Category: Business

Cloud Girls is honored to have amazingly accomplished, professional women in tech as our members. We take every opportunity to showcase their expertise and accomplishments – promotions, speaking engagements, publications and more. Now, we are excited to shine a spotlight on one of our members each month.

January Cloud Expert of the Month is Jean O’Neill
Jean O’Neill, Vice President of Channel at Cyxtera, has over 20 years of technology industry experience with deep expertise within Channel.  She was instrumental in building the Channel Programs at Rackspace, Terremark/Verizon, and Involta.  Additionally, she has counseled, mentored and supplied Channel consulting to companies in their initial stages, laying proper foundations to insure successful Channel/Alliances programs.  O’Neill is an early and active member of Cloud Girls who are advocates dedicated to educating themselves and their stakeholders about the vast and dynamic cloud ecosystem.  She is a Magna Cum Laude graduate of Kennesaw State University.

What do you value about being a Cloud Girl?
The sorority and support of women who I hold in such high esteem.

What advice would you give to your younger self at the start of your career?
You may not have chosen the easy path, but you chose the right path.

What is the best professional/business book you’ve read and why?
“Now, Discover Your Strengths” by Donald O. Clifton & Marcus Buckingham because it greatly contributed to the realization that my time and efforts are best used sharpening my strengths while identifying others to utilize their strengths to augment mine..[…] Read more »…..

The new year promises big changes in Agile methodologies and applications. Here’s a look at what to expect.

The Agile concept has come a long way over the past several years, taking its place as a firmly established set of software development methodologies. Yet Agile continues to evolve and mature, as experience leads to improvements, refinements, and new uses.

Looking forward to 2020, Scott Ambler, vice president and chief scientist of disciplined Agile at the Project Management Institute (PMI), a global nonprofit professional organization for project management, expects Agile to grow even more rapidly. “Agile isn’t just a trend; it’s here to stay, especially as we better learn how to effectively yield its benefits,” he said.

The new year also promises an increased focus on agility at scale, as well as better ways of integrating business delivery into engineering teams, predicted Casey Gordon, director of Agile engineering at Liberty Mutual Insurance. “Where, before, application development teams were handed work from upstream business-centric efforts, there’s a shift to move that work closer to the development teams to help reduce lead time,” he explained. “This may mean organizational alignment and structure changes, while portfolio management and executive teams that were previously planning through longer cycles will see those cycles reduced to quarterly or even monthly,” he added.

Steve Myers, managing director of Accenture’s Industry X.0 emerging, connected and smart technologies practice, noted that enterprises are also prepared to externalize more development capabilities. “Doing so will overturn the traditional approach, where all physical development was carried out in-house,” he stated. “After all, wherever else specialist expertise is required, such as in law or accounting, businesses turn to external experts for their toughest challenges, so why not for development of innovative products?”

SAFe at home

Gina Casamassima, vice president of the federal health division of management consulting firm Apprio, sees Agile moving toward more formal structures, such as Scaled Agile Framework SAFe 5.0. The changeover won’t be easy, however. “Corporations and government entities know they need to transform, but there are challenges in incorporating old managerial styles and structure into SAFe,” she warned. “SAFe 5.0’s focus on business agility requires that business and technology leaders are in sync with development and IT operations,” Casamassima added that business and management leaders should also utilize lean and Agile practices to ensure that the enterprise remains competitive and innovative.

Beth Phalen, president of Dell Technologies’ Dell EMC Data Protection unit, believes there will be greater recognition of Scrum@Scale in 2020. “Business leaders will more aggressively seek out how they need to change as they, too, embrace the Scrum simplicity and power,” she said. As for coders, they will need to keep their product in shippable product quality, always at scale. Coders will also increasingly find themselves collaborating and validating well beyond the confines of their Scrum teams. “They will need to work closely with business leaders on the right methods and investments to shift over to Scrum@Scale,” she explained.

The upcoming year should also see growing adoption of larger-scale Agile initiatives. “It’s been a slow burn, but the idea of extending Agile from individual Scrum teams to large-scale programs is really gathering steam,” observed Oliver Merkle, delivery director at Agile software developer Nexient. “Organizations that have adopted small-scale Agile have seen the benefits, and they’re comfortable with the basic principles,” he observed. The next big leap, he noted, will be to apply those principles at scale.

Agile for all?

Recent years have seen Agile practices flow out of IT and into various business departments, leading to Agile Engineering, Agile Human Resources and Agile Marketing organizations, among others. This expansion is likely to continue at an even faster pace in 2020. “We will see the original values and principles of Agile software development applied to new departments, like Agile Customer Service,” said Scott Abate, Agile project manager at digital business solutions provider Anexinet. “These new adopters will undergo transformations and reap the benefits of agility and adaptability in their own dynamic business environments,” he predicted.

Enterprise Agile is reshaping the way enterprises do business, Merkle observed. “Agile is the best way anyone has found to create products that serve customers and drive business value,” he said. “The principles of constant feedback and rapid iteration are just as valid at the enterprise scale as they are for smaller organizations.”..[…] Read more »…..

There is universal acceptance of the need to be cyber threat resilient—anticipating, preparing for and responding to events and adapting these efforts to continuously changing threat profiles. Creating the security-minded organizational culture needed to achieve resilience remains elusive. One challenge is that the human elements of commitment, collaboration and education are often overlooked. If your cyber risk management efforts remove key human elements from the “machine,” you might accomplish compliance but not resilience.

Kurt Lewin, the father of modern social psychology, put it best: “If you want truly to understand something, try to change it!” Below are three key “resilience killers” from lessons learned over years of working to change organizational mindsets to establish resilience. These are behaviors you should strive to avoid when maturing your cybersecurity capabilities.

1. Lack of commitment. Many organizations address resilience as a stand-alone goal, compartmentalizing cyber resilience as a network management priority and moving it down the list past revenue and profitability, growth and acquisition, cost control and talent strategy. Leadership needs to recognize that cyber resilience is an underlying element that supports all business priorities. Technology solutions need to connect to the people, processes and protocols that drive business. The impacts of a cyber event are not siloed in one area of the company. Direct costs (forensics, legal fees, compensation for personal data compromise, theft of financial assets), operational costs (systems and service delivery disruptions) and cost of decreased customer confidence all result in lost time, productivity, revenue and possibly executive jobs across lines of business.
2. Static risk management. Intending to manage risk proactively is of little use if your organization cannot let go of “our way” or “the way it’s always been done.” Being dynamic requires agility – the willingness to change quickly and efficiently to meet emerging threats and think differently about your risk environment and security profile. Companies become static when they define strategies based solely on subjectively measured risks coming from independent operating units and fail to incorporate how the executive team looks at overall risk. Executive risk assessment of core functions should be paired with traditional business impact analysis at the process level, putting the greatest focus on the areas deemed the highest risk by senior leaders. This top-down approach creates an opportunity for IT to educate the business on how the application of technology addresses risk and enlightens IT leaders on when to tighten/loosen specific recovery objectives to satisfy business requirements…[…] Read more »….

Most businesses now have an IT infrastructure that makes use of multiple cloud services providers. A new study from Business Performance Innovation (BPI) Network finds that multi-cloud security has become the biggest immediate IT challenge for businesses, as the authorization and authentication handoffs between these different services provide ample opportunity for things to go wrong.

Mapping multi-cloud architecture with BPI

The mass movement of businesses to a multi-cloud provider model can be traced back to a number of things: a desire to not be locked in to one vendor’s products, lack of necessary tools from a single vendor (or that vendor not offering those particular tools at a competitive price point), and network improvements such as lower latency and downtime.

There is, however, a widespread errant belief that somehow a multi-cloud setup is inherently more secure. This can be true, but only if sensitive data is exclusively stored on and accessed from a private part of the cloud that is properly monitored and managed by IT staff. What tends to happen in reality is that these disparate cloud components end up being difficult to integrate and train company personnel on. This leads to all sorts of mishaps, from misconfigured storage buckets being breached to vendors being given access to a much higher level of sensitive data than is required.

These are some of the themes seen in BPI’s “Mapping the Multi-Cloud Enterprise,” a survey of the multi-cloud security practices of 127 business and IT decision-makers at a mix of international companies of varying sizes. The survey revealed that 8 out of 10 businesses have implemented a multi-cloud infrastructure, and just over half of these have moved more than half of their applications to the cloud. Over the next two years, 84% expect to increase their use of public or private clouds and only 2% planned to decrease their use. 52% are planning to incorporate additional cloud services in the near future, with only 13% ruling out the possibility.

Though these businesses seem to almost universally be shifting to a multi-cloud approach, only 11% rated their transition as “highly successful.” Multi-cloud security is the #1 issue cited. These companies reported difficulty in juggling all of these cloud services, finding and training personnel capable of securely managing them, troubles with automation and performance, visibility issues and issues with scaling among their central problems.

63% of the companies named multi-cloud security as one of their top challenges. Specific security needs were led by centralized authentication (62%), centralized security policies (46%), web application firewalls (40%) and DDoS protection (33%).

Only 9% of the companies surveyed reported being “extremely satisfied” with the current state of their multi-cloud security. The vast majority of respondents (82%) were either currently re-assessing their security and cloud services suppliers or are at least considering such an evaluation. The majority (51%) reported either only being “somewhat successful” with their cloud implementation or entirely unsuccessful.

Two-cloud (36%) and three-cloud (17%) setups are the most common multi-cloud configurations. About 10% of respondents have adopted four or more cloud services as part of their digital transformation.

Multi-cloud security: Incompatible with complexity?

Complexity and security are two concepts that are always inherently tough to reconcile. As Dave Murray, BPI research chief put it: ““IT and business leaders are struggling with how to reassert the same levels of management, security, visibility and control that existed in past IT models.”

The most common multi-cloud security issue is the potential for misconfigurations, and the temptation to simply weaken authorization processes to make sure everything moves from one app to another smoothly. The more disparate cloud components added, the more that visibility also becomes a problem. This is often the reason that unsecured data buckets are found and breached online.

Another underlooked (but potentially serious) issue that impacts enterprises worldwide is the increased burden of regulatory and legal compliance expenses, particularly in regions such as the EU that require extremely detailed data tracking and reporting. Even if a company deploying multi-cloud is not strictly required by law to have a data protection officer, they may find a need to create such a position (or even a team) simply to track compliance issues and data requests as the cloud architecture expands.

The increased possibilities of “shadow IT” and unauthorized access also need to be accounted for in any multi-cloud security plan. Frustrated by inability to get different services working together, staff may simply create insecure workarounds. Vendor compromise and third-party data breaches have also been in the news recently just as much as unsecured Amazon S3 buckets have; the cause of this is often simply handing third-party partners too much access to circumvent having to navigate complex or non-functional authentication procedures…[…] Read more »…

Introduction: What is badware?

Malware, as the name indicates, is malicious software designed to cause damage to computer systems and networks. Badware is often used as a synonym of malware, but in reality, there are some subtle differences between the two terms.

While malware is an umbrella term that covers a variety of malicious codes including viruses, Trojan horses, ransomware and backdoors, badware is not necessarily software created to destroy systems. In fact, it is often simply used to collect users’ information for a variety of purposes.

In some cases, “users may treat badware infection as an annoyance to be dealt with rather than a threat to their (or their company’s) data and computing resources,” says StopBadware, Inc., an anti-malware organization created in 2006. This nonprofit makes an effort to cleanse websites that are tagged as spreading badware by maintaining a catalog of sites that have been reported to distribute badware and continues to warn consumers about “this kind of attack [that] takes advantage of a vulnerability or ‘hole’ in your web browser, a browser plug-in, or other software on your computer.”

Badware, of course, can be also used by cybercriminals to hack or socially engineer a target and eventually use that info to attack with other types of malware options.

What problems can badware bring?

Badware can be bad news for both webmaster and users. This is because it is software that is able to somehow bypass the intended use of a website or connection to arrive to a certain scope. For users, this means a number of issues.

In the best-case scenario, badware is intrusive and designed mainly to track a user’s moves online to feed information to advertisers and marketing groups. The user will be unknowingly releasing information on his or her browsing or shopping habits through the use of research software or toolbars designed for the scope, or will be stuck with the installation of a secondary, unwanted program when installing a program of choice.

In the worst-case scenario, malware/badware will lead to compromise of sensitive data (like passwords or financial info), serve as a means towards attacking other computers or trick users into buying items and services. A typical purchase scam is the banner that pops up, warning the user that the computer is running slow and needs to be defragged. This prompts the user to download a specific, often infected, piece of software.

Webmasters can be equally affected by badware turning their legitimate website into a repository of malicious software. This is obviously a blow to the reputation of the site and can result in great loss of viewers and clients.

Is badware a growing problem?

Specific data solely on badware is not currently available, but it’s worth noting that this malware threat was already getting attention a decade ago. In fact, StopBadware.org’s May 2008 Badware Websites Report produced the following findings:

Types of badware

The three most common types of badware behavior are:

• Malicious scripts: Used to redirect website visitors to a different site or to load actual badware from another source
• .htaccess redirects: A hidden server file used in Apache web servers that can be compromised by malicious attackers to redirect users to badware websites
• Hidden iframes: A section of a web page that loads malicious content from another page or site, without the visitor’s knowledge

Cybercriminals can also infect computers with badware using drive-by downloads, which is a common method of spreading malware that occurs when a website automatically (and often silently) installs malicious code (usually an exploit kit) onto the victim’s PC — without the user being aware. No clicking is necessary with this kind of attack, which can take advantage of a vulnerability in a web browser, a browser plug-in or other software on a computer to infiltrate the system and take control of it.

How to prevent badware

First of all, it is important to keep a watchful eye and try to identify badware. For example:

• You see a warning from the antivirus software when visiting the site that displays a browser warning, such as “Reported attack site” or “This site may harm your computer”
• The site redirects to an unknown domain when you navigate to it in your browser
• You notice that permissions or files have been altered, or new users have been added

Webmasters, in particular, need to be aware and check if any search engines redirect users heading to their sites to different URLs or if the same happens while navigating within the site.

Badware can be difficult to avoid, as it can be slipped in a system via vulnerabilities or by exploiting users’ behaviors. There are a number of things, however, that can help you counteract this threat:

• Keep website software updated with the latest security fixes. This can patch loopholes that can let badware into the computer where a hacker can steal passwords and/or modify the contents that a user has uploaded…[…] Read more »….

To thrive in the new era, enterprise security needs to reduce the risks posed by AI and make the most of the opportunities it offers.

Artificial Intelligence (AI) is creating a new frontier in information security. Systems that independently learn, reason and act will increasingly replicate human behavior. Like humans, they will be flawed, but also capable of achieving great things.

AI poses new information risks and makes some existing ones more dangerous. However, it can also be used for good and should become a key part of every organization’s defensive arsenal. Business and information security leaders alike must understand both the risks and opportunities before embracing technologies that will soon become a critically important part of everyday business.

Already, AI is finding its way into many mainstream business use cases. Organizations use variations of AI to support processes in areas including customer service, human resources and bank fraud detection. However, the hype can lead to confusion and skepticism over what AI actually is and what it really means for business and security. It is difficult to separate wishful thinking from reality.

What Are the Information Risks Posed by AI?

As AI systems are adopted by organizations, they will become increasingly critical to day-to-day business operations. Some organizations already have, or will have, business models entirely dependent on AI technology. No matter the function for which an organization uses AI, such systems and the information that supports them have inherent vulnerabilities and are at risk from both accidental and adversarial threats. Compromised AI systems make poor decisions and produce unexpected outcomes.

Simultaneously, organizations are beginning to face sophisticated AI-enabled attacks – which have the potential to compromise information and cause severe business impact at a greater speed and scale than ever before. Taking steps both to secure internal AI systems and defend against external AI-enabled threats will become vitally important in reducing information risk.

While AI systems adopted by organizations present a tempting target, adversarial attackers are also beginning to use AI for their own purposes. AI is a powerful tool that can be used to enhance attack techniques, or even create entirely new ones. Organizations must be ready to adapt their defenses in order to cope with the scale and sophistication of AI-enabled cyber-attacks.

Defensive Opportunities Provided by AI

Security practitioners are always fighting to keep up with the methods used by attackers, and AI systems can provide at least a short-term boost by significantly enhancing a variety of defensive mechanisms. AI can automate numerous tasks, helping understaffed security departments to bridge the specialist skills gap and improve the efficiency of their human practitioners.

Protecting against many existing threats, AI can put defenders a step ahead. However, adversaries are not standing still – as AI-enabled threats become more sophisticated, security practitioners will need to use AI-supported defenses simply to keep up.

The benefit of AI in terms of response to threats is that it can act independently, taking responsive measures without the need for human oversight and at a much greater speed than a human could. Given the presence of malware that can compromise whole systems almost instantaneously, this is a highly valuable capability.

The number of ways in which defensive mechanisms can be significantly enhanced by AI provide grounds for optimism, but as with any new type of technology, it is not a miracle cure. Security practitioners should be aware of the practical challenges involved when deploying defensive AI.

Questions and considerations before deploying defensive AI systems have narrow intelligence and are designed to fulfil one type of task. They require sufficient data and inputs in order to complete that task. One single defensive AI system will not be able to enhance all the defensive mechanisms outlined previously – an organization is likely to adopt multiple systems. Before purchasing and deploying defensive AI, security leaders should consider whether an AI system is required to solve the problem, or whether more conventional options would do a similar or better job.

Questions to ask include:

• Is the problem bounded? (i.e. can it be addressed with one dataset or type of input, or does it require a high understanding of context, which humans are usually better at providing?)
• Does the organization have the data required to run and optimize the AI system?

Security leaders also need to consider issues of governance around defensive AI, such as:

• How do defensive AI systems fit into organizational security governance structures?
• How can the organization provide security assurance for defensive AI systems?
• How can defensive AI systems be maintained, backed up, tested and patched?
• Does the organization have sufficiently skilled people to provide oversight for defensive AI systems?

AI will not replace the need for skilled security practitioners with technical expertise and an intuitive nose for risk. These security practitioners need to balance the need for human oversight with the confidence to allow AI-supported controls to act autonomously and effectively. Such confidence will take time to develop, especially as stories continue to emerge of AI proving unreliable or making poor or unexpected decisions.

AI systems will make mistakes – a beneficial aspect of human oversight is that human practitioners can provide feedback when things go wrong and incorporate it into the AI’s decision-making process. Of course, humans make mistakes too – organizations that adopt defensive AI need to devote time, training and support to help security practitioners learn to work with intelligent systems.

Given time to develop and learn together, the combination of human and artificial intelligence should become a valuable component of an organization’s cyber defenses.

Preparation Begins Now

Computer systems that can independently learn, reason and act herald a new technological era, full of both risk and opportunity…[…] Read more »….