them road warriors, remember?

Equality essential for hybrid workmates

Minahan: Exactly. And it’s a big shift that we need to talk about. How do you create equity in the workplace? You just assume that you’re going to have a planning meeting, a work environment where you’re going to have remote workers and in the office workers and how do you create that equality? So, as we talk about this hybrid work model, companies really have an opportunity now to figure it out.

Here at Citrix, for example, we are retrofitting all of our conference rooms to be hybrid oriented. We’ve got cameras now in the middle of the table. We’re operating on Teams whenever we have a meeting. We’ve got cameras on the whiteboard and we’re trying to develop protocols or policies that include remote people participating in a meeting. For example, they get to respond or ask the first questions. Those types of things which we haven’t really thought through need to be thought through, in addition to the technology infrastructure that enables such work.

What is the Future of Digital Workspaces?

Tune in to The Future of Work Podcast.

Gardner: Andrew, companies right now are sort of dealing with some tough, thorny problems around flexible work models and also the talent shortage. What does your research tell you about what they should do sooner rather than later in terms of how to best adjust to this? What is the research telling you are sort of the fast-track things that people should be doing to be best prepared for our strategic approach to these problems?

Bartolini: The new flexible work model, the extended or contingent workforce and its growth in size and in strategic impact really has changed the way that organizations need to engage talent. So, if you are a hiring manager, if you lead a large organization, hiring is now a 24/7, 365-day activity because workers’ duration and the amount of time that they’re staying with a single employee also has shortened dramatically.

And so, you need to be developing and building a talent pipeline and maintaining that pipeline in an ongoing fashion. You need to be working to become the employer of choice. The research that we’ve seen and the strategies that organizations should be employing, if they haven’t already, include that there needs to be a more empathetic approach to how you manage your people. I think that the workforce today, because of the labor shortage or the low unemployment and the high demand for talent really has allowed employees to spend more time seeking out the jobs with employers that match their own sensibilities.

Is there a purpose that the company can communicate to their candidates and to their current workers? What is the culture of the organization and how is that culture manifested when you’re dealing with people that are in a distributed environment and not meeting face to face? How are you thinking about the benefits and how are you trying to better understand what it is that your workers need from a flexibility standpoint?

I think all of those things sort of go back to how do you engage your talent? And that’s the talent that you’re trying to recruit to bring into your organization and the talent that you have now that you’re trying to retain.

Gardner: Similar question for you, Tim. As companies are grappling with flexible work and talent shortage issues that are critical, what does Citrix’s research and its product development efforts tell you that they should be doing now tactically in order to be set up strategically for this cultural shift as we’ve termed it?

Minahan: The number one thing, if you look at it, is that 90 percent of employees plan to use a flexible work model this year. And 80 percent prefer to continue on in that fashion. Companies really need to think about their workforce strategies in different ways. They need to be open to flexible work arrangements to secure the top talent and the modern skills that they need, but also to retain their existing talent who are increasingly looking for new opportunities in this hot job market.

Secondly, they need to create an environment from a technology standpoint that is conducive to allowing employees to do their best work. Before, if everyone was coming into the office, your technology investment was pretty systematic. Now, you have to look at what it is going to take to empower an employee to work from their own device while protecting corporate resources, while ensuring that they have the collaboration, communication, and productivity tools that they need to foster more efficient work execution and collaboration across this distributed environment.

Those are the types of things folks need to think about. But they need to be coupled with a change in policy and culture. One that is forward thinking about, “Okay, if I have a new workforce strategy that is a balance between FTEs and contractors to make sure we have the right skills on the right project and people who are managing things in much greater pools of talent. What are the policies that we need to put in place to make that most effective?

If I know my employees and assume that we’re always going to be in a work environment where we’ve got to have in-person and distributed folks participating in the same meeting, what am I doing to foster an environment that makes it a meaningful experience for everyone involved, not just those who are sitting in the room? And then finally, what am I doing culturally to ensure that development opportunities and career advancement opportunities are not hindered by the choice of where an employee works?

There’s a major reset that companies need to think through. In order to be competitive, to be able to secure the top talent, tame the top talent, and drive and modernize your business with this talent, you need to adjust on those three vectors.

Gardner: Tim, I really respect the amount of research that you’re doing there at Citrix. You’re being empirical and not just using gut instinct on this and that’s great. And you’re also sharing this research, so where can people go to learn more? Where can I find some of the resources that Citrix is providing?

Minahan: I appreciate the feedback, Dana. You can go to Fieldwork by Citrix where we incorporate and make our research available. We also have our own kind of remote-work podcast there. Go to www.citrix.com/fieldwork to check it out.

Gardner: Andrew, where can people learn more about Ardent Partners, their research, and the future of work exchange?

Bartolini: Go to futureofworkexchange.com, that’s our site that’s got all of our current research and innovative ideas and tools. Tim even has a few articles up on the site there, too, which we appreciate.

Gardner: I’m afraid we’ll have to leave it there. You’ve been listening to a sponsored BriefingsDirect discussion on ways workers and businesses alike are adopting flexible work models as the new normal.

And we’ve learned how innovations such as contingent labor exchanges and intelligent workspaces are empowering workers to control their destiny and reward their employers with higher productivity.

So, a big thank you to our guests, Andrew Bartolini, Founder and Chief Research Officer at Ardent Partners. Thanks, Andrew.

Bartolini: It’s been great, Dana. Thank you.

Gardner: And with Tim Minahan, Executive Vice President of Business Strategies at Citrix. Thanks so much, Tim.

Minahan: Thank you, Dana. I appreciate the dialogue.

Gardner: And a big thank you to our audiences as well for joining this BriefingsDirect future of work innovation discussion. I’m Dana Gardner, Principal Analyst at Interarbor Solutions, your host throughout these series of Citrix-sponsored interviews.

Thanks again for listening. Please pass this along to your community and do come back next time.

Listen to the podcast. Find it on iTunes. Download the transcript. Sponsor: Citrix.

Transcript of a discussion on new research into how innovations such as contingent labor exchanges and intelligent workspaces are changing the future of work forever. Copyright Interarbor Solutions, LLC, 2005-2022. All rights reserved.

How Low-Code Development Has Entered a Maturity Spurt Thanks to New Process-Oriented Capabilities

2022-02-13T12:43:00.017-05:00

Transcript of a discussion on how the current maturity of Low-Code development will revolutionize the delivery of essential business applications.

Listen to the podcast. Find it on iTunes. Download the transcript. Sponsor: Appian.

Dana Gardner: Hi, this is Dana Gardner, Principal Analyst at Interarbor Solutions, and you’re listening to BriefingsDirect.

Gardner

Closing the gap between the applications and services a company needs -- and the ones they can actually produce -- has long been a missing keystone for attaining digital transformation.

For increasingly software-driven organizations, the speed by which developers produce the needed processes, data flows, and business transactions has been much too slow for much too long. Fast-forward to the pressing new requirements of pervasively digital business in 2022, and it’s abundantly clear that something has to change.

Stay with us now as we explore the latest capabilities and burgeoning strengths of Low-Code software development. To learn how the current maturity of Low-Code development will revolutionize the delivery of essential business applications, please welcome Matt Calkins, Founder and CEO of Appian in Reston, VA. Welcome, Matt.

Matt Calkins: Hi, Dana, it’s a pleasure being here.

Gardner: Matt, in a nutshell, what is Low Code, and why is this a great time for it to revolutionize digital business?

Calkins: Low Code is a new way to build applications and processes. Instead of using code, drawing your code line by line, you make a picture. You draw a flowchart with lines, boxes, and arrows -- with a start node and an end node -- and that becomes your program.

Calkins

Instead of thinking of a program, it’s now like a series of characters and instructions. At its essence, it’s a drawing. That’s a very human way to program and to envision a process. It’s a very human way -- and it’s empowering to people because it’s intuitive to all of us. It’s also a lot faster. And this is the key advantage of low code. When you do less coding, you move faster.

Now a person can describe a new process by drawing a flowchart -- maybe 10 times as fast, even 20 times as fast, as they could have described the same process using lines of code. When you put that kind of power of speed in the hands of a person, they can develop a lot more software. They can not only develop it, but they can also go back and change it periodically to keep up with the times. It allows far greater flexibility in the way your organization behaves as expressed through software.

Gardner: What is it about the maturity of Low Code now that has more people excited about using it?

Speeding the inevitability of change

Calkins: Low Code is about speed, and speed is helpful because it helps you keep up with change. There’s never been a time that there’s been so much change to keep up with. In the last few years, change has gone from being a nice-to-have to being a must-have.

We've been talking about change and digital transformation for years, but it's never been so imperative as in the last few years. We've now reached a turning point where change is no longer an option.

In the pandemic, every organization had to change to survive, to keep up with the way their customers wanted to do business, the way their employees wanted to work, the locations from which they wanted to work, and to keep up with regulations.

We’ve been talking about change and digital transformation for years, but it’s never been so imperative as in the last few years. We’ve now reached a turning point where change is no longer an option. It’s a necessity. The speed of Low Code allows you to change -- and change is what we’re all about at Appian.

Gardner: So, what can make software development more of a wind in your sail rather than an obstacle to overcome?

Calkins: Software has been too difficult to create -- and to change. Someday we’re going to look back on this period of history and be amazed at how hard we made it on ourselves to program our machines. And how difficult it was to change the behavior of our organizations, because, of course, our behavior is written in software. We’re going to look back and think it’s astonishing that our software was the most immutable thing about our organizations. It’s harder to change than our building, our logo, or our management. Anything could be changed more easily than our software.

That makes no sense to me, because software is ideas, and it should be easy to change them. But the way we’ve created code is so difficult. This structured language with which we instruct machines, it is so complicated, it is so inscrutable. If you didn’t write it, it’s hard to know what the person who did write it was thinking.

It remains very difficult to create and to change our applications. This has got to change. We know we need more software -- and we’re not getting more developers. So, one way or another, we need a faster way to create and change our software.

Low Code is such a way because it makes it intuitive. You’re drawing, you’re dragging and dropping boxes and arrows; it’s very human-like in the way we’re communicating. It’s the last link in a long chain of advancements in the ease by which people instruct their machines. Starting with Ada Lovelace programming the Babbage machine, and all the way up to the present day, we have kept making it easier to program our computers.

Get the Full Guide

On Process Mining for Change

Low Code is just one more step in that direction. It’s not a finished step, we keep trying to make Low Code more intuitive, using more wizards, more drag-and-drop, and minimizing the need for anything that looks like code. We keep working on that, and now we understand the urgency between the global demand for new processes or software and the urgency of change in the pandemic era. We have every reason to be as fast as possible in the way we provide change to our customers.

Gardner: I suppose another difficulty has been the communication of requirements from those who are in the trenches, so to speak, to those who are doing the software development. Is there something about Low Code too that helps understand what the business is doing? Is there a benefit not only in the coding, but also in the communication?

Calkins: Yes, absolutely, there is. If you or I were to look at a Low-Code application, we would understand the main structure of how it works. We would understand the flow because it is a flowchart.

By making it understandable to everybody, even the ones who didn't program it, we've democratized the meaning of a program. We're made it easier to create that program.

By making it understandable to everybody, even the ones who didn’t program it, we’ve democratized the meaning of a program. We’ve made it easier to create that program, but also easier to understand it and therefore, to validate it, to look at it and think that’s not exactly the way I believe it should work. If I’m in the trenches, you may have written it, but I’m looking at it and I know that it’s not right.

That’s a higher degree of common knowledge that will help us be on the same page, write better software, and pivot our organizations more quickly to match the needs that only our people in the trenches, as you say, know that we have.

Gardner: You mentioned earlier, Matt, that we’re having a hard time finding developers. Seems like we’re having a hard time finding all sorts of skills and labor, but development seems near the top. If we have a finite set of resources, but we have growing demand for software, how do we reconcile these two realities?

Calkins: We’re just going to have to get better at creating applications more cheaply and with less time. Because we can’t continue these two curves; they’re diverging, and we need way more software and we’re not getting way more developers.

And for that matter, the cost of a developer we can get is very expensive. So, we need to be more efficient and get more applications per developer, per year. So, if it’s not Low Code, it’s going to have to be something very much like Low Code, a more human, intuitive, and faster way to express our instructions to a machine.

Another way you do this, of course, is to democratize programming to the point where not everybody who does it has to be a “developer,” maybe we could take somebody who’s a power user and bring them in and make them a programmer.

Maybe we could create a programming language, a Low-Code programming language, that is easy enough so a fairly technical person could spend a month and become a productive professional developer in this medium. That’s what we’re going for. We want to democratize access to programming so that more people become developers -- and developers become far more efficient.

Pioneers in democratizing programming

Gardner: What is it about Appian’s legacy that puts you in a position to be helpful in all of this? What is it about what Appian brings to the table that helps make this transformation?

Calkins: We’ve been focused on this for a long time. For about 15 years, we’ve been on this exact issue. How do you create a program by drawing a picture? I encountered that idea nearly 20 years ago, loved the concept, felt it was necessary.

The way the world was going -- more software, not more programmers -- I realized we’re going to need something like that. So, we have been working on it for more than a decade and a half. We were the first Low-Code company to go public in 2017. We’ve been pioneering this space; we’re not the only pioneer, but we’re definitely one of them.

We’ve put a lot of thought into this, and our entire business is focused on just this: Empowering people to create their processes. And so, we’ve a lot to add. We’re setting the standards. We’re creating the new shape of the market. We’re introducing the new nomenclature.

Low Code wasn’t a big thing when we decided that that was the right term. We went public with “Low Code” as our headline, and a lot of people thought, “Oh, you shouldn’t do that. You should always go public with a very famous well-known market.” But we were first. And now, it’s a much bigger deal.

Gardner: I’ve been curious over the years as to why, as software become more sophisticated – with computer aided design (CAD), engineering, and media and video production, and the design of homes and buildings – that it seems like developers put all their emphasis into automating the business tasks of others. Have they been too busy to automate what they were doing? Do the cobblers’ children have no shoes? Why has the development of software for the development of software lagged?

Calkins: You know, it’s funny. You’re right on this dichotomy. You could think of the advances in software as being of two types. There’s the sheer power inside the software application. And then there’s the connection from the user to the application. And, of course, according to Moore’s Law, the processing power is increasing all the time.

We have so much more power to work with. It’s incredible what these programs can do. But the interface hasn’t advanced as much, has it? The connection between a human and the machine is not advancing, not according to the pace of Moore’s Law.

Sometimes it seems pretty backward. It seems like we ought to be able to do better in facilitating human-to-machine collaboration and instruction. And at Appian, that’s what we’re all about. You can’t just surf the advances in the latest chip technology. You have got to think about what would be more human and what would be more intuitive and empowering. That has to be a critical area of advancement as well.

Gardner: Well, the need for improvement is very clear. So, Matt, as an industry, where is Low Code going?

Low Code with a purpose

Calkins: Low Code is in the midst of a dramatic change. Like all industries that reach maturity, it has to change at some point from focusing on what it does to focusing on what it’s for. So far, the Low-Code industry is focused on what it does, and you can see that in the name Low Code even. That’s what it does. It gives you an interface to create a program with less code, that’s Low Code.

We need to make it easier to conceive of a new process, design it, deploy it, run it, and change it -- end to end.

What it doesn’t address is what it’s for, and what it’s for has changed. This industry is now about providing the ability to bring change to our customers. Our customers want to create a new behavior, and these days behavior is done in software. You’re going to create a new process.

We therefore need to make it easy for a customer to conceive of that new process, design it, deploy it, run it, and change it -- everything about it, end-to-end. We are going to be a change engine that allows them to create -- and do everything -- with a new process.

That’s the emerging mission for our industry. We can’t afford any longer to be about the technology. We must be about the effect of the technology.

Gardner: Matt, can we unpack this for two different constituencies? One would be the business leader, so they understand what you’re getting at. But also the technologists, the IT people and developers. What does this mean for businesses, and what does this mean for technologists?

Calkins: First, it means that business and technology are going to be using the same product. Instead of having a product for business, a product for technology, and yet another product later on -- we need a unified suite. We need a change engine that gets you from discovering your new process to designing your new process to automating and deploying your new process. The business will be involved in this largely in the discovery phase and the return on investment (ROI) phase.

Get the Full Guide

On Process Mining for Change

And then, the technologists and the developers are involved in the design, deployment, and automation. It’s going to be one platform, a single product with a single stock keeping unit (SKU) getting you from the beginning to the end on a new process as fast as possible. By bringing all these people together via a common language and common interface, we make it so much easier for businesses to change. And if you don’t think this is necessary, just consider how much difficulty businesses have today with changing fast enough.

They’re always behind the times, always behaving a little too slowly, always reacting to new ideas slower than they should; always, like you said, having their aspirations unmet and their backlog too big. Businesses need to move faster. They need change. And so, we’re providing a change engine to facilitate that most fundamental want in every business I’ve seen.

Gardner: Another trend I’ve noticed over the years, Matt, is that in development, we go through a pendulum swing between centralization and decentralization. On one end there are a lot of different new tools, better testing environments, and yet a lack of integration between them all. That gets too unwieldy, and we swing back to more centralized and integrated platforms.

Is that what’s happening with Low Code as well? Are we swinging in one direction or the other?

Calkins: You’re completely right about that pendulum. I’ve seen the same thing over the last few decades. And lately, the pendulum has swung pretty far toward the power of the largest stack vendors and the big technology vendors. They’ve become exceptionally powerful, pervasive, and irreplaceable in many organizations.

I believe that the pendulum, when it swings, is going to swing back in the other direction. It’s going back to best-of-breed because best-of-breed tends to have better products. It’s going to be very important for customers to get the speed of change that they want and the agility in the way they execute their plans.

Big tech is going to be a straitjacket to achieving that. So, they’re going to want freedom of choice. They’re going to want to be able to plug into whatever data sources they may have around the enterprise instead of having to move all the data to one location.

There’s going to be a swing back in that pendulum toward best-of-breed and freedom, and the natural idiosyncrasy that emerges in any large organization. You can’t put that in a straitjacket or a cookie cutter. They’re going to want to express their unique plans and their unique backgrounds.

Low Code is empowering because you can program quickly -- and so you can change quickly. You can adapt to your unique organization and your own data from many different places.

Low Code is an empowerment tool in this way. It’s empowering because you can program quickly -- and so you can change quickly. But it’s also empowering in that you can adapt to the unique organization that you already are. You can adapt to the fact that you have your data in 27 different places. Some of them are in the cloud, and some of them are on-premises. They’re in different formats. Some of them are databases that you haven’t touched in 20 years.

Your data is scattered, right? That’s a situation that demands freedom, and Low Code is very good at adapting to unique situations like that. So, Low Code is empowering in that it facilitates idiosyncrasy and it also is going to benefit from that swing away from centralization and toward best-of-breed and individual empowerment.

Gardner: When we look for the best-of-breed approach to things like process mining, Low Code, and democratization of skills, are there specific use cases that come to mind where this will be the most valuable the soonest? Is there a low-lying fruit, if you will, to where Low Code platforms will emerge so that the early adopters get the best, empowering results?

Behavioral change in software

Calkins: Every organization of scale needs change, especially in the last few years, because change has become such a norm. Every organization is going to need to make changes.

Imagine a new regulation. Imagine entering a new business. Imagine launching a new product. Imagine having your customers expect something different from you and needing to change your behavior to adapt to that. Imagine your employees saying that they want to work in a new way from a new location, in a new pattern, and on different hours. All of these things require new behaviors. And when you adopt a behavior at scale in an organization, you are always facilitating it with software. So, every change an organization needs to make now is a change that is written or drawn in software.

For example, we recently helped a large financial institution, maybe the most famous financial institution in the world. They were launching a new product, entering a new market. They needed new behaviors and they realized they couldn’t code it fast enough, so they turned to us.

They used our Low-Code platform to program the new behaviors, the new case management that they required to launch this product, and then they were able to launch on time. It was successful. Every time they have to make a new launch or adjustment or behavior around this product, they can come right back to this platform and write some new processes and it’s as easy as drawing.

It’s Low Code, very simple. It’s become a major part of the way they do business. They’ve relied on Low Code to enable their agility -- and every large organization is facing the same situation. They need to be agile. They’re looking for a means to change quickly and Low Code can be that.

Gardner: Matt, are there any misconceptions that you find in the field about Low Code? Perhaps it’s time to better understand the reality. It sounds like from that last example that there are some people who might not be understanding the benefits.

Calkins: The biggest misconception about Low Code is that it isn’t powerful. It’s simple and so, people assume that it’s a toy. But it’s anything but. In fact, it is as powerful as a development language. It’s in use today by the largest organizations in the world to create some of the most important processes that they run, processes that are a matter of law or a matter of satisfying the customer that addresses the core workflows in an organization. Low Code is used for some of the world’s most important processes today, and so, that’s the number one misconception.

The next misconception is that it’s hard to get into. Low Code in fact is exceptionally simple to get into. In fact, you could log on to Appian’s website and learn right there. We have videos, there’s a training course, there’s a free environment that you can use. We’re making it as easy as possible to learn Low Code, make that part of your skill set and make use of it. So, Low Code is actually easy to get into and very powerful, but not everyone realizes it.

Gardner: How do traditional software developers feel about Low Code? How do they react to it?

Calkins: Well, some of them dive right in and realize that it’s very empowering. Others are very attached to a programming language that they’ve used in the past and preferred to stick with it. I see all kinds of reactions.

Low Code is simple so people assume it's a toy. But it's anything but, it's as powerful as a development language. And it's used for some of the most important processes today.

But to those on the edge of programming, let’s say they’re starting a career. They’re in their 20s, they’re learning their place in the world of development and this Low Code tool comes along. Well, they love it, they love it. Those who are getting going with their careers see this as an unqualified positive -- and they enthusiastically get involved.

It’s true, the wages are very high right now, salaries are high for people who know how to do this. There’s a shortage of Low-Code developers. The people who know how to do this are commanding a lot of money and influence in the market. So, I see Low Code as a great tool for those who are finding their way into the development field.

Gardner: If you’re a chief technology officer (CTO), a chief executive officer (CEO), or on the board, if you’re a chief information officer (CIO), how does Appian help you in your role and your company?

Empowered processes and partners

Calkins: If you’re an executive at a big organization, you have to ask yourself, “Are we changing fast enough?” Almost certainly, the answer is going to be, “No.” Seriously think about that. Don’t measure yourself against what you thought was possible. Measure yourself against what your customers would like.

Are we moving as fast as our customers wish we were moving? Are we introducing new products? Are we changing our behavior? Are we as responsive as, ideally, we could be? There’s almost no business I know of that could say yes to that question.

Get the Full Guide

On Process Mining for Change

If it’s true that you would like to move faster, now is your chance. There’s now such a thing as a Low-Code suite that can take you from discovering a new process, to designing it, and automating it in the same product. You can increase the rate at which you launch a new process by 10x or 20x.

So, an executive can ask these questions and then direct the organization to look into Low Code. Whether you’re on the board, the CEO, the CTO, or the CIO, the direction would be the same. Ask that question and then talk to some Low-Code vendors.

Gardner: How about the ecosystem that’s around you? It seems like over the years, there have been consultancies that have developed within vertical industries and focus on solutions. It seems to me that Low Code would be very important and of interest to them. They’re not interested in selling software; they’re interested in creating solutions in vertical industries. What is your partner ecosystem like?

Calkins: There’s been a lot of enthusiasm. If you have expertise in one vertical industry and you want to bring that expertise to value by instantiating it. Well, there’s no better way to instantiate it than in a Low-Code framework. It’s so easy to deploy and adjust. Every client you have is going to want a variation on your expertise, but the core expertise can be expressed and then modified to fit each circumstance so quickly in Low Code.

Instead of selling your time on an hourly basis, you’re selling your ideas and they’re reproducible. This is a critical pivot where you go from selling the minutes to selling the ideas. This has been very enthusiastically adopted by people who are consultants and who have expertise in one industry or another.

Gardner: Matt, where should we expect the direction of Low Code productivity to go next?

See the process mining big picture

Calkins: Appian recently announced a major new product. We announced our process mining module, which we’ve been working on for a long time. We bought a company, and we’ve been developing it. We finally merged it all into our platform and Low-Code suite.

Process mining is like an x-ray giving you a view into what behaviors happen inside your enterprise. It looks at the usage logs of your applications, weaves them together to create a unified understanding of the sequences and the patterns of behaviors that happen whenever you launch a new use case of any kind.

Process mining is like an x-ray giving you a view into what behaviors happen inside your enterprise. It creates a unified understanding of behaviors.

So, after a customer calls, as an example of a use case, what do you do? If a problem happens in such a process, what sequence of actions do you then best pursue? Based on that process mining look -- that x-ray into your actions -- you can tell whether it’s too slow, you’re being inefficient, you’re spending too much money routing work to the wrong resource or keeping your customers waiting too long. This x-ray can tell you a lot about where you need to build a new process or improve your existing processes.

When you get that diagnostic, you can convert it. You can make a workflow based on what you learned. So, this is the natural starting point for the journey of process optimization. First, we take the x-ray, and we understand what’s inefficient and where we need to make an improvement. Then, we develop the new process. We use a Low-Code workflow interface to drag and drop the right process -- and then we automate it.

You start with discovery, go to design, and then you go to automation -- and it’s on the same product. I think it’s a big step. It’s going to be a great way to measure ROI. It’s going to be a great way to find new places to use Low Code. And it will be well in demand by our partners because they’re going to enjoy deploying their expertise to discover new places where they could be of use.

Gardner: The timing is very auspicious in that processes are now distributed across multiple organizations. As we’ve gone to cloud-native services and using third parties as software as a service (SaaS) services for so much, it’s hard to grasp the whole process. They are not necessarily inside your four walls, and probably never will be again. Is there something about process mining that helps ameliorate this complexity of a distributed business?

Calkins: Yes. Process mining looks at all the usage logs and brings them together. That’s the magic of the technology. So, whereas we used to see only an aspect of the business and one dimension of our behavior at a time, now we see all of it. Just like if you’re going from a 2D view to a 3D view, things start popping out at you. It becomes much clearer about what could be improved and where the inefficiencies lie. It’s a great clarification tool.

Gardner: It sounds like that’s something we could dive deeper into at some point and it’s very interesting. Any other ways that people can learn more if they’re intrigued about Low Code? What do you advise them in terms of making this move from a lesson into an engagement?

Calkins: We’re so eager to make it easy to learn Low Code. We’re building our community as fast as we can. We have free resources, free environments to use, a great program to get you involved, a forum where you can post your work and learn from other people’s work. Just go to Appian.com or lowcode.com and avail yourself of all these resources. It’s a booming industry.

Gardner: I’m afraid we’ll have to leave it there. You’ve been listening to a sponsored BriefingsDirect discussion on the latest capabilities and burgeoning strengths of Low-Code software development.

And we’ve learned how the current maturity spurt of Low-Code development will revolutionize the delivery of essential business applications. So, a big thank you to our guest, Matt Calkins, Founder and CEO of Appian. Thank you, Matt.

Calkins: Thank you, Dana. It’s been a great pleasure.

Gardner: And a big thank you as well to our audience for joining this BriefingsDirect future of application development discussion. I’m Dana Gardner, principal analyst at Interarbor Solutions, your host for this Appian-sponsored interview.

Thanks again for listening, please pass this along to your digital business associates, and do come back next time.

Listen to the podcast. Find it on iTunes. Download the transcript. Sponsor: Appian.

Transcript of a discussion on how the current maturity of Low-Code development will revolutionize the delivery of essential business applications. Copyright Interarbor Solutions, LLC, 2005-2022. All rights reserved.

BriefingsDirect Transcripts

Unified Data and AI: Elevating Telecom Customer Experiences

The AI-Driven Enterprise Advantage with Teresa Tung, Global Data Capabilities Lead at Accenture

AI and the Future of Finance: Decoding Earnings Calls with S&P Global Market Intelligence

How The Open Group Portfolio of Digital Open Standards Supports Your Digital Business Transformation Journey

Digital change demands diversification

How we got here

Where to develop your digital strategy

Measure your processes’ progress

Case-by-case connections

Put AI into the proper context

The Open Group support and opportunities

You may also be interested in:

Make AI Adoption a Strategic, ROI-Focused, Fit-for-Purpose and Sustainable Transformation, Says HPE

AI impact adds up everywhere

Data efficiency for effectiveness

Get a handle on AI workloads

Time to move on from Moore’s Law?

Five levers for moving sustainably

An AI ecosystem evolves

Examples of increased AI productivity

Define a sustainable IT strategy

You may also be interested in:

How a Minnesota Law Firm Brings Mission Critical Security to Myriad Mobile Devices

Tame the Wild West of mixed devices

Confidential in the cloud

BYOD means keeping work data separate

Secure success on all endpoints

Keeping track of all the data

Secure documents in the courtroom

Bitdefender: Partner in problem solving

You may also be interested in:

How IT Security Teams Do More With Less When Economies Rapidly Change

Take advantage of downturns to adjust

Collecting security data is good business

Security is much more than passwords

The proof is in the productivity

You may also be interested in:

How Accounts Payable Automation and Agility Drive Long-Term Business Productivity

Global change: Taking it all into account

Invoice intervention imperative

Invoice data insights reap rewards

CFO role encompasses more analytics

Productivity, processing, profits -- all up

Tech-savvy, budget-aware people thrive

CFO: From counter to consultant

You may also be interested in:

How Dashboard Analytics Bolster Security and Risk Management Insights Across IT Supply Chains

Security as diverse as each buyer

Risk management at root of protection

Deal with risk consciously, confidently

Move beyond reacting to assessing

Successful email security systems

Plan ahead to prevent tool sprawl

Embrace expertise to manage threats

You may also be interested in:

How WFH Accelerated IT and Security Transformation at Global Publisher HBG

Diversity strengthens security strategies

Security as speed bump, not roadblock

Architecting for change

Make wide, yet light, security footprints

Just say ‘no’ to tool sprawl

Detection advances to patterns

Start where you are, then dig deeper

You may also be interested in:

Why today’s hybrid IT complexity makes 'as a service' security essential

Data is everywhere, but is it secure?

Expertise at scale

Widespread, yet local service

Multi-tenancy critical in the cloud

Tools and services work well with others

Operational maturity for success

Take down tool sprawl

You may also be interested in:

For UK MSP, optimizing customer experience is key to successful security posture and productivity

Work safely with right tech support

The future is co-management

Manage email to educate users

A single pane of transparent glass

For happy clients, take their temperature