Hey CPA: Should I get anti-virus for my home network?

Recently, I was having a conversation with my friend's 12 year old daughter. She's an avid e-book reader and her Kobo is a close companion. We were discussing the susceptibility of Kobo (in contrast to her computer) to viruses. I wasn't sure what OS was on the Kobo, but I did a quick check and realized that it was a Linux operating system. So I explained the economics of malware: most malware are designed for the Windows or MAC Operating System: criminals want to get the most bang for their buck. So the likelihood that hackers would target the Kobo tablets would be quite low.

Then it struck me: would a CPA be able to lead this sort of discussion?

The recent merger of the professional accounting bodies prompted the publication of a new competency map. The new competency map, however, greatly reduced the amount of technology competence required by a CPA.

Coincidentally, the WSJ published a review of the Bit Defender BOX around the same time I had this discussion. For what it is, see Amazon's Video Review.

As with the conversation with the 12 year-old, I wondered whether a CPA could keep pace with the issues brought up in the article, which include:

• If there's an OS, there's a risk of virus infection: The proliferation of "smart" devices is actually a proliferation of operating systems. As they point, no large scale infections to report yet. But the point is that there is a risk of infection and consumers need to figure out how to handle the virus.
• Network controls versus end-point controls: The solution for the virus can either be put on each device (e.g. mobile phone, tablet, smart thermostat, etc.) or at a network level. But which one is better? And that's the point: could a CPA discuss the advantages and disadvantages of each approach
• Evaluating intrusion detection systems (IDS): box is, in a sense, the IDS for the masses. As noted WSJ, the Box sent a number of "unhelpful alarms". In other words, the system generated "false positives" which means that users will initially check it alert diligently, but then ignore subsequent alerts assuming it's a false alarm. 
• Limitations of scanning devices: The article also notes how the device can't work on encrypted traffic.  More generally, it talks about the overall (lack of) reliability and 
• Best security practices: The article also notes several best practices to make home networking safer including, patching/updating router software + enabling auto-update, use of strong passwords, hardening systems (i.e. changing the default user ID & password on things like routers), use WPA2 standards (i.e. not WEP which can be easily cracked), and use of guest network instead of sharing passwords. 

But that's not all. WSJ also published this article detailing five key corporate security practices, including:

• Patching, i.e. installing software updates to plug security holes in the software,
• Limiting connectivity of devices on a "need to do basis",
• Encrypting data that is confidential or highly confidential (e.g. credit card data)
• Use of physical security devices instead of just passwords
• Independently assessing vendor compliance with security. 

The interesting thing about this article is that it omits the use of SOC audit reports (see Amazon's FAQ on the topic or the AICPA's site) with respect to verifying the level of security compliance with the latter point. 

But, again, does the current competency map train CPAs sufficiently to spot that? 

We should keep in mind a couple of things.

Firstly, the WSJ is a good litmus test of what the business press can expect a business professional to know about IT security, and technology related controls more generally. 

Although not explicitly mentioned in the first article, one of the key trends that has raised the level knowledge required for the average business professional is consumerization: individual have access to technology, such as tablets, smartphones, networks, etc. that were once the sole domain of corporate IT. Consequently, now the average business professional needs to increase their knowledge of IT and IT risks to avoid a virus or getting hacked. For example, I heard a couple of guys at the gym discussing the risks of downloading illegal movies: getting targeted by regulators and malware infection. 

Secondly, my friend's kid is 12 years old and understands the concept of viruses, OS and risk at very rudimentary level. 

Okay so we all know the kids are tech savvy. 

But we need a competency map that would be relevant to the future generation that will be entering the profession.  Furthermore, if the CPA profession wants to achieve its vision of being the  "globally respected business and accounting designation" it must not just meet the level of the business press but must go beyond. 

Should Algorithm Audits be mandated for HFT firms?

Was heading into work on train and came across WSJ's op-ed piece on the need for regulation around algorithms involved in trading. The article mentions how the regulators have not done much since the Flash Crash of 2010.

What is the Flash Crash of 2010?

As noted in the piece, "flash crash hit on the afternoon of May 6, 2010, as riots in Athens and a European debt crisis weighed on markets. In about eight minutes the Dow Jones Industrial Average fell 700 points before rebounding." 

The op-ed goes on to dismiss the "official" explanation (i.e. a large hedge placed by a US firm and financial shenanigans of UK based day trader) and states: "More important, they say, is the role of high-frequency firms, which use hard-to-monitor algorithms to trade large amounts of stock in fractions of seconds. If they trade erratically, the market can come unglued, as happened in the flash crash."

The article notes that the SEC has been exploring the mandating disclosure requirements and controls on firms that use algorithms. However, the article also quotes a number of regulators who say they don't have enough funds to keep pace with the firms. 

Before I go back down memory lane, it is also worth noting that there are other experts who hold that algorithms - from a privacy perspective - need to be regulated. Bruce Schneier, a well known information security expert who helped review the Snowden documents, in his latest book, Data and Goliath (see clip below for a summary), also calls for "auditing algorithms for fairness".  He also notes that such audits don't need to make the algorithms public, which is it the same way financial statements of public companies are audited today. This keeps a balance between confidentiality and public confidence in the company's use of our data.

So is it time for auditing algorithms through an "AlgoTrust" offering?

As I noted on my reflections on "Big Data: A Revolution That Will Transform How We Live, Work, and Think": 

"[H]ow would you go about auditing an algo? Although auditors lack the technical skills of algoritmists, it doesn't prevent them from auditing algorithms. The WebTrust for Certification Authorities (WebTrust for CAs) could be a model where assurance practitioners develop a standard in conjunction with algorithmists and enable audits to be performed against the standard. Why is WebTrust for CAs a model? WebTrust for CAs is a technical standard where an audit firm would "assess the adequacy and effectiveness of the controls employed by Certification Authorities (CAs)". That is, although the cryptographic key generation process is something that goes beyond the technical discipline of a regular CPA, it did not prevent the assurance firms from issuing an opinion."

I also noted:

"some of the ground work for such a service is already established. Fundamentally, an algorithm takes data inputs, processes it and then delivers a certain output or decision. Therefore, one aspect of such a service is to understand whether the algo has "processing integrity" (i.e. as the authors put it, to attest to the "accuracy or validity of big-data predictions"), which is something the profession established a while back through its SysTrust offering."

What I saw to be the challenge at the time I penned that blog post is market demand for this type of service. The answer appears to be that SEC could mandate such audits and leverage the CPA firms the same way they do for financial audits. However, instead of rendering opinion on the financials, such audit firms would render an AlgoTrust opinion on the algorithms to ensure that they are in-line with Generally Accepted Algorithmic Principles instead of Generally Accepted Accounting Principles (sorry I couldn't resist!).

Beyond WebTrust for Certification Authorities, companies are currently leveraging SysTrust which has been subsumed into the SOC 2 and SOC 3 audit reports. For example, Salesforce.com gets an audit opinion that provides reasonable assurance that its systems are secure, available and that it maintains confidentiality of the information they are provided with.

The AlgoTrust standard should address issues such as the ones raised in WSJ (i.e. as it relates to trading algos) as well ensuring the preservation of privacy. But it should not stop there. In the original post, Chris Steiner explains how algos are invading all parts of life, including things like robot pharmacists.

We have at least three experts from three different fields: finance, data, and information security that all see the value in auditing algorithms. If the CPAs don't take the lead on this, who will? As Bruce Schneier notes it won't be easy, but it is something that will eventually be tackled by either the CPA profession or someone else. 

Google's Mobile Launch: It really may be about the big data!

Yesterday Google launched "Project Fi" - Google's foray into providing mobile service. As CBC reported the service "will cost $20 US a month plus $10 per gigabyte of data used" (I am still an accountant, trained to find the numbers!). According to the Google blog post on Project Fi, the service will:

• Find the fastest connection: The service will enable the Google Nexus 6 to switch to the fastest mobile connection, whether it's home/work WiFi, WiFi hot spot, Sprint's network or T-Mobile's network.  
• Seamless transition between networks: The above service is not just about data, but also voice: when you transition between networks, you can keep on talking without any disruption. 
• Ties cellphone number to the cloud, not the device: Is this the end of SIM cards? With this service, you can take a call on any device (tablet, laptop, etc.) 
• Refund for unused data: While implied in the CBC article above, Google has structured the plan to refund the customer for the amount of unused data. 

As I had noted in an earlier blog post, one of the possible reasons that Google is entering into mobile world is to get access to mobile data. Specifically:

"the hidden strategic objective is a big data play: what could Google do with the new data feeds? Sure they already get from being able to correlate the information it already gets from their Android devices. However, they will now be able to analyze this data with the additional data that moves through their MVNO network, such as demographic information and location data. What good is this to Google? In a word: advertising. Advertising is still the biggest source of Google's revenue and adding this pool of data to their reservoir can only add to the bottom line."

Although this project is in "user testing" mode, the video indicates that this is not simply a giant "user acceptance test". Specifically, the announcer says "Getting it in users hands and finding out all the new amazing things we can build that will make your lives easier." (Go to 1:34, if you don't have the 2 minutes to spare)


In other words, the service will actively work with the early adopters to target services that work with the users. Of course these services will be a better way to target ads, such as location based advertising or augmented reality.With respect to the latter, you could use your phone to interact with an augmented reality billboard, store, etc. And Google could turn these numbers back to potential advertisers to demonstrate the effectiveness of such technology. In fact, Google (according to the Verge) invested over half a billion in Magic Leap, an augmented reality firm. But let's see how this rolls out.

Re-corporatification of IT? TMT Tech trends continue to prove true

Came across the coverage of Intel's first quarter results. According to the Australian:

"The Silicon Valley giant, which said last month that revenue would suffer in the first quarter due to sagging PC sales, reported net income for the period grew just 3 per cent on overall revenue that was flat with the year-earlier ­period."

However, not all is bad. The article also noted that:
"Intel’s data centre group, which includes chips for server systems, posted a 19 per cent jump in revenue."


The shift in growth confirm's the Deloitte TMT Predictions for 2015:
"Consumers don’t always lead the way: The pendulum swings back to enterprise adoption
Historically, new technologies, like PCs and cellular phones, were adopted by the enterprise and then by the mass consumer market years later. In the last decade, it’s been the opposite. Tablets and smartphones with large screens were adopted widely by consumers first, but the pendulum will start to swing back. In 2014, consumer uptake of wearable technology like smart glasses was modest, signaling a shift away from the consumerization of IT. Enterprise adoption of wearables, 3D printing, drones and the Internet of Things (IoT) will have a bigger impact generating more economic value in goods and addressing business needs than the consumer market for those technologies"

Although not specifically mentioned in the press release, Intel's increased revenues is a confirmation that the shift from consumer IT to corporate IT is something that can't be ignored.


Author: Malik Datardina, CPA, CA, CISA. Malik works at Auvenir as a GRC Strategist that is working to transform the engagement experience for accounting firms and their clients. The opinions expressed here do not necessarily represent UWCISA, UW, Auvenir (or its affiliates), CPA Canada or anyone else.

Amazon & Drones: Role of "Regulation" in technology disruption

A number of news outlets reported Amazon's testing of drones up here in Canada. According to the Globe & Mail:

"U.S. companies like the online shopping juggernaut Amazon are increasingly choosing Canadian airspace to test new drones after being hamstrung by restrictive laws in their own country that could take up to two years to change, experts say"

Amazon showcased its vision for using drones to deliver light packages in late 2013 (see video below). However, they have been vocal about their frustration with the US regulator to test their innovation. 

The US regulators seems to have buckled under the pressure that the e-commerce giant put on them. According to Gizmodo:

"The Federal Aviation Administration has just given Amazon clearance to begin flight-testing the drones in the United States. Again. For real this time...This is the second time in as many months that the online retail giant has received a drone testing certificate from the FAA. Last time around, however, the certificate only applied to an already-obsolete prototype. Frustrated by the Feds’ inertia, Amazon recently began testing its delivery drones at a “top secret” location in Canada, just 2,000 feet from the US border."

We could explore this from a point of view of how we actually live in corporatocracy - where corporations with millions in the bank drive governmental policy instead of the average citizen. But let's not do that. Instead let's focus on how "regulation" itself can impact technological innovation.

I don't mean regulation just in the narrow sense of the "big bad government" passing this law or that statute. But a much broader concept of how societal conventions and how economic powerhouses in the Capitalist society actually determine the course of technological development.

Take for example the rise of the iPhone in the corporate environment. What allowed consumerization to take place (i.e. allowing users to connect their favourite smartphone devices to the network instead of the corporate devices) was that Microsoft took an open approach to licensing it Exchange Active Sync. They could have created a walled garden that allowed Windows Phone only to connect to their email server, however, they paved the way for iPhone and  Android to connect their devices to the corporate email server. Microsoft as the "regulator" of which mobile device can connect to its mail server - if you will - essentially enabled the iPhone and Android to displace our beloved BlackBerries from the corporate environment (for more on this see this post). Had Microsoft saw more profit in walling off the market for its own devices the ability for Apple iDevice to disrupt corporate IT would have been stifled if not suffocated.

Think this is an isolated incident? Unfortunately, that's what the hype wants you to believe

For example, David Sarnoff of RCA squashed FM radio in order to protect his AM Radio technology and pave the way for television. The inventor, Edwin Armstrong, who initially was Sarnoff's friend, had foolishly shared his technological innovations with him only to be betrayed by him. FM Radio technology had the potential to share data, such as faxes - back in the 1930s. Can you imagine the state of the wireless technology had this technology been allowed to flourish? Well that's the point. Sarnoff - as a regulator of radio technology - saw fit to erase it out of existence.

AT&T is another case in point. It ironically attempted to slay the then maverick David Sarnoff's  nascent radio technology. However, Sarnoff was able to work with the FCC and others to defend his fledgling start up, RCA, and beat the odds (unlike his "friend" Armstrong who ended up taking his life unable to achieve the same victory against Sarnoff). In 1934 AT&T blocked the answering machine for fear that it would undermine their business because "ability to record voice would cause business people to shun the telephone for fear of having their conversations recorded". So although much good came out of AT&T's Bell labs, the point is that it was effectively the one acting as which innovation saw the light of day and which did not.

What this illustrates is that the mythical innovator whose technological rises to the top through some kind meritocratic process is just that - a myth. Rather innovation is much more about how society appoints through or market mechanisms those that will ultimately sanction technology or kill it. We have the Internet because the inventors were part of a governmental DARPA project. If Bell labs had invented the TCP/IP protocol would they have taken the same route or would have it gone the way 1934 AT&T answering machine? To answer that would be pure speculation, but it is entire possible I wouldn't be writing this blog post if some "regulator" had decided otherwise.  

Big Data: Sliding down the Peak of Inflated expectations?

Anyone who follows enterprise IT or has had to research prospective solution would be familiar with the infamous Gartner Hype Cycle. As described in the link, it looks at technology going through a "bubblistic" growth curve. I am not sure if Gartner mentions this explicitly in the book that they published , but the Hype Cycle essentially captures the "herd mentality" that causes Bubbles to form in the Capitalist economic system. Efrim Boritz and I wrote a paper, "A Brief Review of Investment Bubbles throughout History", over a decade ago that analyzes the history of Bubbles going back to Tulipmania back in 1600s to the DotCom Bubble in 2000. In the paper we reference, John Cassidy's "Dot.con: The Greatest Story Ever Sold", as follows:

"According to Cassidy (2002) all speculative bubbles go through four stages: 1) displacement, when something changes people’s expectations about the future; 2) boom, when prices rise sharply and skepticism gives way to greed; 3) euphoria, when people realize the bubble can’t last but they want to cash in on it before it bursts; and 4) bust, when prices plummet and speculators incur great losses. "

So where does Gartner currently see Big Data fitting into the Hype Cycle?

According to the following, it is sliding down "Hype of Inflated Expectations":

Source: Gartner

And actually, there are a couple of facts that back up Gartner's claim. As I discussed in a previous blog post, Forrester cites data woes as continuing problem. For big data to be effective, the underlying data has to have "veracity"  (i.e. as per the definition). The more market driven, perhaps, is the fact that InfoWorld reported, citing a survey from Foote Partners, that "[p]remium pay for 58 big data-related skills and certifications declined by an average of 4.7 percent during the last nine months of 2014". More to the point InfoWord notes "there are signs of a slowdown as businesses learn that jumping into big data is not a recipe for instant ROI".

These factors illustrate how the Gartner Hype Cycle is useful for organizations to identify the current state tech trends to identify when is the right time for that organization to invest in the technology in order to minimize risk of the "bleeding edge" of early adoption but at the same time avoiding the risk of joining the party too late - being taken over by competitors.

Explaining Big Data Technology in under 2 minutes

The class I was teaching this week was looking at Big Data from multiple perspectives, including security. The approach I used with cloud last week was to identify the key differences between ASP and cloud. With Big Data the key difference is between the SQL world of relational databases and the non-relational world of NoSQL technologies, such as Hadoop.

I took a course on Big Data that explained how there is a distributed architecture that enables a "master" to send out the job to vast army of "slaves" to complete the processing. However, how do I explain this in a succinct and effective way to the students? 

In a word, YouTube.

I found this video that gives a pretty good overview of Big Data, but it's real value is how it explains how Hadoop works at a high level (go to 4:10):

Of course, we will be covering  social media later in the term :)