CTO Guide To The Business of Cybersecurity

Bob Gourley June 5, 2019

This is the CTOvision guide to the megatrend of Cybersecurity. This post provides a high level overview of key factors in cybersecurity that we recommend any technology professional should be familiar with, as well as insights that can help assess the near future of cybersecurity solutions. The report also captures insights from recent reporting done on the topic as well as information on cybersecurity vendors we track in the CTOvision solutions directory.

The Megatrend of Cybersecurity

We can make a prediction with absolute certainty: In the future, there will be times when adversaries will surprise even the most well defended organizations. History just makes that totally clear.

Said another way, cybersecurity in the future, like cybersecurity today, is a bit like a rodeo. Sometimes the rider will ride and sometimes the rider will be thrown.

We can also say this about the future of cybersecurity: When organizations are led by leaders that care they can make a huge impact in mitigating risks. Cybersecurity professionals know how to configure existing technology in ways that raise costs for adversaries and can also engineer things to make it easier to spot when an adversary has been successful. Experienced professionals know how to mitigate risks in ways that reduce risks, but what is sometimes missing is support from the most senior executive and/or peers to the security leadership. If the executive team does not really care, the security program will be sub-optimized. That is just a fact.

Cybersecurity In Relation To Other Tech Trends

Cybersecurity is especially important because of the newfound complexity arising in our systems. All the megatrends we review here, and everything we see in doing assessments in the market, point to dramatically enhanced complexity. And all indications are that tricking future systems will become easier not harder. Said another way, every trend we track, including Cloud Computing, Artificial Intelligence, Mobility, Bigdata, Robotics and IoT, all require more focus on cybersecurity. Without enhanced cybersecurity, none of those can be optimized.

A key factor in Cybersecurity

Bottom line: No organization should think they can handle their security needs by themselves. We will all need help.

A snapshot of the Cybersecurity trend right now indicates:

Some of humanity’s greatest thinkers, business leaders and computer scientists have struggled to enhance cyber security. Their approaches are not working.
Cybersecurity will have to advance or none of the other megatrends we review will be optimized.
Cybersecurity is especially important because of the newfound complexity arising in our systems.
Behavioral analytics is seen as a promising approach to enhancing our response
Machine learning and advanced analytics are also seen as promising approaches.

Open Cybersecurity questions decision-makers should track include:

Is humanity sleepwalking into a preventable catastrophe?
Will it be easier to trick future systems?
Will any organization be able to defend itself without help?
What is the role of behavioral analytics?

Cybersecurity and Due Diligence:

Due Diligence in Cybersecurity is one of the most important aspects of M&A.

On the sell side: Firms should take every effort to ensure they are in solid shape from an information security perspective before being offered for sale or seeking growth investment. Review and pre-sale diligence can make a massive difference in how well a firm will be valued.
On the buy side: Buyers should pay particular attention to how well the target understands their digital risks and how well they are governing their risk mitigation efforts. External and independent verification and validation of security policies and practices should include a review of the technical architecture, as well as the degree that the target is complying with appropriate compliance regimes.

Strategically, the acquisition of cybersecurity technology firms is also an art requiring assessment of how unique the capability is and how much in demand it will be in the market. We provide due diligence consulting in the cybersecurity domain via our parent company, OODA LLC.

Other Cybersecurity Reporting at CTOvision:

Latest Entries in the CTOvision Directory of Cybersecurity Firms:

[wp_show_posts id=”108839″]

There are seven key megatrends driving the future of enterprise IT. You can remember them all with the mnemonic acronym CAMBRIC, which stands for Cloud Computing, Artificial Intelligence, Mobility, Big Data, Robotics, Internet of Things, CyberSecurity.

CTO Guide to the Business of Artificial Intelligence

Bob Gourley June 3, 2019

This is the CTOvision guide on the megatrend of Artificial Intelligence. This report gives a high level overview of the most important factors of the trend, gives updated insights into the activities of the major AI companies, and succinct descriptions of AI tech. It also points to key CTOvision reporting to help readers dive deeper into the topic.

We start with a definition of AI:

Artificial Intelligence (AI) is the application of thinking machines to real world problems.

This definition is unique. We like it because it focused on practitioners. Once you take a practitioners view you see AI is really about far more than algorithms. There are a wide range of technical and non-technical factors that must come together to deliver results.

Examples of tech components and non-tech components of real world AI solutions follow:

Tech Components:

Analytic Algorithms (including Machine Learning, Deep Learning)
Natural Language Processing
Robotics
Computer Vision
Data Management
Sensors
Hardware architectures
Technical security measures

Non Tech Components:

New business strategies
Cybersecurity policies
Business risk policies
Ethics
Legal and regulatory regimes
Training and testing
Operation and maintenance
Hiring, promotion, career management

Business Impact of AI:

Here are the key points we recommend any enterprise tech professional consider regarding AI:

With business models returning profit now, all indications are AI will continue to improve.
The evolution of AI has been accelerating due to its coupling with incredibly low cost cloud computing.
Creators use a “generate and test” approach to creating functionality, with no accepted protocol for security or testing in AI. This is a huge negative.
There are four major problems with AI today: 1) Some of the most capable AI is not scrutable (you can’t see how it works), 2) AI can be easy to deceive, trick or hack, 3) AI can be unfair, unethical and unwanted, and 4) AI can be leveraged by competitors and even criminals to your detriment.
There are ways to balance the risks and opportunities around AI.
AI, especially Machine Learning, is playing a huge role in modernizing the cybersecurity industry.
AI is also being used by cyber criminals, with many in the security community predicting AI enabled malware coming soon.
AI can be easier to deceive than current computer software (see Generative Adversary Networks: A very exciting development in Artificial Intelligence).
There are many lessons that can be learned from others on ways to improve your corporate governance over AI including ethics around AI.
More on optimizing AI for business can be found at OODAloop.com

Open AI questions decision-makers should track:

Will job displacement caused by AI be a crisis? Will government put regulations on companies because of this?
Will companies use AI in ways their customers regard as ethical?
Will there ever be a widely-accepted security framework for AI?
Can behavioral analytics enhance security?
How can machine learning improve cybersecurity?

The field is growing dramatically with the proliferation of high powered computers into homes and businesses and especially with the growing power of smartphones and other mobile devices. AI requires lots of data to be effective and with the proliferation of mobile devices there is more data now than ever.

Due Diligence Assessments and Artificial Intelligence

The trend of Artificial Intelligence is an increasingly important element of corporate Due Diligence since it is so disruptive business models.

On the sell side: Firms should ensure their use of AI is done securely and ethically (see our special report at OODAloop.com on “When AI goes Wrong” for insight into issues and mitigation strategies). This applies to any firm that uses any AI enabled capability. However, firms that produce AI (vendors) should pay particular attention to this, it will make a big difference in how well a firm will be valued.
On the buy side: Buyers should pay particular attention to the use of AI in the target to ensure a well thought out architecture that mitigates risks. External and independent verification and validation of AI ethics and security policies and practices are key, as well as the degree that the target is complying with appropriate compliance regimes.

Strategically, the acquisition of technology firms is an art requiring assessment of how unique the capability is and how much in demand it will be in the market. We provide a special focus on due diligence for artificial intelligence companies via our parent company, OODA LLC.

The Technologies of Artificial Intelligence

There are many key technologies used in fielding AI. These are the components of AI technologies we recommend tracking:

Machine Learning: Machine Learning is a subset of AI that focused on giving computers the ability to learn without being explicitly programmed. Machine Learning involves the automated training and fitting models to data. ML is the most widely used AI related technology and is frequently the front end of more complex solutions. This is a broad technique with many methods. Methods commonly taught and applied in ML solutions all have different strengths and weaknesses and part of the art of ML is knowing which applies to the need at hand.

Neural Networks: Considered a more complex form of Machine Learning, this approach uses data flow mappings similar to artificial “neurons” to weigh inputs and related them to outputs. This approach views problems in terms of inputs, outputs and variables that associated inputs with outputs.

Deep Learning: Highly evolved neural networks with many layers of variables and features. Important to most modern image and voice recognitions and for extracting meaning from text. Deep learning models use a technique called “back propagation“ to optimize the models that predict or classify outputs, which adds to complexity of the end model. The end model may have so many 1000’s of variables that no human can really understand how the model functions or how a conclusion was arrived at.

Natural Language processing: This class of technology analyzes and understands human speech and text. Used in modern applications of speech recognition including chatbots and intelligent agents. NLP also requires training data, in this case the output is knowledge about how language relates, often referred to as a “knowledge graph” for a particular domain.

Rule-based expert systems: This is an older approach to AI solutions. It involves establishing sets of logical rules derived from the way people actually work. Used in many processes where sets can be clearly defined. This was the dominant form of AI in the past and is still around today, but is really just complex programming. Imagine a large number of “if-then” statements in a program, but in this case the rules were built by domain experts.

Robots and Robotics: This is the automation of physical tasks. Primarily used in factory and warehouse tasks but growing use in heath care, small businesses and homes. Training data for robots is critically important, but in this case the training data may include location for movement or a wide variety of expected changes in the environment.

Robotic Process Automation: This is the automation of structured digital tasks in the enterprise or factory. This is a highly evolved form of scripting actions. It is a combination of software and workflows built to help automate business processes. RPA is at its best when it provides users with the benefits of other AI capabilities like Machine Learning.

Other Related AI Terms and Concepts:

Supervised Learning: The most common type of training for AI models. Data is labeled by humans so the algorithm can be taught based on what was established by humans. This is very similar to older techniques of statistics like regression analysis. Once a model has been developed using supervised learning, it can be used with new data to provide predictions. This is called “scoring”. Training models on labeled data generally takes large quantities of data that have known outcomes, and in many use cases the outcome that is being sought is actually a rare occurrence (this is called a “class imbalance”).

Unsupervised Learning:This is the development of AI models in ways that detect patterns in data that are not labeled and results are not known.

Training Data:The data used for the development of the model. This is often validated using another subset of data for which the outcome to be predicted is known.

The methods and concepts above are almost always combined in any real world AI solution.

The AI Vendor Community

Most AI capabilities today have their roots in academia, but real implementations are being driven by the corporate world. There are many reasons for this. One is the profit motive. Another is the large collections of data available to the big firms. We provide more focused reporting on the firms driving AI forward in our Disruptive IT Directory in the categories of Tech Titans and Artificial Intelligence Companies. It is especially important to track the AI developments of Google, Microsoft, IBM, Amazon, Apple,

You can see our reference to Truly Useful AI You Can Use Right Today.

For Further Study

Artificial intelligence software is assisting people in most every discipline. The many functions of AI are considered to be threatening jobs across multiple industries, but others consider it a great producer of jobs since it will help create entirely new industries and free more humans to innovate and create. This impact on jobs is best considered in conjunction with the megatrend of Robotics, since together those two trends are going to impact some of the largest sectors of jobs in the U.S. (consider, for example, the impact on retail and shipping).

For alerts on future posts on this topic see CTOvision Newsletters.

Some of the AI companies we are tracking include:

[wp_show_posts id=”108847″]

For more on these topics see:

AI Trends Interview of Bob Gourley and David Bray Focuses on AI Benefits and Risks To Business

Bob Gourley May 30, 2019

AI Trends published an interview of Bob Gourley and David Bray at:

Risk Management of AI and Algorithms for Organizations, Societies and Our Digital Future

The dialog from the interview captured insights into opportunities and risk for businesses. It starts off:

Two technology entrepreneurs and thought leaders, Bob Gourley and Dr. David Bray, recently spoke with AI Trends Editor John Desmond about managing the risk of AI rollouts, addressing security of the organization and realizing the benefits of new AI technologies.

Gourley is an experienced CTO and entrepreneur with extensive past performance in enterprise IT, corporate cybersecurity and data analytics. Creator and publisher of the widely read CTOvision site and co-founder of OODA LLC, a unique team of international experts capable of providing in advanced intelligence and analysis, strategy and planning support, investment and due diligence, risk and threat management. Among past positions, he has served as the CTO for the Defense Intelligence Agency.

Bray also is a C-Suite leader with experience in bioterrorism response, thinking differently on humanitarian efforts and crafting national security strategies, as well as leading a national commission focused on the U.S. Intelligence Community’s research and development and leading large-scale digital transformations. He has advised six different startups and is Executive Director for the People Centered Internet coalition provides support, expertise, and funding for demonstration projects that measurably improve people’s lives.

Both are co-chairing and speaking at the AI World Government Conference & Expo, being produced by Cambridge Innovation Institute. The event will be held on June 24-26, 2019 at the Ronald Reagan Building and International Trade Center in Washington, DC. Discount for the event provided below:

AI World Gov is coming! Mark your calendars now for this 24-26 June 2019 conference and symposium at the Reagan Center in DC.

OODA LLC and CTOvision are very proud to be sponsors and strong supporters of this virtuous forum.

AI World Government provides a comprehensive three-day forum to educate and inform public sector agencies on the strategic and tactical benefits of deploying AI and cognitive technologies. With AI technology at the forefront of our everyday lives, data-driven government services are now possible from federal, state, and local agencies.

Special focus is given to the challenges, solutions, and opportunities that lie in the agency mission, and how agencies can prepare to deploy intelligent automation to address their goals.

For more and to register see: https://www.aiworldgov.com/

You can get a $200.00 discount off the full price by using the code: 1991OODA

DIA Provides Vision of New Data And Analytics Approach Called MARS

Bob Gourley May 24, 2019

Editor’s note: The following was posted on the Defense Intelligence Agency website and is provided for your awareness.

DIA’s Vision of MARS: Decision advantage for the 21st century

JOINT BASE ANACOSTIA-BOLLING, D.C. , May 23, 2019 —

When it comes to providing warfighters with the best intelligence to carry out missions, the decisive use of big data means more than compiling zeros and ones. It means giving warfighters the kind of comprehensive, dynamic picture of an enemy’s operations or environment that was previously unimaginable.

Likewise, the mastery of big data can provide leaders with a better understanding of threats – shedding light on how the United States could counteract adversaries’ plans and weapons systems, for example.

For analysts and planners, it means being able to leverage a virtual model of the real world that’s so thorough it cuts across all domains, significantly increasing the warfighter’s ability to mitigate risks and defeat adversaries.

On the whole, it enables decision advantage.

Enter MARS, the Machine-Assisted Analytic Rapid-Repository System under development by the Defense Intelligence Agency (DIA). MARS aims to make such gains possible by transforming current databases that house foundational military intelligence into a multi-dimensional, flexible and rigorous data environment for the next century.

Advances in cloud computing, coupled with the promise of artificial intelligence and machine learning, form the heart of this initiative. As envisioned, MARS will also enable the simulation of courses of action, allowing operators to quickly and fully grasp the likely effects of proposed activities or movements.

DIA views MARS as the polar opposite of a static acquisition program: it will be designed to solve problems with agile development and early engagement with users to buy down risk as national security challenges and priorities evolve. So its capabilities will continuously improve as it matures. The agency is also working on a separate experimental research effort – which includes technology demonstrations – that will inform MARS’ requirements.

The need for transformation is both clear and urgent.

DIA’s mission is to provide intelligence on foreign militaries and the operational environment to prevent and, if necessary, win wars. Databases that contain this information – the sum total of what the nation knows about adversaries’ capabilities, tactics and military doctrine – are now insufficient.

With data proliferating at the speed of light, DIA must build a system capable of ingesting and managing large volumes of it, and making it available to both humans and machines.

The re-emergence of competition among the world’s great powers is also a reality. Recognizing this, the agency has made the development of MARS its top priority. DIA relentlessly pursues better and faster ways to deliver intelligence to planners, international partners and analysts.

A more granular understanding of complex global events and a corresponding decision advantage are keys to the nation’s continued success. MARS will make it much easier for everyone from U.S. warfighters to national security policymakers to have both.

CTOvision Named A Top 20 AI and ML Blog

Bob Gourley May 8, 2019

CTOvision has been named to another list of top blogs, this time by gengo.ai. We are grateful for the recognition, it makes us want to try harder to get you the information you need to leverage the dynamic changes under way in the tech world for your enterprise. Gengo lists CTOvision as the top blog in the category of General Science, Tech and AI Blogs, placing us ahead of sites we have looked up to for years.

Thanks Gengo!

And thanks to you dear readers! Please help us keep doing better by keeping your feedback coming. And please refer us to your friends, we love new readers!

Bob

For more on CTOvision Awards and Recognition:

I Thought I Had Seen Some Crazy Things In The Intelligence Community, But Nothing Like Nuking The Moon

Bob Gourley May 6, 2019

I love a good history book. And love reading insider info on the mysteries of the U.S. Intelligence Community. Which means I have been looking forward to Vince Houghton’s “Nuking The Moon” for quite a while.

Vince is a special kind of historian, a person who not only looks for facts and meaning, but is skilled in expressing history in understandable ways. This is why his podcast, SPYCAST, is one of the most enjoyable examinations of history and current intelligence community issues available on the net. I could not imagine a better person to serve in his current capacity as historian and curator of the International Spy Museum in DC.

Now back to the book. What a page-turner. The book explores abandoned plans from the U.S. Intelligence Community, some of which are bizarre, and a few, like the concept of dropping a nuke on the moon, are terrifying! The book reminds me of the concept we used to call S&T. I don’t mean S&T in its traditional use of Science and Technology. I mean S&T to stand for Sick and Twisted. Ha! I have seen many successful activities in the IC, and the greatest came from amazing thinkers who had that knack for thinking so far out of the box to be on the edge of crazy. Those Sick and Twisted thinkers generate lots of ideas, many of which never turn into full scale proposals. Some of which turn into plans that never get approved (the subject of Vince’s book), but a narrow slice of these S&T projects become real operations. The successful ones, we hope, will never be written about.

Reading the book will expose you to a way of thinking that comes from a necessity to win in a great struggle. Imagine you were in that fight. Wouldn’t you want the best S&T on your side?

The book has many stories that will make you feel. You will feel empathy for animals harmed in the furtherance of security objectives, you may feel like proposals were being created that would waste your tax dollars, and may in some cases read about ideas that in your mind would actually put us at risk of causing much grater harm to national security than the planners were thinking they would. There is plenty of emotion in this book.

But there is humor too. I found myself laughing plenty of times, maybe because in hindsight we can think of much better ways to accomplish objectives than those proposed here.

Overall I loved the book, and most strongly recommend it to the workforce of today’s Intelligence Community as well as those who enjoy tales of espionage. The book is really well done.

For more see: “Nuking The Moon and other intelligence schemes and military plots left on the drawing board”

Additional Reading:

If You Drive A Car, Or Know Someone Who Does, You Must Read This…

Pulitzer Prize-Winning Fred Kaplan Explores The Secret History of Cyber War

What You Need To Know About The Administration’s Cybersecurity National Action Plan

Like Kip in Napoleon Dynamite, We love Technology

Breakthrough In Energy We Should All Track: New green technology generates electricity ‘out of thin air’

Future Crimes: Everything Is Connected, Everyone Is Vulnerable and What We Can Do About It

The Security Yearbook by Richard Stiennon

The Perfect Weapon: War, Sabotage, and Fear in the Cyber Age

Your Reference To OODA Special Reports

Bob Gourley April 29, 2019

OODA Loop provides actionable intelligence, analysis, and insight on global security, technology, and business issues. Our free newsletter keeps our readers up to date on a daily basis, and our special reports and advisories provide insights for those that need deeper insights into key markets and topics of executive interest.

OODALoop offers additional insights and community resources to our members. For more on becoming a member visit the OODA Network Signup Page.

Special reports members have access to include:

Special Series on Artificial Intelligence

AI, machine learning, and data science will be used to create some of the most compelling technological advancements of the next decade. The OODA team will continue to expand our reporting on AI issues. Please check out the AI reports listed below.

Country Studies and Threat Briefs

These reports provide a solid baseline that can inform your decision-making and put our daily reports into better context. Please contact us for questions or comments on any of these reports.

Russia should be considered a kleptocracy, where the rule of law exists as long as it supports the objectives of the state and the ruling oligarchs. All U.S. businesses should exercise extreme caution before doing business in or with Russia. Our special report on The Russian Threat captures insights on the full spectrum of Russian capabilities and intention, including their actions in cyber conflict. For more read the continuously updated Russia Threat Brief.

Also, be sure to check out our special report: Russia 2020: What Will Putin Do Next?

Several countries have the capability to inflict harm on U.S. interests. However, China is the only one who has declared an intent to challenge the U.S. for global supremacy. China remains a closed society where challenges to party rule are met with harsh, sole crushing response. China is a powerhouse, but one with weaknesses. The same statement carries over to military and intelligence domains. For more read the continuously updated China Threat Brief .

Iran has been investing heavily in cyber operations and is experienced in conducting both espionage and attack. Iran is undemocratic, with power centered in a Supreme Leader (Ali Khamenei). A President exists but has little power compared to the Supreme Leader. But below them is a vibrant and powerful country of over 81 million. Iranian education systems and scientific pursuits make them a technologically empowered nation that can mount surprisingly sophisticated cyber operations. Updated report coming soon.

North Korea describes itself as a “self-reliant socialist state” but it is really best described as a Stalinist dictatorship. Leader Kim Jong-un holds power and dominates all functions through a mix of violence, rewards and intense propaganda. A common misperception about the DPRK is that they are so backwards and poor that they cannot mount a modern cyber war. But reality is that their policy of “Songun” (military first) means there are resources for capabilities considered strategic, and that includes cyber war. North Korea Threat Brief

Special Reports

Traveling executives are frequent targets for cyber espionage. This report provides detailed guidance for global executives and their security teams on how to protect their information and technology systems while on the go. Produced by OODA co-founders Matt Devost and Bob Gourley, the report is based on best practices, an awareness of threats, and a deep understanding of the state of technology. A tiered threat model is provided enabling executives to better tailor actions to the threat. For more see: OODA Releases a Traveling Executive’s Guide to Cybersecurity

In a Joint Intelligence Bulletin issued by the U.S. Department of Homeland Security and Federal Bureau of Investigation the threat of terrorist attacks against faith-based communities and soft targets amid religious holidays is discussed. OODA captures more detail and as always provides input that can help drive your actions. Read more at: DHS/FBI Warn of Attacks Against Faith-Based Communities and Soft Targets Amid Religious Holidays

OODA Best Practices for Agile Cybersecurity: Members of the OODA expert network continuously track best practices for policy, procedures, technology and governance related to cyber defense. We work directly defending enterprises in cyber defense and maintain an always up to date list of actions in a form designed to help any organization stay as agile as possible in the face of dynamic adversaries. Read more at the OODA Special Report on Best Practices for Agile Cybersecurity.

Are you making the most of your data holdings? If you want to leverage your data to the better of your business you need to treat it like a weapon and use it to gain advantage over others. This is not just about your technical architecture, this is about your attitude and the approach you take to being proactive. For our best practices on how to do so see the OODA Guide to Using Your Data As A Weapon.

The last decade has seen an incredible increase in the commercial use of space. Businesses and individual consumers now leverage space solutions that are so integrated into our systems that they seem invisible. Some of these services include: Communications, including very high-speed low latency communications to distant and mobile users. Learn more at: OODA Research Report: What Business Needs To Know About Security In Space

Special Reporting on The Cyber Threat

OODA’s Cyber Threat Analysis Report provides the “so what” behind the news and events we track on a daily basis. When it comes to putting cyber news in context, there really is no substitute for experience. The context in this report is provided by one of the most highly regarded cybersecurity practitioners and pioneer of cyber threat intelligence (and OODA Network expert) Mike Tanji. Review all in this series at: OODA’s Cyber Threat Analysis Report

Uniting Women in Cyber Symposium 2019

Bob Gourley April 25, 2019

Please check out this event and help spread the word. This promises to be a great event that can make positive contributions to a wide range of stakeholders in industry, academia, government and for citizens.

The event is the Uniting Women in Cyber Symposium 2019.

For more and to register see: https://unitingwomenincyber.com

From their website:

OUR MISSION

Uniting Women in Cyber (UWIC) is a program designed to celebrate the success of women leaders thriving in today’s cybersecurity ecosystem and to identify and address issues that may be preventing more women from reaching critical leadership.

OUR PASSION

We are passionate about bringing together partners from corporate, government, academia, investment and nonprofits to:

Create and nurture collaboration for women in leadership roles
Build connectivity and mentoring for women in cybersecurity, innovation and emerging technology topics such as Internet of Things
Promote advancement and visibility of women in leadership positions
Spotlight issues that hinder greater participation in and advancement of women in the tech sector in general, and cybersecurity in particular

For more see: https://unitingwomenincyber.com

Bob Gourley