Organizations undergo digital transformation for a variety of reasons, including maximizing insights derived from data, streamlining operations, and adjusting workflows for hybrid work.

There’s no doubting the benefits. But there are potential traps along the road that businesses must also avoid, not least in the form of cyber security risks. 

Typical risks may arise from failing to provide adequate resources to match a project’s ambition, lacking proficiency to handle a multi-cloud setup, and failing to align with security frameworks. These ‘bear traps’ can be more prevalent if digital transformation is rushed, and organizations speeding up their efforts must be double vigilant because, with haste, comes a lack of focus. 

Prioritizing security, not project outcomes

Security must be the primary concern for any organization undergoing digital transformation, says Rick Hemsley, UK&I government and public sector cyber security lead at EY. That’s the bottom line. Organizations need to “integrate security considerations into every aspect of the development of new systems, processes, and products,” and those that fail to do so “will only be able to take a reactive, whack-a-mole approach to cyber security, instead of adopting a proactive mindset”.

There’s more to avoiding traps than putting security at the heart of digital transformation, though. Organizations need to learn to think differently about security too, says Frank Kim, SANS Institute fellow, cloud curriculum lead, and CISO-in-residence at YL Ventures. “A key metric in the past would have been the mean time to failure, or for something bad to happen. 

“But in the modern world, we look at the mean time to recover,” he tells ITPro. “We don’t think about the mean time to failure because we are expected to fail on a regular basis, so recovery is more important.” 

This approach resonates with a new attitude towards risk, where risk can’t be eliminated entirely, but needs to be understood and managed effectively. 

Speeding up processes heightens risk level

Organizations that decide to speed up digital transformation efforts put themselves at greater risk of leaving cyber security gaps waiting to be exploited, says David Sarginson, head of software development at digital transformation consultancy Opencast. “More change means more risk,” Sarginson explains. “The more change you introduce at any time increases complexity, and therefore the chances of unanticipated consequences.”

Further complications arise from organizations having a multi-cloud setup, Kim adds, and staff needs to be familiar with the nuances of different cloud setups, he says. “Your security team must be knowledgeable in a multi-cloud environment in each of these areas including the pitfalls, the configurations, and the mistakes that could be made. Ideally, architect from the start what those best practices are into your infrastructure.” 

When process speeds are accelerated, there’s less time to get to grips with the nuances, and more opportunity for gaps in security to manifest because security likely won’t be baked in at the outset. “[By] designing best practices directly into the infrastructure code and set-up, you’re providing a paved road for internal stakeholders that need to move to the cloud and adopt these processes,” Kim continues. “When you go off the paved road you know when to pay attention a little more.”

Instigating the right culture

Effectively dealing with cyber security risks associated with digital transformation, whether it’s been sped up or it’s happening at a slower pace, requires a risk-based approach from the outset, says Hemsley. The CIO and security teams should have the right level of knowledge and resources to “create a security framework which is defined by proactivity”, he says.

Achieving this might need an element of cultural change, and Kim confirms this isn’t always easy. “An organization can’t change culture overnight,” he says. “Depending on the size and the nature of the organization it takes anywhere from three to ten years to change.” 

Once organizations then undergo a process of risk awareness, sufficient resources must be allocated, and all employees should be trained on cyber security best practice, adds Sarginson. In addition, his advice includes using frameworks, where possible, like the NIST Cybersecurity Framework or ISO 27001. This may help to make implementing protections more efficient by removing the need to work out a security posture from first principles.

Ultimately, avoiding cyber security bear traps involves taking the proper technical steps and the right cultural ones – or as Kim puts it: “It’s not just about implementing new technology, like lift and shift. It’s about building out your people and building out your processes.” 

Risk awareness and risk management are crucial to safeguarding an organization’s assets from cyber attack, according to conventional wisdom. But how effective are these strategies if businesses are now told it’s not a matter of if, but when, disaster strikes? 

This “when, not if” theme arises again and again in modern cyber security discourse – suggesting falling victim to cyber crime is an inevitability. Being targeted, and cyber criminals successfully pulling an attack off, are two different things, though. Risk management and risk awareness are both concepts designed to make life as difficult as possible for an attacker. 

By an entire business engaging in the process of identifying and evaluating potential threats, they can offer organizations a certain base level of protection. While many might question whether these efforts – from not just the security teams – are worth the bother if an attack is ‘inevitable, they might keep organizations just on the right side of a serious incident.

Building risk appetite

Risk awareness and risk management are different things, explains EY’s UK&I government and public sector cyber security lead, Rick Hemsley.

“Whereas risk awareness refers to the proactive measures taken by organizations to educate their employees and stakeholders about potential cyber security risks,” he says, “[risk] management centers around the identification, assessment, and mitigation of potential risks to a company.”

Within these two definitions lie many distinct actions and activities: some technical and some cultural. Among the most important is defining the organization’s risk appetite, ensuring this is understood across the organization, and making sure mitigations are in place that respond to risk appetite. 

Risk appetite is a fundamental element of risk awareness and risk management. You can’t protect against everything. A person leaving their home in the morning might get their pocketbook stolen or there might be a water leak while they’re away. They can insure against loss of credit cards and water damage. But only if they’ve assessed the possibility, and put in place a mitigating strategy. They’ll do neither if they don’t think the risks are worth addressing – which is where risk appetite factors in.

Risk awareness is essential

Risk awareness is arguably the most crucial aspect, says David Adams, Grc security consultant at Prism Infosec. “Risk management won’t be effective if risk awareness is not included as a strategy.” 

Staff entrusted with implementing controls will only live up to expectations if they understand why it’s important to the organization and aware of the risks of not acting. But risk awareness isn’t just something for the tech team to consider. It must be embedded in the thought patterns and working practices across the organization. 

“The risk management strategy may well advise that personnel only work on encrypted personal applications, and in the risk awareness strategy this would be regularly communicated to staff but made relevant to them, perhaps in the form of awareness training,” explains Adams.

Can we measure how effective risk management is?

One of the issues around promoting risk awareness through an organization is it’s not always easy to measure. A risk management strategy of, say, using threat analysis to identify attempted cyber attacks, and showing which attacks are thwarted, can generate data used to demonstrate how effective these systems are and justify spending on them. 

It’s more difficult to measure the effectiveness of risk awareness in this way. An organization can, howeer, test how well its people understand the various risks it’s identified, and measure how they implement approved behaviors. It can ealso nsure that strong systems are in place, for example by implementing a zero trust framework for technology. 

Frequent and overt testing, as well as measuring people’s attitudes towards risk, can itself alienate staff, as can putting in place technology requirements that feel intrusive to actually getting work done. 

The goal should be to guard the organization, not to corral its people. And, in any case, we can’t compare two real-world scenarios – with and without a strong risk awareness strategy in place – to quantify the effect of the strategy.

Does risk management make a difference?

What organizations can do is be aware of the risks humans bring. Last year, the World Economic Forum (WEF) said 95% of cyber security  issues could be traced to human error. 

Normalising appropriate behaviours can help an organization diminish the risk of human error by increasing awareness of the consequences of certain actions – or absence of certain actions. 

The key is for the organization to ensure people feel part of the strategy, not that the strategy is foisted upon them. “A good risk awareness strategy helps create a security-conscious culture across the company, making it more resilient against attacks,” Hemsley tells ITPro. 

Adams puts it another way: “Security is the responsibility of us all and people are now much more conscious of this fact. But when it comes to the individual, relevance is key. It’s vital to make the strategy meaningful to staff.”

In the end risk awareness is a key component of how an organization handles the risks its exposed to. When the organization’s people are aware of these risks, and understand how their individual actions can help – or hinder – the organization in facing up to the very real prospect of attacks, they can play a part in mitigation. 

When cyber attacks are a matter of when, not if, every possible strategy and mitigation that helps an organization deal with its appetite for risk is a strategy worth having, regardless of how much effort it might take to implement.

The disruptions of recent years have opened our eyes to entire new categories of risks, both seriously affecting business operations and negatively impacting customer experiences. A failure to respond to these threats can have a significant effect on the future of the organisation.

This paper highlights the need to transform legacy risk management approaches, and shares three key pillars that can enable businesses to proactively respond to, and overcome, the risks they face.

Download now to learn how to get ahead of the curve with real-time risk visibility, how to ensure risk management is a company-wide responsibility, and how internal audits can improve risk posture.

Provided by  ServiceNow

Digital transformation creates a variety of new opportunities, but unfortunately can also result in the increase of risks, and the more an enterprise can understand the risks it faces - especially as a company-wide initiative - the more successful their digitisation will be.

This special edition guide can help your employees better understand how they can be part of a successful digital risk management strategy, with practical advice on how to apply learnings to real risk management situations.

Download now to learn:

• The basics of risk identification and management
• How to manage digital risk
• As well as five tips for successful digital transformation

Provided by

A major hardware organisation has implied that Nvidia is at fault for the widely reported instances of melting power cables on its new RTX 4090 graphics cards.

Nvidia's latest line of GPUs was released in October but their power cables have been mired in reports of extreme thermal faults leading to some users’ cables smoking or melting entirely.

Specifically, the GPUs' 16-pin 12VHPWR power cable, which adopts the new ATX 3.0 PSU standard released this year, has been identified as the core issue at play. Nvidia investigated the circa 50 extreme cases reported to it and concluded that “a common issue is that connectors are not fully plugged into the graphics card” - an issue of user error.

However, the Peripheral Component Interconnect Special Interest Group (PCI-SIG), a tech consortium which created the new power standard, and whose board includes representatives from companies including AMD, Arm, IBM, Intel, and Nvidia itself, has sought to distance itself from Nvidia’s claims.

It stated firms are responsible for rigorously testing their own hardware, and referenced an affected individual who has filed a class action lawsuit against Nvidia in a California district court.

"PCI-SIG wishes to impress upon all members that manufacture, market, or sell PCI-SIG technologies (including 12VHPWR connections) of the need to take all appropriate and prudent measures to ensure end-user safety, including testing for the reported problem cases involving consumers as alleged in the above-referenced lawsuit," the group said in a statement to the press.

“Members are reminded that PCI-SIG specifications provide necessary technical information for interoperability and do not attempt to address proper design, manufacturing methods, materials, safety testing, safety tolerances or workmanship. When implementing a PCI-SIG specification, members are responsible for the design, manufacturing, and testing, including safety testing, of their products.”

In the lawsuit (PDF), the plaintiff alleged that Nvidia “marketed and sold the RTX 4090 with a defective and dangerous power cable plug and socket, which has rendered consumers’ cards inoperable and poses a serious electrical and fire hazard for each and every purchaser”.

PC hardware reviews channel Gamers Nexus replicated the fault through the improper connection of the connector to the graphics card, and recorded the card reaching temperatures as high as 250ºC.

The group analysed cables sent in by affected viewers and determined that wear and tear proved the cables had been inserted at an angle, or with pins loose.

Despite this, in lieu of an audible ‘click’ when the cable is inserted properly, the reviewers noted that it’s very possible for a user to accidentally install the card insecurely. They also warned that those tinkering with cables after hearing about the issue might be opening themselves up to failure.

The 12VHPWR is a new power standard and used in Nvidia’s RTX 4080 and 4090 cards in place of the two eight-pin connectors that were used with the firm’s older cards. Rival AMD still utilises this older solution, having opted against including the 12VHPWR on its newest cards.

PCI-SIG’s statement is seemingly aimed at quashing fears that the thermal problems are endemic to the new standard.

IT Pro has approached Nvidia for comment.

In today’s hybrid working world, with the increased number of devices, data and systems, the risk to global IT is significant, making the regulatory environment more complex.

With IT leaders facing more challenges than ever before, the differing regulations and compliance frameworks means a vast amount of work for an often resource-limited team. But being able to get to a stage of IT compliance, ready for audit, is achievable with the right technology.

Download this whitepaper to understand the key components when it comes to being IT audit-ready - including process, technology, and people - with clear steps to follow, ensuring your business gets there.

Provided by

Key risk indicators (KRIs) can help predict adverse events that may impact your organisation and are widely considered an essential part of good governance. These indicators link to a range of operational risk-management activities and processes, making them especially beneficial as metrics of changes in a company’s risk profile.

Here, you’ll learn how to implement, manage and maintain KRIs within your IT department:

• Choosing appropriate KRIs can benefit your organisation
• Examples of effective KRIs
• KRIs/KRI selection worksheet
• Implementing automated reporting

Provided by

While it’s easy to see the benefits of bringing third parties on board – higher revenues and lower costs - outsourcing can introduce a significant threat of risk that can bring long-term reputational and financial damage to your organisation.

In this e-book, you’ll learn about the challenges of third-party risk management, the differences between vendor risk management (VRM) and third-party risk management (TPRM) and discover a framework to help mitigate this risk:

• Essentials of third-party risk management
• Ways third parties can introduce risk
• Real-life third-party failures
• Robust TRPM framework to ensure good governance

Provided by

The Cyber Resilience Think Tank is an independent group of industry influencers dedicated to understanding the cyber resilience challenges facing organisations and providing possible solutions, with this paper in particular focussing on AI.

For CISOs using vendors that employ AI, it’s less about what intelligence their tools provide, and more about how the organisation’s internal security team can integrate external AI tool findings into their broader security programs.

Provided by

The most productive security teams are going beyond the use of tactical tools for investigation and reporting of security incidents. Instead, they are taking a more strategic, proactive, platform-oriented approach to identifying and assessing security-related risks, proving compliance, and maturing the flexibility and resilience of ongoing operations.

Read this report to learn about the evolution of security monitoring capabilities and discover what comprehensive security technologies companies are investing in to support their work from anywhere (WFA) / hybrid work model.

Provided by

Marsh McLennan has announced the launch of its cyber risk analytics center to help clients better understand the risks they face.

In addition to providing a holistic view of cyber threats, the platform helps businesses evaluate the effectiveness of existing and prospective control mechanisms, economic impacts of risks, and more.

The center integrates the cyber security capabilities of Marsh McLennan’s Marsh, Guy Carpenter, Mercer, and Oliver Wyman businesses.

Commenting on available features, Marsh McLennan said its analytics center delivers a comprehensive suite of tools and critical risk insights, ranging from malicious code to complex webs of digital connections.

Per reports, the center will be led by the firm's managing director Scott Stransky.

Marsh McLennan's global network of commercial, government, and academic partners will also assist with research and development through the center.

“Cyberattacks routinely cause millions of dollars in loss to our clients and billions of dollars in loss to the global economy every year. It is no surprise that business, government, and other leaders continue to rank cyber risk as one of the most pervasive and urgent risks for society,” said John Doyle, president and CEO of Marsh and vice chairman at Marsh McLennan.

Doyle added, “For many leaders, however, their concern exceeds their ability to measure and manage cyber risk alone. Our investment in the Marsh McLennan Cyber Risk Analytics Center will help clients confront this risk by connecting them with experts and capabilities from across our businesses, data-driven insights, and a global ecosystem of risk and cybersecurity experts.”

Lastly, the firm aims to enhance the cyber modeling and analytics ecosystem, so clients can make informed decisions about how they identify, prepare for, and recover from cyber risk.

Bigleaf Networks has announced a new AI-based feature called Risk Monitoring within its Cloud-first SD-WAN platform. The feature addresses the most pressing problem IT companies face today: high risk-alert noise.

"The complexity of networks in today's IT-lean enterprises where they have tens or hundreds of cloud applications running across hundreds or thousands of branch and home internet connections has reached a point where all sense of control and excellence has been lost," said Joel Mulkey, co-founder and CEO, Bigleaf.

"People can't process and troubleshoot the volume of alerts and events on networks anymore. It's not a matter of not wanting to. It's that there's simply too much information, most of which is noise. You've got to have intelligent software to solve this problem. By building a platform that takes control of processing and interpreting those events, we've now established true network control for our customers."

Through contextual alerting, Bigleaf’s Risk Monitoring feature allows companies to reduce the unabating noise. The widget translates high-volume network events into prioritised, actionable risks, slashing the risk-alert noise levels by almost 50%.

Proving its point further, Bigleaf exposed as many as 12 risks in the initial launch of its new feature. The risks include, among others, extended periods of elevated health alarm levels, critical traffic volume exceeding the capacity of backup circuits and site outage.

The feature can also highlight the top three risks out of all risks triggered by a site. Each risk alert presents an easy-to-understand explanation of a threat and how to solve it to allow quick decision-making. Any scenario that poses a risk to a customer's business or its site's continuity will trigger an alert.

"This new feature brings incredible relief to daily pain our customers and others in the industry feel. It also brings significant value to our MSP partners who now have a tool that lets them see risks across all of the companies they manage and helps them better determine where they should spend their limited time and resources to keep their customers happy," continued Mulkey.

Existing Bigleaf customers can access the feature by logging into their Bigleaf web dashboard.

Less than half of small technology businesses consider themselves to be ready to face a no-deal Brexit on 31 October, with an economic slowdown and difficulties hiring staff chief among their concerns.

Larger businesses generally consider themselves to be much better prepared for an abrupt exit from the EU, with 87% reporting they're fairly or very prepared, according to research from techUK.

This contrasts wildly with the state of Britain's small businesses, of which 43% deem themselves to be ready, as do 50% of medium-sized companies.

As for general confidence, 71% of techUK members responded to questions suggesting no-deal will have a negative impact on their businesses. This is a slight rise against 69% when they were previously asked in December 2018.

"Being unable to predict the implication of no-deal is the most frequently cited reason amongst those taking no active steps to prepare," Vinous Ali, techUK associate director for policy told IT Pro.

Although 68% of enterprises reported they were aware of guidance issued by government, only 30% of small businesses and 33% of medium-sized businesses felt they were up to date.

TechUK was unable to specify what actions businesses have been taking to prepare for a no-deal Brexit, however, it said that "anecdotally we know there are various things members have been doing to prepare whether that be stockpiling products and parts or updating contracts; inserting standard contractual clauses to guarantee continued free data flow".

The main concerns facing businesses in the event of no deal include the overall impact on the economy, as well as the confusion and uncertainty over various elements of regulatory compliance. Businesses are also anxious over the difficulty in finding staff once freedom of movement ends, and additional regulatory barriers established that hinder trade.

The free flow of personal data, meanwhile, is another key concern for businesses, especially considering the fact that data arrangements post-Brexit have not yet been ascertained.

The readiness of certain businesses also varies depending on the nature of their work. For instance, organisations that do not rely on data transfers, nor trade beyond the UK border, may not require extensive preparations. Businesses that rely heavily on supply chains, meanwhile, are likely to face far greater disruption.

The Information Commissioner's Office (ICO) reissued further guidance yesterday in light of the developing political situation and likeliness of a no-deal Brexit, urging smaller businesses to prepare for every eventuality.

The data regulator still advises businesses to adopt standard contractual clauses where possible, but the validity of this mechanism is currently being considered by the European Court of Justice (ECJ). If SCCs are ruled universally invalid, businesses could be left without a legal means to receive data from the EU.

Failures in 11 health screening programmes across the UK are fundamentally connected to a "hopeless" IT system that will have been deemed inadequate for the best part of a decade when it is due to be replaced in 2020.

All health screening programmes, such as tests for breast cancer and cervical cancer, have relied on a single IT system that was deemed "not fit for purpose" for health screening by the Department for Health and Social Care (DHSC) in 2011.

And dependency on the National Health Application and Infrastructure Services (NHAIS) is the reason why health screening programmes are failing to test enough people with potentially life-threatening conditions, according to the Public Accounts Committee (PAC).

"The benefits of screening cannot be under-estimated: if found at an early stage, treatment can be significantly more effective," said PAC chair Meg Hillier MP.

"Yet millions of people are not being screened for serious illnesses like bowel, breast and cervical cancer.

"Our inquiry has exposed a health service that is losing its grip on health screening programmes. Many individuals waiting for delayed results will suffer avoidable anxiety, stress and uncertainty. Those delays also stretch far beyond the Department's target waiting periods."

The PAC examined statistics relating to four of the 11 programmes during 2017/18 as a measure for how screening is performing generally. They found the number of individuals being screened fell well sort of national targets, and that a swathe of eligible people had not even been invited to begin with.

NHS England told the committee during inquiry stages that reliance on NHAIS, which itself comprises 83 separate databases, was a key weakness, while Public Health England said the "IT was hopeless" when questioned.

The DHSC also admitted in 2011 that NHAIS was "not fit for purpose" to function in screening programmes because it was difficult to track a person's history if they moved across geographical boundaries.

NHS England, which has been tasked with overseeing these screening programmes and in some cases the supporting IT system, is not expected to replace NHAIS until at least 2020. This is three years later than initially planned and will cost 14 million.

The delay is attributable to the fact NHS England was working on the replacement project with outsourcing giant Capita. But after the organisation declared it could no longer work with the firm, NHS Digital has taken on the responsibility for replacing NHAIS.

The state of the cervical cancer screening programme, in particular, is alarming given its reliance on 360 IT systems in total including the 83 databases comprising NHAIS and a further 270 that deal with invites, reminders, analysis and results. Some of these systems are more than 30 years old.

The PAC has recommended that NHS England sets out a clear pathway for how it plans to deliver the new IT system, deemed a "risky" project, on time without making the screening service even worse.

The influential committee of MPs also suggested that Public Health England and NHS England develop a more integrated approach to its IT to ensure these disparate systems talk to each and deliver the best service for patients.

IT Pro approached NHS England, NHS Digital and DHSC for comment.

Six of the eight IT systems critical to border control after the UK leaves the European Union (EU) are at risk of failure, despite less than a month until the official withdrawal date.

There has been some progress on delivery since these systems were first assessed last year, according to the National Audit Office (NAO). But a host of systems the border delivery group (BDG), a cross-government committee managing the projects, deemed key to border control are at "significant risk" of not being embedded in time for Brexit on 29 March.

A memorandum, released this week, provides an update on the progress relating to the issues flagged in its initial report published in October 2018.

Beyond functionality, the delivery risks include the need to ensure traders are ready to use the systems, as well as to ensure the right infrastructure and resources are in place to support their use.

The NAO's latest assessment of border systems has divided risk into two categories, IT and process, against a single view of risk in the last update in autumn.

The six IT systems at risk include the Import of Products, Animals, Food and Feed System (IPAFFS) and Automatic Licence Verification System (ALVS), both listed as amber-red, as well as the roll-on, roll-off (RORO) customs system, deemed amber.

Alarmingly, the contingency plan for IPAFFS is also deemed at risk of not being ready in time, with its IT status rated amber, and process rated amber-red.

This infrastructure is all to some degree co-dependent, moreover, which has heightened risk across the board. One system that may be in a healthier position, for instance, but that also relies on another deemed 'high risk', would render the first at risk of failure as well.

For example, while the IPAFFS is designed to identify and record the results of biosecurity checks, it must also share these via ALVS with the Customs Handling of Import and Export Freight (CHIEF) system.

Meg Hillier MP, chair of the House of Commons' Public Accounts Committee (PAC), which published the NAO report, branded the findings as "alarming".

"The NAO's memorandum shows that with the clock ticking down there remain serious questions about whether the UK will be prepared at the border if there is 'no deal' and what this would mean for individuals and businesses," she said.

"The Public Accounts Committee will be pressing HMRC for answers on preparations for EU exit next week."

As things stand the UK is set to leave the EU without a deal in less than 30 days, barring developments in Parliament. These possibilities including a last-minute withdrawal agreement, or an extension of Article 50.

But NAO has treated 29 March as 'day zero' in its report, with a handful of the most critical systems declared as "at risk of not being delivered to time and to acceptable quality".

"In seeking to reduce the risk to the operation of the border in the event of 'no deal', BDG and departments have focused on putting in place the minimum necessary requirements for 'day one'" the report recommended.

"This includes introducing arrangements that departments believe will facilitate trade across the UK border while still seeking to meet legislative requirements."

For the last couple of years, parliament's PAC has been scrutinising the state of post-Brexit IT systems that are being managed by various departments, including the Department for Environment, Food and Rural Affairs (Defra).

In November last year, the PAC blasted the department for failing to test six critical IT systems that are meant to be in place by the end of March.

These included the system now known as IPAFFS, which is being built to replace the existing Trace Control and Export System (TRACES).

Meanwhile, HMRC's CHIEF has long-expected to be replaced with an alternative system dubbed CDS, the Customs Declaration System. But progress on this had to now been minimal, with Hillier writing to HMRC in October 2018 expressing disappointment that its timing had been slipping.

CDS was expected to be the main system to come into force in the event of a no-deal Brexit, with CHIEF running in parallel until all traders had migrated to the new regime. But HMRC decided last month to use CHIEF as its primary system "because of delays with CDS and concerns from key users including software developers".

A senior Apple lawyer entrusted to oversee the company's safeguards against employee insider trading has been charged with using confidential information to illicitly earn more than half a million dollars.

Gene Levoff allegedly used information about prospective movements in Apple's share price to earn more than $600,000 between 2011 and 2016, according to the US Securities and Exchange Commission (SEC).

Levoff, who was fired from his post as Apple's senior director of corporate law last September, was tasked with ensuring the firm's employees themselves didn't violate US insider trading laws.

But in court filings submitted yesterday, the SEC accused Levoff of making a series of illegal trades during his time with the company that led to profits of $227,000 and avoiding losses of 377,000. These trades amount to violations of the 1934 Securities Exchange Act.

"Levoff was an insider who owed a duty of trust and confidence to Apple and its shareholders not to trade on the basis of material nonpublic information that he learned through his position at Apple," the filings said.

"Further, as a member of the core group of senior Apple insiders entrusted with material nonpublic information, and as an attorney with a sophisticated understanding of securities and corporate law, Levoff knew, or was reckless in not knowing, that he had a duty of trust and confidence to the company and its shareholders."

As part of his role, Levoff set the criteria for employees, himself included, who were restricted from trading around quarterly earnings announcements. He was also party to non-public information about Apple's financial results as part of the company's Disclosure Committee.

He was, therefore, able to make profits and avoid losses on such a scale by buying and selling Apple stock in light of information that Apple's share price movement before this was made public.

For example, on at least three specific instances between 2015 and 2016, the SEC alleges, Levoff profited and avoid losses of approximately $382,000.

On one occasion, in July 2015, he was tipped off that Apple would miss analysts' estimates for iPhone sales, and sold approximately $10 million in Apple stock, ahead of what transpired to be a 4% share price fall. As a result, he avoided losses of $345,000.

Beyond maintaining Apple's procedures, including a 'blackout' around the time financial results were released, the SEC outlined how Levoff personally sent memos to employees warning against engaging insider trading despite insider trading at that time himself.

For example, Levoff sent an email to Apple employees explaining that a blackout period would last from 1 March 2011, and remain in effect "until 60 hours after earnings are released in April 2011".

The email written in all-caps stated: "REMEMBER, TRADING IS NOT PERMITTED, WHETHER OR NOT IN AN OPEN TRADING WINDOW, IF YOU POSSESS OR HAVE ACCESS TO MATERIAL INFORMATION THAT HAS NOT BEEN DISCLOSED PUBLICLY."

The SEC identified two such occasions in 2011 on which he sent such emails immediately prior to insider trading.

"Levoff's alleged exploitation of his access to Apple's financial information was particularly egregious given his responsibility for implementing the company's insider trading compliance policy," said the SEC's associate director of enforcement Antonia Chion.

"The SEC is committed to pursuing insiders who breach their duties to investors."

The complaint charges Levoff with fraud and is seeking the return of his trading profits plus interest, penalties, and a permanent injunction. The US Attorney's Office has also announced criminal charges.

Levoff's lawyer Kevin Marino told CNBC he was reviewing the allegations and looked forward to defending his client. Gene Levoff has denied wrongdoing.

Glitches with an IT system used across the NHS posed a "significant" clinical risk to patients, with thousands of health records left out-of-date.

The NHS discovered two errors this summer with TPP's SystmOne platform, used by more than 2,600 GP practices in England, including one failure that may have led to patients being given the wrong treatment or medication.

According to publicly-available board papers published on the NHS Digital website, seen by Health Service Journal (HSJ) and since seen by IT Pro, an error discovered on 14 August meant prescriptions cancelled using SystmOne were not cancelled on other systems. This includes SPINE, a platform predominantly by social care organisations and pharmacies.

A separate glitch, discovered just three days later, meant updates to patient records on TPP's platform were not carried over to their summary care record, an electronic patient record for patients in England held centrally by the NHS and accessed by clinicians.

"The clinical impact has been assessed as major due to the potential for the incorrect or inappropriate medication being provided to patients," the papers said of the first failure.

"The business impact is that practices are required to carry out clinical tasks from TPP in order to cancel the prescriptions. Practices may also have to contact pharmacies if the cancellation has been unsuccessful. Clinicians may also need to carry out a consultation with the affected patients."

Of the second error, the papers added the clinical risk was "significant" because incomplete or out-of-date patient information may have led a clinician to provide "inappropriate care".

The papers were being used to brief an NHS Digital board meeting on Wednesday. According to the briefing, both errors persisted for at least four weeks and were present in the system as of 12 September, the papers added. Its persistence "significantly" breached the four-hour service level agreement (SLA).

An NHS Digital spokesperson said the organisation would not be commenting on the failures, but confirmed it was aware of the issues and has been working with TPP towards resolving them. The spokesperson did not confirm whether the issues had been resolved.

These failures are the second and third major glitches with TPP's SystmOne platform that have come to light in the last few months, after ministers revealed in July that a separate IT failure led up to 150,000 patients' data being shared against their will.

Prior to the rollout of a new national data sharing opt-out tool, which has been launched in beta, an issue with the previous system handled by TPP led to a vast number of data-sharing objections not being submitted to NHS Digital's central service.

The coding error meant 150,000 preferences set between March 2015 and June 2018 in GP practices running SystmOne software were not sent to NHS Digital.

NHS Digital's CEO Sarah Wilkinson told the board on Wednesday she was "very disappointed" as this was likely to damage public trust in how data-sharing opt-outs are handled in future. She reassured attendees the new system is not reliant on third-party providers such as TPP used by GPs, and will instead rely on an in-house platform.

The first glitch concerning repeat prescriptions not showing as cancelled, highlighted by the paper, raises concerns in light of plans announced this week to introduce a new digital system to administer free prescriptions to patients.

A new system to verify patient identity in real-time, and automate certain functions, is being developed in an effort to clamp down on prescription fraud in England, which the government says is worth 256.1 million per year.

But the move was criticised by health experts who are concerned that various IT failures, exemplified by the one detected in August, may inadvertently lead to patients being charged for medication that they are entitled to for free.

"What if the computer says no?" said the chair of the board for the Royal Pharmaceutical Society in England Sandra Gidley, speaking with BBC Breakfast.

"This is a real dilemma. Because sometimes somebody has free prescriptions legitimately - they've got a medical exemption - they're something like a diabetic, they might forget to renew it, computer says no, you're not going to deny a diabetic their insulin, for example.

"This is potentially fraught with problems and we can't get the NHS systems talking to each other at the moment, so how the secretary of state thinks he's going to manage it for the Department for Work and Pensions (DWP) and other agencies when they can't even get Universal Credit (UC) right is slightly mystifying."

IT Pro approached TPP for comment but the company did not respond at the time of writing. A spokesperson told HSJ both errors have been fixed, and that the firm was working with GP practices to ensure any incorrect prescriptions or records were corrected.

A 330 million deal between NHS England and Capita to outsource administration and transform services, in part due to a legacy IT system NHS England considered unsustainable, had the potential to seriously harm patients.

The National Audit Office (NAO) slammed the seven-year deal struck in 2015 with Capita, a professional services firm, to undertake the duties of a newly formed unit named Primary Care Support England (PCSE) - all while cutting costs by 35%.

The NAO said neither NHS England nor Capita "fully understood the complexity and variation" of the service, which involved performing a range of back-office functions to support around 39,000 primary care practitioners including administering payments to GP practices, opticians and pharmacies; delivering pensions, ordering supplies and moving patients' medical records.

The NAO concluded: "The service to primary care practitioners, including Capita's delivery of PCSE, has fallen a long way below an acceptable standard. This had an impact on the delivery of primary care services and had the potential to seriously harm patients."

The report highlighted one instance of 87 women incorrectly told they were no longer part of the cervical cancer screening programme. Capita says the wrong letter was sent by mistake following an incorrect mail merge, and that the women affected were promptly issued correction letters.

NHS England undertook these back-office functions in April 2013, having previously been performed locally by primary care trusts, which were abolished in an NHS restructuring. These services, comprising 1,650 staff across 47 offices, were fragmented, and lacked coherent leadership or standards, according to the 51-page report, leading to variation in delivery.

Moreover, NHS England felt the 20-year-old IT system running across 82 databases was in urgent need of replacement, with the organisation concluding it "did not have the necessary skills in transforming services through better use of IT"; deciding to outsource the service to a private company.

As part of the deal, NHS England hoped to instigate digital transformation and deliver high-quality support services, all while reducing costs by 35% in the first year - aims the NAO branded "ambitious". The objectives involved moving services from 38 sites across England to three, opening a national customer support centre, and introducing an online portal to provide access to manage PCSE services, among others.

The terms of the deal also aimed to invest in new, modern information technology and updated processes.

"Neither NHS England nor Capita fully understood the complexity and variation of the services being outsourced," said Amyas Morse, the head of the NAO. "As a result, both parties misjudged the scale and nature of the risk in outsourcing these services.

"While NHS England has achieved financial savings and some services have now improved, value for money is about more than just cost reduction. It is deeply unsatisfactory that, two and a half years into the contract, NHS England and Capita have not yet reached the level of partnership working required to make a contract like this work effectively."

In February 2018 there were seven severe service failures recorded against performance indicators, while NHS England applied 5.3 million in contract penalties between January 2016 and April 2017.

NHS England has made savings, in line with expectations, of 60 million in the first two years of the contract, as the financial risk of increased costs sits with Capita who have made a 125 million loss over this period, according to the NAO.

A Capita spokesperson said the report concluded the complex nature of the support services outsourced by NHS England was not fully understood at the time the contract was signed.

"The report notes that several organisations and legacy issues all contributed to underperformance," she said.

"It has been acknowledged that performance has improved and Capita will continue to work with all parties to address the remaining service issues. We have accepted accountability for not meeting our high standards of service previously.

"Our new Chief Executive has made it clear that Capita previously has taken on some contracts that contained too many unknowns. Our new strategy will ensure we focus on doing fewer things better and securing business that we know can be delivered well."

This isn't the first time Capita has failed to deliver on a major government IT contract. In 2014 the Ministry of Defence (MoD) came under fire for wasting millions of pounds on the delayed deployment of an online recruitment tool for the military. The system, which was run by Capita, only went live in 2017 - five years after the deal was first signed, and was reportedly riddled with bugs.

The company, described as Britain's biggest outsourcing company, has failed to win a single government contract since it issued a shock profit warning in January that subsequently wiped 1 billion of its share values in one day. Only last month the ailing professional services firm also declared a pre-tax loss of 513 million for 2017.

IT Pro approached NHS England for comment.

Up to 270 women may have died after an NHS computer algorithm error resulted in missed breast cancer screenings, health secretary Jeremy Hunt admitted yesterday.

The "serious failure" in the code governing the NHS's national breast screening programme occurred in 2009, but only came to light when Public Health England (PHE) analysed the service earlier this year.

That meant that 450,000 women who should have been invited to breast cancer screenings from 2009 to the start of 2018 were not.

Hunt estimated that between 135 and 270 women may have "had their lives shortened" because of the error.

Hunt told the House of Commons: "At this stage, it is unclear whether any delay in diagnosis will have resulted in any avoidable harm or death, and that is one of the reasons I am ordering an independent review to establish the clinical impact.

"Tragically, there are likely to be some people in this group who would have been alive today if the failure had not happened."

Of the half a million women who should have been invited to a scan, an estimated 309,000 are still alive. The Department of Health is sending letters to 65,000 of them this week, and intends to contact all those registered with a GP by the end of the month.

The IT failure - which concerned how age parameters were programmed into the system - was resolved on 1 April, PHE said, and won't affect patients in future.

PHE found the problem when an upgrade to the breast screening invitation IT system gave local services more granular data on the ages of women being invited to screenings.

The data showed that some women on a trial called AgeX, created to explore whether women aged up to 73 could benefit from screenings, were not receiving invitations to their final screening which was due when they were 70 years old.

The analysis found other issues such as a lack of consistency in how different NHS surgeries send out invitations to women.

Hunt ordered an independent review into the programme, its IT system and processes, saying: "Many in this House will also have legitimate questions that need answering: why did the algorithm failure occur in the first place, and how can we guarantee it does not happen again?

"Why did quality assurance processes not pick up the problem over a decade or more? Were there any warnings, written or otherwise, which should have been heeded earlier? Was the issue escalated to ministers at the appropriate time? What are the broader patient safety lessons for screening IT systems?"

Lynda Thomas, chief executive of Macmillan Cancer Support, and Professor Martin Gore, consultant medical oncologist and professor of cancer medicine at the Royal Mardsen, will chair the review, which is expected to report in six months.

Shadow secretary for health, John Ashworth, questioned what assurances Hunt could provide that bowel cancer and cervical cancer screenings for women aged between 60 and 74 "are running properly".

Hunt replied that the government must "need to find ways to improve oversight, and modern IT systems can greatly improve safety and reliability".

The Department of Health has agreed a deal with Microsoft to roll Windows 10 out across the NHS by 2020 in a bid to bolster hospitals' cybersecurity defences, which have been savaged by experts in recent months.

The long-awaited upgrade from Windows XP, which Microsoft stopped supporting four years ago, comes almost a year after the WannaCry ransomware attack spread havoc across IT systems in the NHS.

As part of the deal, NHS devices will be upgraded to Windows 10, with Microsoft pushing the latest security updates to NHS machines as soon as they become available.

Trusts will be allowed to upgrade their devices to Windows 10 free of cost if they join a special service being set up to manage the rollout - but they must do so by January 14 2020.

This coincides with the date Microsoft will stop supporting Windows 7 with security updates.

"Central funding for Windows operating systems licenses will not be available to organisations who are not part of the service," an NHS Digital spokesperson said.

They added: "NHS organisations have already successfully migrated more than 100,000 NHS devices to the Windows 10 operating system, and guidance and support to help trusts with their migration will be provided as part of the service."

While Windows 10 boasts apps like SmartScreen and antivirus tools like Windows Defender to detect viruses, phishing and malware, as well as isolate infected machines and kill malicious processes before they are allowed to spread, the NHS has long been running XP, despite it reaching end-of-life in April 2014.

Trusts that upgrade will also get access to Windows Defender Advanced Threat Protection (WDATP), a security service that will allow NHS organisations to detect, investigate, and respond to advanced threats on their networks.

"We know cyber attacks are a growing threat, so it is vital our health and care organisations have secure systems which patients trust," said Jeremy Hunt, the government's health and social care secretary.

"We have been building the capability of NHS systems over a number of years, but there is always more to do to future-proof our NHS as far as reasonably possible against this threat. This new technology will ensure the NHS can use the latest and most resilient software available - something the public rightly expect."

The announcement comes a fortnight after Parliament's Public Accounts Committee (PAC) published a damning report revealing that not a single NHS trust passed its cyber security assessment, revealing that some trusts had failed "soley because they had not patched their systems - the main reason the NHS had been vulnerable to WannaCry".

WannaCry affected 300,000 computers across 150 countries in May last year. The National Audit Office (NAO) found that at least 34% of NHS trusts in the UK were disrupted by the attack, leading to the cancellation of 6,900 appointments.

Although the NHS was not a target, it became swept up in the attack in light of its cyber security vulnerabilities, with critics pointing out that Windows XP is a major attack vector for hackers, given the lack of patches for security holes. However, an analysis of affected computers at the time, conducted by Kaspersky Lab, found that Windows 7 was responsible for 97% of infections, with Windows XP contributing a negligible number. Windows 10 was unaffected by WannaCry.

Shortly afterwards the Department of Health allocated 21 million to bolster the NHS' defences, as the government accepted the recommendations set out by the National Data Guardian and Care Quality Commission reviews into security standards carried out before WannaCry - but the trusts still failed the recent PAC assessment.

Deputy chief executive of NHS Digital, Rob Shaw, said: "The new Windows operating system has a range of advancements in security and identity protection that will help us to support trusts to keep their data safe from attacks and which will cover both desktop and mobile devices.

"The additional funding will mean we can add an extra layer of protection, whilst boosting our existing services, with real-time monitoring of NHS networks and the ability to see potential threats right down to individual NHS organisations."

When XP fell out of support four years ago, the government signed a 5 million custom support deal for computers still running the aged OS in the NHS, police and other public bodies, an agreement that ended in May 2015 despite many machines still stuck on XP.

When IT Pro spoke to the Metropolitan Police's CIO, Angus McCallum, earlier this year, he claimed the last machines running XP would be upgraded by May.

The Department of Health refused to disclose the cost of the Microsoft deal, saying this was commercially sensitivity information, but clarified it is not part of a wider 150 million investment over the next three years, announced this weekend, which includes money to set up a new NHS Digital Security Operations Centre.

IT Pro has contacted NHS Digital about the number of devices the Windows 10 upgrade will apply to, and the timescale for the project.

"The importance of helping to protect the NHS from the growing threat of cyber-attacks cannot be overstated," said Cindy Rose, chief executive of Microsoft UK. "The introduction of a centralised Windows 10 agreement will ensure a consistent approach to security that also enables the NHS to rapidly modernise its IT infrastructure."

Picture: Shutterstock

SAP customers face a confusing array of options and a lack of clarity around licensing when they approach adopting HANA, the company's in-memory data processing platform.

This is according to research conducted by SAP HANA implementation specialist Centiq, which surveyed 250 UK HANA users across industries including financial services, manufacturing and retail.

While HANA adoption is accelerating among SAP's customer base, users face real challenges too from a variety of deployment choices to concerns over how SAP will license their usage, discovered Centiq's State of SAP HANA Report, which was released yesterday.

"When SAP HANA launched in 2011, many initially struggled to create compelling business cases or measurable ROI," said Centiq COO Matt Lovell. "Seven years later, this has changed."

Now, 61% of organisations are adopting HANA to process data faster to inform decision-making, while 60% want to integrate data from different sources, and 59% want to use it to gain greater customer insights.

However, while three-quarters of HANA deployments are delivered on time and on budget, concerns remain for businesses that are still considering whether or not to adopt it.

Direct access to HANA applications was a key concern for 86% of respondents, despite SAP's attempts to address ambiguity around its licensing last year.

Customers are concerned they will be stung in audits for access to SAP systems that are not covered by their per-user licensing agreements, and SAP introduced exceptions for read-only data and some transactions last summer to try and address the problem.

But Paul Cooper, chairman of the UK & Ireland SAP User Group, told IT Pro: "We are still waiting to see the broader picture talking about other business processes that weren't in that initial announcement from SAP.

"There's the whole IoT piece [that needs resolving] and implications around Leonardo [SAP's product group for new tech like AI and blockchain]. It would be great when new solutions are announced that SAP would talk about licensing then too."

Changing skills

Skills is another obstacle customers must overcome, with 94% citing it as a barrier. Confusion over what skills are needed is also a problem, with respondents working in data roles citing a lack of cloud infrastructure skills, while 70% of COO respondents identifying a lack of business process change talent.

Meanwhile, 68% of CIOs said more knowledge of SAP's HANA-based ERP suite, S/4 HANA, was required.

Centiq surmised that the new skills necessary are more business-based than IT-based, with only 58% of respondents saying they need HANA database skills, and 59% requiring cloud skills. In fact, just 24% of HANA projects were led by IT this time out, compared to 52% in the last report.

SAP User Group chairman Cooper said the state of the economy and worries around future prosperity have played their part in this shift.

"Business cases are having to be more robust than they have been before in terms of pay back and user benefit," he said, "so it doesn't surprise me that business users are having more of a say in that because there's a finite pot will be spent and organisations don't want to be making the wrong decisions."

Cloud

SAP has already announced a 2021 end-of-life for its on-premise Mobile Platform, and organisations can only enjoy support for the vendor's ERP suite ECC 6.0 until 2025.

With SAP trying to push as many customers towards the cloud as possible, however, users are still confused about their options.

Most are deploying HANA in a public cloud like AWS, or on both public cloud and on-premise. Just 6% are running production workloads in SAP's cloud.

"Public cloud dominates over SAP cloud because organisations are looking for more than just SAP HANA," the report stated. "For organisations to get the maximum ROI from their SAP HANA deployment, they must be able to link it to other services, for example Enterprise Content Management (ECM), fulfillment and customer experience, which are already hosted on public cloud."

A former senior researcher at Google has slammed the company, saying it's no longer innovative and merely chases trends.

Senior staff software engineer Steve Yegge left Google after a career spanning over 10 years, stating in a lengthy blog post that he left because "[Google] can no longer innovate. They've pretty much lost that ability".

Yegge blamed this loss of innovation on four factors. He said that as the company has grown, it has become focused on protecting its existing assets, which has made it conservative and risk-averse.

Politics, he said, was another limiting factor. As one of the largest and most influential tech companies on the face of the planet, Google is heavily involved in political discussions at the highest levels of government it spent $18 million on political lobbying in 2017. While Yegge noted this is "sort of inevitable" with a company of Google's size and "not necessarily bad", he also pointed out that it has slowed the company down and introduced new problems.

Yegge also slammed Google's attitude as "arrogant", stating that a sense of corporate invincibility within the company has led to its strategy becoming a mess. He implied that the business has lost touch with customer and that its strategic decision-making has become poor.

"Their attempts at innovation have been confusing and mostly unsuccessful for close to a decade," he said. "Googlers know this is happening and are as frustrated by it as you are, but their leadership is failing them."

However, the biggest and most egregious error that Google has made, in Yegge's eyes, is becoming "100% competitor-focused rather than customer focused". Google's internal incentive structure, he claims, doesn't support a customer-focused attitude, so staff are too busy to make it a priority.

Instead, Yegge says that the company rewards the successful launch of new features and products, and that in order to achieve this, Google simply copies what its rivals are doing.

"You can look at Google's entire portfolio of launches over the past decade, and trace nearly all of them to copying a competitor: Google+ (Facebook), Google Cloud (AWS), Google Home (Amazon Echo), Allo (WhatsApp), Android Instant Apps (Facebook, WeChat), Google Assistant (Apple/Siri), and on and on and on," he said.

"They are stuck in me-too mode and have been for years. They simply don't have innovation in their DNA any more. And it's because their eyes are fixed on their competitors, not their customers."

While Yegge praised certain products and initiatives, such as Cloud Spanner, BigQuery, TensorFlow and Waymo as "generational innovations", he blasted the rest of its output, saying that the company's successes "do not excuse nor justify the parade of failed me-too consumer products that Google has been launching of late".

The changes in the company's attitude over Yegge's time at Google, he says, has driven him to take a job at Grab, an Uber competitor based in Southeast Asia.

"In short, Google just isn't a very inspiring place to work anymore. I love being fired up by my work, but Google had gradually beaten it out of me."

IT Pro contacted Google for a response to Yegge's claims, but hadn't received a response at the time of publication.

For many companies, data is a critical business asset. But how can the value of that data be measured? And what happens when that data is lost or stolen?

The constant occurrence of high profile data breaches shows how crippling a threat to a company's data can be, and the irreparable damage it causes to organisations' reputations. In addition to this, the Ponemon Institute estimated the average total cost of a data breach in 2017 at $3.62 million.

But are companies doing everything they can to protect and insure their data? One industry rapidly growing in response to data breaches is the cyber security insurance market. This industry has seen 30% year-on-year growth, with the industry set to reach $5.6 billion in annual gross written premium by 2020, according to AON.

Cyber and privacy insurance covers a business's liability for a data breach in which the customer's personal information is exposed or stolen by a hacker.

Insuring the uninsurable

However, even with the market's growth and the continued threat of data breaches, only 19% of UK companies are covered for losses associated with cyber security breaches and data theft. PwC say that the amount of cover insurers offer does not come close to the potential losses seen by companies from a truly damaging cyber attack.

There is also a nervousness among insurers themselves to shoulder the risks: half of insurers in the UK do not actively pursue cyber insurance as an area of growth, believing the risk to be "borderline insurable", and those who do offer it tend to limit the amount of cover offered under each policy, according to PwC.

But with the increase in breaches and companies' subsequent losses, it seems likely that coverage will broaden over the next year or so, as no one is immune to the threat of a data breach.

Valuing data

Doug Laney, an analyst at Gartner, recently wrote a book (titled Infonomics: How to Monetize, Manage, and Measure Information for Competitive Advantage) that provides distinct models on how companies across all industries can review the value of their data, both in non-financial models and financial models.

Non-financial models focus on the intrinsic value, the business value and the performance value of the data. These data values can measure a company's uniqueness, accuracy, relevancy, internal efficiencies and overall impact of its usage.

Financial models focus on the cost value, the economic value and the market value of the data. These data values can measure the cost of acquiring data, administering the data internally and the value of selling or licensing a company's data.

Data as a commodity means its value will only increase, and ultimately drive new questions and conversations about how this raw material can continue to project companies to greater heights and help them gain new advantages. But as its value increases and drives a company's wealth-creation strategies, it becomes a bigger target for cyber criminals too, leading companies to seek to protect it. While insurers haven't stepped in yet, the surge of breaches in 2016 and 2017 arguably makes 2018 the year more will begin to offer insurance policies for this increasingly valuable asset.

Picture: Shutterstock

No-one likes uncertainty. It makes it hard to plan and to forge a way forward where you know what will happen, why and when.

In the corporate world especially the SMB space uncertainty can sap appetite for taking risk and growing the business, stunting innovation and limiting market opportunities. Technology offers a way forward, a way of empowering even the smallest of business to think big and act big in ways that belie their actual stature.

"The importance of technology and the IT professionals who support it is a well-known fact of business success," said Joseph Kim, senior vice president and chief technology officer, SolarWinds.

"We want to draw attention to the mounting responsibility being placed on IT professionals to manage an ever-expanding array of technologies - both those owned by businesses and those beyond, such as end user-owned devices and cloud applications provided by third-party vendors. Our surveys reveal that more than ever, end users are connecting more devices, including those personally-owned, to corporate networks; relying on cloud-based applications; and working outside the four walls of traditional offices. These are all trends that take direct control out of the hands of IT departments, yet as the surveys also demonstrate, the demands on IT professionals to support and ensure the performance of related technologies are just as high."

However, getting investment of any kind, particularly when it comes to technology, can be an uphill struggle for the average business. Often, the person in charge of IT is the same person in charge of everything and anything else. And, while they may see the merits of the technology in question, they have too many other conflicting priorities so it never quite makes the grade.

But it's for these very same reasons of limited resources and conflicting priorities that SMBs really do need to sit up and listen when it comes to how technology can protect their most vital asset: information.

The security elite?

Security should not be the preserve of bigger businesses, which seemingly have limitless IT budgets, dedicated tech departments and ever-growing human resources. The right to protect your company's and your customers' data should be a given.

"The most surprising finding of the survey is just how many UK organisations are less vulnerable today than they were a year ago, and, on a related note, how many have implemented security technologies and better security training," said Mav Turner, director, business strategy, SolarWinds.

"While this is a sign the industry is trending in the right direction, it's important for IT professionals to never get too confident in their organisations' security posture, which could potentially result in overestimating one's defences. After all, the findings also illustrate how high the stakes arewhile less than one-third of UK organisations experienced a security breach in 2015, of those, 77% store potentially sensitive customer data."

However, while levels of preparedness have increased, so too has the number of threats. Furthermore, we don't live in a perfect world and those trying to make money out of customer data or just cause problems because they can do not target you because you are small. You are just another target a faceless, but named, line on a spreadsheet somewhere out in cyber space.

So don't get mad, don't get offended and don't even think about trying to get even. Instead come to terms with the fact that no matter what the size of your business, the bad guys are a big threat. And it's not a case of if you're attacked; it's a case of when.

Now we have got those hard truths out of the way, it's time to forge a path of sense for your business moving forward. Security is not your business and you have no idea the size, scale or timing of the various attack vectors out there on the horizon. So what should you do?

Risk intelligence

This is where risk intelligence comes in. Put simply, risk intelligence gives you an accurate picture of the lay of the land. It can give you an idea of your vulnerabilities in terms of both data at rest and data at risk. It creates a dossier on your business exposure and what you stand to lose if certain areas of your infrastructure get hit. It paints a worst case, but very realistic scenario. And that scenario enables you to see the damage in pounds and pence. And having cold, hard minus figures are often enough to get even the most hardened of finance chiefs to part with their money.

Sophisticated risk intelligence tools essentially put a price on your data weak points, so you can make informed decisions about where to prioritise your security resources. But that's not the only element of risk intelligence. It will also proactively scan your infrastructure in recognition your data estate is ever-changing as are the threats look for trends and provide easy to consume and digest reports so you can share the new-found insight with other key business stakeholders and decision makers.

Furthermore, risk intelligence can assist with compliance confidence and identify areas where you may have already been breached, either through user error or through malintent so that you can choose whether or not you would have acted differently had you known and, of so desired, change your future plans for those areas.

"IT is pervasive across work, life and geography. IT runs the world and, without it, our technological existence would come to a screeching halt," said Joel Dolisy, former SolarWinds CIO.

"BYOD and now the IoT have added and continue to add hundreds of thousands of new devices to corporate systems, and as illustrated in this year's report, IT is also evolving from traditional on-premises-only infrastructure to the hybrid strategy driven by the existence of the cloud. In short, IT is everywhere. Effectively managing and monitoring the new environment - from on-premises to the cloud with multiplying endpoints - to be able to act when needed is more critical now than ever."

Want to know more about data protection? Click here to download a whitepaper.

"This is an independent article written by IT Pro, sponsored by SolarWinds MSP to celebrate thought leadership in IT. Learn more about SolarWinds' MSP Risk intelligence and enjoy a free 14 day trial by clicking here ."