Sten Vesterli

Making IT Live up to its Promise

Leadership

Convenience vs Security

, , , ,

The convenience of Microsoft Azure come with some serious problems. It seemed like a good idea at the time to store your cloud service credentials in your on-premise identity management solution. With Microsoft Active Directory and Microsoft Azure, you got exactly that convenience.

The only problem is that when hackers get into your on-premise system, they own your cloud instances too. The US Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert about SolarWinds hackers using privilege escalation to gain access to the Microsoft Active Directory Federated Services (ADFS) and then producing OAuth tokens to move laterally to your cloud instances.

The SolarWinds hack shows that having intruders in your system is the new normal. You need to compartmentalize access, and storing all your access rights in one central place is a very dangerous convenience.

Looking into the Future

, ,

After 9/11, the US vowed never to be caught by surprise again. They created the Department of Homeland Security (DHS) to coordinate the intelligence gathering of a quarter of a million employees. On January 5th, the DHS intelligence summary said “Nothing significant to report.” On January 6th, a mob overwhelmed unprepared police at the Capitol and went rampaging through the building.

Companies are also regularly blindsided by events that in hindsight were obvious. You are gathering a lot of information, but it can be very hard to sift out actionable knowledge. Throwing a huge pile of data to a team of data scientists asking them to find the hidden patterns have rarely been successful.

For you as CIO to be able to peer into the future, you need to disengage from the daily running of the organization. It takes several days away from screens, news, email, and social media before the intuition you have can manifest itself, and generate new insights. Can you step away from your organization for several days? If not, your organization and procedures need some work.

https://www.wsj.com/articles/capitol-riot-warnings-werent-acted-on-as-system-failed-11612787596

Doing the Right Thing

,

Last week’s episode of my podcast Beneficial Intelligence was about doing the right thing. Google used to say “Don’t be evil,” but now they are struggling with their employees who want them to do the right thing. Amazon is unpopular for squeezing warehouse workers, and McKinsey paid $600 million for the role their advice played in the opioid epidemic in the U.S. They could have done the right thing, but didn’t.

As CIO, you also constantly have opportunities to cut corners and squeeze employees to work a little harder. But if you want to attract and retain top talent, you need to do the right thing. 

Doing the Right Thing

,

This week’s episode of my podcast Beneficial Intelligence is about doing the right thing. Google started out with a motto of “Don’t be evil” but that has fallen by the wayside. Occasionally, employees can enforce a change as when they stopped working on military AI. But Google doesn’t seem terribly committed, and their Ethical AI Team is falling apart after they fired the head researcher.

Amazon never promised not to be evil, and they are forcing their delivery drivers to do 10-hour graveyard shifts starting before sunrise and going until mid-day. They are trying to avoid tired drivers causing accidents by installing cameras and AI in the vans so the computer can detect when the worker is falling asleep behind the wheel and can wake him up.

As a CIO, you’re engaged in a war for talent. But you also need to meet your budget, implement hot new technologies like AI and maintain IT security. There is always an opportunity to cut a corner, roll out inadequately tested technology or squeeze employees so you can hit your goals this quarter. But if you want to be able to attract and keep top IT talent, you need to do the right thing.

Listen here or find “Beneficial Intelligence” wherever you get your podcasts.

Future IT Leaders

, , ,

The future IT leaders are coming from the cloud business. Jeff Bezos just announced he is stepping down as CEO, and the new CEO is Andy Jassy, who was running their cloud business. That business is a small part of Amazon’s turnover, but more than half their profits. At Microsoft, Satya Nadella was running Azure before he became CEO of Microsoft.

The next CIO in your organization is also going to be someone with experience running successful cloud-based solutions. And if you are an IT leader and looking to move up to larger things, you will need some cloud successes under your belt, too.

Just be aware that your career doesn’t just need cloud, it needs cloud solutions that provide significant business benefits without loss of flexibility. It is easy to rack up large cloud bills without anything to show for it, or to get locked into an inflexible cloud solutions. It is not easy to create successful cloud solutions. That’s why those who can will get ahead.

Don’t Whine, Fix the Problem

,

In a rare communication misstep, Tesla is on the wrong side of public opinion for once. The National Highway Traffic Safety Administration requested a recall of 158,000 cars because Tesla is using cheap memory chips that fail after a few years. That leaves one of the screens in the car blank, making the user unable to activate features like defrosting the windshield. Tesla has now grudgingly issued the recall, but whines that “It is economically … infeasible to expect that such components can or should be designed to last the vehicle’s entire useful life.”

If you have cut corners and delivered a defective product or service, and you are called out on it, the right way to communicate is not to whine that it’s too expensive to do it right. Steve Jobs was exceptionally charismatic and could get away with telling iPhone users “you’re holding it wrong.” Everybody else should just apologise and fix the problem.

Focus on the Mission

, ,

Do you have a hard time finding the IT talent you are looking for? Spare a thought for the recruitment officers at the CIA. With an image that today is more waterboarding than James Bond, their approval rating among millennials is at an all-time low. Even though they have started running video ads, are on Instagram and post jobs on Linked, they have a hard time recruiting the talent they need.

As the CIO, you can’t do much for the general image of your organization in the public eye, but you can make sure you are communicating in a language and on a platform where your prospective employees are. It is hard and expensive to buy the best talent with compensation alone, so you need to explain how working for you will allow IT professionals to make a difference.

That’s why your job ads should have one thing in common with the CIA: Focus on the mission.

Amateurs and Professionals

,

Last week’s episode of my podcast Beneficial Intelligence is about amateurs and professionals. Amateur traders have recently sent professional investors reeling, but amateurs don’t do well in IT. CIOs need to find a way for the IT amateurs in the business to work productively with the IT professionals in the IT department.

Is Estimation Bullshit?

,

“Estimation is bullshit.” David Heinemeier Hansson (of Ruby on Rails fame) doesn’t mince words. He takes pride in being controversial, and some of his advice is useless or downright dangerous for most organizations. But his point of using budgets instead of estimates is solid.

The reason is it forces everyone to think in terms of business outcomes instead of cost. Instead of asking the impossible “how long will this take” question, you start by determining what a certain feature is worth. If it is worth $200K, you might be willing to spend $50K on trying to build it. If your team hasn’t been able to build the feature after they’ve spent the budget, you kill that project and try something else.

I encourage you to read Wojtek Borowicz’ interview with David Heinemeier Hansson.

If you are involved in the day-to-day running of IT development as a program manager, architect, project leader, or scrum master, I encourage you to read the whole “Shape Up” book. It’s available for free online.

Employee Activism

Some companies have gotten tired of employee activism. Coinbase has just told its employees to shut up or ship out, and 60 employees have taken the severance package offered and left the company.

That’s an aggressive counter to the public complaints from employees at some high-profile tech companies. They have been criticizing projects and customers and even staging (virtual) walkouts.

IT employees are looking at the way their colleagues at Amazon and Facebook are making their voices heard. Do you have a policy for what your employees can and cannot say? Do you allow political discussions on the #random channel on Slack? You need a policy.