• Enterprises who are increasing the average number of endpoint security agents from 9.8 last year to 10.2 today aren’t achieving the endpoint resilience they need because more software agents create more conflicts, leaving each endpoint exposed to a potential breach.
• 1 in 3 enterprise devices is being used with a non-compliant VPN, further increasing the risk of a breach.
• 60% of breaches can be linked to a vulnerability where a patch was available, but not applied. Windows 10 devices in enterprises are, on average, 95 days behind on patches.

CIOs, CISOs and cybersecurity teams say autonomous endpoint security is the most challenging area they need to strengthen in their cybersecurity strategy today. Software agents degrade faster than expected and conflict with each other, leaving endpoints exposed. Absolute’s 2020 State of Endpoint Resilience Report quantifies the current state of autonomous endpoint security, the scope of challenges CISOs face today and how elusive endpoint resiliency is to achieve with software agents. It’s an insightful read if you’re interested in autonomous endpoint security.

Endpoint Security Leads CISOs’ Priorities In 2020

With their entire companies working remotely, CIOs and CISOs I’ve spoken with say autonomous endpoint security is now among their top three priorities today. Cutting through the endpoint software clutter and turning autonomous endpoint security into a strength is the goal. CISOs are getting frustrated with spending millions of dollars among themselves only to find out their endpoints are unprotected due to software conflicts and degradation.  Interested in learning more, I spoke with Steven Spadaccini, Vice President, Sales Engineering at Absolute Software and one of the most knowledgeable autonomous endpoint cybersecurity experts I’ve ever met. Our conversation delved into numerous cybersecurity challenges enterprise CIOs and CISOs are facing today. My interview with him is below:

The Seven Toughest Questions the C-Suite Is Asking About Endpoint Security

Louis: Thank you for your time today. I have seven questions from CIOs, CISOs and their teams regarding endpoint security. Let’s get started with their first one. What happens if an endpoint is compromised, how do you recover, encrypt, or delete its data?

Steven:  It’s a challenge using software agents, both security and/or management, to do this as each agents’ tools and features often conflict with each other, making a comprised endpoints’ condition worse while making it virtually impossible to recover, encrypt, delete and replace data. The most proven approach working for enterprises today is to pursue an endpoint resilience strategy. At the center of this strategy is creating a root of trust in the hardware and re-establishes communication and control of a device through an unbreakable digital tether. I’m defining Endpoint Resilience as an autonomous endpoint security strategy that ensures connectivity, visibility and control are achieved and maintained no matter what is happening at the OS or application level. Taking this approach empowers devices to recover automatically from any state to a secure operational state without user intervention. Trust is at the center of every endpoint discussion today as CIOs, CISOs and their teams want the assurance every endpoint will be able to heal itself and keep functioning

Louis: Do endpoint software security solutions fail when you lose access to the endpoint, or is the device still protected at the local level?

Steven: When they’re only protected by software agents, they fail all the time. What’s important for CISOs to think about today is how they can lead their organizations to excel at automated endpoint hygiene. It’s about achieving a stronger endpoint security posture in the face of growing threats. Losing access to an endpoint doesn’t have to end badly; you can still have options to protect every device. It’s time for enterprises to start taking a more resilient-driven mindset and strategy to protecting every endpoint – focus on eliminating dark endpoints. One of the most proven ways to do that is to have endpoint security embedded to the BIOS level every day. That way, each device is still protected to the local level. Using geolocation, it’s possible to “see” a device when it comes online and promptly brick it if it’s been lost or stolen.

Louis: How can our cybersecurity team ensure compliance that all cybersecurity software is active and running on all endpoints?

Steven: Compliance is an area where having an undeletable tether pays off in a big way. Knowing what’s going on from a software configuration and endpoint security agent standpoint – basically the entire software build of a given endpoint – is the most proven way I’ve seen CISOs keep their inventory of devices in compliance. What CISOs and their teams need is the ability to see endpoints in near real-time and predict which ones are most likely to fail at compliance. Using a cloud-based or SaaS console to track compliance down to the BIOS level removes all uncertainty of compliance. Enterprises doing this today stay in compliance with HIPAA, GDPR, PCI, SOX and other compliance requirements at scale. It’s important also to consider how security automation and orchestration kicks on to instantly resolve violations by revising security controls and configurations, restoring anti-malware, or even freezing the device or isolating it from data access. Persistent visibility and control give organizations what they need to be audit-ready at every moment.

Having that level of visibility makes it easy to brick a device. Cybersecurity teams using Absolute’s Persistence platform can lead to humorous results for IT teams, who call the bricking option a “fun button as they watch hackers continually try to reload new images and right after they’re done, re-brick the device again. One CIO told the story of how their laptops had been given to a service provider who was supposed to destroy them to stay in compliance with the Health Insurance Portability and Accountability Act (HIPAA) and one had been resold on the black market, ending up in a 3^rd world nation. As the hacker attempted to rebuild the machine, the security team watched as each new image was loaded at which time they would promptly brick the machine. After 19 tries, the hacker gave up and called the image rebuild “brick me.”

Louis: With everyone working remote today, how can we know, with confidence where a given endpoint device is at a moments’ notice?

Steven: That’s another use case where having an undeletable tether pays off in two powerful ways: enabling autonomous endpoint security and real-time asset management. You can know with 100% confidence where a given endpoint device is in real-time so long as the device is connected to a permanent digital tether . Even if the device isn’t reachable by your own corporate network it’s possible to locate it using the technologies and techniques mentioned earlier. CIOs sleep better at night knowing every device is accounted for and if one gets lost or stolen, their teams can brick it in seconds.

Louis: How can our IT and cybersecurity teams know all cybersecurity applications are active and protecting the endpoint?

Steven: By taking a more aggressive approach to endpoint hygiene, it’s possible to know every application, system configuration and attributes of user data on the device. It’s important not to grow complacent and assume the gold image IT uses to configure every new or recycled laptop is accurate. One CIO was adamant they had nine software agents on every endpoint, but Absolute’s Resilience platform found 16, saving the enterprise from potential security gaps. The gold image is an enterprise IT team was using had inadvertently captured only a subset of the total number of software endpoints active on their networks. Absolute’s Resilience offering and Persistence technology enabled the CIO to discover gaps in endpoint security the team didn’t know existed before.

Louis: How can we restrict the geolocations of every endpoint?

Steven: This is an area that’s innovating quickly in response to the needs enterprises have to track and manage assets across countries and regions. IP tracking alone isn’t as effective as the newer techniques, including GPS tracking, Wi-Fi triangulation, with both integrated into the Google Maps API. Enterprises whose business relies on Personal Identifiable Information (PII) is especially interested in and adopting these technologies today. Apria Healthcare is currently using geofencing for endpoint security and asset management. They have laptops in use today across Indonesia, the Philippines and India. Given the confidential nature of the data on those devices and compliance with local government data protection laws, each laptop needs to stay in the country they’re assigned to. Geofencing gives Apria the power to freeze any device that gets outside of its region within seconds, averting costly fines and potential breaches.

Louis: How can our IT team immediately validate an endpoint for vulnerabilities in software and hardware?

Steven: The quickest way is to design in audit-ready compliance as a core part of any endpoint resilience initiative. Endpoint resilience to the BIOS level makes it possible to audit devices and find vulnerabilities in real-time, enabling self-healing of mission-critical security applications regardless of complexity. The goal of immediately validating endpoints for current security posture needs to be a core part of any automated endpoint hygiene strategy. It’s possible to do this across platforms while being OS-agnostic yet still accessible to over 500M endpoint devices, deployed across Microsoft Windows, macOS via a Mac Agent and Chrome platforms.

Conclusion

Knowing if their autonomous endpoint security and enterprise-wide cybersecurity strategies are working or not is what keeps CIOs up the most at night. One CISO confided to me that 70% of the attempted breaches to his organization are happening in areas he and his team already knew were vulnerable to attack. Bad actors are getting very good at finding the weakest links of an enterprises’ cyber defenses fast. They’re able to look at the configuration of endpoints, see which software agents are installed, research known conflicts and exploit them to gain access to corporate networks. All this is happening 24/7 to enterprises today. Needing greater resilient, persistent connections to every device, CISOs are looking at how they can achieve greater resilience on every endpoint. Capitalizing on an undeletable tether to track the location of the device, ensure the device and the apps on that device have self-healing capabilities and gain valuable asset management data  – these are a few of the many benefits they’re after.

Answers To Today’s Toughest Endpoint Security Questions In The Enterprise is copyrighted by Louis Columbus. If you are reading this outside your feed reader or email, you are likely witnessing illegal content theft.

Enterprise Irregulars is sponsored by Salesforce and Zoho.

• Startups offering AI-powered software development tools raised $704M over 12 months ending September 2019, according to a Deloitte report published earlier this year.
• IDC predicts the global market for custom application development services is forecast to grow from $47B in 2018 to more than $61B in 2023, attaining a 5.3% Compound Annual Growth Rate (CAGR) in five years.
• Poor software quality cost US organizations an estimated $319B in 2019, according to the Consortium for IT Software Quality’s report on the cost of poor quality software in the U.S.
• 40% of DevOps teams will be using application and infrastructure monitoring apps that have integrated artificial intelligence for IT operations (AIOps) platforms by 2023, according to Gartner.

Looking to reduce the delays DevOps teams are challenged with, software development tool providers are accelerating the pace of integrating AI- and Machine Learning technologies into their apps and platforms. Accelerating every phase of the Software Development Lifecycle (SDLC) while increasing software quality is the goal. And the good news is use cases are showing those goals are being accomplished, taking DevOps to a new level of accuracy, quality, and reliability.

What’s particularly fascinating about the ten ways AI is accelerating DevOps is how effective it is proving to be in assisting developers with the difficult, time-consuming tasks that take away from coding. One of the most time-consuming tasks is managing the many iterations and versions of requirements documents. A leader in using AI to streamline every phase of the SDLC and assist with managing requirements is Jira Software from Atlassian, widely considered the industry standard in this area of DevOps.

The following are ten ways AI is accelerating DevOps today:

1. Improving DevOps productivity by relying on AL and ML to autosuggest code segments or snippets in real-time to accelerate development. DevOps teams interviewed for this article from several leading enterprise software companies competing in CRM, Supply Chain Management, and social media markets say this use case of AI is the most productive and has generated the greatest gains in accuracy. Initial efforts at using AI to autocomplete code were hit or miss, according to a DevOps lead at a leading CRM provider. She credits DevOps’ development tools providers’ use of supervised machine learning algorithms with improving how quickly models learn and respond to code requests. Reflecting what the DevOps teams interviewed for this article prioritized as the most valuable AI development in DevOps, Microsoft’s Visual Studio Intellicode has over 6 million installs as of today.
2. Streamlining Requirements Management using AI is proving effective at improving the accuracy and quality of requirements documents capturing what users need in the next generation of an app or platform.  AI is delivering solid results streamlining every phase of creating, editing, validating, testing, and managing requirements documents. DevOps team members are using AI- and ML-based requirements management platforms to save time so they can get back to coding and creating software products often on tight deadlines. Getting requirements right the first time helps keep an entire project on the critical path of its project plan. Seeing an opportunity to build a business case of keeping projects on schedule, AI-powered software development tools providers are quickly developing and launching new apps in their area. It’s fascinating to watch how quickly Natural Language Processing techniques are being adopted into this area of DevOps tools. Enterprises using AI-based tools have been able to reduce requirements review times by over 50%.
3. AI is proving effective at bug detection and auto-suggestions for improving code. At Facebook, a bug detection tool predicts defects and suggests remedies that are proving correct 80% of the time with AI tools learning to fix bugs automatically. Semmle CodeQL is considered the leading AI-based DevOps tool in this area. DevOps teams using CodeQL can track down vulnerabilities in code and also find logical variants in their entire codebase. Microsoft uses Semmle for vulnerability hunting. Security researchers in Microsoft’s security response team use Semmle QL to find variants of critical problems, allowing them to identify and respond to serious code problems and prevent incidents.
4. AI is assisting in prioritizing security testing results and triaging vulnerabilities.  Interested in learning more about how ML can find code vulnerability in real-time, I spoke with Maty Siman, CTO Checkmarx, says that “even organizations with the most mature SDLCs often run into issues with prioritizing and triaging vulnerabilities. ML algorithms that focus on developers’ or AppSec teams’ attention on true positives and vulnerable components that pose a threat are key to navigating this challenge.” Maty also says that ML algorithms can be taught to understand that one type of vulnerability vs. another has a higher percentage of being a true positive. With this automated “vetting” process in place, teams can optimize and accelerate their remediation efforts in a much more informed manner.
5. Improving software quality assurance by auto-generating and auto-running test cases based on the unique attributes of a given code base is another area where AI is saving DevOps teams valuable time. This is invaluable for stress-testing new apps and platforms across a wide variety of use cases. Creating and revising test cases is a unique skill set on any DevOps team, with the developers with this skill often being overwhelmed with test updates. AI-based software development tools are eliminating test coverage overlaps, optimizing existing testing efforts with more predictable testing, and accelerating progress from defect detection to defect prevention. AI-based software development platforms can identify the dependencies across complex and interconnected product modules, improving overall product quality in the process. Improving software quality enhances customer experiences, as well.
6. AI is proving adept at troubleshooting defects in complex software apps and platforms after they’ve been released and shipped to customers. Enterprise software companies go to great lengths in their software QA processes to eliminate bugs, logic errors, and unreliable segments of code. Retrofitting releases or, worst case, recalling them is costly and impacts customers’ productivity. AI-based QA tools are proving effective at predicting which areas of an enterprise application will fail before being delivered into complex customer environments. AI is proving effective at root cause analysis, and also has proved effective in accelerating a leading CRM providers’ application delivery and a 72% reduction in time-to-restore in customers’ enterprise environments. Another DevOps team says they are using AI to auto-configure their applications’ settings to optimize performance in customer deployments.
7. ML-based code vulnerability detection can spot anomalies reliably and alert DevOps teams in real-time. Maty Siman, CTO Checkmarx told me that, “assuming that your developers are writing quality, secure code, machine learning can set a baseline of “normal activity” and identify and flag anomalies from that baseline.” He continued, saying that “ultimately, we live in an IT and security landscape that’s evolving every minute of every day, requiring systems and tools that learn and adapt at the same, if not a greater, speed. Organizations and developers can’t do it alone and require solutions that improve the accuracy of threat detection to help them prioritize what matters most.” Spotting anomalies quickly and taking action on them is integral to building a business case for AI software-based QA and DevOps tools.
8. Advanced DevOps teams are using AI to analyze and find new insights across all development tools, Application Performance Monitoring (APM), Software QA, and release cycle systems. DevOps teams at a leading Supply Chain Management (SCM) enterprise software provider are using AI to analyze why certain projects go so well and deliver excellent code while others get caught in perpetual review and code rewrite cycles. Using supervised machine learning algorithms, they’re able to see patterns and gain insights into their data. Becoming data-driven is quickly becoming part of their DNA, a DevOps lead told me this week on a call.
9. Improving traceability within each release cycle to find where gaps in DevOps collaboration and data integration workflows can be improved.  AI is enabling DevOps teams to stay more coordinated with each other, especially across remote geographic locations. AI-driven insights are helping to see how shared requirements and specifications can reflect localization, unique customer requirements, and specific performance benchmarks.
10. Creating a more integrated DevOps strategy where AI can deliver the most value depends on frameworks that can keep DevOps customer-centric while improving agility and nurturing an analytics-driven DNA to gain insights into operations. DevOps leaders interviewed for this article say integrating security into development cycles reduces bottlenecks that get in the way of staying on schedule. Several went on to say that frameworks capable of integrating Quality Assurance into the DevOps workflows are key. AI’s use cases taken together reflect the potential to revolutionize DevOps. Executing on this promise, however, requires a framework that empowers enterprise DevOps teams to deliver a transcendent customer experience, automate customer transactions, and provide support for automation everywhere. One of the leaders in this area is BMC’s Autonomous Digital Enterprise framework, which helps businesses harness AI/ML capabilities to run and reinvent in a rapidly transforming world. It’s helping enterprises innovate faster than their competitors by enabling the agility, customer centricity, and actionable insights integral to driving data-driven business outcomes.

Conclusion

Accelerating development cycles while ensuring the highest quality code gets produced is a challenge all DevOps teams face. AI is helping to accelerate every phase of DevOps development cycles by anticipating what developers need before they ask for it. Auto suggesting code segments, improving software quality assurance techniques with automated testing, and streamlining requirements management are core areas where AI is delivering value to DevOps today.

10 Ways AI Is Accelerating DevOps is copyrighted by Louis Columbus. If you are reading this outside your feed reader or email, you are likely witnessing illegal content theft.

Enterprise Irregulars is sponsored by Salesforce and Zoho.

Bottom Line: Defining the perfect mix of cloud apps, platforms and secured endpoints to create compelling online learning experiences customizable to students’ learning strengths is how schools are overcoming the challenge of virtual teaching.

There are over 56 million students in the U.S. alone who are relying on remote learning apps, platforms and autonomous endpoint security to protect them as they pursue their education. School districts, online educators and teachers quickly realized the move to 100% online classes could mean the end to outdated mechanized approaches to teaching. Eager to teach using technologies that tailor individual learning programs to every student’s unique learning strengths, schools are combining cloud, e-learning and endpoint security with strong results. Combining technologies gives every student regardless of their socioeconomic background a chance to excel. The goal is to provide unique personalized instruction at scale using a teaching technique called scaffolding. Scaffolding stresses creating an individual learning plan for each student complete with reinforcement for each lesson.

Why Cybersecurity Is The Cornerstone Of Online Learning 

Tailoring the latest technologies to the diverse needs of online learners is the easy part of creating an online learning program. Far more difficult is choosing the right endpoint security strategies to protect their identities, every one of their video conference sessions with peers and teachers and thwarting breach attempts. Parents, teachers, students and administrators all need to trust an e-learning platform to make it work. The bottom line is an e-learning platform needs to create and grow trust while being adaptive enough to meet students’ unique learning needs.

Interested in learning more about how leading online educators are bringing together the latest cloud and autonomous endpoint security technologies to help students learn online, I recently interviewed Eric Ramos Chief Technology Officer at Duarte Unified School District and Dean Phillips, Senior Technology Director, David Atkins, Director of Marketing and Communications and Jennifer Shoaf, Deputy Chief Academic Officer at PA Cyber.  Duarte Unified School District (USD) serves the educational needs of 3,400 scholars at the elementary, K-8 and high school levels. The Pennsylvania Cyber Charter School (PA Cyber) in Midland, PA, is one of the most experienced and successful online K-12 public schools in the nation serving over 12,000 students. Together the group of education professionals provided valuable insights into how educators can combine cloud, collaboration and cybersecurity applications to create more personalized, effective learning experiences for students. David Atkins of PA Cyber says that their approach to e-learning is succeeding because they take a fully holistic view of the student, their family and their situation. “Our collaboration with the student starts from the very moment that there’s interest in having some sort of cyber education. And we go from enrollments, all the way through any issues of that students could have, or the students family could have and take them all the way through graduation’ David said. “We take the time to listen and see the student as a complete person.”

The following are the key insights based on our conversations:

• Choosing to make cybersecurity the highest priority treats students as customers, protecting their unique online learning experiences while providing excellent access across all socioeconomic levels. That’s when online learning experiences excel. What’s impressive how committed the team of educators I spoke with is about making technology work as a catalyst to help every student achieve their educational goals across all socioeconomic levels. They’re also the most advanced at tailoring complex technologies to deliver customized online learning experiences with PA Cyber serving 12,000 remote students at once. “Each of our students is different and they’re looking to accomplish different things and they learn in different ways. We have a different classroom options that they can choose from. And we have a lot of different scaffolding options in place when it comes to our instructional platform, “Jennifer Shoaf, Deputy Chief Academic Officer at PA Cyber said. Eric Ramos, CTO at USD says that he and his staff “reach out to teachers and staff members and provide them with the latest cybersecurity alerts and make sure they are aware of how their autonomous endpoint security platform is securing every laptop and making their job of staying in compliance to security protocols easy.” Eric continued saying that, “having an undeletable digital tether gives my staff, senior educators and me peace of mind, especially with summer here and the need to keep track of the Chromebooks out with students and families.”
• The more resilient the autonomous endpoint security on the laptop, the easier it is to secure, upgrade and locate each of them if they’re lost or stolen. Duarte Unified School District provides Chromebooks to students for use all year long, often also providing an Internet HotSpot as many students’ families don’t have Internet access. PA Cyber provides students a Dell laptop and an entire technology kit that includes printers and peripherals as well. Having an undeletable digital tether to every laptop makes it possible to keep every system up to date on security and system patches. Dean Phillips, Senior Technology Director at PA Cyber, says that it’s been very helpful to know each laptop has active autonomous endpoint security running at all times. Dean says that endpoint management is a must-have for PA Cyber “We’re using Absolute’s Persistence to ensure an always-on, two-way connection with our IT management solution, Kaseya®, which we use to remotely push out security patches, new applications and scripts. That’s been great for students’ laptops as we can keep updates current and know where the system is. Without an endpoint management solution on student laptops, it is very difficult to manage endpoints without that agent. So Absolute absolutely helps us with that as well. That’s been a big plus.” Eric Ramos, CTO, says that “Absolute has been great, especially when student calls in and says they can’t find their laptop. I don’t know where it is. It’s lost or maybe stolen. We’re able to pull that up, figure out the last time it got pinged and we can locate that usually. Nine times out of 10, the student finds it by next day by just having that information. So that’s been crucial. It’s always been something we love having.”
• Standardize on a secure cloud platform that is flexible enough to support scaffolding or individualized learning yet hardened enough to protect every laptop connected to it via an undeletable digital tether. A major challenge both online schools face is keeping their cloud platforms adaptive enough to support students’ varying skills yet also secure enough to protect every student online.  Dean Phillips, Senior Technology Director at PA Cyber, says that it’s best to “keep technology as simple as possible for the students and families. Standardization is key, I think, with everything you do from a technology standpoint. Making sure that you build from the inside out from the core. Your applications and networks and making sure that that’s consistent all the way to the endpoint, I think that’s extremely important.” PA Cyber’s lessons learned creating a secure and adaptive e-learning platform makes the goal of providing personalized instruction for every student achievable at scale.  Jennifer Shoaf, Deputy Chief Academic Officer at PA Cyber, explains how the school personalizes online instruction for every student. “It all starts when the student first comes to PA Cyber and we try to get an understanding of where they are and where they should be and where they want to see themselves, whether it’s in a month or in a couple years, or when they graduate from our school. So one of the things that we pride ourselves on here at this school is allowing for multiple modes of instruction for our students,” Jennifer said.
• Capitalizing on the excellent asset management reporting autonomous endpoint security solutions have, CTOs and senior IT directors are gaining new insights into how to improve learning effectiveness. Having resilient, persistent connections to every endpoint with an undeletable digital tether also provides invaluable asset management data. Eric Ramos of Duarte USD and Dean Phillips of PA Cyber are leaders in this area of e-learning today. Eric Ramos says that asset management and activity reports made possible by the autonomous endpoint platform he is using from Absolute makes getting prepared for senior management meetings easy. “During principal meetings, I’m able to pull up these reports and say, look, these were the goals at the beginning of the year to use these four products at this amount of time. And here’s where you’re at on a small window. Or you can look at it over time and saying, this has been an increase here, this is a decrease here, these sites are doing really well with it, these sites may be not. But let’s now talk about what’s working for you. What are your teachers liking about the particular program? Or, program aside, how are your results coming about?” Eric Ramos, CTO said.

Conclusion

Delivering an excellent online learning experience needs to start with a cybersecurity strategy that includes autonomous endpoint security. Duarte USD and PA Cyber are leaders in this field, being among the first to see how combining core technologies while having an undeletable digital tether to every laptop is a must-have. Earning and growing the trust of parents, students, teachers and school administrators start with an endpoint security strategy that can adapt and grow as an e-learning program does.

Improving Online Learning Experiences One Secured Endpoint At A Time is copyrighted by Louis Columbus. If you are reading this outside your feed reader or email, you are likely witnessing illegal content theft.

Enterprise Irregulars is sponsored by Salesforce and Zoho.

Bottom Line: DevOps and security teams need to leave one-time gating inspections in the past and pursue a more collaborative real-time framework to achieve their shared compliance, security and time-to-market goals.

Shorter product lifecycles the need to out-innovate competitors and exceed customer expectations with each new release are a few of the many reasons why DevOps is so popular today. Traditional approaches to DevOps teams collaborating with security aren’t working today and product releases are falling behind or being rushed to-market leading to security gaps as a result.

Based on conversations with DevOps team leaders and my own experience being on a DevOps team the following are factors driving the urgency to integrate security into DevOps workflows:

• Engineering, DevOps and security teams each have their lexicon and way of communicating reinforced by siloed systems.
• Time-to-market and launch delays are common when engineering, DevOps and security don’t have a unified system to use that includes automation tools to help scale tasks and updates.
• Developers are doing Application Security Testing (AST) with tools that aren’t integrated into their daily development environments, making the process time-consuming and challenging to get done.
• Limiting security to the testing and deployment phases of the Software Development Lifecycle (SDLC) is a bottleneck that jeopardizes the critical path, launch date and compliance of any new project.
• 70% of DevOps team members have not been trained on how to secure software adequately according to a DevSecOps Global Skills survey.

Adding to the urgency is the volume of builds DevOps teams produce in software companies and enterprises daily and the need for having security integrated into DevOps becomes clear. Consider the fact that Facebook on Android alone does 50,000 to 60,000 builds a day according to research cited from Checkmarx who is taking on the challenge of integrating DevOps and security into a unified workflow. Their Software Security Platform unifies DevOps with security and provides static and interactive application security testing, newly launched software composition analysis and developer AppSec awareness and training programs to reduce and remediate risk from software vulnerabilities.

Synchronizing Security Into DevOps Delivers Much Needed Speed & Scale

DevOps teams thrive in organizations built for speed, continuous integration, delivery and improvement. Contrast the high-speed always-on nature of DevOps teams with the one-time gating inspections security teams use to verify regulatory, industry and internal security and compliance standards and it’s clear security’s role in DevOps needs to change. Integrating security into DevOps is proving to be very effective at breaking through the roadblocks that stand in the way of getting projects done on time and launched into the market.  Getting the security and DevOps team onto the same development platform is needed to close the gaps between the two teams and accelerate development. Of the many approaches available for accomplishing this Checkmarx’s approach to integrating Application Security Testing into DevOps shown below is among the most comprehensive:

Making DevOps A Core Strength Of An Organization

By 2025 nearly two-thirds of enterprises will be prolific software producers with code deployed daily to meet constant demand and over 90% of new apps will be cloud-native, enabling agility and responsiveness according to IDC FutureScape: Worldwide IT Industry 2020 Predictions. IDC also predicts there will be 1.6 times more developers than now, all working in collaborative systems to enable innovation. The bottom line is that every company will be a technology company in the next five years according to IDC’s predictions.

To capitalize on the pace of change happening today driven by DevOps, organizations need frameworks that deliver the following:

• Greater agility and market responsiveness – Organizations need to create operating models that integrate business, operations and technology into stand-alone businesses-within-the-business domains.
• Customer Centricity at the core of business models – The best organizations leverage a connected economy to ensure that they can meet and exceed customer expectations.  By creating an ecosystem that caters to every touchpoint of the customer journey using technology, these organizations seem to anticipate their customer needs and deliver the goods and services needed at the right time via the customer’s preferred channel.  As a result, successful organizations see growth from their existing customer base while they acquire new ones.
• Have a DNA the delivers a wealth of actionable Insights – Organizations well-positioned to turn data into insights that drive actions to serve and anticipate customer needs are ahead of competitors today regarding time-to-market.  These organizations know how to pull all the relevant information, capabilities and people together so they can act quickly and efficiently in making the right decisions. They are the companies that will know the outcome of their actions before they take them and they will be able to anticipate their success.

BMC’s Autonomous Digital Enterprise framework, shown below highlights how companies that have an innovation mindset and the three common traits of agility, customer centricity and actionable insights at their foundation have greater consistency and technology maturity in their business model characteristics compared to competitors. They also can flex and support fundamental operating model characteristics and key technology-enabled tenets. These tenets include delivering a transcendent customer experience, automating customer transactions and providing automation everywhere seeing enterprise DevOps as a natural evolution of DevOps, enabling a business to be more data-driven and achieving more adaptive cybersecurity in a Zero-Trust framework.

Conclusion

Meeting the challenge of integrating security in DevOps provides every organization with an opportunity to gain greater agility and market responsiveness, become more customer-centric and develop the DNA to be more data-driven. These three goals are achievable when organizations look to how they can build on their existing strengths and reinvent themselves for the future. As DevOps success goes so goes the success of any organization. Checkmarx’s approach to putting security at the center of DevOps is helping to break down the silos that exist between engineering, DevOps and security. To attain greater customer-centricity, become more data-driven and out-innovate competitors, organizations are adopting frameworks including BMC’s Autonomous Digital Enterprise to reinvent themselves and be ready to compete in the future now.

Why Security Needs To Be Integral To DevOps is copyrighted by Louis Columbus. If you are reading this outside your feed reader or email, you are likely witnessing illegal content theft.

Enterprise Irregulars is sponsored by Salesforce and Zoho.

Bottom Line: Shattering the false sense of security in tech, the recent Twitter hack blended altruism, fame, greed, social engineering via SIM swapping and insider threats to steal $120,000 from victims when the economic and political damage could have been far worse.

Targeting the most influential celebrities on Twitter, hackers orchestrated a social engineering-based attack Wednesday promoting a cryptocurrency scam. Business leaders, celebrities, politicians and billionaires’ accounts were hacked using Twitter’s administrative tools. Personal Twitter accounts hacked include those of Amazon CEO Jeff Bezos, Joe Biden, Tesla CEO Elon Musk, President Barack Obama, Bill Gates, Warren Buffet and others. Apple and Uber’s Twitter accounts were also hacked.

Using SIM swapping, in which threat actors trick, coerce or bribe employees of their victims to gain access to privileged account credentials and administrative tools, hackers were able first to change the email address of each targeted account. Next, two-factor authentication was turned off so when an alert was sent of the account change it went to the hacker’s email address. With the targeted accounts under their control, hackers began promoting their cryptocurrency scam. While not all details of the attack have surfaced Motherboard’s story of how hackers convinced a Twitter employee to help them the hijack accounts makes for fascinating reading.

Dissecting The Hack

Interested in dissecting the hack from a cybersecurity standpoint, I contacted Dr. Torsten George, Cybersecurity Evangelist and industry expert from Centrify. Torsten is also a leading authority on privileged access management and how to thwart breaches involving privileged access credentials.

Louis:  What was your initial impression upon breaking news of the hack and what did you believe would cause such a massive hack of celebrity and leading political figures accounts this past week?

Torsten: When the news broke, the media probably polled other security experts and the first initial reaction was, ‘Oh, that’s a massive attack, most likely a credential-based attack,’ because 80% of today’s data breaches go back to privilege access abuse. They are typically first triggered by phishing attacks, the precursor to many attacks where the attackers tried to capture these credentials and then leverage them to attack their victim’s organizations.

So, the breaking news indicated that most likely, somebody was able to leverage a compromised credential to enter into the Twitter environment and take over accounts. However, more and more information became available, with screenshots being shared of internal Twitter tools. For me, that raised a red flag, because in a typical attack pattern we’re seeing three distinct phases in the cyber-attack lifecycle: the compromise, the exploration phase and the exfiltration of sensitive data, which includes covering up tracks and potentially creating a backdoor for future attacks.

When performing reconnaissance, hackers commonly try to identify regular IT schedules, security measures, network traffic flows and scan the entire IT environment to gain an accurate picture of the network resources, privileged accounts and services. Domain controllers, Active Directory and servers are prime reconnaissance targets to hunt for additional privileged credentials and privileged access.

They wouldn’t necessarily look for administrative tools that could be leveraged for their attack unless they have intimate knowledge that those tools exist in the victim’s environment — be it by having worked for the company in the past or representing an insider threat.

Louis: What’s the anatomy of an insider attack, based on your experience?

Torsten: As was later confirmed by Twitter, it became very apparent that this is a case of insider threats, where you have an insider that has been leveraged for this attack. The most common insider threats can be defined by the intent and motivation of the individuals involved. The 2019 Verizon Insider Threat Report defines five distinct insider threats based on data breach scenarios and they all have excellent, accurate names: the Careless Worker, the Inside (often recruited) Agent, the Disgruntled Employee, the Malicious Insider and the Feckless Third-Party.

Considering the global environment we’re facing right now, with Covid-19 and other related economic hardships, the risk of insider threats is exacerbated, as pending furloughs or pay cuts may tempt employees to exfiltrate data to secure a new job or make up for income losses.

So a privileged administrator might be more open to people that approach them and say, ‘Would you be willing to share with us your access credentials, or would you do something on our behalf to exfiltrate data or to manipulate data?’ That risk has increased dramatically across all industries.

So it turned out the first suspicion was phishing attacks, followed by compromised credentials. It turns out to be an insider threat. Organizations need to be prepared for that.

Louis: What can companies do to reduce the likelihood a malicious insider will hack them?

Torsten: It becomes a little bit trickier when you deal with a malicious insider because they most likely know your environment, they might know your defense mechanisms and they might know the security tools that your likely using. So they can bypass these security controls and try to gain the control of data that they can then profit from.

Organizations have to rethink the way that they’ve structured their defense controls and truly take an approach of an in-depth strategy with a different layer of defenses. The first layer that comes to mind in this particular case is multi-factor authentication (MFA) which is still low-hanging fruit. There are still many organizations out there that are not taking advantage of implementing MFA.

While MFA is highly recommended, it isn’t as effective against insider threats because they have that second factor of authentication and can pass those challenges. Organizations need to go beyond MFA if they want to have a layered security strategy.

Louis: What are some of the ways they can go beyond MFA to avoid being the victim of an insider threat?

Torsten: A very important component of your defense strategy should be the approach of zero standing privileges, which is something Gartner recommends to its clients. That means that I have normal privileges and entitlements to do my job, like answering emails and using the Internet, but that’s probably all I need. If I need more access, I’ll have to elevate my privilege for the time needed to do that particular task but then rescind that privilege once it’s done.

If I have zero standing privileges – even if somebody compromises my credential, even if I’m an insider – I don’t have immediate access to the keys to the kingdoms to do whatever I want.

And before privilege elevation, organizations should require context through a formal request. For example, require the user to submit a ticket through ServiceNow or any other IT Service Management platform to detail what they need to access, for how long and to do what. That way, there is an auditing trail and an approval process. If the threat actor – whether insider or not – doesn’t do this they don’t get privileged access to that target system.

Louis: Besides those perhaps expected controls, what other controls might have helped in this particular scenario?

Torsten: Organizations should also take advantage of modern tools to leverage machine learning technology, so that looks at user behavior and risk factors to also get a hold of these insider attacks. All the other security controls are more tailored towards external preparation at first. Still, once you implement machine learning technology and user behavior analytics that’s where you also can capture insider threats.

Machine learning can look for suspicious activity, such as a target being accessed outside of a typical maintenance window, or is the administrator logging in from a different location or device than usual. It can then trigger an MFA request and also issue a real-time alert, regardless of whether the MFA challenge is successfully resolved.

Furthermore, in the case of Twitter, there are privacy and regulatory concerns that could also be additional triggers for real-time alerts and to shut down this activity automatically. Regulations like the CCPA (California Consumer Privacy Act) and GDPR (General Data Protection Regulation) mean that platforms like Twitter have to be very careful with any access to or manipulation of a customer’s feed. That could – and should have – instantly triggered a real-time alert when an administrator was posting on behalf of a user.

Louis: Do you think this is going to be the start of an entirely new era of hacks where hackers will pay off internal employees for promotional messages?

Torsten: Quite frankly, we have seen an uptick since the start of the Covid-19 pandemic. And I believe now that this Twitter attack has been covered in the press so much, you will have copycats that will try to do the same. Some of them will also target social media platforms, but others that might be a little bit smarter because social media is easily detectable if something goes wrong. An industry like healthcare could be a prime target and there is already news that Russian hackers are attacking healthcare providers and research labs to try to gain access to vaccine research.

Louis: Given how significant this hack is in terms of the progression or the growing sophistication of threats, what are the top three predictions you have for the rest of 2020?

Torsten: Ransomware is an example of a technique that has changed quite significantly in two ways. First, they are no longer only delivered via an email, but also via social media platforms, SMS messages and more. Second, ransomware is no longer only focused on shutting down business operations. The most recent example with EDP Renewables North American, a subsidiary of an European-based electric utilities company, showed that hackers leveraged ransomware to exfiltrate data. Not to lock it down, but to exfiltrate data and then ask for ransom from their victim to not publish the data on the Dark Web.

Second, as I’ve already covered, the current economic hardships of the pandemic will cause more people to jump on the bandwagon and become cybercriminals. And these aren’t the people you see in movies – dark characters in hoodies using sophisticated hacking techniques to breach the government. These are your neighbors, the little boys next door. For them it’s not a big deal to become a cyber-criminal.

Third, as you’d expect, the number of cyber-attacks will increase as a result and they will continue to find new and innovative ways to find the easiest way in. The Twitter incident taught us that there was no technology “breach” required. It was just finding the right person with the right privileges and paying them to do 25 Tweets. That’s an easy payday.

I think this whole crisis that we’re going through will see a major uptick in attacks from the traditional cyber hackers, but also from a whole bunch of newbies and greenhorns that will try out their luck and see if they can make a buck. Either by ransomware attacks, phishing attacks, social engineering or any combination thereof.

Dissecting The Twitter Hack With A Cybersecurity Evangelist is copyrighted by Louis Columbus. If you are reading this outside your feed reader or email, you are likely witnessing illegal content theft.

Enterprise Irregulars is sponsored by Salesforce and Zoho.

• Startups’ ambitious AI-based new product development is driving AI-related investment with $16.5B raised in 2019, driven by 695 deals according to PwC/CB Insights MoneyTree Report, Q1 2020.
• AI expertise is a skill product development teams are ramping up their recruitment efforts to find, with over 7,800 open positions on Monster, over 3,400 on LinkedIn and over 4,200 on Indeed as of today.
• One in ten enterprises now uses ten or more AI applications, expanding the Total Available Market for new apps and related products, including chatbots, process optimization and fraud analysis, according to MMC Ventures.

From startups to enterprises racing to get new products launched, AI and machine learning (ML) are making solid contributions to accelerating new product development. There are 15,400 job positions for DevOps and product development engineers with AI and machine learning today on Indeed, LinkedIn and Monster combined. Capgemini predicts the size of the connected products market will range between $519B to $685B this year with AI and ML-enabled services revenue models becoming commonplace.

Rapid advances in AI-based apps, products and services will also force the consolidation of the IoT platform market. The IoT platform providers concentrating on business challenges in vertical markets stand the best chance of surviving the coming IoT platform shakeout. As AI and ML get more ingrained in new product development, the IoT platforms and ecosystems supporting smarter, more connected products need to make plans now how they’re going to keep up. Relying on technology alone, like many IoT platforms are today, isn’t going to be enough to keep up with the pace of change coming.   The following are 10 ways AI is improving new product development today:

• 14% of enterprises who are the most advanced using AI and ML for new product development earn more than 30% of their revenues from fully digital products or services and lead their peers is successfully using nine key technologies and tools. PwC found that Digital Champions are significantly ahead in generating revenue from new products and services and more than a fifth of champions (29%) earn more than 30% of revenues from new products within two years of information. Digital Champions have high expectations for gaining greater benefits from personalization as well. The following graphic from Digital Product Development 2025: Agile, Collaborative, AI-Driven and Customer Centric, PwC, 2020 (PDF, 45 pp.) compares Digital Champions’ success with AI and ML-based new product development tools versus their peers:

• 61% of enterprises who are the most advanced using AI and ML (Digital Champions) use fully integrated Product Lifecycle Management (PLM) systems compared to just 12% of organizations not using AI/ML today (Digital Novices). Product Development teams the most advanced in their use of AL & ML achieve greater economies of scale, efficiency and speed gains across the three core areas of development shown below. Digital Champions concentrate on gaining time-to-market and speed advantages in the areas of Digital Prototyping, PLM, co-creation of new products with customers, Product Portfolio Management and Data Analytics and AI adoption:

• AI is actively being used in the planning, implementation and fine-tuning of interlocking railway equipment product lines and systems.  Engineer-to-order product strategies introduce an exponential number of product, service and network options. Optimizing product configurations require an AI-based logic solver that can factor in all constraints and create a Knowledge Graph to guide deployment. Siemens’ approach to using AI to find the optimal configuration out of 10⁹⁰ possible combinations provides insights into how AI can help with new product development on a large scale. Source: Siemens, Next Level AI – Powered by Knowledge Graphs and Data Thinking, Siemens China Innovation Day, Michael May, Chengdu, May 15, 2019.

• Eliminating the roadblocks to getting new products launched starts with using AI to improve demand forecast accuracy. Honeywell is using AI to reduce energy costs and negative price variance by tracking and analyzing price elasticity and price sensitivity as well. Honeywell is integrating AI and machine-learning algorithms into procurement, strategic sourcing and cost management getting solid returns across the new product development process. Source: Honeywell Connected Plant: Analytics and Beyond. (23 pp., PDF, no opt-in) 2017 Honeywell User’s Group.

• Relying on AI-based techniques to create and fine-tune propensity models that define product line extensions and add-on products that deliver the most profitable cross-sell and up-sell opportunities by product line, customer segment and persona. It’s common to find data-driven new product development and product management teams using propensity models to define the products and services with the highest probability of being purchased. Too often, propensity models are based on imported data, built-in Microsoft Excel, making their ongoing use time-consuming. AI is streamlining creation, fine-tuning and revenue contributions of up-sell and cross-sell strategies by automating the entire progress. The screen below is an example of a propensity model created in Microsoft Power BI.

• AI is enabling the next generation of frameworks that reduce time-to-market while improving product quality and flexibility in meeting unique customization requirements on every customer order. AI is making it possible to synchronize better suppliers, engineering, DevOps, product management, marketing, pricing, sales and service to ensure a higher probability of a new product succeeding in the market. Leaders in this area include BMC’s Autonomous Digital Enterprise (ADE). BMC’s ADE framework shows the potential to deliver next-generation business models for growth-minded organizations looking to run and reinvent their businesses with AI/ML capabilities and deliver value with competitive differentiation enabled by agility, customer centricity and actionable insights. The ADE framework is capable of flexing and responding more quickly to customer requirements than competitive frameworks due to the following five factors: proven ability to deliver a transcendent customer experience; automated customer interactions and operations across distributed organizations; seeing enterprise DevOps as natural evolution of software DevOps; creating the foundation for a data-driven business that operates with a data mindset and analytical capabilities to enable new revenue streams; and a platform well-suited for adaptive cybersecurity. Taken together, BMC’s ADE framework is what the future of digitally-driven business frameworks look like that can scale to support AI-driven new product development. The following graphic compares the BMC ADE framework (left) and the eight factors driving digital product development as defined by PwC (right) through their extensive research. For more information on BMC’s ADE framework, please see BMC’s Autonomous Digital Enterprise site. For additional information on PwC’s research, please see the document Digital Product Development 2025: Agile, Collaborative, AI-Driven and Customer Centric, PwC, 2020 (PDF, 45 pp.).

• Using AI to analyze and provide recommendations on how product usability can be improved continuously. It’s common for DevOps, engineering and product management to run A/B tests and multivariate tests to identify the usability features, workflows and app & service responses customers prefer. Based on personal experience, one of the most challenging aspects of new product development is designing an effective, engaging and intuitive user experience that turns usability into a strength for the product. When AI techniques are part of the core new product development cycle, including usability, delivering enjoyable customer experiences, becomes possible. Instead of a new app, service, or device is a chore to use, AI can provide insights to make the experience intuitive and even fun.
• Forecasting demand for new products, including the causal factors that most drive new sales is an area AI is being applied to today with strong results. From the pragmatic approaches of asking channel partners, indirect and direct sales teams, how many of a new product they will sell to using advanced statistical models, there is a wide variation in how companies forecast demand for a next-generation product. AI and ML are proving to be valuable at taking into account causal factors that influence demand yet had not been known of before.
• Designing the next generation of Nissan vehicles using AI is streamlining new product development, trimming weeks off new vehicle development schedules. Nissan’s pilot program for using AI to fast-track new vehicle designs is called DriveSpark. It was launched in 2016 as an experimental program and has since proven valuable for accelerating new vehicle development while ensuring compliance and regulatory requirements are met. They’ve also used AI to extend the lifecycles of existing models as well. For more information, see the article, DriveSpark, “Nissan’s Idea: Let An Artificial Intelligence Design Our Cars,” September 2016.
• Using generative design algorithms that rely on machine learning techniques to factor in design constraints and provide an optimized product design. Having constraint-optimizing logic within a CAD design environment helps GM attain the goal of rapid prototyping. Designers provide definitions of the functional requirements, materials, manufacturing methods and other constraints. In May 2018, General Motors adopted Autodesk generative design software to optimize for weight and other key product criteria essential for the parts being designed to succeed with additive manufacturing. The solution was recently tested with the prototyping of a seatbelt bracket part, which resulted in a single-piece design that is 40% lighter and 20% stronger than the original eight component design. Please see the Harvard Business School case analysis, Project Dreamcatcher: Can Generative Design Accelerate Additive Manufacturing? for additional information.

Additional reading:

2020 AI Predictions, Five ways to go from reality check to real-world payoff, PwC Consulting

Accenture, Manufacturing The Future, Artificial intelligence will fuel the next wave of growth for industrial equipment companies (PDF, 20 pp., no opt-in)

AI Priorities February 2020 5 ways to go from reality check to real-world pay off, PwC, February, 2020 (PDF, 16 pp.)

Anderson, M. (2019). Machine learning in manufacturing. Automotive Design & Production, 131(4), 30-32.

Bruno, J. (2019). How the IIoT can change business models. Manufacturing Engineering, 163(1), 12.

Digital Factories 2020: Shaping The Future Of Manufacturing, PwC DE., 2017 (PDF, 48 pp.)

Digital Product Development 2025: Agile, Collaborative, AI Driven and Customer Centric, PwC, 2020 (PDF, 45 pp.)

Enabling a digital and analytics transformation in heavy-industry manufacturing, McKinsey & Company, December 19, 2019

Global Digital Operations 2018 Survey, Strategy&, PwC, 2018

Governance and Management Economics, 7(2), 31-36.

Greenfield, D. (2019). Advice on scaling IIoT projects. ProFood World

Hayhoe, T., Podhorska, I., Siekelova, A., & Stehel, V. (2019). Sustainable manufacturing in industry 4.0: Cross-sector networks of multiple supply chains, cyber-physical production systems and AI-driven decision-making. Journal of Self-

Industry’s fast-mover advantage: Enterprise value from digital factories, McKinsey & Company, January 10, 2020

Kazuyuki, M. (2019). Digitalization of manufacturing process and open innovation: Survey results of small and medium-sized firms in japan. St. Louis: Federal Reserve Bank of St Louis.

‘Lighthouse’ manufacturers lead the way—can the rest of the world keep up?  McKinsey & Company, January 7, 2019

Machine Learning in Manufacturing – Present and Future Use-Cases, Emerj Artificial Intelligence Research, last updated May 20, 2019, published by Jon Walker

Machine learning, AI are most impactful supply chain technologies. (2019). Material Handling & Logistics

MAPI Foundation, The Manufacturing Evolution: How AI Will Transform Manufacturing & the Workforce of the Future by Robert D. Atkinson, Stephen Ezell, Information Technology and Innovation Foundation (PDF, 56 pp., opt-in)

Mapping heavy industry’s digital-manufacturing opportunities, McKinsey & Company, September 24, 2018

McKinsey, AI in production: A game changer for manufacturers with heavy assets, by Eleftherios Charalambous, Robert Feldmann, Gérard Richter and Christoph Schmitz

McKinsey, Digital Manufacturing – escaping pilot purgatory (PDF, 24 pp., no opt-in)

McKinsey, Driving Impact and Scale from Automation and AI, February 2019 (PDF, 100 pp., no opt-in).

McKinsey, ‘Lighthouse’ manufacturers, lead the way—can the rest of the world keep up?,by Enno de Boer, Helena Leurent and Adrian Widmer; January, 2019.

McKinsey, Manufacturing: Analytics unleashes productivity and profitability, by Valerio Dilda, Lapo Mori, Olivier Noterdaeme and Christoph Schmitz, March, 2019

McKinsey/Harvard Business Review, Most of AI’s business uses will be in two areas,

Morey, B. (2019). Manufacturing and AI: Promises and pitfalls. Manufacturing Engineering, 163(1), 10.

Preparing for the next normal via digital manufacturing’s scaling potential, McKinsey & Company, April 10, 2020

Reducing the barriers to entry in advanced analytics. (2019). Manufacturing.Net,

Scaling AI in Manufacturing Operations: A Practitioners Perspective, Capgemini, January, 2020

Seven ways real-time monitoring is driving smart manufacturing. (2019). Manufacturing.Net,

Siemens, Next Level AI – Powered by Knowledge Graphs and Data Thinking, Siemens China Innovation Day, Michael May, Chengdu, May 15, 2019

Smart Factories: Issues of Information Governance Manufacturing Policy Initiative School of Public and Environmental Affairs Indiana University, March 2019 (PDF, 68 pp., no opt-in)

Smartening up with Artificial Intelligence (AI) – What’s in it for Germany and its Industrial Sector? (52 pp., PDF, no opt-in) McKinsey & Company.

Team predicts the useful life of batteries with data and AI. (2019, March 28). R & D.

The AI-powered enterprise: Unlocking the potential of AI at scale, Capgemini Research, July 2020

The Future of AI and Manufacturing, Microsoft, Greg Shaw (PDF, 73 pp., PDF, no opt-in).

The Rise of the AI-Powered Company in the Postcrisis World, Boston Consulting Group, April 2, 2020

Top 8 Data Science Use Cases in Manufacturing, ActiveWizards: A Machine Learning Company Igor Bobriakov, March 12, 2019

Walker, M. E. (2019). Armed with analytics: Manufacturing as a martial art. Industry Week

Wang, J., Ma, Y., Zhang, L., Gao, R. X., & Wu, D. (2018). Deep learning for smart manufacturing: Methods and applications. Journal of Manufacturing Systems, 48, 144–156.

Zulick, J. (2019). How machine learning is transforming industrial production. Machine Design

10 Ways AI Is Improving New Product Development is copyrighted by Louis Columbus. If you are reading this outside your feed reader or email, you are likely witnessing illegal content theft.

Enterprise Irregulars is sponsored by Salesforce and Zoho.

Bottom line: With many IT budgets under scrutiny, cybersecurity teams are expected to do more with less, prioritizing spending that delivers the greatest ROI while avoiding the top five mistakes that threaten their infrastructures.

In a rush to reduce budgets and spending, cybersecurity teams and the CISOs that lead them need to avoid the mistakes that can thwart cybersecurity strategies and impede infrastructure performance. Cutting budgets too deep and too fast can turn into an epic fail from a cybersecurity standpoint. What I’ve found is that CIOs are making decisions based on budget requirements, while CISOs are looking out for the security of the company.

Based on their ongoing interviews with CIOs, Gartner is predicting an 8% decline in worldwide IT spending this year. Cybersecurity projects that don’t deliver a solid ROI are already out of IT budgets. Prioritizing and trimming projects to achieve tighter cost optimization is how CIOs and their teams are reshaping their budgets today. CIOs say the goal is to keep the business running as secure as possible, not attain perfect cybersecurity.

Despite the unsettling, rapid rise of cyber-attacks, including a 667% increase in spear-fishing email attacks related to Covid-19 since February alone, CIOs often trim IT budgets starting with cybersecurity first. The current economic downturn is making it clear that cybersecurity is more of a business strategy than an IT one, as spending gets prioritized by the best-to-worst business case.

Five Mistakes No CISO Wants To Make

One of the hardest parts of a CISO’s job is deciding which projects will continue to be funded and who will be responsible for leading them, so they deliver value. It gets challenging fast when budgets are shrinking and competitors actively recruit the most talented team members. Those factors taken together create the perfect conditions for the five mistakes that threaten the infrastructure cybersecurity and resilience of any business.

The five mistakes no CISO wants to make include the following:

1.   No accountability for the crown jewels for the company. Privileged access credentials continue to be the primary target for cyber-attackers. However, many companies just went through a challenging sprint to make sure all employees have secure remote access to enable Covid-19 work-from-home policies. Research by Centrify reveals that 41% of UK businesses aren’t treating outsourced IT and other third parties likely to have some form of privileged access as an equal security concern.

And while a password vault helps rotate credentials, it still relies on shared passwords and doesn’t provide any accountability to know who is doing what with them. That accountability can be introduced by moving to an identity-centric approach where privileged users log in as themselves and are authenticated using existing identity infrastructures (such as Microsoft Active Directory) to federate access with Centrify’s Privileged Access Service.

CISOs and their teams also continue to discount or underestimate the importance of privileged non-human identities that far outweigh human users as a cybersecurity risk in today’s business world. What’s needed is an enterprise-wide approach enabling machines to protect themselves across any network or infrastructure configuration.

2.   Cybersecurity budgets aren’t revised for current threatscapes. Even though many organizations are still in the midst of extensive digital transformation, their budgets often reflect the threatscape from years ago. This gives hackers the green light to get past antiquated legacy security systems to access and leverage modern infrastructures, such as cloud and DevOps. IT security leaders make this even more challenging by not listening to the front-line cybersecurity teams and security analysts who can see the patterns of breach attempts in data they review every day. In dysfunctional organizations, the analyst teams are ignored and cybersecurity suffers.

3. Conflicts of interest when CISOs report to CIOs and the IT budget wins.  This happens in organizations that get hacked because the cybersecurity teams aren’t getting the tools and support they need to do their jobs. With IT budgets facing the greatest scrutiny they’ve seen in a decade, CISOs need to have their budget to defend. Otherwise, too many cybersecurity projects will be cut without thinking of the business implications of each. The bottom line is CISOs need to report to the CEO and have the autonomy to plan, direct, evaluate and course-correct their strategies with their teams.

4. The mistake of thinking cloud platforms’ Identity and Access Management (IAM) tools can secure an enterprise on their own. Cloud providers offer a baseline level of IAM support that might be able to secure workloads in their clouds adequately but is insufficient to protect a multi-cloud, hybrid enterprise. IT leaders need to consider how they can better protect the complex areas of IAM and Privileged Access Management (PAM) with these significant expansions of the enterprise IT estate.

Native IAM capabilities offered by AWS, Microsoft Azure, Google Cloud and other vendors provide enough functionality to help an organization get up and running to control access in their respective homogeneous cloud environments. However, often they lack the scale to fully address the more challenging, complex areas of IAM and PAM in hybrid or multi-cloud environments. Please see the post, The Truth About Privileged Access Security On AWS and Other Public Clouds, for additional information.

5. Exposing their organizations to a greater risk of breach and privileged access credential abuse by staying with legacy password vaults too long. Given the severity, speed and scale of breach attempts, IT leaders need to re-think their vault strategy and make them more identity-centric. Just as organizations have spent the past 5 – 10 years modernizing their infrastructure, they must also consider how to modernize how they secure access to it. More modern solutions can enforce a least privilege approach based on Zero Trust principles that grant just enough, just-in-time access to reduce risk. Forward-thinking organizations will be more difficult to breach by reorienting PAM from being vault-centric to identity-centric.

Conclusion

Decisions about what stays or goes in cybersecurity budgets this year could easily make or break careers for CISOs and CIOs alike. Consider the five mistakes mentioned here and the leading cause of breaches – privileged access abuse. Prioritizing privileged access management for human and machine identities addresses the most vulnerable threat vector for any business. Taking a more modern approach that is aligned to digital transformation priorities can often allow organizations to leverage their existing solutions to reduce risk and costs at the same time.

5 Mistakes That Threaten Infrastructure Cybersecurity And Resilience is copyrighted by Louis Columbus. If you are reading this outside your feed reader or email, you are likely witnessing illegal content theft.

Enterprise Irregulars is sponsored by Salesforce and Zoho.

Bottom Line: Absolute’s 2020 Endpoint Resilience Report illustrates why the purpose of any cybersecurity program needs to be attaining a balance between protecting an organization and the need to keep the business running, starting with secured endpoints.

Enterprises who’ve taken a blank-check approach in the past to spending on cybersecurity are facing the stark reality that all that spending may have made them more vulnerable to attacks. While cybersecurity spending grew at a Compound Annual Growth Rate (CAGR) of 12% in 2018, Gartner’s latest projections are predicting a decline to only 7% CAGR through 2023. Nearly every CISO I’ve spoken with in the last three months say prioritizing cybersecurity programs by their ROI and contribution to the business is how funding gets done today.

Cybersecurity Has Always Been A Business Decision

Overcoming the paradox of keeping a business secure while fueling its growth is the essence of why cybersecurity is a business decision. Securing an entire enterprise is an unrealistic goal; balancing security and ongoing operations is. CISOs speak of this paradox often and the need to better measure the effectiveness of their decisions.

This is why the findings from Absolute’s 2020 State of Endpoint Resilience Report​  are so timely given the shift to more spending accountability on cybersecurity programs. The report’s methodology is based on anonymized data from enterprise-specific subsets of nearly 8.5 million Absolute-enabled devices active across 12,000+ customer organizations in North America and Europe. Please see the last page of the study for additional details regarding the methodology.

Key insights from the study include the following:

• More than one of every three enterprise devices had an Endpoint Protection (EP), client management or VPN application out of compliance, further exposing entire organizations to potential threats. More than 5% of enterprise devices were missing one or more of these critical controls altogether. Endpoints, encryption, VPN and Client Management are more, not less fragile, despite millions of dollars being spent to protect them before the downturn. The following graphic illustrates how fragile endpoints are by noting average compliances rate alongside installation rates:

• When cybersecurity spending isn’t being driven by a business case, endpoints become more complex, chaotic and nearly impossible to protect. Absolute’s survey reflects what happens when cybersecurity spending isn’t based on a solid business decision, often leading to multiple endpoint security agents. The survey found the typical organization has 10.2 endpoint agents on average, up from 9.8 last year. One of the most insightful series of findings in the study and well worth a read is the section on measuring Application Resilience. The study found that the resiliency of an application varies significantly based on what else it is paired with. It’s interesting to see that same-vendor pairings don’t necessarily do better or show higher average compliance rates than pairings from different vendors. The bottom line is that there’s no guarantee that any agent, whether sourced from a single vendor or even the most innovative vendors, will work seamlessly together and make an organization more secure. The following graphic explains this point:

•  60% of breaches can be linked to a vulnerability where a patch was available, but not applied. When there’s a compelling business case to keep all machines current, patches get distributed and installed. When there isn’t, operating system patches are, on average, 95 days late. Counting up the total number of vulnerabilities addressed on Patch Tuesday in February through May 2020 alone, it shows that the average Windows 10 enterprise device has hundreds of potential vulnerabilities without a fix applied – including four zero-day vulnerabilities. Absolute’s data shows that Post-Covid-19, the average patch age has gone down slightly, driven by the business case of supporting an entirely remote workforce.

• Organizations that had defined business cases for their cybersecurity programs are able to adapt better and secure vulnerable endpoint devices, along with the sensitive data piling up on those devices, being used at home by employees. Absolute’s study showed that the amount of sensitive data – like Personal Identifiable Information (PII), Protected Health Information (PHI) and Personal Financial Information (PFI) data – identified on endpoints soared as the Covid-19 outbreak spread and devices went home to work remotely. Without autonomous endpoints that have an unbreakable digital tether to ensure the health and security of the device, the greater the chance of this kind of data being exposed, the greater the potential for damages, compliance violations and more.

Conclusion

Absolute’s latest study on the state of endpoints amplifies what many CISOs and their teams are doing today. They’re prioritizing cybersecurity endpoint projects on ROI, looking to quantify agent effectiveness and moving beyond the myth that greater compliance is going to get them better security. The bottom line is that increasing cybersecurity spending is not going to make any business more secure, knowing the effectiveness of cybersecurity spending will, however. Being able to capable of tracking how resilient and persistent every autonomous endpoint is in an organization makes defining the ROI of endpoint investments possible, which is what every CISO I’ve spoken with is focusing on this year.

Why Cybersecurity Is Really A Business Problem is copyrighted by Louis Columbus. If you are reading this outside your feed reader or email, you are likely witnessing illegal content theft.

Enterprise Irregulars is sponsored by Salesforce and Zoho.

Bottom Line: Knowledge-sharing networks have been improving supply chain collaboration for decades; it’s time to enhance them with AI and extend them to resellers to revolutionize channel selling with more insights.

The greater the accuracy and speed of supply chain-based data integration and knowledge, the greater the accuracy of custom product orders. Add to that the complexity of selling CPQ and product configurations through channels, and the value of using AI to improve knowledge sharing networks becomes a compelling business case.

Why Channels Need AI-Based Knowledge Sharing Networks Now

Automotive, consumer electronics, high tech, and industrial products manufacturers are combining IoT sensors, microcontrollers, and modular designs to sell channel-configurable smart vehicles and products. AI-based knowledge-sharing networks are crucial to the success of their next-generation products. Likewise, to sell to any of these manufacturers, suppliers need to be pursuing the same strategy. AI-based services, including Amazon Alexa, Microsoft Cortana, and Google Voice and others, rely on knowledge-sharing networks to collaborate with automotive supply chains and strengthen OEM partnerships. The following graphic reflects how successful Amazon’s Alexa Automotive OEM sales team is at using knowledge-sharing networks to gain design wins across their industry.

The following are a few of the many reasons why creating and continually fine-tuning an AI-based knowledge-sharing network is an evolving strategy worth paying attention to:

• Supply chains are the primary source of knowledge that must permeate an organization’s structure and channels for the company to stay synchronized to broader market demands. For CPQ channel selling strategies to thrive, they need real-time pricing, availability, available-to-promise, and capable-to-promise data to create accurate, competitive quotes that win deals. The better the supplier collaboration across supply chains and with channel partners, the higher the probability of selling more. A landmark study of the Toyota Production System by Professors Jeffrey H Dyer & Kentaro Nobeoka found that Toyota suppliers value shared data more than cash, making knowledge sharing systems invaluable to them (Dyer, Nobeoka, 2000).
• Smart manufacturing metrics also need to be contributing real-time data to knowledge sharing systems channel partners use, relying on AI to create quotes for products that can be built the fastest and are the most attractive to each customer. Combining manufacturing’s real-time monitoring data stream of ongoing order progress and production availability with supply chain pricing, availability, and quality data all integrated to a cloud-based CPQ platform gives channel partners what they need to close deals now. AI-based knowledge-sharing networks will link supply chains, manufacturing plants, and channel partners to create smart factories that drive more sales. According to a recent Capgemini study, manufacturers are planning to launch 40% more smart factories in the next five years, increasing their annual investments by 1.7 times compared to the previous three years, according to their recent Smart factories @ scale Capgemini survey. The following graphic illustrates the percentage growth of smart factories across key geographic regions, a key prerequisite for enabling AI-based knowledge-sharing networks with real-time production data:

• By closing the data gaps between suppliers, manufacturing, and channels, AI-based knowledge-sharing networks give resellers the information they need to sell with greater insight. Amazon’s Alexa OEM marketing teams succeeded in getting the majority of design-in wins with automotive manufacturers designing their next-generation of vehicles with advanced electronics and AI features. The following graphic from Dr. Dyer’s and Nobeoka’s study defines the foundations of a knowledge-sharing network. Applying AI to a mature knowledge-sharing network creates a strong network effect where every new member of the network adds greater value.

• Setting the foundation for an effective knowledge sharing network needs to start with platforms that have AI and machine learning designed in with structure that can flex for unique channel needs. There are several platforms capable of supporting AI-based knowledge-sharing networks available, each with its strengths and approach to adapting to supply chain, manufacturing, and channel needs. One of the more interesting frameworks not only uses AI and machine learning across its technology pillars but also takes into consideration that a company’s operating model needs to adjust to leverage a connected economy to adapt to changing customer needs. BMC’s Autonomous Digital Enterprise (ADE) is differentiated from many others in how it is designed to capitalize on AI and Machine Learning’s core strengths to create innovation ecosystems in a knowledge-sharing network. Knowledge-sharing networks thrive on continuous learning. It’s good to see major providers using adaptive and machine learning to strengthen their platforms, with BMC’s Automated Mainframe Intelligence (AMI) emerging as a leader. Their approach to using adaptive learning to maintain data quality during system state changes and link exceptions with machine learning to deliver root cause analysis is prescient of where continuous learning needs to go.  The following graphic explains the ADE’s structure.

Conclusion

Knowledge-sharing networks have proven very effective in improving supply chain collaboration, supplier quality, and removing barriers to better inventory management. The next step that’s needed is to extend knowledge-sharing networks to resellers and enable knowledge sharing applications that use AI to tailor product and service recommendations for every customer being quoted and sold to. Imagine resellers being able to create quotes based on the most buildable products that could be delivered in days to buying customers. That’s possible using a knowledge-sharing network. Amazon’s success with Alexa design wins shows how their use of knowledge-sharing systems helped to provide insights needed across automotive OEMs wanted to add voice-activated AI technology to their next-generation vehicles.

References

BMC, Maximizing the Value of Hybrid IT with Holistic Monitoring and AIOps (10 pp., PDF).

BMC Blogs, 2019 Gartner Market Guide for AIOps Platforms, December 2, 2019

Cai, S., Goh, M., De Souza, R., & Li, G. (2013). Knowledge sharing in collaborative supply chains: twin effects of trust and power. International journal of production Research, 51(7), 2060-2076.

Capgemini Research Institute, Smart factories @ scale: Seizing the trillion-dollar prize through efficiency by design and closed-loop operations, 2019.

Columbus, L, The 10 Most Valuable Metrics in Smart Manufacturing, Forbes, November 20, 2020

Jeffrey H Dyer, & Kentaro Nobeoka. (2000). Creating and managing a high-performance knowledge-sharing network: The Toyota case. Strategic Management Journal: Special Issue: Strategic Networks, 21(3), 345-367.

Myers, M. B., & Cheung, M. S. (2008). Sharing global supply chain knowledge. MIT Sloan Management Review, 49(4), 67.

Wang, C., & Hu, Q. (2020). Knowledge sharing in supply chain networks: Effects of collaborative innovation activities and capability on innovation performance. Technovation, 94, 102010.

How To Improve Channel Sales With AI-Based Knowledge Sharing Networks is copyrighted by Louis Columbus. If you are reading this outside your feed reader or email, you are likely witnessing illegal content theft.

Enterprise Irregulars is sponsored by Salesforce and Zoho.

• 86% of all breaches are financially motivated, where threat actors are after company financial data, intellectual property, health records, and customer identities that can be sold fast on the Dark Web.
• 70% of breaches are perpetrated by external actors, making endpoint security a high priority in any cybersecurity strategy.
•  55% of breaches originate from organized crime groups.
• Attacks on Web apps accessed from endpoints were part of 43% of breaches, more than double the results from last year.

These and many other insights are from Verizon’s 2020 Data Breach Investigations Report (DBIR), downloadable here (PDF, 119 pp. free, opt-in). One of the most-read and referenced data breach reports in cybersecurity, Verizon’s DBIR, is considered the definitive source of annual cybercrime statistics. Verizon expanded the scope of the report to include 16 industries this year, also providing break-outs for Asia-Pacific (APAC); Europe, Middle East and Africa (EMEA); Latin America and the Caribbean (LAC); and North America, Canada, and Bermuda, which Verizon says is experiencing more breaches (NA).

The study’s methodology is based on an analysis of a record total of 157,525 incidents. Of those, 32,002 met Verizon’s quality standards, and 3,950 were confirmed data breaches. The report is based on an analysis of those findings. Please see Appendix A for the methodology.

Key insights include the following:

• Verizon’s DBIR reflects the stark reality that organized crime-funded cybercriminals are relentless in searching out unprotected endpoints and exploiting them for financial gain, which is why autonomous endpoints are a must-have today. After reading the 2020 Verizon DBIR, it’s clear that if organizations had more autonomous endpoints, many of the most costly breaches could be averted. Autonomous endpoints that can enforce compliance, control, automatically regenerating, and patching cybersecurity software while providing control and visibility is the cornerstone of cybersecurity’s future. For endpoint security to scale across every threat surface, the new hybrid remote workplace is creating an undeletable tether to every device as a must-have for achieving enterprise scale.
• The lack of diligence around Asset Management is creating new threat surfaces as organizations often don’t know the current health, configurations, or locations of their systems and devices. Asset Management is a black hole in many organizations leading to partial at best efforts to protect every threat surface they have. What’s needed is more insightful data on the health of every device. There are several dashboards available, and one of the most insightful is from Absolute, called the Remote Work and Distance Learning Insights Center. An example of the dashboard shown below:

• 85% of victims and subjects were in the same country, 56% were in the same state, and 35% were even in the same city based on FBI Internet Crime Complaint Center (IC3) data. Cybercriminals are very opportunistic when it comes to attacking high-profile targets in their regions of the world. Concerted efforts of cybercriminals funded by organized crime look for the weakest threat surfaces to launch an attack on, and unprotected endpoints are their favorite target. What’s needed is more of a true endpoint resilience approach that is based on a real-time, unbreakable digital tether that ensures the security of every device and the apps and data it contains.
• Cloud assets were involved in about 24% of breaches this year, while on-premises assets are still 70%. Ask any CISO what the most valuable lesson they learned from the pandemic has been so far, and chances are they’ll say they didn’t move to the cloud quickly enough. Cloud platforms enable CIOs and CISOs to provide a greater scale of applications for their workforces who are entirely remote and a higher security level. Digging deeper into this, cloud-based Security Information and Event Management (SIEM) provides invaluable real-time analysis, alerts, and deterrence of potential breaches. Today it’s the exceptional rather than the rule that CISOs prefer on-premise over cloud-based SIEM and endpoint security applications. Cloud-based endpoint platforms and the apps they support are the future of cybersecurity as all organizations now are either considering or adopting cloud-based cybersecurity strategies.
• Over 80% of breaches within hacking involve brute force or the use of lost or stolen credentials. One of the most valuable insights from the Verizon DBIR is how high of a priority cybercriminals are placing on stealing personal and privileged access credentials. Shutting down potential breach attempts from stolen passwords involves keeping every endpoint completely up to date on software updates, monitoring aberrant activity, and knowing if anyone is attempting to change the configuration of a system as an administrator. By having an unbreakable digital tether to every device, greater control and real-time response to breach attempts are possible.

Conclusion

Autonomous endpoints that can self-heal and regenerate operating systems and configurations are the future of cybersecurity, a point that can be inferred from Verizon’s DBIR this year. While CIOs are more budget-focused than ever, CISOs are focused on how to anticipate and protect their enterprises from new, emerging threats. Closing the asset management gaps while securing every endpoint is a must-have to secure any business today. There are several cybersecurity companies offering endpoint security today. Based on customer interviews I’ve done, one of the clear leaders in endpoint resilience is Absolute Software, whose persistent-firmware technology allows them to self-heal their own agent, as well as any endpoint security control and productivity tool on any protected device such as their Resilience suite of applications.

Why Securing Endpoints Is The Future Of Cybersecurity is copyrighted by Louis Columbus. If you are reading this outside your feed reader or email, you are likely witnessing illegal content theft.

Enterprise Irregulars is sponsored by Salesforce and Zoho.

Bottom Line: Barclays’ and Kount’s co-developed new product, Barclays Transact reflects the future of how companies will innovate together to apply AI-based fraud prevention to the many payment challenges merchants face today.

Merchant payment providers have seen the severity, scope, and speed of fraud attacks increase exponentially this year. Account takeovers, card-not-present fraud, SMS spoofing, and phishing are just a few of the many techniques cybercriminals are using to defraud merchants out of millions of dollars. One in three merchants, 32%, prioritize payment providers’ fraud and security strengths over customer support and trust according to a recent YouGov survey.  But it doesn’t have to be a choice between security and a frictionless transaction.

Frustrated by the limitations of existing fraud prevention systems, many payment providers are working as fast as they can to pilot AI- and machine-learning-based applications and platforms. Barclays Payment Solutions’ decision to work with AI-based solution Kount is what the future of AI-based fraud prevention for payment providers looks like.

How AI Helps Thwart Fraud And Increase Sales at Barclays   

Barclays Payment Services handles 40% of all merchant payments in the UK. They’ve been protecting merchants and their customers’ data for over 50 years, and their fraud and security teams have won industry awards. For Barclays, excelling at merchant and payment security is the only option.

In order to offer an AI-based suite of tools to help merchants make their online transactions both simpler and safer, Barclays chose to partner with Kount. Their model of innovating together enables Barclays to strengthen their merchant payment business with AI-based fraud prevention and gain access to Kount’s Identity Trust Global Network, the largest network of trust and fraud-related signals. Kount gains knowledge into how they can fine-tune their AI and machine learning technologies to excel at payment services. Best of all, Barclays’ merchant customers will be able to sell more by streamlining the payment experience for their customers. The following is an overview of the Barclays Transact suite for merchants.

Barclays and Kount defined objectives for Barclay Transact: protect against increasingly sophisticated eCommerce fraud attempts, improve their merchants’ customer experiences during purchases, prepare for UK-mandated Strong Customer Authentication (SCA) by allowing businesses to take advantage of Transaction Risk Analysis (TRA) exemptions, optimize payment acceptance workflows and capitalize on Kount’s Identity Trust Global Network.

Adding urgency to the co-creation of Barclays Transact are UK regulatory requirements. To help provide clarity and support to merchants and the market from the impact of Covid-19 the Financial Conduct Authority (FCA) have agreed to delay the enforcement of a Strong Customer Authentication (SCA) until 14 September 2021 in the UK. The European Economic Area (EEA) deadline remains 31 December, 2020. Kount’s AI- and machine learning algorithms designed into Barclay Transact, tested at beta sites and fine-tuned for the first release, are effective in meeting UK government mandates.

How AI Is Turning Trust Into A Sales Accelerator At Barclays

The Barclays Payment Solutions and Kount teams believe that the more ambitious the goals for Barclays Transact to deliver value to merchants, the stronger the suite will be. Here are examples of goals businesses can achieve with this partnership:

1. Achieve as few false positives as possible by making real-time updates to machine learning algorithms and fine-tuning merchant responses.
2. Reduce the number of manual reviews for fraud analysts consistently by applying AI and machine learning to provide early warning of anomalies.
3. Minimize the number of chargebacks to merchant partners.
4. Reduce the friction and challenges merchants experience with legacy fraud prevention systems by streamlining the purchasing experience.
5. Enable compliance to UK-mandated regulatory requirements while streamlining merchants and their customers’ buying experiences.

Barclays Transact analyzes every transaction in real-time using Kount’s AI-based fraud analysis technology, scoring each on a spectrum of low to high risk. Each Barclays merchant’s gateway then uses this score to identify the transactions which qualify for TRA exemptions. This results in a more frictionless payment and checkout experience for customers, resulting in lower levels of shopping cart abandonment and increased sales. Higher-risk transactions requiring further inspection will still go through two-factor authentication, or be immediately declined, per the regulation and customer risk appetite. The following is an example of the workflow Barclays and Kount were able to accomplish by innovating together:

Conclusion

Improving buying experiences and keeping them more secure on a trusted platform is an ambitious design goal for any suite of online tools. Barclays and Kount’s successful development and launch of a co-developed product is prescient and points the way forward for payment providers who need AI expertise to battle fraud now. A bonus is how the partnership is going to enrich the Kount Identity Trust Global Network, the largest network of trust and risk signals, which is comprised of 32 billion annual interactions from more than 6,500 customers across 75+ industries. “We are excited to be partnering with Kount, because they share our goal of collaborative innovation, and a drive to deliver best-in-class shopper experiences. Thanks to Kount’s award-winning fraud detection software, the new module will not only help customers to fight fraud and prevent unwanted chargebacks, but it will also help them to maximize sales, improve customer experience, and better prepare for the introduction of SCA,” David Jeffrey, Director of Product, Barclaycard Payments said.

How Barclays Is Preventing Fraud With AI is copyrighted by Louis Columbus. If you are reading this outside your feed reader or email, you are likely witnessing illegal content theft.

Enterprise Irregulars is sponsored by Salesforce and Zoho.

Bottom Line:  Excelling at compliance doesn’t protect any business from being hacked, yet pursuing a continuous risk management strategy helps.

With a few exceptions (such as spearphishing), cyberattacks are, by nature, brutally opportunistic and random. They are driven to disrupt operations at best and steal funds, records, and privileged access credentials at worst. Conversely, the most important compliance event of all, audits, are planned for, often months in advance. Governance, Risk, and Compliance (GRC) teams go to Herculean efforts to meet and exceed audit prep timelines working evenings and weekends.

Wanting to learn more about the relationship between GRC and cybersecurity strategy, I searched for webinars on the topic. I found Improve Your Compliance Posture with Identity-Centric PAM, a recent webinar-on-demand offered by Centrify. The webinar brought up several interesting insights, including shared pains companies experience with compliance and cybersecurity, yet require drastically different approaches to solving them.

Rationalizing Compliance Spending with Cybersecurity

The truth is organizations are attempting to rationalize the high costs of compliance by looking for how GRC spend can also improve cybersecurity. This is a dangerous assumption, as Marriott’s third breach indicates. Marriott is an excellently managed business and sets standards in compliance. Unfortunately, that hasn’t thwarted three breaches they’ve experienced.

Why are organizations assuming GRC spending will improve cybersecurity? It’s because both areas share a common series of pains that require different solutions, according to the webinar. These pains include:

• Updates to regulations are exponentially increasing today, averaging 200 or more per day from approximately 900 oversight agencies worldwide, leading to a quickly changing, heterogeneous landscape. Dr. Torsten George, Cybersecurity Evangelist at Centrify, said that when he worked in the GRC space, the midsize clients he worked with had to deal with 17 different regulations. Larger organizations that operate on a global basis are dealing with, on average, 70 or more regulations they need to stay in compliance with. Dr. George provided an overview of the compliance landscape, differentiating between the levels compliance requirements every organization needs to abide by, which is shown below:

• Compliance is, by nature, reactive to a known event (audit), while cybersecurity is also entirely reactive to random events (cyberattacks). GRC teams need to ramp up their staff and equip them with the apps and tools they need at least six months before an audit. For cybersecurity, the threat is random and will most likely be more severe in terms of financial loss. Preparing for each takes entirely different strategies.
• The lack of continuous risk monitoring by GRC teams and identity management by IT cybersecurity leads to systemic failures in achieving compliance and securing an organization. The webinar makes an excellent point that for compliance to succeed, it needs to be based on continuous risk management, not just checking off the boxes or categories of a given GRC approach. The same holds for cybersecurity. Identity-Centric Privileged Access Management (PAM) provides GRC and IT professionals mutual benefits when it comes to achieving the mission of being and staying compliant, and shows how securing enterprises drive better compliance, not vice versa.
• Manually updating compliance mapping tables showing the interrelationships of requirements by industry is not scaling – and leaving gaps in GRC coverage. The more regulated a business is, for example manufacturing medical products, the more important it is to automate every aspect of compliance. A great place to start is automating the process of creating mapping tables. Taking a manual approach to creating mapping tables comparing standards often leads to errors and gaps. And in highly regulated industries like medical products manufacturing, the accuracy, speed, and scale of staying compliant can be turned into a competitive advantage, leading to more sales.

How To Resolve The Conflict Between GRC and Cybersecurity Spending

According to the webinar, 80% of today’s data breaches are caused by default, weak, stolen, or otherwise compromised credentials. GRC and cybersecurity strategies’ best efforts need to be put on securing privileged access first. The webinar makes a strong argument for prioritizing privileged access security as the initiative that can unify GRC and cybersecurity strategies.

Key insights from the webinar include the following:

• Industry standards and government regulations are calling for identity and access management as a requirement, with several specifically naming privilege access controls.
• Identity-Centric Privileged Access Management (PAM) approaches help meet compliance mandates, while at the same time hardening cybersecurity to the threat surface level.
• Attaining greater compliance by taking an Identity-Centric PAM approach ensures machines have secured identities as well, and the use of anonymous access accounts is limited to break-glass scenarios only, while organizations should otherwise be leveraging enterprise directory identities for the authentication and authorization process.
• Improving accountability and segmentation by establishing granular security controls and auditing everything helps bridge the gap between GRC and cybersecurity initiatives.

Conclusion

Continuous risk management is key to excelling at compliance, just as securing privileged access credentials is foundational to an effective cybersecurity strategy. Dr. Torsten George ended the webinar saying, “In the long term, I believe that the current situation that we’re dealing with and its associated spike of cyber-attacks will lead to even stricter compliance mandates; especially when it comes to secure remote access by key IT stakeholders and outsourced IT.” The bottom line is that compliance and cybersecurity must share the common goal of protecting their organizations’ privileged access credentials using adaptive approaches and technologies if both are going to succeed.

Debunking The Myth That Greater Compliance Makes IT More Secure is copyrighted by Louis Columbus. If you are reading this outside your feed reader or email, you are likely witnessing illegal content theft.

Enterprise Irregulars is sponsored by Salesforce and Zoho.

• One in 10 enterprises now use 10 or more AI applications; chatbots, process optimization, and fraud analysis lead a recent survey’s top use cases according to MMC Ventures.
• 83% of IT leaders say AI & ML is transforming customer engagement, and 69% say it is transforming their business according to Salesforce Research.
• IDC predicts spending on AI systems will reach $97.9B in 2023.

AI pilots are progressing into production based on their combined contributions to improving customer experience, stabilizing and increasing revenues, and reducing costs. The most successful AI use cases contribute to all three areas and deliver measurable results. Of the many use cases where AI is delivering proven value in enterprises today, the ten areas discussed below are notable for the measurable results they are providing.

What each of these ten use cases has in common is the accuracy and efficiency they can analyze and recommend actions based on real-time monitoring of customer interactions, production, and service processes. Enterprises who get AI right the first time build the underlying data structures and frameworks to support the advanced analytics, machine learning, and AI techniques that show the best potential to deliver value. There are various frameworks available, with BMC’s Autonomous Digital Enterprise (ADE) encapsulating what enterprises need to scale out their AI pilots into production. What’s unique about BMC’s approach is its focus on delivering transcendent customer experiences by creating an ecosystem that uses technology to cater to every touchpoint on a customer’s journey, across any channel a customer chooses to interact with an enterprise on.

10 Areas Where AI Is Delivering Proven Value Today

Having progressed from pilot to production across many of the world’s leading enterprises, they’re great examples of where AI is delivering value today. The following are 10 areas where AI is delivering proven value in enterprises today

• Customer feedback systems lead all implementations of AI-based self-service platforms. That’s consistent with the discussions I’ve had with manufacturing CEOs who are committed to Voice of the Customer (VoC) programs that also fuel their new product development plans. The best-run manufacturers are using AI to gain customer feedback better also to improve their configure-to-order product customization strategies as well. Mining contact center data while improving customer response times are working on AI platforms today. Source: Forrester study, AI-Infused Contact Centers Optimize Customer Experience Develop A Road Map Now For A Cognitive Contact Center.

• McKinsey finds that AI is improving demand forecasting by reducing forecasting errors by 50% and reduce lost sales by 65% with better product availability. Supply chains are the lifeblood of any manufacturing business. McKinsey’s initial use case analysis is finding that AI can reduce costs related to transport and warehousing and supply chain administration by 5% to 10% and 25% to 40%, respectively. With AI, overall inventory reductions of 20% to 50% are possible. Source: Smartening up with Artificial Intelligence (AI) – What’s in it for Germany and its Industrial Sector? McKinsey & Company.

• The majority of CEOs and Chief Human Resource Officers (CHROs) globally plan to use more AI within three years, with the U.S. leading all other nations at 73%. Over 63% of all CEOs and CHROs interviewed say that new technologies have a positive impact overall on their operations. CEOs and CHROs introducing AI into their enterprises are doing an effective job at change management, as the majority of employees, 54%, are less concerned about AI now that they see its benefits. C-level executives who are upskilling their employees by enabling them to have stronger digital dexterity skills stand a better chance of winning the war for talent. Source: Harris Interactive, in collaboration with Eightfold Talent Intelligence And Management Report 2019-2020 Report.

• AI is the foundation of the next generation of logistics technologies, with the most significant gains being made with advanced resource scheduling systems. AI-based techniques are the foundation of a broad spectrum of next-generation logistics and supply chain technologies now under development. The most significant gains are being made where AI can contribute to solving complex constraints, cost, and delivery problems manufacturers are facing today. For example, AI is providing insights into where automation can deliver the most significant scale advantages. Source: McKinsey & Company, Automation in logistics: Big opportunity, bigger uncertainty, April 2019. By Ashutosh Dekhne, Greg Hastings, John Murnane, and Florian Neuhaus.

• AI sees the most significant adoption by marketers working in $500M to $1B companies, with conversational AI for customer service as the most dominant. Businesses with between $500M to $1B lead all other revenue categories in the number and depth of AI adoption use cases. Just over 52% of small businesses with sales of $25M or less are using AI for predictive analytics for customer insights. It’s interesting to note that small companies are the leaders in AI spending, at 38.1%, to improve marketing ROI by optimizing marketing content and timing. Source: The CMO Survey: Highlights and Insights Report, February 2019. Duke University, Deloitte, and American Marketing Association. (71 pp., PDF, free, no opt-in).

• A semiconductor manufacturer is combining smart, connected machines with AI to improve yield rates by 30% or more, while also optimizing fab operations and streamlining the entire production process. They’ve also been able to reduce supply chain forecasting errors by 50% and lost sales by 65% by having more accurate product availability, both attributable to insights gained from AI. They’re also automating quality testing using machine learning, increasing defect detection rates up to 90%. These are the kind of measurable results manufacturers look for when deciding if a new technology is going to deliver results or not. These and many other findings from the semiconductor’s interviews with McKinsey are in the study, Smartening up with Artificial Intelligence (AI) – What’s in it for Germany and its Industrial Sector? . The following graphic from the study illustrates the many ways AI and machine learning are improving semiconductor manufacturing.

• AI is making it possible to create propensity models by persona, and they are invaluable for predicting which customers will act on a bundling or pricing offer. By definition, propensity models rely on predictive analytics including machine learning to predict the probability a given customer will act on a bundling or pricing offer, e-mail campaign or other call-to-action leading to a purchase, upsell or cross-sell. Propensity models have proven to be very effective at increasing customer retention and reducing churn. Every business excelling at omnichannel today rely on propensity models to better predict how customers’ preferences and past behavior will lead to future purchases. The following is a dashboard that shows how propensity models work. Source: customer propensities dashboard is from TIBCO.

• AI is reducing logistics costs by finding patterns in track-and-trace data captured using IoT-enabled sensors, contributing to $6M in annual savings. BCG recently looked at how a decentralized supply chain using track-and-trace applications could improve performance and reduce costs. They found that in a 30-node configuration, when blockchain is used to share data in real-time across a supplier network, combined with better analytics insight, cost savings of $6M a year is achievable. Source: Boston Consulting Group, Pairing Blockchain with IoT to Cut Supply Chain Costs, December 18, 2018, by Zia Yusuf, Akash Bhatia, Usama Gill, Maciej Kranz, Michelle Fleury, and Anoop Nannra.

• Detecting and acting on inconsistent supplier quality levels and deliveries using AI-based applications is reducing the cost of bad quality across electronic, high-tech, and discrete manufacturing. Based on conversations with North American-based mid-tier manufacturers, the second most significant growth barrier they’re facing today is suppliers’ lack of consistent quality and delivery performance. Using AI, manufacturers can discover quickly who their best and worst suppliers are, and which production centers are most accurate in catching errors. Manufacturers are using dashboards much like the one below for applying machine learning to supplier quality, delivery, and consistency challenges. Source: Microsoft, Supplier Quality Analysis sample for Power BI: Take a tour.

• Optimizing Shop Floor Operations with Real-Time Monitoring and AI is in production at Hitachi today. Combining real-time monitoring and AI to optimize shop floor operations, providing insights into machine-level loads and production schedule performance, is now in production at Hitachi. Knowing in real-time how each machine’s load level impacts overall production schedule performance leads to better decisions managing each production run. Optimizing the best possible set of machines for a given production run is now possible using AI.  Source: Factories of the Future: How Symbiotic Production Systems, Real-Time Production Monitoring, Edge Analytics, and AI Are Making Factories Intelligent and Agile, Youichi Nonaka, Senior Chief Researcher, Hitachi R&D Group and Sudhanshu Gaur Director, Global Center for Social Innovation Hitachi America R&D.

Additional reading:

15 examples of artificial intelligence in marketing, eConsultancy, February 28, 2019

4 Positive Effects of AI Use in Email Marketing, Statista, March 1, 2019

4 Ways Artificial Intelligence Can Improve Your Marketing (Plus 10 Provider Suggestions), Forbes, Kate Harrison, January 20, 2019

Artificial Intelligence: The Next Frontier? McKinsey Global Institute (PDF, 80 pp., no opt-in)

Artificial Intelligence: The Ultimate Technological Disruption Ascends, Woodside Capital Partners. (PDF,

DHL Trend Research, Logistics Trend Radar, Version 2018/2019 (PDF, 55 pp., no opt-in)

2018 (43 pp., PDF, free, no opt-in).

Digital/McKinsey, Smartening up with Artificial Intelligence (AI) – What’s in it for Germany and its Industrial Sector? (PDF, 52 pp., no opt-in)

How To Win Tomorrow’s Car Buyers – Artificial Intelligence in Marketing & Sales, McKinsey Center for Future Mobility, McKinsey & Company. February 2019. (44 pp., PDF, free, no opt-in)

How Top Marketers Use Artificial Intelligence On-Demand Webinar with Vala Afshar, Chief Digital Evangelist, Salesforce and Meghann York, Director, Product Marketing, Salesforce

In-depth: Artificial Intelligence 2019, Statista Digital Market Outlook, February 2019 (client access reqd).

bes Insights and Quantcast Study (17 pp., PDF, free, opt-in),

Marketing & Sales Big Data, Analytics, and the Future of Marketing & Sales, (PDF, 60 pp., no opt-in), McKinsey & Company.

McKinsey & Company, Automation in logistics: Big opportunity, bigger uncertainty, April 2019. By Ashutosh Dekhne, Greg Hastings, John Murnane, and Florian Neuhaus

McKinsey & Company, Notes from the AI frontier: Modeling the impact of AI on the world economy, September 2018 By Jacques Bughin, Jeongmin Seong, James Manyika, Michael Chui, and Raoul Joshi

Papadopoulos, T., Gunasekaran, A., Dubey, R., & Fosso Wamba, S. (2017). Big data and analytics in operations and supply chain management: managerial aspects and practical challenges. Production Planning & Control, 28(11/12), 873-876.

Powerful pricing: The next frontier in apparel and fashion advanced analytics, McKinsey & Company, December 2018

Winning tomorrow’s car buyers using artificial intelligence in marketing and sales, McKinsey & Company, February 2019

World Economic Forum, Impact of the Fourth Industrial Revolution on Supply Chains (PDF, 22 pgs., no opt-in)

World Economic Forum, Supply Chain 4.0 Global Practices, and Lessons Learned for Latin America and the Caribbean (PDF, 44 pp., no opt-in)

Worldwide Spending on Artificial Intelligence Systems Will Grow to Nearly $35.8 Billion in 2019, According to New IDC Spending Guide, IDC; March 11, 2019

10 Ways Enterprises Are Getting Results From AI Strategies is copyrighted by Louis Columbus. If you are reading this outside your feed reader or email, you are likely witnessing illegal content theft.

Enterprise Irregulars is sponsored by Salesforce and Zoho.

Bottom Line:  Endpoint security business cases do much more than just quantify costs and benefits; they uncover gaps in endpoint and cyber protection that need urgent attention to avert a breach.

Bad actors and hackers prefer to attack threat surfaces that are isolated, vulnerable with out-of-date security patches, yet integrated into a corporate network to provide access. For these reasons and more, endpoints are now the popular choice for hacking attempts. Ponemon Institute’s Third Annual Study on the State of Endpoint Security Risk published in January of this year found that 68% of organizations were victims of successful endpoint attacks in 2019 that compromised data assets and IT infrastructure. Since 2017, successful endpoint attacks have spiked by 26 percent. The Ponemon study also found that it takes the typical organization 97 days to test and deploy patches to each endpoint. When the average endpoint is three months behind on updates, it’s understandable why breaches are increasing. In 2019 the average endpoint breach inflicted $8.94M in losses. The following graphic compares the escalating number of breaches and economic losses for the last three years:

Exploring Endpoint Security’s Many Benefits

Think of building a business case for endpoint security as the checkup every company needs to examine and identify and every threat surface that can be improved. Just as all efforts to preserve every person’s health is priceless today, organizations can’t let their guard down when it comes to keeping endpoint security strong.

The economic fallout of COVID-19 is hitting IT budgets hard. That’s why now is the time to build a business case for endpoint security. CIOs and CISOs have to make budget cuts due to revenue shortfalls. One area no one wants to compromise on, however, is allowing endpoint agents to degrade over time. Absolute Software’s  Endpoint Security Trends Report found that the more complex and layered the endpoint protection, the greater the risk of a breach. Overloading every endpoint with multiple agents is counterproductive and leaves endpoints less secure than if fewer agents were installed.  Additionally, Absolute just launched a Remote Work and Distance Learning Insights Center, providing insights into the impact of COVID-19 on IT and security controls. An example of the dashboard shown below:

Business Case Benefits Need To Apply To  IT and Operations

Absolute and Ponemon’s studies suggest that autonomous endpoints are the future of endpoint security. Activating security at the endpoint and having an undeletable tether to every device solves many of the challenges every business’s IT and Operations teams face. And with the urgency to make IT and Operations as virtual as possible with budgets impacted by COVID-19’s economic fallout, team leaders in each area are focusing on the following shared challenges. COVID-19’s quarantine requirements make hybrid workforces instantly appear and make the budgets needed to support them vanish at the same time.  The following are the shared benefits for IT and Operations that need to anchor any endpoint security business case:

• The most urgent need is for greater IT Help Desk efficiency. While this is primarily an IT metric, the lack of real-time availability of resources is slowing down remote Operations teams from getting their work done.
• Both IT and Operations share asset utilization, loss reduction, and lifecycle optimization ownership in many organizations today. Having a persistent, undeletable tether to every device at the hardware level is proving to be an effective approach IT, and Operations teams are relying on to track and improve these metrics. The Absolute and Ponemon studies suggest that the more resilient the endpoint, the better the asset efficiency and lifecycle optimization. Autonomous endpoints can self-heal and regenerate themselves, further improving shared metric performance for IT and Operations.
• The more autonomous endpoints an organization has, the quicker Operations and IT can work together to pivot into new business models that require virtual operations. Education, Healthcare, Financial Services, Government, and Professional Services are all moving to hybrid remote workplaces and virtual operations as fast as they can. Using the business case for endpoint security as a roadmap to see where threat surfaces need to be improved for new growth is key.

Endpoint Security Benefits 

The following are the benefits that need to be included in creating a business case for endpoint security:

• Reduce and eventually eliminate IT Help Desk backlogs by keeping endpoints up-to-date. Reducing the call volume on IT Help Desks can potentially save over $45K a year, assuming a typical call takes 10 minutes and the cumulative time savings in 1,260 hours saved by the IT help desk annually.
• Reduce Security Operations staff interruptions and emergency security projects that require IT’s time to run analytics reports and analyses. Solving complex endpoint security problems burns thousands of dollars and hours over a year between Security, IT, and Operations. Having a persistent, unbreakable connection to every endpoint provides the device visibility teams need to troubleshoot problems. Assuming the 2,520 hours IT Security teams alone spend on emergency endpoint security problems could be reduced, organizations could save approximately $130K a year.
• Autonomous endpoints with an undeletable tether improve compliance, control, and visibility and is a must-have in the new hybrid remote workplace. For endpoint security to scale across every threat surface, having an undeletable tether to every device is a must-have for scalable remote work and hybrid remote work programs in the enterprise. They also contribute to lowering compliance costs and improve every aspect of asset management from keeping applications current to ensuring autonomous endpoints can continue to self-heal.
• Reducing IT asset loss, knowing asset utilization, and system-level software installed by every device can save a typical organization over $300K a year. Autonomous endpoints that can heal themselves and provide a constant hardware connection deliver the data in real-time to have accurate IT asset management and security data teams need to keep software configurations up to date. It’s invaluable for IT teams to have this level of data, as it averts having endpoint patches conflict with one another and leave an endpoint vulnerable to breach.
• Accurate asset lifecycle planning based on solid data from every device becomes possible. Having autonomous endpoints based on a hardware connection delivers the data needed to increase the accuracy of asset life cycle planning and resource allocation, giving IT and Operations the visibility they need to the device level. IT and Operations teams look to see how they can extend the lifecycle of every device in the field. Cost savings vary by the number of devices in the field and their specific software configurations. The time savings alone is approximately $140K per year in a mid-size financial services firm.
• The more autonomous and connected an endpoint is, the more automated audit and compliance reporting can become. A key part of staying in compliance is automating the audit process to save valuable time. The Health Insurance Portability and Accountability Act (HIPAA), General Data Protection Regulation (GDPR), and the Payment Card Industry Data Security Standard (PCI DSS) all require ongoing audits. The time and cost savings of automating audits by organizations vary significantly. It’s a reasonable assumption to budget at least a $67K savings per year in audit preparation costs alone.

Evaluating Endpoint Security Costs

The following are the endpoint security costs that need to be included in the business case:

• Annual, often multi-year endpoint security licensing costs. Endpoint security providers vary significantly in their pricing models, costs, and fees. Autonomous endpoint security platforms can range in licensing costs from $750K to over $1,2M, depending on the size of the organization and the number of devices.
• Change management, implementation, and integration costs increase with the complexity of IT security, Operations, and IT Service Management (ITSM) integration. Expect to see an average price of between $40K to over $100K to integrate endpoint security platforms with existing ITSM and security information and event management (SIEM) systems. 

Creating A Compelling Business Case For Endpoint Security

The best endpoint security business cases provide a 360-degree view of costs, benefits, and why taking action now is needed.

Knowing the initial software and services costs to acquire and integrate endpoint security across your organization, training and change management costs, and ongoing support costs are essential. Many include the following equation in their business cases to provide an ROI estimate. The Return on Investment (ROI) for endpoint security initiative is calculated as follows:

ROI on Endpoint Security (ES) = (ES Initiative Benefits – ES Initiative Costs)/ES Initiative Costs x 100.

A financial services company recently calculated their annual benefits of ES initiative will be $475,000, and the costs, $65,000, will yield a net return of $6.30 for every $1 invested.

Additional factors to keep in mind when building a business case for endpoint security:

• The penalties for non-compliance to industry-specific laws can be quite steep, with repeated offenses leading to $1M or more in fines and long-term loss of customer trust and revenue. Building a business case for endpoint security needs to factor in the potential non-compliance fees, and penalties companies face for not having autonomous endpoint security. The Health Insurance Portability and Accountability Act (HIPAA), General Data Protection Regulation (GDPR), Payment Card Industry Data Security Standard (PCI DSS), California Consumer Privacy Act (CCPA), and other laws require audit reporting based on accurate endpoint security data.
• Endpoint Security ROI estimates fluctuate, and it’s best to get started with a pilot to capture live data with budgets available at the end of a quarter. Typically organizations will allocate the remaining amounts of IT security budgets at the end of a quarter to endpoint security initiatives.
• Succinctly define the benefits and costs and gain C-level support to streamline the funding process. It’s often the CISOs who are the most driven to achieve greater endpoint security the quickest they can. Today with every business having their entire workforces virtual, there’s added urgency to get endpoint security accomplished.
• Define and measure endpoint security initiatives’ progress using a digitally-enabled dashboard that can be shared across any device, anytime. Enabling everyone supporting and involved in endpoint security initiatives needs to know what success looks like. Having a digitally-enabled dashboard that clearly shows each goal or objective and the company’s progress toward them is critical to success.

Conclusion

The hard economic reset COVID-19 created has put many IT budgets into freefall at a time when CIOs and CISOs need more funding to protect proliferating hybrid remote workforces. Endpoint security business cases need to factor in how they can create an undeletable resilient defense for every device across their global fleets. And just as every nation on the planet isn’t letting its guard down against the COVID-19 virus, every IT and cybersecurity team can’t let theirs down either when it comes to protecting every endpoint.

Autonomous endpoints that can self-heal and regenerate operating systems and configurations are the future of endpoint security management. The race to be an entirely virtual enterprise is on, and the most autonomous endpoints can be, the more cost-effective and valuable they are. The best business cases bridge the gap between IT and Operations needs. CIOs need endpoint security solutions to be low-cost, low maintenance, reliable yet agile. Operations want an endpoint solution that has a low cost of support, minimal if any impact of IT Service Help Desks, and always-on monitoring. Building a business case for endpoint security gives IT and Operations the insights they need to protect the constantly changing parameters of their businesses.

How To Build A Business Case For Endpoint Security is copyrighted by Louis Columbus. If you are reading this outside your feed reader or email, you are likely witnessing illegal content theft.

Enterprise Irregulars is sponsored by Salesforce and Zoho.

As a result, the following five trends are expected in the classroom and will require different tools, approaches, and cultural shifts:

• iCloud enhancements.  New capabilities include iCloud Drive folder sharing, sharing auto-accept, and global sharing permissions.  This enables seamless sharing in the classroom
• iWork updates.  Track pad support, new template, offline editing, and drop caps, make it easier to create content.
• New Assessment mode.  Educators can provide testing and assessment capabilites.  These new features meet secur testing requirements and are available on the iPad and Mac.  Assessment mode restrict sfeatures, locks into a single app, and doesn’t require mobile device management.
• Teacher resources and community.  Apple has built a strong community among educators with the Apple Education Learning Series, a set of ongoing programs for educators in K-12.  The Professional Learning Coaching sessions share best practices and provide coaches.  The Apple Teacher Learning Center shares ideas, curriculum, and techniques.  Apple also has a community of distinguished educators its developed over the years.
• iPad for AR in Learning.  Augmented reality (AR), enables teachers to bring visual experiences, overlay information, and provide contextual insights to the learning environment.  Sample lesson ideas include: History – Civilizations AR, Math – Measure, Literacy and Literature – AR Makr, Science – Froggipedia (see Figure 4), Science – WWF Free Rivers, and Math – GeoGebra Augmented Reality
• Privacy support for the learning environment. Apple’s security approach ensures that student work and personal information remain secure.  Using managed Apple IDs, administrators can control how information is shared, which apps are enabled or disabled, and what services such as FaceTime, iMessage, and Schoolwork are deployed.  Apple also has ISO 27001 and 27018 certifications for protecting PII in the cloud.   Further, Apple is a signatory for the Student Privacy Pledge

Figure 5. Froggipedia – Using AR to Study A Frog’s Anatomy

The Bottom Line: Improvements Augment Educators Needed For Improved Tools

News Analysis: Apple Brings New Post Pandemic Solutions To Remote Learning is copyrighted by R "Ray" Wang. If you are reading this outside your feed reader or email, you are likely witnessing illegal content theft.

Enterprise Irregulars is sponsored by Salesforce and Zoho.

I have often been told that we should not be emotional and instead we should be objective at work. That is rarely possible in real life in most scenarios – at least for me. So the closest to a good option in my mind is to manage these emotions as a “portfolio” so that I can survive and thrive without unnatural tactics. Before you ask me (since my colleague asked me today morning) – I will tell you that I do not practice breathing exercises or Yoga or chanting . Those are all probably good things to do – just that I have no first hand thoughts to offer.

So here we go .

Fear ,Anger and Courage are the ones that we need to confront the most given the consequences can be terrible. I feel both at times – and the way I control it is by thinking of the worst case. Am I going to lose a deal ? Lose a talented colleague from my team ? Can I fix this now or later? etc. Almost every single time I realize that the worst case is something I can mitigate. That is how I channelize these two emotions – I often convert them to courage to act.

Sadness and Joy – I do not hide Joy. When I am happy people know it. When I am sad – which is not often – people close to me can read it. On work, I feel sad most often when someone who should know better does a less than stellar job. I feel sad more often than I feel angry. And generally when the person realizes it – it helps them course correct.

Disgust , Surprise and Anticipation – Thankfully there are only two or three incidents in my entire career where I was truly disgusted. It just taught me to not work with certain kind of people. Surprise is actually a beautiful feeling in personal life – but unfortunately I am wired in a way that I do everything to avoid surprises at work. I try hard to not surprise anyone myself. I am not sure if this is good or bad – but the dislike for surprises is something I have to live with. I do a lot of anticipation – in the form of plan A/B/C . It is an intellectual pursuit that makes me feel good most of the time.

Trust and Respect – This is the ideal state of operation in my mind. Being liked at work or being feared at work are both long term problems for a leader. Obviously between the two – being liked is the pleasant and easier alternative . The world of business is not fair and often involves decisions that are hard on the people taking those and communicating it to others. If your objective is to be liked – you will be miserable when a hard decision needs to be taken, and others will feel a big let down. If you operate with fear as primary tactic – you will never have a motivated team. So the only real option is to aim for trust and respect as your operating parameters and help everyone get to a frame of mind that you will be fair in all cases.

Kindness and cruelty – This is pretty black and white . I heavily favor kindness. But there is a certain difficulty in how you execute on it. For example – let us say there is a colleague who cannot seem to operate at the next level to earn his promotion. The kind thing to do is to give him a chance to improve and then if he does not – tell him where he stands including the potential of leaving your team. The cruel thing is to tell him he is doing well and then fire him arbitrarily. Telling him that he is doing well when he is not – that falls under cruelty and not kindness in most cases. It is a thin line for a leader to traverse. I cannot say I have mastered it fully.

Shame, Pity and Envy – I do feel shame especially when I make mistakes repeatedly when I should learn and do better. I used to pity myself and feel envy for others – for a long time. That stopped after I got a better perspective from my mentors. There are always going to be some people who are better than you , were luckier than you etc and you are never going to be totally honest about evaluating yourself objectively. Once you make peace with that – Pity and Envy vanishes. It took me a long time to get there and I have had a few lapses – but generally I think I know when to catch myself these days and reorient my thinking.

Emotions at Work is copyrighted by Vijay Vijayasankar. If you are reading this outside your feed reader or email, you are likely witnessing illegal content theft.

Enterprise Irregulars is sponsored by Salesforce and Zoho.

Over the last 48 hours, I have watched technology CEOs, industry executives, and leading VC firms voice their outrage by the killing of George Floyd and decry racism in America. Many of their companies have made official statements and even provided financial support towards nonprofits supporting racial injustice.

I admire their efforts but frankly I think they can, and should, be doing even more to go beyond the platitudes and philanthropic donations to create more impactful change. As leaders of people and organizations, those same executives can stand up to racism by the examples they create in their own companies. I’m encourage by CEOs like Ken Frazier, Merck CEO, who spoke eloquently yesterday on CNBC about equality and companies opportunity to create change. He leads by example!

As someone who has worked with HR leaders for nearly 2 decades, I encourage all companies to make a stand through your actions. Here is a small list of 10 things you can do today!

1. Define your diversity ethos. What do you stand for? How do you think about inclusion and enable ALL employees to create economic opportunity? Companies should use their resources like the company’s website or social media platforms to make a statement.

Inclusion & Diversity

2. Assign an executive responsible for diversity, inclusion & belonging. This person should be closely aligned with the executive team. Salesforce.com led the way a few years ago but creating a new role, Chief Equality Officer, that reports directly to CEO Marc Benioff.

Salesforce Names First Chief Equality Officer Tony Prophet

3. Make all promotions & compensation structures equal. Mellody Hobson suggests we set targets and create incentives for change. In her words, “you get what you incent.” SHRM has some great content on Managing Pay Equity.

4. Create mentorship programs that connect underprivileged employees with executives. Slack has developed a program called “Rising Tides”, a six-month sponsorship program to develop diverse emerging leaders.

5. Set a standard and goals for recruiting diversity. If the NFL can do it with The Rooney Rule, you can too!

Rooney Rule

6. Make diversity training and unconscious bias education mandatory. Linkedin Learning has 2 dozen courses on diversity and inclusion including a fantastic course by Pat Wadors, Chief Talent Officer at ServiceNow.

diversity inclusion and belonging: Online Courses, Training and Tutorials on LinkedIn Learning

7. Encourage employee resource groups with executive sponsorship support. ERGs have the ability to empower employee voices and socialize topics of inclusion. Just today, Airbnb published an “Activism and Allyship Guide” published by the Black Employee Resource Group.

https://medium.com/media/f40582975d4c3eb2b5045d071471b558/href

8. Share your progress. You can’t change what you don’t measure. I admire companies like Slack, ServiceNow and Atlassian that transparently show their diversity metrics and progress over time.

Diversity at Slack – Several People Are Typing

9. Create a diversity scorecard and measure frequently. Give your leaders the tools to make change. Salesforce.com provides a monthly diversity scorecard for all leaders that manage teams over 500 employees.

How a Diversity Scorecard Helps Salesforce Keep Equality Top of Mind for Its Leaders

10. Build a diverse executive team and board of directors. Nothing is more annoying that watching a company decry racism…

…and then showcase a lack of diversity within their executive team and board of directors.

Box Leadership: Executive Team and Board of Directors

No company is perfect but, in this moment, business leaders must take a stand. We all have an opportunity to create long-lasting change now!

Diversity & The Future of Work — We Can No Longer Sit on the Sidelines! is copyrighted by Jason Corsello. If you are reading this outside your feed reader or email, you are likely witnessing illegal content theft.

Enterprise Irregulars is sponsored by Salesforce and Zoho.

I worry though, when the desire to ‘innovate’ exceeds the quality of the data that the organization has about their employees and workers. Let’s start with some basic ones.

• You would like to provide specific guidance to all line managers that manage contractors in their departments.
• You have decided that independent contractors that have worked at least 20 hours a month for more than six months before the plant shut down will receive a hardship payment.
• You would like your contractors to watch a new health and safety video before they return to work, and formally confirm that they have watched it.
• You wish to model out alternative transport options for employees and contractors to get them to work when your main plant re-opens next week.
• You would like to send several non-medical masks to all your workforce at home, so that when they return to the office it is easier for them follow safe guidelines.
• You would like to send a gift to your retired employees.

Before you start, check if you actually have an up to date home address that you can actually post something to for all your workers. The sad fact is that many organizations don’t.  No amount of fancy technology will help if your core master data is shoddy.  Do you even know who your independent contractors are?

Some of those same organizations that can’t track home addresses think that they can predict workforce churn through some AI magic, or worse, track and predict covid exposure in the workforce.

If the postal code is on-premise and wrong, it is wrong. If the postal code is in the cloud, and wrong, it is still wrong.

Before you post stuff to the wrong John Smith, insist on an accuracy audit of your core HR data, pull a 100  or so random records and have them checked (bearing in mind GDPR etc). But start closer to home, and look at your own record.  If your own key 30-40 data items aren’t spot on, it is very unlikely anyone else’s would be.  If you haven’t watched the health and safety video yourself, it would be tough to expect your workforce to be held to a higher standard.

It’s all about the data is copyrighted by Thomas Otter. If you are reading this outside your feed reader or email, you are likely witnessing illegal content theft.

Enterprise Irregulars is sponsored by Salesforce and Zoho.

This time it is Aneel Bhusri, CEO of Workday.

He talks about leadership during this crisis and likely changes in executive suites as healthcare becomes a major market opportunity and bigger HR challenge for every entity. He talks about conversations with fellow leaders on how best to re-open work places as the economy wakes up. He describes acrobatics in his customer base like running a million-person payroll and financial closes with nobody in the office. He also describes how cloud applications have scaled very well during the crisis and easily supported work-from-home efforts of customers.

Aneel is one of the nicest guys in the industry and while he credits his mentor and co-founder, Dave Duffield for that trait, his calmness comes across throughout the recording. Workday has done backflips for its employees and customers during the crisis – he describes some of each.

There is a definite feel-good, “be kind to each other”, “have fun” vibe during the conversation. It is a small detail in the conversation, but I particularly appreciated his generosity with the Zoom background of Giorgio’s Pizzeria, one of his favorite comfort-food places and his hope they survive the crisis.

I could almost hear ‘Peaceful, easy feeling” by the Eagles playing as I was talking to him. Enjoy.

New Normal: A conversation with Aneel Bhusri, CEO of Workday is copyrighted by Vinnie Mirchandani. If you are reading this outside your feed reader or email, you are likely witnessing illegal content theft.

Enterprise Irregulars is sponsored by Salesforce and Zoho.

We decided to look at our data to understand VC fundraising over the last month and compare last month’s data with the same period last year. We also wanted to analyze a full year of data to compare year-over-year trends. The early indications suggest the fundraising environment has NOT changed as a result of the pandemic. In fact, as you see the data below, if you compare fundraising in Future of Work companies in April 2019 vs. April 2020, it was actually up 40% year over year.

Please keep in mind a few considerations. First, the data is based on actual fundraising announcements so there may be a lagging affect from when the actual investments were made. Nonetheless, we believe a few things are happening…

1. In the “follow the herd” mentality of Silicon Valley, remote work has become a broad-based theme across all stages of investors.
2. Highly competitive deals will still get funded quickly with little-to-no impact on timing or valuations.
3. The large household names — those that have raised outsized funds over the last 2 years — are taking advantage of the uncertainty and being very opportunistic to land deals previously not in market.

That said, we also believe…

1. Deals are still getting done but a “reset” is just starting to happen that will have a lagging effect on venture fundraising later this year.
2. Valuations are increasingly being scrutinized and deals will inevitable take more time to close with increased dilution for entrepreneurs.
3. Investor will be going to the edges, either early seed and later stage. We foresee many companies at risk in the mid-stages as a result of the “frothy” fundraising environment of the last few years. Many companies are “at risk” as a result of high burn rates, high valuations, increased concerns on churn, and stalled net new bookings.

I had a chance to share notes ideas with some fantastic investors focused on the future of work including Roy Bahat (Bloomberg Beta), Kara Nortman (Upfront Ventures), Naomi Ionita (Menlo Ventures), and Lan Xuezhao (Basis Set Ventures). I encourage you to watch a replay of the discussion (coming shortly). Even though I broke Roy’s “no predictions” format, it was a great discussion with wide-ranging topics on remote work, the impact of government, and the future of “shareholder capitalism”.

Pandemic, Future of Work & the Current Fundraising Environment is copyrighted by Jason Corsello. If you are reading this outside your feed reader or email, you are likely witnessing illegal content theft.

Enterprise Irregulars is sponsored by Salesforce and Zoho.