The Return of the Crackberry

This week, Blackberry held its annual security conference in London. so it was a good time to catch up with what Blackberry is doing now, after the melt down of its original secure corporate phone and email business model. 

Well, it is still in the phone business. Partnering with TCL, who undertakes hardware manufacture and smart phone distribution, blackberry is still designing new smart phones. The new models look very smart and offer a key pad equipped, touch sensitive android phone at a competitive price point, i.e. several hundred notes cheaper than the equivalent Samsung or Apple model. It would be easy to dismiss them as being a choice for someone who is into retro chic or an old school aficionado of key pads. However, there are some subtleties in the product design which are increasingly relevant in the current environment of aggressive cyber crime. The devices are designed and built bottom up to be resilient to infiltration and takeover, combining both hardware and software features for this. Additionally, the thumbprint security control is implemented in a way which allows the user to differentiate between what is private and what is shared. Which coupled with features in Android enabling separation between personal and corporate personas, makes it very much a smart phone of the age.

However, mobile phones are really only a side show and not the main story. Blackberry has built on its global secure telecommunications capabilities to emerge as a leading "Enterprise of Things" (EoT) enabler. Someone described its primary mission as being to "Secure your Communications and your Data". However the vision is one of comprehensively enabling secure IoT exploitation by enterprises, leveraging industry standard to deliver on government quality security in the deployment of Smart Things, or as one of the speakers stated "Moving from Mobile First to Things First".

There's a comprehensive set of products with SDKs which enable OEMs to develop secure smart products and Enterprises to deploy Thing based business models securely, whilst users enjoy a relatively seamless secure access experience across a comprehensive range of products.

Although what was probably the most impressive aspect of the conference was to see representatives from Google, Microsoft, Samsung and Blackberry discuss how they are collaborating to deliver a new generation of products which integrate securely and build the IoT world of the future.

Ethics Takes Centre Stage

Last night I attended an event where Ann Roberts of Badoo and Nick Lisher of Nextdoor were discussing the meaning of enterprise values and their application to governance for Digital Platform based enterprises.

In the wake of the various regulatory issues that Facebook has had with Data Privacy legislation in Europe and Uber has encountered with employment law and regulation of taxis in a number of countries and cities, including London, this was a highly relevant discussion. It was pparticulalry refresshing to hear Nick Lisher say "I find GDPR liberating." as he went on to expound the fact that Nextdoor's values and approach meant that they had not had to alter or adapt their product at all to ensure compliance, which confirms assertions that I made in an earlier post that GDPR forces you to do the things that you should do anyway. It gives a great argument to persuade finance that it is necessary to pay for them.

All in all it boils down the the issue of running a digital enterprise as an ethical concern, which is a pre-requisite that I identified in "The Way of DAU", my take on how to adopt a Business as Usual business model.

Digital Business models amplify the concepts behind customer care theory. Traditionally this has proposed that 70% of sales are repeat sales to existing customers and that it is roughly 10 times cheaper to do something to keep a disgruntled customer, by addressing complaints positively, than it is to gain a new customer. Also if you manage to delight a customer, he or she will tell 10 people and sell your company. If you annoy them, they will tell even more and damage your reputation. Badoo's business model actually relies on this, because if you successfully match someone up with another person, Badoo may lose them as customers, but they will tell everyone that it was how they met and sell Badoo positively. Conversely, there have been significant backlashes over how Facebook uses people's data, and recent slow downs in growth and consequent loss in market value, are not the first time that Facebook has suffere significant customer defections.

Google used to have a great reputation when everyone believed in its "Do no Evil" credo, but is gradually losing mindshare with significant portions of people as a result of failure to translate this into a positive corporate culture where ethical concerns are addressed and seen to be addressed by the people who work there, its customers and increasingly EU regulators.

However, whilst we were discussing this and what happens in many traditional PLCs, a penny dropped. It's not just the the Leaders of a digital enterprise who need to be focussed on instituionalising ethics as a core of company culture, but also the shareholders. The llatter need to align themselves with the long term view and how value is created. There's too much emphasis on quick results and returns and not enough on long term value and scalability. Ethics needs to be seen part of a digital business's scalability, not just the architecture of digital products and operational robustness.

Google puts a SOC in it

Google X

So Google (or Alphabet as the parent is now called) has announced today that they are joining the SOC market with proactive security defence based on capture and analysis of events.

This has come out of their X projects division which aims to rapidly develop new breakthrough products.

What's Google Planning?

Presumably Google aims to provide Machine Learning based measures capitalising on the scale of its services and analysis across customer environments hosted on its GCS platforms. This should give it certain predictive advantages, enabling it to home in on certain types of attack.

What would be good to know is how will Google differentiate between poorly configured devices, failing devices and real attacks. As many APT style in infiltrations will mimick poor configuration and failures to disguise their intents. Also what will they be doing around major incident management, remediation and forensics to provide a complete service?

Details are thin on the ground so far and this is bound to spur me too imitations from AWS and Azure.

SOC Fundamentals still Apply

However, as ever the fundamentals for a working SOC will remain:

• You need to know what assets you are managing and keep CMS/CMDB accurate, complete and up to date;
• As far as is practicable, ensure that all assets are implemented with standard configurations, to avoid mis-configuration and creating the noise in which APT infiltration can hide;
• Use automation and software as infrastructure to implement standardised asset configurations and maintain patching up to date;
• Then deploy logging, automated monitoring and analysis;
• Invest in remediation and incident management capability;
• Use scenario planning and practice exercises to ensure that there are no gaps and you are prepared for problems.

What Else is Google Doing?

The SOC services are only part of the offering. The new business unit called Chronicle will also be offering threat intelligence and products from its VirusTotal acquisition.

Google The Rainmaker

On a day when CIO Magazine reported on an Uptime Institute study indicating that only 13% of enterprise loads are operating in the Cloud, Google is holding its Google Cloud Next conference in London.

The key message is that Google is in the cloud hosting game for the longterm and is offering to partner enterprises through their Digital Strategies and to help them unlock the value of their data.

One of their most impresive case studies is helping LUSH the bathroom smellies company to move its global operations to Google Cloud Platform in just 22 days.

Otherwise Google is trying to make a compelling case for its offerings in terms of flexibility of scaling an pricing, the richness of G suite in the collaboration and app devleopment space, AI and bot support as well as data management and Big Data agility. All backed up by rock solid security and sharp performance. 

However, for small companies and start-ups the affordability of its office apps, ubiquity of platforms and flexible pricing makes GCS a "no brainer" for consumer facing brands.

So rather than just trading on its born in the clouds heritage, google is fully positioning itself as a Cloud Builder and a Digital Rain Maker.

Artificial Intelligence and Other Tales

Engineers at Google recently published a paper outlining their work developing a custom AI chip which is so efficient that it saved them having to build new data centres to cope with the introduction of AI based services. The paper itself provided a great insight into the scale and nature of Google's operations. However, it was the catalyst for musing on where we are going with AI and what it all means.

In the 1980s there was a lot of hype around artificial intelligence resulting in thousands of university undergraduates learning languages such as LISP and Prolog, and the Japanese Government sinking hundreds of millions of dollars into its Fifth Generation Computing programme in an attempt to progress the technology further. More modestly the UK's DTI published a few pamphlets and books on state of the art Intelligent Knowledge Based Systems (IKBSs) and Neural Networks. A few rather expensive products hit the market. There were a few relatively trivial case stydies and then it all just seemed to fizzle out, gradually becoming forgotten as the Internet Bubble grabbed people's attention.

However, AI did not go away, its development just went into submarine mode. People were there working quietly away in the background on specific applications of AI and bringing them to a level of maturity where they can be adopted wholesale in real life situations. In the process there have been substantive strides, so for example voice recognition systems now require little training and accommodate regional and national accents. Additionally, there has been a little gentle re-branding to adopt the term "Machine Learning". Consequently many people use "personal assistant" agents on their phones or built into household automation devices. Self driving cars are reaching commercial aodption and the next generation of UAV aircraft will be capable of accepting a programmed mission, taking off and completing it without human intervention or interaction, unless some mission parameter is encountered which requires human decision making or to receive required intelligence.

I was literally blown away with incredulity recently, when someone showed me how easy it is to set up a simple machine learning application in Azure and train it to produce a useful output. But I have been reading recent alarmist claims that "AI robots" will replace millions of human professions with a level of scepticism, as this is not substantiated by previous experience.

In the 1980s, when I worked for a bank, there was an interesting article in the Financial Times on the adoption of IT by the banking industry. The gist of the story was that if the banking industry had not adopted IT to mechanism a lot of its work, then the explosion in consumer banking products in the UK which happened at that time would not have been possible without employing the whole of the UK workforce to support it.

A recently touted robotic brick layer is unlikely to eliminate all brick laying jobs because there is a current shortage of bricklayers and robots will not be economic on small sized jobs. Furthermore, the reason that the United States has traditionally enjoyed higher productivity than Europe is not a result of American technical superiority, but the result of the fact that the US has always been resource rich and people poor. A shortage of labour and skills leads to new methods and investments in mechanisation and automation.

Furthermore, the UK Government Digital Strategy is promoting the investment into the development of AI skills, because the Government believes this will grow both the economy and jobs. The real impact will be in the change of the nature of the jobs. People will do less humdrum stuff and explore their curiosity more to invent new things, discover new things and do their jobs more creatively.

IoT Platforms

Companies going down the cloud bases PaaS route for hosting their applications have some interesting choices. There are 2 main leaders: Amazon, Microsoft and Google. There are also a lot of other platforms built around major applications, e.g. Salesforce & SAP, or technology stacks, e.g. IBM and Oracle.

Most of these platforms have quite features around provision of virtualised servers and storage as well as load balancing, with extensive options for scalability, as well as pricing models. All come with various database management system services as well as data analytic services for BI/Big Data usage.

Whilst Gartner makes a great show of assessing them against its own set of  Enterprise requirement criteria, this is unlikely to be meaningful for long as the leaders are engaged in an arms race to introduce an increasing number of features and capabilities which means that any 3rd party analyst's assessment is bound to be out of data almost as soon as it is published.

Enterprises have a fair guessing game about which platforms are going to be dominant in the future. This is almost impossible to get right. So more pragmatic approaches are needed. If an enterprise intends to move almost everything onto cloud platforms, then some analysis of what services its main SaaS applications uses may be appropriate. For companies tied into .Net, Microsoft Office and AD, then Azure may be a no brainer.

However, when it comes to IoT based applications, this may not be so simple. At present Amazon appears to have the leading  IoT support framework of the big 3 platform providers. Google and Microsoft appear to be trying to get in on the end device with specialist operating system offerings, so that they can own the whole stack. Likewise, Oracle is aiming to lever its Java specialism with its technology stack to provide specialist SaaS applications which facilitate rapid development in the IoT area.

My take is simple. For now anyway, most applications are going to have to deal with at least 2 PaaS platforms. One for internal applications and a second for externally facing applications and IoT. In reality, most corporations may need even more, especially if they want to exploit big application services such as SAP's and Salesforce's.