Cyber Risks: If we don't care, they don't care?

This is a follow-up to my previous posts.  In Creating Cyber Risks which discusses the pervasiveness of  computer related security risks and our headlong charge of adding to these risks.  Later, in Who is Responsible for Internet Security, I discussed the landscape of the various technical areas of potential Cyber weaknesses and who is responsible for keeping the things up-to-date.

Almost at the same time, two different articles came to my attention.  Microsoft has released released a report that tracks the trends of whether home computer users are applying good practice security measures.

There is a disturbing trend in the above graphic which shows a steep decline in the number of users that are are using the basic security capabilities of their computers and networks or keeping their applications software up-to-date.  If this is the case, what are the odds that they are keeping the more hidden elements current (e.g., device drivers, BIOS, etc.)?

Although this is disturbing, the presumption here is that the updates provided by a vendor actually improve the stability and security of an operating system or application.  However, as described in this report, Microsoft Update Quality Issues, this may not be true.  These updates are related not just to functionality improvements but also security improvements.  Pushed automatically to millions of machines at a time, these patches can cause virtually immediate new zero-day vulnerabilities that hackers are staged ready to exploit based on the known vendor path schedule.

So, we really have two problems and in each there really is no party other than the user that suffers.  If a user does not care to take best-practice measures to secure their systems, then an attack is more likely to be successful in either disabling computers or stealing information.  As discussed in Creating Cyber Risks, could enable a hacker to steal your money as well as enter your home.   Problem 1: User is responsible.

The second is that even if we do take care and score a perfect Microsoft Computing Safety Index (MCSI) score, the actual vendor provided updates can cause vulnerabilities.  Problem 2: Vendor takes no responsibility or liability - User is responsible.

So, if we don't care, will the vendors care to put our their best effort for Cyber-related issues?  And, if we do care, will marketplace embarrassment and corporate user agitation make the vendors care?

My Penultimate RIM Post

It’s been a bit since my last post as my work has taken me a bit far and wide doing some technology assessments for my company’s largest customer.

I am still tracking the near final gasps of Research In Motion (RIM), and I believe (but not promise) that this is my penultimate posting on the subject.  The last post will probably be about the final sale of the elements of RIM and its effective end and as a company.

My fist post on the subject was on April 17, 2011, titled RIM Goes the Way of DEC.  At the time, RIM was still a relative high-flyer and it was my observations about the Playbook and their attempt to be “cool” that started me thinking that the company was engaging in a death spiral.  I stated that “The bottom line is that RIM is in trouble”.   Since then, the stock went from around $53 to around $9 today.  Ouch, if I only took my own advice and sold short!

The operative part of my post was that RIM is likely to self-destruct in nearly the same manner that DEC did.  Unfortunately for RIM, this appears to be exactly what is happening:

The company fired its co-CEO dynamic duo that gave us dozens of undifferentiated products and a tablet that was half-baked. This is similar to the messy, expensive, and undifferentiated DEC products that strained corporate resources from producing what could have saved the company (e.g., VAX 9000 that slowed Alpha products development and lack of focus on Networking and the Web). 

A new CEO that has no particular technical vision for the company, but is put into the position of placing everything in the “latest” company technology basket (e.g., Blackberry 10/QNX and new handset compared to DEC’s Alpha and OpenVMS & Windows NT) and preparing massive layoffs to conserve cash.

Preparing to do a massive restructure and sale of company assets. In the last years, DEC sold off major portions of its business (e.g., Networking, Software, Printers), to raise cash, and finally the company was sold to Compaq (and then acquired by HP). Just this week, it was reported that RIM is considering selling their Handset business to either Facebook or Amazon. There are also reports about selling is Blackberry Messaging platform as well (hard to believe that there is really any value in this as Google, Sykpe, and Facebook are now the serious players here – Ask AOL if there is value in AIM).

It took a bit over five years from CEO change at DEC (and the name to “digital”) from the founder Ken Olsen to Robert Palmer for the company to cease as an independent entity, and certainly less time for it to fade from being a force in the industry to playing catch-up.  It appears that RIM will go through the same cycle changing CEOs from founders Mike Lazaridis and Jim Balsillie to Thorsten Heins.  Eerily similar to Mr. Palmer at DEC, Mr. Hiens was an internal promotion.  RIM has already tumbled from being a force in the marketplace (however, it should be noted that they still have strength in several countries around the world) and their revenue has declined by 35% in only one year with its market share dropping from nearly 15% to a scant 8%.  With its new savior products (the new QNX-based Blackberry 10) not even shipping, Apple iOS, Google Android, and now Windows as well as the corporate Bring Your Own Device (BYOD) trend, there is no likely change in this trajectory.  Massive employee reductions, of around 40% are reported to be already in the works.

It’s been nearly six months from the change in CEO at RIM, will RIM make it another five (like DEC did) as an independent company?