Developing Information Risk Management Stories

My what a dull sounding post title but one of the fun things about being a specialist is developing the stories we tell to help the technology make sense. Not stories in the fictional sense, we couldn’t get it past legal! I’m privileged to work on a bunch of products that are genuinely integrated and not just thrown together by somebody in marketing looking to meet some new buzzword requirement.

The usual corporate-PowerPoint-hell exists at Symantec with 50 slide monsters containing everything you ever wanted say written on the slide itself. I apologise if you’ve ever been subjected to one of ours! Personally I try and use whiteboard wherever possible and I’ve been re-thinking the one I usually give recently in the light of our Vontu acquisition.

Vontu as a standalone entity focused on data loss prevention (DLP .. Another fab TLA) which is fundamentally about discovering where your important data exists within your organisation and keeping in the hands of only the people that need it. I think as I’ve been reviewing their messages and slides that the thing that most jumped out at me was the fact that “policy” was the core of all they do. Describe data. Describe access. Describe retention. Discover. Protect and prevent leakage. All those kinds of words and phrases revolve around policies. If you don’t know what your policy is handed down from a legal body, or an internal body, then how on earth are you going to decide how long to keep that pile of emails from your customers?

I think the biggest relief for me though as I discover more about the Vontu technology is that it’s not some toothless auditing or reporting tool but can actually impact and change user behaviour. You can run it in “Monitor/Discover” mode or “Prevent” or both. It’s not hard to build stories when you can impact the behaviour of thousands or millions of interactions of individuals using “our” information within an organisation!

“Stemming the data loss” or “Woo-hoo-Vontu!”

Being the sad individual I am - I was so excited when we announced our acquisition of Vontu at the beginning of the month. My main responsibility at work is the Symantec Mail Security 8300 Series Appliances (rolls off the tongue doesn’t it). This product is the one which has had Vontu’s filtering engine built in for a good while now. I built a slide for a presentation a few months ago that talked about the four main technologies on the box:

  • Brightmail - Top notch anti-spam filtering engine
  • Anti-Virus Engine - Well known and loved (or hated)
  • IMlogic - The core instant messaging security engine
  • Vontu - Advanced filtering technology for Data Loss Prevention (or Protection depending on the day of the week)

These four elements are all integrated on the boxes and I joked whenever I showed it that three were Symantec technologies, though you’d be amazed how many people didn’t know, and the forth would probably be soon. I didn’t do so with any insider knowledge! Just knew that the technology was too good to stay integrated and yet outside the organisation for too long!

The team I’m in is a group of specialists called “Information Risk Management” and it will be very interesting to see if we get the European Vontu employees in with us at somepoint soon. From my experience so far of this area of business need is that it’s only getting more and more important as our organisations (and in fact our entire economies) are being built on growing stack of data. How it’s managed, for good or for bad, internally or externally, with ease or pain - all these are going to be critical. I repeat again - Woo-hoo-Vontu!

Traffic shaping for my inbox

I’ve not written here for far too long. I love writing, but the only writing I seem to do these days is email! Since I joined Symantec my work day seems to never have time in it for stopping, contemplating and composing but I’m going to change that. I’ve realised that if I continue the same pace for too long I will basically run out of stored energy. For me, I am able to continue at a strong pace for a long time, but then I crash!

I’m on my way back from Barcelona right now and one of the things I have been thinking about is controlling my email inbox. The first day I was here, the in-flow was still it’s usual pace (a.k.a. far too much). The second day after people took note of the out-of-office reply they got, it slowed. The third day, it was even less. During the last 3 days I have sent very little email as I’ve been manning a stand here at TechEd. To me, that demonstrates that I’m actually generating in-flow probably by sending mail myself that requires a response (via email). I am going to make a conscious effort to send less email. Think before I send. Pick-up the phone. Do more digging before I reach for the “New mail” button.

Remind me of that in a week.

Yes, Symantec still make appliances…

… and they’re very good.

If you searched on our good friend Google for “Symantec appliances” you’d get the following results as the top two:

Symantec turns off on security appliances | The Register

Symantec is scaling down its hardware offering by pulling the plug on a range of network security appliances. The vendor will stop designing and making the
www.theregister.co.uk/2006/06/27/symantec_appliances/

Avoid Symantec appliances, says Gartner - vnunet.com

Analyst firm predicts that Symantec will exit market sector.
www.vnunet.com/vnunet/news/2159677/gartner-advises-avoiding

Oh dear, that doesn’t bode well for me in my new role at Symantec where my two focus products at the moment are Enterprise Vault (formerly KVS, archiving software) and the Mail Security 8300 Series appliance! I’ve only been in the role two weeks and I’ve already overheard colleagues describe themselves loosing business because “.. we don’t do appliances”. I repeat, yes, Symantec still make appliances… and they’re very good! They don’t make the hardware, it’s well spec’d Dell kit, but they do everything else involved in getting an appliance developed and with customers.

The communication problem stems from an exit from making appliance hardware and forming a partnership with Juniper that occurred mid-last year. The releases weren’t particularly clear and the press certainly focused on the “stopping making appliances” part of them. I’m still not fully clear on what has happened/is happening with those “SNS” and “SGS” products but “SMS” (Symantec Mail Security) is going strong. Amusingly the road-map code names for the upcoming releases are mountain names which keep getting higher and higher… I hope they’re pacing themselves on the way to Everest! Though I hear sub-ocean mountains are higher…

It’s going to be a challenge reversing the perception that Symantec don’t make appliances and that they are a worthy and safe investment for customers to make but I’m sure our team is up to the task! The most frustrating thing for me so far is working out what is publicly promotable about the products and what is “secret”. Everything seems to be marked “Internal Only” by default and only gets made “External” if someone asks the right person the right question about the right material and they agree. I’m still trying to discover the best way for me to change that without stepping on too many toes or ruffling too many feathers!

Blue Monster and more

I’ve been meaning to write the bulk of this post for weeks and weeks and finally got sick of it running round in my head and thought it best to put it down.

The “Blue Monster” is a little project that Steve Clayton (Microsoftie) and Hugh Macleod (of GapingVoid fame). The back story is here and it centres around this little cartoon: Blue Monster

I’ve followed Steve and Hugh separately for a long time and even had the pleasure of meeting Hugh years ago at a Joi Ito meet-up in London and it’s been funny to watch the two worlds collide. If you’ve not heard of the blue monster then go read the back story and come back before you read my thoughts. Otherwise, read on!

My interpretation of the blue monster runs along some thoughts that I’ve had for years about the concept of “Cow paths”. I can’t remember the source of this story but I think it was told by one of the Gillmor Gang on their weekly podcast. The story goes that one university in the USA decided after building its new campus to not lay any paths around the site, between buildings. Instead they let the students walk whichever way was quickest for them. They then returned a year later, looked around and saw the “cow paths” (worn tracks) and laid paths on those. Now the way I think this fits in with the blue monster is that for a long time now people have created pathways at Microsoft and its time for the next generation to make their own. Abandoning the paved stones for the rough grass. Now I’ve recently started walking a new way to the train station that takes me through a patch of grass which for some bizare reason has a wonky cow path on it that doesn’t take the straightest route and I’ve been pioneering a new one and I think its beginning to take shape. However, I have to be careful because people walk their dogs on the grass and though they wouldn’t let them poop on the path, they do let them in the rough. So my take in a nutshell: Make a new cow path, mind the poo.

Now this story takes on another twist today because you may recall my story of trying to get an evangelist job with Microsoft a short while ago. Well I never got round to writing that I didn’t get the job… rejected! Reasons were “not enough experience with the latest version of SharePoint” and “not enough experience taking to groups of 300 plus”. Which I personally thought were very poor reasons… a good evangelist can get their head round almost anything, it’s a personality type, not tied to a specific piece of software.

However, another large software company who I’ve also worked closely with for the last few years thought I was good enough and offered me an evangelist role. That company is Symantec and I start in a few weeks as a “Sales Development Specialist”. It’s going to be very interesting because if Steve et al think Microsoft have a way to go on their transparency then Symantec are miles behind them. I’m yet to discover the boundaries of my open-ness in the new role but as one of the groups I will be charged with enthusing is the channel (partners by another name), I can’t see that being successful behind closed doors. I’m sure I have many lessons to learn, mistakes to make, and frustrations to overcome but I’m really looking forward to it.

I wonder if Steve Clayton will be good enough to meet me sometime and swap tips… How far does the Blue Monster go? (and how often does he check Technorati to see who’s talking about him!)

technorati tags: , , ,

Legal Exoskeletons

I like to think most of the IT systems I work on as being best suited to extending human capabilities in an “exoskelaton” manner. In doing so we gather data about interactions that are of varying importance that occur person-to-person, person-to-system (and even perhaps system-to-system). Sig likes to talk about passing an object through a workflow and storing the changes in state as it goes. I wonder however in these days of information laws such as the Data Protection Act and the Freedom of Information Act, how much and to what level of detail, we are allowed to capture, store and use before we are touching the edges of legality.

Technotainment

I used to be an avid Gillmor Gang listener before the canned it at its peak in something like a Faulty Towers/The Office move. I also listen to the TWiT podcast but recently I’ve become rather disappointed by its content which I’ve decided is best labelled “Technotainment”.  The biggest difference between the two shows is that on TWiT whenever they talk about something which I know a lot about they seem to get it totally wrong. Whereas with the Gillmor Gang it was almost always the opposite with them providing a different and interesting angle on the subjects.

This leaves me in a position of distrust with TWiT… thinking: “if they are completely off with stuff I know about, are they the same with stuff I’m not an expert in?”

Steve, please bring back the Gillmor Gang… train journeys suck without it!

Cost of unpersonal

What is the cost of sending an unpersonalised and untargetted email once you:

  1. collect the data from them
  2. give them a taste of tailoring in action

While working on my currect project which involves working for a large IT supplier the question above struck me.

What the client initially got excited about I’m sure was the ultra-personalised nature of the campaign they were pitched. All the way down to the imagary used reflecting the character of the account managers and customers. While driving the customers to give them descriptions of their appearance they also ask for information about their interests (relating only to their purchasing habits). This data could later dictate what information the do and more importantaly don’t receive. At the moment though the logic is not being added to the mailing tools that could alert the senders to the fact they are about to blast someone with information they’ve already declared a non-interest in.

This will assure the sales people continue to behave as they always have rather than give them information to alter their behaviour. I think its almost like “the boy who cried wolf” and I am still pondering what the average clients threshold is for “wolf cries”?

Was passion, now profession

I’m currently in the process of trying to get a job at Microsoft in the team responsible for evangelism to IT Professionals. Should I be successful my manager would be the delightful Eileen Brown who I’ve met a couple of times at the Unified Communications User Group and some Microsoft community events. She even stole one of my quotes for the title of a post she wrote up about the last event I saw her at - “From passion to profession“. The reason it came up was I was telling her my theory as to why user group weren’t so popular these days compared to the 80’s and 90’s. I think it breaks down into a number of reasons:

  1. Firstly, and most crucially, for most people these days computing and IT has become a profession and not a passion. Previously people had a profession (non IT related) and would go home in the evenings and at the weekends and engage in their passion (random geekery). These days for many it has reversed. People are not willing to sacrifice their “passion-time” to go to evening events, which is when most user groups are.
  2. The people that are still passionate about it tend to be “implementors” (a.k.a. “consultants”)  not users. They for the most part install, configure and walk. This can lead to groups dominated by subjects about implementing or selling the latest and greatest and not making-the-most-of-what-you-have (MTMOWYH) which is what real users care about… getting their job done faster and without it costing too much (both in re-learning time and money).
  3. The placement of a number of the larger companies in the Thames Valley thing is a dampener on fun times (think pizza and beer). If you look at the groups that are really thriving in the web dev/web business area they meet in social places around where they are based, in London (e.g. Pub Standards).  Most people have to drive to events in Reading and if you don’t you won’t get home till gone 10 or 11pm for evening events.
  4. The IT landscape is huge now. Forming company specific and product specific groups is a tough job. Just look at the products in the Office group, enough to keep anyone busy for a lifetime:
    Desktop Programs:
    Access, Accounting, Communicator, Excel, FrontPage, Groove, InfoPath, OneNote, Outlook, PowerPoint, Project, Publisher, SharePoint Designer, Visio, Word
    Servers: Forms Server, Groove Server, Live Communications Server, PerformancePoint Server, Project Portfolio Server, Project Server, SharePoint Server, SharePoint Server for Search
    It’s the same for any large software company or product category you pick.
  5. I’m sure there’s more but that’ll do for now!

After writing this list I thought perhaps I should offer some suggestions as to how address this!

  1. Acknowledge that these meet-ups are generally for implementors and find different ways to address the needs of users by going to them and listening till finding a theme that resonates with them.
  2. Have more daytime events. The EVO (though someone forgot the Vista part) community launch day where I made the quote to Eileen was daytime. If it’s going to be daytime it has to have explicit value to employers who are going to release their staff. Therefore the right balance of knowledge and fun is vital.
  3. Change the learning style. Death by PowerPoint has to be a thing of the past. If you have to show slides co-ordinate amongst all speakers to ensure they don’t all have the same 4 initial slides showing the “introduction to the area”. I’m a big fan of the BarCamp format and I went to the first one here in the UK. Rule number one is: No Spectators, Only Participants. This is a big change for most people though so it has to be done in a gentle manner.
  4. Trying to form more sector based groups (rather than product).

I’m only just starting to think about the part about dealing with the issues but I’m sure I’ll have more thoughts in the coming weeks.

Using the technology of “now”

One of my great influencers is a guy called Jon Udell and I’ve mentioned his work here before. He recently joined Microsoft after a long career in various journalistic roles including time at Byte Magazine and more recently InfoWorld. His role at Microsoft will be to continue to make abstract technical capabilities into real-world, exciting use cases but he’s going to try to also move the audience to a less “geeky” one. Jon is such a geek that he uses the term “outlying data point” to describe himself, which is in itself a geeky phrase!

The reason I wanted to write about it was I’ve been thinking along these lines for the areas that I’m working in at the moment. If you can’t make your technology accessible, understandable, relevant, etc. to end-users then it can be the most life changing software in the world but it will not gain adoption.

Technology will continue to advance at an enormous rate, but will it be adopted at even a moderate rate?

I recently attended a training course for Groove 2007 in Berlin, Germany which took place after the SharePoint Conference. Groove is an excellent software tool that I used to run my consultancy a few years back before it got acquired by Microsoft … Groove that is, not my consultancy! It’s best used as a tool to enable small teams to collaborate on a shared goal or goals. It encompasses document creation, communication, note taking, data gathering and many other things. It’s even clever enough to have the right mix of technology to be peer-to-peer and manageable by an organisation. Most people think of peer-to-peer in the negative sense of disruptive and bandwidth-intensive. One of the many things that struck me as interesting on the course was that they were acquired back in April 2005 and released no products from then until the release now of Office Groove 2007 which actually has features removed from the version 3.1 which was their last before Microsoft. Sure they’ve added some manageability features and made it fall under the security programme that Microsoft run, but how much more innovation could they have had outside, in the agile start-up world? Then I realised that it didn’t really matter! Groove as it stands now has enough features now to more than satisfy most peoples needs. What it needs is adoption by passionate lead users who will invite colleagues to work with them and help them overcome the inevitable conceptual and technical problems will have.

Groove will have a helping hand because it is very different to most enterprise (not consumer) software that exists today because it is viral. When you want to work with someone in Groove you “invite” them. If they don’t have Groove they can get a 120 day trial and by then they’re either hooked or they’ve finished the project but lost nothing.

Most software doesn’t have this advantage but what can we do to make sure that our friends, colleagues and clients can get hold of the knowledge and understanding that will help them run their organisations better? I believe one of the key ways will be defining use cases and finding ways to present them better. Whether this be podcasting (subscribe-able audio downloads), videoblogging (capturing people talking on camera), screencasting (videos of software demonstrations) or any of the presentation methods yet to be invented it has to be language that is accessible and use cases that are relevant.

Another key way will be not telling people about things. It sounds odd but sometimes my passion makes me tell people about stuff that is not ready for prime time. I often haven’t realise how many work-arounds I’ve unconsciously done to make something work until I try to introduce it to someone else and then I have to say “Oh yeah, ignore that button for now it’ll crash it” or other such phrases.

I look forward to the future of technology but I think a job more important is to make the most of what we have now.
technorati tags: , , ,

  • Archives

  • Categories

  • Meta