Below are some key take-aways from an online audio discussion and chat about security for small and mid-sized businesses (SMBs) that featured Richard Stiennon. Richard is the founder of IT-Harvest, an independent analyst firm, and is followed widely through his security blog, ThreatChaos.com. He was formerly chief marketing officer for Fortinet and VP of Threat Research at Webroot Software. Richard was also a VP of Research at Gartner Inc. where he covered security topics including firewalls, intrusion detection, intrusion prevention, security consulting, and managed security services.
The event was part of the Online Audio Series at www.TheSecureSMB.com, which is open to everyone with complementary registration. An archive of the audio portion of the chat with Richard is available at http://tobtr.com/s/2173105. Many thanks to The Secure SMB team and all of the chat participants for their energy and insights, which generated some of Richard's most interesting comments.
Social Media and Security: Social media today is like the Web a few years ago – significant security risks and threats, but too many business opportunities to ignore. Social media also creates and intensifies the need for business and IT decision makers to examine and improve their security policies, practices, processes and technologies.
Security, Social Media and SMBs: SMBs are in a particularly difficult position. Social media presents opportunities for them to compete more effectively with larger companies. But SMBs have few resources to invest in security or IT. This makes them both dependent upon technologies like social media and more vulnerable to technology-borne threats. Even if good policies are in place. Per Richard: "Even if you require the security guy to put the passwords in an offsite safe he invariably changes them (as he should) the day before he gets hit by a truck."
Security and Telecommuting: Companies large and small can benefit significantly from supporting the ability of executives, IT support staff and other workers to work from home or while on the road. However, those supporting telecommuters and traveling workers must weigh and balance security concerns carefully. This is particularly true regarding the "bring-your-own-computer" ("BYOC") initiatives growing in popularity among many companies.
Per Richard: "I think it is unfair for [companies] to expect their employees to work from home without supporting them with technology. The risks are way too high with personal devices, especially laptops. Give them locked-down computers. If they want to browse inappropriate stuff or play games they can do that on their home [or personal] device. Now Netflix when you are on the road – that is different…"
The IT Staff "Threat:" If a company has an IT staff, everyone on that staff becomes a potential point of vulnerability. Especially if that staffer becomes disgruntled. And this is even more of a problem at SMBs where all IT responsibility is in the hands of a single individual.
Per Richard: "There has to be a very large degree of trust there. And yes, there are some scary stories about disgruntled IT guys. [In a] recent one, the guy left the office after being fired, went to a local McDonalds, used their free Wi-Fi to log back in to the [corporate] network and erase every VM [virtual machine] in the data center. Ouch!"
The Best Defense: Whether a company is a global enterprise or emerging SMB, no security technology alone will provide adequate protection. What's needed is a combination of technologies, selected and supported by solid policies, practices and processes. These must work in concert to ensure that there are no single points of vulnerability and that critical resources are protected, regardless of where they or their authorized users may be. And protections must apply to everyone, including executives and IT staffers.
Per Richard: "IT guys tend to assume their own rules do not apply to them. I was called in once because a small company discovered [that its Webmaster] was running a BitTorrent server [typically used for sharing of movies, music and games] on their main Web server. A little forensics work and he was gone. The right solution is in checks and balances. No one person [can have] complete control over the keys to the kingdom. Just like accounting systems."
And in the buried lede department (to paraphrase the great Harry Shearer), HP buys (and likely overpays for) Autonomy.
A "lede" is the lead or first paragraph of a news story. The term "buried lede" refers to stories with headlines about one thing, but details deep in the story that are likely more interesting, important or both. And much of the reporting about HP, PCs and tablets seems to bury what I think should be the real lede: the purchase of Autonomy. Whether or not HP "overpaid," as some of the overheated coverage I've read indicates.
Why? Three reasons.
1. Autonomy is successfully selling enterprise software into a market in which enterprise spending on technology is growing, even while IT budgets are flat or in decline. (Autonomy's software supports enterprise search and what the company calls "meaning-based computing." These are areas already generating both revenues and promises of whole new classes of business solutions.)
2. Software solutions like Autonomy's, both premise-based and increasingly cloud-based, help to sell more server, storage and management hardware and services, things HP continues to sell.
3. HP needs a cultural makeover at least as much as it needs strategic refocusing, and Autonomy might be the key to both.
HP should never have bought Palm or tried to make WebOS any kind of market presence. It should have played to its historical strengths in business markets, and thrown its weight behind whichever tablet and smartphone platforms came to dominate the market. And I can't help but feel that some earlier iteration of the company would have seen that.
As I posted in this very space back in September 2006, Mark Hurd's tenure as CEO saw the undeniable death of what was once proudly known as "The HP Way." That death was certainly not all his fault, but it happened on his watch, while he held the office where the buck's supposed to stop.
What HP's customers, partners and fans need to hope for now is the arising of a "New HP Way." One that puts enterprise customer success ahead of clever corporate machinations. One that sees customer success as a path towards and not in competition with personal success and aggrandizement. (Nothing wrong with either of those, mind, as long as they're the result of good intentions and actions.)
I and everyone who cares about HP is waiting with bated breath to see if the current management team is seriously, willfully committed to such a path. Autonomy is a successful player in a tough market HP cares about a lot. The Autonomy purchase is likely HP's last, best chance at successfully reinventing itself, strategically and culturally, and recalling any of its former greatness. I'm pulling for it to succeed -- but won't be surprised if more wrenching changes precede or even preclude that success.
I moderated five sessions (on virtualization) at Interop Las Vegas last week. Herewith, some thoughts on that show, and on trade shows in general.
First off, I think Lenny Heymann, Manuela Farrell, Andy Saldana, the Interop show network crew and the rest of the Interop management team deserve a major shout-out, for running the show well, treating speakers well and helping to revive a show that many perceived was moribund, if not on its last legs, not too long ago. And I think that the Interop show (which I also participated in last October in New York after several years away) is playing out an evolution of trade shows I and others have been predicting for a while.
Specifically, my impression is that the hottest, highest-value events at Interop Las Vegas were the educational sessions, including but definitely not restricted to the ones in which I participated. The show floor was decent, but not all that exciting to me or to others with whom I spoke at the show. But every person with whom I spoke who attended a session got value out of it, and seemed excited to have learned and/or validated things they could take home and use and/or do.
There were a few weirdnesses at Interop, at least to me. Most notable among these was the fact that keynote addresses were streamed live on the Web, but could not be viewed on many if not most mobile devices that were not traditional laptops. Given that the keynote venue was almost always full to over-capacity and that many speakers and media attending the conference carried various tablets and other mobile devices, this seems…well, weird. But otherwise, the show seemed to hum right along, with last-minute speaker challenges addressed graciously and efficiently.
If you exhibit at trade shows and conferences, think seriously about upping your company's participation in educational sessions and similar interactions. It may be worth reducing or eliminating entirely the expense and difficulty of mounting a major show floor exhibit, unless you're required to exhibit to sponsor or participate in such sessions. (A hotel suite to which you can invite hand-selected visitors during the day and house a staffer or two at night may make a lot more economic and marketing sense.)
If you go to trade shows and conferences, spend a bit more time examining and planning your time at relevant sessions. And work with your colleagues to share and distribute session attendance intelligently, and to make sure all relevant courseware makes it back home in a usable, shareable form. And it wouldn't hurt to collaborate on a post-event report that summarizes relevant highlights and gathers links to any useful materials available online. (The good folks at Interop make all session presentations available for download with user IDs and passwords provided by show organizers.)
Trade shows and conferences are typically expensive, disruptive events for exhibitors, speakers and attendees alike. But that doesn't mean they don't have value. Especially as they continue to evolve, whatever you can do to maximize that value to you personally and to your organization will help to justify the effort and costs -- and maybe free up more time to consume the free food and drink almost always available somewhere, and to make and deepen those personal connections...
I have been in the information technology (IT) business for more than 30 years. And for the first time I've ever seen, my experience and that of many of my peers is working against us when seeking paying projects and employment. And this is something that affects and reaches far beyond the IT business.
I have friends and professional colleagues who are in their 50s and 60s -- people with decades of documented business success and lots of others willing to say good things about them. Some of these people have been unemployed and seeking employment actively for a decade or longer. Since before the dot-com bubble burst, let alone before the current recession began.
It's not just that we're not getting jobs. We aren't getting interviews. Often, we aren't even getting responses from the companies we contact, or we get initial responses that suddenly come to a stop for no obvious or stated reason. (If you can send a "thanks for considering us" e-mail, something a lot of companies have apparently still not figured out how to do, why can't you send a "we've filled that position" or even an "our needs have changed" e-mail?)
Now, I and many of my closest friends and associates have a fair amount of experience analyzing companies and the actions of their key decision makers. In addition, many of us have spoken to numerous others in our or similar positions, as well as with others with credible claims to relevant "inside knowledge." From that perspective, here are just some of the things I and many of those around me know and/or believe demonstrate that recruiting is in fact broken.
1. Despite public pronouncements of an imminent economic turnaround, a lot of companies are still not hiring, or taking longer than usual to fill posted positions.
2. The economy means that every hint of a job posting generates a deluge of expressions of interest, putting every HR professional under incredible pressure.
3. Applicant tracking system (ATS) software scans, analyzes and scores every résumé and cover letter, often before a single human being sees it, and can sometimes have unintended and/or intentional biases against deep experience and/or how it is expressed and/or formatted.
4. There are a lot of hiring managers out there uncomfortable with or downright hostile to the idea of hiring people older than themselves and/or most of the people around them at work, and a lot of business decision makers deathly afraid of being accused of and/or sued for age discrimination.
Items 3 and 4 are the ones that bother me most. The rules and processes that govern the behaviors of ATS software and hiring managers all come from decision-makers who may believe that they are doing the right/best things for their companies. However, those beliefs appear to be skewed against the current reality -- able, active people older than 50 making up a growing percentage of the population and the workforce.
This is especially troubling given the growing need companies of all kinds for experienced thought leadership in the marketplace and operational leadership within the organization itself. If the burst of the dot-com bubble had a single primary cause, it could arguably be summed up as a lack of adult supervision. (A trailing indicator: why would anyone even write a "business plan" on the back of a cocktail napkin, let alone fund such a plan?) In today's world of global competition and sustained economic pressures, why would any sane decision maker not hire someone for whom this was not a first time at the rodeo, as long as they were still able to saddle up and hold on? (It's a Western/cowboy metaphor, kids; Google/Bing/Wikipedia it.)
I have actually heard of candidates for jobs telling potential hirers that the candidates weren't looking for senior positions and would be very happy at low levels of compensation, only to have the hirer insist that the candidate would simply move on to greener pastures once the company had "invested" in them. I've seen a lot of younger people do exactly that, but if a 50- or 60-something with a home and a family tells you they're not really interested in career-building, why would you not believe them? Unless you just didn't know any better…
Or maybe you think us "older folk" can't or won't keep up. But more experienced people have longer track records to provide evidence of our abilities to perform and produce. And any hiring manager worth their compensation package should be focused more on documenting and tracking performance and results than on making facile but likely erroneous assumptions about someone based on perceptions of what their age may mean.
(I'm on an independently managed list of the "Top 500" IT industry analysts using Twitter, a poster child for modern communications and networking technology. I believe I'm also one of the 10 or 15 oldest people on that list.)
Some argue that one way out of the current economic unpleasantness is to raise retirement ages to delay and/or decrease payments from entitlement programs such as Social Security. All well and good, as long as the older among us can actually get hired or find paying projects to live and support their families while they reach whatever the retirement age turns out to be. Otherwise, a lot of older people will end up consuming all of their savings, if any, selling all of their assets, if any, and moving in with their kids, if any. Or competing with other kids for minimum-wage jobs, or with others in need for aid, comfort and support services.
Seems to me it would make more sense all around just to put more of them -- us! -- to work.
In 1970, Robert Townsend, who took Avis from struggling and unprofitable to the number-two rental car company in the world, published ". Up the Organization; How to Stop the Corporation from Stifling People and Strangling Profits." The book spent 28 weeks on the New York Times bestseller list, Wikipedia says. One of the strongest recommendations Townsend made -- and I remember it because I actually read the book -- was that most if not all corporations should fire their HR departments, and let the people actually doing the work hire those who would work with them.
in today's economy, I would never advocate taking away employment from anyone delivering value to a business. But I do strongly recommend that where HR and recruiting are concerned, it's time to take a close look at the processes by which that value is measured, and to consider adjusting those processes to reflect current reality more closely.
I've been in the information technology analysis and observation game for more than 30 years. In all that time, I've never bought a first-generation anything. That streak has now been broken by the iPad. Why?
1. With the Documents to Go app, I can read, edit and create Microsoft Office files in their native formats, compatible with everyone with whom I work who uses Office or anything compatible with it.
2. Documents to Go also lets me synchronize copies of files with the Google Docs online file management service (and with several others). Another app, SimpleNote, lets me synchronize copies of files with SimpleNote servers. By saving copies of my files in the cloud, I can always get to them from any device I have that can access the Web, nit just my iPad (or my wife's -- we got her one, too).
3. I spend hours on buses each week and elsewhere between my home and office. Now, I can always get to my e-mail and my most critical work, even when there's no Wi-Fi where I am. (I'm still not a big fan of the AT&T network, but it is improving, it's better than no connectivity, and the iPad does enough offline to make occasional network hiccups tolerable.
4. I have almost all of my critical documents and notes, all of my critical contacts and appointments, and all of my favorite music and entertainment with me or accessible to me wherever I am, along with navigational assistance, local information and other resources, in a package I can fit and take almost anywhere.
5. The iPad is basically the coolest, most elegant piece of technology I've seen since the lever and fulcrum. (Yeah, I know. Geeky. I went to the Bronx High School of Science and M.I.T. I can't help myself. Sue me.)
I know all about its challenges and limitations. By the way, the on-screen keyboard is not the challenge it's sometimes made out to be. It takes some practice, but in landscape mode at a comfortable angle, it's pretty usable. And if you disagree, the Apple Wireless Keyboard may be worth the additional investment, and adds to the coolness factor. And yes, I also know that future versions are coming with more features. But the first-generation iPad does enough of what I want and need, and enough more cool and neat stuff, in ways even better than I'd thought or seen described before seeing and touching one.
It may not be for you, but it might be more for you than you think or have seen, especially if you rely on a computer and the Internet for work or other important aspects of your life. Ignore the political, religious and ideological arguments, and just check one out. Or ask any of the growing number of iPad users you'll soon see at your local coffeehouse, waiting for a shopping spouse at the mall, or on an upcoming flight. And if the user you run into happens to be me, please forgive my nearly irrational exuberance.
Because everyone I know was affected by a nearby father, whether their own or someone else's. And every man I know has multiple opportunities to make a difference in the life of someone who could use the influence, especially if their father is absent, for whatever reason.
And in a lot of communities and demographic segments, lots of Dads are missing, physically, emotionally, psychologically and/or otherwise. So you and those around you that you care about, whether male or not, have lots of opportunities to help fill in some pretty important gaps in some pretty important lives.
My Dad was there. My parents stayed together until they each died, less than two years apart. (The only idiot who even suggested they consider divorce was me, in a fit of youthful pique about which I am still privately embarrassed. At least, it was "privately" until now.) And I know for a fact -- as a mentor to middle school children, and someone who lives near two or three high schools AND a junior college -- that you, I and society can tell the difference between kids whose parents were present and engaged and kids who lacked this fundamental support. And those differences are not always pretty, to put it mildly.
Love your Dad, whether or not he's around, and especially if he is. And if you know someone who's missing a Dad, try to help out in whatever way you can. Everyone wins.
So Apple has decided that Steve Jobs will not give the Macworld Expo 2009 keynote address in a few weeks, and that the company will pull out of the 25-year-old show altogether after the 2009 edition. And speculation runs rampant across the Web and print media worlds, about (1) Steve Job's health and (2) that of Macworld Expo itself. I'll ignore issue (1) because it's none of my business, and focus on issue (2).
The large computer industry trade show has been a dying dinosaur for years, but has stubbornly hung on in many cases. However, there are now too many factors mitigating against the success of such events. These range from the abilities of companies such as Apple to turn retail stores and Web sites into far more manageable, controllable, and profitable "mini-expos" to growing requirements to reduce or eliminate costly, low-productivity business travel. (I mean, the MacBook Pro on which I'm composing this very screed already has built-in Internet connectivity, a microphone AND a camera...)
But don't cry for Macworld just yet. There is an awful lot of value to be gotten out of the event, even should Apple disappear from it entirely as a participant, or radically reduce its participation. I'm old enough to remember when networking pioneer all but owned the NetWorld trade show, but that event retained value beyond Novell itself, especially when it was combined with Interop, another pioneering big industry event. So there's semi-relevant precedent for the possibility of an Apple-free (or "Apple-reduced") Macworld continuing on successfully, at least for a while.
All depends on how Macworld Expo 2009 actually plays out, and what Apple does, if anything, before, at, and after said event. (If you want to read similar, more granular, and "closer-to-home" musings on this subject, I highly recommend "Apple at Expo: What went wrong?" by Jason Snell of Macworld.com, a corporate cousin of the company that runs Macworld Expo.) But regardless of how things play out at Macworld, what's happened to Macworld is definitely indicative of a larger truth: with few if any exceptions, the larger and/or more focused on a single vendor the trade show, the more likely that its days are numbered. And those numbers, if used to measure years of remaining longevity, are in the low to very low single digits, at best.
So Sprint Nextel has "fired" some 1,000 of what it says are its most troublesome (and apparently troubled) customers. The company said in published reports that these customers made as many as 40 to 50 calls to the company's customer service team every month. And yet, there are folks out there in the blogosphere chalking this up to callously typical Big Business behavior, and stating with falsely ironic wistfulness that it must be nice to be able to fire customers at will.
A few things.
1. ANY business has the right, if not the ethical responsibility, to part company with any customer that business cannot satisfy. As long as the business makes the customer contractually and financially whole, which Sprint Nextel has done with its 1,000 former customers, why stay in a relationship that's not working? (Hold on, hold on -- let's stick to business relationships here, people!)
2. Sprint Nextel says it researched its customer base and complaint call logs extensively before doing this. The fact that the company was able to find 1,000 people who averaged 40 to 50 complaint calls monthly out of a claimed subscriber base of 57 million seems to indicate at least some research was in fact conducted. It should have taken a fair amount of digging -- any wireless carrier where a majority of customers were that unhappy would have gone out of business before most of us would have heard about them. (Fill in your preferred former carrier here.)
3. What happens if customer service and satisfaction levels increase measurably for the 56,999,000 or so Sprint Nextel customers still under contract? Will critics of the move lapse into grumbling silence? (Unlikely.) Will Sprint Nextel seek out the next 1,000 most complaint-prone customers and send them warning? (Possibly.) Will other wireless carriers or other types of companies follow Sprint Nextel's lead? (Unlikely, at least "out loud" among wireless carriers; possibly, in other cases.)
4. This is not about Big Bidness trampling the individual, something that constantly troubles me personally, make no mistake. Nor is it, I believe, anything about getting people to suck it up, shut up, and stop complaining about what they perceive as poor service. I do that all the time, but would have to give up blogging, if not working full-time, to get to the level of 40 to 50 calls a month. This is about a company using business analytics, business intelligence (BI), and customer relationship management (CRM) tools and processes to identify a relatively minute set of apparently extremely, chronically unhappy customers, and walking away from them rather than draining significant resources continuing to try to satisfy them. If it were your business, and you could, why wouldn't you, if it offered a chance to make life better for you and the vast majority of your customer base?
That last is not a rhetorical question. If you have an answer you'd care to offer, as Ross Perot said when he ran for President, "Ah'm all ears!"