Cute shield but cold comfort and no guarantee of security

We have always maintained that SAS 70 Type I and II certifications, though a great make-work program for U.S. accountants and required under some companies’ SOX programs, are next to useless if you want to know whether or not a hosted service provider has adequate security controls in place.

The list of problems with using SAS 70 documents as “security certifications” is long, too long for this post. Though of course, coming from a vendor, any complaints about the abuse of a certification certain competitors rely on can end up sounding like carping.

But Gartner has now stepped up to the plate and agreed with us. Here’s the money quote from Gartner Research Vice President French Caldwell:

“Chief information security officers (CISOs), compliance and risk managers, vendor managers, procurement professionals, and others involved in the purchase or sale of IT services and software need to recognize that SAS 70 is not a security, continuity or privacy compliance standard.”

The press release is here. You can buy the full report here.

There are several useful security standards, including ISO 27001, which is the gold standard and probably what you want to demand from your hosted service vendor.

But one piece of paper you won’t want to be relying on is a SAS 70 certificate.

Jonathan Kayes just died. For most of his career, Jonathan worked with the United States Central Intelligence Agency (CIA). More recently he held the post of Chief Learning Officer at The Masie Center.

My path first crossed Jonathan’s in a funny way.

I was having dinner at Indochine, a French Vietnamese restaurant in Hong Kong, with Elliott Masie of the Masie Center along with his wife Cathy and Graham Higgins, who was then the learning and development manager at Cathay Pacific Airways, when Elliott asked if we knew of any interesting learning or performance support innovations coming out of Asia. I mentioned Chinesepod, which was born during SARS, and was, I thought, a great example of necessity mothering invention.

Elliott liked Chinesepod so much he brought it to the attention of the CIA, where he was a member of the board of advisors. At that point Jonathan picked the idea up and ran with it. Chinesepod has since gone from strength to strength, as have a bunch of other online language learning services, including Livemocha and Smart.fm.

I had the privilege to meet Jonathan several times after that and even to introduce him to one or two officials in other (friendly) governments trying to figure out how to achieve some of the successes he had achieved in his CLO roles.

Jonathan was a serious, good man. We’ll miss him. I’ll miss him.

For the company I mean.

Elliott Masie just posted the interview we did on his Learning 2010 site.

He asked good, open-ended questions. You can judge how good the answers were yourself.

Listen to the podcast interview here.

The good people over at Mozilla set up a spin-off called Drumbeat, essentially a peer to peer, open source, learning and development environment.

Two Drumbeat projects caught my eye.

The first, Universal Subtitles, is both a technology development project and a global learning initiative. To date 772 people have contributed to this project. Subtitles clarify a lot, even song lyrics in one’s native language. Speech-to-text transcriptions and follow-on translations (this is the universal part) cost money and take time. Easy, user generated subtitles mean that videos in one language can be leveraged out to any number of languages easily.

It’s a very cool idea with lots of implications for making video-based learning that gets pushed out globally.

The second project that caught my eye is the P2PU School of Webcraft, which aims to make a “vibrant, peer-led system to help people around the world easily access and build careers on open web technology.” The project bills itself as “the ultimate curriculum for open web developers” with  ”a community endorsed certificate to show off your skills” and is an outgrowth of a course held via Peer2Peer University. The first intake starts in September. The proposed syllabus includes:

* Web 200: The Anatomy of a Page Load
* Web Development 101
* HTML5
* Building Social with the Open Web
* Reading Code
* Semantic Markup
* Organic SEO Basics
* What is PHP
* Drupal Basics
* Building Social Web Applications with Drupal
* Beginning Webservices with Python
* Designers Tackling The Web
* Principles of Project Management
* Introduction to System Administration
* Web Accessibility
* Designing for Education: : How to optimize the user experience.
* Extension Development
* Interactive games for the open web
* Scripting 101

This is serious stuff. It bears watching.

David Wilkins, a technology evangelist at Learn.com, recently published a blog post I thought worthwhile. A Defense of the LMS (and a case for the future of Social Learning) hits several nails on the head, including the ideas that (1) it is without a doubt easier to build social networking functionality into a mature enterprise system like an LMS than it is to build LMS functionality into a social networking application, and (2) LMS platforms are essential business applications in large part because compliance support is crucial, complicated and difficult.

He also makes the point that future learning cooks will want to throw everything but the kitchen sink into the mix — a shake of social, a pinch of old-school personnel records,  a tablespoon of talent management, a cup of sifted reporting and repeated lashings of user generated content.

This is all true but I would add a couple of thoughts:

1) No LMS vendor is going to “own” the social networking space. Applications like Linkedin are powerful precisely because they exist outside the bounds of any one particular company. They benefit from both the power of loose connections and the fact that the service is a single, neutral place, a public commons if you will. Similarly, nobody inside a company is going to want to be on one social network for company products, another for internal “people finder” purposes and a third for learning. Nobody wants to have to be on everything and have to keep up multiple profiles. Eventually, somehow, companies will find ways to incorporate workforce enterprise systems, including learning platforms, into a more unified social landscape. This suggests access and open standards rather than yet more silo-ed reinvention of the wheel; this suggests that a semantic, enterprise version of something like OpenID on steroids (or APIs — see point #2 below) will likely be the future and that much of the effort all of us vendors are putting into building out our social services will prove (pretty quickly I’d wager) an expense of spirit in a waste of shame.

2) The LMS is not dead yet, neither is it dying. David is right on these points. The LMS as an application category is stronger and more important than ever. However, it will disappear from sight. LMS functionality will become even more ubiquitous but the LMS as an end user destination will disappear entirely. As we vendors get more sophisticated in our use of portal tool-kits and rich, persistent API libraries that call features from the LMS into other environments, clients will slice and dice LMS functions and post them wherever they want: an end user will see an icon for, let’s say, a five-minute compliance course in a compliance portal or on the homepage of a company intranet. The user will click on the icon. The course will launch. The user will get it done and move on.

In the background the LMS will have performed a real-time user authentication of some kind, registered the user for the course, launched the course, recorded the user’s results and made the user’s history available for reporting, either in the LMS or on some other system. The LMS may have also done some interruptive or interrogative verification of the user and his identity in the process. But at no point will the user ever “go” to something called an LMS.

So, to paraphrase Bill Gates who once said that the future looks bright for banking but not so good for brick and mortar banks, the future looks ever better for LMS functionality but the LMS as a specific, old-school destination — that paradigm is likely to fade away.

The high cost of creating a management framework for content becomes quickly apparent. The effort, which can be messy and frustrating, requires not only a lot of an organization’s internal time and attention but also a fair amount of help from outside consultants. Just doing an initial inventory and creating a governance structure to move forward with proves painful, time consuming and expensive for many organizations.

The irony of course is that the cost of doing nothing — just letting everyone continue to write Word documents, PDFs and PowerPoints and make rapid e-learning courses on an ad hoc basis (again and again, based on the same or very similar content) — often proves far higher to the organization than the cost of change.

However, the cost of doing nothing, unless you audit it in sophisticated ways, is invisible. The wasted time, mistakes, duplication of effort and poor quality output don’t come out of anyone’s budget. The inefficiency is personal to employees and not counted anywhere as the organizational expense it is.

The larger and more sophisticated the organization, the greater the cost discrepancies become over time. When scope is understood to include communication and training around company policies, procedures, product and service documentation, work instructions, regulatory requirements and quality assurance processes (let alone topics like sales, marketing and investor relations), then the cost of doing nothing and the risks associated with doing nothing (or not doing enough) start to get high.

The risk and cost curves associated with not putting together an enterprise-wide content management framework trend up over time. The associated efficiency curves trend down.

At some point the lines cross.

As a training professional you would ideally have made your move before the lines cross. That’s the hope anyway. However, it is rarely the case. As a practical matter, it is only when senior management start to see the cost of content chaos that something happens.

The extended quote below is from a great book, O’Dell and Grayson’s If Only We Knew What We Know: The Transfer of Internal Knowledge and Best Practice:

“For example, a manager who has just tried out a new sales technique has “tacit” knowledge of it. If he writes it down and posts it on his company’s intranet site, some of that knowledge has become captured and ” explicit.” Next, another sales manager reads the description and uses the technique on her next sales trip (hence turns it into “tacit” once more). Knowledge has been captured, exchanged, and created (see Steps in the Knowledge Transfer Process, below). The learning process hence involves the continuous “intersection” of these two knowledge types and a never-ending, closed-loop transformation process.

“Other organizational experts, such as Leif Edvinsson of Skandia, further divide commercial knowledge into individual, organizational, and structuralknowledge. Individual knowledge is solely in the minds of employees. Organizational knowledge is the learning that occurs on a group or division level. Structural knowledge is embedded in the “bricks” of the corporation though processes, manuals, and codes of ethics. At any one of these three “states, the knowledge can be either tacit or explicit.

“Knowledge is broader than intellectual capital (IC). Whereas some writers have chosen to expand IC to include practices and processes, in its purest form, IC refers to the commercial value of trademarks, licenses, brand names, formulations, and patents. In this view, knowledge-as-intellectual-capital is an asset, almost tangible. Our use of knowledge is broader: we view knowledge as dynamic — a consequence of action and interaction of people in an organization with information and with each other.

“Knowledge is bigger than information. Our organizations are awash in information, but until people use it, it isn’t knowledge. While you can’t have too much knowledge, you can certainly have too much information. Indeed, many organizations have already discovered that information, carried faster and in greater volumes by electronic media, leaves employees overwhelmed, not overconfident. Fumbling rather than focused. Paralyzed rather than proactive.

“Hence, our simple working definition: Knowledge is information in action. In the organizational and commercial context of this book, knowledge is what people in an organization know about their customers, products, processes, mistakes, and successes, whether that knowledge is tacit or explicit.”

How do you know if the LMS you’re about to buy is going to cost you an arm and a leg in professional service (mostly implementation and customization) fees?

Here’s one proxy measure. It’s not perfect but it will give you a sense of likely costs. Ask to see the vendor’s audited financial statements with a segmental analysis by revenue stream (companies that do IFRS (international GAAP) reporting will already have these numbers on hand — companies that use country-specific GAAP reporting standards may have to do the math for you).

If the vendor you’re considering gets more than half of its revenue from professional services, you’re likely to end up spending a lot of money on the implementation.

If the vendor gets, for example, 60 percent of its revenue from professional services and only 30 percent from licenses, whatever the vendor tells you the license will cost, double that figure and add it back to the license fee to get the real cost of doing business with that vendor. So if the license costs $100,000 you’re likely to end up spending $300,000 all in with that vendor.

This is not a perfect indicator, but it’s a good start for having the hard conversation before you sign because armed with the vendor’s real revenue breakdowns, you’re in position to force that vendor to justify his service fees to you.

Note: This test works equally well with SaaS vendors. If the hosting contract is X and professional service charges for the vendor generally equal 2X, then assume 3X in your year-one costs.

Great quote today from Stephen Downes via his email alert and website Stephen’s Web:

“Your network gives you ideas, not answers, and people who follow only the gurus tend to be . . . followers.”

Love him or not (and I do love him — unapologetic straight shooter that he is), Stephen is worth listening to. He always has something to say.

In this post Stephen takes issue with Seth Godin’s latest bloggy channeling of (I think) Richard Florida, who is in turn promulgating somewhat academic theories around the idea of urban elitist perfectibility in real time and in real places whereas Godin thinks it’s at least partly an exercise that can be carried out individually and online.

Downes thinks Godin is drinking Kool-aid, several flavors in fact.

Whatever you think of the positions, the conversation is key and provides a much needed context for all of the talk in the performance support world about social media and learning.

No answers from me — just questions . . . like:

Do we really need or want employer-mediated social networks at all? Do they really add enough value to justify the effort?

If the answer to the questions above is yes, who owns the network — HR, IT, Corporate Communications, Sales? And why?

Should we be trying to make employer-mediated social networks persistent or should we allow them to come to life and die off as needed and used?

A fantastic article I just read on Yahoo News about the volcano in Iceland included the interactive multimedia piece you can click to below.

It’s clear. It anticipates and answers all of the major questions, including the “Why should I care?” question we all ask ourselves in the first three seconds. It tells the story in a logical way and features an easy to figure out user interface.

If you needed compliance reporting, you could use this as is — just add an invitation, tracking and a knowledge-check/acknowledgement question at the end. Though probably not intended to be, this is, I think, a great example of rapid e-learning at its very best.

Congratulations Associated Press.

Click here to see the multimedia piece (will pop up in a new window).