​Accountability is needed to prevent more IT failures

8 ways IT chiefs can ensure everyone is accountable during large scale tech projects.

 David Gee (CIO) 15 February, 2016 13:46

 I’ve seen numerous IT projects in the public and private sectors that are over budget and never deliver the expected benefits. Frankly, this is the norm rather than the exception.

The NSW government’s decade-long Learning Management and Business Reform Project is at least $50 million over budget. This is a perfect example of a lack of project accountability across the NSW Department of Education and Communities.

Earlier this month, we learned that the Baird government will spend $1 million to prevent IT project cost blowouts like this in the future.

I have to ask with all sincerity that it doesn’t matter if this is private or the public sector – what really counts is holding people accountable.

In any IT project, the CIO and his or her team clearly need to be completely responsible for delivering on a project to avoid a costly situation like this where third-party consultants need to be engaged.

It is possible to achieve this kind of cultural shift but it takes more than creating new governance processes and guidelines to prevent IT project failures of this magnitude.

Believe it or not, I’ve seen several instances where large, complex IT programs are delivered on time and within the set budget. But there are still far too many examples to the contrary.

Here are 8 ways IT chiefs can ensure accountability during large scale tech projects.

1. Create transformation principles 

Be clear on the principles to drive the program of work. This will be around what does ‘vanilla’ mean and exactly when are any customisation is allowed. In the best projects, only configuration is acceptable and customisation even for ‘competitive advantage’ is ignored.

2. Deliver value in smaller chunks
The Department Secretary and CIO agree to specific goals for delivery over a 6 month period. There is little point trying to create 2 or 3-year goals. What counts is delivering value in chunks.  

3. Ensure goals are completely clear
The goals must be clear and translatable for every member of staff, and be able to be ‘stretched’ if required.

For example, Suncorp Group said last August that it had decommissioned 7 of its 13 legacy data warehouses in 12 months. It aimed to decommission the remaining 6 – along with a large volume of legacy reporting – by December.

Former Suncorp CEO, Patrick Snowball, deployed on team to complete this task. This project had this was a goal that had a defined temporal scope and end state, and informed the team that they had to work together.

 

4. Employ critical chain level planning
Use critical chain project management methods where the project ‘buffers’ are identified and then managed by a weekly executive steering committee. For example, if you have a project task that normally requires 5 days to complete but in this instance, will be started later and take longer, you must first get permission from the committee.

5. Create a weekly executive steering committee
Get together each week and discuss progress to ensure everyone is accountable at all times. Any hint of an overrun is immediately spotted, and addressed by giving team members different priorities if required.

 

6. Introduce project delivery standups

A project team and its vendor partners must share successes and concerns. A standup meeting should not be a general ‘status update’, rather it should focus on identifying obstacles that stand in the way of executives meeting their commitments. All issues are escalated immediately to the vendor and addressin performance?

7. Hold town hall meetings
A good program has to communicate both regularly but more critically with transparency. The Town Halls keep everyone on the same page and allows for stories to be shared both positive and negative. It just stops the hallway chatter which is typically self-destructive.

8. Encourage leadership behaviours
Team leaders need to demonstrate the right leadership style and focus on outcomes. There must be no tolerance for any teams or individuals who do not comply with the agreed principles.


Players not spectators

In short, the best places that are able to deliver complex and hard projects are those that create a culture of delivery. Pride in one’s work must be an essential ingredient but it’s not enough –
project managers need to know how to build a winning team. They need a system or process to operate that reinforces and helps drive success.

This system has to include effective vendor partnering, escalation and resolution of issues. A really good partnership is truly two-way and it is not about beating up on the vendor.
After all, transformation is not a spectator sport, everyone has to be in the game.

Why DevOps is about more than improving software productivity

The frequency of software releases should not be defined by the development process – but by your organisation’s needs

http://www.cio.com.au/article/593727/why-devops-about-more-than-improving-software-productivity/

Facebook, Amazon and Google, the darlings of Silicon Valley use DevOps – a concept aimed at improving interaction between app developers and IT operations staff – to continuously deliver software.

It’s true, DevOps does enable organisations to release code on a frequent basis while maintaining stability and security.

So if the concept helps some of the world’s largest and most successful IT companies improve software productivity, there’s no reason why it can’t help you do the same.

I will boldly claim that if you use DevOps, you’ll be able to deliver software two to three times faster than using a waterfall approach.

But before you get dazzled with such lofty goals and while speeding up software delivery is important, it’s not the only benefit of moving to a more agile delivery model. In fact, it runs much deeper than that.

This week, I met with Gary Gruver, a DevOps guru who is releasing a book titled, “A Practical Approach to Large Scale Agile Development.” 

When he was VP, operations, engineering and quality at US retailer, Macy’s, Gruver convinced the
company to increase its innovation budget from 5 per cent of base to 40 per cent in three years.

This increase was achieved from better use of the company’s resources and assets not simply by investing more money in innovation. As Gruver explained, when you have to write off a few million dollars worth of test automation scripts, it is not a great experience.

Born from necessity
Now, Gruver should be viewed as a hero, but instead he just wanted not to be “the bottleneck.”
This is the genesis of how DevOps was introduced into Macy’s – the retailer that had 2 million lines of code and monthly software builds so moving to an agile approach was just good common sense.

Read more ​6 questions that a CIO doesn’t want to be asked

 

There were no big goals of being fast or saving money. It was all about improving the quality of software delivery.

I asked Gruver about what was the hardest part of making this shift. Was it moving from monthly or weekly release cycles or the shift weekly to daily, and then to hourly?

His advice was not to start with this goal and this should be secondary to a focus on executive support. He went on to explain that the frequency of releases should not be defined by the software development process - but by the organisation's needs.

Doing what the business wants
If your organisation’s needs are already being met, then don’t try to apply DevOps. It is just not necessary. However, if this is an issue then use the common sense approach and ‘automate and eliminate’ as much as possible. It is likely that what you tackle are issues that have been around since the beginning and have never been addressed.

Read more ​Why identity management will improve the customer experience

 

Gruver said to achieve 15 builds per day, he needs the team to redesign, and in some cases, isolate the process. For example, service virtualisation was applied to isolate DevOps from the expensive mainframe – where cycles cost money. Moreover, this is as much about people as it is about technology and process.

Shifting the culture
You have to engage the leaders, use common tools, achieve ‘green builds’, have a clear definition of when something is "done" and adopt flexible planning. Each of these is a challenge and this is a journey that takes a number of years.

By tackling this, you will shift the culture to where continuous delivery is the goal. The only way to achieve this is to increase the frequency and quality of feedback to developers.

Do this now and you just might just achieve he cultural shift you are looking for.

​Why machine learning may help stop payment fraud

Design thinking will be required to support the new world of faster payments, says David Gee

http://www.cio.com.au/article/593627/why-machine-learning-may-help-stop-payment-fraud/

​

In 2017, the New Payments Platform (NPP) – infrastructure that offers real time payments between financial institutions and their customers’ accounts – will come into effect. This essentially means that payments will be visible in a customer’s account within around 10 seconds.

What this also means is that banks’ risk systems need to work in real time and make a decision in around 5 to 6 seconds if a transaction should be authorised or not. Frankly, that’s incredibly fast and internal processes will need to be slick.

Under the covers
Banking systems have a set of complex fraud rules that are applied to transactions. These rules have been designed for a different scenario and with only a few seconds to decide, fraud

algorithms must be concise.

When the objective is to have fast, secure and reliable payments, ‘design thinking’ is required to overcome the existing paradigm.

A number of other countries such as Singapore and Sweden have already launched faster payments systems. But it is clear that when you have moved from a system where there is a clearing house to transfer money and what I would call ‘old plumbing’, to a real time system – it should be no surprise that fraud is the major concern.

Instant messages, instant cash
As we move to a world where we not only use instant messages instead of email, we also move money at the speed of light with instant cash. At the same time, we are seeing increases in the incidence of money laundering and the funding of terrorist activities.

 

The National Automated Clearing House Association in the US recently announced it would start to take the first steps towards allowing faster payments and settlement. To enable this change, an agreed 8.2 cents per transaction is to be paid to the receiving institution.
But even with the proposed real time clearing house functionality in-place, back office systems are simply not ready to handle such updates.

Paypal’s fraud systems
The newer players such as Paypal use artificial intelligence (AI) technology with machine learning capabilities to help them identify fraud. These algorithms look for patterns from a user’s past purchasing history and once a new pattern is found, a new rule is created to stop repeated scams.

But how effective are these systems? Paypal has a 0.32 per cent of revenue fraud rate, which is significantly lower than the average of 1.32 per cent.

With this individual profiling, PayPal understand the kinds of items that I would buy and when there’s an anomaly in my purchasing patterns, Paypal is alerted that fraudulent activity might be going on.

In Australia, payment card fraud increased from 46.6 cents to 58.8 cents for every $1000 transacted from 2013 to 2014.

It appears that the only real way to combat this trend, which will only exacerbate with real time payments, is to adopt a deep machine learning (AI) approach.
 

New machine learning models

We are starting to see new companies that will help us to navigate the change brought about by real time payments. An example is IRIS Analytics, which was acquired by IBM last year.

The objective of this solution is to detect fraud at scale and speed, using a ‘machine learning’ model, which acts to assist the bank as a ‘virtual analyst’.

Without such technologies, it is impossible for companies to combat fraud. A great example is American Express which uses Hadoop and machine learning to manage the volume of more than 1 trillion of transactions per year.

Humans are still needed in this equation and the idea is to use the technology to process the data, and when required, it still makes sense to have a call or text to the cardholder. Such notifications can really help to get the right level of engagement and reduce the level of fraud.

Are we lemmings?
There is no doubt that the world is moving faster and we all want to use instant messages with instant cash. However, it is arguable that the existing payments systems are sufficient for 80 per cent of volume of business.

The business case to have real time payments is not strong but that is a moot point as we are all charging to that cliff. Let’s not be a lemming. The only ‘safety net’ is that we adopt new fraud engines that use advanced machine learning.

 

The customer experience algorithm

There is logic in looking at improving the customer experience as a pure maths problem 

http://www.cio.com.au/article/593204/customer-experience-algorithm/ 

All companies are on a journey to transform their customer experience and taking various approaches to this, but what are the basic elements of this equation?

Can you solve this problem, just like you can with an advanced calculus equation? It would be wonderful to find the magic formula to creating an amazing experience wouldn’t it?

I’m sure you fondly remember your days in school doing mathematics. I’ve always wondered how useful were the formulas that we all learnt. As I have got older I’ve realised that most of these techniques have not been of much use.

In business, the idea of using an algorithm to manage what is considered to be a ‘touchy feel’ topic would also be ridiculed. But there is logic in looking at this as a pure maths problem.

The customer experience is the holy grail for most enterprises, and it is clear that there is no single owner. In the past, it has been the case the chief marketing officer (CMO) has grabbed this and driven the development of customer journey maps.

But the reality is that customer experience is the result of doing many things well. Using the framework of an algorithm we have a multiple ingredients that make up the numerator.

There are organisations that have adopted digital, design thinking, Agile, big data analytics, mobility, social and many more strategies to attempt to realise a better customer experience.

But this is not about doing of these activities on ‘steroids’. I would maintain that this would create the risk of doing too much and overwhelming your customer with transformation.

Singapore Airlines v US airlines
A simple example when one has the experience of travelling with Singapore Airlines in first, business, or economy class.

First, business or economy, it is no comparison to what you enjoy on an American Airlines or Delta Airlines flight. The customer experience on Singapore Airlines is hard to match and putting your finger on this is not that easy.

  

There are a number of factors from the smiling welcome, personal entertainment and the food service. This all starts prior to check-in and the boarding process.

Doing many things right make a great customer experience. But getting the mix right is all part of this journey. It is not necessary that you have to be the very best in everything to have a great customer experience. But clearly when you raise the bar, any weaknesses are amplified.

 

Best cooks take great ingredients
You have to partner with your CMO, COO and other c-suite colleagues to ensure that you collectively get all the best possible ingredients. The art is in taking these and making them all work in harmony that is reflected as a great experience for the customer.

For instance, don’t think about digital or analytics in isolation.

Take a more holistic view around how you are going to improve the customer service for different segments of customers. This is when the sum of the parts exceeds the pieces.

 

 

Your action plan needs to take into account this broader view and in a recent study organisation identified multiple variables that they needed to improve the customer experience.

Recently, I heard Mike Pratt, commissioner for Service NSW talk about the transformation journey that he is leading. He noted that the government agency was consolidating 30 customer call centres into just 2. This was all about doing a major reset of how customers are being serviced by the NSW government.

Should you walk past a Service NSW branch or kiosk, it is obvious that something uniquely different is happening and it is not a new lick of paint. Behind this are numerators such as payments platform, design thinking, service mindset and digitalisation.

  

Mike Pratt talked about the many hundred of physical licences that are being printed (hunting, fishing, driving etc) and how his team is moving towards this being all consolidated into a digital version that sits on your smartphone.

CIO taking leadership on customer experience

I’ve talked about this problem being an algorithm, which suggests that this is a problem that can be solved. Howeer you may be aware that in reality there are many unsolved problems in the world, that maths has not been able to yet tackle.

As CIO you have a choice, wait for your internal customers to involve you or get in now and partner to make it happen. No doubt you and your team is already involved in delivering digital or analytics, but that is not enough.

Being a business leader mean stepping up and taking leadership on the customer experience. It really can’t happen without you, the mathematics just does not work.

 

5 megatrends for CIOs to watch

David Gee grabs his crystal ball and predicts the five megatrends you'll need to be aware of between now and 2020.

http://www.cio.com.au/article/592873/5-megatrends-cios-watch/

Five years ago, I predicted that CIOs needed to keep a close eye on the following five trends:

• The return to craft (Freelancer, Skillsapien, Expert 360)
• Crypto currency (Bitcoin, Ripple, Dogecoin, Litecoin)
• 3D printing (absolutely everywhere)
• Quantifiable self (FitBit, wearables etc)
• The impossibility of forgetting (Facebook, Pinterest, Instagram etc)

In each of these areas, we have seen significant shifts in our society and for the CIO, this represents
both a threat and an opportunity.

Over the next three to five years, the pace of change will continue to accelerate and CIOs will need to be stronger leaders to take the enterprise forward.

I’ve looked into my crystal ball again to predict five megatrends that I believe you’ll need to watch between now and 2020.

They are:

• Machine learning
• The blockchain
• Continuous monitoring
• Smart objects
• The death of e-mail

Let me explain why I think they are key megatrends to watch.

 

Machine learning
The rate of storage of data both ‘soft’ data and ‘hard’ data is increasing and resembles an exponential curve. We are approaching an era that humans will be unable to detect the patterns, due to data overload.

Machines don’t have this issue. Machine learning is the emerging science around “the study of pattern recognition and computational learning theory in artificial intelligence,” according to Wikipedia.

With vast varieties of data, we have hours of video, photos and documents. Searching through these mountains of digital files needs a digital assistant and unfortunately the analogue ones (humans), just doesn’t cut the mustard.

 

The blockchain

This is the ledger system that is the foundation of Bitcoin which has been willingly adopted by financial institutions and seen as a revolutionary approach. It is actually quite simple but in that simplicity, there is extreme elegance.

The idea of writing all transactions with ‘rich’ data into a public or private ledger, eliminates the need for intermediaries. In short, there are indeed hundreds of use cases.

The most extreme case is that the Blockchain replaces the heart of any bank, its core banking system.

There are also some compelling use cases to create a secure personal identity system using this architecture. Again this would remove many existing middle-men.

There is the whole new world around identity that comes with Enigma. But let’s save that for another time.

Continuous monitoring

In the post Edward Snowden era, we live in times that will later be termed World War III – there is conflict underway with ISIS that is an enemy that we can’t see or easily recognise.

Unfortunately, this coincides with a period that cyber security is the weapon of choice and both rogue states along with the western powers all practice this dark art.Alas, we have to give up some of our freedoms in this environment and our lives will be increasing subject to ‘continuous monitoring’. This is checking that our behaviour in the real world and online remains consistent.

Smart objects

We already own many things – smartphones, tablets, fitness trackers, wireless stereos etc. The big difference is that everything starts to talk to everything and all the new items we acquire have this functionality built-in.

It becomes a security nightmare and let’s not be under any illusions that it won’t be restricted to the home. CIOs will also need to deal with security issues related to smart objects in the workplace.

 

That tablet that is sitting as a room control device on the boardroom table has great utility for the participants but it also needs to be secured otherwise it can be a fantastic spy camera for illegal market intelligence gathering.

For every business we start to be able to track every object – truck, person, asset etc in real time. If we can monitor our machines from remote locations and as smart objects talk to smart objects, then preventative and corrective maintenance will be automatically requested and fulfilled.

Just imagine the look of happiness of the CIO or CISO when servers automatically patch themselves after running regression tests to ensure the updates are legitimate and relevant.

The death of email

Is email going the way that faxes and telex messages have already been? There is no doubt that there has been a rise in the use at a personal and increasingly corporate level of messaging applications.

While email has been a useful tool, it has suffered with the design allowing for too much flexibility to allow SPAM email. There is more than 50 billion SPAM messages sent every day, it is there hidden under all those filters and rules.


Clearly email is far from dead, it is just a medium that is not given that much trust – to illustrate we have seen banking services spawn from Facebook, WeChat and other social media. But I’ve never seen a Gmail banking service.

Rising in the place of eMail will be collaboration tools like Slack. These new class of tools have all the advantages of messaging with integration built-in.

What do you think?

I felt pretty good about my last five picks and that was validated when my predictions came true. As I look forward at the next three to five years, these are the megatrends that will demand your attention.

What's your view? Have I missed any of your own favourites?

CISO Interview Series: Vladimir Petranovic, CISO , Atlantis Healthcare

​“create your long, medium and short term plans and then you work on them.”

David Gee (CSO Online) on 21 December, 2015

Healthcare I would assume has a low risk profile as it is an organisation focused on wellbeing and good health. Is this a naïve assumption and in fact your organisation is targeted as much as others?
 
This is very naïve assumption but unfortunately prevalent not only in general public, but also within healthcare IT and senior management. This is especially visible with small healthcare providers that don’t have enough resources to dedicate to security and risk management. And risks are huge; there are privacy issues related to patients data, governmental restrictions and standards required for holding and processing patients data and sovereignty issues if the organisation is multi-national where each nation has different rules and regulations.

I’m interested in understanding how you engage with the business folks in healthcare? Assuming many of them are doctors and administrators do they understand the importance of cyber security?

Most of them support security initiatives, but when it comes to execution there is not enough will and determination to invest in security. However the same people hit the quite high hurdle when they start to negotiate with government organisations and customers that require certain levels of security posture.

On a scale 1-5, do you expect that your investment on Cyber & Information Security will be increased over the next 3-5 years? What’s going to drive that?

Obviously it should be 5, simply because most of healthcare organisations are significantly lagging behind security requirements and regulations, so they will need to catch up in order to survive.

Could you describe your average day as CISO? Do you have a particular routine for the start and end of day??

Every day is different, but I usually start working at 6 AM so I’m well prepared for the next day. I don’t like surprises so my first activity is to check security news and statuses.

How do you balance your own bandwidth between attention on your longer term security agenda and today's issue that has just arisen?

You need to create your long, medium and short term plans and then you work on them. Then you need to create your priorities and make decision where are you going to channel your energy in that moment. It all depends on priorities.

I’ve heard that “information that healthcare organisations his anywhere from 50 to 250 times more valuable than other personal information”

So if I was a hacker, then there is some really interesting personal information that would be stored by Atlantis Health. How do you secure these ‘crown jewels’?

I can’t put the monetary value on personal information. If breached it could mean big reputational hit
to an organisation and even the end of that organisation. The governmental organisations are very strict and conservative when it comes to personal information leakage and breaches usually end up on TV news with health minister having several microphones under his(hers) nose.

To protect private information you need to make sure you follow all the health standards, rules and regulations in the first place, then you need to assess your specific risks and devise countermeasures to eliminate them.

What percentage of your records are digitized and how much are scanned documents? Do you apply the same security framework to both media?

Most of records are in digitized form, only the small proportion of records are in physical form. Security of the information in the physical form is also under the realm of CISOs and sometimes it is easier to explain security issues of physical documentation then electronic documentation. You simply cannot allow the situations like the one where private documents were floating down the road just because nobody expected flooding risk.


For Best Practices where do you look to understand this in both general terms and more specifically around your own domain?

For me best practices are for general type of organisations like textile factory, forestry etc. Healthcare is under strict regulation from the government and has to satisfy the same requirements as the other governmental organisations (internal affairs, police, military).


Are you more concerned about the internal technology vulnerabilities or of rogue insiders?

These days if you say that you are concerned about rogue employees you will probably be on the aim of internal politically correct watch keepers. So you don’t say it. You run security awareness programs where each presentation starts with the slide that specifies the percentage of internal breaches in other organisations.


When you think about adding new talent into your team. What key attributes that you look for when selecting a new staff member? Also I’m aware that there is a shortage of capability in the industry - how long does it take on average to find new talent?

Personally I look at the completely opposite attributes than typical HR and the rest of CxO team. I look at the quality, expertise and similar categories. Everything else is less relevant.

How do you keep up to date with developments in Cyber Security? I heard another CISO who ensures that his staff are all accredited to be able to ‘hack’, thus they understand vulnerabilities and can ‘defend’

Personally, I like to work on several fronts simultaneously. You need to be member of professional bodies and follow their activities, you need to follow industry developments and you need to follow academic developments and research. If possible you should do academic research by yourself.

Finally, what keeps you awake at night?

A good sports event or movie.

CISO Interview Series: Manoj Tewari, Sr. Manager, Group Information Security, International SOS

"The most difficult part of the job is to stay on top of advanced threats, remediation and persuade other teams to remediate"

David Gee (CSO Online) on 18 December, 2015

International SOS has a unique position of being a provider of services for organisations that are trying to assess Security & Operational, Cyber risks etc. You also have to secure your own organisation. What’s the most difficult part of your job at International SOS ?

The most difficult part of the job of my team is to stay on top of advanced threats, associated remediation of vulnerabilities and persuade other teams to remediate the vulnerabilities prior someone else (hackers, enemies, or competitors) exploiting these potential vulnerabilities.

Could you describe your average day as CISO at International SOS ? Do you have a particular routine for the start and end of day?


Manoj Tewari: Every day is unique and full of opportunities to learn, share and lead. On a daily basis with a few exceptional days, I get involved in:

• Negotiating in matrix structure on financial approvals closely coupled with organisation change management related to implementation of new security technologies.
• Describing and advocating the security posture of organisation to clients and help sales & marketing to achieve their objectives by building trust with clients.
• Risk based discussions with general managers and technical discussions with security analysts and engineers.

On a scale 1-5 do you expect that your investment on Cyber & Information Security will be increased over the next 3-5 years? What’s going to drive that??

Manoj Tewari: I’m very confident that our budget will increase over next 3 to 5 years as we have been able to plan and deliver upon the security strategy that we decided 2 years ago.
In last three years Global IT Security has built the trust with several stakeholders by delivering on plans that helped the organisation to achieve a much better security posture. Over the next few years, we will focus on implementation of advance solutions, operational aspects of fundamental security services and certifications. Surely, this journey towards excellence will continue.

How do you balance your own bandwidth between attention on you longer term security agenda and today's issue that has just arisen?

Manoj Tewari: Today’s agenda always get the first priority however strategic actions are always considered. We have a security operations team that works 24x7x365 to take care of operational issues and a dedicated team of experts and project managers working on new security solutions.

There are many new cyber security startups that are appearing. Are there any that have caught your eye recently and you are tracking their progress?

Manoj Tewari: We are highly focussed on top security service providers with credibility and capability to execute. For almost all decisions on new service providers, two key parameters that we don’t compromise are ‘excellence in execution’ and ‘excellent support structure’.
We treat our service providers as our key partners because they bring capabilities that are necessary for the organisation to concur the cyber game. It works best when we partner with the best in the industry.

 

What do you regard as the crown jewels within International SOS that has the highest level of security? How well do you conduct ‘mock’ incidents so that the team is prepared for data breaches??

Manoj Tewari: For all companies and so for the International SOS , there are critical IT systems that are considered as crown jewels. Due to confidentiality reasons, I cannot document those systems here however I can assure you that we integrate security in business requirements, application build and infrastructure layer for the keys systems. We implement administrative, technical and physical security controls to build the layered security around these key solutions.

We test our incident management and data breach notification procedure by mock test every six months so that our team is prepared and aware of their role and responsibility on security incident and data breach notification procedure.


For your clients I assume that there are specific guidelines that you provide for securing their travel to certain countries and locations. Does this specifically cover IT and Information Security – could you provide a flavour of the value of this?

Manoj Tewari: Yes, it covers specific requirements of our clients related to information security. While we provide emergency medical and travel information services to our clients, we also provide an assurance on information security of the data that we collect from our clients. The information assurance is an integral part of our services.


Within the International SOS environment are you more concerned about the internal technology vulnerabilities or of rogue insiders?


Manoj Tewari: Most of the time we are busy with internal technology vulnerabilities. The technical vulnerabilities get the priorities however also have documented procedures to respond to rogue employee. Thankfully, we haven’t faced rogue employee issues in our organisation leading to information security incidents or data privacy breach so far.



When you are recruiting new talent into your team, what key attributes do you look for when selecting a new staff member? I’m aware that there is a shortage of capability in the industry - how long does it take on average to find new talent??


Manoj Tewari: There is surely a shortage of right talent pool in security industry. It is very difficult to get people with right mix of technical and soft skills. It generally takes 3 months to find people with right skill set. Key technical skills such as security analysis, penetration testing, and security architecture are rare skills.

Finally what keeps you awake at night?


The idea of hackers have to be successful only once, while we have a challenge to remediate every single vulnerability keeps me awake at night.