Posts by aLinDev

The end of net neutrality might mean third-party browser tracking, the deprivatization of online transactions, spyware on your phone, and more. At least that’s what Dr. Kenneth Williams claims.

Williams is director of the American Public University System (APUS) Center for Cyber Defense. When asked how net neutrality’s end could cause all this doom and gloom, the explanation requires a few steps: “When net neutrality ends, [antimalware software] providers are now at a higher cost to service providers,” he begins. This, in turn, could raise the cost of internet access for users who want to maintain the data safeguards their internet service provider (ISP) used before.

“The cost is going to go up if you choose those, but if you’re a user that [doesn’t] care to pay the fee,” Williams continues. “Either you pay or you just go without. When you go without, there’s a risk not only to you but anyone who connects to you and sends an email to you because the virus [would be] going around all over.”

Our new gaming site is live! Gamestar covers games, gaming gadgets and gear. Subscribe to our newsletter and we’ll email our best stuff right to your inbox. Learn more here.
In other words, the security Armageddon hinges on a lot of what-ifs. Even Williams admits his prediction is a little far-flung: “If someone says it’s very much a stretch, then there’s a plausible argument to that because I can’t prove that at this moment.”

 
"The regulatory environment is really confused"

In fact, there’s little the security industry can prove right now regarding the threat implications of net neutrality’s demise. Ask Henry Sienkiewicz, chief innovation and revenue officer at Secure Channels, what will happen, and he says, “Nobody knows. The regulatory environment is still really confused.”

In a way, confusion has been a good word for net neutrality all along. Passed by the Federal Communications Commission (FCC) April 13, 2015, the policy barely had time to get off the ground before the FCC voted it out December 14, 2017. As of this writing, around 50 US Senators are working to overturn this decision.

Net neutrality has viable public support, but support doesn’t equal clarity. Many remain confused about what net neutrality is and how its demise could alter the web, especially when it comes to data security. Can that change be accurately predicted?

For Williams, it comes down to how antivirus software receives updates: “Malware providers do constant updates to our phones all the time,” he says, but these updates require bandwidth--the core issue behind net neutrality. The policy was put into place to prevent ISPs like Comcast or Verizon from charging companies extra when they use more.

 
Debate over whether the internet is a utility

“The question is: [Is the internet] a public resource?” Sienkiewicz says. “Like the electrical grid or the gas grid or the water grid, is the internet a utility or not a utility?” The government regulates the selling of electricity and water, so if internet access is a utility, government would understandably regulate its sale as well.

So what does this have to do with information security? Well, if internet access is a utility, Sienkiewicz explains, Title II of the Communications Act of 1934 “require carriers to balance the commercial, the marketplace, public safety, universal access, [and] privacy...in a way that doesn't expose a critical infrastructure to unacceptable risks.” If it isn’t, regulation falls under Title I, which doesn’t offer the same protections.


“If it is being regulated as a Title I,” Sienkiewicz says, the next question is, “How will the FCC ensure that the carriers--and the ISPs in turn--are going to fully enable organizations to actually properly safeguard their environment?"


State actions might complicate security picture

To make regulation even more complicated, states are now getting involved. On January 22, Montana became first in the nation to pass its own net neutrality law, separate from any federal decision.


Again, the way this impacts information security goes back to whether you see the internet as a utility. Sienkiewicz explains: “Utility companies are regulated at the state level,” so it’s perfectly possible for individual states--like Montana--to pass their own legislation. He also says laws like Montana’s will be “technically very complex to actually enforce.”


If more states splinter off and create their own rules, the country could wind up with a European Union-type situation, where overarching security requirements cover the whole region with different countries still enforcing their own: “Will we end up getting a California emission control standard, [for example], as a way to provide the standard for internet traffic?” Or, he suggests, ISPs might wind up completely pulling out of states where local laws are onerous.


Of course, some might ask why internet security simply doesn’t just revert back to the way it was before. Sienkiewicz says that’s problematic: “Prior to the net neutrality regulations, the networks were not a very pristine environment.” If you think about the organic way in which early internet providers were created, it’s easy to understand why the landscape might have been messy--or at least not an ideal to go back to.


Net neutrality or no net neutrality, data security will remain a challenge

According to Sienkiewicz, "The question is how do we ensure that the networks and the carriers have some type of responsibility for ensuring security to all of the end users? The individual end users don't necessarily have the wherewithal to manage all of the incredibly increasing amount of threats. For those who could contend that prior to the regulations it was a clean environment, I would say that assertion is misplaced.”


 
How will the end of net neutrality affect data security? That question will have to wait until we know how it will affect the actual internet first. The good news is all those scare stories about spyware aren’t as well grounded. “You have to make these decisions based on fact,” Sienkiewicz contends, and in security terms, there aren’t a lot of those available yet. Yes, a shift from Title II to Title I would change what ISPs are legally required to do. Williams is right when he says some companies may cut security budgets to pay for extra bandwidth, but to quote Sienkiewicz, “[C]o-mingling net neutrality and cybersecurity per se may be a bit of a red herring.”


In the meantime, Sienkiewicz says, businesses and users have to be mindful of their own data security: “Organizations have to take personal responsibility for this, as well as the providers taking personal responsibility. All of them have to take personal liability for these things. Until the regulatory environment changes, I don't know where we will go.”

NordVPN gives you a private and fast path through the public Internet. All of your data is protected every step of the way using revolutionary 2048-bit SSL encryption even a supercomputer can’t crack. Access Hulu, Netflix, BBC, ITV, Sky, RaiTV and much more from anywhere in the world. Unmetered access for 6 simultaneous devices. You're sure to find dozens of good uses for a VPN. Take advantage of the current 72% off deal that makes all of this available to you for just $3.29/month (access deal here). This is a special deal available for a limited time.

This story, "Get 72% off NordVPN Virtual Private Network Service For a Limited Time - Deal Alert" was originally published by TechConnect.

With hundreds of business-oriented laptops to choose from — everything from sleek ultralight tablets to huge portable workstations — picking the right ones to outfit your company’s workforce can make finding a needle in a haystack seem easy. We’re here to help with a buyer’s guide that breaks the options into categories and provides pros and cons of each.

Let’s begin with the basics. Unlike consumer systems, business laptops are not meant for gaming, movies or idle web surfing — unless that’s your business. First and foremost, these systems are serious tools to help people do their jobs. In addition to sporting less garish color schemes than many consumer models, they focus on reliability and durability. Manufacturers typically sell business models for close to two years to accommodate long enterprise deployments; many promise replacement parts for five years.

Turned off by the price tags of business systems? Unlike consumer purchases, they are generally the starting point for a negotiation over cost. Most vendors offer volume discounts or the option to lease, which turns a large capital cost into a predictable monthly expense, usually at no cost premium over its life. Plus, at the end of the lease, you don’t have to worry about hardware disposal.

And with an expected three- to four-year usable lifetime, many mid- and upper-price-range business notebooks go beyond the standard single-year warranty with three years of coverage. This is often worth several hundred dollars compared to systems aimed at home users.

[ Further reading: 15 video conferencing products that are enterprise-ready ]

Based on what most large companies use, this guide concentrates on Windows systems, but in an age of workplace diversity, Apple devices are also represented. Chromebooks are also gaining traction among companies outfitting employees who don’t need peak performance: See “A new business tool: Chromebooks.”

What to look for in a business laptop

With all the hacking horror stories, security is critical in today’s business. Companies that use Windows PCs should look for systems with a Trusted Platform Module (TPM) and some sort of biometric authentication method, such as a fingerprint reader or a camera capable of Windows Hello facial recognition for password-free log-ins. Business-oriented Windows laptops should also support serious manageability features, such as the ability to tap into Intel vPro processor extensions so IT departments can remotely diagnose and service a system.

What are artificial intelligence and machine learning?

In a cybersecurity context, AI is software that perceives its environment well enough to identify events and take action against a predefined purpose. AI is particularly good at recognizing patterns and anomalies within them, which makes it an excellent tool to detect threats.

[ Learn how AI makes security systems more flexible | Sign up for CSO newsletters. ]

Machine learning is often used with AI. It is software that can “learn” on its own based on human input and results of actions taken. Together with AI, machine learning can become a tool to predict outcomes based on past events.

Using AI and machine learning to detect threats

Barclays Africa is beginning to use AI and machine learning to both detect cybersecurity threats and respond to them. “There are powerful tools available, but one must know how to incorporate them into the broader cybersecurity strategy,” says Kirsten Davies, group CSO at Barclays Africa.

For example, the technology is used to look for indicators of compromise across the firm’s network, both on premises and in the cloud. “We’re talking about enormous amounts of data,” she says. “As the global threat landscape is advancing quite quickly, both in ability and collaboration on the attacker side, we really must use advanced tools and technologies to get ahead of the threat themselves.”

AI and machine learning also lets her deploy her people for the most valuable human-led tasks. “There is an enormous shortage of the critical skills that we need globally,” she says. “We've been aware of that coming for quite some time, and boy, is it ever upon us right now. We cannot continue to do things in a manual way.”

The bank isn’t alone. San Jose-based engineering services company Cadence Design Systems, Inc., continually monitors threats to defend its intellectual property. Between 250 and 500 gigabits of security-related data flows in daily from more than 30,000 endpoint devices and 8,200 users -- and there are only 15 security analysts to look at it. "That's only some of the network data that we're getting," says Sreeni Kancharla, the company's CISO. "We actually have more. You need to have machine learning and AI so you can narrow in on the real issues and mitigate them."

Cadence uses these technologies to monitor user and entity behavior, and for access control, through products from Aruba Networks, an HPE company. Kancharla says that the unsupervised learning aspect of the platform was particularly attractive. "It's a changing environment," he says. "These days, the attacks are so sophisticated, they may be doing little things that over time grow into big data exfiltration. These tools actually help us."

Even smaller companies struggle with the challenge of an overload of security data. Daqri is a Los Angeles-based company that makes augmented reality glasses and helmets for architecture and manufacturing. It has 300 employees and just a one-person security operations center. "The challenge of going through and responding to security events is very labor-intensive," says Minuk Kim, the company's senior director of information technology and security.

The company uses AI tools from Vectra Networks to monitor traffic from the approximately 1,200 devices in its environment. "When you look at the network traffic, you can see if someone is doing port scans or jumping from host to host, or transferring out large sections of data through an unconventional method," Kim says.

The company collects all this data, parses it, and feeds it into a deep learning model. "Now you can make very intelligent guesses about what traffic could potentially be malicious," he says.

The poor security of much enterprise software can be dramatically improved at low cost with the compile-time equivalents of seatbelts and airbags. With that in mind, the Cyber Independent Testing Lab (CITL) is building a Consumer Reports-style rating systems to grade the security of thousands of software binaries.

Founded by l0pht hacker and former head of cybersecurity research at DARPA Peiter "Mudge" Zatko, and bankrolled with seed funding from the US Air Force, the CITL presented their methodology and some preliminary results at the 34c3 hacker conference in Leipzig, Germany a few weeks ago.

"It's ridiculous," Tim Carstens, acting director of the CITL, says. "At the enterprise scale, you've easily got a hundred thousand different binaries running in different places, and some infinitesimal fraction of that has the latest security features, and most of it isn't compiled in a way that enables those trivial defenses."

Our new gaming site is live! Gamestar covers games, gaming gadgets and gear. Subscribe to our newsletter and we’ll email our best stuff right to your inbox. Learn more here.
While basic compile-time security features like ASLR or DEP may not be silver bullets, they do make an attacker's job much more difficult. The vast amount of low-hanging fruit that attackers currently enjoy can be taken away from them, and at low cost to software vendors and enterprise security administrators. "At scale a lot of really basic defenses are not present," Carstens says. "Major vendors' software does not have stack execution prevention or heap overflow prevention enabled, and this is software that has an attack surface."

 
To solve this problem, the CITL is building a checklist of compile-time security best practices. "For software vendors, the main question I would pose to them is, what is their pre-release process on their gold image?" Carstens says. "What is their prerelease checklist? Check for the presence of compiler hardening features like ASLR and DEP, things in that class."

Artificial intelligence and machine learning have been shaking up many areas of business, from cybersecurity to market analytics, bots and self-driving cars.

But when it comes to core corporate functions, especially those where the risks of making bad decisions are substantial, the use of artificial intelligence is still in its early stages.

Take, for example, AmerisourceBergen, a drug wholesale company based in Conshohocken, Penn. The company has 19,000 employees in 47 countries, and gross revenues of $147 billion a year, good for 11th on the Fortune 500.

Our new gaming site is live! Gamestar covers games, gaming gadgets and gear. Subscribe to our newsletter and we’ll email our best stuff right to your inbox. Learn more here.
Alexander Kugler, the company's VP of pricing, is well aware of the potential of artificial intelligence to help the company make better decisions when it sets prices for its products. Set prices too high, and customers will go elsewhere. Set prices too low, and the company will lose money.

 
Previously, the company used spreadsheets to pull in data from various systems to determine production costs, and used past history and their own general knowledge to try to figure out how sensitive customers were to price changes and what the competition was doing.

"It was an archaic pricing methodology that hasn't kept up with industry trends and dynamics," says Kugler.

So, 15 months ago, AmerisourceBergen began the move to an integrated system that automatically calculates production costs, analyzes historical transaction data, and pulls in outside data such as weather forecasts to create a foundational layer for future deployment of artificial intelligence.

This anticipation of the need for AI to improve ERP functionality as part of business transformations is growing among first movers, and ERP vendors are weaving machine learning functionality into their offerings to meet the coming demand.

 
The future of ERP

The platform AmerisourceBergen picked, Vendavo, has intelligent functions built in, but so far, the company hasn't put those to use.

Instead, the company is using built-in expert algorithms such as alerts for when a price is set below cost. These were created based on the work of data scientists, but are not generated on the fly by machine learning systems.

"We just went live with the system in September, and we're using it more in terms of executing the black-and-white business rules right now," he says. "We're crawling — and we're about to start walking."

Calculating whether a price has been set below production costs may be a complicated calculation, but is still just a calculation. Once there's a formula, and the right data is available, getting a result out is just arithmetic.

But there are other possible alerts, which require judgment rather than simple calculations. For example, a particular series of weather events could trigger more demand for, say, flu vaccines. Or a new competitor may be about to enter a particular market segment, driving prices down.

"Looking forward, I absolutely see the value in business-risk alerts," says Kugler. "We have tens of thousands of customers, and sell tens of thousands of products. Having a process or framework in place that can alert us of potential issues before they occur would be phenomenal."

Another use of machine learning is in workflow automation.

The first step is to have a framework where a person can make a decision that automatically triggers a series of actions. Then, the next time a decision needs to be made, the system could suggest a course of actions based on past experience. Finally, once there is sufficient confidence in the recommendations, the system could take action automatically, with human beings just overseeing the process and dealing with exceptions.

 
"You would get consistent decision making, and enable the pricing team to focus more on the art behind the pricing," says Kugler. "It would free up the pricing team to focus on real opportunities that truly bring value to the organization."

Today, for example, a pricing team member might spend three hours on more complex price analysis, and five hours on the more routine tasks involved with price administration. With smart automation, they might be able to spend just one hour on price administration, and the other seven hours on value-added activities.

"This is not a situation where I'm looking to reduce headcount," he says.

But all that is in the future.

Right now, AmerisourceBergen is still in the process of putting the basis in place, so that it can then move on to figuring out how to use machine learning for business risk alerts, predictive analytics and workflow automation. No decisions have been made yet, Kugler adds.

But making better predictions, setting better prices and even lowering production costs isn't the only benefit of having smarter systems.

AI technology will also help the company defend itself — and not just against its current direct competitors.

"We're acutely aware of things like Amazon entering our space," he says. "We would be fools to think that Amazon isn't going to leverage everything it can to try to muscle in."

Those companies that don't take advantage of AI will suffer, he says. "I think you're going to see more erosion of their profits and ultimately they're either going to have to diversify and find other revenue streams, or become candidates to be taken over."

Getting ready for AI

Like AmerisourceBergen, many companies are still in the process of getting ready for smart ERP systems that use machine learning and advanced analytics, intelligent interfaces, and workflow automation.

AI-based ERP products and features have only recently hit the market and companies are taking a slow and careful approach to adoption, says Josh Sutton, head of AI at New York-based SapientRazorfish, which provides consulting services to help companies add AI-powered capabilities to their ERP systems.

"AI is a very significant part of business transformation today," he says, "and the rate of transformation is faster than it has ever been."

Sutton is seeing a lot of companies starting narrowly-targeted pilot projects related to adding AI to ERP, but it's still very early.

"We're really at the beginning of this path," he says. "And the companies that are having the most success are those that are taking the small, bite-sized pieces rather than trying to boil the ocean. These companies have real results, and sooner rather than later."

Another company that can see the potential of artificial intelligence and machine learning to improve operations is Home Depot.

Today, the company has data scientists on staff analyzing sales, weather trends and other data to help anticipate customer needs.

Take hurricanes, for example.

"We're able to quickly respond and stage emergency supplies like water, plywood and generators at strategically-located distribution centers," says Paul Mayer, Home Depot's manager of communications. "We definitely are the hurricane headquarters."

Today, this is all done with human brain power. But the company is evaluating and testing the use of artificial intelligence and machine learning, especially when it comes to supply chain and inventory management.

"Our goal is to make sure we have the right products at the right time when customers need them," he says.

According to a survey released this month by analytics company LevaData, 69 percent of companies are extremely interested in how AI can help improve their supply chain.

So what's holding up the move to smarter ERP? There are several factors at play, including cultural issues, the slower pace of cloud adoption for ERPcompared to other aspects of business, and the fact that the technology is only just now emerging.

ERP's people problem

According to the LevaData survey, 49 percent of respondents said that their in-house talent is not yet ready for radical digital transformation of these core business processes.

Take, for example, the procurement process. Large companies may be dealing with thousands of different products, from thousands of suppliers, but the people in charge are generally still using Excel spreadsheets and gut feelings when negotiating prices, says Rajesh Kalidindi, founder and CEO of LevaData.

They want to pound on the table, and use their years of business experience and well-honed instincts, he says.

Now they need to move to a data-driven approach.

"And people think, 'It's going to take away my job,'" he says. "'Are they going to rely on the decision of the machine, or mine?'"

According to a survey conducted this summer by SAS, the cultural challenge is the biggest barrier to AI adoption, with 49 percent of respondents saying that they had a lack of trust in the technology.

In addition to being reluctant to take a machine's advice, employees may also be reluctant to turn over the information that the machine needs to make better decisions. In particular, when it comes to, say, price negotiations, the AI needs to know not just the final results, but also what strategies didn't work.

"The challenge is getting all the data, not just the data that people want to be managed by," says SapientRazorfish's Sutton. "This is a behavioral challenge that companies are struggling with. AI works better with all the data, not just the data that people want to share. Many times, people will only put things in the system that reflect well on them."

Slow-moving clouds

Cloud-based and SaaS deployments make it easy for ERP vendors to implement the latest technologies and integrate data feeds and analytics tools from outside partners.

However, 67 percent of companies still use on-premises ERP, while only 33 percent use cloud or use cloud-based vendors, according to a report released earlier this year by Panorama Consulting.

By comparison, according to IBM, 87 percent of CRM systems are now cloud-powered.

"Most companies have stayed on top of the pace and technology enhancements on the front office but are only beginning to look at their back-office applications," says Mickey North Rizza, an analyst at IDC.

Companies that do use cloud-based ERP or SaaS products have a head start when it comes to artificial intelligence, she says.

"Unfortunately many large enterprises still have traditional on-premises ERP systems and have not moved to the cloud yet," she says. "These large enterprises are missing out on the innovation."

Rizza expects more companies to move operations to the cloud to help drive business transformation, and to do more with machine learning.

ERP vendors rolling out AI capabilities

Every major ERP vendor either has artificial intelligence on their near-term road map, or is already rolling out features and tools.

For example, in October, Oracle announced several AI-powered add-onsfor its cloud-based ERP products.

More products are coming soon, says Steve Cox, group vice president for Oracle ERP and EPM product marketing.

So far, companies are still at the very beginning of adoption, he says, though some organizations are already using AI on the analytics side.

"The NHS uses artificial intelligence to spot fraudulent claims in Britain," he says. "That's a good example of a use case."

But AI can do more.

"Imagine that you get a weather warning indicating that one of your factories won't be able to make its production quota on a certain day, and you're going to find yourself with major problems with customers," he says. "Based on what happened previously, it suggests to you that there are six possible solutions, and it shows you the financial implications of each solution. When you select the one you want, it shows the steps you need to take. But the most important thing is that next time something like this happens, the system remembers."

That's the future, Cox says, and that's why he expects AI to be as transformative for business as cloud computing.

"In my view, artificial intelligence and machine learning will change everything," he adds.

Cox predicts that 2018 will be the year when AI will start seeing major adoption in the ERP space.

"I think the interest is huge," says Paul Farrell, VP of product marketing for Oracle NetSuite. "There are some businesses utilizing it right now, but looking at our base of customers, everyone is interested, but they're waiting on the practical applications."

Another ERP vendor with an artificial intelligence product is Infor, which announced its Coleman AI bot this past summer. The bot uses the Amazon Lex deep learning and natural language interface.

The product is currently in beta, and will go live next spring, says Rick Rider, senior product director for Infor Coleman AI.

It's a fantastic set of features, says Billy Blackerby, solution architect for supply chain and merchandising operations at Whole Foods.

"You are bringing consumer-grade functionality into a business setting," he says.

There are also predictive analytics and machine learning capabilities being developed that help the system predict what the user wants.

"A particular use case that comes to mind for me is in the realm of assortment planning," says Blackerby. "‘Coleman, I need a product that can fit on a 3-foot-wide shelf in the X category that has parity with other dried goods to be carried in the Y holiday season.’”

"Large corporations want to ease into this," says Mitchell Lee, profit evangelist at Vendavo, which sells pricing analytics tools to large global companies in the B2B space, and began offering machine learning tools in 2016.

More CIOs are turning to an emerging technology practice called robotic process automation (RPA) to streamline enterprise operations and reduce costs. With RPA, businesses can automate mundane rules-based business processes, enabling business users to devote more time to higher-value tasks. Others see RPA fitting into a larger context, as they take a more deliberate path to adoption, seeking to understand RPA's potential to work alongside machine learning (ML) and artificial intelligence (AI) tools.

Here CIO.com takes a look at what robotic process automation really is, and how CIOs can make the most of RPA in alignment with business goals.

What is robotic process automation?

RPA is an application of technology aimed at automating business processes. Using RPA tools, a company can configure software, or a “robot,” to capture and interpret applications for processing a transaction, manipulating data, triggering responses and communicating with other digital systems, according to the Institute for Robotic Process Automation and Artificial Intelligence.

Our new gaming site is live! Gamestar covers games, gaming gadgets and gear. Subscribe to our newsletter and we’ll email our best stuff right to your inbox. Learn more here.
Inclusion of the term "automation" may cause some to confuse RPA with ML and AI. RPA can include ML or AI, but it is governed by set business logic and structured inputs, and its rules don't deviate, whereas ML and AI technologies can be trained to make judgments about unstructured inputs.

 
RPA scenarios span a wide spectrum, ranging from something as simple as generating an automatic response to an email to deploying thousands of bots, each programmed to complete a specific task, to automate jobs in an ERP system. Insurers use RPA to pipe policy management data into a claims processing application, rather than having humans type them in from their computers.

Enterprises are looking to RPA to automate legacy business processes because their talent, technology and time resources are constrained, Dave Kuder, a principal with Deloitte Consulting LLP, tells CIO.com. With RPA, CIOs can complete in days or weeks manual processes that previously took months or years, and at a fraction of the cost. "You can imagine why this is gaining a ton of traction right now," Kuder says.

The RPA market is small but growing. Spending on RPA software will reach $1 billion by 2020, Gartner says, growing at a compound annual growth rate of 41 percent from 2015 through 2020. By that time, 40 percent of large enterprises will have adopted an RPA software tool, up from less than 10 percent today. For many organizations, RPA may prove to be a stop-gap on their way to AI.

Either way, the consensus is that RPA remains a vital tool worth exploring. CIO.com asked some technologists and consultants how IT leaders can tackle RPA.

 
9 tips for effective robotic process automation

1. Set and manage expectations

Quick wins are possible with RPA, but propelling RPA to run at scale is a different animal. Deloitte’s Kuder says many RPA hiccups stem from poor expectations management from the outset. Bold claims about RPA from vendors and implementation consultants haven't helped. That's why it's crucial for CIOs to go in with a cautiously optimistic mindset. "If you go in with open eyes you'll be a lot happier with the result," Kuder says.

2. Consider business impact

RPA is often propped up as a mechanism to bolster return on investment or reduce costs. But Kris Fitzgerald, CTO of NTT Data Services, says more CIOs should use it to improve customer experience. For example, enterprises such as airlines employ thousands of customer service agents, yet customers are still waiting in the queue to have their call fielded. A chatbot, could help alleviate some of that wait. “You put that virtual agent in there and there is no downtime, no out sick and no bad attitude,” Fitzgerald says. “The client experience is the flag to hit.”

3. Involve IT early and often

Thanks to the emergence of cloud computing in the digital era, "citizen developers" without technical expertise are implementing RPA right from their business units, Kuder says. Often, the CIO tends to step in and block them. Kuder says that business heads must involve IT from the outset to ensure they get the resources they require.

4. Poor design, change management can wreak havoc

Many implementations fail because design and change are poorly managed, says Sanjay Srivastava, chief digital officer of Genpact. In the rush to get something deployed, some companies will overlook communication exchanges, or "handshakes" between the various bots, which can break a business process. "Before you implement, you must think about the operating model design," Srivastava says. "You need to map out how you expect the various bots to work together." Alternatively, some CIOs will neglect to negotiate the changes new operations will have on an organization's business processes. CIOs must plan for this well in advance to avoid business disruption.

5. Don't fall down the data rabbit hole

A bank deploying thousands of bots to automate manual data entry or to monitor software operations generates a ton of data. This can lure CIOs and their business peers into an unfortunate scenario where they are looking to leverage the data. Srivastava says it's not uncommon for companies to run ML on the data their bots generate, then throw a chatbot on the front to enable users to more easily query the data. Suddenly, the RPA project has become an ML project that hasn't been properly scoped as an ML project. "The puck keeps moving," and CIOs struggle to catch up to it, Srivastava says. He recommends CIOs consider RPA as a long-term arc, rather than as piecemeal projects that evolve into something unwieldy.

6. Project governance is paramount

Another problem that pops up in RPA is the failure to plan for certain roadblocks, Srivastava says. An employee at a Genpact client changed the company’s password policy but no one programmed the bots to adjust, resulting in lost data. CIOs must constantly check for chokepoints where their RPA solution can bog down, or at least, install a monitoring and alert system to watch for hiccups impacting performance. "You can't just set them free and let them run around; you need command and control," Srivastava says.

7. Control maintains compliance

There are lot of governance challenges related to instantiating a single bot in environment let alone thousands. One Deloitte client spent several meetings trying to determine whether their bot was male or female, a valid gender question but one that must take into account human resources, ethics and other areas of compliance for the business, Kuder says.

8. Don’t forget the impact on people

Wooed by shiny new solutions, some organizations are so focused on implementation that they neglect to loop in HR, which can create some nightmare scenarios for employees who find their daily processes and workflows disrupted. “We forget that it’s people first,” Fitzgerald says.

 
9. Put RPA into your whole development lifecycle

CIOs must automate the entire development lifecycle or they may kill their bots during a big launch. “It sounds easy to remember but people don’t make it a part of their process.”

Ultimately, there is no magic bullet for implementing RPA, but Srivastava says that it requires an intelligent automation ethos that must be part of the long-term journey for enterprises. "Automation needs to get to an answer — all of the ifs, thens and whats — to complete business processes faster, with better quality and at scale," Srivastava says.

Fears of the rise of robots swooping in to steal jobs abound, stoked by the confluence of artificial intelligence, machine learning and other technologies that automate routine tasks traditionally performed by humans. The reality is that job replacement will happen more gradually than the media headlines suggest, and eventually AI will create more jobs than it eliminates, say Gartner researchers.

"I try to step back and wait for the boomerang because there always will be one," says Gartner analyst Craig Roth, of the hype surrounding job cannibalization via automation. "Once it goes too far to one side, people wake up and realize, 'you know, maybe it's not that bad.'"

Make no mistake, AI and robotics will have a profound impact on the job market long term. As many as 39 to 73 million jobs will be usurped by automation, according to research McKinsey Global Institute released in November. Yet the consultancy also says that workers will perform new tasks or reskill as tasks become automated, leading to millions of new jobs. Gartner estimates that by 2020 AI will create more jobs than it eliminates — 2.3 million to 1.8 million. By 2025, job creation related to AI will top 2 million net-new jobs, including new positions of highly skilled, management and even the entry-level and low-skilled variety, Gartner says.

Our new gaming site is live! Gamestar covers games, gaming gadgets and gear. Subscribe to our newsletter and we’ll email our best stuff right to your inbox. Learn more here.
Such statistics contradict the panic-inducing headlines that millions of jobs will evaporate. One reason for this is that people tend to conflate job automation with automation of certain tasks, which is a much more accurate snapshot of the current corporate climate, Roth says. In other words, robots and other machines aren't replacing humans outright, but sharing the workload.

 
Robots and humans making pizza together

Take a pizza business that employs robots to work alongside humans. Maybe the robots perform roughly 10 of 20 tasks it takes to build, bake and deliver a pizza, says Roth. In fact, such a business already exists in Zume Pizza, a Mountain View, Calif.-based startup that uses several robots to help humans assemble and bake pizzas. 

Humans prepare and divide the pizza dough, put it into a dough press and then onto a moving assembly line. When orders come in, one robot applies sauce and another spreads the sauce before handing it off to a human to smooth out imperfections, says Zume CTO Josh Goldberg. The human worker then adds cheese and toppings, which requires fine-motor skills robots are, for now, largely incapable of. "Humans do it today because it's a pretty highly skilled thing to do," Goldberg says.

Another robot takes the finished pie and places it into a par-bake oven, which heats the pizza at 800 degrees to kill the active yeast in the dough before transferring it to trucks, Goldberg says. Beyond saving humans from burns, Zume's value proposition is fresh, farm-to-oven ingredients and speed. Zume is using trucks equipped with "bake-on-the-way" technology that begins cooking pies shortly after they are ordered; the average delivery time is around 22 minutes. 

Zume uses optical targeting and computer vision technology to inform the automation for the base robots, which are made by ABB, and has developed custom tooling to enable the robot's manual operations. Roth says Zume offers a glimpse of the human-machine labor division typical today.

 
What the future of AI means for work

You can think of AI, robotics and even robotic process automation (RPA) as endowing humans with certain "superpowers," enabling them to get more tasks accomplished in less time, Roth says. Gartner calls this "AI augmentation," and posits that one in five workers engaged in mostly non-routine tasks will rely on AI to do a job by 2022.

The growing application of AI technology to automate tasks also means IT leaders must take into consideration what jobs will be lost, what jobs will be created, and how staff will collaborate and get work done. CIOs may have to reskill employees and reposition them for other services that provide greater value for customers, Roth says. Ultimately, CIOs must prepare their organizations for an automation boom that will trigger significant, though hard to quantify, changes.

To that end, Roth advises:

• Avoid hype. Don't get distracted by shiny new AI technologies or dread-inspiring headlines that say robots are taking over the world.

• Watch what you say. When talking about the automation capabilities of a certain technology, don't hammer home the fact that it could lead to headcount reduction. Maintaining a low-key, sober approach is crucial in conversations with employees. You don’t need to incite a panic.

• Keep societal impacts out of the equation. Consider how AI and other automation capabilities can fortify the business and drive competitive advantage, but don’t worry about the societal impact these technologies portend. Figuring out the right technology decisions for the business is hard enough without falling into a moral quandary. That's for academics to worry about, Roth says.

• Approach AI lightly. Given their disruptive potential, don’t rush into AI and automation.

• Avoid the “nuclear AI” problem. Another reason to proceed with caution is the potential for something to go awry, leading to a public relations disaster that sets the AI and automation markets back years. For example, Microsoft didn’t do the AI software sector any favors when it’s chatbot Tay unleashed racist, sexist and other incendiary comments on social media. One possible scenario: What if a self-driving delivery car operated by Zume Pizza gets into a serious car accident? “There's a risk that some employers make stupid decisions about AI that could cause a backlash,” Roth says. “There are so many opportunities for that to happen.”

Bottom line: “If [CIOs] can sprinkle [AI and automation] in lightly and in a humanistic way over time, that will do a lot more for society than trying to solve the challenge at the societal level,” Roth says. “And if a CEO or CIO could convince their peers to follow suit, that will have the most impact.”

Related artificial intelligence articles:

• A practical guide to machine learning in business

• Machine learning success stories: An inside look

• 9 IT projects primed for machine learning

• 10 signs you’re ready for AI -- but might not succeed

• 10 strategic tips for getting started with machine learning

• Which deep learning network is best for you?

• How to build a highly effective AI team

• Why you should invest in AI talent now

• Why AI careers can start with a degree in linguistics

• The year of Alexa and the coming decade of A.I.

One of the habits from Stephen Covey’s bestselling book The 7 Habits of Highly Effective People is to begin with the end in mind. Putting that in today’s business context, organizations need to figure out what digital transformation means for their business and what their goals are before they go throwing a bunch of new technologies at an ill-defined problem. By focusing too closely on being competitive and innovative and putting the bulk of their efforts into technology, they might be missing the boat.

Technology, of course, is a key driver. IDC estimates $1.2 trillion will be spent on digital transformation technologies in 2017, an increase of 17.8 percent over 2016.

Yet, a significant number of organizations are not getting transformation right because of a fundamental quandary over what digital transformation really is, says Brian Solis, principal analyst and futurist at Altimeter, a Prophet company.

Our new gaming site is live! Gamestar covers games, gaming gadgets and gear. Subscribe to our newsletter and we’ll email our best stuff right to your inbox. Learn more here.
Altimeter’s 2017 State of Digital Transformation report finds that while organizations are investing in innovative technologies, most are lagging or failing to respond to consumers’ new expectations due to “meager digital literacy.” The report also finds many companies have cultures and that “politics, ego and fear are the main obstacles to achieving the collaboration and solidarity needed within companies to make the changes digital consumers want.”

 
When companies start with a tech-first approach they miss the purpose of what digital transformation is all about, maintains Solis. “I think a lot of times, companies and CIOs in particular, fall into what I call ‘the technology trap.’” Quite simply, he says, it means they are building upon a legacy foundation with new stuff.

[ Get an inside look at 13 real-world digital transformations at today's leading organizations, find out why companies struggle to cultivate digital strategies, and learn what digital transformation really means. | Get the latest on digital transformation by signing up for our CIO Leader newsletter. ]

“There’s this idea if we use the technology that our customers use or the latest apps and mobile sites or chatbots, we’re keeping up with disruption,” Solis says, “and I think none of this is bad, but it’s a common trap for the evolution of digital transformation.”

To see how it’s being done right, here are the seven habits of highly effective digital transformations.

 
Digital transformation is really about human transformation

When Shamim Mohammad became CIO and senior vice president of CarMax a few years ago, “I didn’t look at transforming technology, but how do we transform us … so all of us are moving at the right speed.”

That sentiment is echoed by James Lowey, CIO at TGen, who says that one of the largest challenges around transforming a business is keeping a workforce up to speed with current skills necessary to participate in this change.

“Having a stellar team who is always willing to embrace technologies helps … as often, the pace of technological change exceeds the ability of formal education to keep up,’’ he says. “I believe having people who are passionate, curious and motivated by the mission is the key to success in achieving a true digital transformation.”

A few years ago, Pitney Bowes began looking at where technology was headed in 10 functional areas, including mobile, data, analytics, machine learning, APIs, SaaS, and designing a user experience. “We realized for our organization to move forward in addition to a clear technical strategy, we needed to have a people strategy,’’ says James Fairweather, senior vice president of technology and ecommerce.

Curriculums were organized around all 1o areas, and everyone in the 1,200-person innovation organization was required to select one of those 10 tracks and commit to learning it for one year. Fairweather says they have made a commitment to employees to enrich their skills and enhance their personal value proposition.

This mindset shift has moved the company forward. “We were 80 acquisitions over the past 10 years but … having people swear allegiance to one of these topic areas has created a lot of cross communication and new relationships were formed as people got to know each other. We’ve seen huge benefits to doing that proactive training,” Fairweather says.

Take a customer-centric approach

While businesses cite “evolving customer behaviors and preferences” as the top driver of digital transformation, fewer than half invest in understanding digital customers, the Altimeter report found.

“The few that are getting it right start with an outside-in approach,’’ says Solis. “They’re looking at something that is either broken or missing to solve a need,” and then tie in ROI and key performance indicators (KPIs) “to demonstrate progress and success.”

 
They are also focusing on the customer experience first and foremost, he adds. “They look at the customer journey or parts of the customer journey; they look at the mobile journey in particular, and they look at fixing something that could create greater opportunity so they can tie immediate opportunity to it.”

That’s what CarMax’s Mohammad found after the senior executive team took a “tech safari” trip to the West Coast and visited several successful companies to learn about technology “and the art of possibility around technology,” Mohammad says.

One of the takeaways was that they weren’t always meeting what customers want. While CarMax has a customer-facing website, it would take weeks or months to get a new feature implemented on it “because teams weren’t organized right,” he says. “We didn’t have a structure for speed.” 

Create new teams

CarMax knew consumers wanted a better experience with the ability to buy a car from its website. To do that, officials organized employees into product teams that all have “three critical, non-negotiable roles”: a product manager, a lead developer/engineer and a user experience person. They are supplemented by other development, quality assurance, finance and operations members for anywhere from seven to nine people.

One idea officials wanted to try out was delivering a car to someone’s home. One of the product teams built a mobile app and embedded capabilities so a customer can order a car from a mobile device and have it delivered to their driveway within a couple of weeks. The team “didn’t go for a perfect solution on day one; they got the capability in the hands of a customer quickly and then worked on making it better,’’ Mohammad adds.

The first car has since been delivered in Charlotte, N.C., the only market with that capability right now.

The teams all hold two-week “open houses” to provide internal transparency and updates on how they’re meeting business objectives and customer needs.

Today, with the teams in place, the goal is to “deliver a great idea in matter of hours; try it out and see how it’s working and make it better. That’s a big shift,’’ says Mohammad.

The approach is similar at John Deere, where executives have come up with a roadmap of what the vision is for the future with the goal of developing a smart connected enterprise. A 7,000-square foot workspace dubbed the Foundry, was built in one of the company’s factories complete with lower table heights, so people can collaborate more freely. There, new teams will be brought together to learn a new agile methodology from a set of experts who walk employees through what one cycle of development will look like.

“We’ve embraced agile because we realize it helps us build a culture of learning, so we’re now going through sprint cycles” to develop a product every two months, says Ganesh Jayaram, vice president of IT at John Deere. “We’ve broken up our portfolio of projects and we’re trying to implement that in two-month increments. Then we’ll step back and say, ‘Did we meet the expectation of customers?’ as opposed to waiting for months or years to pass by before we prototype a new solution.”

The next step will be forming teams of employees who will make the leap with a series of workshops to educate them on what this journey will entail, Jayaram says. “It’s a very different way to work. Going forward, we’re trying to embrace an approach where applications, infrastructure and business [units] are all going to work together.”

Informing the strategy for the connected digital enterprise was done through external benchmarking and internal interviews to make sure IT understood what the CEO and some of Jayaram’s peers in other functional areas expect of IT.

“In the past we’ve been thought of as a cost center,’’ he says. “Going forward, we’ll be front and center. It’s the first time in John Deere’s history we’re leading what the enterprise needs. We took the mandate and said, ‘How do we make that real for us?’”

Fostering collaboration as technology is deployed

As Pitney Bowes was designing curricula around targeted technology areas, officials also formed a tech strategy team and global innovation roundtables to foster greater collaboration. “All teams were sharing practices to test continuous integration and continuous delivery so all apps moving to the cloud were benefiting,’’ says Fairweather.

With help from “trailblazing teams” the company developed a standard tool chain and a standard set of practices that were then shared by building a community around devops, he says.

Fairweather adds that management believes face time is important and officials have sponsored face-to-face interactions to drive connections between geographically distributed teams.

The collaborative efforts have paid off. “As a result of sharing practices, we have identified cases where we see a common failure mode in our continuous integration, delivery and operational practices — and then we are able to propagate the fix across all teams and improve and correct across all teams,’’ Fairweather says.

Management also conducted a survey of its strategic foundational technology program. Fairweather recalls one comment an employee gave as feedback: “Instead of being a cog in the wheel I’m a better-informed contributor. The best part of learning from peers is gaining new contacts. We are more united as global organization in pursuing these 10 areas because we had done this.’’

Be unapologetic about change

With a salesforce of 25,000 people, there was bound to be resistance when industrial giant GE began implementing digital technologies into its global sales operation. And there was. Most hadn’t changed the way they sell in over 20 years.  

“We did have naysayers [but] if you’re trying to drive any change, don’t worry about them,” says Cate Gutowski, vice president of GE Commercial and digitalTHREAD, the connected digital ecosystem.

Gutowski forged ahead anyway, articulating what needed to be done. “When you do that you accumulate a group of early adopters and innovators,” she says. She also bought into the Law of Innovators theory, from the book Start with Why, which says to take something from an initiative to a movement, identify the innovators, who are the first 2.5 percent. “If you focus on that group you can create influence and drive any type of change,’’ she says.

She admits that driving a people transformation is “not for the faint of heart. What this is really about is breaking glass.”

Gutowski also learned that “You have to first be unapologetic about driving change and you also have to be comfortable with constantly being uncomfortable.” Getting buy-in at the outset from GE’s leadership team, of course, helped. Then she got sales professionals on board “by doing a lot of crowdsourcing,” and listening and getting feedback on what the customer field sales organization wanted.

Adopt a startup mentality

In 2014, AT&T’s prepaid carrier was merged with the newly acquired Cricket Wireless. The two competing prepaid companies needed to transition into one large national player.

Like John Deere and CarMax, Cricket Wireless has adopted a more agile development model, says Darin Morrow, vice president and CIO. That has meant a focus on “operating nimbly and with integrity, making sure that things happen in the right way.”

As organizations get larger, different groups can begin to cut themselves off from one another, creating silos of information, he says. “A startup mentality helps breaks down those walls and encourages communication across teams.”

For example, it was critical for Cricket Wireless’ digital/online delivery teams to roll out smaller functionalities faster. Working close together on site, in person, eliminated a lot of missed communications that can get in the way, he says. “We are able to elevate and make decisions quickly.”

Drive management buy-in

The Altimeter survey indicates that only 40 percent of respondent companies operate with an executive-mandated steering committee responsible for organizational transformation.

Although the C-suite typically decides what the business strategy will be and informs the rest of the organization, Jayaram of John Deere decided to turn that around. “I chose to flip the traditional top-down approach” and instead brought together 40 people “from different levels of hierarchy within IT” to create a new IT strategy for transforming the company to a digital enterprise.

“We went through a whole co-creation process before we took it to the C-suite,’’ he says.  Some who gave input are new to the company but are subject matter experts in user experience or agile development. 

“As we went through the rollout of the strategy, we polled about 170 of our fellow colleagues across IT to find out if it makes sense and resonates as directionally correct,’’ Jayaram says. The results were a 4.5 out of 5.

Then Jayaram went to the C-suite and presented the smart connected plan with lean agile methodologies.

“We know people believe this is a life strategy and will transform the company,’’ he says, and leadership is committed, and they can personally see how we can make a big difference.”

As more organizations expand to new locations around the world, a growing number of IT leaders are finding themselves collaborating with colleagues, staff and business partners in places with drastically different personal, work and ethics practices.

For an IT professional, moving into a global management environment can be both a shock and a matchless career advancement opportunity. "IT professionals must be prepared to drive innovation in today’s globally interconnected markets," says Sandra Smith, director of Brown University's IT Leadership Program. "To this end, they need transferable leadership skills effective across all markets, industry and cultures."

A successful global IT leader can come from any background, notes Doug Bordonaro, chief data evangelist at analytics developer ThoughtSpot, where he works with numerous Global 500 companies. "Although there are many increasingly popular international management programs that can help prepare you for global leadership, ultimately the most successful business people have three core traits: respect for foreign cultures, a skill that is in demand and the patience to listen and communicate openly."

Our new gaming site is live! Gamestar covers games, gaming gadgets and gear. Subscribe to our newsletter and we’ll email our best stuff right to your inbox. Learn more here.
Yet even IT pros who possess these basic attributes often have difficulty connecting with teams and individuals in diverse global locations. Becoming familiar with foreign customs and practices within a matter of days or weeks, and not inadvertently creating suspicion and mistrust, can be a tall order. The following five steps provide a basic game plan for any IT leader suddenly entrusted with global responsibilities:

 
1. Understand the challenge

The most effective global IT leaders are those who make an effort to understand the local business and cultural environments in which their organization operates. "The best leaders take from the norms of multiple cultures and disciplines they work with to create a blended strategy, one that leverages the best practices from headquarters and from the local offices," Smith says. "Creating this blended approach takes time but also generates greater buy-in and a sense of ownership by the local offices."

An IT leader in a multicultural environment must also be aware of his or her own cultural framework, observes Annalisa Nash Fernandez, a New York-based intercultural strategist who advises international executives on cross-cultural communication. "For an American CIO, that may mean a high degree of individualism and personal accountability, a task-based versus relationship-based approach and a linear view of project timing, which is the lens through which the diverse cultures and business styles of the teams abroad will be understood and processed," she explains.

Begin the journey with face-to-face contacts to better know your customers, business partners and team, suggests Keith Collins, executive vice president and CIO of SAS.  "Language and cultural differences make conference calls difficult at best," Collins says. "Practicing empathy is critically important in this environment."

To better understand local markets, practices, challenges and needs, a global leader should be prepared to ask a lot of questions when visiting a local site. "Having a mentor relationship with a peer or counterpart based in other countries, may also help IT leaders become acquainted with market-specific foreign business and IT practices," Smith explains. "Reading about the country’s economic and political environment, the history and culture, is also a good way to understand the context and the rationale for some of the practices observed."

 
2. Polish your communication skills

Successful global communication requires both listening and respect. "Really hear what the other person is saying and think about their point of view before you jump in," Bordonaro suggests. "Understand that their perspective or method may be different, but ultimately just as valid as yours."

When dealing with a culturally and geographically diverse team, a new global IT leader must remember to keep the message simple and devoid of jargon, advises Ed Addario, CTO of Currencycloud, a London-based global payment service provider. To gain trust, it's important to show your human side as well as your business and IT professionalism. "Sharing how excited you were to try a new gadget at your last convention is guaranteed to bring a few chuckles from your French team," he quips.

Communicating effectively across cultures requires commitment and preparation. "Proactively seeking opportunities to practice in front of others with different backgrounds who can provide honest and critical feedback is an excellent way to develop communication skills," Smith says. "Reading or taking a course on effective public speaking is also a good way to go," she advises.

Trust is always the key, no matter where colleagues are located. "Do what you say. Follow through. Share responsibility. Be empathetic," Collins suggests.

"Say what you mean with no room for error," adds Frank Auger, CIO of HubSpot, a Cambridge, Mass.-based developer of marketing and sales software. "Don't put the responsibility on the listener to pick up on and correctly interpret the nuances in your communication." This is especially true when making requests and suggestions. "With some cultures, 'I'm just curious' carries as much weight as, 'I'd like you to do this right now,'" he explains.

3. Familiarize yourself with local business and IT practices

A new global IT leader shouldn't reflexively impose U.S. business and technology practices on global teams. Nor is it a good idea to completely defer to local preferences. "Identify what are the values and practices that matter across the company regardless of location," Auger says. "Prioritize those without compromise, but allow local leadership to drive their own regional execution and approach within guidelines that don't allow for the watering down of the core values."

"American IT practices that are team-based with open communication across divisions may face challenges in hierarchical cultures such as India, Mexico or France where team members are used to a top-down management style," Fernandez warns. Conversely, the explicit communication styles favored by U.S., Canadian and many Western European leaders may seem condescending or overly simplistic to team members in Asian countries that favor a more nuanced, context-based communication style. "Teamwork and consensus is in the DNA of the highly collectivist cultures of Asia, although this may be confusing to project managers in Japan, which is both hierarchical in terms of management style but consensual in terms of decision-making," Fernandez adds.

"Speaking as a German, I can imagine that U.S. business practices will be especially hard to apply to a German engineering department," observes Guido Laures, CTO of Spreadshirt AG, an online apparel retailer located in Leipzig, Germany. "From a German perspective, U.S. business patterns are sometimes very blatant or bold," he notes. According to Laures, Germans like to dig into details, especially when it comes to engineering and IT practices. "In the U.S., time-to-market sometimes rules everything," he says. "Outside of the U.S. there is a balance between time-to-market, quality and maintainability."

 
4. Become an international collaborator

People from diverse backgrounds are often the most productive members of a brainstorming group. "The key to success is to set aside time for informal discussion and to solicit impact outside a structured meeting or brainstorm," Bordonaro says. "This can be unexpectedly challenging, as everyone gets used to following the defined communication process."

"Get to know the members of your global team the same way you know your local team," Collins advises. "Do all you can to have social events at each office so you can share local traditions and culture."

A big downside to managing across time zones is that there are fewer opportunities for IT leaders to enjoy informal chats with international colleagues, since they don't ordinarily pass them in the hallway or catch them in the lunchroom or gym. "It takes an extra effort to talk during the brief period when you're both awake and working," Bordonaro observes. He recommends scheduling brainstorming and other discussion-heavy meetings at a mutually-convenient time. "You’ll be surprised how diversity and distance quickly become an asset," he notes.

As they seek input from their global teams, IT leaders should strive to create an environment of fairness and respect. "Team members need to believe that new ideas, regardless of their origin, are welcome and that diverse perspectives are truly valued," Smith says. Innovation should be rewarded and acknowledged publicly. "Testing new ideas and learning from mistakes should be encouraged and expected as a regular part of business," she explains. "On a practical level, videoconferencing tools should be used for group brainstorming over regular phone-based conferencing."

5. Embrace change, reject fear

Fear is change's unwanted partner. An IT leader suddenly pushed onto the global stage frequently fears rejection, humiliation and, ultimately, failure. Yet fear also visits the remote staff, who worry that their new boss will upset their tidy little world with irrational schemes, procedures, requirements and, worst of all, layoffs.

The good news is that while some fear may be warranted, a change of command rarely plays out as horrifically as either side expects. Much of this is due to the fact that while the world is populated by many different cultures, people generally have similar job-related goals. "Respecting the cultural differences while practicing the patience to find the underlying common goal is the key to successful international business," Bordonaro concludes.

Related IT leadership articles:

• The skills and traits of a next-generation CIO

• The 8 biggest IT management mistakes

• 9 lies CIOs tell themselves

• 6 hard truths CIOs must learn to accept

• The secret to being a superhero CIO? A kickass sidekick

• Digital transformation: Your career at a crossroads

• IT's identity crisis: How to remain essential as the business evolves

• State of the CIO 2017: More challenging, still complicated

• How IT leaders can define and drive IT innovation

• How CIOs are transforming their organizations for the digital era

• Why CIOs need to take the lead on digital transformation in 2017

• Modernizing IT: How to thrive as a CIO ‘value broker’

• IT mission, vision and values statements

What do IT workers want? Fair paychecks, challenging work and ample opportunities for growth, for starters. Our annual listing showcases the organizations that excel at keeping their employees engaged and loyal with compensation, training and access to hot technologies. The report is published every June.

The 2017 Best Places to Work in IT list, our 24th annual report, was published on June 12, 2017.

The 2018 Best Places to Work in IT will be announced in June 2018.

Our new gaming site is live! Gamestar covers games, gaming gadgets and gear. Subscribe to our newsletter and we’ll email our best stuff right to your inbox. Learn more here.
Past special reports:

• 100 Best Places to Work in IT 2016

• 100 Best Places to Work in IT 2015

• 100 Best Places to Work in IT 2014

• 100 Best Places to Work in IT 2013

• 1994 - 2017: Search the Best Places archives

Contacts

The FAQ list below answers many questions about participating in Computerworld's Best Places to Work in IT program. Additional questions can be emailed to bestplaces@computerworld.com.

 
About the Best Places to Work in IT program

Computerworld conducts an annual survey to identify the 100 best places to work for IT professionals. We invite Computerworld readers, PR professionals and other interested parties to nominate organizations they consider great employers for IT workers. We then ask those nominated organizations that meet our basic criteria to participate in our survey.

The employers in the Best Places list are ranked by company size: Large organizations have 5,000 or more U.S. employees; Midsize have between 1,001 and 4,999 U.S. employees; and small organizations employ 1,000 or fewer U.S. workers (keeping in mind that some companies may have a large global presence but only a small U.S. footprint).

To be eligible, organizations must have a minimum of 30 IT employees. Organizations based outside the U.S. must have a minimum of 300 total employees at a U.S. headquarters and a minimum of 30 IT employees at a U.S. headquarters. At least 50% of non-U.S. organizations' IT employees must be based in the U.S. We consider IT employees to be those IT workers who provide technology support and services to their own company -- or to multiple companies through their work at an IT service provider. Workers who would *not* be included are administrative support staff for the IT department, staff who work in communications or PR for the technology department, IT contractors, or those staff whose primary role is in product development for outside sales.

In most cases, we prefer to have the parent organization, rather than subsidiaries or affiliates, apply for the Best Places to Work in IT list. However, a subsidiary or affiliate may be eligible, providing that it stands out as a separate entity from the parent organization, with separate business functions, IT leadership and so on. A subsidiary may also be eligible to apply separately if its parent organization is a holding company. In those cases, the parent organization and subsidiary may be able to apply separately. We encourage organizations to complete the nomination form or contact us at bestplaces@computerworld.com, and our Best Places research team will evaluate the submissions on a case-by-case basis.

 
Organizations need not be nominated to complete the survey. Additionally, participating organizations must distribute an employee survey to a randomly selected sample of their IT staff as part of the survey process.

The Computerworld Best Places to Work in IT survey resides on a secure server, which prevents network transactions from being decoded, thus preserving the privacy of sensitive information.

Questions about Computerworld's Best Places to Work in IT program can be emailed to bestplaces@computerworld.com.

Frequently asked questions

• Survey requirements and eligibility

• Survey contents and procedures

• List publication and notification

Survey requirements and eligibility

Does my organization have to be nominated to complete the survey?

No. Organizations may participate even if they were not nominated. In lieu of a nomination, please send an email to bestplaces@computerworld.comwith the name and contact information (including email address) of the individual who should receive the company survey and other information; we'll take care of the rest.

Does the Best Places to Work in IT list include public companies only?

No. The survey includes private as well as public organizations.

What criteria must my organization meet to participate?

To be considered for our Best Places to Work in IT list:

• Organizations must have a minimum of 30 IT employees.

• Organizations based outside the U.S. must have a minimum of 300 total employees at a U.S. headquarters and a minimum of 30 IT employees at a U.S. headquarters. At least 50% of non-U.S. organizations' IT employees must be based in the U.S.

• In most cases, we prefer to have the parent organization, rather than subsidiaries or affiliates, apply for the Best Places to Work in IT list. However, a subsidiary or affiliate may be eligible, providing that it stands out as a separate entity from the parent organization, with separate business functions, IT leadership and so on. A subsidiary may also be eligible to apply separately if its parent organization is a holding company. In those cases, the parent organization and subsidiary may be able to apply separately. We encourage organizations to complete the nomination form or contact us at bestplaces@computerworld.com, and our Best Places research team will evaluate the submissions on a case-by-case basis.

Who should complete the survey?

An individual familiar with employment statistics, benefits, policies and programs of your IT department and your organization should complete the survey. This could be a human resources representative, a CIO or corporate PR representative -- or a team of all of the above.

Survey contents and procedures

What does the company portion of the survey ask?

Our online survey asks about organizations' benefits, training and development, average salary increases, percent of staff promoted, turnover rates, and the percentage of women and minority staff in management in IT departments. In addition, we will collect information on each organization's hot projects, mentoring programs and a variety of benefits ranging from elder care and childcare to flextime.

 
What does the employee portion of the survey ask?

The employee survey collects data on employee satisfaction with management, benefits, workplace culture, compensation and job duties.

Which employees are considered "IT workers" in this survey?

Answers to the survey should be based on those IT workers who provide technology support and services to their own company -- or to multiple companies through their work at an IT service provider. Workers who wouldn't be included are administrative support staff for the IT department, staff who work in communications or PR for the technology department, IT contractors, or those staff whose primary role is in product development for outside sales.

What happens if I leave a question blank on the survey?

You can't leave a question blank if it is required. Many of the questions on the survey are required; the survey can't be processed if they aren't answered. Please answer to the best of your ability for questions with lists or options included. If any open-ended/text based questions aren't applicable to your organization, please indicate "NA" for "not applicable." If there is a question you can't answer fully given the format of the survey, you may briefly explain your answers in an addendum field that follows each survey section.

Organizations that withhold information used to rank the finalists will have points deducted from their ranking. Answers that are left blank or have unexplained N/As will be assumed to be 0 (zero).

Organizations must provide answers to questions related to data we run in our feature story and graphics in order to be considered. Please see below for the types of required information that are typically published in the report.

Can I save my survey and come back to it at a later date?

Yes. You will be able to save your partially-completed survey, and can save a partially-completed survey as many times as necessary. Please save your unique ID and password in order to re-enter the survey. When you return to the survey, you will be able to review/modify questions that you have already answered. However, we will continue to provide a printer-friendly version of the survey, and we recommend that you complete this survey, then enter your answers online.

How should I send my organization's information to Computerworld?

We accept company information from the online survey only. Please enter all data as accurately as possible. Provide organization name, location, Web address and other information, as you would like it to appear in print.

Can I get a copy of the survey to review before I go to the online survey and submit my organization's information?

Yes. A printer-friendly version of the 2018 Best Places company survey can be viewed here, for reference. We encourage participants to complete this version offline before filling out the online survey.

download

2018 Best Places to Work in IT Company Survey

Computerworld

Will Computerworld provide us with a copy of our submitted survey?

Upon survey submission, Computerworld will email you a password-protected link to view your organization's survey responses.

What reports will be available to us?

For organizations that are named to the final list of 100, Computerworld will offer a custom benchmarking report with the organization's results compared to the average of all 100 Best Places and to other organizations in its size category, as well as the organization's aggregate employee survey results. Those reports will be available approximately one month after publication, for a fee.

Is there an employee portion to the survey?

Yes. Organizations will be asked to randomly select IT staff to complete an employee survey. Organizations may sample their entire IT staffs, if desired, or a representative portion, as long as the following requirements are met:

• Organizations with 1,000 or more IT employees will be required to gather completed survey responses from at least 15% of their IT staff.

• Organizations with between 500 and 999 IT employees will be required to gather completed employee survey responses from at least 20% of their IT staff.

• Organizations with between 80 and 499 IT employees will be required to gather completed employee survey responses from at least 30% of their IT staff.

• Organizations with fewer than 80 IT employees must gather at least 25 employee survey responses.

Organizations will be asked to document how they choose and contact their employees to take the survey. This portion of the survey is separate from the main company survey and will be available in January 2018.

A third-party research firm will receive the employee responses via a secure server. Responses can't be linked to specific employees, but only to your organization overall.

May we review the employee survey?

Yes. A printer-friendly version of the 2018 Best Places employee survey can be viewed here, for reference.

download

2018 Best Places to Work in IT Employee Survey

Computerworld

Is there a particular way we need to contact the employees we have randomly selected to participate in the survey?

Yes. Computerworld provides a sample letter that can be customized to tell employees they've been selected to complete the survey and explain the survey the survey to them.

download

Sample letter to employees Best Places to Work in IT 2018

Computerworld

Also, we provide sample text to serve as a reminder note about the survey.

download

Reminder letter to employees Best Places to Work in IT 2018

Computerworld

Once we contact our employees about the survey and send them the link to the survey, what do we do next?

Computerworld will determine the minimum number of respondents required based on the size of your IT staff, as outlined above. Once you send the employees a link, Computerworld will keep you up to date as to the number of employee responses we have received. Organizations will be responsible for meeting that minimum requirement. Throughout that process, companies can contact bestplaces@computerworld.com for updates on the number of employees who have filled out surveys.

Do we have to explain whom we chose to participate in the employee survey?

Yes. Participating organizations will be asked to read and fill out a short form (to be provided in January 2018).

Can we have the results to our employee survey?

Organizations that are named to the final list of 100 can receive a report, for a fee, that details results of their employee surveys if they meet a minimum response criterion and if the response base is not so small as to jeopardize employee anonymity. Please note: Results will be an aggregate of employee responses. Individual surveys won't be released.

List publication and notification

When will the list be published?

The 100 Best Places to Work in IT list is published annually in June in both the Computerworld digital magazine and online at www.computerworld.com.

When can I find out if my organization is on the list?

Computerworld notifies the organizations that make the Best Places list several weeks in advance of publication. Computerworld's marketing group contacts winners to offer assistance with press releases.

Is there a timeline to which I can refer for survey action items?

Below is the 2018 Best Places to Work in IT timeline.

Extended to Jan. 8, 2017

Nomination process is closed.

January 2018

The printer-friendly version of the Best Places company survey is made available on Computerworld's website. Nominated organizations receive an email with link to the Best Places survey from Computerworld by the end of the second week in January.

Friday, Jan. 19, 2018

Email rollout of employee survey information. Organizations that have COMPLETED the company portion of the survey will receive an email with a link to their organization's employee survey for distribution to selected employees. Organizations will also receive instructions on selecting a random sampling of IT staff as well as instructions on verifying the process used to select the employees and a sample cover letter.

Monday, Feb. 5, 2018

DEADLINE: Best Places company portion of the survey is due to Computerworld.

Thursday, March 1, 2018

DEADLINE: Best Places employee portion of survey is due to Computerworld. Letter that verifies employee selection process and cover letter is also due to Computerworld.

June 2018

Best Places to Work in IT list is published.

What information will be printed in the Best Places special report?

Computerworld tries to avoid printing information that an organization may consider competitive. The following information may appear in the digital magazine or online:

Please note that overall IT budget and other sensitive information will not be reported. Such information will be used only in aggregate format or for ranking purposes.

• • Organization name

  • Location

  • Industry

  • Website

  • Total number of employees

  • Total number of IT employees

  • Percentage of IT employee turnover

  • Percentage of IT employee promotions

  • IT training days

  • IT training budget

  • Paid time off after one year of service

  • Paid time off after 10 years of service

  • Percentage of employee’s health insurance premium paid for by the company

  • Information from a 300-word essay outlining what's special about your organization and IT department

When it comes to which programming languages are in demand by employers, JavaScript, Java, Python, C++, and C—in that order—came out on top in a recent developer survey. Developers, however, want to learn languages like Python, Go, and Kotlin.

A survey of developers by technical recruiter HackerRank, conducted in October, found no gap between languages employers want and what developers actually know, with JavaScript barely edging out Java. But as far as which languages developers prefer, Python is the language developers most want to learn—and many already know it, HackerRank found.

InfoWorld has you covered for all the hot languages

Go:

• Tap the power of Google’s Go language

• The best Go language IDEs and editors

Kotlin:

• What is Kotlin? The Java alternative explained

• Kotlin frameworks: A survey of JVM development tools

Python:

• What is Python? Everything you need to know

• Tutorial: How to get started with Python

• 6 essential libraries for every Python developer

Rust:

• What is Rust? The way to do safe, fast, and easy software development

• Learn how to get started with Rust in the InfoWorld tutorial

HackerRank also queried about which languages developers were planning to learn next. The top languages developers said they will learn were—in order—Go, Python, Scala, Kotlin, and Ruby.

Our new gaming site is live! Gamestar covers games, gaming gadgets and gear. Subscribe to our newsletter and we’ll email our best stuff right to your inbox. Learn more here.
HackerRank noted that language preference varies by industry. Java, for example, has been favored in financial services for years, while C dominates in hardware development.

 
HackerRank also found gaps in JavaScript frameworks between what employers want and what developers know:

• The React JavaScript UI library had the biggest delta between employers and developers, with about 37 percent of employers wanting React skills but only about 19 percent of developers having them.

• For Angular, the gap was less, with about 39 percent of employers wanting Angular skills and roughly 32 percent of developers having them.

• For Node.js, the gap was about  38 percent to 30 percent.

[ Need the skills that employers want? InfoWorld can help: InfoWorld’s tutorial on getting started with React. | Node.js tutorial: Get started with Node.js • 10 JavaScript concepts every Node developer must master.• The complete guide to Node.js frameworks • 7 keys to structuring your Node app. | Tutorial: Get started with Angular, the development platform for high-volume websites and apps. • What’s new in Angular 5. ]
Of the 39,441 developers surveyed, 7,000 were also technical hiring managers, whom HackerRank also questioned about recruiting.

Other findings in the report include:

• Developers are getting started early. More than a quarter of developers surveyed wrote their first code before age 16.

• Problem-solving skills are the most-sought by employers, more than language proficiency, debugging, and system design.

• While 67 percent of developers have computer science degrees, about 74 percent said they were at least partially self-taught.

• On average, developers know four languages but want to know four more.

This story, "Employers want JavaScript, but developers want Python" was originally published by InfoWorld.

IoT is going to expand on its current strengths in the coming year, broadening its presence in the industrial, energy and transportation sectors and continuing to see growing usage in fields like healthcare and retail.

Rohit Mehra, IDC vice president for network infrastructure research, said that those up-and-coming IoT sectors are getting new applications that make their deployment more attractive to end-users.

RELATED: REVIEW: Micirosoft Azure IoT suite | 7 Cool Internet of Things companies to watch

“Newer use cases and deployment across distributed enterprise, retail and logistics, healthcare and smart cities will provide increased momentum across these verticals,” he said.

 
According to Northeastern University Silicon Valley campus IoT program director Kilton Hopkins, one common theme for new IoT deployments in 2018 involves the coordination of high-value infrastructure that occupies relatively large geographical areas.

“Many verticals still have business operations that involve manual observation of equipment status, inventory levels, and other key metrics,” he said. “Where there is currently manual observation, there may be a great opportunity for a high-ROI project involving IoT. Some verticals that have a lot of manual observations are oil and gas, energy distribution, supply chain and telecommunications.”

Moreover, some companies that don’t necessarily deal with IoT in a line-of-business sense will see their engagement with the technology broaden, thanks to a growing presence in the smart buildings, according to Mehra.

“Increased drivers for ruggedized IoT deployments relating to building automation systems will help spur ‘indoor’ IoT deployments to complement various uutdoor initiatives like in energy, utilities and transportation,” he said.

 
Management is improving

Hopkins’ colleague, Northeastern University Silicon Valley dean P.K. Agarwal, said that large-scale management application is becoming more attractive in part because the technology around IoT is advancing quickly.

 “Device management and connectivity management has been around for several years already, but now that the pieces of IoT systems are coming together to form whole enterprise-scale solutions, management of these solutions has become higher up on the ‘tech wishlist’ for organizations,” he said.

Part of what’s going to shape that growth, according to a set of predictions from Forrester, is the change that’s coming to IoT services in 2018. There’s a wide range of different offerings out there, providing different capabilities – to design, integrate, and operate IoT systems – to different users. Those users, of course, all have different needs, which is what’s going to drive a realignment among the providers of those platforms, which include AWS IoT, Azure IoT, and GE Predix.

“[D]esigners using IoT to design … IoT into products and experiences need capabilities for remote product management, monitoring, and control,” said the researchers. “’Operate’ buyers need orchestration software that integrates their diverse set of IoT-enabled business assets into a cohesive business process that they can focus on running the business, not manually managing IoT bits.”

What’s more, those platforms will increasingly become partnerships between operational technology companies like GE and Siemens and cloud powerhouses like Amazon and Google, allowing both sets of players to focus on what they’re good at – mating operational expertise to IT scale and power.

“Customers running production workloads from their industrial IoT platform provider’s data center will rapidly become the exception, not the rule,” the researchers said.

Security still an issue

Several issues persist across the IoT landscape, of course, most notably security, of which awareness is, at least, starting to grow among IoT users. Nevertheless, it’s simply not cost-effective to secure every IoT implementation at the device level, and most experts agree that new approaches will be critical.

Paradoxically, however, IoT’s well-known security issues aren’t stopping companies from deploying them to actually help with non-digital security – a Spiceworks survey released earlier this month found that physical security was the number-one driver of IoT adoption among IT professionals working with IoT.

 
Marketing technology, as well, is a potential major driver of IoT growth in 2018, according to the Forrester researchers. Business-to-consumer marketing hasn’t been a traditional area of strength for IoT, but that could be set to change.

“The hype around and growing adoption of intelligent agents like Amazon Alexa and Google Assistant in more and more devices will open marketers’ eyes to new ways of interacting with customers more than any other recent technology has — including wearables,” the researchers said.

;

Logitech's K400 Wireless Keyboard for internet-enabled TVs is designed to be compact, comfortable, quiet, and easy to use from the comfort of your couch. It features a familiar key layout and a large 3.5-inch touchpad. A 33-foot range makes for a trouble free connection even in large rooms, and its battery is strong, lasting up to a year and a half without needing a charge, even with 2 hours of typing per day. The keyboard averages 4.5 out of 5 stars on Amazon from over 1,700 customers (read reviews). It's regular list price of $39.99 has been reduced by 30% to just $27.99. See the discounted K400 wireless keyboard now on Amazon.

Thanks to the Mirai botnet attacks, few people in the world of tech need a reminder that IoT devices remain a serious threat to enterprise networks. Still, more than a year after the botnet made headlines worldwide, IoT security remains mostly an idea, rather than a reality.

Such is the scope of the problem that Frost and Sullivan IoT research director Dilip Sarangan argues for governmental intervention. Sarangan says that, because the responsibility for IoT security is diffused across device manufacturers, network providers, software developers and many others, it’s difficult for the industry to make progress on all-encompassing standards.

+ALSO ON NETWORK WORLD: Review: VMware’s vSAN 6.6 + Red Hat responds to the Intel processor flaw

“The only entity that has the ability to actually dictate what the minimum threshold is, unfortunately, is the U.S. government,” he said.

 
The difficulty in creating overarching standards mostly has to do with the fact that any given IoT implementation has a large number of moving parts, each of which may be administered by different organizations, or even by third parties. For example, a set of medical devices provided by company A connecting to a network provided by company B, running an application, originally written by company C and residing in company D’s cloud.

“Everyone talks about it like they’re going to provide end-to-end security, and there’s actually no way to do that,” said Sarangan. “You have no control over a lot of parts of an IoT solution.”

Network visibility

From the networking side, Sarangan said, there are plusses and minuses to most of the options available to any given IoT implementation. Cellular networks, for example, tend to be a lot more secure than Wi-Fi, ZigBee or the other wide-area options, but a company will probably have much more limited visibility into what’s happening on that network.

That, in and of itself, can be a security issue, and it’s imperative for the carriers to provide more robust device management features in the future.

 
“What type of device it is, what type of information it’s supposed to send, where it’s supposed to send the data, what you are supposed to do with that data – until you know all of that, it’s hard to be completely secure,” said Sarangan.

Improved network visibility is key to preventing worst-case scenarios like malicious actors accessing power grids and Internet infrastructure, but so are common-sense measures like air gaps.

“You have the hacks happening, but the hacks haven’t been significant enough to where you’d worry about it,” he said. “The other side of it is that a lot of critical infrastructure – let’s say a smart grid – is on private networks.”

A sea of IoT devices

A lack of quality control and the presence of a host of very old devices on IoT networks might be the most critical security threats, however. Decades-old hardware, which may not have been designed to be connected to the Internet in the first place, let alone stand up to modern-day security threats, creates a serious issue.

“You have over 10 billion IoT devices out there already … and a lot of these devices were created in 1992,” noted Sarangan.

Moreover, the huge number of companies making IoT-enabled hardware makes for a potentially serious problem where quality control is concerned. Big companies like Amazon and Microsoft and Google make headlines for their smart home gizmos, but the world of IoT is a lot broader than that.

China, in particular, is a major source of lower-end IoT devices – speakers, trackers, refrigerators, bike locks and so on – and it’s not just the Huaweis and Xiaomis of the world providing the hardware.

“[There are] hundreds of mom-and-pop shops out there developing hardware that we don’t necessarily know whether to trust or not – these are devices that are getting on unsecured Wi-Fi networks,” said Sarangan. “That’s already a security threat, and a large portion of Americans don’t actually protect their routers.”

As the explosive growth of IoT tech continues; businesses, vendors and consumers all have to confront the issue that the world is more connected than ever before, with potentially gigantic consequences.

The central problem with IoT security is that there is no central problem – IoT is a more complicated stack than traditional IT infrastructure and is much more likely to be made up of hardware and software from different sources.

+ALSO ON NETWORK WORLD: Review: VMware’s vSAN 6.6 + Configuration errors in Intel workstations being labeled a security hole

Our new gaming site is live! Gamestar covers games, gaming gadgets and gear. Subscribe to our newsletter and we’ll email our best stuff right to your inbox. Learn more here.

There are three main areas of IoT security – devices, network, and back-end. All of them are potential targets, and they all require attention, according to Forrester principal analyst Merritt Maxim. Right now, devices are getting the bulk of the attention – the huge number of different manufacturers, some of whom haven’t worked very hard to make their products secure, makes device-level IoT security problematic.

“You don’t have the Wintel monopoly you have in the desktop world, which makes a more homogeneous environment,” said Maxim. “Generally [IoT] devices are running embedded Linux or various flavors of that, which creates security blind spots,” since those operatings systems might not be what IT security pros are used to working with.

What’s more, most of the IoT players that are actively focusing on security are approaching it at the network or back-end level – not on the devices themselves, according to Stacy Crook, IDC’s research director for IoT.

“There’s a point to which these guys can get down deep in the device, but they have to figure out how much investment they want to make there because … there’s so many different device types and different architectures,” she said. “So they have to figure out how much of their time do they really want to spend.”

Addressing the threat

Specialist security firms are doing their best to keep pace with the changing nature of the IoT security threat. Companies like Pwnie Express – which got its start making penetration testing devices – have tried to adapt to the new threat landscape.

“In the early days, [test devices] were things like [fake] wall plugs, and they worked harder at making sure they were disguised, since the pen tester didn’t want to make it obvious that the environment was under test,” recounted Matt Williamson, CTO of Pwnie Express.

The latest and greatest, however, is a module that sits in a customer’s data center and monitors Wi-Fi, Bluetooth, and a host of other wireless network types for unusual traffic, since the network is a major potential target for malicious hackers.

Yet it can be difficult to focus security efforts, according to Williamson, with different customers worrying about different parts of the network.

“Because we’ve got a fairly broad set of things that we cover, it’s tough to put a finger on which ones are more important,” he said. “Some of our customers are more concerned about Bluetooth … Bluetooth TVs, and so on. Other people are more worried about rogue access points.”

These issues aren't unique to IoT, but they're relevant nonetheless – so much so that Pwnie's corporate focus is squarely on IoT as it applies its pen testing expertise to the increasingly broad array of devices present on corporate networks.

Polls: IoT Security is a major issue

The IT world has, at least, obtained an awareness of the scale of the problem it faces, according to several recent surveys. Pwnie’s 2017 Internet of Evil Things report, which surveyed 800 security professionals, found that fully 84% of respondents said that the Mirai botnet incident – which saw vast numbers of poorly secured IoT devices, primarily digital security cameras, harnessed into a powerful botnet used in DDoS attacks – in 2016 had changed their view of IoT security threats. 92% said the problem will remain a major issue.

Part of the problem seems to be that efforts to address it are still in the early stages – just 23% of security pros who monitored the connected devices entering their offices said that they scanned them for malicious code, and two-thirds of respondents said they weren’t sure of the total number of connected devices being brought onto their networks.

A poll of 500 executives conducted by Forbes concurred, finding that respondents ranked IoT as the most important emerging technology, outpacing even robotics and AI. A third of the respondents said that security is the most serious problem facing IoT.

According to Maxim, part of the reason for that is that the consequences of IoT hacking are potentially a lot more serious than those of traditional computer crime – a 2012 scene from the TV series Homeland, which saw a character die when his pacemaker was hacked is anything but far-fetched, he said.

“That’s not a theoretical attack, that’s possible today – and that’s a different dynamic than the traditional online world, where it’s just about identity theft or payment information for monetary gain,” said Maxim. “IoT hacking can cause potential loss of life.”

Common platforms link devices to the backend

The traditional way of connecting IoT devices to the back end was with customized platforms, but now a majority – 57% – of IoT deployments use platforms that can be applied to most deployment scenarios, according to Crook’s research.

Google and Microsoft are raising the profile of this option with their service offerings Google Cloud and Azure IT that provide such platforms.

“It’s really the idea about leveraging a common platform to build these IoT applications across different use cases, instead of having to create a custom platform for every single different IoT use case,” she said.

There are security ramifications, mostly positive, to the increasing use of these platforms – Crook’s recent research said that 57% of IoT deployments are using this type of platform – and most of them center on the edge layer, a new part of the stack that sits between the endpoint devices and the data center. An example would be a hub device that analyzes data and does low-level management of connected devices on a factory floor.

Edge computing is an important concept for IoT, because many applications – particularly those that are highly delay-intolerant – can’t wait for data to make the cycle all the way from the endpoint to the data center and back again before action is taken. Hence, IoT hubs and other devices will take up some of the computational and management slack – and add an additional place in the stack that security features can be implemented.

“Increasingly, [data is] going to be collected at the edge,” said Crook. “It could be on a factory floor, for instance, and there are going to be more and more of these edge devices collecting data.”

More broadly, she added, an IoT platform is an architecture created with security in mind but not as the main focus. There are threat detection capabilities available, but they’re usually sold as add-on services, not as core components of the platform.

“IoT security is definitely going to be an ecosystem approach,” said Crook. “The platform providers will work with other security companies on providing full solutions, but I think the platform certainly plays a key role in security.”

Recommended actions

There’s a limited amount of action that most IoT users can take, according to Maxim, but the most important steps at the device level are:

Never using devices with default passwords.

Ensuring that there’s a way to patch everything – a device that can’t be patched remotely, once compromised, is now a part of the “Internet of Bricks.”

But attacks are likely to continue, which could have far-reaching consequences down the road.

“We have started to see fines levied against medical device companies and others for privacy violations, so there is some regulatory heat there,” Maxim said. “Unfortunately, we probably need a couple even higher-profile compromises to get to a point where it’s regulated or get the industry to act.”

In the future, we may see systems that are more fundamentally security-oriented, according to the CEO of blockchain-based IoT security startup Xage, Duncan Greatwood - who noted that they could look very different than previous-generation technology.

A lot of people outside China ask whether the government there is going to shut down the corporate VPNs of international companies with facilities in China. How will the new Chinese cybersecurity law impact foreign IT operations in the country? Is it safe to transfer information into and out of China?

To answer, let’s start with the Great Firewall of China (GFC), which has a big impact on what information is allowed to move in and out of the country. The GFC is a combination of government policies and advanced telecom equipment deployed by the main Internet Service Providers in China. It is intended to safeguard the national security and the best interests of China.

Its basic function is that of a filter. It determines which packets can traverse it and which are blocked. Anybody visiting China can see it in action, as sites like Google, Facebook and Twitter are not accessible via the Chinese Internet.

Our new gaming site is live! Gamestar covers games, gaming gadgets and gear. Subscribe to our newsletter and we’ll email our best stuff right to your inbox. Learn more here.

But the GFC is much more than that. Besides filtering specific URLs, it can also block specific content or divert users to alternative sites. Moreover, it uses Deep Packet Inspection (DPI) technologies to analyze traffic flowing in and out of China.

VPNs vs The Great Firewall of China

However, the GFC cannot access encrypted content like that within IPSec tunnels. And that is where VPNs that are illegal under Chinese law come into play: There are many applications that leverage encryption technologies to gain access to content that is restricted in China. 

VPNs disguise the traffic flowing through the GFC, making it seem as if it is permitted information exchange with destinations in other parts of the world that the GFC allows. Once tunneled to those foreign locations, the users can access any web content available on the global internet.

Nonetheless, the GFC collects a lot of information, like source and destination addresses, quantity of data flowing in each direction and, based on protocols and/or traffic patterns, infers the nature of the information being transmitted, such as web content, voice communications, video streaming, etc.

Therefore, it is only a matter of time until illegal VPNs are pinpointed, their URLs and IP address are blocked, and they are shut down completely. But then new ones appear, more sophisticated and difficult to track down. And so a decades-old cat-and-mouse game continues.

Corporate VPNs vs The Great Firewall of China

Multinationals set up VPNS to connect their Chinese locations with other global locations. They are not targeted if they are used to enable employees inside and outside of China to communicate among themselves and to access corporate and SaaS applications for legitimate business purposes.

However, if these corporate VPNs run over the Public Internet they can be negatively impacted by the GFC’s workings. The network controls applied by the GFC combined with the sheer quantity of Internet users in China creates a lot of congestion, which translates into degraded connection performance.

Besides, there is always the risk of corporate VPNs being mistakenly confused with illegal VPNs, being flagged as potentially breaching the new cybersecurity regulations, or being affected by internet content provider (ICP) registration requirements. 

The Chinese cybersecurity law requires all data generated in China that is private – personal ID, bank accounts, etc. – or “important” – related to national security, economic development or public interest – to remain within the boundaries of the country. 

Thus, a high volume of asymmetric data leaving the country might raise concerns. On the other hand, a high volume of asymmetric data entering the country might conform to the traffic patterns exhibited by illegal VPNs and trigger their shutdown.

Making web content available or running e-commerce operations in China requires going through the processes of ICP filling or ICP registration, respectively. Thus ports 80, 8080, 443 and 8443 are normally blocked and so are VPNs that might use them, such as SSL VPNs.

How to comply with China’s VPN regulations

So what can multinational corporations with operations in China do to ensure the continued operations of their corporate VPNs and their compliance with Chinese regulations? Below a few alternatives and suggestions.

Companies should consider a dedicated internet access (DIA) service as opposed to standard xDSL/xPON/HFC internet service in China. This would reduce the impact on performance caused by congestion and processing delays that occur at the lowermost layers of the GFC.

When possible, it is always advisable to consider hosting an instance of business-critical applications, including those that require a high level of performance for end user experience, within private data centers or public cloud environments located inside China.

Multinational corporations should work directly with ISPs and telecom carriers that are authorized to provide corporate VPN services. This provides a level of transparency so the Chinese government knows the actual end user of those services and the nature of the business.

New technologies like SD-WAN-based tunnels from authorized providers are subject to minimum performance impact from GFC controls and can allow access to multiple SaaS and public cloud services hosted outside of China for internal business use.

High-end private network VPN solutions like MPLS do not go through the GFC filters but must only be used for internal business and adhere to Chinese cybersecurity regulations.  Note: It is illegal to resell VPN services in China without government authorization.

Global carriers often buy MPLS services from authorized providers and terminate them at some location outside mainland China, typically Hong Kong or Tokyo, where they integrate them with their own networks. However, this network architecture is not optimal nor fully transparent to the government.

Therefore, is advisable to deploy corporate VPNs, whether Internet-based, SD-WAN or MPLS from Chinese locations all the way to corporate headquarters, data centers and/or public cloud environments, using authorized providers to ensure regulatory compliance and business continuity.

Jacinto Cordero is a Regional Sales Manager for China Telecom Americas and before that worked as Solutions Sales Expert for Huawei Technologies.

This story, "How to use VPNs in China without breaking the law" was originally published by Network World.

What is the Julia language?

Created in 2009 by a four-person team and unveiled to the public in 2012, Julia is meant to address the shortcomings in Python and other languages and applications used for scientific computing and data processing. “We are greedy,” they wrote. They wanted more: 

Our new gaming site is live! Gamestar covers games, gaming gadgets and gear. Subscribe to our newsletter and we’ll email our best stuff right to your inbox. Learn more here.

We want a language that’s open source, with a liberal license. We want the speed of C with the dynamism of Ruby. We want a language that’s homoiconic, with true macros like Lisp, but with obvious, familiar mathematical notation like Matlab. We want something as usable for general programming as Python, as easy for statistics as R, as natural for string processing as Perl, as powerful for linear algebra as Matlab, as good at gluing programs together as the shell. Something that is dirt simple to learn, yet keeps the most serious hackers happy. We want it interactive and we want it compiled.

(Did we mention it should be as fast as C?)

Here are some of the ways Julia implements those aspirations:

• Compiled, not interpreted, for speed. Julia is just-in-time (JIT) compiled using the LLVM compiler framework. At its best, Julia can approach or match the speed of C.

• Straightforward but useful syntax. Julia’s syntax is similar to Python’s—terse, but also expressive and powerful.

• Dynamic typing with static type benefits. You can specify types for variables, like “unsigned 32-bit integer.” But you can also create hierarchies of types to allow general cases for handling variables of specific types—for instance, to write a function that accepts integers generally without specifying the length or signing of the integer. And, finally, you can do without typing entirely if it isn’t needed in a particular context.

• Python, C, and Fortran libraries are just a call away. Julia can interface directly with external libraries written in C and Fortran. It’s also possible to interface with Python code by way of the PyCall library, and even share data between Python and Julia.

• Metaprogramming. Julia programs can generate other Julia programs, and even modify their own code, in a way that is reminiscent of languages like Lisp.

Julia vs Python: Julia language advantages

Julia was designed from the start for scientific and numerical computation. Thus it’s no surprise that Julia has many features advantageous for such use cases:

• Faster by default. Julia’s JIT compilation and type declarations mean it can routinely beat “pure,” unoptimized Python by orders of magnitude. Python can be made faster by way of external libraries, third-party JIT compilers (PyPy), and optimizations with tools like Cython, but Julia is designed to be faster right out of the gate.

• A math-friendly syntax. A major target audience for Julia is users of scientific computing languages and environments like Matlab, R, Mathematica, and Octave. Julia’s syntax for math operations looks more like the way math formulas are written outside of the computing world, making it easier for non-programmers to pick up on.

• Automatic memory management. Like Python, Julia doesn’t burden the user with the details of allocating and freeing memory, and it provides some measure of manual control over garbage collection. The idea is that if you switch to Julia, you don’t lose one of Python’s common conveniences.

• Parallelism. Math and scientific computing thrive when you can make use of the full resources available on a given machine, especially multiple cores. Both Python and Julia can run operations in parallel. But Julia’s syntax is slightly less top-heavy than Python’s, lowering the threshold to its use.

Python vs Julia: Python advantages

Python is a general-purpose computing language that is easy to learn, and that has developed into a leading language for scientific computing. Some of the reasons Python may still be the better choice for data science work:

• Julia arrays are 1-indexed. This might seem like an obscure issue, but it’s a potentially jarring one. In most languages, Python and C included, the first element of an array is accessed with a zero—e.g., string[0] in Python for the first character in a string. Julia uses 1 for the first element in an array. This isn’t an arbitrary decision; many other math and science applications, like Mathematica, use 1-indexing, and Julia is intended to appeal to that audience. It’s possible to support zero-indexing in Julia with an experimental feature, but 1-indexing by default may stand in the way of adoption by a more general-use audience with ingrained programming habits.

• Julia is still young. The Julia language has been under development since 2009, and has undergone a fair amount of feature churn along the way. It still doesn’t have a 1.0 release, although the developers are getting close.

• Python has far more third-party packages. The breadth and usefulness of Python’s culture of third-party packages remains one of the language’s biggest attractions. Again, Julia’s relative newness means the culture of software around it is still small. Some of that is offset by the ability to use existing C and Python libraries, but Julia needs libraries of its own to thrive.

• Python’s huge community is a huge advantage. A language is nothing without a large, devoted, and active community around it. Python enjoys just such a community right now. The community around Julia is enthusiastic and growing, but it is still only a fraction of the size of the Python community. 

Fueled by a capital injection of $263 million making it the first cloud-native data warehouse startup to achieve "unicorn" status, Snowflake is set this year to expand its global footprint, offer cross-regional, data-sharing capabilities, and develop interoperability with a growing set of related tools.

With the new round of funding, announced Thursday, Snowflake has raised a total of $473 million at a valuation of $1.5 billion. Founded in 2012, the company has become a startup to watch because it has engineered its data warehouse from the ground up for the cloud, designing it to remove limits on how much data can be processed and how many concurrent queries can be handled.

What is Snowflake?

Snowflake at its core is essentially a massively parallel processing (MPP) analytical relational database that is ACID (Atomicity, Consistency, Isolation, Durability) compliant, handling not only SQL natively but also semistructured data in formats like JSON by using a VARIANT custom datatype. The marriage of SQL and semistructured data is key, because enterprises today are awash in machine-generated, semistructured data.

Our new gaming site is live! Gamestar covers games, gaming gadgets and gear. Subscribe to our newsletter and we’ll email our best stuff right to your inbox. Learn more here.
With a unique three-layer architecture, Snowflake says it can run hundreds of concurrent queries on petabytes of data, while users take advantage of cloud cost-efficiency and elasticity -- creating and terminating virtual warehouses as needed -- and even self-provisioning with no more than a credit card and about the same effort it takes to spin up an AWS EC2 instance.

  Snowflake
Snowflake can store diverse datatypes.

While the Snowflake on Demand self-service option may be particularly enticing to smaller and medium-size businesses (SMBs), Snowflake is well-positioned to serve big enterprises, such as banks, that are moving to the cloud, says CEO Bob Muglia, a tech veteran who spent more than 20 years at Microsoft and two years at Juniper before joining Snowflake in 2014.

"It turns out that the data warehouse is one of the pivot points, a tentpole thing, that customers have to move because if the data warehouse continues to live on premises a massive number of systems surrounding that data warehouse will continue to live on premises," Muglia says.

And even well-funded, big enterprises like banks are attracted to cloud cost-efficiencies, Muglia points out. "If you've got some quant guy who wants to run something and all of a sudden needs a thousand nodes and needs it for two hours, it's kinda nice to be able to do that really quickly then have it go away versus paying for them 365 days a year."

Snowflake will expand globally

At the moment Snowflake runs on Amazon in four regions: US West, US East, Frankfurt and Sydney. It will be running in another European region within weeks, Muglia says. The capital infusion will enable the company to add Asian and South American regions within a year, he added. Within that timeframe the company also plans to:

 
-- Add the ability to do cross-region data replication. Right now, Snowflake's Data Sharehouse allows for real-time data sharing among customers only within an Amazon region. The ability to replicate across continents should open up doors to global enterprises.

-- Run on another cloud provider. Muglia has been coy about which provider it will be, but concedes it's likely to be Microsoft Azure. Cross-provider replication is also in the works, Muglia says.

-- Continue to work on the system's ability to interoperate with various tools that its customers use. Customers often use certain database tools and add-ons for years, even after vendors stop updating them, and customers want new systems to work with them.

The list of cloud data warehouse rivals grows

There are, however, a gaggle of players vying to be the online data warehouse of choice for enterprises. Snowflake must contend with, for example, Microsoft Azure's SQL Data Warehouse, Google's BigQuery and Cloud SQL -- where users can run Oracle's MySQL -- as well as RedShiftfrom Amazon itself.

But Muglia contends that Snowflake's unique architecture allows it to scale way past traditional SQL databases, even when they are run in the cloud. In addition, its does not require special training or skills, such as noSQL alternatives like Hadoop.

Most of the traditional databases, as well as RedShift and many noSQL systems, use shared-nothing architecture, which distributes subsets of data across all the processing nodes in a system, eliminating the communications bottleneck suffered by shared-disk systems. The problem with these systems is that compute cannot be scaled independently of storage, and many systems become overprovisioned, Snowflake notes. Also, no matter how many nodes are added, the RAM in the machines used in these systems limits the amount of concurrent queries they can handle, Muglia says.

"The challenge that customers have today is that they have an existing system that's out of capacity, it's overtaxed; meanwhile they have a mandate to go to the cloud and they want to use the transition to the cloud to break free of their current limitations," Muglia says.

Snowflake
Snowflake is designed to solve this problem by using a three-tier architecture:

 
-- A data storage layer that uses Amazon S3 to store table data and query results;

-- A virtual warehouse layer that handles query execution within elastic clusters of virtual machines that Snowflake calls virtual warehouses;

-- A cloud services layer that manages transactions, queries, virtual warehouses,  metadata such as database schemas, and access control.

This architecture lets multiple virtual warehouses work on the same data at the same time, allowing Snowflake to scale concurrency far beyond what its shared-nothing rivals can do, Muglia says.

One potential problem is that the three-tier architecture might led to latency issues, but Muglia says that one way the system maintains performance is by having the query compiler in the services layer use the predicates in a SQL query together with the metadata to determine what data needs to be scanned. "The whole trick is to scan as little data as possible," Muglia says.

But make no mistake: Snowflake is not an OLTP database and it's only going to rival  Oracle or SQL Server for work that is analytical in nature.

Meanwhile, though, it's setting its sights on new horizons. "In terms of running and operating a global enterprise having a global database a very good thing and that's where we're going," Muglia says.

Snowflake's latest venture capital round was led by ICONIQ Capital, Altimeter Capital and newcomer to the company, Sequoia Capital.

Now: https://www.amazon.com/Block-Software-Deluxe-Refund-Download/dp/B075XZZQ4D/ref=sm_n_au_dka_RO_pr_tex_0_0_nodl?adId=B075XZZQ4D&creativeASIN=B075XZZQ4D&linkId=c358c1defe892ceb7a00541dca66a08f&tag=httpwwwidgcsm_itnrecrrdpmod-20&linkCode=w41&ref-refURL=https%3A%2F%2Fwww.itnews.com%2Farticle%2F3247666%2Fsoftware%2F33-off-handr-block-tax-software-deluxe-federal-and-state-2016-deal-alert.html&slotNum=0&imprToken=jrtu-7BQNOs3cyC94Wlx.Q&adType=smart&adMode=auto&adFormat=grid&impressionTimestamp=1516990787333