Vulnerability Research

Recently one of our clients is going through a major transition of implementing new systems with few other vendors, actually a chaos of new systems interacting with each other. The implementation has been rushed and  though the system functions as they are supposed to as stand alone out of the box solutions without fulfilling much of the business's initiatives. There are some major vulnerabilities within the system architecture, the implementation has been driven by lack of understanding of the domain and the business logic that drives it.

I spent less time reading about vulnerability research and QA control mechanisms, but the current implementation  at XYZ corp. has spiked my interest back in this area. The vulnerabilities market for security experts is not as lucrative as it used to be but I suspect this will have its own economic shift cycles as information and services of organizations move more into the cloud and SAAS based environments.

Currently there remains a lack of information awareness and a gap (along with a huge divide) among the IT professionals within small and medium scaled organizations (non-profit & for-profit). And more importantly vulnerability research being a part of the CIO's responsibilities and policy making functions; my recommendation here is that information technology directors and CIO actively create policies and conduct periodic penetration and vulnerability testing on all their IT infrastructure systems internal and the ones that they stick in the cloud or out-source, these include but not limited to sql injection tests, malware checking and reporting, social engineering hacks, reverse-engineering of services and products, mobile management of BYOD as wells company supplied and routine network testings.

Create policies that aim  for zero-day vulnerabilities in such a way that annually (or every two years) an IT auditing firm's view point is gathered and incorporated in the discussions of strategic planning with senior management.

Thoughts,

Sam Kurien

Key Components of Enterprise Portfolio Management

When organizations grow in business complexity in terms of products and services they offer, the senior management is always concerned with if resources are being effectively used and if the stakeholders (internal as well as external) are getting the right returns on their investments. Hence in the market lots of software products that do multi-portfolio management of projects and programs. Most of the products out their aim at managing the project life cycles but a true EPM will take into consideration the entire top-down planning approach to include strategic planning, investment analysis, capacity planning and tune it with the components of Demand & Change management in lieu of projects that are being executed. They also thus take into account resource management and pop in the dashboard metrics related to them with the monies or finances being allocated and thus incorporating or integrating components of Financial management.

Strategic Planning in management of enterprise portfolios entails about how mission and objectives align with the strategies and tactics employed in execution of projects. A true EPM will thus allow to manage trade-offs before taking or executing that strategic path, allow for accurate assessment of allocation of funding and staffing and most importantly employ strategy that covers the entire business continuum plans.

Investment models within portfolios then make it simple if employed correctly within EPM to identify the risks associated, calculate the cost, evaluate the value variances, and give clues how best to optimize the project investments, balance innovations to sustain business continuum processes.

This then from a operational point of view helps in portfolio management to plan for capacity where demands of the business and resources are matched to support the key business strategies. A EPM software will thus give you an understanding where the resource are lacking, what is the excess capacity that can be transferred or reserved, and forecast resource capacity within the framework of roles and responsibilities of individuals on various teams at different times on various projects. Capacity planning is closely aligned with metrics that demand management cycles produce like number of work requests, status checks, incident and problem requests, mean time between failures, life cycle reviews etc.

At the granular level of EPM then is the ability to track projects, their scope, time lines and actual costs to the project value to the Enterprise. Tracking of project times against expenses, managing associated risks, and getting quick snapshot views of projects and their progress in lieu of organizational objectives.  The financial management and resource management are tied in closely  and portfolio manager can look in using the EPM software that link organizational financials to project plans and strategic initiatives to the final operational delivery of products, programs and services.  I personally haven't seen a EPM that gives clues or hints to what is the level of strategic alignment in terms of operational delivery of the four P's (programs, projects, plans and people) to overall strategy in a assigned % form even if there are lots of qualitative data involved.

Finally on my wish-list would be plug-ins for EPM's that will allow for high level integration with all office products and project management software's to give operational PM's up to date instructions and get up to date feedback on projects in action which in turn populate the EPM dashboard.

Thoughts,

Sam Kurien

Change Is the Only Constant

Everybody talks about "Change" and importance of "Change management" as the only "constant" with dynamics in the global economy changing rapidly. Global competition necessitates that traditional organizations service or product line models incorporate innovation for on-going differentiation.  However little is said about the Change Agent leaders who lead this change. One of our clients (I will not mention the name) is going through a change management process. My observations on this are little effort has been made by the leadership in understanding the business model of how and why the change needs to be done along the lines how to lead by participative trust. Instead the model of "divide and conquer" is assumed making the change management process a painful, chaotic and chasing after the wind affair.

I think the fair questions that a change management leader needs to ask before he embarks on one are:

1. What are the main dimensions of innovation that can be brought before disrupting a business model holistically?
2. How do I enable my organization to pursue business model innovation?
3. How does the role of technology, software and people integrate in supporting my business transformation?

I feel answering those three questions goes in parallel with self introspection within the change leaders and may translate to something like:

1. How am I contributing to build this organization and how can I involve the existing people so that growth takes place in them as well?
2. How can I be innovative myself ...what the changes that I personally need to make before I dictate?
3. How am I using technology, software and people skills to support my transformation in alignment with the business transformation?

 Circling back then on the innovation organization go through different models of business innovation to facilitate change this can be customer-centric, process innovation centric, or supply chain centric. In the past lot of emphasis has been given to customer centric innovation but management specialists have realized the internal stakeholders are also a type of customer who make up the organization and provide the services. If change is not accepted by the them, change management and change initiatives will fail, even if you alienate them or throw them out of the organization.

My suggestions are simple here:

1. Understand why the change and outlay the metrics for transparent discussion
2. Be the change first before you dictate change.  
3. Involve everybody in the road map. This takes time but is very essential. There are proponents who may say we don't have that kind of time...but believe me if this is not done well ...we will be spending lot more time and resources fixing stuff. 
4. Improve responsiveness and service with love and trust. (Boy this is a hard one!!) 
5. Optimize pricing, think or creative sources of funding.
6. Research, monitor and gather feedback, incorporate back the good and refine the process. 

Change is the only constant but how we manage this change will enable our constancy in the marketplace.


Thoughts,

Sam Kurien

Quick Windows Shortcuts

After setting up multiple displays at home and because of cable clutter I could not move my left side monitor, based on desktop identity - so to fling a window to the left monitor I had to go through the monitor on my right and drag the windows to the one on the left. This was frustrating but a cool windows trick helped to get this resolved quickly. Holding down the Windows logo key along with shift and using left or right arrows key literally moves the active windows to the left or right monitor.

For your reference other cool short cuts I find routinely useful on the keyboard are Windows logo key + T to launch pinned applications on the task bar; Windows logo key + spacebar to get quick peek on the desktop; Windows logo key + L to lock the computer to avoid those intrusive office workers; Windows logo key + 1,2,3 each number when pressed in launches application in the order they are pinned on the taskbar; and finally the lazy man's delete highlight the file and press shift + Del keys on the keyboard and it will bypass the recycle bin completely, not useful if you want the file back by any chance. 

Cool short cuts!!

Sam Kurien

Next Gen -Enterprise Architecture

The importance of Enterprise Architecture continues to grow in all directions with the obvious demand for technology integration row along with the demands in governing it more tightly. Four observations that will demand higher indepth look and role of EA's.

1. Business demains and integration of technology
2. IT Governance over project initiatives and tightening of financial belt
3. Globalization - Need for business's to explore opportunities beyond their current boundaries.
4. Process improvements that are integrated with technology

What does this mean for enterprise architecture?

The C level executives (CEO, CIO's , CFO's & CTO's) all need to recognize EA cannot be a back office or support component instead needs to be a design/strategy component in the initiatives of the organization (be it operational or strategic expansion). This means going beyond just the "IT alignment" and prioritize and drawing the big picture in such a way that EA/IT strategy is highly integrated. This in trun means information architecture will be guided by constant tapping into business intelligence, process optimization, and enterprise evaluation of on going strategies. Leading research firm Forrester believes business process modeling and having master data plan will help in giving this information.

The impact of globalization on EA will be taking on action plans of how an organization needs to be flexible in addressing the local needs to global needs and this may also reflect of strategizing how EA strategies address mature markets and developmental markets. For example one of our clients an association is struggling to manage an explosive growth in the African market without understanding how to balance the mature market needs and facilitate the developmental inititaitves in the African continent. This offers not only a financial challenge in enterprise organization and its impacts on enterprise architecture but presents significant puzzles that need to be solved in setting up sound business and operational processes.

Hence next generation EA will be focussed on holistically thinking, integrating and strategizing keeping the big picture in mind. Technology and business process are no longer separate but fused for every individual in the company is a tech-knowledge worker that contributes in supporting the short term and long term objectives of the organization. In closing then the biggest result in this direction will be decentralization of organizations instead of centralization of power, the diagram below is taken eBiz'g guide to IT agility which shows that one solution or custom solution that fits all will lead to constraints and higher cost to mainatain these application but customized self-service solutions that are designed or architected to be adaptive for future growth (provided this info is gathered by analysts and planners) result into richer distributed outcomes which are decentralized in nature.

Thoughts,

Sam Kurien

Design Innovation In Watches

All those who know me (well most of them) who know me know I love watches and am a collector of good watch designs. I came across this Harry Winston designs and love it.

And my favorite design of all time "Maitres-du-temps" (Masters of Time) with only custom ordering to specifications.

Enjoy and drool! Like I am doing now.

Cheers,

Sam Kurien

A Day Made of Glass

DA send me this video link, I think though still in concept its is so cool and is not far in our future as we have seen bits and pieces of all this cool research from different quarters of surface computing.

Enjoy The future is round the corner!!!

Cheers,

Sam Kurien