The new Enigma

MIT’s Enigma project is a decentralised computation platform with guaranteed privacy

David Gee (Computerworld) 13 January, 2016

 

An enigma is someone or something that is mysterious or puzzling.To this end researchers at MIT are working on a new Enigma, which allows for computation involving sensitive data without revealing information.

Enigma’s historical namesake was built by German engineer Arthur Scherbius. It was a mechanical device used to encrypt secret military messages. The Allies’ efforts to break Enigma are considered to have had a significant impact on the course of World War II.

A killer privacy app?
Cyber security and breaches that expose individuals’ private data are major — and growing — concerns. This, then, could be a killer app.

“Enigma is a decentralized cloud platform with guaranteed privacy. Private data is stored, shared and analyzed without ever being fully revealed to any party,” the project’s home page states.

 

In the current world we have two choices: Encrypt data to protect it or don’t encrypt and face the risks.There is no middle ground; while data is protected through encryption, it is effectively unusable.

For instance, privacy laws are all about protecting the personal data that is stored at various institutions.To secure this then strong encryption is applied to protect this data ‘at rest’ and also ‘in transport’.

But the problem is if we want to actually just use this data to, for example, plot the suburbs or states where members of our service's user base are located or calculate an average salary.

Even obtaining some kind of average figure based on the data of members of a particular group is not possible without decrypting.

The grey zone
From the current binary, black or white scenario, Enigma allows for ‘grey’.

Enigma is based on the concept of homomorphic encryption, which allows encrypted data to be operated on without seeing the actual data.It works as a peer-to-peer network and enables anonymous untrusted parties to use sensitive data without the need for a third party intermediary.

The geniuses behind this development are MIT’s Guy Zyskind, Oz Nathan and Alex ‘Sandy’ Pentland.

“Enigma is a decentralized computation platform with guaranteed privacy,” states a paper authored by the three.

“Our goal is to enable developers to build ’privacy by design’, end-to-end decentralized applications, without a trusted third party...

“Today, sharing data is an irreversible process; once it is sent, there is no way to take it back or limit how it is used. Allowing access to data for secure computations is reversible and controllable, since no one but the original data owner(s) ever see the raw data. This presents a fundamental change in current approaches to data analysis.”

What’s the secret sauce?
 The technology behind Bitcoin — the blockchain — is Enigma’s secret sauce. Instead of data being stored in one large encrypted database, it is actually stored in smaller private databases or ledgers, each within a separate node.Thus the large scale data leakage can’t happen.
A key feature of Enigma is that you, as a private individual, can provide access to information or parts that you allow to be disclosed. Such permission can be provided or revoked, just as quickly.

This is a big deal and could revolutionise how we interact with others and indeed what we allow
others to store about ourselves. It would represent a shifting of the balance of power squarely back to the individual.

You control the action
If you control your data, it threatens the likes of Google and Facebook, whose business models are in part predicated on keeping your data within their walled gardens.By allowing you to decide who gets what data, it in effect creates a value and marketplace for you to monetise.

An instant use case is that you could sell your anonymous data to market researcher bots that collect relevant information from Enigma clients. These would be ‘smart objects’, talking to each other and transacting data for payment.Real world use cases could be found in just about every industry and sector.

An enigma
This is truly an enigma; it is puzzling and a significant departure from where the Internet and cyber security are today. The promise is incredible, although I would assume that such tectonic shifts are not going to come easily.
 

Who’s blocking the blockchain?

It’s no surprise that the distributed ledger underpinning Bitcoin has caught the attention of both banks and regulators

http://www.computerworld.com.au/article/590571/who-blocking-blockchain/

The hype around the blockchain is becoming deafening.
Just this week, both Westpac and the Commonwealth Bank have run sessions on the blockchain during the Sydney leg of an international series of conferences on the technology’s potential.

Bitcoin was the genesis of the blockchain. The cryptocurrency uses the technology essentially as a distributed ledger for transactions.

However, around two years ago, there started to appear a number of companies that were working on blockchain-based applications separate from Bitcoin.

Friend or food?
As a virtual, decentralised currency, Bitcoin represents a challenge for governments and regulators.
Banks have a vested interest in the status quo; the system they operate within is highly regulated and it has taken a significant investment to get them to this point of operation.

But now there has developed a clear separation between Bitcoin, which uses the blockchain, and the blockchain, which can be used without Bitcoin.

The blockchain is used to store information about transactions. When you consider this at 10,000 feet, this is essentially what a bank’s core systems have been built to provide.
In essence, the blockchain is both a threat and opportunity for the banks.

Blockchain is digital banking
In some respects the blockchain is employing concepts and technologies that already exist, so what’s really new?

Shared ledger: Systems of record existed before the blockchain.
Cryptography: The basis of current commerce.
Smart contracts: We had this with Workflow technology

Consensus (of the nodes that validate transactions): This is new!
Fundamentally this is taking money and banks into a true digital era. What I mean by this is that most large banks have been innovating on the edges with new interfaces, UX etc.

Blockchain is using all of these technologies together and that is a key difference.The blockchain is all about technologies that are all massively compute-technology-intensive with compliance and auditing built in from scratch.

Jargon
There is significant jargon in this space: Sidechains, coloured coins, smart contracts and more. I’m not going to attempt tackle them in this article.

What should be understood, however, is that there are public and private blockchains. The private ones are permissioned with known participants, while the public ones are what are called permission-less and involve untrusted third parties.

You can store just about any information on a blockchain: Names, addresses, ID, passport, photos. In fact you could store your whole life on this medium and then employ it to validate yourself when you need to fill in forms or identify yourself.

It is expected that employing private blockchain technology to provide point solutions will be the starting point for most of the banks that are interested in the technology.

There will be a natural resistance to tackle public blockchains as this requires much greater coordination and regulatory approval.

Regulators should be friends
Regulators have yet to endorse blockchain, but neither have they condemned it as inappropriate.
There has been a strong belief that this lack of being a declared safe playground held back the technology, with the uncertainty slowing uptake.

However, this no longer the case: There is an explosion of blockchain use cases with more than 50 ways to apply this technology in innovative fashions. Over the last few weeks I’ve heard three to four pitches from new startups that are in this space.

Regulators are naturally conservative, but the power of the blockchain has great potential. Just imagine a bank having a private blockchain system used adjacent to their core banking or payments applications.

Right out of the box a blockchain has a built-in audit trail. You can trace or interrogate the data, and theoretically this would allow a regulator to perform their own searches of the data set.

That is, frankly, a scary thought for many banks but the transparency it could bring would be welcomed by regulators.

A win-win for regulators and banks?
There is a significant cost for every bank to be compliant with growing regulatory requirements – AML, FATCA, APRA and so on. Compliance costs have been a major component of strategic project spend at banks.

It is not a surprise to hear that a major bank spends $100 million to $200 million on regulatory compliance for just one small requirement.

This is clearly required to keep things running effectively, but each new layer of regulatory compliance adds an incredible burden and the required investment doesn’t add a single dollar of profit.

Embracing the blockchain for private in-bank use to replace existing legacy can yield immediate benefits for a bank — and immediate benefits for regulators.

​The 3C’s of digital transformation

Having the right capability, capacity and culture are the key to the success of digital transformation projects.

I recently ran two events in the same week on digital transformation and it was a unique juxtaposition.

One event was attended by more than 150 enterprise sales managers who are striving to learn how to sell digital transformation strategies to the c-suite. The other was attended by an elite group of more than 20 CIOs who were sharing stories about the challenges they face when rolling out digital transformation projects.

It struck me that in both cases that there were 3C’s that were key to their success. Both parties were all trying to achieve the same goal for different sets of customers. In both cases, external customers and in one case also an internal one.

3C’s for CIOs: Capability, capacity and culture
For the group of CIOs, I asked the question for their respective enterprises as they looked forward on these 3C’s. What were their gaps? Did they have right digital ‘capability’ to drive the enterprise forw

I was referring to areas such as:

• Design thinking
• UI/UX
• Lean startup
• Customer journey mapping
• Analytics
• DevOps

I then asked the CIOs if they had the ‘capacity’ to manage true transformation in all of these areas.
Every transformation creates stress and strain, I’ve never seen any organisation have excess capacity – particularly of the right capability.

Bearing in mind some past scar tissue, I also asked if their enterprises had the right depth in of staff and skills to tackle the peaks of the effort required to make that breakthrough and truly transform their processes. Most were struggling with the bandwidth that was required.

Read more ​Why Agile and DevOps is shaking up management

Finally I asked the CIOs if they have the right ‘culture’ that will enable and sustain the digital transformation. The CIOs all gravitated immediately to the gaps in their organisation’s culture.

It is clear that they understand that both in the business and in IT, that there are significant gaps which will impede the success of digital transformation.

Culture is all about the right ‘mindset’, and how do we create this with our own teams and indeed with business partners. And this is not about ‘good or bad’ culture but more about culture that will embrace and support this digital transformation.

3C’s for enterprise sales managers: Capability, culture and content

In the second session, I ran a fireside chat with the CEO of a respected enterprise provider. This organisation is moving into a broader solution set and as a result, looking to engage with the c-suite.

The CEO’s team of 150+ sales and sales support members were keen to make the leap into providing tools for digital transformation.

My role was to help them prepare to make this pitch to the CIO and his peers. It is clear that these meetings are a critical element of their overall account management and sales approach, and we talked about the best ways to tackle this. I even suggested that if the CIO looked too distracted should he suggest the meeting is rescheduled?

It was insightful that this organisation, like many of its competitors, understand that digital transformation is where their customers are facing. Hence they want to be able to sell solutions to meet this demand.

We also talked about the day in the life of the CIO, and how to prepare for a pitch. It is clear that suppliers are providing ‘capability’, but to succeed they too need to have the right ‘culture’.

By ‘culture’, what was meant was confidence – that their solutions would stack up against new competitors and they the planned approaches in this new territory would have a high probability of success.

And there was a new ‘C’ and that was ‘content’. This was a weapon to be used to help position their capability, I explained that being able to share a best practice use case from another industry is powerful.

For instance, being able to add that a client ABC has 100 per cent hybrid cloud or big data implementation and you would be happy to ‘connect’ them is the really a big deal.

How the sales manager can help make the CIO, understand and learn new things can potentially also make him or her look good.

Selling to the c-suite
No CIO ever wants to be ‘sold to’, but we all want to have good partners to work with and rely on.
It is intriguing when you start to look at the idea of would a CIO want to have a partner sell to his c-suite and the answer is ‘maybe’. This all depends on the level of trust that exists and the partnership that is in place.

Every CIO during a transformation needs to add capability and capacity. The leader also wants this to be a good cultural fit, and needs to be able to sense if a partner has the right stuff.

My personal hypothesis is that the way to sell this to the CIO is around content.

Using stories that illustrate your products is key and when others are doing this, then it’s even more powerful.

Yes, content is king – but is a means to an end.

Why Agile and DevOps is shaking up management

Middle and senior managers are not exactly sure what their role should be in an Agile world

 

http://www.cio.com.au/article/599283/why-agile-devops-shaking-up-management/

Many organisations adopt Agile principles during their project planning process and then use DevOps methodologies to release regular – perhaps continuous – changes.

We have been used to seeing large complex projects adopt the classic ‘Waterfall’ method. The old approach was about trying to do enough planning to be able to manage a project’s scope, resources, and schedule. The reality is that during such a project, the assumptions are never accurate enough.

I’ve seen requirements, planning and development phases all have major issues. The Waterfall approach can become unstuck and usually at every junction. As a result, there are many examples of team never delivering usable code.

Taking centre stage
As Agile methodologies become more commonplace, the question for CIOs is how do Agile and Waterfall approaches exist in the same organisational architecture?

In Agile, the focus is about incremental builds with the most critical functionality first. The code drops are made early and during the process on a regular basis. For instance, digital music service,
Spotify and other leaders in their respective industries have been successful allocating project scope to Agile teams of less than 100 staff.

Each team has constructed user stories and tests these against some agreed customer personas. They also use an Agile coach (who works across a few teams and drives delivery).

Consequently, we have some middle and senior managers who are now not exactly sure what their role should be in an Agile world. The same may be true for people managing DevOps teams.

Many people assert that DevOps is just an Agile principle taken to the full enterprise and as a manager, your role becomes more about managing the team rather than individuals.

 

The philosophy is that you are empowering this group be responsible for solving their own issues. Accordingly, you have to manage the team in a more subtle fashion, than perhaps you have been accustomed.

First, all of the members of an Agile team should have the exact same performance goals. However, you are required to assign individual goals for individual performance development, and these have to be 100 per cent aligned with team’s goals.


Your feedback cycle has to be regular and much more frequent; it can’t wait for a month and also it requires a more holistic 360-degree flavour. Such amplification of feedback is an also critical element of DevOps and in both cases, there is a special need for behaviours to be highlighted.

 

In the same vein, resource management is also exercised with a subtle difference and it is not about allocation of resources to increase to get work done.

While you still care about keeping utilisation rates as high, it is more about helping teams to achieve delivery for selected projects and not working on multiple and not really being focussed on anything.

One such approach is that enterprise would queue up the projects for the team instead of having the team tackle multiple projects simultaneously.

Management reporting

Read more ​The 3C’s of digital transformation

For both Agile and DevOps, there is a strong focus on teams accomplishing a volume of work in a specific period of time. DevOps is more about releasing software into production rather than the speed by which it is delivered.

As a manager, you use metrics from the various teams and product owner to help the team improve its own throughput and also update executives on value being delivered and released.

The new status quo
While the team members are directly impacted by the use of Agile and DevOps, IT leaders will need to be able to adapt to the changing requirements for their own role.

The overall impact of these interventions will be positive, but like most changes, there is an impact on human beings and this is always a critical element that cannot be ignored.

This new status quo is necessary in today’s digital world where we want to be able to achieve continuous releases of new customer-facing technology platforms.

To expect that we can do this without changing the way we work would be fundamentally flawed.

5 reasons why you should care about GitHub

GitHub is an intriguing startup that's worth paying attention to. Here's why.

I first became aware of GitHub as a version control system but quickly realised that it’s also a publishing tool and collaboration platform. Essentially, GitHub hosts Git repositories and it has fast become the ‘go to’ tool for developers working with open source.

There are 30 million repositories on GitHub and 12 million users. It’s quite an intriguing 400-person startup, which is valued at more than $2 billion.

But why should CIOs care about it? Here are 5 good reasons why you should pay attention.

1: The world is moving to open source
GitHub is the largest open source library in the world. Various governments and enterprises are moving towards open source by default. It still sounds a funny statement to say that “the world is moving to open source”, but there is truth in this.

Linux runs on 40.5 per cent of all servers globally versus 47.9 per cent for Windows. On the desktop,

Linux, in all the various forms that it takes, is nipping on the heels of Apple iOS in terms of market share.

Earlier this month, the Australian Digital Transformation office signed an MOU with its UK counterpart that will encourage the building of open-source software and solutions.

2: Your team can learn from others
GitHub is a great resource and it hosts the source code for millions of projects which means anyone can read the actual code used to create those applications and see all the different versions of this code as it evolves.

This is a learning tool that your coders can really learn from others. The evolution of a good piece of code can be traced including all the fast followers who ‘forked’ and copied this starting point.

3. GitHub is free
 Well, it is for individuals and small businesses. Everyone can see whenever you post on GitHub and the code becomes part of the open source for others to use. That is what makes GitHub powerful as it combines the wisdom of crowds – you can easily see where the winners and losers are. However, enterprises that want to keep their code private pay for the privilege.

4: Source code management is critical
Most organisations work with partners and offshore developers and their teams need to be able to
work with different versions of code across various time zones.

When you use GitHub, you create a replicated copy on your own computer. You might rationalise that this is both a good thing and also a potential risk. However, as this is open source, we are talking about the rules are different.

5: You can hire the best coders
Just picture this, you have a library that automatically monitors who is active and who has been contributing. In GitHub, every coder will start to accumulate followers, in theory the more that follow you – the better you are.

Thus, when you have a project, you can search for the best coders as adjudged by their peers. This opportunity has not gone unnoticed and I came across a site that has created a new marketplace for the best GitHub coders, architects etc.

This site is named ‘topal’, and it claims to hire the top 3 per cent of freelance GitHub developers. Its
clients include JP Morgan, AirBnB and Zendesk.

Let me close with one excuse not to use GitHub. Because it’s open source, hackers are fully aware of who is using what code. Vulnerabilities can open the door to an instant exploit of your code base.

Perhaps this is not an excuse but a word of caution. There are many reasons why you should use GitHub but you have to also understand that there are always caveats that should be taken into account.

​Why identity management will improve the customer experience

David Gee imagines a world with a single, secure identity management solution that provides trust and control.

 

​Why identity management will improve the customer experience

Share 471

Attackers are probing and exploiting the ImageTragick flaws

​Why identity management will improve the customer experience

David Gee imagines a world with a single, secure identity management solution that provides trust and control.

 

We’ve all made those phone calls to our utility providers, insurers or other organisations where we are asked to answer questions that confirm our identity.

Now, most people don’t have a problem with confirming who they are once but having to do it over and over again when transferred to another department inside an organisation makes for a pretty ordinary customer experience.

The problem is that without what is known as a ‘know your customer’ process, it is impossible for an organisation to ensure it is talking to the correct person.

This process is not particularly interesting but behind it sits what I believe will be one of the hottest IT trends over the next five years – identity management.

Identity management is a broad term but by definition it “deals with identifying individuals in a system (such as a country, a network or an enterprise), and controlling their access to resources within that system by associating user rights and restrictions with the established identity.”

The problem we all face is that we have to justify who we are and repeat this process for different companies. Compounding this issue is that sensitive information – such as our passport number, date of birth etc – is then shared with a third party.

 

Fundamental to this whole issue is to prove who you are. Let’s remember that we are talking about identity management at a macro level (country) and not about this at a micro (company level).

Once we have this distinction clear, the whole discussion makes more sense.

Players in the identity management sector
There are several start-ups and new players in this arena. Let’s start with a local organisation headed by Pascal Nizri who is an executive at HSBC and has founded an intriguing startup named CHEKK.

CHEKK is essentially your own database that you use to grant access and updates to your identity details. You control this and your various providers are given access as required.

 

Then there is KYC.com (know your customer) is a data sharing utility that enables us to control identity management data. It’s a joint venture between Markit and Genpact and operates out of Hong Kong and Singapore.

US-based, Cambridge Blockchain, is one of the ‘new age’ blockchain companies that has a public/private blockchain to manage identity management tasks.

While I’ve just shared three different companies that all play in this new and highly competitive space, my belief is that we will see the winners emerge in the next five to seven years. But it’s not going to be an easy transition as we don’t ever want to use multiple identity management masters.

Practical issues
We all want convenience and control. But it seems that one of the largest challenges to conducting ‘know your customer’ is the regional variation for cross border compliance. Every country has slight variation of requirements.

Read more ​Why DevOps is about more than improving software productivity

 

The practical issue, may mean that ‘macro’ means country and not ‘universal’. Let’s remember that we all live in a world with multiple currencies and also where we use different railway gauges.

To get a universal standard is always difficult and the convergence takes time.

The promise of Blockchain
The ultimate is the vision of blockchain-based identity, which promises to empower users to be in complete control of their identity.

Just imagine being able to have a single sign-on to move between each and every site that you have to visit. And do this with the assurance that you feel that your personal details are well protected.

 

If you boil this down a blockchain can be used to uniquely authenticate your personal identification and this will mean you retain ultimate control.

I would assume that this will be a battle that is fought and the current giants of the world Facebook,
Google prefer you to stay within their ‘walled gardens’.

At present, you may already use OAuth-based identifications we routinely perform on the Web to login into signing to Facebook, Twitter or Google.

However with Blockchain, once you have registered your details, then it is about linking these third party sites to be authorised.

Baby steps first?
My view is that Blockchain is a very natural choice in this space. However, I would expect that this will be not where the world starts. We will see multiple standards emerge in every country, before a natural winner then arrives.

It will then take time for convergence for a potential universal identity management solution to emerge. All told, I would say this is a 5-7 year journey and won’t be resolved overnight.

Yes it is a nuisance to have 40 different passwords, but this degree of change is not a simple one. There are vested interests at stake across businesses and with existing internet players.

But just imagine having a single identity management solution that is secure and that you trust and control. I’d buy that!

Why you need to be a master of managing conflict

CIOs do need to gain experience in how to manage conflicts that will invariably happen

As a CIO, you’re in the conflict zone. This doesn’t mean you are looking for an argument or trouble – but that you are naturally working with change and transformation.

This means that your boss and peers are under pressure as you are to perform. The truth is that individuals are never 100 per cent aligned around objectives and behind this is that it is unlikely to have absolute clarity. As a leader working when there is ambiguity is a trait that is highly regarded and sought after.

The issue is when there is ambiguity and the interpretation of leaders is different. Invariably, this can lead to conflict.

No longer a back-office role
The CIO is often working in new business focus areas such as digital or business analytics. In these circumstances, there is a great expectation that the CIO will be a strong leader to take the enterprise into a different strategic plane.

It is no longer a back-office position and what is expected is that you can help drive these changes and manage the process of taking this transformation into reality.

Being able to step up and take this accountability will not be easy. What happens is that this will create some natural tension with other leaders. Both you and your own team members will need to understand how to manage this conflict.

As American preacher, Max Lucado once said: “Conflict is inevitable, but combat is optional.”

Why fight?
 This is not about wanting to combative, but the reality is that in most enterprises there is a high priority of regulatory and compliance projects – which get the first bite of the cherry, then the
strategic projects and then core IT projects.

There is always going to be someone who feels that they are missing out in getting attention and their fair share of resources. As the CIO, you have this on your shoulders and while you want to avoid ‘shadow IT’ this is often a by-product of this situation.

So what are you going to do to work through this?

I’m not sure that you need to take this as a serious qualification but you do need to gain experience in how to manage conflicts that will invariably happen. How you step up to the plate yourself is important but what is also apparent is that your own team needs to learn how to manage through this.

My view is that this is a fantastic group development opportunity for the CIO offsite and while it can be provocative, it is necessary and will provide the team with tools to work with.

One of the best that I have come across is the FYI book, published by Korn Ferry, which is practical and comprehensive. The book lists behaviours that are reflective of the unskilled and skilled leader in conflict management.

Take the test
So take the test below - do you and your team members have more ticks in the ‘skilled’ or ‘unskilled’ section? First, just imagine the team or a member trying to manage your way through a cost cutting project without provoking others.

Alternatively, how they would effectively run an ‘after action review’ of a failed project? These are necessary tasks that as leaders we have to perform and doing these without creating more negativity is the best outcome:

Unskilled

• Avoids conflict
• Gets upset, takes it personally
• Gives in and says yes too soon
• Let’s thing fester
• Too competitive and has to always win
• Accommodate others to get along

Skilled

• Reads the situation
• Looks for common ground
• Can hammer out a tough agreement
• Steps up to conflicts

Are you a master or apprentice?
The good news is that you can learn to get better at managing conflicts. Trying to avoid doing that is a recipe for disaster, at least being competent will help you and your team to navigate through the day.

Most important is that you recognise if this is a weakness and take measures to ensure it does not become an issue.