Skip navigation

iStock_000034700658LargePost.jpgIs it me, or this the pace of change accelerating as we speak? I can remember as a kid, the days between Thanksgiving and Christmas just seemed to drag on and on. Christmas would NEVER arrive! Today, as my wife and I follow our time honored tradition of tearing apart the house so we can decorate for the holidays, it seems like yesterday I packed all the tinsel, garland and ornaments away in the closet. It seems like yesterday, the trees were blooming and the grass was greening, now I look across Whitetail Meadow at flurries of snow, the meadow and the forest now shades of brown and grey. Maybe its me and the fact that I have reached the point in life that there is more behind me than ahead, maybe, just maybe, its the world changing at an incredible pace.

Think about how fast technology and communication are changing. In my career, we’ve gone from mainframes that fill rooms, programmed by punch cards, that produce reams of greenbar reports; to client-server, programmed in an alphabet soup of languages, that put the power into the hands of the end user; to the world we live in today with apps, cloud storage, communications so fast our data can be stored anywhere in the world and be instantaneously accessed, with more power in the palm of our hand than the computers just two decades ago.

Even as I sit here writing this blog (ok who knew what a blog was 10 years ago?), I am completely untethered from an cables, in fact I am hurtling down the highway at 70 mph (while my wife drives), fully connected with my Chromebook to Google Drive, my email flowing in and out, my social media streams of Hootsuite, Addvocate, LinkedIn, Facebook and Twitter all current with the up to the second happenings around the world (anybody remember 300 baud, acoustic coupler modems?).  By the way, my cell phone that I am using for my internet connection at the moment is less than six months old and it has already been replaced by a newer, faster, more powerful model.

Over the course of the last twelve months, we have explored many confluences of change impacting technology leaders today. In my series “The CIO is Dead! Long Live the CIO”, we have looked at SMAC (Social, Mobile, Analytics, Cloud), along with marketing technology, appification, gamification and other changes. It is mindboggling! How is a CIO, who is responsible for delivering value to the their business, at the same time protecting its informational assets, all the while “keeping the lights on” for millions of dollars of legacy, equipment supposed to keep up?

There are no easy answers (sorry, if you were looking for one, you will have to look elsewhere, but in the mean on), however focusing on three key areas can make the job a bit easier: People, Partners, Platform.


It has always been important to surround yourself with talented people, however, the faster things change around you, it is paramount to have “the right people in the right seat on the bus” (thanks Jim Collins). You have to build a team that has complementary skills to your own, one that wholeheartedly embraces change, and one that is focused on business from top to bottom.

Obtaining and retaining the right people can be incredibly difficult. Bringing people in who have complementary skills to yours can be frightening, they will be better at some things than you are. Perhaps when you are considering technical skills, this is easier to swallow. After all, the last time I wrote code, I used COBOL on a 3270 Terminal. But what if you brought someone in who was better at building relationships than you, or better at communicating than you, or better at visioning the future than you? It could be very intimidating.

Finding people that embrace change can be very challenging, even in technology. There are many who like to hold on to what they know. Case in point: several years ago we changed our email platform. We moved from a traditional on-premise model to a cloud-based model and a non-traditional provider. Two weeks after our conversion, our senior systems engineer resigned. He had always seen himself as an administrator and expert on our prior platform and could not see himself in an environment without that platform. Contrast that with the senior engineer in my current shop who has embraced Recovery-as-a-Service and Infrastructure-as-a-Service and who in a sense has eliminated a significant portion of his job and his comfort zone. He has re-invented himself into one of the city’s top cloud architects.

Creating a business-first focus instead of a technology focus in a team of career technologists begins with you. You must be focused on the business: its issues and challenges; its strengths and weaknesses; its industry trends. You have to get out from behind your desk and be “in the business”, but more importantly, you have to have an environment in which your team is encouraged to get out and be “in the business”. There is no better way to understand the challenges of being a cashier than to be a cashier. Allowing your team the time to immerse themselves in the business will be critical to your team’s success.


I have written a lot over the last few years about partnership. It is a word that is bandied about in our industry quite a bit. Vendors say they want to be your partner. You say you want partners not vendors. What does it really mean? In my post “Three Keys to a Lasting Relationship”, I talk about Partnership, Transparency and Trust. I won’t go into detail here (hey, you could click the link and read all about it), but I want to add, that it starts with you Mr. or Ms. CIO. If you want a partner relationship with your vendors, you have to be the one to start to be transparent and to exhibit trust.

Partners can be an excellent resource to dealing with the pace of change. They are out in the trenches where change is happening, where the new is being implemented, on the cutting edge. They have the scars to prove it. Leverage your partners for the skills you don’t have in-house. Since you already have all the right people on the bus, they are probably skills you don’t want to own, such as legacy systems support; or they are new skills your team has not yet acquired and you need a jump start.


OK, I could have used the term “cloud”, but I would have lost the alliteration of People, Partners, Platform. The lowering cost and the blazing speeds of communication have provided the ability to put your data and applications virtually anywhere in the world. The cloud model has provided the ability to “pay for what you use” to an extent never before possible.

Moving to a cloud-based delivery model (in this instance, I am referring to “true cloud”: someone else’s hardware, someone else’s data center) unlocks two parts of the holy grail of IT: agility and elasticity.

Agility means your team can respond to the pace of change in business and the pace of change in technology. The underlying hardware and OS layer become almost irrelevant, or at the very least, someone else’s headache. Your team can be focused on spending time in the business to learn and understand the challenges. They can be focused on the A-C projects, not the C-F projects (thanks Andrew McAfee).

Elasticity means you can expand as your business expands. It can be done smoothly on a growth curve as opposed to the traditional stairstep approach where you always have too much or too little capacity. However it also provides the ability to contract when needed. I know, no one likes to think about their business contracting, happens a lot! Having the ability to pay for what you use provides the ability to scale down when needed so you are ready to leverage the next growth cycle when it comes.

While the pace of change is not likely to slow down anytime soon, leveraging People, Partners, and Platform can help you with the peace of mind that you CAN keep up, maybe even stay a step ahead.

This is a continuation of a series of posts titled “The CIO is Dead! Long Live the CIO!” looking at the confluence of changes impacting the CIO and IT leadership. #CIOisDead. Next up “It's a Small World After All - Globalization and the Impact on the CIO”.

Jeffrey Ton is the SVP of Corporate Connectivity and Chief Information Officer for Goodwill Industries of Central Indiana, providing vision and leadership in the continued development and implementation of the enterprise-wide information technology and marketing portfolios, including applications, information & data management, infrastructure, security and telecommunications.

Find him on LinkedIn.

Follow him on Twitter (@jtongici)

Add him to your circles on Google+

Check out more of his posts on Intel's IT Peer Network

Read more from Jeff on Rivers of Thought

2015 Predictions.jpgCybersecurity is poised for a notorious year.  The computer security industry had a tumultuous 2014, with significant breaches, compromises, and vulnerabilities permeating the news.  Governments, businesses, and huge swaths of everyday people were affected.  In the next twelve to eighteen months will see even greater, bolder, and more complex attacks emerge. 

This year’s installment for the top computer security predictions highlights how the threats are advancing, outpacing defenders, and the landscape is becoming more professional and organized.  New targets will emerge and the expectations of security will rise.  As the industry changes, there will be struggles, setbacks, victories, and surprises.  Although the view of our cybersecurity future is obscured, one thing is for certain, it will be an exciting ride.

Top 10 Predictions:

  1. Cyber warfare becomes legitimate

    Governments will leverage their professional cyber warfare assets as a recognized and accepted tool for governmental policy.  For many years governments have been investing in cyber warfare capabilities and these resources will begin to pay dividends.  Most activities will remain discrete, but governments will not be apologetic when activities become public.  Such national capabilities are another instrument, complementing traditional military and espionage resources, for leaders to use in driving international policy.  State sponsored attacks will rise globally, supporting various foreign policy agendas, as will intelligence and surveillance activities.

  2. Active government intervention

    Governments will be more actively involved in responding to major hacking events effecting their citizens.  The increased law enforcement resources for investigative and forensics functions will aid local authorities and enterprises of key economic and infrastructure organizations, in identifying and prosecuting attackers.  Expect government response and reprisals to foreign nation-state attacks, which ordinary business enterprises are not in a position to act or counter.  This is a shift in policy, both timely and necessary to protect how the public enjoys life under the protection of a common defense.  They may also take on the role as public advocate to point fingers and direct blame, something few companies want to do themselves.  This will also be the year which cybersecurity regulations, specifically in response to recognized attacks, emerge and get ratified much faster.  Although, the term ‘faster’ is of course relative in comparison to the normal time it takes to pass cyber related regulations.  Overall, governments will take a more active and public role to investigate, prosecute, and respond to significant cyber-attacks.

  3. Security talent in great demand

    The demand for security professionals is at an all-time high, but the workforce pool is largely barren of qualified candidates.  A lack of security workforce talent, especially in leadership roles, is a severe impediment to organizations in desperate need to build and staff an in-house teams.  The best talent has been scooped up.  Universities are trying desperately to fill the gaps but are having difficulty in delivering the needed knowledgeable and experienced personnel.  We will see many top level security professionals jump between organizations as big companies are willing to lure them with better compensation packages.  The demand will drive a rise in salary for cybersecurity professionals, drawing in more recruits.  Eventually, the pipeline of professionals will grow to meet demand, but that will not happen in 2015.  Those seeking to fill roles should plan accordingly.  Organizations will struggle in filling crucial security roles to protect their business and customers. 

  4. High profile attacks continue

    High profile targets will continue to be victimized.    As long as the return is high for attackers while the effort remains reasonable, they will continue to target prominent organizations.  Two types of victims exist, those who have something of significant value and those who are easy targets.  As it stands, many large organizations are both easy to compromise and have tremendous value to attackers.  Expect more business data theft, forgery, impersonation, and hijacking.  Also expect a resurgence of social activists expressing themselves through hacking, in more creative ways than just Denial-of-Service attacks.

    The financial industry, although tougher from experience from the past few years of being targeted, will see new attacks intensify.  Bank and credit cards remain the easiest to compromise and fraudulently use.  Although they will feel more pain, their efforts are making a difference and lessening lower classes of attacks overall.  Unfortunately, advanced and directed attacks will continue to be successful.  Lastly, we will see more nation-state sponsored cyber warfare attacks against governments and their defense apparatus.  The public will see a large variety and number of complex and bold compromises in the next year. 

  5. Attacks get personal

    We will witness an expansion in strategies in the next year, with attackers acting in ways to put individuals directly at risk.  This will take many forms, but the common thread will be a personal feeling of being targeted.  Instead of your bank being compromised, it will be your PC infected to steal your account access.  The most worrisome tactic will be how cyber attackers will seek ways to threaten damage of the physical world and put people in harm’s way.  This may include personal threats, damaging industrial facilities, critical infrastructures, and even tampering with safety controls in devices we operate.  This can put human lives at risk.  Executives, politicians, government officials, and the wealthy will be singled out and targeted more than ever.  Governments will work to monitor political dissidents and effort ways to identify social protesters.  High profile individuals will be threatened with embarrassment, exposing sensitive healthcare, photos, online activities, and communication data.  Everyday citizens will be targeted with malware on their devices to siphon bank information, steal crypto-currency, and to hold their data for ransom.  For many people this year, it will feel like they are being specifically targeted for abuse.

  6. Enterprise risk perspectives change

    Enterprises will overhaul how they view risks.  Serious board level discussions will be commonplace, with a focus on awareness and responsibility.  More attention will be paid to the security of their products and services, with the protection of privacy and customer data beginning to supersede ‘availability’ priorities.  There will be much less tolerance for failure or apathy on the part of the CIO, CSO, and CISO.  

    Changes will be made in how risks are evaluated.  Many more considerations are added to the mix and the overall 'impact' potential rises across the spectrum.  The ‘who’ and ‘why’ of the attackers becomes important, not just ‘how’ the defenses might be breached.  Calculations, now relevant and understandable at the board and C-suite levels, will be included when determining the optimal security posture, thus driving more focus, accountability, funding, and overall visibility.  Enterprise leaders will adapt their perspectives to focus more attention on security as a critical aspect to the sustaining success of the business.

  7. Security competency & attacker innovation increase

    The security and attacker communities will make significant strides forward this year.  Attackers will continue to maintain the initiative and succeed with many different types of attacks against large targets.  Their success will encourage more attacks and bolder endeavors.  Advanced threats will leverage the tremendous computing power from cloud hosting services to accomplish brute force attacks and support the important command, control, and communication infrastructures necessary for broad and complex attacks.  Popular cloud drive services, application stores, and web advertising networks will be used to deliver malware.  Crypto currencies such as Bitcoin will continue to be the preferred economy supporting underground activities, compelling more regulation and oversight.

    Certificate theft will increase as well as the supporting dark markets who peddle and offer up services using them.  Stolen credentials are used to sign malware, making them appear legitimate to slip past network filters and security controls, and in phishing campaigns.  This is a highly effective trust-based attack, leveraging the very security structures initially developed to reinforce confidence when accessing online content.  Rising demand will drive black market prices higher.  Hackers who are adept at compromising networks will realize they can make a quick profit by stealing certificate credentials.  Cybercrime will grow quickly in 2015, outpacing defenses and spurring smarter security practices across the community.

    Security industry innovation will advance as the next wave of investments emerge and begin to gain traction.  Protections for next generation data centers, tools for communication surveillance, attack attribution, threat intelligence, and contextual security controls are a few capabilities which will significantly improve to aid defenders.  The security industry will go through another cycle of consolidation where larger companies absorb smaller start-ups to harvest innovation and point products, to expand established offerings.  Cross technology alliances will form to allow disparate tools to communicate and collaborate together to increase overall effectiveness of cybersecurity postures.  Smarter, not more security, will be the trend.

  8. Malware increases and evolves

    Malware numbers will continue to skyrocket, increase in complexity, and expand more heavily beyond traditional PC devices.  Malware remains the preferred means to control and exploit systems.  Malicious software will continue to grow at a relentless pace, averaging 50%+ year-over-year growth.  More sophistication of the code will make detection, analysis, and permanent eradication more difficult.  Writers protect their most specialized and insidious code with obfuscation techniques, to keep activities stealthy.  This can include the heavy use of encryption, certificates, self-updating, sandbox sensing, system demolition, and self-destruction protocols, all in an effort to make attribution, dissection, and removal problematic. 

    Malware expands to work on more specialized devices, beyond personal computers and traditional server environments.  Industrial, automotive, home devices, phones, tablets, online service environments and even the Apple ecosystem will see more tailored code, putting them at risk. 

    Two types of malware attacks will see a spike.  Ransomeware and theft of banking login credentials will grow significantly to infect end-users devices.  As banks are closing easy avenues of attack in their infrastructure, the end-users become the next easiest path of compromise.  Second, crypto-extortion will expand into a booming market, where malware encrypts users’ data files and holds them for ransom.  Individuals, businesses, and even police departments have succumb to this type of attack.  With hundreds of millions of dollars to be made, organized criminals will commit serious resources to this electronic disease.  The rapid growth and rising complexity of malware will create significant problems for the security industry.

  9. Attacks follow technology growth

    Attackers move into new opportunities as technology broadens to include more users, devices, data, and evolving supporting infrastructures.  As expansion occurs, there is a normal lag for the development and inclusion of security.  This creates a window of opportunity.  Where the value of data, systems, and services increases, threats surely follow.  Expect attackers to explore the emerging world of IoT, wearables, home automation devices, banking and Bitcoin ATM and Point-of-Sale machines, and multi-functional digital display and sale devices.  Attacks against phones will increase and legacy ATM's will become a favorite target for organized crime.  National cyber warfare teams will continue to target communications for intelligence gathering, but will also focus on being able to compromise, monitor and tamper with high-tech industrial controls and critical infrastructures.  Attackers are fast-followers for market shifts, attracted by areas of recognizable value, and will seize the new opportunities driven by the adoption of popular technology.   

  10. Cybersecurity attacks evolve into something ugly

    Cybersecurity is constantly changing and the attacks we see today will be succeeded by more serious incursions in the future.  We will witness the next big step in 2015, with attacks expanding from Denial-of-Service and Data Theft activities to include more sophisticated campaigns of monitoring and manipulation.  Attackers will compromise defenses to gain internal access and establish a beachhead for conducting long-term surveillance and exploitation.  Professional threats will take the time necessary to understand the inner working of their victim and position themselves deliberately to gain from this knowledge. 

    Foregoing the temptation of a quick smash-and-grab of user and credit account data, they will show patience for a more strategic and profitable purpose.  They will begin to tamper with data to manipulate the operations of their host.  Combined with long-term data collection, they will use this capability for a variety of financial gains and as a prelude for more insidious control schemes.

    Imagine what an attacker can accomplish if they had the ability to tamper with transactions occurring within a financial institution, modify the settings of the safety systems in an industrial control environment, or control the communications infrastructures from trusted entities.  This type of integrity attack has not been widely seen to date.  Security controls in this space are weak in the industry.  Detection and recovery will be very problematic, bordering on nightmarish. 

    Welcome to the next evolution of security headaches.

I predict 2015 to be an extraordinary year in cybersecurity.  Attackers will seek great profit and power, while defenders will strive for stability and confidence.  In the middle will be a vicous knife-fight between aggressors and security professionals.  Overall, the world will take security more seriously and begin to act in more strategic ways.  The intentional and deliberate protection of our digital assets, reputation, and capabilities will become a regular part of life and business





Take a look at previous years predictions to see how cybersecurity history has unfolded.




Twitter: @Matt_Rosenquist

IT Peer Network: My Previous Posts