Unfortunately, measuring the effectiveness of cybersecurity solutions is not easy, mainly because it is impossible to prove a negative. How do you quantify the number of attacks that didn’t happen? The amount of money that wasn’t lost? The severity of the regulatory penalties that weren’t incurred? Security teams are oriented around preventing negative outcomes rather than generating positive ones, which makes demonstrating return on investment (ROI) to board members a challenge. Fortunately, it’s a problem with a solution: embracing metrics. By creating a culture of metrics within security teams, organizations can find creative—not to mention useful—ways to demonstrate the effectiveness and value of the solutions in use.

Effectively Communicating with Decision Makers

It’s often said that the only thing worse than a bad measurement is no measurement. This isn’t unique to cybersecurity—marketers, for example, need to know how their campaigns are performing, while sales teams need to project potential revenue. Hard numbers and precise metrics are obviously preferred, but even imprecise ones can give decision makers a helpful impression of how things are going. Without metrics, organizations are left to base their decisions off anecdotal evidence and gut feelings. For security professionals, swapping anecdotes might share important information—but it’s unlikely to satisfy board members who want to see evidence that they are getting the most out of their cybersecurity investments.

There are some security metrics that are quantitative. Dwell time (the amount of time an attacker spends in the network before detection) is one. Time to resolution (the amount of time between when an incident is detected and when it is resolved) is another. These can be helpful, but they can also be fuzzy—there are many factors that go into rising and falling dwell time and resolution rates, and it can be difficult to effectively convey context to those without a security background. Instead, let’s take a step back. At their core, metrics like dwell time and time to resolution are really just proxies for what you really want to convey—which is how well your security tools are operating and how responsive your organization is to threats. Creating metrics that measure those factors over time can relay the efficacy of a cybersecurity program more effectively than counting stats like dwell time ever could.

Tracking Against Established Frameworks and Known Threats

One of the best ways to measure your attack preparedness is to see how it compares to established frameworks. The National Institute of Standards and Technology (NIST) is an agency within the U.S. Department of Commerce that regularly releases and updates security frameworks to serve as guidelines for organizations seeking to better protect themselves. Tracking how your security stack measures up to the recommendations made in the NIST Cybersecurity Framework (CSF) or Privacy Framework (PF) can provide a valuable measuring stick—especially if you can reduce it to a single, easily digestible number, such as percentage alignment. This also allows you to track performance over time, which is another valuable way to demonstrate progress to board members and other decision makers. The same can be done with audit results and other external reviews. MITRE is another respected organization that publishes regular cyber defense frameworks, and if your organization undergoes a periodic SOC 2 audit, consider comparing those results year-over-year.

This same logic applies to internal assessments as well. Independent of NIST frameworks or other security standards, do you have a solid grasp on the threats that your specific industry, company, environment, or product tends to face? And do you have a way to measure those threats? Most importantly, are you trending in the right direction when it comes to mitigating them? It isn’t as simple as putting together a metric based on “number of intruders detected” or “number of attackers quarantined,” but metrics don’t need to be black and white to be effective. Identifying the most pressing threats and cataloging how they are addressed is critical. Simply put, it’s incredibly valuable to be able to say, “here’s a risk we identified, here’s how we measured it, here’s how we addressed it, and here’s what it cost.”

Making Metrics the Norm

When you’re talking to board members and other business decision makers, it’s important to be able to speak to cybersecurity metrics in a holistic manner. Granted, not every board is the same—and board members with technical expertise may appreciate seeing vulnerability statistics and other high-level numbers. But generally, your best bet is to frame things in terms of enterprise risk management. Identifying and quantifying risks, measuring performance against established standards, and consolidating those measurements to easily digestible and understandable metrics can help paint a more complete picture of the effectiveness—and value—of a cybersecurity program. Building a culture of metrics within the IT and security teams helps create an environment where tracking performance over time in clear and understandable ways becomes the norm—making it easier to provide business decision makers with the information they need.

Greg Notch is the Chief Information Security Officer (CISO) at Expel.

The post Why a Culture of Metrics Helps Security Teams Communicate with Business Leaders appeared first on My TechDecisions.

The reason for the adoption of telehealth is sound. Patients enjoy it. From the HBR article:

Studies have consistently shown that consumer preference is behind much of this movement. In one recent consumer survey, 94% of people who sampled telehealth, in the form of synchronous virtual visits, for the first time during Covid reported satisfaction with the ease and convenience and expressed interest in other modes of virtual care, such as digital monitoring and at-home lab testing. In healthcare, however, it bears reminding that digital adoption is a two-way street, requiring the satisfaction and buy-in of providers as well as patients.

The same article states that, “In surveys fielded over the past few years, a third or more of physicians regularly report symptoms of burnout, while more than half say those symptoms have increased since the onset of the current public health crisis.”

So the problem isn’t that customers don’t find the technology helpful. The problem is that for whatever reason the users on the healthcare side are having problems utilizing the technology.

Consider this when you’re implementing your own technology in any business. Let’s say you’re in retail and you have a stellar sales team on the floor. You decide to install a new digital signage system that helps advertise products. This system increases sales due to advertisement by $1,000. However, your sales staff finds that customers are interacting more with the screen than with the employees on the floor. As a result, employee generated sales are down $1,500. In this case you’ve got a successful technology installation that is losing money.

That’s super oversimplified, I know. But the logic behind it is what I’m trying to impart. Often with technology the impact isn’t measured in dollars and cents. You have to dig deeper for your ROI. If your customers are locing a new technology, but your employees are losing productivity because of it, that can easily become a new failure.

That’s why it’s so important to bring employees into your process of implementing technology. You want to make sure, first and foremost, that employees will adopt and benefit from new technology. Tailor the new tech to fit into your organization’s workflow. That way you still receive the benefits from customer adoption, while not losing out internally.

The post The Need for Technology Adoption on Both Sides of the Equation appeared first on My TechDecisions.

The research, the results of the fourth edition of the company’s Small & Medium Business Trends Report, is a culmination of a survey of more than 2,300 business owners and leaders from around the world.

The report found four major trends: customer safety and safe interactions, optimism amid new challenges, digital-forward businesses are better equipped to survive volatile markets and using lessons learned over the last year to prepare for future crises.

According to the, businesses are making better use of technology to continue to grow their business during the pandemic. More than half of growing businesses surveyed (55%) said technology is driving their customer interactions, and 51% said it drives the growth of their customer base.

Only 24% of businesses surveyed said they’ve accelerated their technology investments, but 75% said they have either slowed or made no progress. Also, half of declining or stagnant businesses have slowed However, business leaders are embracing technology, including CRMs like Salesforce. The report found that 56% of businesses surveyed have adopted a CRM system, up from 51% in March 2020 and 45% in March 2019.

Read Next: Microsoft, Salesforce Partner on New Teams Integration

Recovery from the immediate impacts of the pandemic remains the top priority, but many businesses are now focused on long-term business resiliency, the report found.

Once the pandemic subsides, 60% will modify their business in some way, while just 33% said they’ll return to business as usual. Further, technology is driving those changes, as 38% said they’ve adopted technology to help digitize customer interactions, 35% said they’ve adopted technology to digitize internal communications and 34% have adopted technology to help digitize workflows.

According to the report, 64% of business leaders said they’ve implemented safety and sanitation policies for spaces where customers and employees frequent, 59% said they follow local public health mandates, 48% said they have introduced digital, contactless services and 43% said they’ve changed the layout of their stores of offices for social distancing.

Business leaders who made it this far into the pandemic aren’t pessimistic about their business’ future, as 72% of businesses said they were optimistic, although that is down somewhat from 80% in March.

The post Salesforce Report: Strong Digital Operations Are Helping Businesses Survive Pandemic and Beyond appeared first on My TechDecisions.

When managed services providers (MSPs) work with customers today, AV equipment is a clear and necessary concern in terms of bandwidth and security. 

It’s not, however, the convergence people feared—the final Armageddon where AV integrators and IT providers fight in a righteous battle where only one emerges to handle all technology integration until eternity. 

Those who scoff at the idea of the convergence never coming think of it in those terms. So why would they worry about a convergence that isn’t close to fruition? 

In reality, that doom-and-gloom notion of the AV/IT convergence is never going to occur. Instead the convergence is exactly what the name suggests: two industries coming together and evolving into one. 

What does that mean for technology managers as we move into the 2020s? 

Why AV and IT Need Each Other 

The biggest detriment to the relationship between AV integrators and their customers is a failure to communicate. The language IT pros use is not the same language the AV integrator uses; in some cases, the same words, phrases, and acronyms mean completely different things. That’s why MSPs are there to help on the IT side.

However, an MSP can’t simply start designing complicated AV systems. It’s two totally different disciplines. So increasingly you’ll see AV integration firms and MSPs partner in order to provide customers with a total solution. This is a great thing for technology managers, as you get the best from both worlds.

Here is how it works: 

• AV Integrator A does its research and finds MSP B, an organization that it could work well with given both organizations’ strengths. They make an arrangement where each will recommend the other to clients when necessary. 
• So, when MSP B is outfitting a new office that also needs digital signage and videoconferencing suite, they introduce the customer to AV Integrator A. When AV Integrator A is creating a communications suite that needs proper bandwidth, they introduce the customer to MSP B. 
• Each firm now has an extra arm out there prospecting.  

It can be more formal than that, of course. 

In another model, MSP B may automatically contract AV Integrator A and vice versa, taking the customer out of it. There may be a finder’s fee that changes hands when one gets business from the other. 

As a customer, you should encourage these types of relationships. You don’t want an MSP trying their hand a designing a videoconferencing system with little experience, any more than you want an integrator with little experience attempting to set up a network. The two should work hand-in-hand, and as the customer its your right to make sure they’re doing so.

Don’t settle for less. Drag the industries into a truce to ensure that your entire technology stack works – with AV and IT harmoniously converged.

The post What the AV and IT Convergence Means for You appeared first on My TechDecisions.

Citing the report, The Verge says that in the past, Amazon has ignored employee requests for injury logs, or only provided partial records. On top of that, records that were provided may not have been entirely accurate. One report notes, “Several years ago, according [a few] former safety managers, Amazon had a policy for systematically hiding injuries. A former safety specialist in a warehouse confirmed their account. He said higher-ups instructed him to come up with justifications for not recording injuries that should have been counted by law.”

There are also accounts of an OSHA investigator, who was reporting on the death of the worker at an Amazon factory in Indiana, being told by a superior that his report “may need to be manipulated” to place the blame on the worker. That investigator felt that Amazon hadn’t provided enough training to employees, and also claimed that he was brought to a meeting with a labor commissioner who told him to lay off his investigation so that he wouldn’t risk Indiana’s chances of being chosen as the new location for Amazon’s second headquarters, The Verge reports. “In the end, the official record essentially blames the employee for his own death. Amazon did not choose to locate a headquarters in Indiana.”

The Verge says that keeping tabs on injury reports like these are pivotal, especially this time of year, since it’s Amazon’s busiest season, and the amount of injuries spikes during this time, as they did this time last year. Amazon says that the reason for the injury spikes is due to the large amount of employees it’s taking on; other sources, including The Atlantic, say that these injuries are attributed to other causes, including “Amazon’s mandatory 12-hour shifts.”

The post Amazon in Hot Water for Unsafe Working Conditions appeared first on My TechDecisions.

Employees have reported unhappiness at the way the tech giant handles some of its internal affairs, including sexual misconduct allegations, business with the military, and the recent implementation of a tool that monitors and reports employees who create “a calendar event with more than 10 rooms or 100 participants. Most recently, Google fired “several outspoken workers” for “allegedly violating its data-security policies;” the announcement was made internally late last month.

Employees have expressed concerns that the tech company is making efforts to punish critics and even potentially “intimidate workers,” CNN Business says.

Examining the “Public Imagination” of Google

The news of friction between Google and its employees is shocking, especially since the tech company has been painted as the ideal place to work for years. For example, Google has been praised and known for its “enviable benefits,” such as free meals, office slides, onsite childcare, and free time to work on side projects that “occasionally turned into real Google products.” Workers were also naturally drawn by a sense that, despite being a corporation, employers like Google were on a mission to make the world a better place,” one researcher told CNN Business.

However, the reality seems to be that Google isn’t what it was cracked up to be. Turns out, numerous Silicon Valley companies face similar tensions with employees: Facebook employees have opposed the social media company’s stance on political advertising; Amazon employees staged a walkout to impel the CEO to take more action on climate change; Microsoft and Saleforce have gotten letters from employees requesting them to cut ties with contracts with U.S. Immigration and Customs Enforcement.

As a result, current employees of tech companies, as well as prospective employees, should consider taking a deeper look at the ethics and practices of their employers. If employees don’t feel that a company’s values line up with theirs, they might consider bringing concerns up with their supervisors, raise awareness about these affairs internally, or, if the situation is severe enough, maybe relocate to another company who values employees. Regardless of which action is taken, decision makers might consider bringing to light Google’s longtime motto, “Don’t be evil,” and encouraging other companies (including Google itself) to act on it.

The post Tech Companies Should Care About the Friction Between Google and Its Employees appeared first on My TechDecisions.

Noncompete agreements essentially ban workers from doing similar types of work at competing firms for one to two years. One of the better-known benefits of noncompete agreements is that it can potentially prevent skilled employees from leaving their current position and taking a job at a competitor, as well as protect innovation and intellectual property.

However, there are cases where companies abuse noncompete agreements, and workers are negatively affected, such as low-wage workers, or new hires who aren’t immediately made aware of a company’s noncompete agreements, and who end up bound to the company.

The proposed legislation, called the Workforce Mobility Act, aims to curb noncompete agreement abusers, and empower workers and entrepreneurs to freely apply their talent and skills to any job. According to Senator Todd Young’s website, the legislation would:

• Narrow noncompete agreements to include only certain dissolved partnerships or business sales.
• Up the Federal Trade Commission’s and the Department of Labor’s responsibility to enforce this legislation, and require that each department reports to Congress on any completed enforcements.
• Require companies to inform employees about how noncompete agreements come with their limitations.

It Might Just Work

ArsTechnica points to a current example of how this noncompete agreement proposal might work – California. Having one of the strictest laws against noncompete agreements, many companies based in the Golden State have become powerhouses, especially in Silicon Valley.

One expert argued that Silicon Valley’s success is attributed to employees being able to “hop from job to job, taking their valuable skills with them.” This enabled good ideas and new innovations to spread widely and quickly, “ultimately benefitting the entire regional economy.”

Ars Technica also says that California’s ban on noncompete agreements actually helped many of the major tech companies of Silicon Valley to get off the ground from the start, especially since those who founded those companies often could not get their employers’ buy-in on their great ideas.

When this happened, those workers had the option to quit “and pursue their ideas independently;” many of them did. Now, those former employers might be kicking themselves to have lost that talent.

The post Limiting Noncompete Agreements Worked for Silicon Valley – Could This Work for the Rest of the Country? appeared first on My TechDecisions.

The bill, called the Assembly 5 bill, will affect at least one million workers. It will help workers that have been working as contractors and struggling with no access to “basic protections,” such as minimum wage and unemployment insurance, the New York Times reports.

Numerous workers and political figures have been praising the bill, especially as it is expected to increase fairness, boosts worker protections, and create opportunities for employees working under app-based services and gig-companies – which depend on contracted work for their customer base. “It will have major reverberations around the country,” David Weil, who worked under the Labor Department during the Obama administration, told the New York Times.

Dealing with Mixed Feelings

While the newly passed bill appears to help workers and has the potential to boost California’s economy, not everyone is happy about it. A spokesman from Lyft told the New York Times that legislators who passed the bill “missed an important opportunity” to support workers who want their job to “balance flexibility with an earning standard and benefits;” this is especially the case for contractors who like to make their own scheduling decisions.

Industry officials have said that when companies have to rely on employees instead of contractors, costs increase by 20 to 30 percent, which may happen with the passage of this bill. This can cause companies to take control of contractors’ schedules, which could reduce those workers’ freedom to decide when and how often they work. It could also limit the number of employees that are needed, too; for example, driving companies like Uber and Lyft could opt for a smaller number of employees, some of whom are scheduled during slower hours or slower markets. This may cause drivers to not rake in as much revenue, and thus reduce the companies’ need to keep a larger number of employees. Uber recently laid off over 400 workers earlier this month, the New York Times says.

For now, decision makers will have to wait and see how and if the Assembly 5 bill will benefit companies and employees – it won’t go into affect until Jan. 1 of next year.

The post California Bill Makes Companies Pay Contracted Workers appeared first on My TechDecisions.

What I discovered as I dug into the story was a unique, new-age marketing strategy.

Most people know the brand name Yamaha for motorcycles and pianos. Many people don’t know that they also make commercial AV equipment. The UC division of Yamaha found itself in a unique marketing situation – how to build a brand within a brand.

Enter Barstool Sports, and a media strategy that excites me as someone that writes about businesses as a living. Yamaha UC partnered with Barstool Sports not only to outfit Barstool’s new headquarters with audioconferencing equipment, but to sponsor podcasts and videos in order to reach Barstool’s audience.

First, the equipment had to fit. Pete Overmyer, Head of Media Technology and Production for Barstool Sports, tested the equipment, worked with Yamaha UC support to get it on the network, and implemented devices in conference rooms, huddle rooms, and desks at the new Barstool Sports headquarters. Check out the video above to learn more about that process.

Once the technology was in place, the marketing portion of the partnership kicked in. The goal is to reach commercial AV end users where they consume content privately. A typical male, 25-year-old consumer of Barstool will learn about Yamaha UC’s products and bring that knowledge into work. Perhaps that same person is even in the IT department and has purchasing power to implement the technology themselves. Yamaha UC hopes to partner with more organizations like Barstool in order to hit the end user at home and build brand awareness through the professional consumer.

The idea fits perfectly with Yamaha UC’s easily-deployed, user-friendly products. Where a complicated, expensive, wired AV system might not appeal to these folks, a simplistic, front-facing conferencing device is something every laymen employee uses. If the IT department is smart, they’ll outfit laymen employees with these types of devices to cut down on their own headaches – an easy-to-use device means less service desk calls.

The strategy is one I’ve not heard of before in the AV industry, but I think it’s really smart in the long-term. There is less of a barrier between work and home than ever before. The consumerization of technology has led to more user-friendly products that resemble what end users have at home. So why not market commercial tech to the consumer in cases like this?

I’m excited to see how this strategy plays out. Check out the video above to learn more!

The post Barstool Sports Implements Yamaha UC Conferencing Equipment as Part of Partnership appeared first on My TechDecisions.

“Temporary workers and independent contractors are by definition intended for short-term and non-core work, and we urge Google to end any abuse of these worker classifications and treat all Google workers equally, ” reads the letter, which is addressed to Google CEO Sundar Pichai.

CNBC’s report of the issue explains that contractors make significantly less than their full-time counterparts, with statistics from GlassDoor showing the median pay for contractors at $90,000 per year and the median pay for full-time employees at $128,000.

“The differences between the categories of workers appears to be in name only, ” the letter continues. “In at least some cases, your company determines where these individuals work, the hours they work, the tasks they perform, and whether or not they should continue to work on Google contracts. In the case of temporary workers, they are commonly working on permanent projects alongside full-time Google employees for years and typically at much lower pay than their full-time employee counterparts.”

The issue runs even deeper than the obvious problems of benefits and salary inequity. Contracted employees have little pull when it comes to workplace discrimination or harassment. The Times told the story of Mindy Cruz, a Google contractor who hoped to one day be brought onto the full-time team, but was fired after rejecting her manager’s sexual advances. 

“I had heard that a lot of times when you say something to your recruiting agency, they just take you out of the situation and put you somewhere else,” Ms. Cruz said. “And I didn’t want my job to go away.” 

Democratic Sens. Sherrod Brown, Patty Murray, Benjamin Cardin, Brian Schatz, Elizabeth Warren, Kamala Harris, Edward Markey, Richard Blumenthal, Richard Durbin and Bernie Sanders, who is an independent but caucuses with the Democrats all signed the letter.

Eileen Naughton, VP of people operations, responded with a letter representing Google’s stance. 

“We are proud to create economic opportunities for both the people we employ directly and our extended workforce of vendors, temporary staff and independent contractors, and believe that our practices in this regard accord with the highest industry standards. Respectfully, we strongly disagree with any suggestion that Google misuses independent contractors or temporary workers,” reads the response letter. “Independent contractors comprise 0.5% of our total workforce and we independently vet all of our independent contractors to ensure they meet the requirements of a 1099 workers.”

The post Senators Call on Google to Hire Long-Term Independent Contractors appeared first on My TechDecisions.