Those who violate 10 commandments of business continuity plan fail

When a business continuity plan is non-functional

Failed Business Continuity – This morning about 2:00 AM MST one of the largest providers of cloud services went down.  As I write this it is 11:30 AM MST and the service is still down.

It seems that their entire network – both the east coast and west coast is down.  I talked to their corporate office and at this time they have no idea as to when they will be back up and at the same time the person I talked to said he did not know what their business continuity plan was since this was a nation-wide failure in their network.

They should have followed the 10 commandments that we published earlier.

  1. Analyze single points of failure: A single point of failure in a critical component can disrupt well engineered redundancies and resilience in the rest of a system.
  2. Keep updated notification trees: A cohesive communication process is required to ensure the disaster recovery business continuity plan will work.
  3. Be aware of current events: Understand what is happening around the enterprise – know if there is a chance for a weather, sporting or political event that can impact the enterprise’s operations.
  4. Plan for worst-case scenarios: Downtime can have many causes, including operator error, component failure, software failure, and planned downtime as well as building- or city-level disasters. Organizations should be sure that their disaster recovery plans account for even worst-case scenarios.
  5. Clearly document recovery processes: Documentation is critical to the success of a disaster recovery program. Organizations should write and maintain clear, concise, detailed steps for failover so that secondary staff members can manage a failover should primary staff members be unavailable.
  6. Centralize information – Have a printed copy available: In a crisis situation, a timely response can be critical. Centralizing disaster recovery information in one place, such as a Microsoft Office SharePoint® system or portal or cloud, helps avoid the need to hunt for documentation, which can compound a crisis.
  7. Create test plans and scripts: Test plans and scripts should be created and followed step-by-step to help ensure accurate testing. These plans and scripts should include integration testing— silo testing alone does not accurately reflect multiple applications going down simultaneously.
  8. Retest regularly: Organizations should take advantages of opportunities for disaster recovery testing such as new releases, code changes, or upgrades. At a minimum, each application should be retested every year.
  9. Perform comprehensive recovery and business continuity test: Organizations should practice their master recovery plans, not just application failover. For example, staff members need to know where to report if a disaster occurs, critical conference bridges should be set up in advance, a command center should be identified, and secondary staff resources should be assigned in case the event stretches over multiple days. In environments with many applications, IT staff should be aware of which applications should be recovered first and in what order. The plan should not assume that there will be enough resources to bring everything back up at the same time.
  10. Defined metrics and create score cards scores: Organizations should maintain scorecards on the disaster recovery compliance of each application, as well as who is testing and when. Maintaining scorecards generally helps increase audit scores.

Order Disaster Plan TemplateDisaster Plan Sample

 

DR/BC Plans and Security Procedures have errors

DR/BC Plans and Security Procedures errors

DR/BC Plans and Security Procedures errors – Janco has reviewed the recovery processes of 148 enterprises that were impacted by the recent hurricanes, fires, miscellaneous business disruption events and found that 53% had some significant error(s) or omission(s) in their DR/BC Plans and/or security procedures. Many were attributed to the length of the business interruption event and the lack of supporting infrastructure such as cell communication (Puerto Rico) or shortage of fuel for back up generators.

Only 17% of enterprises that had major business disruption events in the summer and fall of 2017 had no major issues with their DR/BC plan activation process and security procedures

Janco is currently in the process of determining what were the causes for these defect.  Preliminary  findings are that as a result of the slow economy enterprise cut back on the maintenance of core infrastructure.  This included updating existing DR/BC plans Security procedures with changes, training in those areas, and people being reassigned or leaving the enterprise that were critical for these processes.

Janco’s Solution

Janco has added 17 electronic forms to alleviate this problem in DR/BC plan and its Security Manual Template. Included as a bonus is an eReader format of both templates.  The forms can be completed via tablets and smartphones and stored in a remote cloud location.  With the included security and DR/BC audit programs, it now is easier to highlight those areas of existing plans and procedures which need work to guarantee compliance with security mandates and success in the recovery process.

Security and DR - BC Read onOrder DRP BCP SecurityDownload Table of Contents Security and DRP templates

10 Question Security Assessment Process

10 Question Security Assessment Process for CIOs and CSOs

10 Question Security Assessment
Everything that needs to be done in order to improve the security and compliance of the enterprise

10 Question Security Assessment Process is a way for CIOs and CSOs to quickly identify risks that they need to address.

  1. What does the enterprise need to differently today in order to stop a breach tomorrow?
  2. Does the enterprise know if the company has been breached? How does it know?
  3. What assets are protecting, what are they being protected from (i.e., theft, destruction, compromise), and who are they being protected them from (i.e. cybercriminals or insiders)?
  4. What risks does the enterprise face if it is breached (i.e., financial loss, reputation, regulatory fines, loss of competitive advantage)?
  5. Does the enterprise’s IT security implementation match the enterprise’s business-centric security policies?
  6. Are formal written policies, technical controls or both in place? Are they being followed?
  7. What is the enterprise’s security strategy for IoT?
  8. What is the enterprise’s security strategy for BYOD and “anywhere, anytime, any device” mobility?
  9. Does the enterprise have an incident response plan in place?
  10. What is the enterprise’s remediation process? Can the enterprise recover lost data and prevent a similar attack from happening again?

Supports Meaningful Use Compliant Stage Implementation – Meets HIPAA Ransomware Guidelines — Comes in eReader, MS Word, and PDF formats. Includes 24 Electronic Forms that are ready to use and User Bill of Rights for Sensitive Data and Privacy

Order Security Policies and ProceduresDownload TOC security policies

Over 50% Job References Not Checked

Job references not checked by employers

Job references used to be the gold standard that almost all enterprises used to verify candidates backgrounds and character.  That is no longer the case according to Janco Associates.

In the process of updated and re-issuing its Interview and Hiring Guide, they found that only 46% checked even one reference.  Surprisingly they discovered that 30% depended on statements made by candidates during the actual interview process.  In addition, 26% whet to social media pages like Linkedin and Facebook reviewed what was posted there and assumed it was factual and correct.

Job references
Hiring managers no longer depend as much on job references when evaluating whether to hire a candidate.

The move away from personal references has been driven by the inability of individuals to provide “accurate” information on candidates.  For example, if a negative reference is given by an enterprise’s employee or agent, the enterprise could bee subject to litigation. Plus, many severance agreements stipulate that companies provide “positive references” for terminated employees.

Interview and Hiring Guide

Version 2.0 of the Interview and Hiring Guide contains specific questions that interviews can ask about prior employment, the position the candidate is interviewing for, education and training, remote workers, decision-making and creativity, management and leadership, non-work activities and interests, and questions that should be avoided. In addition, it provides a list of best practices for screening resumes, phone screening, the top 10 interview best practices, and hiring best practices.

The Interview and Hiring Kit can be purchased separately $89 or with one of the four versions of the IT Hiring Kit, ranging in price from $579 to $2,399 with 12 months of update service or $799 to $2,799 with 24 months of update service.

Read on Order Interview Hiring GuideDownload Interview Guide

Top 10 Interview Best Practices

Top 10 Interview Best Practices to get the candidate to say yes

Top 10 Interview Best Practices to improve an enterprise’s chances that a candidate will say yes to your job offer.

  1. Make the right impression from the first point of contact to the job offer.
  2. Have complete and accurate job description available during the interview.
  3. Let the candidate review the job description before the interview.
  4. Communicate to the candidate what the interview will entail.
  5. Be prompt and do not make the candidate wait.
  6. Allow no interruptions and focus on the candidate.
  7. Prepare for the interview and have a set of questions ready to be asked.
  8. Have materials to be provided to the candidate available –  put a post-it note on the materials with the candidate’s name on the materials.
  9. Be enthusiastic and positive not only about the job that is being filled but also about the company.
  10. Define next steps at the end of the interview.
Top 10 Interview Best Practices
“Everything enterprises need to hire the best IT Pros as demand for IT Professionals increases” – CIO Fortune 500
Order IT Hiring Kit

10 step disaster recovery clean up

10 step disaster recovery clean up

Walking into an office after an event has occurred, the facility looks to be a shamble.  There are dirt, mud, and debris all over the entire facility.  Where do you start?

Here is Janco’s 10 step disaster clean up process extracted from the Disaster Recovery Business Continuity Template. In addition to this, consult a professional conservator for further treatment.

10 step program

dr/BC template
Disaster Recovery Business Continuity Template is the industry standard. Over 3,500 enterprises world wide use this as the base fore their DR/BC plan
  1. Wet objects (electronic) – Disconnect from the power source and do not turn it on. In the case of disk drives or other electronic storage devices – inventory all of them and label them.
  2. Mobile Devices – cell phones – Small items like cell phones and mobile devices can be put in rice. The rice absorbs the moisture and after a day or two, they can be turned on. In most cases, this works.
  3. Wet objects (non-electronic) – Rinse with clear water or a fine hose spray. Clean off dry silt and debris with soft brushes or dab with damp cloths. Try not to grind debris into objects; overly energetic cleaning will cause scratching.
  4. Drying Objects – Air dry objects indoors if possible and use portable fans to move the air. Sunlight and heat may dry certain materials too quickly, causing splits, warping, and buckling. If possible, remove contents from wet objects and furniture prior to drying. Storing damp items in sealed plastic bags will cause mold to develop.
  5. Mold Prevention and Cleanup – Exposure to molds can have serious health consequences such as respiratory problems, skin and eye irritation, and infections. The use of protective gear, including a respirator with a particulate filter, disposable plastic gloves, goggles or protective eye wear, and coveralls or a lab coat, is therefore essential. In order to inhibit the growth of mold and mildew, you must reduce humidity. Increase air flow with fans, open windows, air conditioners, and dehumidifiers. Moderate light exposure (open shades, leave lights on in enclosed areas) can also reduce mold and mildew. Remove heavy deposits of mold growth from walls, baseboards, floors, and other household surfaces with commercially available disinfectants. Avoid the use of disinfectants on historic wallpapers. Follow manufacturers’ instructions, but avoid splattering or contact with objects and wallpapers as disinfectants may damage objects.
  6. Broken Objects – If objects are broken or begin to fall apart, place all broken pieces and detached parts in clearly labeled, open containers. Do not attempt to repair objects until completely dry or, in the case of important materials, until you have consulted with a professional conservator.
  7. Paper Materials – Documents, books, photographs, and works of art on paper are extremely fragile when wet; use caution when handling. Free the edges of prints and paper objects in mats and frames, if possible. These should be allowed to air dry. Rinse mud off wet photographs with clear water, but do not touch surfaces. Wet books and papers should also be air dried or kept in a refrigerator or freezer until they can be treated by a professional conservator.
  8. Office Furniture – Furniture finishes and painting surfaces may develop a white haze or bloom from contact with water and humidity. These problems do not require immediate attention; consult a professional conservator for treatment. Textiles, leather, and other “organic materials will also be severely affected by exposure to water and should be allowed to air dry. Shaped objects, such as garments or baskets, should be supported by gently padding with toweling or unlinked, uncoated paper. Renew padding when it becomes saturated with water. Dry clean or launder textiles and carpets as you normally would.
  9. Art Work – Remove wet paintings from the frame, but not the stretcher. Air dry, face up, and away from direct sunlight.
  10. Metal Objects – Rinse metal objects exposed to flood waters, mud, or silt with clear water and dry immediately with a clean, soft cloth. Allow heavy mud deposits on large metal objects, such as sculpture, to dry. Caked mud can be removed later.
Read on DRP BCP TemplateOrder Disaster Plan TemplateDownload Selected Pages Disaster Plan Template

Minimize breach response cost

Minimize breach response cost with operational strategy

Minimize breach response cost
Policies and procedures need to defined and be in place in order to minimize breach response cost

While the costs of a data breach can vary widely on a case-by-case basis, CIOs who understand the drivers behind the expense will be better positioned to take steps needed to protect their organization.

Here are 6 way to minimize breach response cost:

  1. Eliminate data you do not need.
    You can potentially dramatically reduce your exposure by destroying records of past customers.  You cannot lose data if you do not save it. In 2015 one company served 69 million customers, yet when they were breached that year, they exposed 78 million records. The extra nine million records most likely come from former customers. Each of these individuals had to be notified and offered credit monitoring, driving up costs.
  • Do not store street address if there is no real business requirement.
    When a breach occurs, companies are typically required to notify affected individual via old-fashioned, handwritten “snail mail.” But they can use alternative methods of notification, such as email or public announcement if they do not have a valid mailing address. Physical, written notifications can cost up to $2 per person, and the cost quickly adds up. It may be worth asking twice what the business need for those customer addresses is and considering not capturing these addresses to reduce the exposure to notification requirements.
  • Utilize logs to prove proof a breach or data loss did not occur.
    One industry study shows that in 44% of incidents, public notification is not required. To avoid notification, companies must prove that, even if they were attacked, no records were improperly accessed. To do so, they use systems logs. Without logs, a company may be forced to assume a breach occurred because it cannot prove otherwise.
  • Follow PCI rules and protect credit card data.
    For breaches that involve credit card data, reimbursing card companies for fraudulent transactions can amount to a staggering cost, from $3-$30 or more per card. New chip cards are designed to reduce fraud, and early data show they are having the intended effect – MasterCard reported a 54% reduction in counterfeit card fraud costs at retailers who have switched to chip cards.
  • Use experts who know the breach response landscape.
    Your breach response effort is not a good time to reinvent the wheel. Missteps happen fast and have serious consequences. Credit monitoring alone can cost $5 to $30 per person. Data breach specialists, such as PR consultants or data privacy lawyers, often have seen as many as hundreds of data breaches and are highly practiced at helping you craft a genuine story that keeps confusion – and costs – down.
  • Be prepared for additional audits and compliance reviews.
    In the wake of a breach, a company may be audited and investigated by a number of regulatory agencies. While it’s not guaranteed to occur, it is likely, and there are simple steps you can take to prevent sensational fines if it does. To start, CIOs and  CFOs should be strong advocates for the implementation of the security controls recommended by external auditors or by regulators themselves.

10 Best Practices for managing cyber-attack

10 Best Practices for managing cyber-attack

10 Best Practices for managing cyber-attack
10 Best Practices for IT Infrastructure are contained in this bundle of policies and procedures

10 Best Practices for managing cyber-attack have never been more important than today. They are:

  1. Stay calm, prioritize and don’t point fingers
  2. Assign response responsibility to a single point of contact
  3. Have both an incident response plan and a disaster recovery plan in place
  4. Take detail backups regularly – store backups on non-connected sites
  5. Have a business continuity plan in place with solutions that do not depend on the existing networks and data
  6. Have a PR/media and legal operational plan in place before the event
  7. Immediately notify customers
  8. Manage user/customer expectations
  9. Conduct a postmortem
  10. Implement policies and procedures that focus on infrastructure security
Order IT Infrastructure PoliciesDownload Selected Pages

 

Common Security Concerns

Common Security Concerns that CSOs and CIOs have

Security Manual Template - Common Security Concersn
CIOs and CSOs often are tasked to address user and C-Level management’s common security concerns. The Security Manual Template and its associated items address each of these in detail.

When the CIOs and CSOs discuss common security concerns these five topics always seem to appear:

  1. Surfing the web anonymously is a thing of the past – As online tracking systems become more sophisticated and harder to shake, the likelihood of private, anonymous browsing is becoming a long-ago memory. Take into account the latest ISP changes, where the U.S. government allows providers to not only track, but sell your browsing history without your consent. These changes in “net neutrality rules” require users to be more vigilant about their own browsing patterns. You can guard your activity by logging out of search engines before browsing, clearing your cache and search history, and switching to a private browser to minimize the various ways your browsing history is catalogued.Order Security Policies and ProceduresDownload TOC security policies
  2. Anyone gain access your webcam – Hackers can and do target cameras by disabling the light that notifies of access, and keeping tabs in order to commit some sort of crime. Many users have responded by putting dark tape or coverings over their computer’s webcam. But as more smart devices are created and purchased, the surface area for webcam hacking only expands. Think, for example, of all the places you take your smartphone, with its built-in camera almost always pointing in your direction. The malware used to hack webcams, known as RAT (remote access Trojan), is often spread through spam email. Once clicked, the software is capable of disabling your light so you’re never made aware of anyone watching.
  3. How to protect against identity theft – Be wary of sites asking for personal information to complete a basic task, such as subscribing to a newsletter. When submitting personal information, such as your address or payment method, check for https versus http and never submit this information to a party you’re not familiar with or for a request you don’t remember making.Protecting your identity, at its core, always comes back around to common sense behavior online. Understand risks, practice careful consuming, and taking precaution to diversify passwords and watch out for phishing schemes.
  4. Free antivirus software is not free – You get what you pay for in the area of antivirus and malware protection. If it is free a lot of people use it and when there is a security hole – hackers will attack.  That is opposed to paid programs were vendors constantly update the software to address new issues as the occur.
  5. Are tablets, Smartphones and Macs safe without antivirus software? – Though the Android and Mac OS X boast of operating systems that claims they are tough to breach, they still contains weak access points. Just like any tool that surfs the web or connects to wireless routers, security is needed to scan all those items you click. (Recent research suggests Macs are now more vulnerable than PCs.)While these devices have often carried around the title of most-secure operating system, it doesn’t hurt to back up your devices with the latest antivirus security protection.

IT Related Fraud issues addressed by Janco

 IT related fraud occurred in over 70% companies

Malware exposure is high in many enterprises

IT related fraud and alware infections cause a number of problems. Machines become unresponsive or sluggish resulting in users become frustrated and administrators spending precious time trying to find the problem.

Once an attacker is on the inside, his or her work is significantly easier since on most networks, systems on the inside are trusted.   To that end, in a review of over 300 security audits Janco has found a list of the greatest security weaknesses.

Enterprise Wde Security Weaknesses

The weaknesses are:

  • Using only single level verification for access to sensitive data
  • Having “public” workstations or access point is connected to a secure network
  • Sharing login credentials
  • Data validation for forms is contained in client-side JavaScript
  • Connect to network from an unsecure access point
  • Corporate web site is encrypted but the login process is not
  • Using weak encryption for back end management
  • Using unencrypted or weak encryption for Web site or Web server  management

Order Security Policies and ProceduresDownload TOC security policies

eReader Security Template

eReader Security Template released with version 12

eReader Security Template
eReader Security Template now address SIEM with both best practices and KPI metrics in addition to identity protection

eReader Security Template has just been released by Janco with its latest update of the security manual.  This is a major update as it the template now also includes KPI metrics and best practices for Security Information and Event Management (SEIM) as well as a chapter in Identity Protection.

This security template was first release in 1999 and has been updates between 3 to 4 times each year.  Currently the template is over 250 pages and includes chapters on the following topics.

  • Security policies – scope and objectives
  • Minimum and Mandated Security Standard Requirements
  • Vulnerability Analysis and Threat Assessment
  • Risk Analysis – IT Applications and Functions
  • Physical Security
  • Facility Design, Construction and Operational Considerations
  • Media and Documentation
  • Physical and Virtual File Server Security Policy
  • Network Security
  • Sensitive Information Policy
  • Internet and Information Technology Contingency Planning
  • Insurance Requirements
  • Security Information and Event Management (SIEM)
  • Identity Protection
  • Ransomware – HIPAA Guidance
  • Outsourced Services
  • Waiver Procedures
  • Incident Reporting Procedure
  • Access Control Guidelines
  • Electronic Communication
  • Mobile Access and Use Policy

Read on SecurityOrder Security ManualDownload Selected Security Manual Pages

 

 

10 point DR power checklist

10 point DR power checklist defined in Janco DR/BC Template

10 point DR power checklist — After an event that disrupts a network, availability of power to recover and run the network often is critical.  Below is a 10 item check list of what to consider in your disaster recovery – business continuity plan.

  1. Electricity, water, broken wires do not mix.  Before anything else validate that the power source and power distribution systems are dry and functional before power is turned on.
  2. Understand the minimum power requirements to be operational.   Have a clear understanding of a facility’s critical loads.
  3. Have an adequate fuel supply to operate backup power sources. Make smart fuel and technology choices, considering things such as if natural gas pipeline service were to be disrupted in your community. Make sure that you have sufficient fuel storage capacity onsite for an extended outage.
  4. Set reasonable response times for standby generator.  Frequent outages of a few seconds, a few minutes, or more, can have significant cost implications for businesses. While some other generators take up to two minutes to engage, diesel-powered generators are uniquely able to provide full load power within 10 seconds of a grid outage.
  5. Maintain your equipment and test it operations. Standby generators should be exercised periodically to ensure they will operate as designed in the event of an outage.
  6. Understand your environment and geography.  Even the best generators won’t work underwater when subjected to extreme flooding.  Check unit location for protection from flooding and ensure you use the proper gauge extension cord.
  7. Set up generators in an “open environment”. Use generators or other gasoline or charcoal-burning devices such as heaters in an open area or outside near an open window. Carbon monoxide fumes can build up and poison people.
  8. Quarterly review your load.  Know when there are any new demands or critical circuits to protect.  If you’ve added new computers or other power-hungry devices, consider updating switchgear.
  9. Meet all mandated compliance requirements. Make sure you have the proper permits and records on operations.
  10. Optionally contract for a rental power source.  Consider a rental generator power for use in the event of an extended outage.

Order Disaster Plan TemplateOrder Disaster Plan TemplateDisaster Plan Sample

Top 10 tips improve social networking security

Top 10 tips and best practices to improve social networking security

Top 10 tips to improve social networking security are necessary in order to secure the enterprise’s data and reputation.

  1. Educate employees – Educating employees of best practices can help improve the overall security of the business. Awareness through seminars, workshops, and other programs help educate how attackers use social media to target a brand via individual employees.
  2. Have employees use different passwords for different system – Encourage users to have multiple unique passwords. This can be support by implementing a cloud based password management system.
  3. Mandate strong passwords – Make it a requirement to have unique strong passwords.
  4. Have employees change passwords regularly – One every three or four months communicate with employees to tell them it is time to change their passwords.
  5. Do not share accounts – For social accounts that represent the enterprise only have one user per each and the linking e-mail account should be one that is in the enterprise domain and will remain with the enterprise in case the employee leaves or is teminated
  6. Implement two factor authentication – Many of the larger social networks provide two-factor authentication, commonly in the form of a code sent to their smartphone or email each time a new device or browser attempts to login to the account.
  7. Educate employees to NOT open email attachments or go to links where the originator is not known – Stress the practices of carefully reviewing URL links before clicking to make sure the company and site name are spelled correctly. Cybercriminals will often blast out links that are very similar to a real address adding, subtracting or rewording parts to differentiate them.
  8. Utilize antivirus and security software – . No matter how careful a user is, there’s always the risk of accidentally engaging with a malicious link – and just one unfortunate click can lead to months of recovery time.
  9. Don’t friend people you do not know – Companies should encourage employees to thoroughly vet a friend request before hitting “accept”. They should check to see if other colleagues are also connected to the account. If the account seems suspicious or you don’t know the individual, ignore or report the user, and refrain from clicking on any links they may have sent.
  10. Validate and verify – just because it is on the Internet does not make it true.

Top 10 WYOD Best Practices

Top 10 WYOD Best Practices expand beyond BYOD

Tio 10 WYOD Best Practices - Policy
WYOD Policy that address all of the issues generated by this technology.

Top 10 WYOD Best Practices – Employees bringing their own smartphones into the workplace started the BYOD trend requiring enterprises to deal with the serious security implications that come from these devices. The decision for employees to wear their own device (WYOD), such as an apple watch that can link to your Wi-Fi; capture audio, video and data; store; and transmit poses similar problems for IT departments.  Employees and individuals outside of the enterprise can use these devices, sometimes discretely, to access and share business content.

This puts corporate data and infrastructure at risk, and reinforces the need for IT managers to focus on securing the content, rather than the device that’s in use. Wearable devices simply add another level of access and security concern to what we’ve already seen with the BYOD trend.

Here are top 10 best practices for WYOD:

  1. Have a strategy for how, when and why WYOD devices can be used
  2. Implement an acceptable use policy
  3. Identify the connectivity options that are available to both internal and external users
  4. Approved devices should be easily connected to the available secure access points
  5. Define a management process for the WYOD devices
  6. Plan for the activity WYOD devices will add to the network
  7. Make collaboration tools a priority
  8. Secure the end points and isolate sensitive/confidential information and locations
  9. Be prepared for little to no advance notice on upgrades
  10. Formalize your 7 x 24 support

For more information on this go to WYOD Policy.

Why H-1B is Wrong Solution

Why H-1B is wrong solution – a question that we have been asked

Why H-1B is wrong solution – a question that we have been asked by a number of reporters (see press release).  Below are two tables that  Janco has created in getting the answer to that question.

Why H-1B is Wrong Solution
H-1B Visas 2015 – 2017 – What is wrong with the H-1B visa program
Why H-1B is Wrong Solution base on who get the visas
Number of H-1B visas issued for IT related jobs is 78.5% of the total – Is a lottery the right way to allocate the visas

Below are some of the questions that we were asked by a reporter for a national publication.

General Questions

Reporter: Is the Information Security Analysts job the only H-1B security job in your findings?

Janulaitis: Yes, that is the only pure security role.  However, there are individuals who have those skills and are classified as Network and Computer Systems Administrators. They fill some of the roles of the security analysts.

Reporter: Do you have any insights into whether that number is so low because. A) no company’s are looking abroad for security skills. or B) people with these skills are applying but not getting accepted? 

Janulaitis: First there has to be demand for that role.  Many C-Level executives do not feel comfortable with security being done by non-US workers who are not on shore and/or are outsourced.

When C-Level executives have a choice, the idea that an H-1B is responsible for security is not one they relish. They need some assurance that H-1B employees will remain with the company.  There have been too many hacks that have taken place where immediate response is required. There is less control when the individual is an H-1B employee that is a contractor.  Companies like Microsoft and Apple (vs Tata’s) offer real opportunities for security specialists. These are US companies, not outsourcers, and have a long term view.  I know both Microsoft and Apple have good internal training programs in place with real career paths for the “best of breed” technologist that they hire with H-1Bs.

Reporter: Do you think that IT security and cyber-security skills should be given special consideration for H-1B visas? Under the proposed revamping of the program that may include moving to merit-based selection program rather than a pure lottery system.

Janulaitis: In general, all H-1B visas should be merit based.  My feeling is that the first choice for jobs should be US nationals who are qualified, then foreign nationals who are graduates of US Universities and want to become US residents and lastly, graduates of foreign Universities who want to become US residents.  The idea that there is a lottery and companies like Tata win a large number of positions that they then use to “replace” US workers does not make any sense at all.  The purpose of the program is to give the US a competitive edge in technology not reduce cost for US corporations.

Reporter: The question is being raised because the global demand for cyber-security workers is expected to reach 6 million by 2019. There is a projected shortfall of 1.5 million qualified security pros. More than half of organizations today say that finding and recruiting talented IT security staff with the right skill sets is a “significant” or “major” challenge.

Janulaitis: First we start to educate our IT pros in the disciplines required. Then have jobs for them when they graduate and there will be much less of a need for “foreign” workers.  It should be a H-1B requirement that these individuals have a “desire” to become full time US residents.  If companies like Tata game the system, they should be penalized. Perhaps they could be required to post a bond of say 20% of the annual salary be put in trust.  That would be returned when the individual qualifies to be a permanent resident.  If they do become full time residents within a specified period, then the bond would be forfeited and the individual would have to leave the US. We need to take the profit out of gaming the H-1B program.

Other Observations

Reporter: Any other insight you might have into this would be greatly appreciated.

Janulaitis: Companies like Tata should not be allowed to get the number of H-1B visas they do.  They are gaming the system by creating US subsidiaries that are just a shell to get revenue out of the US and not necessarily help the US to be a technology leader. The focus of the H-1B program should be to get foreign nationals that are world class to come to the US, become full time residents, and contribute to our society.  Currently students come to the US and take the limited number of advanced degree slots available we have and are capping the number of US nationals who can fill them.  It is not the US’s role to educate the world.  We need to do everything possible to have H-1B visa holders stay here.  It is not good when over 75% graduates leave and go back to place like China and India.

I believe much of the problem we have is due to our educational system.  We need to have more of a focus on math and science and less on social engineering.  As a county we spend more on education but rank behind Poland. We have a bias towards foreign nationals in our graduate and doctoral programs.  We need an educated population of college graduates who focus on both math and the science. Then we need to have jobs for the individuals that have STEM (Science, Technology, Engineering and Math) degrees. That includes undergraduate as well as masters and doctoral degrees.  It is much easier to grow our skill base if we have the professors who can teach those subjects.  China, for example, is graduating more students from it universities in robotics on an annual basis than we have in total.