If you expect a system to perform when you need it most, you’d better test it. And it’s a fact of life that it will be a better test if it’s done by people who did not build that system in the first place. We’re not talking about manipulation here. It’s just that a fresh perspective will raise at least some areas of weakness that are otherwise inevitably overlooked. An ethical hack is such an independent test.
For a prospective customer, third party audits and a prestigious customer list will often suffice as adequate validation but in some cases there is simply no substitute for checking under the covers yourself. As CTO at BoardVantage, far from being a purely negative ‘cost-of-sale’, I welcome third party inspection. Different eyes might uncover overlooked details, and the hack itself serves as a process refresh which is difficult to accomplish with just internal staff
An ethical hack is usually performed either by the information security team of an F-100 or financial institution, the IT department of a smaller organization, or a third party specialist. Because in commercial SaaS environments, the production system is in use 24×7, the ethical hack is ALWAYS performed against a mirror system. That way you obviate the (slim) possibility of customer data being compromised or bring about potential performance deterioration during DoS (Denial of Service) testing.
It is much easier to talk the talk on security than walk the walk but an ethical hack will quickly separate the vendors who fall in the former group from the ones who have made the costly investments and who fall in the latter. So, if a vendor is serious about security, ethical hacks are a wonderful source of customer feedback. Third parties, immune from internal politics, can make observations that might be difficult for internal QA departments and security teams. By subjecting oneself to a plethora of different tests by different teams, the vendor dramatically increases the coverage of possible exposures.
While an expensive investment for both customers and vendors, ethical hacks remain the most effective way to verify the security of any SaaS vendor. In addition ethical hacks remain one of the best ways for a vendor to assure that the systems meet the standards and that the vendor’s standards are in fact up-to-date.



Say Hello, Wave Goodbye
Thursday, September 2nd, 2010Whatever happened to Google’s Wave? Barely on the market a year and suddenly withdrawn by Google, it begs two questions.
1. Why did the world’s biggest and baddest Internet player, with the biggest and baddest engineering team (the guys that came up with Google Maps) fail so miserably?
2. Is there anything in this wreckage that could be salvaged?
My take-aways on the first point are as follows:
Value proposition. Wave was supposed to be an email replacement but nobody seemed to be able to articulate why exactly it was better and under what circumstances. I confess to never “getting it”, so it was somewhat reassuring that no one else did either. The analyst community, who sang Wave’s praises until recently, seems somewhat lost here. My take? Wave was too unstructured – letting people see what you type as you type might look cool in a demo, but it can be severely career-limiting if your boss is on the other end. If I know one thing about collaboration it’s that process is key. Wave was the opposite.
Performance – or the lack thereof. I’m not sure if this was architecture, Google’s addiction to perpetual betas, or simply them not putting enough oomph behind it. Still, while it’s not often discussed by vendors, performance is hyper-critical for product adoption. No one wants to wait around for a screen to paint. Rest assured at BoardVantage (and it’s one reason we’re not cheap) that we deliver a performance level commensurate with business critical systems.
Integration – or the lack thereof. If you can’t get your content in or out the system, whatever magic happens inside the box is irrelevant. In this context, the fact that Wave integrated with neither Gmail or Googledocs is particularly puzzling.
The second question is harder to answer. It’s easy to poke fun at giants when they trip up, but there is a lot to be said for maintaining context in any collaborative environment – a central feature of a “wave”. At BoardVantage we’ve taken a somewhat different approach with our “discussions” which are integrated both with email as well as the document repository, even to the level of recognizing which versions were relevant at a particular time. Perhaps not as hype-worthy, but similar in philosophy, and one I believe will match more corporate use cases, where you need broad access but without sacrificing process.
PS
I can’t finish this post without a nod to Joe’s article “Size Doesn’t Matter”. If Google can so unceremoniously discontinue Wave, it’s safe to say that company size and product market profile are no guarantees of longevity. Caveat emptor.
Posted in Industry Comment | 1 Comment »