Author Archives: Jeremy Swenson

Demystifying 9 Common Types of Cyber Risk

1)       Crimeware
This is designed to fraudulently obtain financial gain from either the affected user or third parties by emptying bank accounts, or trading confidential data, etc. Crimeware most often starts with advanced social engineering which results in disclosed info that leads to the crimeware being installed via programs that run on botnets which are zombie computers in distant places used to hide the fraudsters I.P (internet protocol) trail. Usually the victim does not know they have crimeware on their computer until they start to see weird bank charges or the like, or an I.T. professional points it out to them. Often times it masquerades as fake but real looking antivirus software demanding your credit card info in an effort to then commit fraud with that info.

2)       Cyber-Espionage
The term generally refers to the deployment of viruses that clandestinely observe or destroy data in the computer systems of government agencies and large enterprises – unauthorized spying by computer, tablet, or phone. Antivirus maker Symantec described one noteworthy example where the U.S. Gov’t made a worm to disable Iran’s nuclear reactors arguably in the name of international security (Fig. 1).

“Stuxnet is a computer worm that targets industrial control systems that are used to monitor and control large scale industrial facilities like power plants, dams, waste processing systems and similar operations. It allows the attackers to take control of these systems without the operators knowing. This is the first attack we’ve seen that allows hackers to manipulate real-world equipment, which makes it very dangerous. It’s like nothing we’ve seen before – both in what it does, and how it came to exist. It is the first computer virus to be able to wreak havoc in the physical world. It is sophisticated, well-funded, and there are not many groups that could pull this kind of threat off. It is also the first cyberattack we’ve seen specifically targeting industrial control systems” (Accessed 03/20/16, Norton Stuxnet Review).

Richard Clarke is the former National Coordinator for Security, Infrastructure Protection and Counter-terrorism for the United States and he commentated on Stuxnet and cyber war generally in this Economist Interview from 2013.

Fig.1.

3)       Denial of Service (DoS) Attacks
A DoS attack attempts to deny legitimate users access to a particular resource by exploiting bugs in a specific operating system or vulnerabilities in the TCP/IP implementation (internet protocols) via a botnet of zombie computers in remote areas (Fig. 2). This allows one host (usually a server or router) to send a flood of network traffic to another host (Fig. 3.). By flooding the network connection, the target machine is unable to process legitimate requests for data. Thus the targeted computers may crash or disconnect from the internet from resource exhaustion – consuming all bandwidth or disk space, etc (Fig. 3.). In some cases they are not very harmful, because once you restart the crashed computer everything is on track again; in other cases they can be disasters, especially when you run a corporate network or ISP (internet service provider).
Fig. 2.                                                                Fig. 3.Botnet and TCP image
4)      Insider and Privilege Misuse
Server administrators, network engineers, outsourced cloud workers, developers, I.T. security workers, and database administrators  are given privileges to access many or all aspects of a company’s IT infrastructure. Companies need these privileged users because they understand source code, technical architecture, file systems and other assets that allow them to upgrade and maintain the systems; yet this presents a potential security risk.

With the ability to easily get around controls that restrict other non-privileged users they sometimes abuse what should be temporary access privileges to perform tasks. This can put customer data, corporate trade secrets, and unreleased product info at risk. Savvy companies implement multi-layered approvals, advanced usage monitoring,  2 or 3 step authentication, and a strict need to know policy with an intelligible oversight process.

5)       Miscellaneous Errors
This is basically an employee or customer doing something stupid and unintentional that results in a partial or full security breach of an information asset. This does not include lost devices as that is grouped with theft – this is a smaller category. The 2014 Verizon Enterprise Data Breach Investigation Report gives an example of this category as follows:

“Misdelivery (sending paper documents or emails to the wrong recipient) is the most frequently seen error resulting in data disclosure. One of the more common examples is a mass mailing where the documents and envelopes are out of sync (off-by-one) and sensitive documents are sent to the wrong recipient” (Accessed 02/21/16, Page 29).

6)       Payment Card Skimmers
This is a method where thieves steal your credit card information at the card terminals, often at bars, restaurants, gas stations, sometimes at bank ATMs, and especially where there is low light, no cameras, or anything to discourage the criminal from tampering with the card terminal.

Corrupt employees can have a skimmer stashed out of sight or crooks can install hidden skimmers on a gas pump. Skimmers are small devices that can scan and save credit card data from the magnetic stripe (Fig. 4.). After the card slides through the skimmer, the data is saved, and the crooks usually then sell the information through the internet or if they really want to be secure the Darknet which is a secure non-mainstream internet that requires a special browser or plug-in to access. After this counterfeit cards are made, then bogus charges show up, and the bank eats the costs which unfortunately drives up the cost of banking for everyone else. Also, some skimmers have mini cameras which record the pin numbers typed at ATM machines for a more aggressive type of fraud (Fig. 5.).  Here are two images of skimmer technologies:

Fig 4.                                                                       Fig 5.
Card Skimmer and Camera

7)       Physical Theft and Loss
This includes armed robbery, theft by accident, and/or any type of device or data lost.  Although some of the stolen or lost items may never end up breached or used for fraud sometime they are depending on what device and/or what data is on that device and/or if it was encrypted or not, or if it the data could be deleted remotely, etc.

8)       Point of Sale Intrusions
See my 2014 post on the Target Data Breach here for a good example.

9)       Web App Attacks
These incidents were carried out primarily via manipulation of vulnerabilities in input validation and authentication affecting common content management systems like Joomla, Magento, SiteCore, WordPress, and Drupal.

According to the 2015 Verizon Data Breach Investigation Report these types of attacks are not only a reliable method for hackers, but also fast with 60% of the compromises taking a few minutes or less(Accessed 02/21/16). With web applications commonly serving as an organization’s public face to the Internet, the ease of exploiting web-based vulnerabilities is alarming (Accessed 02/21/16, 2015 Verizon Data Breach Investigation Report). According to The Open Web Application Security Project these are two common types Web App weaknesses (Accessed 02/21/16, 2013, OWASP 10 Most Critical Web Application Security Risks):

“i) Injection flaws, such as SQL, OS, and LDAP injection occur when untrusted data is sent to an interpreter as part of a command or query. The attacker’s hostile data can trick the interpreter into executing unintended commands or accessing data without proper authorization.

ii) XSS flaws occur whenever an application takes untrusted data and sends it to a web browser without proper validation or escaping (Fig. 6.). XSS allows attackers to execute scripts in the victim’s browser which can hijack user sessions, deface web sites, or redirect the user to malicious sites access unauthorized pages”.

Fig. 6.
RXSS
Jeremy Swenson, MBA is a seasoned, Intel certified, retail technology marketing and training representatives on assignment at Best Buy for clients including Intel, Trend Micro, Adobe, and others. He also doubles as a Sr. business analyst and project management consultant. Tweet to him @jer_Swenson.

What the Windows Phone Must Overcome to Gain Traction:

There is no doubt that Microsoft is a tech super power in this game of smart phone wars, but Google’s Android and Apple’s iOS have challenged them to date.  As per Fig. 1. Microsoft’s phone OS (operating system) market share has stayed about steady at about 2.9%.  Blackberry on the other hand has so little market share they are hardly worth mentioning since their mobile phone OS market share has dropped to .09% at the end of 2015 (Fig 1.).  Although different phone OS market research reports have slight up or down variations, the point is that Microsoft and Blackberry are hugely losing the Smart Phone Wars.

Fig. 1.
Smart Phone Stats dec 2015Last time Cassem and I commentated on this situation was August of last year when Microsoft was high on the release of Windows 10, arguably their best operating system in a decade but not without risk.  In our last piece we valued many aspects of Microsoft’s products including the Cloud, SharePoint, and Windows 10 for business users, but we only began to address the full story.  Yet our prior conclusion that Microsoft as a company is undervalued is unchanged because they have so many successful products including Server, Exchange, Visual Studio, System Center, Dynamics, and SharePoint, in spite of their phones weaknesses.

In this post we will specifically explore why Microsoft is losing the smart phone war and what can be done about it so they can win.  First of all, Microsoft was late to the game in October 2010 with the release of the Windows Phone 7.  Google was early with the T-Mobile G released in October 2008. (Fig. 2.).  Apple was the first with the iPhone 1 released in June 2007.  Microsoft’s late entrance in conjunction with their delay to take phone apps seriously has proven to push app makers to the dominate platforms, Android and iOS.

Mobile applications are increasingly addictive for phone users and since the Windows platform has so few that means most mobile gamers, media streamers, and multitaskers will avoid the Windows Phone in the immediate future.  Most corporate mobile phone contracts favor the iPhone and those contracts will take years to be undone to the detriment of Microsoft.

Fig. 2.
First Android Smart PhoneWith 53.3% (Fig. 1.) of the phone OS market share there are a few things that Android got right.  The integration of Google Calendar is easy, useful, and free.  Conversely, on a Windows phone, the integration of Microsoft Outlook is awkward, overly optimized for a traditional PC, and it’s not free for the full version.  As an owner of many Android phones I can see how the many OS updates have proved to make the platform much better with more efficiency and less bugs, especially on the Lollipop release of Android.

Apple comes in second with 42.9% of the mobile OS market share (Fig. 1) because they have gotten a lot of things right.  Apple’s OS works well together and is recognized as artful by the majority of the creative community — their early integration of iTunes and the iPod into the iPhone made it a big hit.  Also, you can use the iPhone with Apple TV, an iMac, iCloud, the Apple Watch, and Airport Time Capsule, to name a few.  ITunes has been a force to deal with but has started to lose market share in recent years as streaming services and other digital music services have come on board, specifically Pandora and Google Play.  Android users will say iPhones are overly simplistic, but to those users, that is a benefit.  There are a lot more settings options in Android, but Apple fans feel they don’t need all those features.  This is one ongoing battle between iOS and Android.

Security varies greatly in each of the platforms.  Apple has a very secure and closed off OS and network and they rarely share info with other tech companies.  Apple’s app network is also massive and thus they have experience with a lot of different architectural frameworks and they are good at approving and declining apps based on security.  Unlike Apple, Android has had some issues with fake apps designed to compromise security that were available for download in the app store.  Additionally, in recent weeks Apple has taken a respected but partially controversial stance to protect its user’s privacy in the wake of what many argue is an overreaching government. (In Debate Over Apple-FBI Dispute, Gates And Zuckerberg Don’t Agree).  This is a public debate that needs to continue and unfortunately as of now, Microsoft has given a more a-political and lukewarm response to this debate – though Microsoft founder Bill Gates disagrees with full privacy coverage arguments.

Windows 10 appears to be a pretty solid platform that builds off of some security benefits of Microsoft’s enterprise systems.  Windows 10’s Credential Guard protects corporate identities by isolating them in a hardware-based virtual environment.  Device Guard depends on Windows 10’s virtualization-based security to allow only trusted applications to run on devices — letting the service use signatures defined by your enterprise-controlled policy (Tech Net Device Guard Overview).  In our mind, Microsoft needed to do this to help leverage its legacy network of enterprises that could upgrade to the new Windows 10 OS in the most secure way including Server, Exchange, Visual Studio, System Center, Dynamics, and SharePoint.

Moving on, iPad and Android based tablet customers have been frustrated with the slow speed and low power and functionality of these devices for a long time.  In response to this Microsoft has been an innovator and leader with the design and release of the Microsoft Surface.  The Surface redefines what a tablet can be.  It brings full computer power, something that had not been done on a tablet in the past.  As the Surface improved up to its latest iteration, the Pro 4, it proved to validate the clever Windows 10 OS.  As of January 28th 2016 Surface sales are up 29% from last year (2015) (Microsoft Q2 2016 Earnings Report) which suggests that with the right improvements they could also get considerable gains in the phone market.

Why would someone change to a Windows Phone?  First off, there are a lot of users out there that are familiar with Windows in general.  “For example, Skype has been downloaded more than 900 million times on iOS and Android devices, Microsoft CEO Satya Nadella said during a recent earnings call” (Microsoft Q2 2016 Earnings Report).  The only problem in most people’s minds is that they use their phone differently than they use their PC.  Microsoft has to convince these people that there are similarities, cross-usage benefits, and that the user experience is better or good.  From a user experience standpoint, Windows Hello is a great feature that provides for facial recognition log in and Cortana is the virtual assistant that is controlled by voice recognition (Fig. 3.).  Positively, Office Mobile comes with all Windows 10 phones and that includes a great iteration of PowerPoint with a fun and easy to use interface (see video below).  Moreover, all Windows 10 phones can connect to Blue Tooth keyboards, mice, and dual monitors.  Granted, the mobile version doesn’t have a desktop built in like the PC version does but it has something better for the mobile environment, Continuum.  Continuum turns your phone into a big-screen projector and a big-time productivity tool when you have the Microsoft Display Dock as described in the video below.

Fig. 3.

The new Windows 10 is a much more connected OS than previous OSs.  It seems that part of Microsoft’s strategy is connecting the new OS with their cloud business over time.  The Windows 10 Phone gives a lot of connected apps that show new emails, current weather, and news just by glancing at the home screen.  In the iPhone, the icons will rarely show updates.  The only iPhone app that comes with the phone that shows updates is the calendar app.  This is an idea that is built into Windows 10 giving people the convenience of not actually having to open the app to get the information they are quickly looking for.  If they want more information, they can open the app and go from there.  Lastly, the criticism of Nokia as a phone company is exaggerated.  It is a good thing for a hardware and software company like Microsoft to own a phone maker and although not all Lumia models have been hits they have a positive trajectory.  This trajectory is due to enhancements including a great camera, crystal clear screen, a removable battery, Windows Hello, Office Mobile, and most of all its ability to transform into a desktop computer via Continuum.

Jeremy Swenson and Mike Cassem are two seasoned, Intel certified, retail technology marketing and training representatives on assignment at Best Buy for clients including Intel, Trend Micro, Adobe, and others.  Swenson doubles as a Sr. business analyst and project management consultant while Cassem doubles as a Marketer and Sales Consultant.  Tweet to them @jer_Swenson and @micassem.
Jeremy Swenson About Photo for BlogMike Cassem

Windows 10 Review: Mobile $ Centric, Cloud Informed, Touch Winner!

Ever since Google’s Android and Apple’s iOS have dominated the mobile operating system (OS) market, Microsoft has been running scared and has realized they cannot rest on their non-mobile products and established business application strongholds. The present and future OS market is heavily about mobile cloud-connected devices and that is why Android holds 78% of the mobile OS market (Fig. 1, 2015). Google’s release of the Chromebook in June 2011 was a quiet nuclear bomb against Windows, thus threatening their personal computer OS leadership.

Microsoft’s counterattack was supposed to be Windows 8.1 in 2012 to 2013 which was designed to run effectively on mobile and traditional devices but as per Fig. 1. their phone market share fell from 3.2% in 2013 to 2.5% in 2014 and then rose only to 2.7% in 2015. These results are horrible for a global software company that dominates the non-mobile OS and business application markets with more than 1.5 billion daily users according to Corporate Vice President of Education Marketing at Microsoft, Tony Prophet (2014). Windows 8.1 did not go over well because the Microsoft Store has few apps, people did not like the new tile start menu, it is clumsy to navigate, Internet Explorer is slow, and next to no one was inspired to get a Windows Phone because of Windows 8.1.

Fig. 1. Smart Phone OS Market Share
Mobile Phone MarketShare 2015
(IDC, May 2015, http://www.idc.com/prodserv/smartphone-os-market-share.jsp)

Windows 10 is supposed to be Microsoft’s comeback album and it’s going to be just as big as Carlos Santana’s 1999 Supernatural album with the hit song “Smooth”. Windows 10 was released on July 29th and so far the reviews are great all bugs aside. To share the love they are giving away free upgrades from Windows 8.1, 8.1 Phone, and 7 for one year. Microsoft never could quite sell the idea to everyone that you didn’t need a start menu. The Windows 8.1 start menu became the start screen, much the same way your tablet or cell phone works with tiles laid out like a board game. Thus Microsoft is bringing back the start menu on the bottom left yet they are leaving a partial live tile display for mobile enthusiasts that can be collapsed or expanded as per Fig. 2.

Fig. 2.
windows_10_start_screen_desktop_full_screen_0Windows 10 also introduces a function that allows you to utilize multiple desktops not just screen extensions, and this is a lot like Mission Control from Apple OS X. This will be a big benefit for business users, creative users, students, and people who do a lot of multitasking. The hot key shortcut to open a virtual desktop is: Windows key + Ctrl +D. Windows 10 also adds something new for gamers and graphics focused users, direct X12, which is a Microsoft proprietary graphics card decoder that communicates with and optimizes the many different graphics chips on thousands of computer models. It is the industry standard and that is why it’s used on the hugely popular X-Box. Windows 7 and 8.1 will not get access to direct X12 so graphics will be better on Windows 10. A creative person could even game in one desktop while they work in another assuming they have the RAM and CPU power needed for those specific applications – this is pretty cool. Another interesting visual add is the Windows Snap feature which allows you to split your screen into two, three or four separate areas and the hotkey shortcuts for this are:

  • Windows Key + Left – Snap current window to the left side of the screen.
  • Windows Key + Right – Snap current window to the right side of the screen.
  • Windows Key + Up – Snap current window to the top of the screen.
  • Windows Key + Down – Snap current window to the bottom of the screen.

For years customers have been unimpressed with the slow speed and incompatibility of ad-ons with Internet Explorer. Microsoft made a good move to create an all new browser similar to Google Chrome and it’s included for free with Windows 10. Code named Project Spartan and unveiled as Edge the new browser is up to 112% faster than Chrome according to Business Insider (07/15/15, http://www.businessinsider.com/microsoft-edge-windows-10-faster-than-google-chrome-2015-7). Edge allows you to circle, highlight and write your thoughts directly on web-pages. It also has a very cool reading view that strips out all the ads, sidebars, pop-ups and links, so you can scroll through a single column of text and pictures. However this does not work on all web-sites because some websites have not made the updates for 10. We really like this feature as we have been annoyed by these distractions when reading on-line and we like a lot of people do a lot of on-line reading.

Yet probably the second biggest addition to 10 will be Cortana. This is Microsoft’s digital assistant and promises to be much bigger than other voice assisted programs out there. Cortana is much like Dragon or Siri but much more advanced and integrated into the operating system. It will tell you your schedule and schedule things for you and is also an advanced web encyclopedia. It will learn more about you based off of Microsoft’s cloud databases which you can opt to share information with, including your e-mails, phone numbers, and web search data.

Fig. 3.
CortanaAfter upgrading to Window’s 10, we weren’t sure if we would use Cortana, but the more we use it the more we like it. In playing around with Cortana, you can provide feedback with screenshots that go right back to the teams at Microsoft. To prepare for the 10 release Microsoft was using an estimated five million external testers known as “insiders” to get this type of bug feedback.  This impressive number is a considerable increase from prior releases. Cortana is easy to locate in the bottom left of the screen next to the start menu. We find that if the user types a question in the search bar it will add tips and give you interesting facts each and every day, if you let it. Cortana starts out giving you information on the weather, finance, and sports but you can customize this under notebook settings (Fig. 3). Cortana is very intuitive and can track things for you. If you’re receiving a package, it will tell you the progress or details of that package. Say you’re picking someone up at the airport, Cortana will tell you if the flight is on time.

We really see Microsoft using Cortana to compete with Google Search and Google Analytics. Much the same way Google uses search on Android, Microsoft can use Cortana to provide different results for what you are looking for on phones, tablets, or computers. This really gives Microsoft a link to future ad and analytics revenue which could seriously challenge Google’s revenue streams.

In summary, Windows 10 is a much better product than prior operating systems and is a real threat to Apple and Google’s OS growth. It is designed for mobile and non-mobile devices and has the ability to exponentially learn about you from your use habits and Microsoft’s big data in the cloud. It is also a threat to Apple because they do not have a touch based OS on their computers but only on their iPads and iPhones. A lot of companies up to this point are still using Windows 7 but we see some of them moving to Windows 10 thus bypassing Windows 8.1. Imagine an HVAC worker, health care worker, or tax assessor having the power of Windows 10 to query their corporate database with Cortana while working in the field customized from their GPS trail.

With Cortana, the cool mobile aesthetics, the useful features of touch, the speed of the Edge browser, the ability to use multiple virtual desktops, the quad split screen, this is a growing hit among consumers. Based off these new upgrades it is much easier to use and much closer to what people are familiar with from previous versions of Windows yet it is still creatively different. We think app makers who have focused much of their energy in the past on the Android and iOS platforms will be forced to make more apps for Windows 10 and this will force more phone makers to sign on with Windows 10. We predict Windows 10 in conjunction with Microsoft’s own proprietary devices like the Surface will help them gain a lot more of the mobile OS market in the next 18 months thus driving Microsoft’s stock price above $55-$60 per share.

Jeremy Swenson and Mike Cassem are two seasoned, Intel certified, retail technology marketing and training representatives on assignment at Best Buy for clients including Intel, Trend Micro, Adobe, and others. Tweet to them @jer_Swenson and @micassem.

Jeremy Swenson About Photo for BlogMike Cassem

Social Tech CEO Jimmy Chamberlin Rejoins Smashing Pumpkins

Jimmy Chamberlin is a founding member of the multiplatinum, generation-defining, hyper-symphonic guitar melding alternative rock band the Smashing Pumpkins. Chamberlin joined the Pumpkins after band leader Billy Corgan could no longer perform with a drum machine in 1988. Chamberlin as a drummer is better than 100 drum machines and honed his chops on jazz and show tunes before turning to rock. Although Chamberlin is known for his complex harmonic drumming with chimes, tom toms, and trigger pads on songs like Tonight Tonight, Disarm, Today, Muzzle, Porcelina Of The Vast Oceans, and his own fusion band The Jimmy Chamberlin Project; he is also a social streaming tech CEO to the surprise of some but not me.

GettyImages-75268493-630x420

Musicians and entrepreneurs have a big thing in common that makes them able to take risk and own creative success, passionate creativity and vision. From the very beginning the Smashing Pumpkins ran their own business like a start-up, hosting their own shows, hustling their own demos, coordinating P.R., and even using video promotion for the legacy of the band’s first death (Graceful Swans of Never Documentary, 2001). They reshaped the copy and marketing needed behind a costly double album via artful music videos and lyrics deriving record-setting results making 1995s Mellon Collie and The Infinite Sadness one of the best-selling double albums of all time.

Yet rock and roll stardom was not enough for the quick-witted and well-read Chamberlin who left the Pumpkins again in 2009. Recalling the bands early success with e-mail and their web-site, and a growing interest in streaming concerts starting as early as 2003, Chamberlin began to research how social media could be integrated with a live stream type service with useful marketing features and insights for advertisers. Like any good business person he had the network to explore how to move the company forward, including former GroupOn CEO Andrew Mason of Chicago and many affluent music business executives including, Producer Butch Vig of the rock band Garbage and Irving Azoff the former CEO of Ticketmaster Entertainment and the former Executive Chairman of Live Nation Entertainment.

Chamberlin’s company LiveOne® is a digital media company focused exclusively on audience engagement solutions for creators of live content and their brand partners. LiveOne’s main product, CrowdSurfing®, is an award-winning, real-time social engagement platform that surrounds viewers with an interactive global audience by interfacing with social apps like FaceBook, Twitter, and LinkedIn, thus delivering rich, immersive entertainment experiences. LiveOne’s test customers thus far include Coca-Cola, Yahoo, ROC Nation, CBS Sports, and Sony Music. And yes they are hiring if you’re looking to move to Chicago.
Live One1This entrepreneurial effort is only likely to gain momentum and it shows that Chamberlin’s creativity is beyond music. In terms of the Smashing Pumpkins it shows that Billy Corgan is likely to tap Chamberlin’s business sense to help remake and remarket the Smashing Pumpkins since the band has been mostly a revolving door over the last 6 years. It will be much harder for Corgan to lose Chamberlin this time around as he has the ability to cross market the band’s shows via his company, even if it’s still in development mode. Corgan and Chamberlin truly could be at the beginning of a new music business nirvana but let’s hope egos and miscommunication do not get in the way of a reunion that has a history and talent that is worth much more than a small summer tour.

Cheers to Billy and Jimmy.

Small Planes Become Casual Hobby Sport Devices

icon-a5-trailer
Many of us think planes are only for the ultra-rich, politically connected, and status seeking consumers, and in the past that was mostly true. Yet in 2004 the FAA made a surprising regulatory change that created the Light Sport Aircraft License. This positive change lowered the cost, experience, and educational requirements to own and fly a small plane.

Yet it does require the following:   
1. Seats: Two (max.).
2. Max. Gross Takeoff Weight: 1,320 lbs. (1,430 lbs. for seaplanes).
 3. Max. Stall Speed: 51 mph / 45 knots CAS.
 4. Propeller: Fixed-pitch or ground adjustable (thus no jet).
 5. Max. Speed in Level Flight (at sea level at standard temperature):138 mph / 120 knots CAS.
 6. Engines / Motors: One (max. if powered.).
 7. Cabin: Unpressurized.
 8. Fixed-pitch, semi-rigid, teetering, two-blade rotor system, if a gyroplane.
 9. Landing Gear: Fixed (except for seaplanes and gliders).

It took well after 2004 for plane makers to engineer and test the types of planes that this regulatory change aimed to address. One such new entrant, plane maker ICON Aircraft, who has gotten a lot of investment capital in recent years, has an inspirational story and I believe will change aviation for average people because of their spin-resistant design (safety feature), and their clever angle of attack (AOA) feature which normally is only on higher end jets and military aircraft! ICON’s CEO Kirk Hawkins is a veteran U.S. fighter pilot and he shows what creative people can do with an MBA when they take school projects to the next level as per the below video.


The ICON A5 is a two seat closed compartment plane that has wings that fold in, lands on water or land, and it can easily be towed with an average car. It currently costs $189,000 but prices will likely come down in the near future as people like me anticipate their increased availably. Part of the reason why this price is a bit higher is the fact that these planes are not mass produced and because there are not enough other plane makers joining this market to thus increase output and lower prices. According to ICON (formed in 2007), “with over 1,000 delivery positions already assigned, the A5 has demonstrated unprecedented and broad market appeal. The A5 has also won numerous prestigious design awards and received prominent media coverage in well-known outlets including Wired, The Wall Street Journal, Robb Report, CNN, CBS, Fox, and the Discovery Channel.”
A5 nice shot
As this decade moves forward, globalization, the need for travel, crowding of the roadways, GPS navigation enhancements, and other technological advancements will make causal hobby plane ownership an undeniable reality. Taking your plane to work will be the new norm, and lots of plane service stations will pop up somewhat like gas stations but likely more regulated and hopefully with longer lasting or renewable energy. If Apple computer was the innovator behind the personal computer revolution than ICON Aircraft will be the leaders behind the personal aircraft revolution!

Microsoft HoloLens, Mobile vs. Good Web-Design, and Security Needs Innovation Not Gov’t.

Microsoft HoloLens1) We knew there would come another well-positioned company who makes a pair of smart glasses like Google Glass and that it will derive more competition and innovation. Microsoft raised their hand right away with their HoloLens glasses which are hologram based, slightly “gamified”, and seemingly better than Google Glass largely because they tied it in with known Windows functionality (broader offerings). See a video of this cool new technology here:

2) It is a fact that on average people now access more of their e-mail via mobile devices more often than on a traditional computer. This has forced websites, news makers, and companies to design their web offerings in a mobile compatible design so when you go to the web on a computer the sites are often overly mobile in their design aspects and sometimes look goofy and the buttons and frames are too big. CNN.com is a good example of a web-site that went too far with their mobile design so if you access it from a normal computer it looks more like a kids play web-site with big buttons and frames optimized for touch with little info presented. Yet their prior design was better especially if you want to read more on one screen view.

(Old vs. New CNN.com, respectively)
Old and New CNN WebsiteThere is no doubt that mobile will continue to grow and will be used on smaller devices like watches, ear buds, pacemakers, and contact lenses. Web design has shifted so fast to mobile that sometimes good web design and user experience is forgotten about for non-mobile users or business users who on average spend much more time on those same sites than mobile users. Thus a better balance of the two design types is needed, and an app is a separate project all together yet still needed. I also think Microsoft will take more mobile market share away from Android and Apple since they have learned a lot from their Windows 8 release and are quickly working to release Windows 10 as a better touch based mobility optimized O.S. that many are excited to try.

3) There will be more data breaches but many of them will be supported by the Western Governments who in effect devalue security standards by corroborating with large companies to quarry vast amounts of metadata all in the name of security. Sadly we know Governments have abused this power in the past and will continue to do so thus the private sector needs to collaborate and inspire innovation in this space for better security and transparency so the masses may have security and corrupt Governments can be exposed.

Equation group victims map

As it stands now hackers are a few steps ahead of antivirus makers and they are constantly tweaking their viruses so they can’t be detected. The newest types of viruses are suspected to be created by the Equation Group, one of the most sophisticated hacking groups ever known. These new viruses hide in your hard drives firmware and are undetectable. Antivirus maker Kaspersky commented on this in their Q&A doc on the Equation Group by stating, “We were able to recover two HDD firmware reprogramming modules from the EQUATIONDRUG and GRAYFISH platforms. The EQUATIONDRUG HDD firmware reprogramming module has version 3.0.1 while the GRAYFISH reprogramming module has version 4.2.0. These were compiled in 2010 and 2013, respectively, if we are to trust the PE timestamps” (http://25zbkz3k00wn2tp5092n6di7b5k.wpengine.netdna-cdn.com/files/2015/02/Equation_group_questions_and_answers.pdf).

Kaspersky went on to further speculate that there were clues that the U.S. N.S.A. was involved in the latest hard drive firmware virus and even suggested they had the cooperation of major hard drive makers like Western Digital, Seagate, Samsung, and Toshiba in order to get the code needed to write the virus. Any reasonable technologist would likely agree with this. Yet this decreases innovation and free competition and you know big money likely traded hands to make these deals happen. How can a big company now trust paying a technology company for security or services when they are just going to give it away to supposed governments here or elsewhere? More importantly, if one government has the ability to get into a tech companies data, then other more ill-intentioned governments and organizations can quickly learn how to do that as well and that is the real threat.

If you want to hire me to speak at your next event or consult for your company on these and related topics please contact me.

Four PMBOK Inspired Tips For Success On Complicated Projects

imagesCMHQ1JHK1) Stakeholder Management: Attain clear support from the executive stakeholders from the beginning of the project and schedule regular check-in meetings with them ahead of time as they tend to be very busy and are often pulled in many directions.  Set the tone that their participation is needed and that they will need to approve change requests which is not uncommon.  You should also use clever people skills and empathetic listening skills as you interview the many high-level stakeholders in the early part of the project so as to diffuse conflict and get consensus on disagreements about scope, business goals, order, and to find out who will be the thorn in your back as the sooner you know that the better.  Also, accept that stakeholders will be different and they may not even directly work for your company which is ok as those ones tend to offer specialized expertise and are often very creative.

2) Communications Management: It’s common to have one or two stakeholders who are difficult, protesting the project through their actions, or who are otherwise egotistical, and/or just plain difficult to deal with.  As a project manager, project consultant, or business analyst, it is your responsibility to deal with these people and situations.  One way to do this is to understand the communication styles of all project stakeholders early on in the project and document this.  Strength Finders, DISC, and many other communication style tests can help with this or you could consult a person who has a lot of international travel experience – they are often helpful understanding group communication dynamics.  You should also know when to be direct, indirect, and/or silent in your communications.  Communication is mostly about listening and perception and as project manager you are not the direct boss of the project team members so your ability to drive tasks is heavily based on your communication and motivational skills – so ask all team members what you can do to clear their roads either yourself or in partnership with other stakeholders.  This reduces surprise road blocks down the road and encourages silent people to speak up.

Project Mgmt3) Quality Management: Having worked on many complex projects in highly regulated industries over the last 5 years I have noticed a shift towards agile methodologies vs. waterfall.  From my perspective this is really about quality and timely flexibility.  Aligning the project tasks in small pieces allows you to test the results independently and faster, and if the results are bad that’s a good thing because it’s just one piece of the project and you can learn from it – getting an early warning.  Yet to get better quality out of an error you need to have documented what went into the error from beginning to end and you need intelligent consensus.  On SDLC projects there will be many small errors which then raise questions about other systems and how they relate to the business rules.  Yet with good process flows, screen shots, and JAD sessions with key people, you can ensure that these errors are nothing more than normal bumps in the road.  Every project has its bumps but the real test is having above average quality on budget and on time at the projects end thus creating a reusable plan others can learn and be inspired from.

imagesRIPQVZGS4) Risk Management: In this new era where almost everything is in the cloud and hackers are targeting large and mid-sized companies to steal and sell their data, every risk analysis document/plan should take into consideration data security, customer privacy, access controls from the project team, and there should be an independent audit plan – often out of scope of the project and done by a different group for checks and balances.  No project has no data so data is always a part of a project, sometimes more and sometimes less.  Question number one is who should have access to the data and at what point?  In today’s environment you should embrace a need to know policy and you should document that to reduce risks.  You should also imagine a worst case scenario and be prepared for it and run this by the executive project sponsors, and/or risk officer if your company has one.

Another common risk is project delay.  Have you analyzed how a one or two month delay would affect your critical path and logical task order?  For some projects it may not matter and for others it may cost your project millions more.  It may harm another dept. or a related project thus in your project risk document you should list the longest delay your project could handle and the dependencies of that delay.  Delays on projects, especially SDLC projects, do happen and are not necessarily bad and they can be dealt with but your project team needs to be ready for it and the sooner they know the better.

If you want to hire me to speak at your next event or consult for your company on these and related topics concerning project risk, process improvement, project management, and related areas please contact me.

Thought$ On The Future of Digital Curren¢y For A Better World

In the old days the gold standard was the way global economies secured their financial backing yet over time that got to be too costly to secure and too heavy to move. In all reality inflation and population growth far exceeded the amount of gold available for it to be widely used so nations moved away from the gold standard and adopted their own currencies and financial regulatory systems – for better or worse. Yet with growing curiosity around digital currency in conjunction with the decline of traditional cash usage I offer my commentary at an increasingly relevant time.

Figs. 1. and 2.
blog post small

Governments are wrong to assume all or most forms of digital currency are associated with illicit activity. We all know there have been bad actors out there in the digital currency space, and we know that some platforms like Silk Road have been attractive to them. Yet we must not forget that most bad actors use normal currency more often, and more importantly, the form of the currency is not as important as what the actor does with it.

Since we are at the beginning of the digital currency revolution it scares big governments who use traditional currencies to govern and collect taxes, and in some countries like Venezuela, Rwanda, Iraq, and Libya, they commit war crimes, financial fraud, and they steal from their citizens under the auspice of a legitimate financial system. In these countries, could a new more secure digital currency inspire a government revolution showing more transparency in currency movement and tax records sustaining democracy, human rights, and economic growth? The point here is that governments have abused their power to collect taxes and regulate financial services since the beginning of time. Didn’t the United States fight the Revolutionary War to stop excessive and unjust taxation from the British, and prior to the formation of the United States (July 4, 1776) the Thirteen Colonies had their own contradictory currencies, used the Spanish dollar, and counterfeiting was widespread by government and non-government people alike. Indeed governments should discourage immoral activity via legislation but not innovation in payment methodologies because lots of good can come from these new technologies. We as a world must think harder, longer, and we must inspire debate among global leaders for a better currency form in the future as paper cash is too darn simple and will soon grow more insecure due to better printer technologies observing the endless capabilities of the 3d printer.

Figs. 3. and 4.
Bit Coin Apple Pay
Conservative Wells Fargo led the industry in a surprise joint effort with Apple for the iPhone Apple Pay application in Oct. of 2014, setting a new standard with a mobile digital currency that has great security. Wells Fargo’s move to Apple Pay is a step closer to a digital currency and it is gaining traction and according to Forbes.com 10 major banks have now signed up for it (http://www.forbes.com/sites/roberthof/2014/12/16/apple-pay-gets-more-bank-support-but-it-still-needs-a-lot-more-stores-to-succeed/). Yet like most new technologies it takes time for others to upgrade to it, and in this case that means retailers need new software and terminal equipment that will accept the mobile payment platform. Although this takes time and money, every new technology does, and over time I believe it will save retailers money and time. Imagine a busy retailer two years from now who has no ability to take mobile payments during a busy holiday rush, they will have to staff more people, suffer more human error via cash transactions and manually entered credit card transactions, risk employee theft of unmasked credit card numbers, and customers will leave feed up with how long it takes to be serviced. Conversely, imagine a busy retailer two years from now who has the ability to take mobile payments, they will staff less people, customers can check themselves out and the risk of human error is reduced while security has the potential to be better. Moreover, in a hyper competitive retail market this can bring prices down and service levels up to the benefit of the customer, the community, and the technology sector. This is where innovation is born and some Subway franchise owners have taken the lead as of Nov. 2013 (http://www.cnbc.com/id/101211284). Economic policy makers must not hide from this better future and should take note from the private sector.

Fig. 5. Subway entrepreneur using Bitcoin:

It is likely less costly to make and secure digital currency than it is to make and secure cash and coins. Every time the U.S. Mint releases a new version of its bigger bills it takes years to develop, billions to make, billions to secure, they have to burn and shred billions of old bills, and a credible 2013 Market Watch Report backs this up by saying, “the new hundred dollar bill costs 60% more to make than the prior version” (http://www.marketwatch.com/story/new-100-bill-costs-60-more-to-produce-2013-10-08). With this type of growth rate how can these costs be sustainable especially as the population grows and paper resources become sparser?

Fig. 6.
New 100 Bill

Conversely, we know that technology costs go down or stay even when balanced for inflation over time. We also know that RAM memory, CPU speed, CPU size, fiber optic cable connectivity, and data encryption have made exponential leaps in the last five years thus making the environment for digital currency ripe. After all, many governments including the U.S. claim to have cloud, server, metadata, and predictive analytic technologies that manage to monitor and track all the internet transactions in most of the world, and the private sector would agree with this. If technology is this good why then can’t we have digital currency?

The answer is that change takes time and government bureaucrats have insulated themselves with yes lobbyists who support the current status quo. Supporting the current status quo is big business after all there are secured vehicle companies, printing companies, risk management companies, and many other companies that make money off the current financial regulatory system; lots of jobs and money are at risk if the current model would change. A good example of this is what happened to the film based camera company Kodak when it failed to respond to digital, but with digital currency its worse because we are dealing with big government and elected leaders who are at best imperfect though at times well intentioned. Yes there are some true leaders out there like Congressman Steve Stockman (R-TX 36th District) who took Bitcoin donations on his campaign and introduced the Virtual Currency Tax Reform Act (http://www.forbes.com/sites/perianneboring/2014/04/08/breaking-rep-stockman-to-introduce-first-bitcoin-bill/) to get the dialogue on Capitol Hill started but the bill has not yet passed and more work and research needs to be done. We as business/tech people need to be a loud part of this research and discussion and then more elected leaders will support it.

Lastly, digital currency moves the world closer to a one world currency where foreign exchange risk is significantly reduced or eliminated. Thus tariffs and geopolitical economic sanctions will be easier to see, prevent, and private sector companies that do a lot of international trade can benefit from that. Are there too many currencies throughout the world and would one global currency be better? Well it would be better in that there would be fewer economic highs and fewer economic lows but it would be worse in that highly valued companies and individuals would be greatly devalued in the developed world and some in the U.S. would argue that violates the free market principles of the constitution and discourages private sector competition. Moreover, a one world currency would be impracticable to support and would violate state sovereignty across the world yet that didn’t stop China from advocating for it in 2009 and subsequent years according to this credible source (http://usa.chinadaily.com.cn/world/2014-01/29/content_17264069.htm).

In sum, I don’t think a one world currency is the answer as I do think it would violate free market principles. Yet I do think a leading digital currency is needed when it can have transparent transfer rates, a secure audit trail, and can enable some cross-border economic development to balance out the third world so they don’t have to go to loan sharks for their crop loans. Cheers to our digital future!

If you want to hire me to speak at your next event or consult for your company on these and related topics concerning financial services risk, process improvement, project management, and related areas please contact me.

Lessons Learned From The Target Data Breach: Part 1

In the holiday shopping rush of December 2013 Target (TGT), the 1,778 store middle market retailer, had one of the biggest data breaches in American business history.  The breach apparently affected more than 70-100 million customers over 40 million cards (varying estimates exist) across all U.S. stores but excluded Target.com and stores in Canada.
target date leakThe general consensus is that a HVAC contractor for Target, Fazio Mechanical Services, who had access to Target’s networks got their own networks hacked via an e-mail phishing attack, normally an elementary attack method; yet that attack installed malware that then got onto Target’s network and installed more malware that copied personal data from Target’s payment processing terminals when it was in the “working memory area” or “cache” of the software/system – that is before it gets encrypted to be sent to the bank to be authorized.  This is part of the reason why it was not detected so fast and yes these hackers were smart.

Yet Target also did a bad job separating their networks and servers while they were trying to save money by having less networks and broader access for those who needed them.  Yet I don’t see why an HVAC contractor would need to be so close to the networks that work the registers.  This is simply poor design.  I am sure the HVAC company could have done their job without access to the Target network.  Let’s not hope they just wanted to upload HVAC reports and browse the network.

According to a recent Business Week article, “Target had a team of security specialists in Bangalore to monitor its computers around the clock.  If Bangalore noticed anything suspicious, Target’s security operations center in Minneapolis would be notified.  On Saturday, Nov. 30, the hackers had set their traps and had just one thing to do before starting the attack: plan the data’s escape route.  As they uploaded exfiltration malware to move the stolen credit card numbers—first to staging points spread around the U.S. to cover their tracks, then into their computers in Russia—FireEye spotted them. Bangalore got an alert and flagged the security team in Minneapolis.” (http://www.businessweek.com/articles/2014-03-13/target-missed-alarms-in-epic-hack-of-credit-card-data)
target date leak2Yet Target did not take this alert seriously but why?  Fear of change, ego, poor leadership, and too much bureaucracy got in the way of the costly software’s effectiveness.  At the time of the breach FireEye was a new software tool for Target’s technology group and what I know about new technology is that people delay embracing and learning new systems of out of fear that those systems will be buggy or not as good as the old ones.  I understand this very well having worked part time in the P.C. dept. at Best Buy for more than 3.7 years representing Intel and related software makers Microsoft, Symantec, Trend Micro, and Adobe.  When Windows 8 came out all kinds of people were doubting it not because it was bad but because it was more work to get to know, and if they saw something really different about it, they were inclined to think it was a bug when in fact it was a useful design feature they didn’t yet understand.  The same bias can be applied to Apple computers.  People falsely think that they are immune from viruses because Apple designs them that way.  What a joke.  Apple computers are only as secure as their understanding of the latest virus.  Yes it is true the Apple operating system is not targeted as much for viruses but it is also not used as much and it is hardly used by large companies and governments.

Moving on, the CIO really needs to get behind any major software change like this, and if Target’s former CIO Beth Jacob was really behind FireEye she probably would have done something about the alerts they were giving her.  You would think as CIO she would want to immediately act and reduce any risk.  What was she doing at the time, giving some speech about how she was such a great leader in the industry while some high buck corporate partner pays for her three-course lunch?  Clearly, her eye was not on the ball or even on Target (no pun intended), and she had a big enough ego to think she was smart enough and had put the right people on her team to take care of this.  Yet what an epic fail.  It is also likely that there were people some layers below Jacob that tried to inform others to the alert but I am sure their voice of concern and reason got squashed by Jacob’s massive ego, after all you can’t doubt a CIO – right?  I highly doubt everyone in Target’s IT security team was going to ignore these alerts but it is too many layers of bureaucracy that got in the way of Target’s safety.  Target is better off with a more open style of bureaucracy where concerns can be heard at all levels and tools and processes are shared for innovative solutioning – Google’s culture is a good example of this.

Target has also grossly underestimated the costs associated with the data breach to keep their stock price up but of course they would never say it like that, however I am not alone in thinking Target’s $147 million figure is too low.  According to one analyst, “costs would rise even more over time. “I don’t see how they’re getting out of this for under a billion, over time,” he said, adding, “$150 million in a quarter seems almost like a bargain.” (http://www.nytimes.com/2014/08/06/business/target-puts-data-breach-costs-at-148-million.html?_r=0)

Those who have the stolen data are likely outside of the U.S. and when and if they use the data to commit fraud the ability of a U.S. corporation or court to go after them is diminished, timely, and costly.  Moreover, since the U.S is the midst of negative geo-politics with parts of Europe, particularly Russia where some sources have traced the hack, those who have the data are likely to be bold in how they use it and that’s where the cost to Target will add up.  The other areas where the costs will grow is in Target’s own internal policy and procedure changes as well as the growth of their IT security staff and tools, but most importantly their investment in training must grow.  At present Target has over more than 90 lawsuits against them regarding the breach and that number is likely to grow so the costs here are going to be huge overall.

Lastly, I am not all negative on the Twin Cities’ favorite corporate hometown hero as I shop at Target often, have the REDCard, have been to their diversity events, and I have also seen a lot of concerts and sporting events at both Target Field and the Target Center.  However, the mere fact that Target has the money and lobbying power to get their name in the community does not mean they are a true leader in the community.  As the data security community increases consumer awareness retailers like Target will continue to be challenged to innovate and that’s better for all people.

By Jeremy Swenson

Prince and Purple Rain 30 years later: Business and Music Innovation

June 25 2014 marks the 30th anniversary of Purple Rain and many artists, business people, universities, politicians, and even technologists have a renewed curiosity about the album or they are exploring it for the first time. As a true fan of the kind of creativity Purple Rain represents, and as a patron of many Paisley Park jams and parties over the last fourteen years I offer my commentary on Purple Rain at 30.

Purple Rain is without a doubt one of the top four albums of the 80s and it is arguably the most unique and controversial due to its sex appeal and dirty lyrics, intricate guitar solos, use of the drum machine, dreamy synth lines, wide vocal range, long songs, and gospel energy. When the movie and album are lumped together as one piece of art, the piece transcends generations and has the ability to awaken emotions in us that inspire our best creative thoughts.

1017488367_62c523be73PURPLE Rain 1984

Purple Rain is a passionate story of a conflicted artist who is more than confident yet insecure about his love life but he has the musical ability that most university music departments combined could not get close to. Prince’s equivalent in the corporate world would be that creative trial lawyer who never ever loses a case and has garnered the largest settlements possible.  Yet his ego and intimidating personality push some people away from him — that distance from regular people allows him to connect with regular people via his art whether in the courtroom or on the concert stage.

L. Londell Mcmillan.

LLM-w-PlaquesAlthough Prince is no lawyer, he has hired some great ones over the years, L. Londell Mcmillan – the famous entertainment lawyer and owner of the Source R&B Magazine, and Clive Davis – the Harvard Law educated record mogul, chart-topping producer, and long time record company CEO at Sony, Arista, and J records. Prince’s legal and business maneuvers have helped him win a legal case against his estranged half-sister, got him out of an unfavorable contract with Warner Bros in 1996 to redefine his brand under a new name thus renewing interest in his art, allowed him an open record deal at Arista Records in 1999, and in 2004 his business team came up with the idea to sell his album with each concert ticket sold for his large worldwide Musicology arena tour thus bringing his album sales numbers to the top of the Sound Scan charts in an unprecedented move. Yet Prince like the King / Elvis has lost a few battles, mostly due to his poor management style and huge ego. In one case a European court ordered him to pay $2.95 million dollars to a European concert promoted he stiffed — for good or bad reasons – Prince is indeed battle-tested. Yet presently he has renegotiated a new contract with Warner Bros to re-master and remarket Purple Rain and many of his best albums of years ago and for the most part, he gets the rights to the masters which is unheard of for most artists. Purple Rain helped broaden free speech in music for today, brought about “explicit lyrics” stickers, and encouraged multiculturalism in a band that has mass appeal.

Whether or not all of Purple Rain the movie is factual, Prince’s former manager Alan Leeds would suggest it is at least true about his personality. Prince is the ultimate storyteller with his music even when it has no words. Trial lawyers will use all kinds of words and images to tell stories that lead to winning outcomes, yet Prince has an infinite palette of sounds, tones, and rhythms, and he commands them all at once like a sophisticated CRM software package.

In the movie Prince’s band, The Revolution is on a spaceship ride with Prince as he takes them to musical highs they otherwise would not reach, yet he does have a special relationship with Wendy and Lisa, and the sensitivity they add to the song Purple Rain can be positively felt as helping Prince release his pent-up innovation and raw emotions regarding misspent love, family anger, and frustration with his status as a young boy. Additionally, all the songs are performed as if the band is at a gospel church, and the theme of faith and diversity seems to be inferred in the panoramic cuts to the audience, the band, and even backstage. It is thus no surprise that Prince is now a very serious believer.

Many fans know that the recording of Purple Rain the music was far from perfect. In fact, it was done in 1983 before the movie was released, and it was recorded by a mobile studio sound truck that was connected into First Ave, and not everything went well with the recording in terms of mixing and rigging up the sound. Although the movie and soundtrack ended up being a smash hit not all involved with the project thought it would be and there were concerns that they would not have enough budget to get it done so they were rushed. On the album, tape splices can be heard at times, and When Doves Cry has no bass (Prince’s intention), and the mix is imbalanced by today’s standards but for the most part it is a live album, and even with these imperfections the musical performances are amazing, innovative, and emotionally real, and the songs make the album timeless. The performances truly were a perfect storm and that’s why no other takes even with better recording would have made the album any better. It is a masterpiece and I and many others look forward to the re-mastered version ideally with extra songs on it.

By Jeremy Swenson