Tom Soderstrom:
Let's talk about cybersecurity inside the micro battles. I was NASA's first chief technology innovation officer at Jet Propulsion Laboratory and it took me a while to figure out that I got to bring in cybersecurity early because in the end, cybersecurity can protect us from doing dumb things, but also, you need cybersecurity's buy-in to go live later. How do you deal with that in these micro battles?
Frank Ford:
I'd agree with the basic idea that cybersecurity needs to be involved very early if you're developing something that has any implications for cybersecurity, anything to do with technology, for example. There is a real cost of bringing in cybersecurity late because what often happens is either something's been envisaged or designed, developed in a way which is not adequately secure.
So then either you have to go incur more costs and make changes. There's generally great reluctance to do that because it slows things down and often the resources aren't available.
There are many organizations that feel cybersecurity is a barrier. It slows them down, it creates problems. We've seen some organizations where when someone wants to do something they have to fill out lots of documents about the solution, the approaches, how they're going to solve certain problems. One company I saw, they had 27 different forms to be filled out before you could start anything.
The key evolution for cybersecurity teams is how to actually help the development teams and to make it as easy as possible. Some of the key ways that companies are starting to do that is training their people and deploying their people to work as part of these two-pizza teams.
Tom Soderstrom:
Exactly.
Frank Ford:
It's helping people understand what needs to be done from a security point of view, working with them to find the right solution rather than being dogmatic that it has to be done a particular way. It has a very positive effect because developers, in our experience, are not opposed to building good cybersecurity.
Tom Soderstrom:
But they're opposed to filling out 27 forms.
Frank Ford:
The forms are not very popular, that's for sure. When they understand it better, then they are quite willing, and often if you talk to them early, they will create with you and come up with solutions.
Tom Soderstrom:
Completely agree. So, one of the things we saw, I'm very curious to see if you see other companies do this, was instead of, because security was always a delay, if you can't go live, if you're not compliant, it's costing money. Instead of the cyber security people run a script to figure if it's compliant, give that script out to developers, they run the script and now they get a more secure solution and it shortens that time. That helped us at NASA. How does it work for your companies practically? What do they do to speed up this waiting for compliance check?
Frank Ford:
Some companies are very good at this and so the ones that are very good at it have really focused on driving as much automation into their software development life cycle.
Tom Soderstrom:
Yes, that's right.
Frank Ford:
Which is not just around writing the code, but it's also about the cyber security checks as you go along, so it's built into the development process. For example, relatively early on there would be automated tests against the code to see whether it meets certain requirements, has certain vulnerabilities, uses latest patches, et cetera, and compliance checking and so forth. It's built in. It's very difficult actually to produce code at the end that's not compliant because of the way it's all automated and built through. Setting one of those things up is quite an endeavor.
But the target state is this more automated, more inbuilt machine to develop code which automatically helps people develop it in a secure way.
Tom Soderstrom:
I wish that I'd had, in those days when I was a developer and software leader, the tools we now have. I'm really happy about Amazon Q Developer, and the other cloud providers are also having coding assistants. It's really helpful because you can bring in compliance and security upfront. I think we will see the level of innovation go sky-high because of these automated processes that delay us and people don't want to do and they insert vulnerabilities in our code. If they could be automated, what are we going to see?
Frank Ford:
Yeah, I agree. I think the basic point of the cycle time for developing prototypes and code into production keep reducing, and I think we'll continue to see that and I think gen AI is going to help a great deal as well in terms of generating code samples. There's more and more automation coming in.
Tom Soderstrom:
When you talk to the executives and presumably the teams, is there a big worry that AI will take my job? Are you hearing that or are you hearing the executives saying, "Yeah, I'm going to cut my staff in half because I have AI."
Frank Ford:
I think it is a concern in some industries and I think to my mind it's just another example of automation and the impact of automation. Basic robotics and manufacturing on assembly lines has been in place for decades. That changed the nature of the jobs in those manufacturing plants. There are still jobs but they're different jobs and there may be less number of them, but the skill requirements changed radically. Generative AI will have a similar effect for some jobs.
I think most companies are looking at it an assistant, as opposed, at this stage, versus an outright replacement so that there are some tasks that can be automated using AI to help people focus on the higher value activities. If it's, say, dealing with a customer's inquiry, the ability to deal with it to a higher quality more rapidly through AI and actually really help the customer so they feel happy, is a good thing and the people can intercept the calls which are more complicated or require a person to talk to.
Tom Soderstrom:
One of the key worries is I don't have the people I need. We tend to disagree. We think that you do have the people you need, they may not have the skills they need. Now what you can do is you can solve it by just up-skilling, because if you just replace all the people, you lost all the business knowledge too.
Frank Ford:
I think it's a topic that comes up very often across many different domains, and so companies do need to get quite thoughtful and serious about the capabilities that they need in their business and how they acquire them and have the right strategy for acquiring them. Some of it will undoubtedly be retraining and up-skilling people. Also at the board level as well. There's lots of issues at the board level in terms of the relevant skills, particularly around technology topics. Also outsourcing other sourcing methods to actually build the skills that you need into the organization. It's not necessarily that you'll have to have everything within your organization. There are certainly skills that you can and should outsource, and most companies look at that as more commodity skills. They will outsource the ones that are really important for their core business. For example, in technology terms, it could be around cyber security, it could be certain engineering skills, it could be architecture for certain. Those types of topics we want to keep in house.
Tom Soderstrom:
I really agree with, and that's one of the key things, it's so tempting, the board of directors says you need to do Generative AI. Now, okay, I'll outsource that. Well if that's the future, don't outsource it, bring in experts to help you. But you've got to grow, and then get rid of some of those things that are not differentiating.
Frank Ford:
I think it's very important, I think when you recognize something like AI is going to be an increasingly vital part of everyone's business as time goes on. What drives AI is your data, your data architecture, your data strategy, so you really want to have your skills in-house for how you really understand your data and how you architect it and make it usable for your core business processes and for generative AI. Those types of skills are extremely important for companies to retain. They're very differentiating.