The insulin pump is designed to communicate wirelessly with an external monitor which allows medical staff to both monitor the device and alter the parameters of the device so that dosages can be increased or decreased as needed.  From a patient perspective this is fantastic.

The major vulnerability lies in the fact that the data stream is unencrypted.  Jack was able to write software that overrode restrictions which would normally prevent wireless commands from increasing dosages.  He was also able turn off the pump’s normal behavior of vibrating or issuing a tone when it dispenses it’s normally life saving insulin.  Under these circumstances it is possible to issue a series of commands which would deliver an undetected fatal dose of insulin and do it from a distance of up to 100 meters away.

Whoa!

Is it likely to occur, of course not.  Does is sound like something from a Dan Brown novel?  Yes, indeed.

There have been similar discoveries in the past surrounding pacemakers.  Again, not very likely to occur but still technically possible.  How many other devices are susceptible to wireless alteration?  According to the article, Medtronic stated they would “incorporate stronger security” in future versions.  Future versions?

Wireless medical devices are not unique to Medtronic nor are unencrypted data streams so I don’t want to appear in any way this is unique to their products.  Other medical device manufacturers have similar potential flaws.  Given the long development and certification times involved in producing this class of medical device, many on the market today were initially developed more than 10 years ago.  I’m fairly certain none were not developed with an eye toward IT security.  It’s time the FDA open that eye and reevaluate these and similar devices.

It’s easy to ignore the potential for harm here and say the chances of anyone hijacking an insulin pump to injure, let alone murder someone, is miniscule.  A decade ago the same could have been said for someone hijacking a plane and using it as a guided missile to topple buildings and kill innocent victims.

Kudos to Porsche Design, the pictures on their site look really cool.  Remember, their involvement is industrial design not things like OS features or battery life so don’t knock them for taking on this project.  Personally, I’d like to see their influence on an Android phone.

Considering PlayBooks are now being sold like t-shirts (buy 2 get 1 free), maybe I’ll just wait a while before plunking down the $2,000 they are asking for the P’9811.

Like I wrote in my last post, it’s time for RIM to rid themselves of their hardware division and concentrate their efforts on being a services company before they become the next AOL.

I’ve been a BlackBerry user, nay, CrackBerry junkie, since 2001.  Like most junkies, I received my first sample free and I’ve been paying ever since.  RIM handed out 500 “BlueBerrys” at the WAVE convention in Las Vegas and I was one of the fortunate 500.  I remember playing with the device for a few days at the convention and then putting it in a drawer for months.  Our corporate E-mail platform didn’t have a BES and I already had a cell phone.  A few months later we stood up a BES and the rest is history.

I’ve had no less than seven different models since then and only one has been a real dog.  If there ever was a way to have one surgically implanted, I’d be one of the first to sign up.  For me, it’s always been about mail.  For years I’ve needed my E-mail attached to me 24x7x365.  As the smartphone has evolved I’ve had to watch from the sidelines as others started to take pictures, play games, instant message, navigate, listen to music, and stream video all because RIM wouldn’t let me get in to the game.  I was content though because I had my bullet-proof mail and that was what was important. My BlackBerry was a tool I couldn’t live without.

Sure, RIM eventually added many of these features and updated their play book (pun intended) but they have done it as a follower not a leader.  For the past few years their hardware has been playing catch-up and not faring well.

Innovation?  Seriously?  It’s been virtually non-existent.  Somewhere along this path RIM has lost their way with the BlackBerry.  Take a look at some of these designs and patents they’ve been working on.  What where they thinking?

It seems that while Apple, Google, HTC, and Motorola have been advancing the Smartphone RIM (read: eating RIM’s lunch) has been content to revel in their position in the corporate market as the provider of secure communications.  Too bad.  The corporate world has begun to embrace the other platforms just as the other platforms have begun to embrace the corporate market.

RIM has ceased to produce world-class products.  They’ve managed to saw off one of the four legs holding up their table… “which others choose to emulate.”  The iPhone?  World-Class.  Android?  World-Class.  Sorry, RIM, you loose.  You’ve been attempting to emulate what those two offer and haven’t been doing well with that attempt.

Think about how well RIM has embraced the explosive growth of the consumer market?  When it the last time you’ve seen a BlackBerry commercial on television?  How about that multi-year deal to put their name on the “BlackBerry Field?”  Exactly.

A few days ago I was talking with a friend of mine and said that I was looking to make the switch to an Android phone.  He nearly fell out of his chair, shocked that I would even utter such a blasphemous statement.

Does all this gloom and doom mean the end of RIM?  Certainly not.  RIM isn’t quite in the same position as Nokia’s phone division, may she rest in peace.

Unlike Nokia, RIM still has the BES and the enterprise.  While Nokia manufactured handsets, the BES is integral to the entire BlackBerry experience.  Your communication has to travel across RIM’s servers.  Despite the recent outage they’ve done a damn good job of keeping them running over the years.  RIM can afford to lose money on their handsets because they make it back on the BES and BIS services.  It’s a business model that works.

Maybe, just maybe, the folks over at RIM have begun to recognize this.  Take a look at this post from a few months ago.  RIM plans to integrate Android support into their BES?  Will we finally have full enterprise support for Android?  I sure hope so.

While some have begun to ring the death-knell for RIM, this doesn’t have to end like a Shakespearean tragedy.

It’s crystal ball time.

RIM stops chasing their tail, and the other smartphone manufacturers, and exits the hardware business.  They concentrate on making the BES an integral part of enterprise messaging and security supporting legacy BlackBerry devices, Android, and perhaps even Windows Phone and anything else that comes along.

No need to innovate, no need to try and embrace the consumer market, no need to pay millions to settle patent disputes.  Just sit back and keep those servers humming.

You read it here first.

The Pentium G6951 is a low-end CPU intended for use in systems in the range of $500 or less. A $50.00 upgrade represents a 10% premium on the price of the entire system.

What if Lexus sold you a car with an engine that had eight cylinders but they configured the on-board electronics to disable two of the eight?  If you wanted the additional power you could bring your car in to the stealership (pun intended) and pay an additional $4,500 for them to unlock the two cylinders.  Alternately, if you felt comfortable enough doing it yourself, Lexus would send you a code to enter in to the car’s radio, or something like that, to enable the two cylinders.

Perhaps Sony and Samsung should start selling high definition televisions that only display a maximum resolution of 720p but if you send them a check for another $200 they will unlock the television to display full 1080p.

How ridiculous is that?

I don’t see this as an upgradable CPU at all.  They’ve taken a product, intentionally deactivated some of it’s features, and then repackaged it as upgradable.

All they are doing is give the world-wide teen hacker population an afternoon project to break the code and then make it freely available on the Web.  Let’s not forget DVD Jon was a 16 when DeCSS was released.  Even Blu-ray’s HDCP has been broken.

Does Intel believe they are impervious to such efforts?  How long do you think it will take for someone to release code that will unlock these CPUs for free?  I have a three byte code that will eliminate the Intel upgradable CPU issue completely:

0x41 0x4D 0x44

Much like the differences between accountability and responsibility, most confuse the terms best-in-class and world-class.  These two terms are not the same.  They are not interchangeable.  Striving to build a best-in-class widget, team or process is good.  An even loftier goal is that of building world-class widgets, teams, or processes.

As a senior manager and IT consultant, I come across groups of people claiming to either provide world-class service or wanting to develop world-class products and services.  While I understand and appreciate their desire to build a world-class organization or product, when I ask them what that looks, they can not explain what world-class means or how it is measured.

How can you set a goal for yourself, or your organization, when you don’t know what that goal looks like?  How will you know when you have achieved it?  How can you develop a strategy to reach any goal that you can not define?

In order to define exactly what world-class is and is not we must take a look at the term best-in-class.

I have read many definitions for the term best-in-class and most seem to be in sync with each other.  BusinessDictionary.com defines best-in-class as “Highest current performance level in an industry, used as a standard or benchmark to be equaled or exceeded. Also called best of breed. See also best practice.” In terms of computer hardware or software another oft-cited definition is “A product considered to be superior within a certain category of hardware or software. It does not mean absolute best overall; for example, the best-of-class in a low-priced category may be seriously inferior to the best product on the market, which could sell for ten times as much. See best-of-breed.”

The later definition accurately states that being the best-in-class doesn’t necessarily mean best overall.  The class must be defined as well.  Being number one in a class when the class is the group of underachievers isn’t necessarily something to be proud of.

I’ve tried to find definitions of world-class and can’t.  No, really.  When researching the definition of world-class what you will find are examples which are twins to the definition of best-in-class.  This must be what leads to the confusion and misuse of the term.  For example, the American Heritage® Dictionary of the English Language defines world-class as “Ranking among the foremost in the world; of an international standard of excellence; of the highest order: a world-class figure skater.”  Isn’t that our definition of best-in-class?  Just what is that standard to which they elude?  The Collins English Dictionary defines world-class as “of or denoting someone with a skill or attribute that puts him or her in the highest class in the world a world-class swimmer.”  Once again exactly what is the “highest class.”  Neither of these recursive definitions are helpful.

Exactly what is the definition of world-class?  What makes it different from best-in-class?  Is there really a difference?  Absolutely.

I have developed a definition, a benchmark if you will, that I use in developing world-class teams and processes.

world-class
adjective

A scalable, repeatable, defined process, or item, which others choose to emulate.

In order for something to be classified as world-class each of the four parts of the definition must be met.  If even one of these four is missing, the item can certainly be described as best-in-class but cannot be considered to be world-class.

Let’s break it down step by step.

1. It must be scalable.  Any world-class item must be scalable either in size or quantity.  You mom may bake the best apple pie but unless she can scale production up from her one at a time kitchen method to a method which will be able to produce thousands a day, she doesn’t quite have a world-class apple pie recipe.  However, she still may have the best-in-class apple pie and I would argue in this case, best-in-class is probably tastier than world-class.  In this case, she has a best-in-class pie, the class be all home-baked pies.  Often when things are scaled for mass production they lose something in the translation.  Scalability does not presuppose superiority.  Bigger is not always better.
2. It must be repeatable.  In order to be considered world-class the item must be able to be duplicated or, in the case of a process, repeated over and over.  This is what separates a world-class product from a one-hit wonder.  Each duplicated item must be exactly the same as the original.  The hand-built, 1104 BHP Zenvo ST1 is certainly a marvel but it’s not a world-class automobile.  It is simply a best-in-class wonder, that class being hand-built supercars.  On the other hand, the BMW 7 series can be considered a world-class automobile as it can be duplicated over and over again.
3. It must be documented.  No item can be deemed world-class if it is not documented in some way.  This documentation often takes the shape of intellectual property.  Whether it’s Coca-Cola’s recipe for Coke, McDonald’s secret sauce, or the Colonel’s secret blend of eleven herbs and spices each of these recipes are well documented trade secrets.  Without the documentation there would be no way to comply with rule number 2.  In the case of a process, the documentation would be a well written run-book.  If we were looking at something like a world-class faucet the documentation would be the plans for the faucet.
4. Others must choose to emulate it.  It is said that “Imitation is the sincerest form of flattery.”  Nothing could be more important in defining world-class.  In order to be considered world-class others, whether they are your competitors or your allies, must want to emulate your product or process.  If no one is trying to do what you are doing, it is certainly not world-class.  You may still have a best-in-class product but much like a tree falling in the woods, if no one is around to hear it fall, does anyone really care?

Now that we have our definition, let’s look at some real-world examples:

First off, McDonald’s.  World-Class?  Sure, most of the time but not all of the time.  Is the Big Mac® a world-class sandwich?  Absolutely.

1. Is it scalable?  You bet, they serve millions a day
2. Is it repeatable?  Of course.  That is the restaurant’s hallmark.  Every time you order one of those sandwiches it tastes exactly like the last time you had one.
3. Is it documented.   Yes, indeed.  The exact portion, cooking process, recipes, etc. are all well documented.
4. Do others choose to emulate it?  This is the tricky part.  In this case, yes.  There are many restaurants, both small and large, that try to duplicate the Big Mac sandwich.  In some cases, they might even make a tastier or more meaty version.  The important part is that the Big Mac® itself is so defined, so popular, so well selling that others try to emulate the sandwich.

If the Big Mac® meets the definition of world-class does that mean it is the best burger on the planet?  Certainly not.  Simply being world-class does not presuppose that item is also best-in-class.  Five Guys recently dethroned In-N-Out burger in the 2010 Zagat survey as best fast food burger.  As these two battle each other for the title of best-in-class neither is quite world-class.  No one is yet attempting to emulate their burgers.

Does this mean that all of McDonald’s foods are world-class?  No, not all of them.  Their french fries, of course.  Their fish sandwich?  No.  Can you honestly name anyone that is trying to duplicate that sandwich in their restaurant?

How about cars?

BMW, Toyota, Ford, and Pagani all manufacture automobiles yet only one, in my book, is a world-class auto manufacturer.

Each of these four product repeatable products from well documented blueprints but that is where the similarities end.

Pagani manufactures no more than ten vehicles a year, certainly not scalable.  However, the Zonda Roadster F is a 12 cylinder, 48 valve, 7.3l behemoth that outperforms anything from the other three stables.  It is a best-in-class super car but it is certainly not world-class.

Toyota and Ford both meet the scalability requirement but where they fail is the fourth criterion.  When is the last time you heard of any auto manufacturer clamoring to build a car that looked and performed exactly like a Camry or Taurus?  Sorry, guys, you just don’t produce world-class autos.

Finally, we have BMW.  Scalable?  Yes.  Repeatable?  Yes.  Documented?  Yes.  Most importantly, other manufacturers try to build cars which both resemble and/or perform like a BMW.

I challenge you to take the definition provided here and apply it to items, processes and companies you are familiar with and determine if they are indeed world-class.  Use it as a working definition when building out your teams or products.  When you have something that is scalable, repeatable, documented and mature enough that others wish to emulate it you have indeed created something worth of the moniker, world-class.

A few years ago, while dining at one of my favorite restaurants, the manager introduced me to a special liqueur that has become one of my favorite digestifs.  I can honestly say there hasn’t been one person that I’ve introduced this wonderful elixir to that hasn’t also become a fan.

One evening, after dinner, I served it on the rocks to one of my guests.  He held up the glass and asked “What is this?”  “Trust me, just sip it,” I responded.  He took a sip, paused, held up the glass, then, longingly said, “This is perfect.”  (Thanks, Igor.)  I couldn’t have said it better myself.

The liqueur is the product of Venezuela’s Ron Santa Teresa.  Two of their Rums won gold medals at the San Francisco World Spirits Competition this past April.  The Orange Rhum won Silver along with another of their white rums!

… the perfect blending of the finest rums aged for at least 2 years with an exquisite orange peel maceration. With its splendid golden amber color, luscious texture, its fragrant aromas reveal the scent of oranges…

My favorite way to serve it is on the rocks.  As the ice melts, the water opens the flavors and aromas similar to a good single malt.  For a truly decadent treat, drizzle a small amount over a scoop of vanilla bean ice cream!  Have a favorite brownie recipe?  Brush a tablespoon on top of the brownies after they come out of the oven.  Chocolate and orange… a winning combination.

Santa Teresa’s rums are a bit hard to find but are, obviously, worth the search.  I get mine from K&L Wines.  They ship throughout the US and have an exceptional selection of wines, many of which they import themselves.

Go ahead, grab yourself a glass of perfection.

Seems our friends at Twitter just settled charges that it failed to protect consumers’personal information.  Their site was allegedly hacked on two separate occasions in 2009 resulting in the hacker(s) gaining administrative control.

The first breach was the result of an insecure (read: ridiculously insecure) password and a lack monitoring.

The administrative password was a weak, lowercase, common dictionary word. Using the password, the hacker reset several passwords, and posted some of them on a website, where other people could access them.

The second instance was, you guessed it, because an employee had his/her passwords stored in plain text.  This time the hacker was able to reset at least one Twitter user’s password and could access non-public user information and tweets for any user.

“…a hacker was able to guess the administrative password of a Twitter empoyee (stat) after compromising the employee’s personal email account where two similar passwords were stored in plain text.”

You may be thinking to yourself… “So what? It’s only Twitter. It’s not like they store credit card information or medical records. Who cares?”

Think again.

Under the terms of the settlement, Twitter will be compelled to “…establish and maintain a comprehensive information security program, which will be assessed by an independent auditor every other year for 10 years.“  They are also “…barred for 20 years from misleading consumers about the extent to which it protects the security, privacy, and confidentiality of nonpublic consumer information…“

Not only do those actions affect Twitter’s operating costs, in the future, each violation of such an order may result in a civil penalty of up to $16,000!

This is just plain dumb.

Daily, I’m amazed at the number of security holes and vulnerabilities in IT systems that are not the result of bad code but are directly the result of bad practices.  There are many examples of perfectly secure IT systems which are rendered about as secure as a Madoff managed retirement fund when placed in the hands of their administrators or users.

My biggest pet peeve at the moment are clear-text passwords.

To be clear (no pun intended), I’m not referring to passwords being stored in clear-text format or whether or not they are encrypted when traveling a local network.   I’m referring to passwords sent as clear-text in E-mail.

We have met the enemy and he is us!

Unless I’m really missing something, I see no point in requiring an eight character password in which no two characters can repeat, one character must be a capital letter, another must be a digit and I can’t reuse any of the previous dozen or so passwords when the web site I just logged in to sends me back my password in clear-text!

Most of the sites I’m seeing this happen with are, of all things, HR related.  Yes, that HR… Human Resources.  These are the sites that process personal information including, in some cases, social security numbers.

Looking for a new job?  Create a profile on our site, be sure to include your full name, address, phone number, etc and then we’ll send you back a confirmation with your login ID and password in clear text so that anyone capturing E-mail or using a packet sniffer will have full access to your profile.

Need to access your benefit information?  Create a user ID on our site, be sure to include your employee ID number and we’ll send you an E-mail with your login ID and password for future reference.

This isn’t far removed from the thousands of people storing their passwords on sticky notes under their keyboards except that I never asked anyone to send my credentials back to me in an insecure E-mail.

I realize not every site operates this loosely but there are plenty.  It seems as if no one is bothering to validate their systems holistically.  They concentrate on whether the daemons are running on locked down platforms with secure sockets and infinite logging but they neglect to review how these systems operate.

Simple architectural reviews and guidelines can eliminate these and other vulnerabilities.  The question is who is minding the store?  No system should be designed or created which sends clear text passwords back to its users.  Period.

Yes, we have met the enemy and he is us!

What’s next?  Removing the pictures from history textbooks that include images of guns?  Do we remove all references to the Minute Men because they carried rifles?  While we’re at it, let’s re-write Ralph Waldo Emerson‘s “Concord Hymn” from “And fired the shot heard ’round the world.” to “And created a very loud noise heard ’round the world.“

The Arizona Republic reported in 1998 of a 13-year-old student was inspired to build a model rocket after seeing the movie “October Sky”, a biography of NASA rocket scientist Homer Hickam.  School officials classified the toy as a “weapon” and suspended him for the rest of the year based on its zero tolerance weapons policy.

Sorry, Mr. Hickam, while your story is compelling, we can’t possible have any of the children bring in model rockets because all rockets are weapons.

In 2002 an eleven-year-old bold died because his school’s zero tolerance drug policy prevented him from carrying his inhaler on his person.

The issue is not guns, drugs, harassment, weapons, rockets, explosives, racial epithets, or any societal ill other than the sheer lack of common sense.

As the father of two I certainly don’t want my children exposed to anything harmful, especially in the classroom, but can no one apply a modicum of common sense to any of these situations?

There little to no evidence that these zero tolerance policies do anything to make our schools safer or improve students’behavior.

Thankfully, for Master Morales, Lt. Gen. Reginald Centracchio took matters in to his own hands and bestowed David a challenge coin and a certificate that allows him to call himself a brigadier general!  In his words “You did nothing wrong, and you did an outstanding job.  We can only hope that kids of your caliber will continue to defend this country.”

Maybe there is a little hope after all.

Experience, especially leadership experience, can’t be rushed.  Just as a fine wine matures over time, becoming a leader can also only be done over time.  Rushing either often produces an inferior, unpalatable, product.

The art of being a leader (I use the term art as there most certainly is no science that can define all the qualities of a leader) is dependent upon one’s experiences.  Yes, we’ve all heard the term, and may have even seen, a “natural-born leader” but even those leaders rely on their personal and professional experiences.  They are only born with the potential to be a great leader.

Being placed in to a leadership role, or worse, assuming a leadership role, without the experience necessary to support one’s decisions is a recipe for failure.

Many years ago I worked for a computer integrator whose “National Sales Manager” knew little about computers, little about customer service, and even less about leading a team.  He would often change the rules regarding sales territories and referrals based on how it would benefit himself the most.  Needless to say he was universally disliked and no one respected him.

How did he garner the position of National Sales Manager?  Over time, all of the other sales people left the company leaving him as the only sales person.  Naturally, he granted himself to the title of National Sales Manager never having managed anyone or anything before.  He was simply the last sales person left at the company.

Many start-up companies, especially in the dot-com arena, fall prey to a similar elevation of titles.  How many “C” level people at these start-ups attained their position simply because they were the first developer hired?

Being the last person standing, or the first person in, doesn’t make someone a leader any more than being the most senior or tallest member of an organization.

A leader must understand the difference between assertiveness and aggressiveness.  He or she must be able to develop and articulate their vision of the future.  They must be open to new and different ideas.  They ask “what if” rather than dictate “what is.”  A true leader operates with integrity and humility.

Each of these qualities are best when, like a fine wine, they are developed and nurtured over time.