Pentagon says "Cyber Attacks Can Count as Acts of War"

On the surface it might seem like a "giant leap for mankind". The Pentagon has finally acknowledged what many of us have long believed (and known) to be true - Cyber attacks are every bit as dangerous, if not more, as any other conventional attack and should be counted as an act of war.

Isn't it about time?

It's a well known fact that no other country has the capability to match our (U.S.) armed forces - air, land, or sea. However, in recent years a fourth dimension - Cyber Space - has come into prominence where we are highly vulnerable for at least two key reasons:

1. The barriers to entry for establishing the capability and conducting cyber warfare are significantly less than those for the same capabilities in the conventional warfare, which is where many Eastern European countries and others such as China can reap huge benefits from relatively little capital investment and their huge numbers of math, science, and computer scientists.

2. Our heavy reliance on our extremely sophisticated, connected, and converged data and utility networks makes us more vulnerable to the same cyber attack that we could carry out on a another country that is far less reliant on their cyber networks.

Pentagon's announcement comes on the heels of an admission by Chinese Defence Ministry spokesman, Geng Yansheng, in a briefing in Xinhua. The elite unit - part of China's People's Liberation Army - is called the "cyber blue team" and will supposedly not only protect Chinese networks from external cyber attack but could also be utilized as a first strike, offensive mechanism in warfare. According to the Channel 4 news story, governments and companies around the world are already concerned that their networks come under regular attack from Chinese hackers. In February, for example, Chinese hackers targeted multinational energy firms to steal information, in an attack called "Night Dragon.

In my opinion, the Pentagon has been slow to react to the cyber threats that have existed for a while. There are numerous examples of cyber warfare having been used in the past decade. So why the lethargic response from the Pentagon? All I can say is it's "better late than never." The announement from the Pentagon yesterday formalizing cyber attacks as an act of war is definitely a step in the right direction as is the establishment of a new cyber command last year, headed by the director of the National Security Agency, to consolidate military network security and attack efforts.

These are great first steps but we still have a long way to go in protecting ourselves from cyber attacks. Cyber war is here to stay exposing us more than ever and it is up to us to be ready for it whether we like it or not.

Eenie meenie miney mo - Packaged Apps Vs. Custom Apps

Today's question on the ebizQ Tech forum was about which one is better - packaged apps or custom developed ones? The question was inspired by Mike Gilpin's Forrester blog, Packaged Versus Custom Apps: The Debate Rages On, where he writes that it wasn't that long ago that packaged apps ruled the application delivery landscape and custom development was decidedly the second choice. He contends, however, that today, the decision is not so cut and dried, as firms struggle to find the right balance between the quick time-to-market of packages and the competitive distinction custom development can create.

The simple answer is neither is better. An enterprise needs both. The question is akin to asking "what's better - peanut butter or jelly?" How often have we heard of just a peanut butter or just a jelly sandwich. Definitely not as much as we hear about a "peanut butter and jelly" or "PBJ" sandwich. Similarly, it would be rare to find an organization that did not have both custom and packaged applications weaved together.

Make no mistake however that this by no means implies that both custom and packaged apps are the same. There are different reasons why a situation might warrant one over the other. For example, a core strategic business process most often requires a custom application in order to create and maintain maximum competitive advantage. Packaged apps typcially standardize "best practices". Since packaged apps can be bought and used by anyone, they (and therefore standardized best practices) rarely yield a true competitive advantage. But if a business process (such as billing your customers) is routine (i.e. is not the source of your competitive advantage) then by all means leveraging a packaged app and customizing it makes perfect sense.

The moral of the above is that one thing is rarely better than another in the absolute sense. It's the situation that might make one solution more appealing than the other.

* Originally posted in ebizQ's Tech forum on May 4, 2011.

And we wonder why Enterprise Architecture efforts seldom succeed...

It's been a while but worth the wait since I have finally been rewarded with a question on the ebizQ SOA forum worthy of attention :).

Gartner recently stated "Enterprise architecture (EA) is a key strategic initiative, as the majority of practitioners have shifted their focus to their business's strategic vision, not focusing on the IT organization alone. By 2016, 30 percent of EA efforts will be supported as a collaboration between business and IT, up from 9 percent in early 2011."

The question on the forum was "Do you agree?"

All I can say is "Wow!!!"

A 30% collaboration on EA between business and IT by the year 2016! I wish I could have heard and seen Betsy Burton, vice president and distinguished analyst at Gartner, as she quoted these numbers. I would have loved to see how she would have managed to keep a straight face while quoting these numbers without any hint of sarcasm in her voice. 

With abysmal numbers like these is it any wonder why most Enterprise Architecture initiatives fail miserably? If only 9% of EA efforts today are a collaboration between business and IT then what the heck are the other 91% efforts doing? 

Want to see more wins for EA? Then don't wait for 30% collaboration by 2016; instead strive for 100% collaboration by the year 2012.

Click here to follow the entire discussion on the ebizQ SOA forum.  

Back to the Future - The Role of an Enterprise Architect

My first question on ebizQ's Enterprise Architecture forum is an interesting one that was inspired by a blog entry titled Enterprise Architects' Role In Aligning IT With Business by Forrester Research VP Gene Leganza as he ponders what the Enterprise Architect role would look like in the future based on what he is seeing happening today. 

While it's a question worthy of serious thought, I believe that the role of an Enterprise Architect (EA) has always been and will always be to implement an organization's business strategy with a supporting and complementing IT strategy. Different companies have different names and reporting structures for this role depending on their size, vertical, and geographical location. Some call the role an EA, some a business architect, some a chief architect, and some call that role a CTO or CIO, but the role always exists. The biggest game changer that I see is that our global, innovation-based economy is just accelerating the pace at which "EA"s that don't fit this role are exposed and replaced.
 
* Originally posted on ebizQ's Enterprise Architecture forum on February 23, 2011.

Have Cloud... Bye bye IT Department?

It's been a while since I've participated in the ebizQ forums. But I'm back now! :)

Today's question on the Cloud Computing forum was whether the advent of the cloud will one day make IT departments a thing of the past - especially for "smaller" companies. Will the cloud at some point allow smaller companies to do away with their IT department?

I think the question needs some further clarification. Is it do away with the IT Department or with IT Capital Assets?

Although it may seem trivial on the surface, there is a major distinction between the two. An IT department has more than just physical "IT" or technology. It has people and processes as well. Cloud Computing might be able to replace all of the technology but not all of the people and processes. So, my answer is "Yes" to doing away with IT Capital Assets but "No" to doing away with the IT Department.

By the way, way back in early 2010, Gartner had made the bold proclamation that one-fifth of all businesses will own absolutely no IT assets come 2012. While I don't know if that number (20%) will hold true, I would like to point out that they too mentioned "IT assets" as opposed to IT department.

* Originally posted on the ebizQ Cloud Computing forum on February 9, 2011.