Sten Vesterli's Blog

Making IT Live up to its Promise

Risk and Reward

Beneficial Intelligence, , ,

This week’s episode of my podcast Beneficial Intelligence is about risks and rewards. Humans are a successful species because we are good at calculating risks and rewards. Similarly, organizations are successful if they are good at calculating the risks they face and the rewards they can gain.

Different people have different risk profiles, and companies also have different appetite for risk. Industries like aerospace and pharmaceuticals face large consequences if something goes wrong and have a low risk tolerance. Hedge funds, on the other hand, takes big risks to reap large rewards.

It is easy to create incentives for building things fast and cheap, but it is harder to create incentives that reward quality. Most organizations don’t bother with quality incentives and try to ensure quality through QA processes instead. As Boeing found out, even a strong safety culture does not protect against misaligned incentives.

As an IT leader at any level, it is your job to consider the impact of your incentive structure. If you can figure out a way to incentivize user friendliness, robustness and other quality metrics, you can create a successful IT organization. If you depend on QA processes to counterbalance powerful incentives to ship software, corners will be cut.

Listen here or find “Beneficial Intelligence” wherever you get your podcasts.

Another Avoidable Disaster

IT Leadership,

Today’s totally avoidable IT disaster is found in the Slack app for Android. It turns out the app stored the user password in unencrypted plain text. That means that every other app on your phone had access to it, and it might now lurk in various log files on your device. Slack is red-facedly asking users to update their app and change their password.

This is an example of what happens when developers operate under tight deadlines and without adult supervision. Any competent IT development organization has code review procedures. If you are a large, high-profile organization that release apps to millions of user, any new release should have a separate security review performed by a security professional. But Slack insisted on letting their team operate without any guardrails. That means it was a matter of time before they ran off the track.

If you are a CIO, take a look at your systems list. For every non-trivial or externally facing system, there should be a link to the latest security review with a date and a name of a real person – outside the development team – who performed the security audit.

Avoidable Disasters

IT Leadership,

Humans keep causing avoidable disasters. I’m a pilot qualified to fly under Visual Flight Rules (VFR), and I am acutely aware that the number one cause of deadly crashes for pilots like me is to fly into clouds or fog. It turns out that it takes only 45 seconds for an untrained pilot  to become completely disoriented in clouds. Professionals train long hours to learn to override their intuitive feeling of what is up and down and trust their instruments.

Nevertheless, a professional helicopter pilot who had only VFR training flew his helicopter into the ground after getting disoriented in a cloud, killing himself, basketball icon Kobe Bryant, and seven others.

In IT, we also know how to do things. As an industry, we have decades of experience building solid, user-friendly systems and running IT projects. But we mysteriously insist on doing it wrong, causing one IT disaster after another. We think we can take a shortcut in order to meet our deadline, just like the helicopter pilot taking the shortcut through a cloud. As the CIO, you need to make sure you have a process in place to prevent people working on critical systems from taking shortcuts.

Convenience vs Security

IT Leadership, , , ,

The convenience of Microsoft Azure come with some serious problems. It seemed like a good idea at the time to store your cloud service credentials in your on-premise identity management solution. With Microsoft Active Directory and Microsoft Azure, you got exactly that convenience.

The only problem is that when hackers get into your on-premise system, they own your cloud instances too. The US Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert about SolarWinds hackers using privilege escalation to gain access to the Microsoft Active Directory Federated Services (ADFS) and then producing OAuth tokens to move laterally to your cloud instances.

The SolarWinds hack shows that having intruders in your system is the new normal. You need to compartmentalize access, and storing all your access rights in one central place is a very dangerous convenience.

Looking into the Future

IT Leadership, ,

After 9/11, the US vowed never to be caught by surprise again. They created the Department of Homeland Security (DHS) to coordinate the intelligence gathering of a quarter of a million employees. On January 5th, the DHS intelligence summary said “Nothing significant to report.” On January 6th, a mob overwhelmed unprepared police at the Capitol and went rampaging through the building.

Companies are also regularly blindsided by events that in hindsight were obvious. You are gathering a lot of information, but it can be very hard to sift out actionable knowledge. Throwing a huge pile of data to a team of data scientists asking them to find the hidden patterns have rarely been successful.

For you as CIO to be able to peer into the future, you need to disengage from the daily running of the organization. It takes several days away from screens, news, email, and social media before the intuition you have can manifest itself, and generate new insights. Can you step away from your organization for several days? If not, your organization and procedures need some work.

https://www.wsj.com/articles/capitol-riot-warnings-werent-acted-on-as-system-failed-11612787596

Doing the Right Thing

Beneficial Intelligence,

Last week’s episode of my podcast Beneficial Intelligence was about doing the right thing. Google used to say “Don’t be evil,” but now they are struggling with their employees who want them to do the right thing. Amazon is unpopular for squeezing warehouse workers, and McKinsey paid $600 million for the role their advice played in the opioid epidemic in the U.S. They could have done the right thing, but didn’t.

As CIO, you also constantly have opportunities to cut corners and squeeze employees to work a little harder. But if you want to attract and retain top talent, you need to do the right thing. 

Doing the Right Thing

Beneficial Intelligence,

This week’s episode of my podcast Beneficial Intelligence is about doing the right thing. Google started out with a motto of “Don’t be evil” but that has fallen by the wayside. Occasionally, employees can enforce a change as when they stopped working on military AI. But Google doesn’t seem terribly committed, and their Ethical AI Team is falling apart after they fired the head researcher.

Amazon never promised not to be evil, and they are forcing their delivery drivers to do 10-hour graveyard shifts starting before sunrise and going until mid-day. They are trying to avoid tired drivers causing accidents by installing cameras and AI in the vans so the computer can detect when the worker is falling asleep behind the wheel and can wake him up.

As a CIO, you’re engaged in a war for talent. But you also need to meet your budget, implement hot new technologies like AI and maintain IT security. There is always an opportunity to cut a corner, roll out inadequately tested technology or squeeze employees so you can hit your goals this quarter. But if you want to be able to attract and keep top IT talent, you need to do the right thing.

Listen here or find “Beneficial Intelligence” wherever you get your podcasts.

Future IT Leaders

IT Leadership, , ,

The future IT leaders are coming from the cloud business. Jeff Bezos just announced he is stepping down as CEO, and the new CEO is Andy Jassy, who was running their cloud business. That business is a small part of Amazon’s turnover, but more than half their profits. At Microsoft, Satya Nadella was running Azure before he became CEO of Microsoft.

The next CIO in your organization is also going to be someone with experience running successful cloud-based solutions. And if you are an IT leader and looking to move up to larger things, you will need some cloud successes under your belt, too.

Just be aware that your career doesn’t just need cloud, it needs cloud solutions that provide significant business benefits without loss of flexibility. It is easy to rack up large cloud bills without anything to show for it, or to get locked into an inflexible cloud solutions. It is not easy to create successful cloud solutions. That’s why those who can will get ahead.

Don’t Whine, Fix the Problem

IT Leadership,

In a rare communication misstep, Tesla is on the wrong side of public opinion for once. The National Highway Traffic Safety Administration requested a recall of 158,000 cars because Tesla is using cheap memory chips that fail after a few years. That leaves one of the screens in the car blank, making the user unable to activate features like defrosting the windshield. Tesla has now grudgingly issued the recall, but whines that “It is economically … infeasible to expect that such components can or should be designed to last the vehicle’s entire useful life.”

If you have cut corners and delivered a defective product or service, and you are called out on it, the right way to communicate is not to whine that it’s too expensive to do it right. Steve Jobs was exceptionally charismatic and could get away with telling iPhone users “you’re holding it wrong.” Everybody else should just apologise and fix the problem.

Do you Really Need Blockchain?

IT Leadership, ,

It is reported that the IBM blockchain team has been gutted, even though IBM vehemently denies it. Enterprise blockchain seems to be in retreat across a wide range of industries.

Organizations with high value maturity have solid processes in place to calculate the business benefit of new technologies, and only a few of those invested in blockchain. But organizations with a lot of legacy technology who felt the need to jazz up their tech portfolio enthusiastically embraced blockchain and started vaguely defined projects

If you are a CIO, take a look at your project portfolio. If you have blockchain projects on the list, have an experienced analyst from outside the project team take a good look at the business case. If she reports back that it is based on overly optimistic assumptions, it should be re-evaluated. If that means the costs outweigh the benefits, the project should be cancelled.