By Martin Fincham, CEO – LANSA
A common misapprehension in the financial services sector is that its tight regulatory infrastructure prohibits Shadow IT activity.Shadow IT is any unofficial application development project that is commissioned, introduced or executed outside the IT department’s formal control or plan. However, in reality, there are numerous areas in this market where the practice frequently occurs and threatens the governance, compliance and risk management provided by the organisation’s official IT function.
Why does Shadow IT creep in?
Shadow IT happens for a reason. Many IT departments simply cannot cope with the demands from line of business managers for the applications they need.Typically, this is because IT departments are already under pressure delivering major mobile or web applications, integration projects, getting cloud-ready or driving other pressing digital transformation initiatives. In parallel, a significant percentage of their time is spent on the maintenance and support of enterprise apps. When it comes to developing new apps, Corporate IT usually has a 2-3 yr road map which is constraining a sector that is starting to feel the heat from new entrants such as Lemonade in the financial planning services space, which is making many more established players sit up and consider their own ability to respond. Line of business managers need to be as agile as new entrants, which is challenging when they have legacy systems to maintain. Inevitably,demand for new and innovative applications accumulates and Shadow IT is often the response of line of business managers as a means of ‘getting the job done’.
Line mangers, puzzled at the month or year long wait presented by IT to their demands, do what they believe is right for their own area of the business. In effect, they fill in the gaps for themselves. Typically, the skill level in Excel and other business tools is high, so business users are used to building solutions of their own. However, whilst this may meet their short-term requirements, the Shadow ‘rebels’ don’t always appreciate the considerable risks or complexity involved, or the Pandora’s box they may be opening.
Proliferation of Data Silos
Getting a single view of the truth is a major thrust in Financial IT. Just as IT pulls in the direction of integration in order to enable that single view, so Shadow IT can pull in the opposite direction, setting up new silos for their individual projects, using data which cannot be leveraged by the rest of the business.
The dangers of such proliferation are very real. Unchecked, Shadow IT can pose myriad risks. Application usage can spread to greater numbers of users than intended, and performance can be crippled. In addition, data usage by Shadow IT apps can violate privacy laws and sensitive data can be leaked through embarrassing security breaches. Of particular relevance to the banking and financial services sector is the imminent arrival of GDPR compliance rules. Shadow IT systems pose a risk to such compliance as the projects have no governance or guidance over them.
Who’s working in the shadows?
The sources of such unofficial systems vary. Shadow developers, also known as ‘Citizen’ or ‘Stealth’ Developers, can range from creative and technically aware internal marketing staff exploring exciting cloud apps, through to external ‘offshore’ development teams keen to get a foot hold in or reference check from a respected financial services organisation through a friendly contact.
From humble financial and management analysis systems through to highly sophisticated marketing and sales apps, the ‘outing’ of Shadow IT applications is often unexpected.
An executive might want to manipulate or represent their data in different ways. To achieve this, they download data from core systems, for example an asset management application, add macros and then run their own reports.These shared tools may include errors, and the misinformation proliferates. At some point, the error is discovered and IT is drawn in to fix it. The IT Department was most likely unaware that the application existed but are charged with fixing it regardless.In an attempt to control this activity,IT may allow circulation of files as PDFs only, but this in itself can be restrictive for business management.
In the insurance market, actuaries often create and use extremely complex spreadsheets to create precision pricing dependent on risk variables. Effectively, they are building their own complex pricing tools. They may involve hugely complex algorithms to generate pricing and which may be uploaded into corporate price books. The risk to the business in the event of errors being made is significant. It is unlikely that any extensive testing on these applications takes place.
Another common example occurs in the Marketing department, where shadow IT can proliferate as organisations seek to ‘know their customers’ better. From customer and sales analyses through to unofficial promotional web pages, marketing managers are responsible for organisational creativity and demand ‘competitor beating’ solutions.However,as they struggle to get to the top IT’s priority list, they resort to crafting their own solutions.
Evidence of The Rapid Spread and Growth of Shadow IT
Shadow IT is growing, but not without risk. Gartner estimates that by 2020, one third of successful attacks on enterprises will be through Shadow IT doors.The 2017 Application Architecture, Development and Integration Summit in London highlighted a 2015 Cisco study indicating that companies are using up to 15 times more cloud services to store critical company data than CIOs were aware of or had authorized. Supporting that claim, an NTT report in April 2016 indicated that 77% of business decision makers admitted to using a third-party cloud application without the approval or knowledge of their own IT department.Identity governance firm SailPoint claims that already over 70% of company employees have access to data that they shouldn’t have.
Outsourcers are acutely aware of this, as many discover unaccounted for servers after contract wins. Financial Services customers provide a detailed list of servers to the outsourcer and bids are submitted and accepted on this basis with only high-level due diligence available. The real discoveries are made post contract award where additional servers and applications are found. One outsourced service provider quoted an instance where e.g. 850 servers & 42 line of business internal applications are listed in the outsource RFP, yet 982 servers are discovered & 65 line of business applications exist, all additional servers and applications were shadow IT projects.
Shadow IT ina Low-Code Light
Shadow apps are not, in themselves, a bad thing. Many of these systems fulfill a valid need and play a role in the success and or survival of the organisation. Some IT departments are now openly recognising this and seeking to bring the alleged ‘rebels’ back into the IT fold.
What IT really needsto achieve this, is a technology approach that helps them deliver on these requirements at speed; technology that means that they no longer have to say ‘no’ or ‘yes, but later’ in response to requests from the business. Enabling IT to be agile by using ‘low-code’ rapid application development tools to build apps at high speed, can overcome the bottlenecks. So instead of outlawing Shadow IT ideas, this new approach recognizes and utilizes their creativity. Low-code platforms, such as those offered by LANSA, provide the kind of prototyping capabilities needed to validate business needs, direct with the users, iterate as they formalize their requirements, then speed up the final development way beyond the timescales they have been used to. The resulting apps are robust, well architected, high performance, and, importantly, managed and easily maintained by IT. Low-Code can be a significant tool in the armoury of IT to keep IT relevant to the business.
Single View of the Truth
Once integrated within the confines of IT,management has a ‘single clear view’ of the entire IT estate, allowing them to utilize and maintain newly developed systems to optimal effect.
Through this approach, the very same IT managers and CIOs that are currently by-passed by ‘Line of Business’ managers are transformed into agile system leaders,able to respond quickly to business demands. They can take back control and re-establish a proper and secure governance infrastructure,through which they can monitor IT with a single integrated view of the truth. Most importantly, through the use of Low-Code development, organisations can now finally banish the spectre of Shadow IT & deliver a much brighter future for internal IT application development.
‘Spooky’ AI tool brings dead relatives’ photos to life
By Umberto Bacchi
(Thomson Reuters Foundation) – Like the animated paintings that adorn the walls of Harry Potter’s school, a new online tool promises to bring portraits of dead relatives to life, stirring debate about the use of technology to impersonate people.
Genealogy company MyHeritage launched its “Deep Nostalgia” feature earlier this week, allowing users to turn stills into short videos showing the person in the photograph smiling, winking and nodding.
“Seeing our beloved ancestors’ faces come to life … lets us imagine how they might have been in reality, and provides a profound new way of connecting to our family history,” MyHeritage founder Gilad Japhet said in a statement.
Developed with Israeli computer vision firm D-ID, Deep Nostalgia uses deep learning algorithms to animate images with facial expressions that were based on those of MyHeritage employees.
Some of the company’s users took to Twitter on Friday to share the animated images of their deceased relatives, as well as moving depictions of historical figures, including Albert Einstein and Ancient Egypt’s lost Queen Nefertiti.
“Takes my breath away. This is my grandfather who died when I was eight. @MyHeritage brought him back to life. Absolutely crazy,” wrote Twitter user Jenny Hawran.
While most expressed amazement, others described the feature as “spooky” and said it raised ethical questions. “The photos are enough. The dead have no say in this,” tweeted user Erica Cervini.
From chatbots to virtual reality, the tool is the latest innovation seeking to bring the dead to life through technology.
Last year U.S. rapper Kanye West famously gifted his wife Kim Kardashian a hologram of her late father congratulating her on her birthday and on marrying “the most, most, most, most, most genius man in the whole world”.
‘ANIMATING THE PAST’
The trend has opened up all sorts of ethical and legal questions, particularly around consent and the opportunity to blur reality by recreating a virtual doppelganger of the living.
Elaine Kasket a psychology professor at the University of Wolverhampton in Britain who authored a book on the “digital afterlife”, said that while Deep Nostalgia was not necessarily “problematic”, it sat “at the top of a slippery slope”.
“When people start overwriting history or sort of animating the past … You wonder where that ends up,” she said.
MyHeritage acknowledges on its website that the technology can be “a bit uncanny” and its use “controversial”, but said steps have been taken to prevent abuses.
“The Deep Nostalgia feature includes hard-coded animations that are intentionally without any speech and therefore cannot be used to fake any content or deliver any message,” MyHeritage public relations director Rafi Mendelsohn said in a statement.
Yet, images alone can convey meaning, said Faheem Hussain, a clinical assistant professor at Arizona State University’s School for the Future of Innovation in Society.
“Imagine somebody took a picture of the Last Supper and Judas is now winking at Mary Magdalene – what kind of implications that can have,” Hussain told the Thomson Reuters Foundation by phone.
Similarly, Artificial Intelligence (AI) animations could be use to make someone appear as though they were doing things they might not be happy about, such as rolling their eyes or smiling at a funeral, he added.
Mendelsohn of MyHeritage said using photos of a living person without their consent was a breach of the company’s terms and conditions, adding that videos were clearly marked with AI symbols to differentiate them from authentic recordings.
“It is our ethical responsibility to mark such synthetic videos clearly and differentiate them from real videos,” he said.
(Reporting by Umberto Bacchi @UmbertoBacchi in Milan; Editing by Helen Popper. Please credit the Thomson Reuters Foundation, the charitable arm of Thomson Reuters, that covers the lives of people around the world who struggle to live freely or fairly. Visit http://news.trust.org)
Does your institution have operational resilience? Testing cyber resilience may be a good way to find out
By Callum Roxan, Head of Threat Intelligence, F-Secure
If ever 2020 had a lesson, it was that no organization can possibly prepare for every conceivable outcome. Yet building one particular skill will make any crisis easier to handle: operational resilience.
Many financial institutions have already devoted resources to building operational resilience. Unfortunately, this often takes what Miles Celic, Chief Executive Officer of TheCityUK, calls a “near death” experience for this conversion to occur. “Recent years have seen a number of cases of loss of reputation, reduced enterprise value and senior executive casualties from operational incidents that have been badly handled,” he wrote.
But it need not take a disaster to learn this vital lesson.
“Operational resilience means not only planning around specific, identified risks,” Charlotte Gerken, the executive director of the Bank of England, said in a 2017 speech on operational resilience. “We want firms to plan on the assumption that any part of their infrastructure could be impacted, whatever the reason.” Gerken noted that firms that had successfully achieved a level of resilience that survives a crisis had established the necessary mechanisms to bring the business together to respond where and when risks materialised, no matter why or how.
We’ll talk about the bit we know best here; by testing for cyber resilience, a company can do more than prepare for the worst sort of attacks it may face. This process can help any business get a clearer view of how it operates, and how well it is prepared for all kinds of surprises.
Assumptions and the mechanisms they should produce are the best way to prepare for the unknown. But, as the boxer Mike Tyson once said, “Everyone has a plan until they get punched in the mouth.” The aim of cyber resilience is to build an effective security posture that survives that first punch, and the several that are likely to follow. So how can an institution be confident that they’ve achieved genuine operational resilience?
This requires an organization to honestly assess itself through the motto inscribed at the front of the Temple of Delphi: “Know thyself.” And when it comes to cyber security, there is a way for an organization to test just how thoroughly it comprehends its own strengths and weaknesses.
The Bank of England was the first central bank to help develop the framework for institutions to test the integrity of their systems. CBEST is made up of controlled, bespoke, intelligence-led cyber security tests that replicate behaviours of those threat actors, and often have unforeseen or secondary benefits. Gerken notes that the “firms that did best in the testing tended to be those that really understood their organisations. They understood their own needs, strengths and weaknesses, and reflected this in the way they built resilience.”
In short, testing cyber resilience can provide clear insight into an institution’s operational resilience in general.
Gaining that specific knowledge without a “near-death” experience is obviously a significant win for any establishment. And testing for operational resilience throughout the industry can provide some reminders of the steps every organization should take so that testing provides unique insists about their institution, and not just a checklist of cyber defence basics.
The IIF/McKinsey Cyber Resilience Survey of the financial services industry released in March lasy year provided six sets of immediate actions that institutions could take to improve their cyber security posture. The toplines of these recommendations were:
- Do the basics, patch your vulnerabilities.
- Review your cloud architecture and security capabilities.
- Reduce your supply chain risk.
- Practice your incident response and recovery capabilities.
- Set aside a specific cyber security budget and prioritise it
- Build a skilled talent pool and optimize resources through automation.
But let’s be honest: If simply reading a solid list of recommendations created cyber resilience, cyber criminals would be out of business. Unfortunately, cyber crime as a business is booming and threat actors targeting essential financial institutions through cyber attacks are likely earning billions in the trillion dollar industry of financial crime.A list can’t reveal an institution’s unique weaknesses, those security failings and chokepoints that could shudder operations, not just during a successful cyber attack but during various other crises that challenge their operations. And the failings that lead to flaws in an institution’s cyber defence likely reverberate throughout the organization as liabilities that other crises would likely expose.
The best way to get a sense of operational resilience will always be to simulate the worst that attackers can summon. That’s why the time to test yourself is now, before someone else does.
Thomson Reuters to stress AI, machine learning in a post-pandemic world
By Kenneth Li and Nick Zieminski
NEW YORK (Reuters) – Thomson Reuters Corp will streamline technology, close offices and rely more on machines to prepare for a post-pandemic world, the news and information group said on Tuesday, as it reported higher sales and operating profit.
The Toronto-headquartered company will spend $500 million to $600 million over two years to burnish its technology credentials, investing in AI and machine learning to get data faster to professional customers increasingly working from home during the coronavirus crisis.
It will transition from a content provider to a content-driven technology company, and from a holding company to an operational structure.
Thomson Reuters’ New York- and Toronto-listed shares each gained more than 8%.
It aims to cut annual operating expenses by $600 million through eliminating duplicate functions, modernizing and consolidating technology, as well as through attrition and shrinking its real estate footprint. Layoffs are not a focus of the cost cuts and there are no current plans to divest assets as part of this plan, the company said.
“We look at the changing behaviors as a result of COVID … on professionals working from home working remotely being much more reliant on 24-7, digital always-on, sort of real-time always available information, served through software and powered by AI and ML (machine learning),” Chief Executive Steve Hasker said in an interview.
Sales growth is forecast to accelerate in each of the next three years compared with 1.3% reported sales growth for 2020, the company said in its earnings release.
Thomson Reuters, which owns Reuters News, said revenues rose 2% to $1.62 billion, while its operating profit jumped more than 300% to $956 million, reflecting the sale of an investment and other items.
Its three main divisions, Legal Professionals, Tax & Accounting Professionals, and Corporates, all showed higher organic quarterly sales and adjusted profit. As part of the two-year change program, the corporate, legal and tax side will operate more as one customer-facing entity.
Adjusted earnings per share of 54 cents were ahead of the 46 cents expected, based on data from Refinitiv.
The company raised its annual dividend by 10 cents to $1.62 per share.
The Reuters News business showed lower revenue in the fourth quarter. In January, Stephen J. Adler, Reuters’ editor-in-chief for the past decade, said he would retire in April from the world’s largest international news provider.
Thomson Reuters also said its stake in The London Stock Exchange is now worth about $11.2 billion.
The LSE last month completed its $27-billion takeover of data and analytics business Refinitiv, 45%-owned by Thomson Reuters.
(Reporting by Ken Li, writing by Nick Zieminski in New York, editing by Louise Heavens and Jane Merriman)
Sunak to give UK Infrastructure Bank £12 billion of capital in budget
LONDON (Reuters) – British finance minister Rishi Sunak is expected to announce an initial 12 billion pounds of capital and...
Robinhood plans confidential IPO filing as soon as March – Bloomberg News
(Reuters) – Online brokerage Robinhood, at the centre of this year’s retail trading frenzy, is planning to file confidentially for...
Wall Street Week Ahead: Investors weigh new stock leadership as broader market wobbles
By Lewis Krauskopf NEW YORK (Reuters) – A shakeup in stocks accelerated by the past week’s surge in Treasury yields...
SoftBank reaches settlement with former WeWork CEO Neumann
(Reuters) – SoftBank Group Corp said on Friday it has reached a settlement with WeWork’s special committee and the company’s...
Sunak warns of bill to be paid to tackle Britain’s ‘exposed’ finances – FT
(Reuters) – British finance minister Rishi Sunak will use the budget next week to level with the public over the...