Desicritics Category: BizTech: Management

Systems Thinking and Counter-intuitive Nature of Social Systems

Sumanth — Mon, 15 Mar 2010 20:01:15 EDT

In the forward to the book "Order out of Chaos" by Nobel Laureate Ilya Prigogine, Futurist Alvin Toffler wrote:

One of the highly developed skills in contemporary Western Civilization is dissection: The split-up of problems into smallest possible components. We are good at it. So good, we often forget to put the pieces back together again.

What Alvin Toffler said was profound. He actually pointed at obsessive reductionism and lack of wisdom in Western civilizations in understanding and designing systems to solve complex social problems. I do not have to give examples from recent history of Middle East, Iraq or Afghanistan to prove this fact.

In the 90s, I spent couple of years doing research on complexity, computer simulation of complex process and learning systems apart from avidly reading some of Alvin Toffler’s books. I was passionate about the whole “Systems Science”. I wondered if mathematics of dynamical systems(link) can be applied to complex disciplines like management, sociology and psychological Sciences.

Then, I came across some work on “Systems Thinking” by Peter Senge, professor at MIT Sloan School of Management. That led me to work that Jay Forrester did on “Systems Dynamics” at MIT. That made a connection between Control Theory(link) and Social Dynamics. (Fifth Discipline, Peter Senge, System Dynamics)

Systems Thinking is, more than anything else, a mindset for understanding how things work. It is a perspective for going beyond events, to looking for patterns of behavior, to seeking underlying systemic interrelationships which are responsible for the patterns of behavior and the events. Systems Thinking embodies a world-view; A world-view which implies that the foundation for understanding lies in interpreting interrelationships within systems; Interrelationships which are responsible for the manner in which systems operate. Interrelationships which result in the patterns of behavior and events we perceive.

When we go beyond the linear cause and effect paradigm to study patterns of behavior and then to study the systemic interrelationships among the parts of systems we develop a much deeper understanding of the nature of the way things operate; an operational understanding, which can allow us to work with the system rather than against it. An understanding which allows for the development of interventions to create lasting change within the system, if that is the desired intent.

Jay Forrester writes

Society becomes frustrated as repeated attacks on deficiencies in social systems lead only to worse symptoms. Legislation is debated and passed with great hope, but many programs prove to be ineffective. Results are often far short of expectations. Because dynamic behavior of social systems is not understood, government programs often cause exactly the reverse of desired results.

The field of system dynamics now can explain how such contrary results happen. Fundamental reasons cause people to misjudge behaviour of social systems. Orderly processes in creating human judgment and intuition lead people to wrong decisions when faced with complex and highly interacting systems. Until we reach a much better public understanding of social systems, attempts to develop corrective programs for social troubles will continue to be disappointing.

Then, he throws the bombshell:

The human mind is not adapted to interpreting how social systems behave. Social systems belong to the class called multi-loop nonlinear feedback systems.

The basic principles of Systems Thinking are listed below and they are based on mathematics of dynamical systems. Their application is very simple. Whenever, a policy maker violates any of these principles (which can be used as a checklist), then one can look for a disaster waiting to happen.

1) Today's problems come from yesterday's "solutions."

2) The harder you push, the harder the system pushes back.

3) Behavior will grow worse before it grows better.

4) The easy way out usually leads back in.

5) The cure can be worse than the disease.

6) Faster is slower.

7) Cause and effect are not closely related in time and space.

8) Small changes can produce big results...but the areas of highest leverage are often the least obvious. (Most obvious solutions for complex social problems can be at best useless and at worst dangerous)

9) You can have your cake and eat it too ---but not all at once.

10) Dividing an elephant in half does not produce two small elephants.

11) There is no blame.

It is very easy to see that a lot of these principles get violated by political parties and governments worldwide. The feedback systems create havoc across the world economies as the bubbles get burst and the coupled systems swing wildly impacting lives of billions of people.

These principles of systems thinking can result in different patterns or structures of behaviour called “archetypes”. Some examples of Archetypes are: Fixes that fail, Accidental adversaries, shifting the burden.

Why are Social Systems counter-intuitive?

Humans are inherently limited in thinking that cause and effect are closely linked in time and space. For example, you touch a hot stove and you immediately feel a burning sensation on your hand. However, in social systems, the cause and effect are often far removed in time and space, which completely deceives the policy makers.

The simple example is: Imagine there is 8 second delay in the steering wheel of your Car. That is, when you turn it left, it does not respond immediately and it starts turning only after 8 seconds. Now, consider there is a 20 second time delay in your accelerator pedal. Imagine when someone calls you on cellphone, the speed of your car doubles. Now, imagine driving such a Car at 50 miles per hour in a test track. That Car will take you for a ride.

Social systems seem to be slow, but they are much more complex than this example and they take the policies and interventions for a ride. That is what dangerous time delays and couplings in space and time can do. Human mind is not adapted to interpret such multi-loop nonlinear feedback systems. One policy intervention creates multiple effects and side effects over different periods of time at different locations in space (say in the country). These side effects in turn are misinterpreted and polices are implemented to counter these side effects. This entire process takes one very far from real solution or original intentions. The problems do not get solved, but the interventions produce some more severe problems. Then, societies deal with both.

We just have to look at problems in Middle East, Iraq or Afganistan to appreciate this idea.

Jay Forrester adds further.

Social systems exhibit a conflict between short-term and long-term consequences of a policy change. A policy that produces improvement in the short run is usually one that degrades a system in the long run. Likewise, policies that produce long-run improvement may initially depress behavior of a system. This is especially treacherous. The short run is more visible and more compelling. Short-run pressures speak loudly for immediate attention.

Attractive Policies can Create Disaster.

For example, usage of certain pesticides in a farm can lead to reduction in pests for some months and then the pests increase rapidly in spite of usage of the same pesticide. So, what happened? The pesticide initially started killing off one category of pests. However, this category of pests used to feed on other pests more immune to the pesticide. As the pesticide killed the predatory pests, the other pests immune to pesticide started breeding and took over the farm.(link)

Then, I read in newspapers that dowry problem has spread all over India as more and more laws are enacted, crime against women is increasing at a rapid rate and women in US are unhappier compared their grandmothers after 40 years of campaigns and struggles. Now, I know, why India has much less crime rate than US in spite of India's corrupt police and dysfunctional judicial system.

What happened? When you push a complex system harder, the harder it pushes you back. There are only a very few points of influence in such chaotic systems(link), which are highly sensitive to initial conditions. These points of influence are not at all obvious. It’s like those kid’s fairy tales, where a demon has hidden his heart in some box somewhere and to kill him, you need to locate that box. It is very certain that the System pushed the policies back harder as the counter-intuitive non-obvious solutions were discarded due to rhetoric, populism or lack of understanding of how systems work.

I have every reason to believe that wild rhetoric on victimhood of women with false statistics, contributed to a rise of “female foeticide” in urban India and it worsened the already existing situation by disempowering educated parents, who may have actually fought against the bias.

Similarly, a law against acid attacks may actually lead to rapid increase in incidents. The massive newspaper coverage of enactment of the law followed by victim stories may spread the idea (of use of acid) to many pathologically sick criminals. At present a few hundred people get attacked by acid every year. After the news, thousands may in fact think of storing acid at home as a weapon for their own self defense and that will create a far worse problem than what it is today.

If 33% seats are reserved for women in Parliament, it may lead to more laws in favour of women. However, soon there can be a small strongly held “male vote bank” and women candidates may compete with each other for “appeasement of males” in the constituency. Being women, these elected representatives will face less chance of being labeled as anti-women, so they will be more confident in cutting off privileges bestowed up on women now.

Systems Thinking can be applied to all dynamical systems starting from teams in corporates, to management, economic systems, stock markets, social movements for change and Government policies. All it requires for one is to train oneself in this alternate way of thinking by taking non-linearity, circular influences/feedbacks and multiple side-effects in time and space into account. One can also use various computer simulation and modeling tools to simulate and play with the complexity. It’s like a “social or management flight simulator”. One can see some such simulations in Wikipedia link on Systems Dynamics.

It is possible to create self-organizing and self-replicating learning organizations(link) to bring change, when one uses the principles of systems thinking at its core.
References:
1) A Guide to Learning System Dynamics.

2) Generic Structures: Overshoot and Collapse.

3) Generic Structures:Oscillating Systems

4) Archetypes: Interaction Structures

IT Outsourcing Can Actually Increase a Firm's IT Spend

Dr Bhaskar Dasgupta — Sat, 6 Mar 2010 17:40:55 EST

I have learnt the hard way that trying to outsource on the basis of “manage my mess for less” is a sure fire way of crashing and burning at worst and being more expensive at best. Anything that is crucial to your firm’s success, you do not outsource. In other words, only outsource which is a commodity and it is easy to switch suppliers such as perhaps storage management, electricity supplies, sewage, catering, cleaning, etc.

Lo and Behold, here’s a paper which provides some more data to back up the idea that outsourcing actually pushes up your costs. The data used is crucial and I quote:

ITOS and IT spending data were obtained from InformationWeek magazine, a weekly print magazine aimed at business technology professionals. Since 1991, InformationWeek has conducted annual surveys to gather current year IT budgets from a variety of the largest US public and private firms and government entities that use IT. It has supplemented this with firms demonstrating innovative use of IT. In 1999, InformationWeek began asking firms what percentage of their IT spending is outsourced. InformationWeek recently provided the additional firm-level data for the 1998 to 2005 time period for this study with strict disclosure restrictions on the authors precluding the sharing of specific firm responses. Data are used from respondents who provided both IT spending and ITOS information for one or more years between 1999 and 2005. Observations for non-public firms were eliminated and merged with corresponding Compustat financial data to calculate the various control variables shown to affect IT budget levels in Kobelsky et al. (2008b). This reduced the overall sample to 1959 firm-year observations for 647 firms in the period 1999 to 2005

The model comprises of variables:

• itb/sls = firm IT budget for each year per InformationWeek data divided by sales for that year (Compustat data12);

• itos dummy = 1 if IT outsourcing percentage per InformationWeek data is positive in Current Year, 0 if not;

• size = log of Current Year sales;

• ind_conc_ratio = four-firm concentration ratio for four-digit SIC;

• uncertainty = standard deviation of earnings before extraordinary items for previous 5 years scaled by sales;

• rel_divers = related diversification (within 2 digit SICs);

• unrel_divers = unrelated diversification (across 2 digit SICs);

• op_ros = operating return on sales, before depreciation (compustat data13/data12);

• debt_ratio = debt ratio (Compustat data9/data6);

• ave_sales_growth = average sales growth for last two years;

• automate = 1 for firms in automate industries, 0 otherwise;

• transform = 1 for firms in transform industries, 0 otherwise;

• hi_tech = 1 if high-tech firm, 0 otherwise

• lo_tech = 1 if low-tech firm, 0 otherwise.

• year = 1 for each year 2000-2005, 0 otherwise.

90% of the sample companies partake of outsourcing some or all of their IT activities. The authors find that while on a project level, they might see a reduction in the IT costs and spend, on an aggregate firm level, the IT spend actually goes up. Note that they do control for scope and volume changes by looking at the sales growth. Within two years of outsourcing, the IT cost level of firms who have outsourced is correspondingly higher than firms which have not outsourced. While the authors suggest that this is because of capabilities are enhanced, I have my doubts. One cannot improve IT capabilities in 2 years, it is simply not possible to evolve the business and IT side so quickly that a statistically significant improvement in productivity and quality can be observed. It is, in my opinion, clearly aimed at the fact that the business case is frankly wrongly specified and outsourcing doesnt really help as far as cost control is concerned.

Business cases are rarely expressed in terms of ratio’s, in other words, you will very rarely find that the managers concerned or the IT outsourcing firm are quoting you IT costs as a ratio to say the sales revenue or operating costs or profits of the firm. This is why I am very nervous whenever I hear that outsourcing is happening which is going to drive down costs.

There is a good argument to outsource to improve efficiencies, drive a centre of excellence, to improve productivity, but for cost purposes, the figures do not bear out the benefits.

It Takes Intelligence to Review & Deliver Intelligence

Dr Bhaskar Dasgupta — Fri, 8 Jan 2010 21:20:21 EST

This is the most amazing and honest report I have read. This Major General (U.S. Major General Michael Flynn) has shown huge courage to be brutally honest about the intelligence failings in the Afghan campaign and typically the press reports and the Pentagon have dumped on him. This is one reason the USA and its allies will win, because they learn (at least I hope they do). I would also hope that his maverick behaviour does not end up harming him, but given the courage and intelligence shown by General Petraeus and General McChrystal, his two respective bosses, I think not. But let us get back to the report and what a report it is! It is brutally honest. It cuts across the fog of organisational chaos by the ton and homes in directly, in a few short pages, on exactly where the problem is, giving some examples of where they are going right now and what they need to do.

But first the background. This report was written by the Head of Military Intelligence of the US forces in Afghanistan as a review report on how intelligence gathering is happening, what the objectives are, what the drawbacks are, and how to improve the procedures so it benefits the senior military leaders and the political masters.

Reading this report will also help the generals and ministers of any other country currently facing an insurgency or dealing with a terrorist campaign. If you look at Thailand, India, Pakistan, China, etc., they all need to read this report.

However, it is not only a must read for those, but actually also for those who are also facing not just direct insurgency campaigns. Are the people in the United Kingdom who are being faced with a domestic British Muslim terrorist campaign reading this? Are they adapting the lessons learnt from Afghanistan in this intelligence evaluation report with respect to the Islamic societies in British Universities and the mosques in the UK? The quiet neighbourhood doctor or engineer who is secretly planning to blow up a building or nightclub? How are the links between the society, the mosques, the press, the NGOs, the charities, the police, MI5 & MI6 and the ministers being managed?

I don’t think this is only applicable to terrorism or the military. I think this is equally applicable to big firms and financial institutions. Here’s a question you can ask any grand poobah of strategy or CEO or head of planning. Do they have a strategy for collecting product, customer, market, country, regulator, and other types of information which is relevant to what head of the business needs to know? Have they ever run a review akin to what this report does? How do they know the mass of information being produced at the coalface (and believe you me, there is a whole load of information that is produced - ranging from product information, customer details, trading details, supply chain information, contact reports and emails, etc. )? How are they aggregated, distributed, sliced, fed up, sideways and down the chain? I quote from the report:

“Creating effective intelligence is an inherent and essential responsibility of command. Intelligence failures are failures of command – [just] as operations failures are command failures.”

In other words, if you as a senior manager are not getting sufficient information, then the responsibility of getting that information is yours, not somebody else’s and you need to take responsibility for this The execution, however, can be done by your head of MI, sales, COO, etc. etc.

There are absolute gems hidden in this report, which again have implications for both the military and civilian businesses. I am going to quote them and try to comment on them to clarify what I mean.

The second inescapable truth asserts that merely killing insurgents usually serves to multiply enemies rather than subtract them. This counterintuitive dynamic is common in many guerrilla conflicts and is especially relevant in the revenge-prone Pashtun communities whose cooperation military forces seek to earn and maintain. The Soviets experienced this reality in the 1980s, when despite killing hundreds of thousands of Afghans, they faced a larger insurgency near the end of the war than they did at the beginning.

This is far too common. Just measure the number of body bags (as was done in Vietnam), or the number of meetings held with customers or the revenue per customer, etc, these are often metrics that are used to judge progress or performance. But is that really what the military or corporate strategy is? No, that’s not it. The military strategy is to provide security and allow or support a fairly stable governance in Afghanistan so the Taliban’s bent of ideology and governance backed by their rage boys cannot take root. Yes, there are other requirements as well, but the objective is not to kill the Taliban, but to take the moral, civil, economic and military ground away from them. This might mean (and does mean) popping off the relevant commanders and does include having fire-fights, but you don’t measure by this metric. One needs intelligence and analysis to supports decision making. Similarly on the business front, far too often metrics drive management and strategy. We need to grab customer loyalty. No, we want customers to not only give us their business, but help us get more business by recommending us to other customers. That cannot be achieved, managed and delivered by measuring the number of calls you make to the customer, it needs a much broader sense of information. Otherwise, what you will end with is a huge body count or a huge list of contact reports, but lose the war or the business.

What are the barriers in getting this information?

“The barriers to maximizing available intelligence are surprisingly few. The deficit of data needed by high-level analysts does not arise from a lack of reporting in the field. There are literally terabytes of unclassified and classified information typed up at the grassroots level. Nor, remarkably, is the often-assumed unwillingness to share information the core of the problem. On the contrary, military officers and civilians working with ISAF allies, and even many NGOs, are eager to exchange information. True, there are severe technological hurdles, such as the lack of a common database and digital network available to all partners, but they are not insurmountable.

People often think that they need a giant new CRM system, network, or a database or that they have to establish big hairy governance bodies aligned with massive organisational transformation or dual / triple reporting lines. Not really, frankly that is rarely the problem. But it’s an easy solution, mind you, because it provides a concrete “something” that you can touch and deliver. Why do most of the business intelligence projects fail? They do because the fixation is on the damn system, database, network and not on the information or the culture or the strategy. An example where many of these issues have been resolved and fixed is the investment banking business, which is perhaps one of the most efficient legal sustainable moneymaking organisations known to man, with the exception of loan sharking or drug running or Ponzi trading. Data is always there, people LOVE to talk and give you information. But one needs to listen, read, review, pass up and down and sideways. See what the report says further:

The most salient problems are attitudinal, cultural, and human. The intelligence community’s standard mode of operation is surprisingly passive about aggregating information that is not enemy-related and relaying it to decision-makers or fellow analysts further up the chain. It is a culture that is strangely oblivious of how little its analytical products, as they now exist, actually influence commanders.
It is also a culture that is emphatic about secrecy but regrettably less concerned about mission effectiveness.1 To quote General McChrystal in a recent meeting, “Our senior leaders – the Chairman of the Joint Chiefs of Staff, the Secretary of Defense, Congress, the President of the United States – are not getting the right information to make decisions with. We must get this right. The media is driving the issues. We need to build a process from the sensor all the way to the political decision makers.”

I would add another factor when discussing the impact on commercial firms. We have lost layers of middle management in the previous few decades, which has had an impact on the organisational ability to aggregate. I have nothing much further to add to the points above. Pretty self explanatory, no?

Nowhere does our group suggest that there is not a significant role for intelligence to play in finding, fixing, and finishing off enemy leaders. What we conclude is there must be a concurrent effort under the ISAF commander’s strategy to acquire and provide knowledge about the population, the economy, the government, and other aspects of the dynamic environment we are trying to shape, secure, and successfully leave behind. Until now, intelligence efforts in this area have been token and ineffectual, particularly at the regional command level. Simply put, the stakes are too high for the stability of Afghanistan and Pakistan, for NATO’s credibility, and for U.S. national security for us to fail in our intelligence mission. The urgent task before us is to make our intelligence community not only stronger but, in a word, “relevant.”

We are now faced with a set of very challenging, complex economic, social and political conditions across the world. This will require intelligence, information and data to be provided to managers - up and down the chain - in a significantly different manner. The firms which manage to crack this will win. I don’t have to tell you the changes that we are going to face in the next 3-5 years, but how to react to them? Well, a good management information, business intelligence, strategy and planning function can assist in doing this much better. In other words, yes, deal with the tactical bits, but don’t forget the strategy and the broader basis for analysis.

The example of Nawa was brilliant. Within the British area of operations, they were getting killed day in and day out. And the British thought the Americans knew nothing about COIN. Now look at what the Americans did. This might well be conflicting information and may be counted as national chest thumping, but by heck, the 1st Btn, 5th Marines gave an example of how to wage broad war. He quotes an example of how they avoided the issue of logistical problems.

The battalion intelligence officers refused to allow the absence of a data network to impede the flow of information. Each night, the deputy intelligence officer hosted what he called “fireside chats,” during which each analyst radioed in from his remote position at a designated time and read aloud everything learned over the last 24 hours. Using this approach, daily reports incorporated a wide variety of sources: unclassified patrol debriefs; the notes of officers who had met with local leaders; the observations of civil affairs officers; and classified HUMINT reports. The deputy intelligence officer typed up a master report of everything called in by analysts and closed each “chat session” by providing them with an updated list of questions – called “intelligence requirements” – for the companies to attempt to answer.
In the earliest days of the operation, many of these questions dealt with basic logistical matters, such as the location and conditions of roads, bridges, mosques, markets, wells, and other key terrain. Once these were answered, however, the focus shifted to local residents and their perceptions. What do locals think about the insurgents? Do they feel safer or less safe with us around? What disputes exist between villages or tribes? As the picture sharpened, the focus honed in on identifying what the battalion called “anchor points” – local personalities and local grievances that, if skillfully exploited, could drive a wedge between insurgents and the greater population. In other words, anchor points represented the enemy’s critical vulnerabilities.

Please note the second paragraph above. This shows that a smart intelligence officer (or a BI person in a corporation) understand the value of time. The same questions will not be asked all the time, there is an element of time, and things move on, questions change, the environment changes, you build on what you have got, evolve your strategy and questions. This means that it’s a learning organisation. It’s an important point which is often forgotten, that just when you have found the answer to the question, somebody goes and changes the question. Your organisation should have the ability to understand this, crack this an be able to handle these changes and then evolve to answer the changed question.

The report then moves into a detailed discussion of how the recommendations will work out in the Afghan theatre, which is very much unique to Afghanistan, presuming he knows more than I on the situation on the ground and will not comment more on this part. However, the organisation that he is suggesting is eerily similar to how commercial organisations are also setup. It might be an idea for commercial analysts to check back or back-test their MI or BI organisation and operating model against this. It might give them some ideas.

Like the NGO’s mentioned on page 20, the investor relations department and the corporate communications department could benefit from these organisational and operating model recommendations. They frequently need this information for the analysts, the shareholders, the regulators, press, etc. etc. Good information like this will almost certainly have a definite impact on the stock price and on the reputational risk of the firm.

So what do you do? I loved this quote:

Doing so will require important cultural changes. Analysts must absorb information with the thoroughness of historians, organize it with the skill of librarians, and disseminate it with the zeal of journalists.

Brilliant! This is an absolutely stonking formulation. It’s pretty straightforward and you know immediately what you need to do. We know what historians, librarians and journalists do and we can relate to that function.

There’s another great comment:

The format of intelligence products matters. Commanders who think PowerPoint storyboards and colour-coded spreadsheets are satisfactory for describing the Afghan conflict and its complexities have some soul-searching to do. Sufficient knowledge will not come from slides with little more text than a comic strip. Commanders must demand substantive written narratives and analyses from their intel shops and make the time to read them. There are no shortcuts. Microsoft Word, rather than PowerPoint, should be the tool of choice for intelligence professionals in a counterinsurgency

I was perhaps one of the worst offenders for PowerPoint use, but over the past 4-5 years, I have realised the value of a word document. It forces people to think about what they are writing and arguing about, especially for senior management. People spend hours and days mucking around with graphics and fancy animation when a short summary of one-page distils things down. This forces people to think about what are they trying to achieve, what decision they want their audience to take and whether the information they are providing is enough to help them take that decision?

Here’s another interesting point:

Historical lessons run the risk of sounding portentous, but disregarding them comes at a high price. History is replete with examples of powerful military forces that lost wars to much weaker opponents because they were inattentive to nuances in their environment. A Russian general who fought for years in Afghanistan cited this as a primary reason for the Soviet Union’s failures in the 1980s

History is indeed a vast early warning system and people who forget the lessons of history are condemned to repeat them. I know, I know, you are going to tell me that nobody has ever won in Afghanistan, not in any war, at any time, but hey, guess what? They didn't do the nuances either. Think about how the Mughal Empire managed to rule over Afghanistan for such a long time. They were not locals, they were invaders as well, so if pointing to the British and Soviets as a reason for saying that NATO will lose in Afghanistan, one should realise that the Mughals did win.

While we are not adopting the Mughal way of conquest and rule, the reason I think we will win is because we have Generals who have the courage to write reports like this, others who have the patience to read it, the confidence to realise that we are going down a wrong route and the humility to make changes. As it so happens, the US Secretary of Defence has now stated that he loves the report and would like to see the recommendations implemented. Sometimes being a maverick helps.

All this to be taken with a grain of salt.

Book Review: Practical Intrusion Analysis

Ganadeva Bandyopadhyay — Sun, 3 Jan 2010 19:00:33 EST

With a core emphasis on intrusion detection systems(IDS) in networks, the book includes further topics like wireless IDS, Intrusion Prevention System(IPS),etc.

SNORT and Bro are the two main IDS tools discussed. Both of them are open-source tools. While SNORT is representative of signature-based IDS, Bro is an example of anomaly-based IDS. A signature-based IDS looks for signatures in the network transmission indicating an attack in progress whereas an anomaly-based IDS goes by a normal traffic pattern and raises alert if there is an abnormality detected.

There is some discussion on writing signatures for SNORT. There are sites on the internet where signatures can be downloaded. However, any intrusion analyst using SNORT in detail, would need to know the techniques for writing signatures. There are methods discussed in this book for strategy to create good signatures while going through a vulnerability' life cycle.

Some of the other network analysis tools described in this book include vulnerability assessment scanners(ex. Nessus, Nikto, router audit tool a.k.a RAT), packet sniffers(ex. Wireshark, TCPDump), file integrity checker(ex. Tripwire, RANCID, AIDE), password auditing(ex. Cain and Able, Brutus, RainbowCrack), wireless security toolkits(ex. AirCrack, AirSnort, Kismet), vulnerability exploitation tools(ex. Metasploit), network reconnaissance toolkits(ex. Hping2, nmap, ngrep, ntop). The distinctions between these may be small and sometimes even overlapping such as an essential packet sniffer in an intrusion detection system.

There is some discussion on web application firewalls, wireless IDS/IPS, some other less frequent topics like physical intrusion detection and geospatial intrusion detection. Web Application Firewalls are specialized IDS to cater to the practicalities like more percentage of secure network protocols in use and wide variations from web applications across organizations. This makes the the general IDS tools practically ineffective as a intruder can go within a tunneled traffic which is not configured for monitoring out-of-the-box.

To summarize, the book covers a lot of topics within its scope. It is a good read for a introduction to current intrusion analysis,detection and prevention techniques. A more continuous discussion with more real-world examples and their solutions within the topics would have made this a delightful read.

Haagen-Dazs - Ice Cream or Creaming The Indian Hide?

J Srinivasan — Sat, 19 Dec 2009 13:31:44 EST

I was rather dismissive when there were a flood of tweets with weird looking Bit.Ly links and hash tags with #HaagenDazs in them, saying this must be one more of those crazy things that fly around. Then I received a DM from a friend who suggested I read this “trending” outrageous thing on Haagen Dazs. I did and was initially outraged by the thought that some foreign ice cream brand wanted Indian Rupees but had the audacity to let only “International” passport holders in!

It bothered me all day today and I let fly some tweets this evening (check out the @jsvasan timeline). My tweets caught my friend’s attention and again it was suggested that I read a blog by what appears to be a foreigner who spends time in India. The blog is eloquent in its presentation of his point of view. But both he and my friend’s blog miss the point that bothers me. But before I run away with it, I’d like to respond to this blog. It is typical for a foreigner to explain away things without assuming any responsibility for misleading his readers or listeners as the case may be.

In my 35 years in industry, including working in a German company as also consulting with MNCs, I have never, ever, ever, seen an International Brand being launched in a new “territory”, let alone in a new country, without every single minute detailed being “directed” and cross checked by the big bosses. Thus I reject the implication that this was a “local” slip up. Too convenient. No, this was and remains an intended and well planned pitch, that has gone wrong. And may well have been in planning for months before the opening. Like the training pre-opening party the blog cites. And to think that their main bill board would be left to ‘local’ restaurant management? An International brand’s first store launch? Rubbish! It was intended and carefully crafted – very possibly by an astute advertising agency who knew the Indian psyche and who specializes in MNC accounts! Why do I say that? Here is why…

It is no secret that we Indian’s still have a hangover from colonial times. Anything foreign and white skin is “in”. Checkout ads and TV programmes, if you need any proof. But back to the HD story. Thus to justify HD’s high prices, they had to pitch to the “upper” or elite. And Noida is full of them. Only those who wouldn’t mind coughing up tons of money for frozen water laced with some flavour and milk, but more importantly to be seen at the place, would be able to even afford such a luxury. Add the population of home sick expats and you have a large enough market and nice $$$ in the business plan.

No, I reject the defense that this blogpost puts forth. I don’t blame him though, since blogging for a living isn’t easy. I assume this because any detail about the author is conspicuous by its absence on his home blog, save except that he blogs because the NYT refused his publish even his letters to the editor “with such alacrity and regularity.”

But the main reason for this post isn’t to let the Blogger know that not every Indians is fooled.

The main reason I post this is the fact that the BillBoard aimed at some things that’s true, even though not palatable. I’m not so bothered that some “locals” must surely have been allowed inside the restaurant. Or that some shameless Indian designed the BillBoard as directed by his brief. Or whether some gora sahib approved it. The ‘inadvertent’ slip doesn’t hurt because it was tactless. It hurts because it hits the bulls eye of truth. We Indians are masters at denial and hypocrisy. The bogey of racism is a convenient camouflage for a real inferiority complex. And I say this as an Indian myself, not as an accusation but as an inquiry that may help us in leaving the colonial past behind for the economic power this country is supposed to be heading towards.

If we had any self respect as distinct from a false sense of outrage, we would refuse to work at this company. We would boycott their products. We would refuse to supply things as vendors, We would file a criminal complaint at the jurisdictional police station. We would file a complaint with the Company Affairs Ministry. We would expose the ad agency this company employs. Given that it has happened in the a Delhi suburb, the MPs and Ministers are at hand for those with connection to demand prosecution of HD and its Indian distributor. The TV channels made passing mention and will be bought over; the ad revenue in these ‘hard’ times can’t be ignored. Blogging is fine to raise awareness, but needs to be the start, not the end of this episode. In this, the “locals” must step up to the plate. Now. Otherwise, a clear and distinct opportunity to send a message worldwide will be lost as also a move to leave our hangover of the past behind. One company tried a similar stunt here in Bangalore. The rest, as they say, is history.

And this is where we fail. Like one of the blogs identified, we are cowards. That’s the reason why we have a colonial past. And will continue to have one, even after the Gora sahib left. It’s time to stand up. Where is the famed courage of the Aryans?

That this has happened under the nose of the Indian Government is the final irony.

Book Review: The Leader's Guide to Storytelling by Stephen Denning

Anuradha Goyal — Thu, 3 Dec 2009 08:35:35 EST

For sometime now I have been trying to understand the art of Storytelling. To me it was always an art to weave the story in such a way that the audience keeps looking at you to know 'what next'. Wrapped in the story is the message which the audience takes away with them without feeling being forced upon. We all know that there are some people who are born with this art and some cultivate it over a period of time. To me it is a refined form of communication that combines knowledge, the context of knowledge for the current circumstances and the narration in a way that is appropriate both qualitatively and quantitatively for the situation at hand. The purpose of storytelling can be entertainment, education, passing the message, inspiring people, port knowledge or simplification of a complex communication. It can also be used for multi-layer communication.

The author of The Leader's Guide to Storytelling has tried to look at the business narrative aspect of storytelling. He tries to solve all the business problems that the leaders face via storytelling. He talks of various types of stories relevant in various business scenarios. He talks about the purpose of a story and about the depth that it should go to. He has tried to put a framework around storytelling with charts and tables explaining the various narratives which can be handy for a practical user. But what he missed is the how of storytelling. Till the storyteller knows the art of storytelling, the frameworks will be just like books telling you how to make a powerful Powerpoint presentation, which will look good on the projector but may not make any sense till you can explain what is written there.

Now, I think it is fair to expect a book on storytelling to be interesting to read. I am sorry to say that this book was quite boring to read. There is lot of repetition. There are only a few stories including one of author's personal stories that have been used as an example time and again throughout the book. All the books that derive a hypothesis out of few instances are like a thief telling a judge 'Ok, you have two witnesses who saw me stealing, but I can show you millions who have not'. While the stories that author quotes have leaders using the storytelling to communicate what they are saying. To me a clear communication, weather it comes by way of hard numbers or by way of stories is when the leader has a clear vision and knows exactly what he wants to do and what he expects from his teams. Unless there is clarity of thought, the technique used to communicate is just a means. Yes, storytelling can help in tricky situations. It can help in giving subtle messages, it can help tame the grapevine, and it can keep the flow of communication on within the organization. But to say that storytelling is the panacea of all business problems is flawed.

Author's narrative in the book does not really make it an interesting reading, it is more like a research report. My concept of storytelling says the story must have 'Rasa'. I do not know if there is an English equivalent of Rasa, but it means the story has an emotion and it lets both the storyteller and the listener establish 'connect' with the story and bringing them together at the end of the story. This book is completely devoid of this Rasa, something that is very basic and something that I expected to be an integral part of the book on storytelling. The book completely misses out on the most important party in a storytelling session, that is the audience, how to change the narrative according to audience, how to judge if the audience is believing in your story or not, reading the feedback built in the audience responses, involving the audience in the story, provoking or inspiring them to join in and tell their stories. Storytelling can be turned into a two-way session where the teller and listener exchange places and storytelling sessions become knowledge sharing sessions or something similar.

What you can do use this book for is to understand the aspects of a story that you decide to tell, when to use which aspect, to be able to understand the purpose of the story that you are about to tell and narrate your story from there.

IIM CAT Snafu Continues - Mismanagement and Inconvenience

Aaman Lamba — Mon, 30 Nov 2009 08:19:45 EST

The first online Common Admission Test (CAT) for the Indian Institutes of Management presented a poor showing for the institutes and the company conducting the test, Prometric, as problems continued to plague some test centres, impacting a number of students across the country.

Problems started on the first day of the CAT, which runs up to December 7th, with students being unable to log in to the test, and a variety of excuses being made by the test centres and IIMs, ranging from hardware problems and virus attacks. Test examiners and invigilators did not appear to have been well trained. Often, computers hung while tests were underway, creating an unfair advantage for the student. The central server is reportedly affected by a virus or malware, and it is strange there was no backup server. Fail safes and alternatives did not seem to have been sufficiently planned, and students were mostly left in the lurch with little to no clarity about students taking the test at alternate dates. Many students travel across the country, take leaves, and generally prepare mentally for the test, thus new slots might be inconvenient in various ways, and affect the general outcome.

Over 50 out of the 360 labs were reportedly closed and problems have continued on day 3. A press conference convened by the IIM Convenor and Prometric representatives seemed to have nothing concrete to offer, apart from platitudes and promises to accommodate all the unfortunate students who had faced problems. The convener seemed to have not taken care of even basic courtesies like turning off his cell phone before the conference and provided generic answers to questions, before trying to pass the buck to the test vendor, Prometric, not best practices from a management institute. As the Wall Street Journal put it, the IIMs need to practice what they are supposed to preach,

The weekend CAT fiasco, in which 50 of the 360 centres had systems fail and students could not take the test, has reinforced the perception of poor coordination and collaboration of IIMs. Going by feedback from some of the candidates who took the test , it seems they not only failed to manage the technical aspects of the test but also did a bad job in training the staff present in various centres. If good management is about reducing uncertainty and systematic errors, then the IIMs have failed that test .The way the coordination committee of the IIMs reacted to the fiasco is also a matter of concern.

The HRD Ministry, under whom the IIMs function, has sent a letter to the IIMs and the CAT Convenor, Professor Satish Deodhar, asking for a factual report on the disruptions of the Test.

The CAT fiasco also creates a problem for broader adoption of computer-aided testing, that is expected to be a major growth industry for test-happy India.

In Death We Differ

Suresh Naig — Fri, 25 Sep 2009 07:13:38 EDT

We have heard several times in management jargon that, "Everyone is important, but no one is indispensable." However, there is a dangerous trend where trade union activists are deriving a different meaning to the phrase - to dispense with the persons who do not suit them.

It happened first at Noida, when a mob lynched L.K. Chaudhury, the CEO of an Italian organization, and now it has happened again at Coimbatore. The Vice President (HR) of PRICOL, Roy J George succumbed to the grievous injuries sustained at the hands of an unruly mob. It was alleged that he was hit on the head by workers, who were protesting his action of sacking 42 employees of the Company, working in a different unit.

What is worrisome is the reaction or the lack of it from the Government and the media. Oscar Fernandes made an awkward comment about Noida incident, "This should serve as a warning for the managements." After serving the stern warning, he appealed to the managements to deal with compassion with the workers. Was it not a tacit approval of the heinous act?

Apparently, the media and political leaders wanted to show that they are with the powerless masses. By raising their voices against these killings, perhaps political leaders are afraid that the public would construe that they are taking sides with the empowered. For the same reasons, the print media underplayed this incident. Joining them are social activists, who are conspicuously absent with their silence.

All these people would have lost no time in shouting from the rooftops had this been a terrorist, a Maoist, or a person from a minority community. To evoke a sound response from these persons, the death should have been caused by the empowered establishment, or a group belonging to the majority. The same logic holds good, when a wife is beaten by the husband for them to react, because they consider women to be "Abalas", whereas men are empowered.

One expects that "Death is the greatest leveler" but sadly this is not borne out in practice. If we resort to foul play in foul deaths, it would manifest with disastrous consequences in the future.

Jet Airways Strike Ends - Victory for Labour

Aaman Lamba — Sat, 12 Sep 2009 14:35:55 EDT

The five-day old simulated strike by Jet Airways pilots came to an end with the agreement of the management to take back the pilots who had been dismissed for forming a union, the National Aviators Guild. In return, the pilots agreed for a review of the registration of the union by the Registrar of Trade Unions. A coordination committee may replace the union.

The agitation saw over 400 pilots call in sick, and had disrupted operations for the premier airline, cancelling hundreds of flights and impacting thousands of passengers, but the pilots claimed they were fighting for a greater cause, and refused to budge. In response, Jet Airways chairman Naresh Goyal threatened to hire foreign pilots, termed the 'sick' pilots 'terrorists', while continuing to work behind the scenes to resolve the crisis.

The government stayed out of the affair for the most part, apart from making alternate flight arrangements and encouraging a speedy settlement. Rival airlines took advantage of the situation and hiked airfares until the government ordered them returned to normal levels.

The event demonstrated the force of collective action still had effect, and while the root cause may not have been onerous working conditions as with miners or industrial labor, it fit the definition of a trade union as a "continuous association of wage earners for the purpose of maintaining or improving the conditions of their employment" (History of Trade Unionism, 1894).

As a union of the executive class, it had further significance, since these are typically rare. My father helped co-found a similar union in the steel industry in the 1970s, standing for ethics and honesty, although it later became a mouthpiece of the management, as they often do. The right to join or abstain from a trade union is enshrined in the Universal Declaration of Human Rights. While unions serve to level the playing field between the management and individual employees, it can also work to the detriment of employees by driving up wages and reducing employment, as in the American model. It can also mean disruption of public services and reduce customer-orientation, as we have seen with the Jet Airways strike.

It remains to be seen how long flights will take to return to normal, and whether this will have a lasting impact on Jet Airways' image,

Book Review: The Process of Software Architecting

Ganadeva Bandyopadhyay — Sun, 30 Aug 2009 07:26:24 EDT

Software architecture developed as a profession with the increasingly high-level and comprehensive understanding required for OOP paradigm. There is a plethora of definitions available for these two words in different contexts and mentioned in various standards and consulting company documentations.

In the The Process of Software Architecting, the authors start with discussions of the various definitions and terminologies associated th the Software Architecting field and go on to illustrative test cases and project scenarios where the issues and possible solutions are discussed.

The book is divided roughly into three parts. The first part gives briefly the core concepts of architecture, architect and architecting, documenting a software architecture, and reusable architecture assets. The second part provides a guided tour through a typical software development project. The last part brings out how the concepts described in the preceding parts apply to architecting complex systems.

The task of the software architect comes in between the requirements phase and the development phases in a software development project. Initially the architect has to make a logical architecture based on the requirements which have to be made into a logical detailed design in the development phase. Based on the inputs of requirements, logical architecture and logical detailed design, it is the job of the architect to create physical architecture taking the available technology into account.

Some of the architecture related best practices in the industry are the Rational Unified Process, IBM Unified Method Framework, OpenUP, eXtreme Programming(XP), Scrum, etc. In addition to these, one of the standardization initiatives like the Software and Systems Process Engineering Meta-model Specification(SPEM) is also considered for the discussion on method elements.

Few of the other notable aspects of this book is the need for accommodating differing viewpoints through accounting for the political landscape within the respective organization, the necessity to avoid ivory towers by a team of architects too engrossed in discussions to get the feedback from the end-users/management and taking the decision to reuse architecture assets or not based on several factors.

To summarize the review, with a highly condensed text and examples, an experienced software architect would keep coming back to this book to have the improved understanding of principles, best practices as well as avoiding the pitfalls in this developing field. Drawing heavily from the software engineering principles, the book goes beyond finalizing the perfect software architecture document into the evolution stage of software architecting as an art to software architecting as a science.