Will business leaders stand up and take responsibility for Digital success or failure ?

Recently came across an interesting article on “Why IT projects still fail ?” and the subject caught attention as it is still being discussed. It had references to some spectacular failures where the blame was squarely placed on the implementation partner; another one where business users at the bottom of the pyramid showed spirited resistance to the new way of working. Finally it quoted the most popular reference on IT projects with limited change in results over score of years with IT Business Alignment retaining high marks.

Reasons attributed to the dismal success record included inadequate resources, overly aggressive timelines, underestimated costs, overlooked requirements, unanticipated complications, poor governance and human mistakes such as bad code can all lead to project failure. Surprisingly a quote “the definition of success is evolving with traditional measures of scope, time, and cost no longer sufficient in today’s competitive environment. The ability of projects to deliver what they set out to do — the expected benefits — is just as important.”

Everything pointed the finger at IT; they are understaffed, overpromise, don’t know how to estimate costs or gather requirements and stick to them and finally are bad project managers. Also I am not sure about the world the respondents of this 2017 global report live in if they do not articulate the benefits in business terms. Okay, I take my words back, I do know of a few who still are unable to, but those are exceptions. Interestingly the article goes on to define formula for success without addressing the core.

So I dug a bit on the background of the author and found no evidence of having either run an IT shop or been at the receiving end. The article was an observation based on statistical evidence from various reports and the hypothesis that has lived for long: IT does not communicate, IT does not know the business, IT needs to sell the project to business, IT should prepare a business case and illustrate the benefits, IT should get the budgets sanctioned and then monitor time, cost, resources, success, failure, … really ?

Let’s for a moment shift focus from IT to the business folks; business models have undergone major upheavals and digital has been thrust upon the willing and unwilling alike. Majority of the incumbent leaders and giants have been slow to react – unwilling to accept reality brushing it off as irrelevant – and then finding someone (read IT) to blame for not delivering in (the constrained) time while the new players have eaten market share. They have treated the change like a technology project rather than technology enabled business transformation.

Success stories are all about the handful of enterprises who decided to create cross-functional teams to evaluate and respond to the upcoming opportunity. They did not hire consultants to give them a roadmap, or define waves of implementation, or hire from outside to lead the internal team; they were willing to change, explore, experiment, willing to take risks, and understood the limitations of pure technology over the collaborative success that they had co-created multiple times in the past along with IT.

The leaders do not hand off accountability, they find ways to induct others into their vision; they are always on the lookout for creating differentiation against competition. There are no IT projects, only business projects that use technology. Even mundane decisions like cloud evaluation or change in support vendors seek business impact and changed outcomes. IT responsibilities and KRAs are spelled out in business terms; this is the real world of pervasive IT today which has shed the technology skin of the past.

In such a world then why does “Why IT projects still fail ?” still find a headline and mention ? Such reports and publications continue to berate technology teams. They find it convenient to continue using the old scapegoat without looking elsewhere if the paradigm has shifted. So are these about the laggards and disconnected teams who have failed to stay current and relevant in the new normal with shrinking business and loss of customers ? This does not appear to be the universal truth but sensation sells better than reality.

Can business grow up and take responsibility for success or lack of it rather than live in a world of transferred responsibility especially when things don’t work out the way they were planned ? Can the technology teams stop being subservient and stand up to their professional achievement and pride ? Wherever the chasm still exists, can both start by acknowledging it and work towards building a sustainable bridge that will offer achievement of business objectives ? A necessary step to stay relevant internally and externally.

Finally let’s bury IT projects !

Flashback ! 15 years on, security breaches have only gotten worse

Rummaging through my archives I came across a presentation I had made in a large IT conference fifteen years back to the date. The subject line had me wondering if I had made a fool of myself in the gathering considering that the topic was not my core expertise, though I was a bit enamored by the discipline. Memory is kind and there is no recollection of being booed off stage or being in an uncomfortable position. The presumptuous title of the presentation was “How to protect your enterprise from being hacked”!

Organizations get hacked for many reasons, though most of the hacks in recent times were attributable to human error, lapse in controls, malice towards existing or ex-coworkers or bosses and finally social engineering resulting in compromised data which allowed nefarious elements to gain access and control of information assets for potential future misuse. There were also few brute force attacks as well as skilled hackers who could break the firewall and other technologies that protect the digital ecosystem.

The past decade and half has seen exponential growth in devices connecting to the internet; what started as basic email on mobile, extranets and the surge with the dotcom bubble has grown beyond the predictions of all kind of futurists and consultants surviving the blips due to dot bust and many years later the subprime crisis. M2M, IoT and connected consumer devices have already added to the exposed digital fabric available, vulnerable to attacks as well as errors and omissions by people who configure and monitor.

Back then before the turn of the century reported security incidents were a handful; current reality is 10X of that and for clarity these are reported numbers. Guestimates on the actual number portray a similar multiplier on the reported number. The difference lies in BYOD which has removed the mobile end user compute from purview of the enterprise subduing the number. Smartphones and Tablets, wireless hotspots, public internet kiosks and free terminals at airports, all have helped in accessing information anytime, anywhere.

For IT organizations threat vectors multiplied sending them on a quest for better security and balancing the demand and need for access to corporate systems. Controls and checks soon became bureaucratic with everyone wanting to connect as a result of undue corporate pressures. The number of breaches continues to rise with IT security playing catchup. MDM anyone ? Locked USB ports, containerized phones, IRM enabled documents, the world has changed while we continue to stay exposed with cookies/mobile app trackers.

Globally, Governments have giving a thrust to digital e-governance and citizen services; identities and records of interactions with Government, tax filing, health records, bank statements, what have you, almost everything is digitized across most countries with varied degrees of information security policies, processes and technology. Access via mobiles and apps is the base expectation which needs to be fulfilled; feature phones too have been enabled using USSD (Unstructured Supplementary Service Data) which can be compromised.

Interestingly time to uncover a breach has now increased from weeks to many months and in rare cases more than a year; this rise is despite availability of plethora of solutions. Software is getting bulkier, crammed with features; integration with other solutions is now the norm exposing solutions with potentially unfixed or insecure APIs (application programming interface) from third parties. Unfortunately security wrappers and multi-factor authentication make solutions unwieldy or complex to end users.

Fifteen years back the discussion was about security policies, management endorsement and budget allocation; it was about protection from insiders – disgruntled employees and contractors. One of the key elements of an information security strategy was education of involved stakeholders, their responsibilities, dos and don’ts. Today is still about security policies, more controlled that clearly separate the personal from enterprise; earlier digital access was controlled by hierarchy and exception, today exceptions to the rule for business is the norm.

I wish I could give a presentation today with the same confidence and aplomb that I did decade and a half back; technology has swamped our lives with blurring boundaries between technology at work and personal use. The continuum with high dependence on devices and tether to the internet for almost everything, logs our daily activities in the background only to be used against us. Enterprises struggle to create a balance between storing data on the cloud and enterprise vaults only to discover that neither are safe.

Reality is that most of your data is out there available for pennies to whosoever wants it whether you like it or not !

Can Small & Medium Enterprise leverage Digital to achieve their full potential ?

The SME segment globally is the vehicle for growth contributing as high as 90% of GDP in some developing economies; they are also the largest employment generators for countries. Impact of any macro-economic activities are felt quickly by this segment especially when negative while they take some time to see an upside. Digitalization of the world and every industry has created opportunities in plenty for scale and disruption, the small and medium enterprises have mostly struggled to take advantage.

Most SMEs aspire to scale and become big enterprises; they are constrained by many factors – some within their control, some that they don’t and some that can be addressed with help. The recent brouhaha about Digital has resulted in consultants mushrooming with all kinds of services and offers. Owners shying away from the large names and mostly technology agnostic and ignorant, based on their understanding engage the consultants with mixed results; this is where good news now appears on the horizon.

Last week the CEO of a global IT superpower – Google – visited India; much covered by the media and debated on social media. Government functionaries welcomed the announcements on launches that help the majority of SMEs in their quest to derive benefits in the Digital world. The assumption is that technology availability to the masses will help reduce the gap between the technology haves – the big enterprise and the have nots – largely the SMEs; thus this step is seen as positive stimulus for the industry.

Interestingly the technology announcement also included a training program with certifications from Google, an institute and industry body. The workshops thus planned should trigger trials which will require support for sustaining the effort to keep the momentum going. SME business are typically Digital migrants and thus a big opportunity; trust deficit has been the constraint in their adoption of technology solutions and the fact that they do not have internal resources who can lead the way in their digital journey.

As an extension of the "Google My Business", the "Digital Unlocked" from Google is a big step forward. I believe that for this initiative to succeed, there needs to be a significant push towards publicizing the availability of the curriculum and benefits to the adopters especially the segment that is still not connected. Proliferation of the initiative through various channels will help the cause of democratizing the Digital India initiative. Future promise of tools should aid overcoming the starters block with simplicity and ease of use.

Current estimates that less than ten percent of SMEs are digitally enabled thus leaving a huge opportunity; the potential impact can be significant with increase in numbers and the ability to serve newer markets and customers. A report by KPMG predicts a direct correlation such that democratization of the digital platform will increase SME contribution to the GDP. They can definitely provide much needed stimulus to the economy in the currently constrained sentiment driven consumption post demonetization.

I believe that the entrepreneurial spirit will also see the rise of service providers who will master these tools and provide services to the SME sector. Over time this should have a multiplier effect on the services market with the cascading to B, C, and D class cities and towns. Availability of internet connections is slowly and steadily improving beyond the 2G speeds with the proliferation of new service providers as well as upgrades undertaken by the incumbents; we are at the cusp of a new world, let’s all become the catalyst !

Fatigue is setting in on Information Security scares, a darker future ahead ?

Another site hacked, millions of user credentials compromised !

Zero day attack discovered, patch on the way !

Ransomware is getting smarter, stay alert !

Everything having an embedded computer or chip is vulnerable to potential attack especially if connected to the Internet. Compromised software, backdoors, unchanged admin passwords, shared identities, complex every changing passwords written down on pieces of paper, the number of ways in which we are being exposed is increasing every day. The information security bogey is breathing down our neck every minute while we wonder where the next attack with emerge from to compromise our identity or steal from us.

Every company going Digital is exposing information to the Internet; strategy varies by company and implementation, but the fact is that now information is available on servers that are facing the public and thus will be targeted. IT organizations and vendors tend to live in their self-proclaimed paradise, smug that they have taken adequate steps to protect themselves. Most of believe that if there is no evidence of leakage or compromise, then I am protected and do not need to worry about the changing threat landscape.

IT departments are under constant pressure to keep the information assets of the company secure and ensure safety of data residing in various machines, removable media, data in motion, and also address phishing attacks on customers using their domains, as well as employees clicking through on spam. Protect the gullible, irresponsible, and naïve who refuse to learn from training programs and past mistakes; at the same time provide access to information on mobiles, via internet cafes, and public wireless hotspots.

Device management, network management, VAPT (Vulnerability Assessment & Penetration Testing), firewalls, anti-virus, DLP (Data Leakage Protection), log management, SIEM (Security Information & Event Management), patch management, hardened devices, VPN (Virtual Private Network), multi-factor authentication, identity management, IDS (Intrusion Detection System), IPS (Intrusion Prevention System), Automatic malware detection and analysis, Anti-adware, WAF (Web Application Firewall), the list of tools is almost endless.

All these pieces or combination have to work together to make the enterprise safe and protect the extended ecosystem and staff. The information security organization struggles to educate and protect the digital assets of the company while consumerization of IT keeps creating holes in the fabric. Everyone wants email access on phones and enterprise apps on the go; the same phones have all kinds of apps downloaded from public app stores snooping around; containerization is still new though evolving.

Employees, especially senior management desire flexibility to additionally access corporate applications from their home computers which are not under the corporate security programs. Increasing touch points increase susceptibility; the CISO has to work hard keeping under control the complex jigsaw which threatens to collapse regularly. Organizations are reaching a break point wherein they are now working on acceptable risk models rather than fix every piece that is broken or likely to be threatened. Let some fires burn !

Most companies live in the perception that targets are normally the visible and high profile companies rather than the small, relatively unknown, obscure or insignificant websites and portals. DDOS attacks are launched only when there is commensurate gain; hacking attempts are made only on digital assets of value or high visibility. While this may be relative truth, reality is that no one can afford to be slack in their preparedness or live in a fool’s paradise that as a low profile non-entity they are safe.

In most large enterprises, security budgets have been steadily increasing to the point that they are now being managed independent of IT. Business expects periodic feedback on information asset security and action being taken by competitors; Boards want answers on risks to business, market, and reputation in the digital world. The bogey of security is no longer adequate to get budgets sanctioned, they need clearly outlined business case, risk profiling, regulatory compliance for some industries, ROI, and connect to business outcomes.

News of breaches today have become less sensational with people accepting the fact that some will get compromised while the majority will stay safe and a few will not disclose. In most cases the root cause analysis indicates human oversight, error or not following the basics resulted in successful attacks with majority being internally motivated. Complex and high tech attacks target (pun not intended) easy pickings on financial and personal data that can be used for monetary gain, or are orchestrated by state actors.

Don’t let fatigue defeat you, stay awake and alert, the complex digital world increases dependence on technology and there are no choices to make !

If you are a CIO, you better know your domain and industry, else …

For every industry regulatory compliance is a given with no exceptions; these are local to the enterprise home country or in the markets they operate in, and dependent on products and services. In such situations there is always a choice of vendors who offer solutions to solve the problem at hand. These vary from local providers who grow with the industry and tailor their offerings to evolving needs; and then there are global providers who offer deep and wide solutions for large enterprises.

The conversation started by stating the problem the industry was facing and how it was expected to impact revenue and profitability in the near term followed by the standard sales pitch on how they were better than competition and why the assembled companies should consider their solution. The audience comprising of potential customers represented by CIOs, IT teams and few business folks agreed with the problem statement in varying degrees based on their frame of reference and charted journey which was their reality.

We started working on the problem three years back with the Board endorsing the strategy and approving the investment. We have almost completed the project and are now auditing what we have done. We comply with current requirements and are ready for the upcoming regulations deadline. We welcome your team to review our current state of readiness and highlight lacunae if any so that we are sure of our status. Please ask your teams to get in touch with me so that we can work together on this initiative.

Our business operations are not very large in the markets that require compliance to upcoming regulation; they have scaled down a bit in the last year or so due to some issues. We did start a couple of years back and took a step by step approach to solving the problem; my colleague here leads the initiative. There are a few gaps in our current readiness and we would be happy to explore your offerings to evaluate the value proposition. Let’s connect back after a few weeks and take the discussion forward.

Local vendors have given us the solution that complies with current requirements; they have offered to continuously develop the product based on evolving needs and deploy when we want it. Our Management has taken a decision not to deploy any solution until absolutely necessary. My team leader would know the exact status, I am not aware of the details; I will speak with them and revert on where we are in the journey. Once I have the status, I will reconnect if there is a need; in the meanwhile send me some information.

Three different perspectives from seasoned CIOs, each had spent over a decade in the industry; their respective companies were market leaders and competed fiercely with each other. Their journey towards compliance were spread across the spectrum with varied strategies and solutions – local and global. What was surprising though is their level of involvement, understanding, preparedness and attitude to critical business process that could adversely impact revenue, market share, and profitability.

The conversations also depict domain expertise and connect within the enterprise to the business and its challenges and opportunities. The first company is clearly a leader in usage of technology which the industry also hails. The second has experienced some trials and tribulations which has left the company losing market share, profitability and reputation. Progressively you will surmise that the last would be in the most disadvantageous position ! At least not at the moment, though their current stance may result in such a position.

Gigabytes have been written about the evolving CIO, role, opportunity in the digital world, CIO 3.0 and what have you ! CIOs have also been threatened by disruptions and the opinionated passing judgement on their future. The role has survived, evolved and many have thrived; unfortunately with the multi-dimensional nature of rising expectations, the numbers are beginning to dwindle. It is not that CIOs have lost touch or ability to make IT work, it is just that they are not in a position of influence when it comes to business.

Leaders are expected to not just make a difference internally but also be seen as beacons of light for others to follow; they need to shape opinions and outcomes for the industry while leading from the front. CIOs who achieve this are the ones that get written about in magazines, have case studies, and are seen in seminars and conferences on the dais, while the rest make up the audience. I believe that the true CIOs will continue to forge new paths while the rest of the industry will wait for early adopters to follow.

Where are you in the journey ?

How can you expect returns if you are unwilling to invest ?

Business is hurting from the lack of the right tools and enablers, we need a good dose of IT to create efficiency. We acknowledge the need to transform and that is why we are talking; the team also agrees with the direction and the way forward. The benchmark results are well received and we would like to be in the top quartile of the industry. We should create the framework for evaluation of options to our specific requirements before we finalize on the best option and let’s work to an aggressive time line.

The CEO intuitively knew, to take performance to the next level, technology has to play an important role. Coming in of global competitors had started slowing growth and put pressure on profitability. Operating margins and other business metrics were lagging behind; survival was not at stake but to stay relevant to major customers, the business begged for technology. The absence of mature IT leadership posed additional challenges in execution of the strategy defined through a technology consulting engagement.

Early investments in technology solutions had not delivered to promise; early decisions were taken by the business based on promises made by vendors on business benefit. Business participation in the project waned quickly as technology formalized processes and exposed lacunae in operations. People on the ground resisted the change creating roadblocks – real and imaginary – towards deployment. The cycle repeated itself a couple of times leaving everyone frustrated and wondering if technology will ever deliver.

That was before global players invaded the market changing the way business was done, improving customer satisfaction and driving profitable growth became an urgency. Even with higher overheads and manpower cost, they delivered; in came Consultants offered a mirror to the business and helped them with a well-crafted plan and strategy; technology strategy followed. A new CEO added to the excitement with experience at competitors. Culmination of events necessitated that the company reach a decision rather quickly.

In a perceivably low margin business where the average margin was half of the best, it was evident that operational efficiency can gain significantly with the right IT interventions. Industry specific solutions and generic options competed on functionality and price with a wide variation in between. An all hands meeting agreed to the strategy and initial steps enthusiastically committing resources and time. With negligible investments thus far, in parallel the Management decided to approach the Board for budgetary approvals.

The Board members had diversified business interests with business operations of varied size; they were also parsimonious in their approach to investments especially technology which was seen as necessary but not essential. Thus while their companies had grown in size and reputation, they had not been able to realize the true potential while newer competitors had moved ahead. The minnow in the family thus started from a disadvantage when the CEO put his case across for investments in technology.

Discussions went back and forth on various technology options, merits of one over the other, cost of acquisition and support, TCO (Total Cost of Ownership) and business benefit; the figures appeared obscenely high even though they were competitive and in line with benchmark investments. For the Board reality was that other larger entities in their bouquet too had rarely invested similar amounts barring the initial stages for industry standard ERP solutions. They finally approved a significantly reduced number which turned the project into a non-starter.

The business case was clear in identifying the benefits – financial, customer satisfaction, growth, profitability – the ROI was less than a year; but past experience made the Board wary of committing to the investment. Ensuing “What if” had no answers beyond a point; there are no certainties, only probabilities of success. The sanctioned budget did not cover basic costs even if executed in phases to demonstrate potential success. Risk mitigation strategies can be created for most action plans, the keyword being “action”.

Except in cases of some of the new technologies and innovative digital models, most of the solutions – vertical or horizontal – have successfully established credibility to deliver business value with discipline of execution and leadership oversight and endorsement. Phases can reduce risk if logically broken down with continuity in the journey. Processes if left out of design consideration will fail to provide the end result. Analysis paralysis can miss opportunities that become clear only in the future, status quo breeds mediocrity.

Years have passed since the above happened; they are still at the same milestone the debate continues, they are yet to decide and the industry continues to grow rapidly !

The world of technology led disruptions beyond SMACS

It was an interesting conversation with a veteran technology industry observer who had spent more than a decade with technology vendors and users alike, narrating their stories to the world. His insights were always incisive and valued by the industry as key markers towards adoption and success. We ruminated about the past and the fast pace of change that had everyone scampering for a Digital strategy; but even that is now in the past. Execution challenges and failures make better reading than laggards who are yet to decide.

Unicorns aside, disintermediation and asset lite new business models were key digital drivers for startups threatening to disrupt existing business models, only to realize that survival rate for paper tigers has been extremely low after success of first few in an industry segment. Consolidation and shift from broad to narrow and broad again, hyperlocal to nationwide and back again to niche had everyone struggling to find a profitable equilibrium; churning trends also left many on the wayside never to rise again.

Few years back for conventional enterprises enamored by SMACS (Social, Mobile, Analytics, Cloud and Security), the first mover or competitive advantage frittered away with the rest catching up. Digital engagement, delivery, customer service, and experience are beginning to level off, the aura of the brand coupled with carpet bombing advertisements across channels has waning interest in products and services. Customers are expecting more for the same investment, the quality bar is raised in a buyers’ market.

CIOs and CDOs are being challenged to explore new opportunities using old and the as yet untested new, which can offer solutions to the unmet needs or a better value proposition to existing ones. Design thinking and deep learning are no longer buzzwords, they are being applied to invigorate organizations and solve real life problems. Discussions are no longer about incremental innovation, focus is shifting to create exponentially better products and services; and technology is expected to play a role in making it happen.

Watches and wearables – new miniature screens pose new challenges and opportunities with almost complete association with the wearer. Body vitals, moods, behaviors, eating habits, alerts, nudges, tracking almost everything that matters and some that don’t, the wearable is like the IoT device streaming data imploring to be analyzed. Location tracking, your address book, browser history, nothing is private anymore. Fitness is the current killer use, critical care and health monitoring additional benefits to the provider and consumer.

Virtual Reality could not live up to the promise with refinements taking time and the cost of devices; Augmented Reality now creates new paradigms. The future may blur the lines between the real and augmented interchangeably making it difficult to differentiate thus passing control of individual and collective experiences in the hands of ethical providers and willful manipulators. Mind and thereby actions influenced by governments or lawbreakers bring back scary images from the literary world of George Orwell four decades later than his predictions.

Workplaces monitoring of activity and outcomes which otherwise appear unsupervised would create a hyper-efficient work culture with high levels of automation and efficiency. Segmenting performers aided by data shall eliminate the unfit and inefficient; productivity norms would render meaningless the need to publish reports and dashboards, everything tending to Six Sigma. Bordering on utopian ? This scenario can be easily created with culmination of existing technology solutions with some innovative analytical models.

The outliers would be the Digital hermits who have been able to recuse themselves by virtue of their power, wealth, or fugitive status. Digital vacations much sought after to experience real life, real people and the real world devoid of augmented embellishments; the real look, touch and feel, to be cherished and imprinted into real memory. Self-learning computers are already making advancements where they optimize their own learning algorithms to create better neural networks conceptualized by Arthur C Clarke; the tipping point is not far.

Science fiction of the past is no longer unreachable; if you can imagine it, you will find someone already attempting it. Be the dreamer, not the subject of subjugation by others; it does not matter if it is an individual, corporate, government or a nefarious mind wanting to control. It is not about the control, it is a display of power over others destiny. It is not about technology, it is about changing the world because you can. It is a world where the human race is a slave to technology which is a slave of humans.

Sounds far fetched ? Are you really reading this or …

Should you allow exceptions to an information security policy ?

Once upon a time when information security did not figure in the priorities of the IT Head (the era before the CIO title came into vogue), the company took upon itself to protect sensitive information that if leaked would be detrimental to the image and reputation. The internet was beginning to spread its wings reaching out to residential customers, the browser wars had just begun, electronic commerce was yet to reach irrational valuations, and information leakage or protection was not on the radar of many enterprises.

There were no USB connectors or drives, internet connections were rationed and capacity low, email the primary mode of information dissemination apart from paper. Separation of Information Security & Risk into an independent entity was a big pioneering step forward. The new team started with creation of dos and don’ts for users that culminated into a set of policies. In a hierarchical world moving up the ladder, the stringent policies became liberal as you look upwards for the convenience of senior executives.

Then came the noise and requests for exceptions citing business need and impact with the newly imposed controls; function heads authorized the leniency thereby rendering policies significantly compromised in intent and execution. New threats that were perceived to be largely external were intercepted and addressed, internal exceptions however stayed and continued to grow. Companies worked on an acceptable risk internally and with high levels of trust with senior executives to guard the family jewels.

Fast forward to the current world of heightened awareness and impact from information leakage and cyber threats, is the scenario any different ? Sampling across companies in a cross section of size, industries and geographies indicate that the information security function now exists in a majority of enterprises, reporting into the CIO who has also taken on the mantle to protect the information assets. High maturity and regulated companies have given security independent charge to the CISO accountable to the CEO/Board.

Policies have become stringent, implementation rigor higher and with the availability of a plethora of tools, the ability to monitor better. The industry has continued to disrupt available solutions with newer, faster, better, cheaper, painting a scarier picture forcing adoption driven by FUD. Social engineering has evolved to new levels with multitude of avenues reaching out to the gullible and the stupid who are willing to give away everything including personal records that compromise corporate and individual assets.

Most policies are cookie cutter approaches with standard templates from the consulting companies with some variance by industry; many of them have statements that put at risk the enterprise and the policy itself. The implementation too is outsourced to IT companies who provide out of the box solutions at times with no alignment to industry specifics. Compliance continues to drive policy creation and intent: to pass the statutory audit, to ensure that customer audits do not show non-compliance, to help justify budgets for information security.

Leaving aside an exceptional case of incompetency at the senior management level within an enterprise, today the awareness and intent to protect information assets of the company is genuine enough to put pressure on IT and Information Security professionals. Auditors and regulators have also gained adequate expertise to go beyond the superficial reports, dashboards or compliance statements. They are better equipped and have raised the bar for owners, entrepreneurs, management and the Board.

ISO and other standards based practices and certifications are mainstream, the cost of information leaks can now be measured in fiscal terms; wordsmithing to crisply document and disseminate the policies with no room for ambiguity or misinterpretation has become the baseline expectation. No exception is the new rule; need to deviate ? Change the policy instead, create grades and boundaries for execution. It makes life so much easier rather than to explain why an exception was granted and how was it managed.

Staying compliant is mandatory, protecting information is necessary, educating stakeholders is a starting point; take steps before a crisis emerges. Make sure policies are easily understood in intent and execution; have employees sign off acceptable use policies that define the boundaries; reinforce with frequent communication; assess, audit and publish results irrespective of status, success or opportunities to improve; stay connected to innovators and peers in the industry to benchmark your effort and stay safe.

But whatever you do or don’t, please don’t create exceptions to any policy !

Job hoppers seeking the perfect match rarely find it

It was an embarrassing moment for the CIO who I bumped into at the reception of a customer; he was there for an interview with the Group CIO for a position with one of the business units. He did not expect to find me there; while he knew that I had given up my corporate role some time back, he wondered if I too was there for the same interview. So making polite conversation, he queried if I had also come for the interview. I smiled back at him and nodded in affirmation that it was indeed the interview that brought me there.

He was beginning to build an image in the industry as a CIO who will make it to the big league sooner or later. He had started getting visibility in the CIO circles with a few panel discussions where he was able to make his presence felt. Though he was not quoted often or written about, he appeared to be taking the right steps towards creating a persona. After a longish tenure at a mid-sized enterprise, he had a string of short-term roles each lasting not more than six months which surprised peers, friends and industry observers.

Leaving aside the tenured CIOs (and here I refer to the real CIOs, not people with underserving titles) with over a decade in their current roles, most CIOs typically spend an average of 3-4 years in a company. They create and leave behind an impact on the enterprise with their management style, technology solutions, and bit of leadership. They contribute to an overall improvement in the IT maturity, elevation of the IT team perception, business impact led by technology, and a general acceptance of the value of IT to the company.

Coming back to our friend in dire need, he walked into the room with a complete panel to grill him on why he should be given the coveted position. Seeing me on the interview panel unbalanced him as we all greeted him and introduced ourselves wanting to make him comfortable. As we progressed through his professional life and key milestones, the conversation finally reached the point where his quick changes came into the limelight as the panel sought clarification on what caused the instability in an otherwise good career.

At the time of the interview, he had been in the current role for less than 4 months and two earlier stints had lasted six months apiece; here he was again wanting to move ! He started off talking about cultural mismatch between the first of the 3 and the fact that he was constrained from making any decisions. The second was an attempt a new industry segment which he quickly realized he was unable to adjust to; and finally the current role was more of a maintenance role and did not offer any freedom to innovate.

Closing the interview the HR Head thanked him for his time and promised to get back should he make the grade ! Between 5 of us on the panel we had unanimous consensus that the candidate would find it difficult to get into any new role which will not give him the comfort of the old one he had discarded sometime back for greener pastures. Fallaciously he was seeking acceptance as a new comer rather than build relationships with peers and trust with his team that comes with immersion into the new role and company.

Every new role has a honeymoon period that the newbie enjoys as s/he learns about the company, industry, culture, people, team and expectations of the role. The duration varies by company, size, and the level in the hierarchy of the enterprise. The new entrant has to create an enduring and affable persona that is true to self; it is difficult to act like someone else and sustain it for long. This is the time that needs to be spent in building bridges and credibility which sustains a person in the role and organization.

My friend never got the call he was waiting for as he had frittered away the honeymoon period or made bad choices not aligned to his ability and/or goals. Call it mid-career (or life) crisis or a victim of the changing dynamics of the role, it is evident that he is not ready for the new dimensions that are base expectations now. In the fast changing digitally disruptive business models world, the CIO has to step up the ante. Many have transformed themselves to take on the new challenge, a large majority faces disruption.

Ready or not, that is reality !

None from the new generation want to be the CIO ? I wonder …

Someone forwarded me a link on the finding that no one in the current lot of fresh job seekers is excited about CIO as a career. The writer of fame and an opinion leader went on to predict that the role has been short lived in its amoebic existence getting pulled and pushed in all directions with every change in technological wave which threatens to change the technology landscape and value proposition for enterprises. Unable to resist a rejoinder, I decided to provide an alternative view to the sustainability of the CIO role

CIO’s role is complex, everyone agrees to this fact, even the antagonist acknowledged the fact. CIOs manage infrastructure, business applications, and communication from the enterprise to customers, suppliers, regulators, and interested stakeholders. They help run the business efficiently or what is now referred to as “Keeping the lights on” or “Business as usual”. They are also responsible for information security, business continuity, disaster recovery, governance, risk and compliance, and contribute to business success.

Barring the recent fad driven CXOs with X = Digital, Cloud, Social (media), Innovation, Mobility (?!), and many more to come, the CIO is the youngest of the C-suite. S/he has seen a lot more discussion and debate around the role, responsibilities, accountability, KPIs and importance. It is probably in focus because every other CXO is now dependent on the CIO and the IT team to provide them with basic standardized and secure infrastructure to conduct business and consume information to stay successful in their roles.

This situation elevates insecurities and spurs demand for breaking away from the shackles that IT has bound the business in; restricted End user compute devices with lower juice and freedom in comparison to their home devices; lock down mobile phones with containerized security or locked USB ports and unrestrained internet access (I am a responsible manager of this company !). Revolt thus stoked attempts to surface with errant behavior (as seen by the CIO) and deployment of islanded cloud solutions.

The resultant angst creates perceptions of IT rigidity and bureaucracy which business users hate and seek approvals for exceptions to the rule book. Enterprise IT needs to be simple that does not require training; I don’t need a training program or manual to use technology for personal consumption; then why is enterprise IT so complex ? They forget the fact that enterprise solutions are limited by budgets, require structured data that lends itself to analytics, correlations, and associations for transactions, payments, and other business processes.

Everyone would however agree that all the applications can do with a dose of simplicity which is not an unreasonable ask. Does this imply that UI/UX should be a separate portfolio with the creation of one more silo CUO or Chief User (Interface/Experience) Officer, a person who shall be tasked with the responsibility of ensuring that systems remain idiot proof ? Or the task can be done by a specialist in the IT or any other team ? Such has been the rationale for slicing away the role of the CIO to create new micro but super-sized heads.

History bears the fact that the fancy and irrational paranoia to rechristen or create parallel roles has borne no fruit and almost all of them have been relegated to oblivion. The Internet, Cloud, SMAC, Security, Digital, and what have you fancy, have all disappeared after the title ran out of vogue with realizations that they were too small a role or responsibility to sustain standalone. The willing or grudgingly magnanimous CIO has taken them in his/her stride, not just surviving, but thriving and growing from strength to strength.

So when I see proclamations and hypothesis put across by the learned and opinionated, I wonder why do we get anxiety pangs ? Does postulation of such theories make them the reality for the CIO ? I have seen discussion, debate, instigative behavior, challenge, and provocation from peers and outsiders but never felt threatened in my role or tremors in my foundation of trust build brick by brick with credible delivery and dialogue. I believe that CIOs have nothing to be afraid of except their own fears towards their longevity.

And talking about no one wanting to be a CIO ? Probably the institute in question is going to have a big miss in the digital world !

Don’t let your Digital Strategy fail; align to execution on the ground

I have been searching for replacement tires for my car for the last few weeks; so I traveled from search engines, to websites of popular manufacturers, to social media groups, to for purpose automobile portals to find where I can get genuine, reliable tires at a good bargain. Search results pushed me towards aggregators and marketplaces who probably do better SEO but did not carry the product I wanted. That is when I realized that the specifications of my requirement are unique and will require me to invest more time and effort.

In the digital world with every newspaper carrying multi-page advertisements from popular internet marketplaces to hoarding on roads, I believed that everyone is hungry for business. So painstakingly I filled all kinds of forms on various manufacturer websites and portals giving them the information they wanted – personal details, car make/model, tire specifications, timeframe for my requirement, and waited for a response. I was hopeful that between 8 portals and manufacturers I will be able to fulfill my need.

Patience is a virtue and the portals/manufacturers were colluding to prove that I am not that virtuous after all. Days passed with no response from anyone, big name global and local internet shopping sites as well as global and local big brands who collectively invest ridiculous amounts on advertising enticing consumers to choose them or shop on their sites over others (barring one who regretted that they did not service my location). Wondering if my email id or phone number had a problem, after a week repeated the process while expanding my search to the physical world.

Many years back I was involved in setting up an internet portal for a large retailer; we evaluated multiple technology solutions wanting the best option within our affordability. The team was excited and it was the beginning of the new cycle of euphoric expectations that subsequently resulted in obscene investments being thrown at virtual retailers and marketplaces. Conservatively we focused on process: how we will receive queries from customers, check orders for completeness, inventory availability to promise.

As we went live and the site picked momentum, we learned the ropes spending frugally on SEO, SEM, PPM, PPC, social media, steadily increasing traction. We exercised care to respond to every message received, suggestions, bouquets and brickbats, and fulfil all orders. 93% order completion was a sore thumb while 99% response to queries offered solace. Enviously we observed the investments into the perceived bubble with no focus on customer or end to end process while we toiled to create a profitable, sustainable business model.

The market expansion based on the promise of low price ensured that remaining wisps of customer loyalty disappeared into thin air fueling a race to burn money faster than others. Abandoned carts increasing and returns crossing the teens, some believe that they are too big to fall and moneybags will continue to prop them with the fear of losing their investments. What does it take for someone to become irrelevant ? Someone with deeper pockets and money to burn to eventually starve the other to oblivion.

Checking around with friends I discovered a few contacts with some of the manufacturers and portals; so I send emails to my connects describing my need and predicament. Prompt came the responses apologizing for the lapse and the offer to help connecting me to relevant people. This is where things started to get interesting. One manufacturer advised that they do not manufacture the specific SKU and that it would be figuring on the website by error. Another offered an attractive price but could not guarantee availability.

The portals/marketplaces feigned remorse that they did not control their partners who listed their merchandise; they were only a technology provider and offered fulfillment services as a value add. The merchant claimed they were out of stock and did not know when the new consignments would arrive. In comparison the store that I visited courteously offered alternatives to choose from explaining the finer nuances of my choices making me wonder why I spent so much time attempting to buy online.

Digital marketing strategies work, they attract customers, create a pull, help customers choose, and then they need the real world to take over with real processes that will stand the test of time without failing. Success requires alignment to create customer satisfaction, repeatability ensures delight and repeat purchases. The future belongs to those who unflinchingly focus on execution, right first time, every time. Invest in technology and also in process and execution, they will collectively stand by you.

People build companies, people destroy companies

This is a story of an industry that has seen digital disruption that started as an innocuous event two decades back and became a force to reckon with within a decade. The last ten years systematically dismantled whatever was remaining with local, global and legendary brands biting the dust. Whatever remained in a few parts of the world were undone by incompetent leadership unwilling to listen to their teams or adapt to the change quickly – something we have observed across industries. This is based on events that are very fresh in everyone’s memory.

The entity started with humble beginnings, a young team passionate about the cause working in perfect unison build the company brick by brick, byte by byte, one step at a time. They worked hard to create a brand that gained trust of their customers with every interaction raising the bar with each engagement, getting into the psyche of their patrons. Quickly they had overtaken older competitors who were unable to change their personas; soon they became the benchmark against which success was measured in their industry.

Talent attracts talent, they grew from strength to strength and became an aspirational company work for in their segment. It appeared that nothing could go wrong for them, they were in the zone almost all the time, minor aberrations were pardoned by the staunch loyalty of the staff and customers alike. Their challenges if any – internal or external – appeared to be minor bumps on their journey to greatness. The journey continued and the customer facing leaders became brands in their own right, synonymous with the company.

Some of the founding members moved to alternative careers handing over a bigger organization in the hands of professionals to run. The team adjusted to the new way of working of the new management with a different ethos, trying their best to eliminate friction in the interest of progress. They toiled hard to stay in the good books of the new powers and at the same time keep their customers delighted. The strain slowly started appearing in stray conversations and murmurs in the corridors; attrition began to slow them down in a deliberate but sure way.

The brand ambassadors put up a brave face to the external world while the internal turmoil began to show cracks on the surface. Loyal customers demonstrated elasticity which was surprising to many, but it appeared to be a matter of time before the institution crumbled. The irrational behavior attributable to the people now at the helm confused and belittled some customers who were unforgiving, chiding the senior management for letting them down; they disengaged leaving some of the surviving founder members seething and helpless.

It was then a matter of time that the monument start falling, the demise imminent; customers and sponsors shied away from active long-term engagements, as one of the pillars withdrew leaving the load on the lone surviving and primary mainstay. He bravely took the brunt of the illogical and unreasonable demands and frequent and predictable indecision driven by the highest levels of (in)competency which had now become the norm and accepted as a distraction to work. On one fine day the cup overflew and the last man standing too quit.

The spiral effect downwards was predictable; the marquee annual gathering that followed a few months later was an unprecedented disaster that left everyone saddened. The primary business suffered an unrecoverable setback with cascading adverse impact on the organization which was almost wounded fatally. The industry at large cried in anguish at the fall of the mighty, the patrons wondered if the vacuum will ever get filled, the world moved on. Having been a part of the journey from inception though from the outside, I mourn.

Outcomes could have been different had the old leadership stayed on or the new listened to the team or the warning bells that tolled globally; maybe they could have survived longer if the team had revolted against their boss; there may have been an epitaph less if someone had recognized the ineptitude early on and got rid of the damaging elements. Companies suffer this way every day across industries – at time due to inaction, false sense of stability or bravado, the ostrich effect, or a combination of these and leadership indecision and stupidity.

Many of my friends from the company have found their niches and calling, I wish them all the best !

Enterprise challenges in getting ready for Generation Z in the phygital world

The other day I was reading about a new generation of future customers/workers/citizens referred to as the Generation Z. According to this piece of analysis, it is a term used to collectively refer to people born in this millennium. They are different from generation Y which was the classification for Digital Natives – people who grew up with the Internet and computers during their school and college years – while generation X typically bunched together Digital Migrants (who were exposed to Personal Computers as they got into the workforce).

Generation Z is on the go with their computer in their pockets; they are the mobile generation equipped with smartphones, apps for almost everything they need or want, socially active, leaving a trail behind for anyone to leverage, fickle in their behavior with no perceivable loyalty to brand or product, ready to experiment and explore the world at large, impatient with the pace at which the rest of the world is moving, have a strong mind of their own; a generation that is going to be ready to get into the work force in the next 5+ years.

If we look inwards, enterprises today have embraced Cloud and Mobility working their way through the legacy systems which are not easily amenable. The journey has been full of challenges while the new generation systems have attempted to disrupt the monolithic systems of the past. Organizational inertia and fear of breaking a running system and process has prevented large scale deployments. App-ification of the world of IT has begun with new startups wanting to optimize every micro process by making it available in real-time.

Productivity on the move has rendered the laptop an unwieldy device which is losing ground to tablet computers as the primary consumption device. The tablet too has evolved bridging the gap and offering similar or better capabilities on the go; progressive early adopters have embraced this trend while conservatives continue to view the tablet as a consumer device under the ambit of BYOD. The sooner the transition happens, the faster the enterprise will be ready to move to the next level of engagement and productivity.

Focusing on the external world of direct and indirect consumers, some parts of the world are going mobile first with the web being an alternate channel; optimization of engagement and experience on the mobile is the Holy Grail that everyone is chasing. While Generation Y is adaptable across different channels, Generation Z will seek gratification primarily on the mobile channel and may not engage on other mediums. Organizations are thus building for current as well as the future which is creating discomfort for existing decision makers, the Generation X.

Generation Z presents new paradigms for enterprises internally as well as externally. The mobile first consumers of information are used to finding everything at their fingertips. Can they be tied down to a desk with a monitor, keyboard and mouse at their workplace and expect productivity at the same level that is delivered today ? Their restless will be challenged to stay subdued while they are corporatized to conform to existing norms of workplaces. The multi-tasking generation will seek avenues to vent their high energy existence.

At the same time, their social existence in the physical world is complemented by the mobile digital world with 4G and 5G speeds. They do not shun personal touch and immerse in the real world with equal élan leaving bread crumbs for marketers and analysts to microsegment personas. Can enterprises find a way to stay omnipresent in the new phygital world ? This was a much debated topic in a recent conference with thinking caps of all knowing consultants to enterprise captains and participants from all walks of life.

Conclusions were sparse with the world still evolving and no one wanting to put their bets on one direction or another; pace of change being what it is, attempting to hazard a guess was seen as epitome of foolishness. Everyone agreed that the future remains opaque with wearables bringing in a dimension as yet little understood in its impact. Work and Life are fungible today; in a boundary less world of the future, the focus will shift to outcomes rather than tasks; micro specialized skills will create new opportunities for enterprises and people.

Get ready for the phygital world, its coming sooner than you think !

The anti-social social media in a Digital World

She was a teenaged student enamored by social media, trusting quickly, befriended what appeared to be similar minded youth. The emotional play slowly convinced her to take steps that would have been forbidden by her parents resulting in indescribable gory incident that left her wounded for life. Similar fate has courted many young lives globally; awareness and education being a partial cure, cutting off the connecting threads being a drastic step rarely enforceable. Peer pressure coupled with rebellious nature has not alleviated the situation significantly.

Sharing and social platforms have now been around for almost a decade, first among them took off in 2002, others followed; some are raising their heads even now. In the not too distant past everyone was going gaga over social media and its relevance to the enterprise and why it mattered to be on various social media platforms; quickly the problem morphed into an analytical one with social listening and unstructured data giving rise to a new paradigm – Big Data – that promised to provide insights hereto unknown and unthinkable.

The market segmented itself into personal social, professional networking, image sharing, chatting, and short messages with 140 characters to broadcast or send to individual subscribers (the origin being that the messaging service was built on top of the Short Message Service or popularly known SMS on mobile phones which had a limit of 160 characters). Then came convergence with each of them wanting to take mindshare from the other. Blurring lines and interconnect reduced the distinction to almost nothing for consumers and corporates.

Popularity was determined by the number of followers, connections, and shares by others of what a person or corporate account posted; which obviously gave rise to false accounts and commercial models to buy followers showing inflated numbers against a profile which was the measure of success. Slowly as the hype died down, investments were questioned and everyone scampered around to find financial models to justify their budgets. Stretch of imagination and leap of faith set aside, fear of not doing it kept depleting the coffers.

Unable to hold ground with ROI models, marketing justified brand building, customer engagement, pulse of the market, and put effort in managing negative vibes spread by dissatisfied customers. Smattering of success selectively by a few campaigns ensured that everyone kept trying as the dynamics continued to change. Individual customers made the most of the paranoia of corporates to decimate all evidence of their shortcomings until it reached a point where many just gave up or ignored the listening justifying their steps using statistics.

Success of the medium attracted unwanted elements who used social engineering methods to target the gullible; emboldened by their success, they gradually increased threat levels and expanded scope to target the young and innocent or holding naïve and unprepared corporates to ransom. Changing terms of engagement on the platforms kept everyone guessing on what next and how to keep themselves sane. In the melee emerged experts with a proficient air of confidence to part the fool from his money promising salvation.

Overloaded and fatigued by Digital flood, people sought vacations with no connectivity or rationing time to get some real work done while hundreds of messages filled with good intentions, emotional stories, knowledge snippets, motivational videos, tips and tricks, humorous anecdotes and more, all of them converging to occupy free and busy time until personally and professionally the impact begins to hurt. It also ends up overshadowing meaningful communication from those who matter while everyone runs faster to stay in touch.

How to unshackle and detox from this whirlpool of quicksand ? How to protect corporate reputation and assets ? How to keep the innocent youth shielded from nefarious elements ? How to keep customers happy and reduce negative mentions ? What can individuals and enterprises do with everyone pushing the Digital agenda as if survival depended on it ! Maybe for some it does but it is not the universal truth; Technology does not have all the answers, some of them require a different level of thinking discarding current beliefs.

I believe that we need to go back to basics and start challenging every demand on our sensibility and stop reacting to external stimulus that forces us to mimic others. Create a decision matrix that aligns to your company, industry, geography, and customer demographics. Keep a vigilant watch for the next hype with a responsive strategy; do not fear for survival, adapt to the situation. IT will play a significant role in your ability to execute, give some latitude to your CIO and IT teams, they hold some of the keys to the future.

Banning mobiles at work in the age of BYOD and Digital

Enterprise X has banned employees across all its group companies from using mobile phones in office. On July 30, it was extended to offices of all group companies, including …. The thinking behind the move, according to an employee who did not want to be identified, is that "people tend to misuse social networking sites inside office. Popular chat applications, while used for official purposes can also be used to chat with friends and family. So the management is trying to curb the unwanted use of these platforms during work hours”.

One step forward, two steps backward, or did I get it wrong, two steps forward, one step backward ! Either way it does not matter, reality for the hapless employees of Enterprise X is that one of their primary sources of collaboration and customer insights is no longer available to them. Everyone is bewildered; what was the trigger that caused it ? Did employees protest ? Did they voice their anguish to the Management ? Did the quality of work improve after the draconian law was passed ? Did output actually go up ?

On the same page of the publication was another report: “No one really doubts the importance of digital transformation to today's businesses. Our global survey found that few can deny the mounting internal and external pressure to do more than pay lip service to digital. Yet, digital adoption is not achieved without changing the behavior of the business. Management must be convinced of the business case, a thorough implementation plan must be in place, and enterprises must alter and revamp internal processes, technology, and staff to make the digital transformation”.

The founders had held on to control despite the next generation driving the business; the younger inheritors were adept at technology and current with the times however unable to challenge the occasional unilateral and irrational directions the company took. Were the business interests of Enterprise X immune to Digital disruption ? The answer is a vehement no; in fact they had led digital innovation from the front. Then something changed and they started lagging behind competition with the margin increasing with time.

Discussions on clamp down on social media and mobile enablement are in the past. Digital aspirations of enterprises changed the dialogue, while benefits from mobile computing driven by consumerization of smartphone, created new opportunities for information dissemination and customer engagement. Better telecom networks also enable geographically dispersed workers to stay logically connected thus improving collaboration and productivity. In such an environment the concentration camp mentality raises curiosity to get to root cause.

Reading the report verbatim the purported trigger was work hours being utilized for personal interest; it raises an interesting question on the dividing line between what are defined work and personal hours. For most work hours extend beyond the time spent in the place of work; laptops changed the paradigm two decades back, the smartphone redefined it a little later. Globalization of enterprises extended work hours beyond the conventional 9 X 5; whatever limited time that was remaining disappeared in the economic troughs.

Is Enterprise X giving a message that staff needs to clearly demarcate work and life hours ? Are they saying don’t indulge in any activity that can be construed as personal at workplace and similarly when they step out of the hallowed premises they shall not be expected to cast a cursory glance at the official email ? Or for that matter if the workload increases, the employees will not be expected to spend extra hours to complete tasks at hand ! An internal circular demanded people to deposit phones on the way in and take them when leaving the premises. OMG !

Everyone would nod their heads to the fact that attention span of the new generation has significantly reduced. Messages and notification craving have people checking their smartphones with increasing frequency; distractions apart, reality is that everyone is also connected to the enterprise 24 X 7 with rigor and passion unknown in the past. Weekends and vacations have laptops, tablets and smartphones as constant companions seeking wireless networks. With the work and life disconnected it’s anybody’s guess if withdrawal symptoms will emerge post working hours.

Maybe Enterprise X is path breaking with this new policy; only time will tell …

I need a Digital Vacation

A popular B2C eCommerce marketplace announced that it will shut down the website and engage customers only on the mobile phone; the news had everyone wondering about the wisdom behind such a move. Various views prevailed on the trigger towards this unusual step; speculations did not stop despite press releases that outlined the rationale behind the move. Everyone watched with abated breath when D-day arrived; a few days later a small dip in traffic and revenue was reported with an optimistic view that they will bounce back.

It is published statistics that number of smartphones is increasing globally; the personal device is also becoming the primary means to access Internet, browse, check email, communicate, socialize, and do some personal and official work. Phones are also getting smarter, larger, with higher compute capacity now beginning to rival computers of a not too distant past, offer reasonable mobile storage and increasingly better cameras. Conventional wisdom says that mobile is and will remain the primary device of choice.

Then the latest hype and hoopla is around wearable technology; it all started with glasses (the kind you wear on the eyes) mimicking some of the futuristic movies of the 90s depicting humanoids with special powers. Next came fitness bands which offered alternative ways to view limited information while they monitored body vital functions; these were followed by smart watches wanting to change the way you consume information. Seesawing between screen sizes, each device competed for attention by offering notifications of all types (see Divergence is …).

Did I forget tablets which now masquerade as mini-laptops or phablets that disguise themselves as big sized phones or handy sized tablets ? Crossovers of all types have attempted to bridge a perceived gap until they either became the standard or irrelevant. Case in point as an example, laptops with touchscreens or tablets with keyboards competing for bag space. Depending on need and at times driven by corporate policy, there are cases where both have won and coexist as personal and work device.

Are we obsessed about staying connected or is technology pressurizing us into compulsive behaviour for the next notification or alert. Who benefits from connected devices and alarms that keep us on our toes ? Is our life changing for the better or worse with guiding forces that we no longer control ? From a closed society that valued privacy we have moved to an open world where almost everyone has access to life events that we decided to share and then exercise control on who can see them forgetting that it has been cataloged for data mining !

Coming back to the Thing that could/will be the primary information creation and consumption device(s), it is quite likely and highly probable that contextually there will be separation. We will have the choice on how we would like consume; willingly or inadvertently we will be broadcasting data into the servers of service providers, marketers, and feed analytical engines through the various Things that on or off us will monitor what we are up to in our lives and the feedback mechanism will to nudge our choices subconsciously.

Information consumption shall extend beyond visual interactions to encompass auditory as well as kinaesthetic experience. I think the phone as we know it today will probably retain a large share while other form factors (may be integrated into the phone or discrete) will complete the experience. Change contextually will be driven by where we are, what we are doing, who are we with, time of the day, at work or home or leisure, traveling or stationary, and finally personal choice based on peer influence and personal comfort.

There will also be forced or chosen moments of disconnected bliss (let’s call it Digital Vacation) until withdrawal symptoms give way to the craving or we time out the detached life. Extreme cases would undergo Digital detoxification camps and participate in support groups (not digitally but in person) and be monitored actively ironically by digital devices. Does this situation sound too dramatic, hypothetical or out of science fiction ? Well I believe that the future is already here for some while others will catch up sooner than later.

Blessed would be a few who can at will detach themselves and have no impact on professional or personal life. 

Sliding IT security priorities put enterprises at risk

I read somewhere about the government’s intent to increase budget allocation towards fighting and creating cybersecurity awareness. The link was hidden somewhere towards the bottom of the newsletter; quickly I clicked through to read word by word the good news and realized that it was indeed true ! The chart showing CAGR was quite impressive with the trend line going north; then I looked again at the Y axis to find that the investment per annum was so low that the entire news was like actually too scary to be funny.

Not too long ago when I wrote about Creating Secure & Safe Enterprise, many CIOs and CISOs wrote back with their personal experiences; most of them agreed that their realities were reflected within. Some of the interesting facts that emerged is that budgets were a challenge, but then not really a challenge when an incident occurred. With corporate focus on short-term goals and measurement of tactical performance, the biggest challenge that everyone unanimously portrayed was that of sliding priorities with security settling close to the bottom.

Why is security investment such a drag when it comes to budgeting and spending ? Why do enterprises and with that I imply the CXOs who collectively represent the Management believe that they don’t really need to invest in protecting their information assets which are family jewels in most cases ? What creates such a lackadaisical attitude towards creating process, policy, and implementing tools that provide a secure framework to do business despite the fact that threats are increasing and businesses are losing customers, revenue and credibility !

Everyone agrees in principle that security is a must; they (the CXOs) espouse this in conferences and project themselves as the messiahs of information protection and security. When one such leader was asked pointed question on the budget allotted, he sidestepped the question deftly instead talking about how the industry needs to up the ante. The lip service that ignores the elephant in the room is beginning to hurt enterprises. The cause for such an attitude towards keeping the doors and windows open has to be deeper.

I am not that big and not an attractive target for anyone ! Why would any hacker want to breach our security ? Our customer data is locked up on one computer and only two people have access to it; they are both trustworthy. We don’t have anything worth stealing, so why would anyone compromise our systems ? We know internal threats are higher than external, we have information distributed across multiple solutions, so no one can decipher the full picture; we have locked USB, installed anti-virus and firewall, isn’t that enough ?

Is lack of awareness or education creating a false sense of security and complacency ? Or is it a belief that such things happen to others and I am safe ? Is CXO ignorance and indifference an acceptable proposition towards defining the security posture of an enterprise ? When you live dangerously sooner or later an adverse incident does occur and that is when the scapegoat syndrome always ends up pointing fingers at the CIO or the CISO, and/or the service provider. Breaking this paradox is the need of the hour for enterprises.

No one wants to fall sick or die but everyone takes health and life insurance ! Investments in security are like insurance to protect the business. Physical security has seen this paradigm shift with electronic tags and biometric solutions becoming the norm. With the number of threats increasing and new ones emerging, the education of CXOs is not just an imperative but an urgent need. CIOs, CISOs, Internal Audit, and Risk Committees have to own up the information protection agenda and drive it with their collective might.

Using ethical means to understand vulnerabilities and fixing them should be high in the corporate agenda towards creating a safer digital enterprise. Customers and consumers are becoming sensitive to this fact and the probability of them taking their business elsewhere is beginning to happen. A safe and secure ecosystem is required for the extended enterprise including suppliers, contractors, partners, and customers. The writing on the wall is that companies who emerge as secure digital enterprises will be winners of the future.

Where are you ?