devopsy.kinsta.cloud

Author: Scot Finnie

Survey: CIOs Driving Digital Transformation

A survey from IT World Canada (ITWC) apparently shows that CIOs are preferred by their companies to shepherd the digital transformation process in part because of their knowledge of legacy systems. The fifth annual CanadianCIO Census concludes that CIOs are “able to bridge in-place technologies required to run the business, while increasingly guiding their companies on how to grow and transform the business using digital technologies.”

Going hand in hand with that notion is the survey’s finding that the rise of the chief digital officer is a myth.

There are other interesting takeaways from the survey, which was completed by 164 IT leaders, mostly CIOs, in April:

The 2017-2018 time frame is shaping up to be a growth year with nearly half of respondents expecting to add IT staff this year, and only 7 percent expecting to decrease staff. Increased IT budgets are also the trend for 2018, with 57 percent of the respondents reporting that they expect an increased IT budget. Some 11 percent expect an increase of more than 15 percent.

Although the No. 1 concern of respondents is data security/data privacy, the more significant bit of data may be that the third-highest concern is business innovation, which rose significantly in priority over last year’s survey. Canadian CIOs also seem less enthralled with some of the latest technologies that some of their U.S. counterparts ballyhoo. Social media, artificial intelligence, blockchain and even internet of things rated lowest in terms of “benefits realized to date from investment” in these technologies.

The picture that emerges from the survey is a strong tension between opposing forces faced by IT executives. Cloud services, though heavily embraced and widely successful, still haven’t brought down the price of keeping the lights on sufficiently to divert enough IT budget to digital transformation and business innovation projects. The transition of funding toward digital business is inevitable in some companies, and senior IT leaders need to avoid being run over by that freight train. If IT budgets grow year over year, investment in digital transformation should be stepped up significantly, too. Find ways to automate processes that were more labor-intensive before.

Analysis

Although the survey finds that the CIO is the de facto digital transformation technology leader, I’m not sure you can draw that as a hard conclusion from a survey of 164 mostly CIOs. CIOs are a logical choice for this role, assuming they possess strong technical acumen, in-depth knowledge of the systems in place and up-to-date insights on the latest tools and services at their disposal. Many CIOs have shrewdly focused on the business innovation end of things—in other words, what you can do with a digitally transformed enterprise. And in the long run, that may be the smarter position for a CIO to take.

No CIO should assume they are in the driver seat on digital transformation. On the other hand, grooming and selecting a lieutenant to execute on the digital plumbing while you plan and implement your first digital business wins may be the better approach for some CIOs.

— Scot Finnie

August 31, 2017
Synopsys: IoT, ICS More Vulnerable to Security Exploits

A new report shows that internet of things (IoT) implementations and industrial control systems (ICS) are more vulnerable than most to potential zero-day exploits of the open-source protocols, common file formats and APIs they rely on. The report, prepared by vulnerability test firm, Synopsys Inc., is based on 4.8 billion fuzz tests conducted on the company’s customers throughout 2016. The report focuses on six key vertical areas: automotive, financial services, government, health care, ICS and IoT.

To rank the vulnerability of different protocols, Synopsys measured the time it takes between the start of fuzz testing and when a protocol crash is recorded along with how many crashes occurred over longer periods of time. Newer, less mature or proprietary protocols proved to be the most vulnerable. In some cases, time to failure was measured in minutes or even seconds. Fuzz testing is a method of testing code for flaws and security vulnerabilities that involves throwing large amounts of malformed, random data at the system being tested.

Industrial control systems are the most vulnerable of the six areas covered by the report. To a great degree that’s driven by the fact that ICS uses a lot of proprietary or ICS-specific protocols, some of which may not have been tested thoroughly enough. Three of the most vulnerable protocols are IEC-61850 MMS, IEC-104 SERVER and MODBUS PLC. The ICS protocol IEC-61850 MMS failed in just 6.6 seconds.

IoT is the next most vulnerable system. It mixes older, better-tested core IP protocols with newer niche categories such as wireless and ICS. The three most vulnerable protocols for IoT are CoAP Server (failed in 8.5 seconds), CIP and OPC UA.

It’s important for enterprises to prioritize security in their zeal to build IoT solutions. In some cases, Synopsys revealed that security vulnerabilities stemmed from an incomplete or improper implementation of protocols or unpatched code.

“The applicability of IoT across all vertical markets and within enterprises of all shapes and sizes has brought us to an important inflection point,” said Brad Shimmin, service director for IT Technology and Software at GlobalData. “Thanks to ubiquitous and readily accessible APIs, development frameworks and even pre-built but extensible apps, virtually anyone can stand up an IoT deployment with very little experience in the way of application development practices. This will undoubtedly reveal the many dangers inherent in building highly distributed systems—dangers affecting both data and logic.”

Some interesting data from the report: The overall average time to first failure of a protocol was 1.4 hours. When the time to first failure is measured in seconds instead of hours, it indicates a higher potential for criminal exploitation. The most vulnerable protocol tested was the previously mentioned IEC-61850 MMS; the least exploitable was the TLS client, which had an average time to first failure of 9 hours.

Of the vertical areas the report classifies, the two least risky sets of protocols are the ones used by government and financial services. Synopsys attributes this to the more mature aspects of the categories of protocols used by these industries. They had fewer overall failures and longer test times to their first failure. It would take black hats a lot longer to fuzz them into vulnerability.

— Scot Finnie

August 21, 2017
Survey: Inviting Security into DevOps Promotes Effective Agility

Two of the biggest trends in business technology are seemingly at loggerheads with one another. Many companies are under severe pressure to digitally enable their businesses. At the same time, the need for hardened application security has never been more critical than it is now. You can deliver apps quickly and you can deliver apps securely but, generally speaking, the two things don’t happen at the same pace. The DevOps mission is aligned more with development efficiency and agility, but it’s also in keeping with the thinking behind DevSecOps. How are enterprises handling the conundrum?

According to a new survey from identity and encryption enterprise vendor DigiCert, they are handling it quite well. The recently released “Inviting Security into DevOps” survey found that 98 percent of respondents said their companies are integrating their security teams into their existing DevOps methodologies. The survey found that 49 percent of the respondents are in the process of doing so; the other 49 percent have already done so. Those who report having already integrated security with DevOps are 21 percent more likely to report what might seem counterintuitive: They are doing well at meeting app delivery deadlines.

“Successful security for DevOps requires a combination of culture building and the right technology,” said DigiCert CSO Jason Sabin. “Companies that can do this and bring in security at the start of a project avoid costly delays, because they deliver their project just once rather than discovering security issues late in the process.”

The methodology for the survey, which was conducted in May, involved 100 DevOps professionals, 100 IT professionals and 100 security professionals with executive management to management titles skewing 3:1.

The large enterprises polled for this survey agree it’s worth striving for. Some 88 percent of the respondents called security working directly with DevOps somewhat or extremely important. More than 70 percent of the respondents are concerned that if their companies don’t make this change, one or more of these negative repercussions are likely: increased costs, slower app delivery and increased risks.

Although nearly all the respondents have integrated or are integrating security within DevOps, they’re not saying it is an easy process. Their top challenges include a lack of a champion for the transition, the security team resists the change, lack of relationship skills required to bring the teams together and it takes much more time than expected—an average of one to two years.

How should you approach this in your company? First, recognize that it’s no panacea. It’s a logical first step, but don’t spend a year planning it, just do it. Start by appointing or identifying a leader for the project. Someone who understands both sides, ideally, and who knows how to get things done. And install a security lead at the DevOps table for all DevOps business. Integrate, standardize and invest in automating baseline security practices within DevOps workflow. Thinking that way will get you the agility you need.

Then address what comes next. Have the team identify choke points in the application security process and develop ways to work around them or eliminate them. In other words, attack the problem head on with all your best minds. Don’t forget to look for best practices developed by others. It’s a problem a lot of companies are trying to solve, so networking with people from other companies at industry events may give you your best ideas.

— Scot Finnie

August 2, 2017
Gartner: Digital Business Driving Spending

With half the year gone, Gartner just revised its 2017 worldwide IT spending projection up 1 percent to 2.4 percent. That may not sound like a lot, but last year’s IT spending growth was effectively flat at 0.3 percent. It isn’t just the uptick in the overall spending level that’s interesting, it’s how Gartner predicts the money is being spent. It sees the move to digital business and the related adoption of new technologies such as internet of things (IoT), blockchain and smart machines as a growth engine that’s creating new potential reasons for spending.

“Digital business is having a profound effect on the way business is done,” said John-David Lovelock, vice president and analyst at Gartner. “The impact of digital business is giving rise to new categories; for example, the convergence of ‘software plus services plus intellectual property.’ These next-generation offerings are fueled by business and technology platforms that will be the driver for new categories of spending. Industry-specific disruptive technologies include the internet of things in manufacturing, blockchain in financial services (and other industries), and smart machines in retail. The focus is on how technology is disrupting and enabling business.”

Worldwide, Gartner is forecasting that the enterprise software market will be the highest growth segment of IT spending—7.6 percent growth in 2017 from 5.3 percent in 2016. (Device spending is also up markedly in the report.) Enterprise software will be one of the keys to driving and controlling revenues derived from digital business advances.

Takeaways for senior IT leaders: Digital disruption is the probable stick slowly driving the adoption of digital business. The carrot is innovation. This is putting it too simply, but it’s true: Disrupt or be disrupted. And just because many of the high-profile digital disruptions have been business-to-consumer, don’t think you’re safe in the business-to-business sector, either. As this plays out, probably over the next five to 10 years, a lot more companies are going to be burned and a lot more companies are going to be made. You can no longer laugh this off as a buzzword.

It starts with analytics, preferably sifting through meaningful big data. Digital business is rewriting business process and the way data is collected, interpreted, moved and consumed in profound ways. That could make your analytics easier to implement and analyze. But if you don’t have a major business analytics upgrade just rolling out, you’re flying blind.

Ride the wave, but as you adopt new cloud-based services and enterprises apps, there’s a potential for management complexity to trip you up.

“With the increased adoption of SaaS-based enterprise applications, there also comes an increase in acceptance of IT operations management tools that are also delivered from the cloud,” said Lovelock. “These cloud-based tools allow infrastructure and operations organizations to more rapidly add functionality and adopt newer technologies to help them manage faster application release cycles. If the I&O (infrastructure and operations) team does not monitor and track the rapidly changing environment, it risks infrastructure and application service degradation, which ultimately impacts the end-user experience and can have financial as well as brand repercussions.”

— Scot Finnie

July 20, 2017