admin

April 16, 2020 by admin

Levels of Network Security for IoT Devices at Home

Infographic for Home IoT Network Security

We are regularly warned of significant security risks [1] by the use of IoT technology in our homes. But who of us can resist (OK. OK. I know at least one of them in my household) the lure of some of these useful/cool and more and more affordable devices?

The risks of security gaps associated with these devices are well discussed in the media [2] and I have lumped them into two categories:

Rouge Device: the device, if hacked, can be used to conduct external attacks from your home network against other systems (ex: DDoS) or internally against your personal devices on your network (ex: ransomware, loss of PII).
Data Exposure: the data that the devices collect and generate can be accessed by bad actors and used against you (ex: home security cameras).

This article addresses the first risk. The challenge for most households is that we have been sensitized to the need to secure our personal devices (laptops, tablets, phones) but we do not have the same guidelines or helpful advice for the IoT devices we bring into our home. Also, these devices are not standardized in their security features/options/configurations. This is because the devices cover a wide spectrum of device configuration management from fairly basic, like an electric bulb, to complex systems like environmental controls with multiple sensors.

We often acquire these devices in an ad hoc manner through real needs (ex: baby cams) or as interesting accessories or toys (ex: programable mood lighting). For example, I just recently installed a video camera with a cloud app outside my home to try to determine how a squirrel is getting into my house – I class this as a real need, but it is fun to finally identify the perpetrator!

So, this is the scenario I am addressing in this article because I think it applies to a large majority of the folks using these consumer-based devices. We have a lot of devices on our home network that we need to worry about. I have spent time trying to come up with some guidelines for non-technical folks on how to reduce the risks of your collection of IoT devices.

I am starting at a basic level and hope to add more guidelines as the market for consumer WiFi routers and like-devices develop to address the need to segregate these devices from your personal systems. Market leaders in this space are working on projects for frameworks to standardize security [3] but it will take some time to get adoption by the majority of IoT device manufacturers.

This first article introduces an infographic that attempts to illustrate how we can improve our risk exposure through the use of guest networks. I have categorized network configurations by types so they are easier to describe and discuss.

The message is pretty simple – get the IoT devices onto the guest network [4] [5]. The considerations for this guideline are, however, are not simple and result in a primitive infographic with a lot of small font content to explain the benefits and limitations of this recommendation. (My excuse for the primitive infographic is that my objective is to provide a one-pager to be used stand-alone.)

You can download the infographic below.

Pdf of Types-of-network-security-for-home-IoT-v1 Download

I imagine a lot of readers may consider this first guideline to be simplistic – but, I hope in a positive sense, in that it is easily understood in order to consider its recommendation as a first step to reduce the risks of these ubiquitous devices.

References used for this article:

January 27, 2020 by admin

Product Management Scope – version 2

This is an updated version of the mind map of the scope of responsibilities for product mangers that I build for an earlier post. I had some feedback on the original version and the scope of the product management role has evolved in the last few years. Accordingly, I have made updates to this map to address:

continuous review of the product business plan through roadmaps/release mapping and the adjustment of the business success criteria over a 3 year horizon. This approach complements the agile software development methodologies and their affect upon product evolution.
the accelerated migration of product delivery using cloud services which requires addressing DevOps methodologies for production deployment, performance monitoring, and application usage logging. The deployment of products as SaaS requires the PM team to regularly review the costs to deploy and maintain the services/applications over the full deployment lifecycle.
user experience requirements for mobile users, as well as the support for multiple languages. The rapid convergence of laptop/desktop/tablets/smartphones hardware and software frameworks puts a focus on well designed and adaptable UIs. In addition, the development tools for the above reduces the technical roadblocks of providing multiple language support for a larger customer base.
social networking platforms. Platforms like Facebook and LinedIn offer bi-directional communications between many of the product stakeholders. I would recommend that the responsibility for the care and feeding of these communication channels lies with Product Marketing roles, who typically spend much time leveraging the potential for these platforms. However, Product Managers must pay close attention to the content generated there.

If you have suggestions for improvements, by all means drop me a note at (tom@stoneturnerllc.com) or comment. In the meantime, if you would like a pdf copy, you can download it from here.

May 11, 2016 by admin

Product Management Scope – mind map

I was working on a description of the product manager (PM) tasks I could provide as a consulting PM and decided to use a mind map to help me build out the various responsibilities of a PM. Once I built a first draft, I thought it might be helpful for others to use to describe their own PM processes.

My thoughts about the next version are:

Show the various interactions with other stakeholders like sales, busdev, product marketing, engineering, support, devops, etc.
Create short descriptions of each bubble (but maybe leaving them less descriptive allows wider interpretation)
Show some interconnections and control loops between the bubbles to indicate the process flows.

If you have some suggestions for improvements (and I am sure there potentially a lot since this is a fuzzy topic), by all means drop me a note (tom@stoneturnerllc.com) or comment and I will generate another version if needed. In the meantime, I can provide this version in FreeMind format (https://goo.gl/lgMskm ), so you can customize it as you would like (no copyright implied by me).

April 27, 2016 by admin

How to reduce the chance of being hit by ransomware using Gmail, Drive, Docs

Image courtesy of FireEye

The danger of ransomware is escalating and affecting many individuals and industries. [1] The main vector to distribute this type of malware is through email. Often the phishing email contains, as an attachment, a Word document that requests that the recipient “enable editing and content “ (effectively enabling macros) in order for the recipient to be able to read it. [2] If this done, the malware starts its process to encrypt files and provides messages to explain how they can be recovered.

In almost all recent cases, the file types involved in ransomware have been Word docs, Adobe pdf and graphics files.

In many cases, the files attached to the email are opened by individuals who are concerned or curious about the contents – they don’t do this unthinkingly. The criminals involved in this type of threat are becoming very good at the social engineering of their emails to convince even experienced business executives to open the files and enable the malware to execute. Even with media warnings about this type of malware individuals are still opening files purporting to be invoices or e-tickets because they are concerned that this is something that is important to them in some way.

As it turns out, once the recipient sees the actual content/text/image of the fake files they realize (in most cases too late) that the document is not relevant to them – it is spam or a hoax or involves something unknown to them. So if the individual can see the document or image in question in a “safe” and non-vulnerable and read-only application, they will be able to determine its relevance and if it requires them to subsequently open it in Word or Excel or PowerPoint, etc.

If we can look at the text of the document in a safe environment, we will be able through our normal critical review of content to mitigate the ransomware risk.

Most folks have been exposed to warnings and articles about how to protect yourself from this type of malware: keep current and protected back-ups, keep anti-virus apps updated, don’t open suspicious documents. The reality is that most people want to open the file to see if it is important to them. The objective of this prelude is to offer a simple and safe process to open attachments and files that are suspicious and/or unexpected without endangering your system. Here it is.

Google provides both their Drive and Docs/Sheets/Slides applications free to us. These applications are web based and the files are opened in the Google Drive space and not on your device. Files on the Drive can be opened with Preview, Docs, and other pdf applications. So if you are a Gmail user, rather than downloading a file immediately onto you device, it is easy to either open the file with Docs (if it is a Word/Excel/PowerPoint file) or upload it to Drive and open it there with Preview. In this way you can look at the file without risk of it infecting your device. If the file insists that it is to be opened in, say, Word, I would think this is a big red flag of danger. Don’t do it. If a partner or customer sends such a file, send them a link to this article! If the file content looks legit, you can download it to your device.

Gmail attachment options

Once the file is on Drive, if you want to share just the text or image of it with others safely, you can download it as a pdf, rtf, or text file. In these forms, the file text or image can be shared without the potential embedded exploit.

Drive download options

The other benefit of this approach is that Google provides free file scanning before the file is downloaded. So if this file has been seen before and tagged as malicious, it will not be downloaded.

Virus scanning: Google Drive scans a file for viruses before the file is downloaded or shared. If a virus is detected, users can’t share the file with others, send the infected file via email, or convert it to a Google Doc, Sheet, or Slide, and they’ll receive a warning if they attempt these operations. The owner can download the virus-infected file, but only after acknowledging the risk of doing so. https://support.google.com/a/answer/172541?hl=en

For folks that are on enterprise systems and use Exchange for email, this approach is a bit more intrusive – but still effective. You need to setup a free Google Drive account and upload any suspicious files to the Drive and then open them there before opening them on your device in Word/Excel/Adobe Reader/etc. Don’t open the original file on your system until you are satisfied the contents are appropriate to you and your job. For example, if the invoice looks strange and you want to get another opinion, download it from Drive as a pdf file or print it and advise your IT team that you have a suspicious file

Once you get familiar with Drive and the up and down loading, this is a simple and quick process – well worth trying.

So here is my suggestion to help reduce your exposure to ransomware:

Only open any unknown/unexpected file using Google Docs or Preview

Tom McHale www.stoneturnerllc.com 26 April 2016

[1] http://www.securitymagazine.com/articles/86787-ransomware-attacks-to-grow-in-2016

[2] https://www.carbonblack.com/2016/03/25/threat-alert-powerware-new-ransomware-written-in-powershell-targets-organizations-via-microsoft-word/

April 14, 2014 by admin

Product design cannot be driven by policy or legal oversight

I saw this article on LinkedIn this week concerning the Time magazine article (Code Red) about the saving of healthcare.gov and one of the major items for me was the quote:

“Looking at the highlights of what we have [accomplished], it is notable that delivery of services, whether they be information or transactional, has come before final strategy work is completed. Or put more simply, in an analogue world, policy dictates to delivery, but in a digital world, delivery informs policy. This is what agile means for Government and its services, and if delivered in this way, the ramifications are profound.”

This suggested an Agile methodology approach to governing by all levels of government can be a game-changer to the delivery of public services. The agile approach assumes to be incremental and responsive to continual user feedback. This means an adjustment of the actual product features as we adapt to the needs of the target user role. Use cases need to be adjusted, user interfaces adapted, and support and documentation aligned. As the article points out, this is at odds with the traditional, and often current, waterfall approach to service design. The “build it and they will come” approach overlooks a lot of variables that cannot be easily tested in a QA environment, such as the “too many are coming” scalability problem faced by healthcare.gov.

I very much sympathize with the original team that built healthcare.gov where there did not seem to be a single entity that decided what would be delivered in phase 1. With many stakeholders all dictating their requirements concurrently, you inevitably will have conflicting requirements. And without a final pragmatic design authority, the design team will attempt to satisfy everyone – and hence often no one.

This team must of felt like I have at times when we had our corporate attorneys involved in the product user interface. Naturally when you are an attorney your primary job is to be concerned about the protection and liability of the corporation and, secondly, the end user experience. Everyone pretty well knows that few people read the fine print when trying to do something on the web – so including legalese on the business part of a web design is thankless. I knew, just like the healthcare policy makers, that our attorneys just wanted to make sure that the service was in line with the government’s/corporation’s legal policy. We addressed this directly by giving them a full page where they outlined all the legal issues and then provided links to it at various points in the UI design. In this way, the legal information was fully covered but did not distract from the actual service.

I am a fan of a transparent and activist government that provides responsive services. This is the only approach that can address the increasing requirements we expect of our governments. Manual processes get stuck in often intentional generalized policies while a public web service has to be very specific in its uses. The agile process of delivering public services enforces specifically defined use cases extracted from the policy makers – and if done well, will have the support of the general public to keep incrementally adding to those use cases.

March 12, 2014 by admin

Guy Kawasaki & the Art of Innovation & PMs

Recently Guy Kawasaki wrote a blog entailed The Art of innovation.

In it he lists 11 principles of innovation he has learned over his career. I looked at these principles and tried to determine if product managers could use them in their pursuit for innovation in their sphere of influence. Often executive teams of businesses can only exercise these principles and the product teams are hamstrung by very limited budgets and time frames. I have listed the titles of the principles below and added a few words of italicized text from the blog (you need to read his blog for the full description) and then rated if a product manger had influence in that area.

1. Make meaning. Determine how you can change the world — Notwithstanding you own personal life objectives, as a product manager (PM) this is obviously the mission of your business and how they address this. Low influence by most PMs.

2. Make mantra. Your mantra should be a three- to four-word mantra that explains why you make meaning. Same as 1. Low influence.

3. Jump to the next curve. True innovation occurs when you jump to the next curve — or better yet, invent the next curve. This is definitely an important area for PMs to identify the next curve. High influence.

4. Great products are DICEE: Deep, Intelligent, Complete, Empowering and Elegant. This is the PM soft spot and where they become super stars. High influence.

5. Don’t worry; be crappy. Don’t worry about shipping an innovative product with elements of crappiness. Yipes! This is a tough area for PMs. Shipping a product that has crappy bits will normally result in the PM getting some crap feedback. This needs the business team’s buy-in and their appetite for risk. Medium influence.

6. “Let a hundred flowers blossom.” The lesson is to sow fields, not flower boxes, and to let a hundred flowers blossom. This is probably a wider company program rather than within a single product or portfolio scope. Low influence.

7. Don’t be afraid to polarize people. The worst case is to incite no reactions at all, and that happens when companies try to make everyone happy. This is definitely the job of the PM to identify the profiles of the product audiences. Very few products can address the novice to expert spectrum of possible users. You need to nail the target population and make them smile – others may need to wait awhile. High influence.

8. Churn, baby, churn. I’m saying it’s OK to ship with elements of crappiness — I’m not saying that it’s OK to stay crappy. Oh yes, this is another PM soft spot. Get it out there and keep improving often. The team knows what needs to be improved and customers will give you a “buy” if they see incremental improvements to the new approach. High influence.

9. Niche thyself. The holy grail of innovation is to create a product that is unique and valuable. Hmm, this seems a little obvious but/and PMs have High Influence.

10. Perfect your pitch. There are three keys to a perfect pitch. This is a product marketing aspect and PMs have a big influence on the messaging, if not the final pitches. Medium Influence.

11. Don’t let the bozos grind you down. The bozos will tell you what you’re trying can’t be done, … This is about the toughest part of innovation – the folks that want to play “devil’s advocate”. This is the polite way of disguising their bozoness. Guy does not suggest the approach to the bozos. Mine is usually asking the devil’s advocates to become guardian angles and helping the team because there is lots of DAs out there already trying to out sell us. Medium influence.

So the final tallies: 5 high, 3 medium and 3 low.

Based on the above, my belief is that a PM is probably one of the most influential players in these innovation principles. I cannot identify other roles that may be bigger influencers. Can you?

January 6, 2014 by admin

product managers as enablers of innovation (part 2)

I mentioned in the previous article that I was going to build on the thought about product managers and how they can be enablers of innovation. Since then I came upon this article about ways to create a culture of innovation and there is a lot there that lines up with my thoughts on this topic. The first three of the ways to create a culture of innovation listed in the article are quite easily assigned to a project manager’s domain:

Be intentional with your innovation intent
Create a structure for unstructured time
Step in, then step back

To other three are good ideas but more generic to the development group’s team spirit.

For the first method it is fairly straightforward for the product team to assign a percentage of the development budget to innovation. The management team needs to be aware (and agree to) of this type of allocation so they are not surprised when the CEO drops by for a visit and is told by the team that it has a new innovative idea to show and it is a sanctioned part of the program. However, this part of the budget should not be the first to be cannibalized for overruns, delays, etc. If it is, the innovation spirit dies with it. This time should be managed and planned by the team itself in how it will make use of it for design, prototyping, testing, etc – BUT the product manager is best situated in the ecosystem to help prioritize, track progress and lubricate the wheels of the business when any outside assistance may be helpful.

The second way of managing unstructured time within a project is again within the scope of the product manager because s/he understands the cadence of the program and can set expectation for sprints within the project. Assuring that team members have some planned time to work on innovative ideas is critical to the culture of the team. In most cases if the team sees that there is an effort to promote ideas from within, they will spend a lot more of their own time working on them. This is a win-win.

Finally, in the third way of “Give just enough structure and support to help people navigate uncertainty and tap into the creative process without stifling it”, product managers are skilled at providing a light touch of structure to development teams. Product managers walk the balance beam of setting hard requirements and encouraging innovative solutions.

So my assertion is that product managers usually have the appropriate mindset and skills to be able to promote the innovation track within product teams. The important premises of this type of program are that the innovation may not be associated directly with the current product and each innovation phase may not end up as a killer product/concept. The concept of failing forward is critical in these programs. An idea that is tried and found failing is a valuable experience for the whole business and is a steppingstone (catch the stone reference!) to an ultimate successful result. There are data points in the above article that product teams that have these innovation tracks will consistently deliver good results because they know there is space for them to potentially deliver the “the next best thing” for the business.

December 6, 2013 by admin

Are product managers innovation catalysts?

Wikipedia has a entry for product management. I have provided a snippet of the entry below:

==== start snippet====
Product management is an organizational lifecycle function within a company dealing with the planning, forecasting, or marketing of a product or products at all stages of the product lifecycle.

The role consists of product development and product marketing, which are different (yet complementary) efforts, with the objective of maximizing sales revenues, market share, and profit margins. The product manager is often responsible for analyzing market conditions and defining features or functions of a product. The role of product management spans many activities from strategic to tactical and varies based on the organizational structure of the company. Product management can be a function separate on its own, or a member of marketing or engineering.
====end snippet====

This is an excellent description of the responsibilities we require of product managers. The job entails business plans, forecasting, customer relationships, sales enablement, technology expertise, subject matter expertise, communications skills, and leadership abilities.

Product managers deal with very smart and opinionated folks like customers, sales teams, software development teams, industry analysts and business unit executives to name a few. They need to be able to direct and justify their product strategies to all these players. In these discussions, there is a lot “what if” scenarios that generate lots of off-the-wall ideas.

What seems to be missing in the Wikipedia article is any mention of the product manager being responsible for generating the next big idea from within this ecosystem. Certainly there is no lack of ideas on how to improve performance, add functionality, fix the ugly UI, provide more reports, make it mobile friendly, build and support it cheaper, etc. These are all important enhancements to a product to keep it competitive in the market. But where does the next big ideas for the business come? And does a product manger have any responsibilities (or time) to identify, adopt and foster them? If not, who does?

I will consider practical options for this important issue for technology led businesses in the next blog in this series.

December 6, 2013 by admin

Cloud security and compliance. Have we moved ball down the field or should we be penalized for delay of game?

I wrote this blog in July 2009 dealing with security, the cloud and how organizations will need to deal with this mashed up infrastructure. I think it is worth another read in spite of the loss of formatting.

My proposition here was that both organizations and cloud infrastructure and application vendors need to put security and the ability to measure its operation as a top service feature. Customers of cloud vendors cannot be left holding the bag to assert to their auditors that their infrastructure is within compliance with (insert here your required regulation or industry standard).

Four years have past since this blog was posted and I would contend that much of this still applies. I know security assurance has not become any easier to architect, deploy and manage in those four years, but we seem to be falling behind rather than making progress in offering strong, certifiable and continually monitored security for cloud services.

Please comment and show me that I am out of date on this issue because I want to be.

December 5, 2013 by admin

Steve Jobs and the story of stones and teams

I really like this exerpt from “The Triumph of the Nerds: The Rise of Accidental Empires”, Steve Jobs and the Parable of the Stones – so much that I have provided a snippet below with my bolding to accent the stone theme.

We all know the genius of Steve Jobs to take innovative ideas to highly successful business results. He is an example of my proposition that taking innovative ideas to successful products is the tough part, especially for large businesses. Without leaders like Jobs who got his hands really dirty in the product design and manufacture stages, and gave the green light to projects that failed (Lisa, Newton) but still pursued new projects, Apple would not be the powerhouse it is.

My proposition is that there is plenty of innovative ideas floating out there in businesses but the biggest obstacle is taking them to the market successfully. This is why most innovative products come from small start-ups where there is little competition for limited budgets and resources. In large organizations, by far the greatest energy is put into presenting many business plans across several levels of management who are not being awarded for taking any risks.

Here is the story of Steve and the stones (not the Rolling ones!):

You know, one of the things that really hurt Apple was after I left John Sculley got a very serious disease. It’s the disease of thinking that a really great idea is 90% of the work. And if you just tell all these other people “here’s this great idea,” then of course they can go off and make it happen.

And the problem with that is that there’s just a tremendous amount of craftsmanship in between a great idea and a great product. And as you evolve that great idea, it changes and grows. It never comes out like it starts because you learn a lot more as you get into the subtleties of it. And you also find there are tremendous tradeoffs that you have to make. There are just certain things you can’t make electrons do. There are certain things you can’t make plastic do. Or glass do. Or factories do. Or robots do.

Designing a product is keeping five thousand things in your brain and fitting them all together in new and different ways to get what you want. And every day you discover something new that is a new problem or a new opportunity to fit these things together a little differently.

And it’s that process that is the magic.

And so we had a lot of great ideas when we started [the Mac]. But what I’ve always felt that a team of people doing something they really believe in is like is like when I was a young kid there was a widowed man that lived up the street. He was in his eighties. He was a little scary looking. And I got to know him a little bit. I think he may have paid me to mow his lawn or something.

And one day he said to me, “come on into my garage I want to show you something.” And he pulled out this dusty old rock tumbler. It was a motor and a coffee can and a little band between them. And he said, “come on with me.” We went out into the back and we got just some rocks. Some regular old ugly rocks. And we put them in the can with a little bit of liquid and little bit of grit powder, and we closed the can up and he turned this motor on and he said, “come back tomorrow.”

And this can was making a racket as the stones went around.

And I came back the next day, and we opened the can. And we took out these amazingly beautiful polished rocks. The same common stones that had gone in, through rubbing against each other like this (clapping his hands), creating a little bit of friction, creating a little bit of noise, had come out these beautiful polished rocks.

That’s always been in my mind my metaphor for a team working really hard on something they’re passionate about. It’s that through the team, through that group of incredibly talented people bumping up against each other, having arguments, having fights sometimes, making some noise, and working together they polish each other and they polish the ideas, and what comes out are these really beautiful stones.

Recent Posts

Categories