Posted on

SURVIVAL OF THE SMARTEST / CYBERCRIME EN VEILIGHEID

BCT_survival_of_the_smartest

Als kennisgedreven organisatie werkend voor kennisintensieve bedrijven, ligt onze focus doorgaans op de technologie. We faciliteren organisaties om vanuit data de juiste informatie boven te krijgen.

Vervolgens interpreteert de professional de informatie, waardoor deze transformeert in waardevolle kennis en relevante know-how. Daarvoor is het belangrijk dat de breinkracht van de professional adequaat, betrouwbaar en fit blijft. Het brein is immers de transformator van informatie naar kennis.

Om als organisatie mee te gaan in het snel veranderende IT-landschap, hebben we het brein dus hard nodig. We spreken niet langer meer over survival of the fittest, maar over survival of the smartest. Vanuit onze corebusiness dragen wij zorg voor de IT-kant van dit verhaal, maar we zijn van mening dat de andere component, het brein, minstens zo belangrijk is.

We vertellen dan ook graag het verhaal van de technologie en koppelen dit aan het brein middels een achttal trendpapers. Van intelligente devices tot big data, managed services, cloud en nog veel meer – alles komt aan bod.

We wensen u veel leesplezier!

Cybercrime…

Het is een onderwerp waar de gemiddelde persoon het Spaans benauwd van krijgt. We kunnen ons allemaal het worstcasescenario voorstellen, weten dat hacks en phishing aan de orde van de dag zijn. En toch laten we met z’n allen de achterdeur openstaan – zowel zakelijk als privé.

Het is niet voor niets dat volgens het CBS afgelopen jaar ruim 1.2 miljoen Nederlanders slachtoffer zijn geweest van cybercrime. Willen we dit digitale gevaar het hoofd bieden, dan is bewustzijn een must.

Bewustzijn rondom de technologische kant: hoe ontwerp je veilige software? Moet je daarvoor naar de cloud? Is blockchain de oplossing? Maar ook de humane kant: wat kunnen wij hier als mens mee en wat gebeurt er in ons brein als het aankomt op veiligheid? Dit trendpaper behandelt de belangrijkste facetten rondom de technologietrend cybercrime en exploreert de bijbehorende state of mind.

CYBERCRIME EN VEILIGHEID

Een kleine inventarisatie in IT-land leert ons dat er onder de noemer veiligheid een drietal sub-trends hangen. De eerste betreft de Algemene Verordening Gegevensbescherming (AVG) die geldt sinds 25 mei 2018 en een grote impact heeft op het organiseren van informatiebeheer.

Privacy is waar het hier om draait. Een ander domein gaat over archiefwetgeving: hoe wordt informatie bewaard? Tot slot spelen dataveiligheid en datazekerheid een grote rol. Deze trends zijn niet allemaal even eenvoudig te waarborgen en dat wordt pijnlijk duidelijk uit de regelmatige berichtgeving over bedrijven die last hebben van cybercrime. Het laat zien dat beveiliging nog te vaak een ondergeschoven kindje is.

De eeuwige ratrace tussen aanval en verdediging

Dat beveiliging niet de aandacht krijgt die het verdient, betekent niet dat er geen bewustzijn bestaat rondom het onderwerp. Iedere organisatie is ervan op de hoogte dat het cyberdomein voor criminelen dé ingang is naar gevoelige bedrijfsgegevens.

Zo werden er in 2018 welgeteld 20.881 datalekken gemeld aan de Autoriteit Persoonsgegevens. In 2017 waren dat er nog 10.009. Gedegen beveiligingsmiddelen hebben voor de IT-afdeling daarom de hoogste prioriteit. Helaas is het niet zo eenvoudig als het bouwen van een hoge muur. De mens is ontzettend vindingrijk en laat zich niet zomaar tegenhouden. Dit vertaalt zich in de wereld van cybersecurity naar steeds complexere aanvallen, die op hun beurt vragen om een steeds complexere verdediging. Daarnaast is het ontzettend lastig om aanvallen tijdig te signaleren en de benodigde maatregelen te treffen. Hierdoor wordt in veel gevallen pas gehandeld als de problemen al bestaan.

Het inregelen van cybersecurity draait daarom ofwel om het voorkomen ofwel om het beperken van de impact van aanvallen. Het is een continu proces, een voortdurende ratrace tussen aanval en verdediging.

Beveiliging first

Gelukkig zit er ook een positieve kant aan het kat-en-muisspel tussen aanval en verdediging. Binnen software-ontwikkeling is nu namelijk een veel grotere focus op beveiliging. Deze focus was er in het verleden uiteraard ook, maar vormde toen nog een separaat onderdeel in de ontwikkeling van software.

Nu is het vrijwel ondenkbaar om niet uit te gaan van het zogenaamde security by design, wat betekent dat de software vanaf de basis is ontworpen om veilig te zijn. Hetzelfde geldt voor privacy by design. Deze principes vormen de grondbeginselen van goede software.

Ook de opkomst van nieuwe technologieën zoals mobiele technologie en de cloud, heeft eraan bijgedragen dat beveiliging steeds meer een randvoorwaarde vormt in het ontwerpen van software. Nu informatie altijd en overal beschikbaar is voor iedereen, praten we niet meer alleen over een veilige IT-omgeving met een firewall en beheerder.

Organisaties komen in aanraking met hele andere beveiligingsoverwegingen en kunnen het zich niet meer permitteren hun data op één plek achter één firewall weg te zetten. Het antwoord daarop in de markt is blockchain, oftewel het versnipperd opslaan van informatie.

Het inzetten van blockchain gaat echter niet met één druk op de knop. Ook in dit geval moet software vanaf de basis gebouwd zijn om hiermee te kunnen dealen. Beveiliging first dus.

Kennisborgen in het organisatiegeheugen

Wanneer de basis is gelegd en bewustzijn rondom het belang van ‘beveiliging first’ bestaat, is de vraag wat je als organisatie op technisch vlak kunt doen. Informatie veilig en compliant opslaan is stap één, zeker in het geval van informatie waarover de organisatie zich moet kunnen verantwoorden. Ervoor zorgen dat alleen de juiste personen toegang hebben tot de juiste informatie is stap twee.

Om dit te realiseren is het verstandig gebruik te maken van bewezen informatiemanagementtechnologieën die garant staan voor informatieveiligheid. Hiermee ben je al een heel eind, maar wil je écht inzetten op veiligheid dan is het belangrijk de organisatieprocessen zo in te richten dat je er lering uit kunt trekken.

Wanneer er zich een veiligheidsbreuk voordoet, bestaat er dan een geheugen waarin je terug kunt kijken om te zien hoe er eerder gehandeld is? De mens heeft de neiging vervelende ervaringen snel te vergeten. Des te belangrijker is het om hier als organisatie streng op te zijn en alle kennis goed te borgen.

Zet die extra stap en zorg niet alleen dat informatie veilig is opgeslagen, maar haal er ook waarde uit. Met andere woorden: zorg voor verantwoord, duurzaam en veilig informatiemanagement waardoor informatie direct en in de juiste context beschikbaar is op een transparant, compliant en toekomstgericht platform.

Zo kun je de regie blijven voeren over je professie en de kansen benutten die de digitale wereld biedt.

HET BREIN & VEILIGHEID

Wat gebeurt er in ons brein als het gaat om (digitale) veiligheid? We maken een kleine uitstap. Om te begrijpen hoe ons brein handelt als het gaat om veiligheid vallen we terug op het “drie-enige brein” model van Paul MacLean.

Dit model, dat MacLean ontwikkelde in de jaren 60, is gebaseerd op de verdeling van het menselijke brein in drie afzonderlijke regio’s: het reptielenbrein, het limbisch systeem en de neocortex. MacLean suggereert dat deze regio’s hiërarchisch zijn georganiseerd, gebaseerd op een evolutionaire kijk op de ontwikkeling van het brein.

Hoewel dit model een sterk vereenvoudigde opvatting van de werking van het brein is, biedt het een gemakkelijk te begrijpen benadering van de hiërarchie van breinfuncties.

Het reptielenbrein is, zoals de naam doet vermoeden, het deel van ons brein dat afstamt van de reptielen. Dit brein is verantwoordelijk voor onze basis overlevingsinstincten zoals de hartslag, ademhaling en lichaamstemperatuur.

Functies die onder dit deel van de hersenen vallen hebben voorrang op andere hersen activiteit. Wanneer we ons in een levensbedreigende situatie bevinden, zal het reptielenbrein als eerste reageren. Hier houden onze oerdriften zich namelijk ook schuil. Als we in gevaar zijn en snel moeten reageren wordt het reptielenbrein actief en bereidt het ons voor op actie door stofjes in het hele lichaam vrij te laten komen. Dit onderdeel van ons brein kent geen emotie en handelt puur reflexmatig.

In een later stadium van de evolutie heeft het limbisch systeem zich ontwikkeld, waarin emoties een grote rol spelen. Dit is het reactieve deel van het brein dat de ‘vecht, vlucht, of verstijf’ reactie initieert. Belangrijk hierin zijn de hippocampus, de amygdala en de hypothalamus die samen een snel, onderbewust evaluatie- en reactiesysteem vormen dat is ontworpen om ons veilig te houden.

De amygdala fungeert hierin als een vroegtijdig waarschuwingssysteem dat het motto ‘safety first’ hanteert. Het zorgt ervoor dat we eerst onszelf in veiligheid brengen, alvorens de neocortex (het uitvoerende brein) te raadplegen.

De amygdala evalueert dus heel snel, zij het niet altijd nauwkeurig, en zet inkomende informatie van de thalamus snel door naar de hypothalamus die een reactie initieert. De hippocampus speelt ook een belangrijke rol bij het vastleggen van gebeurtenissen en bij het verplaatsen hiervan van het korte- naar het langetermijngeheugen.

Tot slot is er de neocortex, het uitvoerende deel van ons brein dat verantwoordelijk is voor alle ‘intelligente’ activiteiten zoals taal, abstract denken, verbeelding en creativiteit.

Het herbergt ook veel van ons geheugen – niet alleen situaties die we meemaken, maar ook alle herinneringen die essentieel zijn om te kunnen praten, schrijven, wandelen en talloze andere activiteiten. In de neocortex bevindt zich de prefrontale cortex, dat trager reageert op binnenkomende informatie dan het limbische systeem, maar veel geavanceerder is in de verwerking ervan.

Complex denken op technisch, emotioneel, sociaal en logisch vlak vindt hier plaats. Maar is er sprake van een waargenomen dreiging, dan kan de prefrontale cortex ‘gekaapt’ worden door het limbische systeem en ‘offline’ gaan om ons veilig te houden.

Posted on

Skincity: Med hjälp av Bitlog har vi blivit mer än 70% mer effektiva

bitlog_skincity

En av de stora utmaningarna för e-handlare idag är att skapa en effektiv och lönsam lagerhantering som är anpassad efter företagets storlek. Bitlog har sedan 2006 levererat innovativa mjukvaror för lager och distribution där målet är att skapa system som gör att de tidskrävande rutinerna i lagerhanteringen försvinner. Med gedigen erfarenhet och kunskap tar de sig an några av Sverige snabbast växande e-handlare och hjälper de att bli mer effektiva och lönsamma i sitt arbete. Ylva Pagmén, Chief Operating Officer på Skincity berättar:

– Vi hade behov av att hitta en leverantör med ett genuint intresse av att hitta lösningar och arbetssätt som passade vår verksamhet och som vi kunde arbeta med under vår tillväxtresta.

Skincity, Sveriges största hudvårdsklinik online, hade utmaningar med effektiviteten vid bland annat orderplock. Logistikavdelningen bestod av hudterapeuter som tack vare stor produktkunskap lyckades plocka rätt produkter men i takt med att de växte uppstod nya behov i orderplocksprocessen. Bitlog hjälpte Skincity att automatisera logistikflödet genom sina lösningar.

– Tidigare plockade vi en produkt åt gången, men efter att ha fått hjälp att automatisera processen kan vi nu plocka tolv ordrar på samma gång, något som ökat vår effektivitet kraftigt, säger Ylva Pagmén.

Enligt Bitlogs grundare Fred Boström handlar det om att ha väl integrerade system mellan e-handel, affärssystem och lagersystem för att skapa ett effektivt arbetsflöde. Att automatisera delar av lagret innebär ofta stora effektivitetsvinster när den mänskliga faktorn stängs ute från flödet. Dels genom att ordern direkt når lagret på ett automatiserat sätt och dels genom att hantera eventuella avvikelser som kan uppstå, så som förseningar eller saldobrist som i sin tur kommuniceras till kunden.

– Vårt samarbete med Bitlog har förändrat vårt arbetssätt mycket. Framförallt i plock- och packprocessen där vi blivit mer än 70% mer effektiva, förklarar Ylva Pagmén. Redan efter en månads samarbete märkte vi av resultaten och blev snabbt 50% mer effektiva. Även kvaliteten i form av kontroll på lagersaldo och lägre felplocksfrekvens har blivit bättre. Vi har tillsammans tagit fram en fantastiskt bra plattform för oss att stå på, en plattform som gör det möjligt för oss att fortsätta växa, sammanfattar Ylva.

Bitlog faktaruta

Bitlog har sedan 2006 levererat moderna lösningar för smart lagerhantering. Företaget grundades av Fred Boström som tidigare arbetet på andra företag med stora utmaningar inom lager- och distributionsområdet.

Besök www.bitlog.se för att läsa mer

 
Posted on

Mensch und Marke am Scheideweg – eine Frage des Vertrauens

Das Ringen um Aufmerksamkeit beim Kunden wird zunehmend härter: online, offline und mobil. Globaler Wettbewerb und zunehmende Vergleichbarkeit sorgen für schwindende Markenloyalität, die Konkurrenz scheint oft nur einen Klick entfernt. Hinzu kommt, dass Konsumenten heute zwischen verschiedenen Geräten wechseln und auf unterschiedlichsten Kanälen mit Marken interagieren. Die klassische Customer Journey wird seit Jahren komplexer, ein ehemals präzises Bild möglicher Interessenten verschwimmt zusehends mit der steigenden Anzahl an Touchpoints, die Unternehmen heute bieten (müssen).

Christoph Kull

Wer in diesen Zeiten nun einfach die eigene „Lautstärke“ erhöht, um noch Gehör zu finden, trägt meiner Meinung nach zum kollektiven Dilemma bei, in dem wir uns befinden. Ein erhöhtes Grundrauschen ist kontraproduktiv, ressourcenintensiv auf Unternehmensseite und für Konsumenten wird es bestenfalls unübersichtlicher, oftmals leider anstrengender. Wirklich zum Kunden durchdringen kann heute nur, wer konsequent auf Relevanz statt auf Marktschreier-Mentalität setzt. Voraussetzung dafür ist jedoch ein präzises Bild der (potentiellen) Kunden, um diese hochpersonalisierte Ansprache und individuelle Relevanz erfolgreich anbieten zu können. Das funktioniert nur über Daten und an dieser Stelle kommt Vertrauen ins Spiel.

Vertrauen ist der Schlüssel jeder erfolgreichen (Kunden-)Beziehung

Was zeichnet eine gute Beziehung zwischen Mensch und Marke aus? Zum einen sicherlich eine gute Erreichbarkeit im Bedarfsfall und eine hohe Konsistenz in Aussage und Markenauftritt über alle Kanäle. Zum anderen aber – und da unterscheidet sich die Kundenbeziehung nicht sonderlich von der zwischenmenschlichen – entscheidet das Vertrauen über die Qualität der jeweiligen Beziehung. Wer die Datenschutzgrundverordnung (DSGVO), die jüngste Rechtsprechung des EuGH zur Opt-in Pflicht für Trackingtools oder den fortschreitenden Standard populärer Browser, Drittanbieter-Cookies automatisch zu blocken nun verantwortlich für schwindenden Kundenkontakt macht, sollte sich fragen, welche Art von Beziehung das eigene Unternehmen bislang zu seinen Kunden unterhält. Ich bin überzeugt, dass wir an einem Punkt angekommen sind, an dem Marken das Verhältnis zu ihren Kunden überdenken und neu definieren sollten.

Für echte Beziehungen gibt es keinen Shortcut: Vertrauen wird langsam aufgebaut und ist ein hohes Gut, mit dem wir behutsam umgehen müssen. In keinem Fall erscheint es mehr ratsam, dies in die Hände Dritter zu legen. Anders gesagt: Marken sollten es zu einer ihrer ureigenen Kompetenzen machen, das Vertrauen ihrer Kunden zu gewinnen und zu pflegen. Dafür sind Transparenz und Wahlfreiheit gefragt: In einer neuen Beziehung lernen wir unseren Partner schließlich auch Schritt für Schritt besser kennen. Manches erzählt man gleich beim ersten Treffen, persönlichere Details geben wir erst preis, wenn wir dem Anderen vertrauen. Gleiches gilt auch für die Beziehung zwischen Marke und Kunde: Vertrauen und ein klar ersichtlicher Mehrwert, dass auf Basis von besseren Daten auch das Kundenerlebnis viel besser wird, sind entscheidend, um eine echte, langfristige Beziehung zu etablieren und authentisch mit den eigenen Kunden kommunizieren zu können. Der Weg zu diesem neuen Verhältnis führt meiner Meinung nach zwangsläufig über die eigene Datenwirtschaft. First Party Data ist der ehrliche unverstellte Blick auf die Qualität meiner Kundenbeziehungen. Das zeigt auch unsere im vergangenen Herbst veröffentlichte Studie „Across the Ages“: Für ein besseres Kundenerlebnis würde die Mehrheit der Konsumenten ihre Daten durchaus mit einer Marke teilen – sofern sie dieser vertrauen.

Je größer das Vertrauen im Laufe der Beziehung wird, desto eher sind Kunden bereit, weitere Daten mit einer Marke zu teilen – diese können sich mit dem Einlösen Ihres Versprechens von passgenaueren Informationen und Angeboten revanchieren. Das wiederum steigert die Kundenzufriedenheit und damit auch ihre Loyalität. Wer in diese Form von Beziehung investiert, hebt sich von der Konkurrenz ab und investiert in die eigene Wettbewerbsfähigkeit.

Autor: Christoph Kull

Posted on

Master your true leadership in retail

The retail industry is currently evolving to keep up with Industry 4.0 and John Brahim, CEO & AI Business Architect at Maistering BV believes that digital innovation will be even more at the heart of the fast-changing sector. Brahim shares his knowledge and insights in this article on the path to master leadership in retail. While talking about Master Collections, a brand-new orchestration platform, he shares five practical guidelines on incorporating digital innovation and applied AI. Good reading for those who aim to co-shape the future of retail.

Innovation Transforms Consumers, Enterprises, and Leadership Alike

As the retail industry undergoes a massive transformation with the Fourth Industrial Revolution, a new type of leadership will play a crucial role in leading the charge towards digital transformation of the retail sector. Brahim outlines the steps that retail leaders might take to reinvent themselves and shape Retail 4.0, a lesser-known twin of Industry 4.0.

“Retail is shaking on its foundations as applied AI will infuse the current digital innovation wave. Like now, the sector will be driven by consumers that demand digital era shopping and delivery experience allowing them to combine ease, ratio, and emotion fitting to their style and choices. However, the way these preferences will be expressed, perceived and translated across the channels, will become much, much more sophisticated.”

Brahim continues, “This forces retail leaders into numerous, never-ending transformation journeys. Maistering’s sole mission is to augment retail leaders and their teams. Master Collections, our platform is an unparalleled set of AI-based collaborative services to orchestrate magical business journeys. Master Collections require limited set-up effort and allow retail leaders to reinvent their play in a natural way, both the big picture and the day-to-day work one step at a time. But I don’t want to emphasize the platform, as innovation is always about leadership: it takes a visionary leader to adopt a visionary approach.”

As it is with all emerging technologies and innovation, organizations and businesses must be prepared for change. Legacy thinking often slows down or even impede change, however, Brahim points out there are established ways to facilitate innovation in mature organizations.

“Innovation is always a mix of technology, new paradigms, new instruments with behavioral change – mental and emotional. First tip: acknowledge that innovative change is now at the core of your job and lead by example by embracing AI in how you orchestrate and collaborate.”

Any new method, process, product or service introduction that comes out from innovation typically results in change – change in people, ways of working and unlearning and learning. Brahim believes that it is essential for leaders to build the right team, inspire them with the right focus on impact and empower them with the ability to intelligently move ahead.

Of course, to ensure a successful innovation process, the onus will be on leaders to be effective in their role to lead both employees and partners towards sustainable business growth.

“Since innovation comes from everywhere, leaders should have the ability to tap into the employee base, get ideas, and suggestions, nurture them and develop solutions to implement them – thus ensuring a successful innovation process. As this is a collaborative world, this is equally true for partners. Since most change is people-related, it is imperative to keep a good eye on the emotions, motivate people and ensure that the team is on board and along with you on the journey. Second tip: assure that you use the new generation collaborative tools to help your team and your partners undertake these crucial journeys.”

Integrating Digitalization and Partnership To Push Innovation

“It is an illusion to think that one can lead to an era of digital innovation without embracing digital behavior and AI augmentation. Leaders need not be technologists themselves but indeed must become hands-on in using AI in everything they do. Key is to act holistic, really focus on transformation journeys from early intention to final touch down and impact. Third tip: leverage AI in all facets of your job: exploring, aspiring, plotting, inspiring, disrupting, mobilizing, executing.”

Brahim understands that a leader has many business journeys running in parallel and has to bring insights at their fingertips, frame them from multiple lenses to translate them into actions that will lead towards profitability and customer delight. All of these can be aided by AI-technologies that exist today.

And Maistering understood this as their platform, Master Collections, addresses this topic by providing leaders the ability to run magical business journeys with essence, beauty, and impact.

“Innovation today is now more than ever a collaborative process. It is about undertaking experimental journeys with customers and partners in ways that are joyful, fast, rich, and impactful,” notes Brahim.

“Master Collections has an entire atelier of management techniques to shape transformational journeys. Some leaders are biased towards purpose, most are centered on action, some are too content-based, many have difficulty with the emotional side of change. No wonder so many digital initiatives fail. Fourth tip: teach yourself how to look at magical journeys from different angles, also the ones that do not come to you naturally.”

But how to drive AI-based innovation with a legacy systems landscape? 

Brahim acknowledges that legacy systems often do not really help business leaders “to be on their toes – listen to customers, their buying choices, their experience of the service they get; and to partners and stakeholders to leverage this information in real-time and respond quickly to the changing dynamics of their business.”

Still, he doesn’t plead for wall-to-wall implementation of new systems. “Too often, enterprises lose themselves in costly re-engineering of their systems landscape, only to discover that they end up with a new generation of legacy. IT efforts should definitively focus much more on collaborative data harmonization in the sector. Fifth tip: pay more attention to emerging external content services and leverage legacy systems better by combining them with new generation orchestration services.”

Dealing With Your Strong and Weak Points When It Comes To The A.I. Revolution

Understanding both their AI and behavioral change is a necessity for businesses to lead in retail 4.0. True, new players often have an advantage in the first part of the equation. So, Brahim believes that established leaders should learn from new leaders to leverage AI-based innovation. He recommends established leaders to:

“Relentless drive towards digital experiences and willingness to bet on AI as it will change everything. Then again: established leaders know how to mobilize people. The combination will fuel journeys that combine speed, sophistication, and common-sense feasibility.”

Of course, in the retail industry, innovation can come from different areas of technology. The reason Brahim has strong convictions that Artificial Intelligence will take center stage is based on how it will impact the shopping experience.

“The real revolution is still to come.AI will completely change the connection between consumers, retailers, producers, and the products & services: with conversational interfaces, cognitive abilities, virtual experiences, and proactive personal suggestions and conditions.”

In addition, AI will also lead to new levels of digitalization and automation of production and distribution. For businesses to lead in Retail 4.0, they need to start implementing AI as a core part of their strategy.

Ultimately, Brahim is confident that the retail sector will not suffer, but benefit from AI-driven innovation and that “business leaders adopting AI technologies; new ways of working, will orchestrate magical journeys that allow them to master their true of retail leadership.”

Posted on

Das Zusammenwirken von Technologien, Prozessen und Menschen verbessert die IT-Sicherheit

cyberark_IT_sicherheit

Autor: Michael Kleist*

Viele Unternehmen halten ihre Daten in Silos, und genauso fragmentiert betreiben sie auch ihre IT-Sicherheit: räumlich oder nach Applikationen getrennt. Vor allem die IT-Sicherheit braucht aber ein integriertes Konzept, das Technologien, Prozesse, Mitarbeiter und sogar die Schatten-IT berücksichtigt. signing out team. dont stay on too late chr

Zuverlässige IT-Sicherheit beginnt bei der Architektur. Erste Sicherheitsmaßnahmen umfassen etwa den Perimeter-Schutz mit Antiviren-Lösungen und Firewalls, aber auch Privileged Access Management sollte State-of-the-Art sein, um Angriffsvektoren abzuwehren. Entscheidend ist, dass solche Lösungen nicht isoliert betrieben, sondern miteinander verzahnt werden: Beim Privileged Access Management etwa sollte auch eine Integration mit SIEM (Security Information and Event Management)-Systemen und SOC (Security Operations Center)-Services vorhanden sein.

Diese Integration ist wichtig, denn eine einzelne, als Silo implementierte Lösung kann durchaus zusätzliche Sicherheitsgefahren mit sich bringen, wie das Schwachstellen-Scanning zeigt, das unter anderem auch Marktforscher Gartner empfiehlt. Das Problem dabei ist, dass Cyberkriminelle auf Systeme mit hochprivilegierten Accounts zugreifen, um etwa den aktuellen Patch-Stand oder die Konfiguration zu überprüfen. Eliminiert werden kann ein solches Risiko nur mit einer ergänzenden Lösung, die ein Passwort für den Schwachstellen-Scanner nur für kurze Zeit bereitstellt – mit einer anschließenden Passwort-Rotation; damit wird ein Angriffsvektor geschlossen.

Ein weiteres Risiko, das in Unternehmen lauert, ist die Schatten-IT. Will ein Unternehmen bei der Sicherheit integriert vorgehen, ist es wichtig, alle Aspekte, Applikationen und Systeme der Schatten-IT zu ermitteln, schließlich gilt: Was ich nicht kenne, kann ich auch nicht sichern. Dabei müssen sowohl vergessene Systeme als auch Anwendungen, die bewusst unter dem Radar der IT betrieben werden, Berücksichtigung finden.

cyberark_IT_sicherheit

Gleiches gilt für die OT (Operational Technology)-Sicherheit. Oft behaupten Unternehmen, eine strikte Trennung zwischen IT und OT sei vorhanden, in etlichen Projekten hat sich aber gezeigt: Es gibt oft Schnittstellen und Hintertürchen, die keiner kennt. Eine hohe OT-Sicherheit kann aber nur gewährleistet werden, wenn solche Nahtstellen ermittelt und für alle relevanten Geräte, Ports oder Verbindungen adäquate Sicherheitsmaßnahmen ergriffen werden – etwa mit der Überwachung vor allem privilegierter Zugriffe von IT-Clients auf kritische OT-Ressourcen und einer Unterbindung des Zugangs bei verdächtigen Aktivitäten.

Technologie ist aber nur ein Aspekt der IT-Sicherheit: sie umfasst auch organisatorischer Belange, also unternehmerische Prozesse, die ebenfalls geschützt werden müssen – selbstredend. Und in diesem Fall gilt ebenso die Maßgabe für Unternehmen, einen integrierten Ansatz zu wählen. Wiederum bezogen auf das Privileged Access Management sollte auch eine Vernetzung mit Lösungen von Identity-Management-Anbietern gegeben sein. Für Unternehmen ergeben sich dadurch mehrere Vorteile: von einer harmonisierten Definition von Workflows oder Prozesslogiken, etwa für Rollenfreigaben, bis hin zur optimierten Umsetzung von Governance- und Compliance-Vorgaben in Prozessen. Außerdem ist die Integration aus zwei weiteren Aspekten von Nutzen: Die Eliminierung von Doppeltätigkeiten reduziert sowohl Fehleranfälligkeit als auch Betriebskosten.

Gefördert wird das Silodenken in der IT-Sicherheit oft durch Compliance-Themen: Das ist aber nicht der richtige Weg. Eine Compliance-Vorgabe kann etwa lauten, dass PCs mit Antiviren-Software ausgestattet sind. Ebenso wichtige Maßnahmen wie die Auswertung der Daten oder ihre Weiterleitung an ein SOC sind aber in den seltensten Fällen Anforderungsbestandteile. Man könnte sagen: Gute Compliance führt nicht zwingend zu mehr Sicherheit, gute Sicherheit hingegen führt zwangsläufig zur Compliance.

Nicht zuletzt muss auch der Faktor Mensch ins Kalkül gezogen werden. Regelmäßige Sicherheitsschulungen sind Pflicht: Es muss deutlich gemacht, dass Sicherheitsmaßnahmen keine Gängelung darstellen, sondern der Risikominimierung dienen, auch wenn sie vereinzelt den Benutzerkomfort einschränken mögen. Voraussetzung für eine breite Akzeptanz ist, dass klar gemacht wird, warum welche Maßnahmen konkret ergriffen werden.

Insgesamt kann eine hohe Sicherheit nur durch einen ganzheitlichen, durchgängigen Security-Ansatz erreicht werden. Das heißt, ein Unternehmen muss unter Nutzung verschiedenster Technologien eine sicherheitstechnische und organisatorisch-prozessuale Integration vornehmen – und darf dabei den Faktor Mensch nicht vergessen.

* Michael Kleist ist Regional Director DACH bei CyberArk in Düsseldorf

Posted on

No Business without IT

Wanting to implement innovations quickly, companies often develop digital process inside the different departments without the adequate involvement of IT. This leads to isolated solutions within the organization. But solutions can only deliver true added value for the entire company if they can be scaled and integrated with each other.

The digital transformation has reached the company. However, departments often introduce SaaS-based applications on their own, or they develop their own solutions. This leads to the uncontrolled growth of incompatible systems.

 

Examples of isolated solutions in a production operation

  1. The purchasing department has a platform for supplier management that enables digital purchase orders. The specifications and volumes, on the other hand, are e-mailed to the production department and must then be entered manually.
  2. The sales department uses an independently developed web portal that provides customers with 3D models of products, which can then be customized. However, the product information is manually entered into the tool since the interface to the product information management system does not work properly.
  3. Production uses a manufacturing execution system that digitally displays the various production steps. But forecasts about production capacity, the finishing of individual products and defective products must be determined manually by analysis and provided to other departments as Excel reports.
  4. The development department uses a CAD system that sends drawings directly to the various machines. But the department is missing the experience data for cost-effective and reliable materials from production and purchasing.

This means that manual interfaces are required to exchange data, but they also represent a potential source of error. Therefore the systems should be integrated across the departments to warrant complete data integrity and availability.

In the case of a production company, this would allow customers to modify their product during the production process, actually see the progress and track the shipment in the web portal. The supplier management tool automatically receives data on current purchase orders and inventories. Supplier orders are automatically adjusted based on forecasts for product demand. And the development department always has access to current prices and production experience. The result: the cost-effective and efficient series production of individual products.

The role of IT in the digitization process: from service provider and enabler to driver

As a result, digitization requires a holistic approach for companies, their value chains and in particular their IT organizations. But IT must also accept and be allowed to practice this new role. In practice, it often finds itself trying to balance the requirements for rapid, efficient, agile, scalable and innovative digitization in the company with the growing IT independence of the various departments. These often view the IT organization as a hindrance, inflexible or old-fashioned. And so they go ahead and do their own thing – using Cloud services or external developers.

But it is exactly these types of isolated solutions that frequently lead to rising administrative expenses, more complexity and not least increased security risks since the existing governance requirements and guidelines do not cover these cases. The result:

Therefore the IT department (whether the other departments like or not) must strictly control the use of customized solutions and approaches during the digitization process. But by doing so, it cannot act primarily as a hindrance, but rather as the keeper and enabler of new business models. The IT department has several trump cards over its colleagues in the other departments: It focuses on what is good for the entire company and it has the flexibility to pro-actively find the required service providers. In addition, it can organize or manage tenders to negotiate the best terms with external providers.

The new IT organization: DevOps, agility and business partnering

To complete this transformation, IT departments must develop and pave the way for the future particularly with regard to the IT organization, business centricity and technology. They must assume responsibility for the scalability of the new digital solutions. In addition, they must ensure that processes are fully thought through, developed and automated, and that they can be integrated into the overall organization in a flexible and (if needed) agile manner.

This means: The processes in the IT department are increasingly changing in the direction of an agile collaboration with departments. Moreover, the IT team increasingly assumes advisory and managing functions. To this end, it must push for the following:

  1. recruit employees with the right skills, who understand agile methods and carry them into the company
  2. make data-based decisions on the basis of Data Analytics and prevent incorrect decisions due to a lack of skill or information
  3. despite higher levels of security, reduce the complexity in the operation while remaining flexible to reduce the required amount of time and resources
  4. lower IT costs with transparent IT controlling and service management to remain competitive
  5. develop and implement an IT sourcing strategy to speed up the process of finding the right service providers and concentrate on processes that differentiate the company from the competition

In addition, interdisciplinary DevOps Teams in the IT department also help to increase software quality and availability and therefore customer satisfaction. Business Centricity must also be improved (or introduced), and a detailed understanding must be created for the company’s business processes and value creation. To this end, the IT department must develop joint solutions with the other departments.

This can be done with:

1. Professional Partner/Business Centricity: IT developments are often based on the viewpoint of management. Therefore IT must see itself as a partner in the development of joint ideas and solutions to ensure rapid and flexible compliance with business requirements and to guarantee competitiveness.

2. Co-Innovation: Co-Innovation: Innovations are led and promoted jointly by IT and the departments. Particularly in agile environments, this means that IT experts work in teams with staff from other departments so that the steadily changing requirements can be met as much as possible and the investment expenditures are fairly distributed over the participating departments.

3. IT Service Management: The coordination between the service provider and the service recipient is intensified. Here too, it is all about promoting and practicing small and flexible partnerships between IT and its internal clients, so that technological changes and opportunities can be tailored to the requirements of the business. This provides a high degree of automation for standard business processes.  amirite?!

On the whole, it means that the existing employees in the IT department must increase their knowledge and skills for supporting business processes because company-wide innovations require IT departments to take a close look at the new requirements and the associated fundamental technological developments, which promise a lot of added value for all departments today.

They primarily include:

1. Cloud Computing such as IaaS, PaaS or SaaS to address the need for flexibility, efficiency, productivity and scalability, and to facilitate the collaboration of the teams.

2. Platforms for improving and accelerating processes to reduce manual error sources.

3. Analyses of Big Data (Analytics), so that relevant information from customer data, deliveries, orders, transactions, product details or manufacturer information can be extracted in a very short time (e.g. to improve the pricing process).

4. The IT-Security, which must always be scrutinized so that the required security concepts can be developed for the current company-specific structures and requirements, which also provide the requisite protection for critical business data in the digitization age.

It is only by including these issues that IT has the flexibility to meet the requirements of the departments, while also guaranteeing the company’s security and efficiency.

Conclusion

The idea of aligning the IT department to the digital transformation of the entire company sounds pretty simple in theory: It “only” has to make its own organization agile, maintain a strong connection to the business, focus on the main technological trends and actively promote these to management and the various departments.

However, this fundamentally changes the conduct of IT as a service provider and requires significant restructuring of the IT organization and its resources. In practice, the IT department must also become an enabler for employees.

At the same time, it must manage on-going operations and provide sufficient resources for modernization and the introduction of new approaches and technologies.

Therefore, in order to achieve an optimum and successful digitization process, IT departments should be considerably strengthened with regard to their skills and impact – or they should take the initiative in this regard. An IT transformation is not possible without a mature and enabled IT department that is viewed as a partner by the business. And without an IT transformation, there can be no long-term and sustainable company-wide digital transformation.

Posted on

Joachim Hensch: Who’s The BOSS of Smart Factory 4.0?

Equipped with automated machines, artificial intelligence (AI), and advanced analytics, the HUGO BOSS production facility in Izmir, Turkey, is just one example of smart factory advancements and digital transformations that the manufacturing sector is undergoing in the new decade.

With an increasing number of manufacturers planning or in the midst of optimizing their operations with smart factory elements, what strategies should they take to attain an Industry 4.0 factory? Management Events interviews Joachim Hensch, the Managing Director for Hugo Boss Textile Industries, on tips to successfully achieve a digital revolution.

 

The Beginning Of Change

Faced with rising consumer demands and a highly competitive global market, manufacturers are arming themselves with the latest intelligent industrial solutions to thrive and survive in the industry. Foreseeing the need for change, HUGO BOSS began re-imagining their factories into agile and flexible production facilities.

“It all started with the realization that we are operating in an ever more connected market that is becoming progressively unpredictable,” Hensch relates. “There appeared a strong need for a different setup for our factory in order to deal with ever-increasing complexity. Yearly plans became obsolete due to erratic changes in customer behavior and the market environment.”

“Therefore, to keep up with this, we needed to go through a transformation. We started from the organization, continuing with the layout of the factory, the way we deal with new employees, with technology, the way we plan with regard to digitization, the way we treat people, and so on. Basically, we changed everything!”

 

The Three-Step Plan

While mass-produced products might have satisfied the customers of old, the new generation of consumers are looking for more personalization. Manufacturers are heeding the trending change, moving towards mass customization.

For HUGO BOSS, the Izmir smart factory follows a three-step plan to adapt to today’s market conditions and customer expectations.

“The first part is digital transformation,” Hensch explains. “We connect our 4 main components, which are people, machines, processes, and products, digitally to create a digital twin of the factory.”

 

“With the help of this, we are able to manage complexity in production and realize digital initiatives in order to improve our efficiency, quality and employee satisfaction.”

 

“The second step is robotics and automation,” he continues. “In this part, our strategy is to help our people first, and then invent half-automated and completely automated machines.”

“The third step has the artificial intelligence focus. Around this, we work on algorithms that help us with the planning and management of both manufacturing and HR initiatives.”

 

Overcoming Challenges

HUGO BOSS’ digital transformation is not without its challenges, however. The luxury fashion brand faces concerns with data usability and technology integration.

“Some of the data we collected was unusable but some were extremely valuable for gaining insights into how the factory operated. We follow the scrum mentality work in two-week sprints, and then decide whether to invest more. This way, we build in flexibility and can react fast if something changes on the course.”

“Additionally, we realized that we could not just buy gadgets. We had to convince our people to use it, which meant we had to make the software easy to use. We leveraged gamification a lot when designing the UI, as UI and UX are key parts of digitalization. The systems should be as easy as WhatsApp for their users.”

 

The Human Touch

Many organizations tend to focus strongly on technology implementation, leading to neglect of workforce integration and fears of machines taking over jobs. But Hensch emphasizes that the fashion industry is probably the least threatened by automation replacing people.

“The most fundamental reason is working with a non-rigid raw material such as fabric. If you want to do something with fabric, you will not be able to find anything better than the sensors in the hands of people for a while.”

Hensch further clarifies that technology should help to support and upskill employees. “The most visible example of this is our training module with virtual reality applications, Virtual Dojo, which we launched in HUGO BOSS Izmir. This project helps us to customize our operator training processes and increases its quality, which cut down our training periods in half and brought us two international awards.”

“If you manage to prepare your human resources for these technologies and use technology in a form that supports people and brings out their skills, I believe there will be a lot of room for people in smart factories in our industry.”

 

Maintaining A Competitive Edge

As Industry 4.0 brings new innovations and ways of thinking, manufacturers have to adopt the latest emerging technologies in order to stay ahead of the competition. For HUGO BOSS, however, their focus goes beyond normal manufacturing strategies.

 

“At HUGO BOSS Tekstil Sanayi, we don’t only manufacture products, [we] also generate knowledge there.”

 

Hensch conveys that, “In Izmir, we generated a consultancy company called HUGO BOSS Solutions, which provides solutions for digital transformation and organizational development. Imagine a ready-to-wear company, that has full-time data scientists, data engineers, speech recognition and Chabot specialists, and image processing technology specialists working together, creating an IT team and a TechnoLab of around 60 people. This is rare in our industry.”

As Hensch continues to discuss HUGO BOSS’ business strategy, it becomes clear that employees are fundamental components for organizational success.

“Technologies are there and it is just a toolset to use,” Hensch expresses. “However, who will use them and how they will be used is much more significant. For the next few years to come, human intelligence will still be the main driver, and to maintain competitive advantage, companies should first focus on their people and their know-how.”

 

Embracing The Fourth Industrial Revolution

Even though we are already headlong into Industry 4.0, manufacturers are still facing challenges in implementing digitalization changes in their factories. According to Hensch, the setback could be resolved if they have the right system in place.

“In manufacturing, the success of transformation is not about digital screens and sensors, but the creation of the correct engineering ecosystem and organization at the production plant,” he advises. “Digital systems built on a proper engineering infrastructure can be those magic touches that make a true transformation possible and have a dramatic impact on profitability.”

“The good thing was that, in Izmir, we had a neat analog system to start with. What we learned fast is that if you have a messy analog factory and you start building a digital system on top of it, you basically end up with two messy systems.”

 

Strategic Leadership

However, smart solutions are not the only success factors for the fourth industrial revolution. Sound and strong leadership is also integral for effective and successful digital transformation.

“Simon Sinek has just released a new book called The Infinite Game, and this would be my advice [to leaders],” Hensch imparts. “There is no end. There are always going to be things to improve for the better. Therefore, leaders should keep themselves motivated to discover these improvement areas.”

He also advises leaders to engage their staff when creating a mission or vision. “People will hold back because they think the boss already has all the solutions. You need to give people a lot of space and trust in order to make them contribute and fill this vision, and not define everything by yourself.”

Posted on

Blocks Instead of Lines: A Tale of Fast ROI in IT Projects

craftwares_block_and_lines

Craftware, Salesforce Platinum Partner and UIPath Gold Partner are implementing projects for clients in Europe and the USA. It works directly with business and IT, in both areas ensuring the ultimate value of implementation for organizations and end-users.

Jacek Zawłocki, co-founder and CEO of Craftware, the architect of IT solutions. He took part in numerous projects, including the fintech, retail and telecom industries. Based on project experience, he explains how to smoothly implement IT systems in a company and quickly achieve a Return of Investment thanks to the agile approach and flexibility of Salesforce technology.

Do you know the YouTube blockbuster — a funny video about seven red lines? Yes, it’s the one about a project for seven red lines some of which are to be drawn with green, and some with transparent ink. And all of them must be perpendicular — according to the absurd vision of tenacious customers and the supporting project manager. Everyone insists on completing this awkward order despite the objections of an expert who from the very beginning tries to prove that the task is unfeasible.
Do you want to achieve ROI from an IT project fast? Don’t go down that road!

Business and IT — instead of going to war, we can sit down and talk

Although the video is a clever parody, the business reality is full of such missed ideas, and some of them are made real — this is well known to, for example, employees of advertising agencies. However, the issue is not specific to this industry only. Similar situations are not uncommon in other large organizations, especially in those were business meets (or rather collides with) IT.

“We would like to have a new system to automate and optimize some of our processes” — what happens when sales or marketing departments turn to “their” IT department with such an idea? How is the project carried out? It’s a topic for another article — you can read it here. There, you will learn why projects usually fail, and if they are completed somehow, the budget is exceeded or they are much delayed.

Fortunately, you can do it another way. There are more and more companies that decide to use modern technology platforms… Interest is growing not only in CRM systems but also in RPA platforms, such as UiPath – Craftware is its Gold Partner.

The era of cumbersome IT implementation is slowly coming to an end, giving up its place to the Agile approach and positive scenarios which prove that business and IT do not have to fight each other, but team up in a smart manner. Then, it is possible to successfully complete a project, and… win a bet for a crate of beer by the way — just as Craftware did on one occasion. We were given this gift by our satisfied client — a known and large online business that faced a challenge due to its rapid growth.

Start with MVP

The company decided to sell advertising space on its website. The idea hit the bull’s eye, but the massively increasing number of advertisement reservations and equally rising number of errors, for example, related to advertising space quotations, turned out to be a challenge. The employees were simply falling behind with orders. After a series of consultations with the client, we suggested them to implement a reservation system to eliminate this bottleneck.

“We will provide you with the first version of the system in six weeks,” we declared to the client. “Six weeks? We bet a crate of beer that you won’t be able to do that. This is a project for one and a half years.” As we learned later, this had been the deadline proposed to our client by another vendor.

According to our deal, we implemented MVP at the client after six weeks of starting the work on the project. This first step already brought some visible benefits: the sales of advertising campaigns accelerated by half, and the reservation of a single advertising space by 10%. The risk of errors that happened to the department employees was reduced by one fourth. Of course, the won bet gave us satisfaction, but above all, we were proud of our client’s success. The high level of adoption of the tool was rated “four” by the users, on a five-point scale.

Small steps towards your business goal

The key to success was the Agile approach and our client’s willingness to carry out the project according to this methodology. We agreed that we would work in small steps focusing on business goals.

But let’s imagine that a client — this very specific one (or another one interested in cooperation) — comes to us with an idea of seven red lines and stubbornly sticks to it. They vaguely explain what they want to use the lines for, or do not explain that at all — just like in the video described before. They do not accept our suggestions. How would such a project proceed? Would there be a chance to complete it?

Working on business goals requires the client to take responsibility for the project. It means a willingness to talk to the implementation partner: to give up forcing your own project visions and trust the suggested solutions. However, this responsibility must be also at the other side which means that the partner is reliable, proved, and experienced knows project patterns and how to translate them into business needs, because they put this into practice many, many times. What’s more, they can schedule work properly in time.

Small steps methodology, which means dividing implementation into intervals, enables the business to achieve ROI much faster. Costs are necessary at each stage but — starting from MVP implementation — each and every part of a project brings about visible benefits. As the implemented system grows, the pace at which it starts to turn a profit increases — it is best illustrated by the chart below: the cost and income curves cross very quickly.

Craftware_graph

Figure — drafted by Craftware

Build on modules

There is also one more element without which the Agile approach would be difficult: access to technology. To implement tools that quickly bring business value and generate the income needed to pay for other functionalities, not only do you have to know them very well, but you also need to have such tools, you need to have the proper technology, such as Salesforce, at hand. Flexibility is one of the greatest advantages of this solution: it allows you to react immediately and extend the range of solutions as the project is carried out.

Executing a project based on Salesforce, which we are the Platinum Partner, is like building a structure using Lego blocks. In both cases, we have a catalog of available solutions, but we also have generic blocks with which we can change, enhance, and enrich the basic products.

Getting back to the seven red lines for the last time: get rid of them and choose… blocks! Think outside the box — software can be built in modules!

I invite you to watch the recording of my speech during the first edition of the MIT Sloan congress, organized by the prestigious MIT Sloan Management Review Polska magazine.

Posted on

Vulnerability Magnitude, Exploitation Velocity, Blast Radius… No, Not Rocket Science

Qualys_IoT

One of the tangible effects of digital transformation is the impact on security teams, processes, and roadmap.

Organizations are realizing that the technology landscape is rich in a very varied digital biodiversity – with species living in the cloud or in containers, in mobility or in the IoT/IIoT parallel universes, and in space-temporal tunnels called CI/CD pipelines.

And this digital biodiversity should be continuously qualified, assessed, and remediated in case anything is too anomalous… all these being responsibilities of Security teams.

The complexity that these actions imply is remarkable, often requiring augmentation of capabilities to avoid a devastating impact on specialized resources.

But capabilities need to be grounded on solid processes, and here is where an issue often surfaces: lack of operational efficiency.

Swiveling chairs, multiple consoles, poorly implemented APIs, manual operations are still common causes of long processes, human errors, and repetitive operations. Some solutions started to appear, to try automating the steps and accelerating the process.

Data about discovered assets are made available to other platforms, which try to transform these data into more refined information that can be processed by algorithms to understand the vulnerabilities detected; then the data about the vulnerable surface is propagated to other solutions which overlay other data to detect the exploitability, to enrich the context provided and enable prioritization; eventually, reports are produced for the infrastructure team to proceed with patching or remediation.

Again, this orchestration does little to improve the operational efficiency, because all the phases are processed by different platforms and different teams with varying objectives; hence these data lack consistency, normalization, and require adaptation to be properly ingested and processed by the subsequent consumer.

In short, there is a lack of a unified workflow.

Qualys invented VMDR, acronym for Vulnerability Management – Detection and Response.

A new app running within the Qualys Cloud Platform, processing the same consistent source of data across the products that implement the entire process through a single and integrated workflow:

  • asset discovery, categorization, and dynamic tagging;
  • detection of the vulnerable surface by identifying OS, network vulnerabilities and configuration errors
  • cyber threat intel based context enrichment, augmented by a machine learning engine to help prioritization
  • refined prioritization based on exposure, business impact and other unique distinctive traits of the digital landscape where the solution is deployed
  • Vulnerability-patch correlation, tailored on the assets and perimeters for the considered tags and for the prioritized vulnerable surfaces to be remediated
  • support the remediation with patch deployment
  • continuous validation of the security posture according to CIS benchmarks

All this without limits to the sensors you may need to properly observe your IT estate and collect data: software agents conceived to minimize the footprint on the servers/workstations/mobile devices where they are installed, virtual scanners to actively probe the networks, passive sensor listening to traffic and exposing every device visible, cloud APIs to have instant visibility on PaaS/IaaS deployments, container sensors to monitor images in registries or hosts and running containers.

All this in a unified application, where data are collected once and processed efficiently to support the whole workflow. All this with customizable dashboards and reports to keeping critical KPIs under control, and with an API to flow the refined information to other workflows – such as CI/CD pipelines. Besides the operational efficiency, the quality and accuracy of the information produced by this unified workflow using Qualys VMDR effectively support the risk mitigation.

From a more pragmatic standpoint, this boils down to have a clear perception of three important things.

First, the Vulnerability magnitude: this is the synthesis of your vulnerable surface enriched with important contextual information such as the patch availability for a given perimeter, considering supersedence and severity information, and the ability to summarize this information based on the observational needs.

Second, the exploitation velocity: crucially relevant to prioritize and plan the remediation, this data concerning the availability of an exploit. Including details about the ease of exploitation, the potential collateral damages coming from a wormable weaponization of vulnerability or from the potential lateral movement following the possible compromise of a system.

Third, the blast radius: the combination of the network context enriched with the business criticality of assets, the automatic validation of CIS benchmarks, and the ML-assisted risk scoring of the vulnerable and exploitable surface provide a tangible help to estimate the potential harm of a security incident, providing the needed refined information to measure and track the Time To Remediate.

Posted on

IIoT: Which comes first – Martini or Bikini?

When it comes to planning your industrial Internet of Things adoption strategy, all you need is a Martini and a bikini…

What do they have to do with IIoT? And which comes first?

You start with your Martini, of course.

Why? To use an analogy, the couple in the 1970s Martini & Rossi advertisement enjoy things “Anytime, Anyplace, Anywhere.” But today’s manufacturers are struggling to do the same, especially when it comes to connecting their assets and data across the enterprise.

So we will adapt the Martini analogy for IIoT Integration: You need the ability to connect “anything, anytime, anywhere.” I’ll get to the bikini later.

Although manufacturers place a high value on IIoT, they are encountering serious difficulties in unlocking the value of their innovation across their organizations. This is the conclusion of a recent Software AG IIoT survey of over 125 North American manufacturers*.

The vast majority of manufacturers said their IIoT investments are limited by being locked in one small department or sector of their company, preventing them from sharing the power of IIoT across the enterprise.

We call this a “fractured enterprise” and, in the Internet of Everything economy, the fractured enterprise cannot hope to compete. Half-answers from disconnected enterprise assets result in ill-founded decisions – or business reaction times that are too slow to be effective.

Manufacturers can lose millions of dollars in potential profits as they fall behind more forward-thinking competitors who have invested in predictive analytics and innovative integration strategies to scale IIoT across the enterprise.

Total integration is what makes a fractured enterprise whole, and total integration – on-premises, in the cloud and at the edge – is the only way to build successful IoT architectures, landscapes or applications.

To prepare for IoT, Industry 4.0 or a digital future, the enterprise must integrate, integrate, integrate. It makes the whole greater than the sum of the parts.

So, what about the bikini? If the Martini is integration, the bikini is analytics. Analytics are like bikinis; what they reveal is suggestive, but what they conceal is vital (to paraphrase academic Aaron Levenstein!). But don’t start with analytics before integration (a mistake which is often made in IIoT projects).

What does the IIoT bikini reveal about analytics? Usually, it means that the analytics must stay in the hands of domain experts. Data scientists can help by revealing what is suggestive. But it is the shop floor operator, the product designer, the finance director – those closest to the issue – that can uncover the real operational insights that would otherwise remain concealed.

Martinis and bikinis: A holistic approach to integration and analytics. So, in a nutshell, mix your Martinis before donning your bikinis (although you wouldn’t normally phrase it this way at a management meeting.)

This is Software AG’s approach, integrate anything (from assets to apps to back-end systems), anywhere (from the edge to the shop floor to the cloud). Then add a layer of “anytime” – streaming, historical, external, internal and time series data analysis and AI – to uncover and reveal the information that will transform your enterprise.

This is why Gartner has acknowledged Software AG as an IIoT “visionary.”

*The Software AG IIoT Implementation survey was completed in Q2 2019 by Software AG and an independent third-party research house. The survey queried nearly 200 respondents at large manufacturing companies across the automotive, heavy industry, high-technology, electronics, pharmaceutical, and medical device industries. The respondents were primarily senior executives leading manufacturing or information technology, with the breakdown being 50% Managers, 38% Directors and 13% Vice Presidents or higher.