As the cybersecurity industry works to address a shortage of skilled workers, an advertisement backed by the UK government may provide an example of what not to do.

The ad, which encouraged people working in the arts to retrain in cybersecurity, has been abandoned amid backlash online and even within the government, according to reports from The Guardian, The Washington Post and MarketWatch.

Although pulled from the official website, the ad was still easily viewable after going viral on social media with the hashtag “#SavetheArts.” The image displays a ballet dancer tying her shoes. The caption reads, “Fatima’s next job could be in cyber (she just doesn’t know it yet),” followed by the tagline “Rethink. Reskill. Reboot.”

Posted on the website of training firm QA, the ad was part of the UK cybersecurity agency’s Cyber First campaign, which promotes tech training for young people. Oliver Dowden, the British culture secretary, tweeted that the ad was “crass” and did not come from his agency. A spokesperson for the prime minister said, “This particular piece of content was not appropriate and has been removed from the campaign.”

The UK government’s volte-face followed widespread criticism that the ad showed disrespect toward the culture sector, which has been suffering catastrophic job losses. The author Caitlin Moran tweeted: “I don’t know if the government know they appear to have recently created a ‘Hopes & Dreams Crushing Department,’ but for a country already depressed and anxious, I would suggest it’s a bit of a ‘Not now, dudes’ moment?" The shadow health minister, Rosena Allin-Khan, chimed in: “Fatima, you be you. Don’t let anyone else tell you that you aren’t good enough because you don’t conform to their preconceived social norms.”

Meanwhile, a recent survey finds that most people say a career in cybersecurity isn’t for them, despite the sector’s demand for talent. Among 2,500 U.S. and UK workers surveyed by (ISC)2, 69% said that while cybersecurity seems like a good career path, it isn’t the right personal fit.

The world of analytics is changing.  Self-Service Analytical tools like Tableau, Qlik, and Power BI are enabling business users to perform reporting and analytics on their own with little to no support from the IT organization. This trend has evolved due to several factors including:

1)    Organizations are flooded with data and IT organizations are not able to keep up
2)    Easier to use Business Intelligence tools make it more efficient for business users to directly create their reports rather than go through IT for a project
3)    IT organizations analytical projects can take several months when a business needs this information in weeks

This trend has caused the efforts of IT Business Intelligence (BI) teams to spending most of their energy gathering, cleaning, and structuring data for the business to perform their own analytics through a self-service model. In special cases, they provide industrial strength reporting that can scale to thousands of users where trusted verified data is needed.  However, they are still being shown the door when it comes to some of the more interesting work.

What can IT BI teams do to stay relevant and valuable to the business? We have several suggestions that relate to embracing self-service analytics as the new reality and transitioning core competencies of the Business Intelligence team away from purely descriptive reporting and moving to diagnostic & predictive analytics.

Let’s explain that last concept before prescribing several solutions. The current state of most analytics is descriptive in nature and helps answer questions of, “what occurred?” Diagnostic and Predictive Analytics help answer the questions of, “Why did it occur?” and sets the stage to answer, “What can I do about it?”  Diagnostic Analytics helps organizations to not only understand what, but also why and what decisions and actions can be taken to solve for the issue. This type of analytics is more valuable to the business and requires competencies that IT BI teams are uniquely qualified to bring from their years of building analytical solutions.

To enable IT Business Intelligence teams to move up the value chain from providing commodity reports to business driving analytics, we recommend adding these four components:

1. Build out a Data Science capability– Data Scientists are starting to appear in analytical groups within companies. However, they are still not pervasive and the function is understaffed. In addition, most groups within a company cannot justify the cost of a full-time data scientist. By adding data scientists to the IT BI organization, you are creating a centralized team that can provide analytics to underserved parts of the organization.  This team is already focused on creating analytical data structures and reports and adding the ability to derive insights from the data is a natural extension.   
2. Make it about the Decision– In your requirements process, add Decision Architecture Methodology as a capability. Most methodologies for capturing analytical requirements focus on the questions asked of the data to surmise the Dimensions and Facts.  While this gives us great descriptive analytics, but it does not move the company along the analytical maturity curve.  A deeper focus on the decisions that the business makes and thereby centering analytical capabilities around helping to enable actionable insights will move the needle.
3. Add Decision Theory to your analytics– If Data Science helps you turn information into actionable insights, Decision Theory helps you structure the decision process to guide a person to the correct choice. Decision Theory, along with Behavioral Economics, is focused on understanding the components of the decision process to explain why we make the choices we do. It provides a systematic way to consider tradeoffs among attributes that helps us make better decisions. Tools such as thresholds, alerts, decision matrixes, and choice architecture should be considered important capabilities to add to your team’s tool chest.
4. Create a Report Certification process– As report proliferation occurs with self-service analytics, creating a standard for the health and validity of a report is going to be important if the analytics are to be consumed by a broader audience and are to be trusted.  For example, you may have one group create a report with key metrics sourced from uncertified data sources. By putting reports from individual departments through a certification process similar to UL labeling on electrical products, broader consumers will know the level of scrutiny that has been put on the report by Data Governance and IT teams and thereby trust the data and metrics contained within it.

As IT Business Intelligence teams look to move up the value chain in the capabilities they offer to their internal customers, adding addition skillsets, methods, and tools will be a necessity. The capabilities outlined are a great fit for a centralized team to own and this transformation in IT BI teams can speak to the value these enhanced capabilities provide to the business.

Andrew Roman Wells is the CEO of Aspirent, a management-consulting firm focused on analytics. Kathy Williams Chiang is VP, Business Insights, at Wunderman Data Management. They are the co-authors of Monetizing Your Data: A Guide to Turning Data into Profit-Driving Strategies and Solutions. For more information, please visit www.monetizingyourdata.com.

It’s no surprise that big data is on the rise in businesses around the world. Companies routinely use big data to analyze common trends in their practice; enabling them to make sophisticated decisions to ensure their businesses prosper. According to Statista, an online statistics, market research and business intelligence portal; companies routinely use data to drive process and cost efficiency; drive strategy; and to monitor and improve financial performance. When used in these ways, data has the ability to save the company a significant amount of money because they are able to spend their money efficiently.

While data does have the ability to improve a company’s performance; companies just aren’t catching up on the trends as fast as one would assume.  Big Data software company, Quoble along with Dimensional Research; recently published an e-book, “An In-Depth Look at Big Data Trends and Challenges”. As the name suggests, the data looks at global data trends in the workplace and the problems that businesses often face.

Among the issues that the research uncovered was, “the realization of value from big data in on-premises environments has lagged expectations, largely due to complexity, cost overruns, steep demands for specialized talent, and need for powerful computing platforms.” While companies may understand the value that big data brings their company; finding qualified candidates and obtaining funds to purchase the computing platforms needed to manage data sets are among the set backs employers are facing today. Nearly 75% of those surveyed sighted a gap between the necessary resources and tools that are available to them. And while 50% of businesses plan to moderately increase their data headcounts in the next year; 83% find it difficult to find the right candidate.  Not only does it take time to find the money to pay for data headcounts; finding the right candidate can often times be complex and time consuming.

The survey found that big data teams’ lack of experience creates a slow progress to get things done. 42% also sight that it is hard to keep up with big data trends and new data sources.  Big Data is constantly expanding. Five years ago machine learning and AI weren’t as mainstream as they are now. BI tools were available but not widely used and companies didn’t have big data teams. In fact their “team” often consisted of one or two data scientists. Big Data’s continuous growth has lead to expansion that many businesses can’t keep up with.

The intention of Quoble’s “An In-Depth Look at Bid Data Trends and Challenges” is  not to solve these problems, but to bring awareness to the issues that companies are facing when it comes to data.  As big data continues to surge, so will an influx of knowledgeable employees and efficient software that will guide the business to succeed in an age where big data is becoming the norm.

To view the full report, go to Quoble’s website and download the free e-book.

Colleagues think of data analysis much in the same way they think about marketing. Which is everyone thinks they are data analysts. With little to no practice they can put together graphs and visualize data at the drop of a hat. When interviewing Dave from accounting he made sure you knew that he has Tableau reader on his desktop which totally means he’s one step away from Tableau certification. Karen from Sales also discussed her extensive knowledge when it came to Excel. Yes, that same Karen who emailed you a month ago and asked how a pivot table worked.

If you’re interested in a career in big data it shouldn’t be daunting, but you should take the time to research and learn the tools and software needed to excel (pun intended) at the job. Data analysis is so much more than filtering data and pretty graphs. It takes someone who is curious and can think analytically to thrive in the job.

In his 2009 book, Now You See it: Simple Visualization Techniques for Quantitative Analysis; author and information technology innovator Stephen Few lists 13 key traits of a data analyst. Among those traits include, self-motivation; open-mindedness; and the ability to spot patterns. An average data analyst can access a data set; scrub the data; and visualize it using one of numerous data visualization platforms available. She then comes to conclusions based on those visualizations and calls it a day. An exceptional data analyst can use that same data set and visualization tools and come to the same conclusions. The difference is that he will ask different questions and hypothesize about why conclusions are what they are. An exceptional data analyst asks why 9 out of 10 dentists prefer Colgate or why Rugby is becoming a more popular youth sport in the United States while lacrosse youth teams are declining.  For them, it isn’t enough that the data shows an increase in Rugby youth teams. They have to know why. Which will ultimately bring them to more questions which will lead to more data sets and more visualizations. In essence, is a data analyst’s job ever really done?

Another factor that separates a mediocre from an excellent analyst is the ability to tell a story. Unless you are speaking to a fellow analyst, chances are spewing out data isn’t going to capture the attention or the comprehension of what the statistics show. In fact, if you go that route, you may be met with a lot of blank stares. It’s important to tailor a narrative to the audience you are speaking to. Crafting a story beforehand makes it easy for your audience to follow and will help you answer any follow up questions that you might receive.

While you may have the skills that make an excellent data analyst, without practice you’ll never truly be outstanding at your job. And with data analysts and scientists being critical to the success of a company, it’s important that you push past mediocrity and aim for excellent. So tomorrow when you go into work remember that not everyone can be an analyst but by methodically thinking, crafting a perfect story from your data sets and asking questions, you’ll be on the road to greatness.

Texas Gov. Greg Abbott has signed a bill that changes the state’s data breach notification requirements, effective September 1. So reports Business Insurance.

The new law requires the Texas attorney general to post a listing of breaches that involve at least 250 of the state’s residents.

A similar law in California requires such posts for breaches that involve 500 or more residents.

Read the full article from Business Insurance.

Colorado lawmakers have passed the Colorado Privacy Act, making the state the third to enact legislation protecting consumer data. So reports The Colorado Sun.

The measure would allow Colorado residents to ask companies to delete their personal data.

At press time, the bill was still pending a signature from Gov. Jared Polis.

Read the full article from The Colorado Sun. 

Democratic and Republican lawmakers have recently unveiled a wide range of cybersecurity bills. So reports GovInfoSecurity.

In the Senate, the International Cybercrime Prevention Act would stiffen penalties for hacking critical infrastructure, while in the House, the Enhancing K-12 Cybersecurity Act aims to protect school districts.

Another Senate bill, the Data Protection Act, would create a new agency to protect Americans’ private data.

Read the full article from GovInfoSecurity.

The massive Colonial Pipeline breach has spurred the Department of Homeland Security to begin regulating the pipeline industry’s cybersecurity practices for the first time ever. So reports Security Systems News.

The DHS-overseen Transportation Security Administration (TSA)issued a security directive that would mandate disclosure of cyber incidents by pipeline companies. The directive mandates critical pipeline owners and operators:

• Report cybersecurity incidents—both confirmed and potential—to CISA
• Designate a Cybersecurity Coordinator who is available all day, every day
• Review current cybersecurity practices, identify potential risks and solutions to them and report them to the TSA and CISA within 30 days  

Read the full article from Security Systems News.

While recent focus has been on ransomware attacks with national security implications, a recent data breach at wireless provider T-Mobile still holds lessons for the cybersecurity community, recent reports suggest.

As The Wall Street Journal reports, T-Mobile has confirmed that hackers stole the personal data of 54 million people, including birthdates and Social Security numbers. Hackers then tried to sell the information online for between $80,000 and $270,000 in bitcoin. The Federal Communications Commission was reportedly investigating.

As The Washington Post notes, while these types of attacks may lack the headline-grabbing drama of ransomware, the T-Mobile breach shows that the threat from hackers who steal data simply to sell it online remains serious. Brett Callow, a threat analyst at Emisoft, told The Post, “The motivation obviously is money.”

The incident also raises the question of why certain companies seem particularly prone to cyberattacks. Forrester security and risk analyst Allie Mellen told The Post that the breach is at least the fifth in four years for T-Mobile. Mergers and acquisitions, such as T-Mobile’s combination with Sprint last year, can make it harder to align cybersecurity standards, Mellen observed.

There’s an old saying about why bank robbers rob banks: because that’s where the money is. Michael Daniel, president and CEO of the Cyber Threat Alliance, pointed out to The Post that cybercriminals target companies “where there are large pools of customer data available.”

Still, as The Washington Post notes in a separate report, even tens of millions of data breach victims may not be enough to capture public attention in an era when news of cyberattacks have become routine. The T-Mobile breach may wind up as a defining example of what security researchers call “breach fatigue.”

As AdAge reports, customers might “shrug off” the news. Marketing experts and analysts said that while new users might be reluctant to sign up with T-Mobile while the breach is top of mind, existing customers will probably stay put. They might have even expected as much. A Compliance Week headline calls T-Mobile’s hack “the least surprising data breach of 2021.” Nevertheless, according to Bloomberg Law, T-Mobile faces a pair of class action lawsuits alleging violations of the California Consumer Privacy Act.

T-Mobile is working with Mandiant and KPMG to bolster its cybersecurity, reports The Verge. In an interview with The Wall Street Journal, the 21-year-old taking responsibility for the attack called the company’s defenses “awful.”

A massive bipartisan infrastructure bill passed by the Senate includes billions in cybersecurity spending. As The Washington Post reports, the $1.2 trillion infrastructure package passed the Senate by a 69-to-30 vote on August 10 and was headed to the House.

The Colonial Pipeline ransomware attack in May helped galvanize lawmakers to protect roads, pipes and electric grids from cyberattacks. Sen. Angus King (I-Maine) told the Post, “​​This is an incredibly serious threat to this country that’s only growing more serious.” As the Post notes, the bill calls for a new Federal Highway Administration tool to improve transportation authorities’ cybersecurity response and detection. The bill also provides emergency funding for responding to cyber attacks on public water systems. The Federal Energy Regulatory Commission is instructed to set up incentives for cybersecurity funding and data-sharing among power utilities.

The Senate infrastructure package also allocates more than $1.9 billion for particular cybersecurity programs. As The Hill reports, that includes $1 billion to help state and local governments improve their cybersecurity. The funds would be administered through a four-year grant program at the Department of Homeland Security. A quarter of the spending is set aside for rural communities.

The bill also allows the DHS secretary to declare a “significant incident” regarding a digital attack on critical U.S. infrastructure. This declaration would unlock a five-year, $100 million pot of money to aid affected organizations.

Other allocations in the bill include $35 million to DHS’s Cybersecurity and Infrastructure Security Agency for sector risk management investment, $160 million to DHS’s Science and Technology Directorate for cybersecurity and tech research investment and $21 million for the previously unfunded White House national cyber director office.

As CNBC reports, the infrastructure package also includes tech spending beyond cybersecurity, such as boosts for broadband access and electric vehicles.

Verizon has unveiled its latest annual data breach investigations report, and it comes as no surprise that a year unlike any other was also an active time for cybercriminals.

The 2021 Verizon Business Data Breach Investigations report, based on a review of 29,207 incidents and 5,258 confirmed breaches worldwide, illuminates the cybersecurity impact of last year’s shift to remote working during the COVID-19 pandemic.

“The COVID-19 pandemic has had a profound impact on many of the security challenges organizations are currently facing,” Verizon Business CEO Tami Erwin said, in a press release. “As the number of companies switching business-critical functions to the cloud increases, the potential threat to their operations may become more pronounced, as malicious actors look to exploit human vulnerabilities and leverage an increased dependency on digital infrastructures.”

Phishing attacks were present in 36% of breaches studied, up from 25% in last year’s report, with the role of misrepresentation rising 15 times over 2020’s edition. Ransomware proliferated, doubling its share of breaches to 10% from 5% the previous year.

Relatedly, web applications represented 39% of all data breaches, according to Verizon (it wasn’t clear what share they made up in 2019).

A human element was at play in 85% of the breaches. External parties discovered more than 80% of them.

Using simulations, Verizon estimates the median financial impact of a breach was $21,659, with all but 5% of incidents fitting in an $826-$653,587 range.

As ZDNet notes, data breaches showed subtle differences across industries in Verizon’s report. Healthcare suffers from “basic human error,” particularly the misdelivery of documents. Phishing emails based on social engineering beset public administration.

Other nuances emerge across regions. In North America, cyber attackers’ motivation is often financial, and the tools they prefer tend to be social engineering, hacking and malware. Europe, the Middle East and Africa face basic web application attacks, system intrusion and social engineering.

As Avast notes, while last year’s report found that small organizations discovered breaches more quickly, this year the gap between small and large organizations has mostly vanished.

In general, the report states that “breaches are moving toward social and web-app vectors, and those are becoming more server-based, such as gathering credentials and using them against cloud-based email systems.”

Florida’s legislative session has come and gone without the passage of a sweeping new consumer data protection bill.

As the Miami Herald reports, House Speaker Chris Sprowls prioritized the Florida Privacy Protection Act, also known as HB 969, and the bill had enjoyed wide bipartisan backing in both the state House and Senate. The measure, largely modeled after the California Consumer Privacy Act of 2018, would have forced Florida businesses to reveal the data they collect from their apps and websites.

Specifically, according to marketing publication The Drum, any company doing business in Florida with at least $50 million in annual revenue would have been subject to HB 969. Also covered would be any company that collects, sells or shares data on at least 50,000 customers a year, or that makes at least half of its revenue selling consumer data.

Under the bill, consumers would gain the right to request their data be deleted and choose whether they want their data to be gathered or resold. Businesses that sold data from consumers who opted out would have been potentially liable for civil damages.

This right for consumers to sue—a so-called private right of action—became a particular point of opposition for business lobbyists, as the Herald reports. Sprowls, a Republican, contended that a private citizen should be able to sue if an organization collects and resells their data after being denied permission. Of 334 lobbyists hired over the bill, most were reportedly trying to drown it.

In March, Virginia recently followed California as the second state to enact a consumer privacy law, though Virginia’s version doesn’t include a private right of action. Instead, the state attorney general’s office is in charge of enforcing the law.

Al Saikali, chair of the privacy and data security practice at law firm Shook, Hardy & Bacon LLP, opposed the Florida House bill, as The Wall Street Journal reports. Saikali said that HB 969 would have gone further than California’s law, allowing businesses to be sued for a wider range of infringements. He said the Senate version would have more closely followed the California and Virginia laws.

“The Florida privacy legislation appears to be dead, and the best way to explain it is with the southern adage that ‘pigs get fat, hogs get slaughtered,’” Saikali wrote in a separate blog post. “With a strong privacy bill in hand that gave privacy advocates 95% of everything they wanted and approved by the Senate, the House decided it wanted more. It really wanted its private right of action.”