Security Architect

Security Architect is a Hot New Job

Security Architect job description
Security Architect is just one of over 280 full job descriptions that are delivered electronically

Security Architect – The one position that CIOs and C-Level executives are looking to fill.  With all of the recent cyber-attacks and negative publicity they have generated there is a need for this proactive position.

Most of the other positions are focused on “after the fact” monitoring.  This one looks at what could happen and creates an architecture which address potential cyber-attacks and hacks.  The individuals operate on a philosophy that is easier to prevent something from happening versus trying to address problems after they occur.

Position Purpose

The individual in this position  assumes responsibility for data security including the planning, design and implementation of security measures which safeguard access to enterprise terminal files and data elements.  The administrator provides rapid response to user community’s request for security assistance.

They  secure enterprise information by determining security requirements; planning, implementing, and testing security systems; preparing security standards, policies, and procedures; mentoring team members.

The full job description for this position has just been released.

Security Architect read on…

Order Security Architect Job Description

Tenure of Telecom pros exceeds that of CIOs

Tenure of Telecom pros exceeds that of CIOs by 18 months

Tenure of Telecom pros – In the process of preparing for our mid-year IT salary survey, we have started to review the impact of the baby boomers who are now starting to to retire in droves.   The issue that CIOs and CSOs face is wither they have the resources in place to fill those positions as these professionals retire.

Employee Tenure
Telecom professionals have a median tenure of six years. That is 18 months longer than for CIOs.

Added to this is the fact that over the last several quarters the total number of job in the telecom field has shrunk significantly. This has also dampened the number of new entrants into that job market.

Preliminary data that we have seen shows that telecom salaries are not keeping up with the rest of the IT industry.

CIOs and CSOs are going to have to address succession planning for not only the telecom pros retiring, but also for the rest of the baby boomers that they have on their staffs.

Common Security Concerns

Common Security Concerns that CSOs and CIOs have

Security Manual Template - Common Security Concersn
CIOs and CSOs often are tasked to address user and C-Level management’s common security concerns. The Security Manual Template and its associated items address each of these in detail.

When the CIOs and CSOs discuss common security concerns these five topics always seem to appear:

  1. Surfing the web anonymously is a thing of the past – As online tracking systems become more sophisticated and harder to shake, the likelihood of private, anonymous browsing is becoming a long-ago memory. Take into account the latest ISP changes, where the U.S. government allows providers to not only track, but sell your browsing history without your consent. These changes in “net neutrality rules” require users to be more vigilant about their own browsing patterns. You can guard your activity by logging out of search engines before browsing, clearing your cache and search history, and switching to a private browser to minimize the various ways your browsing history is catalogued.Order Security Policies and ProceduresDownload TOC security policies
  2. Anyone gain access your webcam – Hackers can and do target cameras by disabling the light that notifies of access, and keeping tabs in order to commit some sort of crime. Many users have responded by putting dark tape or coverings over their computer’s webcam. But as more smart devices are created and purchased, the surface area for webcam hacking only expands. Think, for example, of all the places you take your smartphone, with its built-in camera almost always pointing in your direction. The malware used to hack webcams, known as RAT (remote access Trojan), is often spread through spam email. Once clicked, the software is capable of disabling your light so you’re never made aware of anyone watching.
  3. How to protect against identity theft – Be wary of sites asking for personal information to complete a basic task, such as subscribing to a newsletter. When submitting personal information, such as your address or payment method, check for https versus http and never submit this information to a party you’re not familiar with or for a request you don’t remember making.Protecting your identity, at its core, always comes back around to common sense behavior online. Understand risks, practice careful consuming, and taking precaution to diversify passwords and watch out for phishing schemes.
  4. Free antivirus software is not free – You get what you pay for in the area of antivirus and malware protection. If it is free a lot of people use it and when there is a security hole – hackers will attack.  That is opposed to paid programs were vendors constantly update the software to address new issues as the occur.
  5. Are tablets, Smartphones and Macs safe without antivirus software? – Though the Android and Mac OS X boast of operating systems that claims they are tough to breach, they still contains weak access points. Just like any tool that surfs the web or connects to wireless routers, security is needed to scan all those items you click. (Recent research suggests Macs are now more vulnerable than PCs.)While these devices have often carried around the title of most-secure operating system, it doesn’t hurt to back up your devices with the latest antivirus security protection.

IT Related Fraud issues addressed by Janco

 IT related fraud occurred in over 70% companies

Malware exposure is high in many enterprises

IT related fraud and alware infections cause a number of problems. Machines become unresponsive or sluggish resulting in users become frustrated and administrators spending precious time trying to find the problem.

Once an attacker is on the inside, his or her work is significantly easier since on most networks, systems on the inside are trusted.   To that end, in a review of over 300 security audits Janco has found a list of the greatest security weaknesses.

Enterprise Wde Security Weaknesses

The weaknesses are:

  • Using only single level verification for access to sensitive data
  • Having “public” workstations or access point is connected to a secure network
  • Sharing login credentials
  • Data validation for forms is contained in client-side JavaScript
  • Connect to network from an unsecure access point
  • Corporate web site is encrypted but the login process is not
  • Using weak encryption for back end management
  • Using unencrypted or weak encryption for Web site or Web server  management

Order Security Policies and ProceduresDownload TOC security policies

New IT Jobs 2017

New IT Jobs 2017 as the economy improves

New IT jobs 2017 will be driven by an improved manufacturing job market.  As of March 2017, Janco forecast that there will be a total of over 125,000 new IT jobs created.

New IT Jobs 2017
IT Job Market growth forecast from Janco Associates

Janco’s forecast is based on interviews with over 100 CIO, CFO, and HR professionals in the IT sector of the economy.

Close to 12,000 new jobs were created in the first two months of 2017.  With the model dreated by Janco, the firm believes that and additional 113K new jobs will be created in the balance of the year.

On a monthly basis Janco updates it model, forecast, an projections on its main web site at the page titled IT Job Market.

Factors driving the IT job  market in 2017 will be:

  1. The job market will be in favor of the IT professional job seaker
  2. IT will pay IT professionals to swith companies this year
  3. IT professionals will and should ask for pay raises this year
  4. There will be a labor shortage of IT professionals who are social media , programmers, security, and networking experts.
  5. More IT pros will become freelancers and contractors who prefer to telecommute and set their own hours.
Download Selected Pages

Women CIOs comprise over 20% of all CIO roles

Women CIOs  hold over 20% of all CIO roles according to data analyzed by Janco Associates

Women CIOs – In the process of capturing public data on CIO compensation, Janco has found that well over 1 out of 5 CIOs is a women.

Women CIOs and other C-Level positions

According to the CEO of Janco Associates, at least two thirds of large public companies doing CIO searches require the recruiter to include women in the candidate pool. Further, when “all else is equal”, between a male candidate and a female one, companies are tending to choose the latter specifically to enhance the diversity of perspectives on the management team.

Unfortunately, even with this data, there are still too few women in senior, experienced roles to populate the candidate pools of all diversity-minded companies. So it’s not enough to decide at the CIO level to hire a woman. The relevant decisions must be made and opportunities offered earlier, at the developmental stage of potential finance leaders.

Companies need to provide more mentors who can share wisdom about things like where to invest time and ways to be motivated.

For those with leadership potential who prioritize family and stability over always making the best career move, the path to the C-suite may be inherently more difficult in CEO and finance than in other functions, like IT and human resources.

Number of employed rises

Number of employed rises by over 1/2 of million individuals

The initially reported number of employed individuals rises by almost 300,000 in February. At the same time, there are now over 650,000 newly employed individuals since the election.

Number of new job increases by almost 650,000 in the three months since the election

When the data is analyzed over a long term the trend recent trend does not stand out as much.

However all of the indicators are that this is the start of an upward progression in the number of individuals employed.  This is in line with the other data that we have analyzed.

“Everything you need to respond and hire as demand for IT Professionals increases” – CIO Fortune 500″
Order IT Hiring Kit
Simplify Recruiting While Making
Sure You Hire The Best IT Staff Possible

In today’s economy, nearly every organization faces pressure to reduce waste, run at peak efficiency and “do more with less”.  While the economy has shown signs of improvement and the unemployment rate has dropped modestly, organizations are still extremely cautious when it comes to hiring. When it is necessary to hire, it is critical to make every hire count. There is little room for error. It is crucial for senior-level leadership, human resources and hiring managers to all be on the same page and do the right thing.
Order IT Hiring Kit

Tech Savy Young Hires Talent Shortage

Tech savy young hires talent Shortage is real for many enterprises

Shortage of Young IT Talent makes the promotion process falter

Tech savy young hires talent shortage is widely discussed among CIOs. The shrinking unemployment rate has drained the talent pool in many corporate IT functions and industries, and companies continually complain that they can’t find qualified staff. For Information Technology departments, the problem is different: If they were looking solely for the technical skills they wanted years ago, they would be overwhelmed with candidates. Today, though, such skills are table stakes, and the focus is on finding people who stand out because they have other desired qualities as well.

Download Selected Pages

Given companies’ increasing reliance on data in decision-making, demand is soaring for a demonstrated aptitude for analytics. Even more important for the long-term success of new hires, however, are assorted “soft” skills that allow them to communicate and collaborate with others, as well as influence others’ attitudes and behaviors.

According to some CIO, there is not a shortage of finance talent per se, but there is a shortage of people who have both technical expertise and these additional skills that will enable them to work well inside an organization.

Given this shortage, IT departments are aggressively positioning themselves as employers of choice. And they can’t allow themselves the luxury of easing up on that quest, since their competitors are doing the same thing.

What are CIOs and CFOs looking for

CIOs and CFOs are telling Janco Associates they want Information Technology students who know how important application strategy will be in any IT function and who show a willingness to embrace and explore analytical tools and methods. Students don’t necessarily need to know how to code.  Many companies that are successfully hiring young candidates with prowess in analytics are looking beyond traditional sources like business schools and accounting firms.

The problem is that demand for those candidates far outpaces supply. CIO should be looking for people who may not have the desired business background or professional experience but who possess the analytical skills IT pros need now and in the future.

10 point DR power checklist

10 point DR power checklist defined in Janco DR/BC Template

10 point DR power checklist — After an event that disrupts a network, availability of power to recover and run the network often is critical.  Below is a 10 item check list of what to consider in your disaster recovery – business continuity plan.

  1. Electricity, water, broken wires do not mix.  Before anything else validate that the power source and power distribution systems are dry and functional before power is turned on.
  2. Understand the minimum power requirements to be operational.   Have a clear understanding of a facility’s critical loads.
  3. Have an adequate fuel supply to operate backup power sources. Make smart fuel and technology choices, considering things such as if natural gas pipeline service were to be disrupted in your community. Make sure that you have sufficient fuel storage capacity onsite for an extended outage.
  4. Set reasonable response times for standby generator.  Frequent outages of a few seconds, a few minutes, or more, can have significant cost implications for businesses. While some other generators take up to two minutes to engage, diesel-powered generators are uniquely able to provide full load power within 10 seconds of a grid outage.
  5. Maintain your equipment and test it operations. Standby generators should be exercised periodically to ensure they will operate as designed in the event of an outage.
  6. Understand your environment and geography.  Even the best generators won’t work underwater when subjected to extreme flooding.  Check unit location for protection from flooding and ensure you use the proper gauge extension cord.
  7. Set up generators in an “open environment”. Use generators or other gasoline or charcoal-burning devices such as heaters in an open area or outside near an open window. Carbon monoxide fumes can build up and poison people.
  8. Quarterly review your load.  Know when there are any new demands or critical circuits to protect.  If you’ve added new computers or other power-hungry devices, consider updating switchgear.
  9. Meet all mandated compliance requirements. Make sure you have the proper permits and records on operations.
  10. Optionally contract for a rental power source.  Consider a rental generator power for use in the event of an extended outage.

Order Disaster Plan TemplateOrder Disaster Plan TemplateDisaster Plan Sample

Top 10 tips improve social networking security

Top 10 tips and best practices to improve social networking security

Top 10 tips to improve social networking security are necessary in order to secure the enterprise’s data and reputation.

  1. Educate employees – Educating employees of best practices can help improve the overall security of the business. Awareness through seminars, workshops, and other programs help educate how attackers use social media to target a brand via individual employees.
  2. Have employees use different passwords for different system – Encourage users to have multiple unique passwords. This can be support by implementing a cloud based password management system.
  3. Mandate strong passwords – Make it a requirement to have unique strong passwords.
  4. Have employees change passwords regularly – One every three or four months communicate with employees to tell them it is time to change their passwords.
  5. Do not share accounts – For social accounts that represent the enterprise only have one user per each and the linking e-mail account should be one that is in the enterprise domain and will remain with the enterprise in case the employee leaves or is teminated
  6. Implement two factor authentication – Many of the larger social networks provide two-factor authentication, commonly in the form of a code sent to their smartphone or email each time a new device or browser attempts to login to the account.
  7. Educate employees to NOT open email attachments or go to links where the originator is not known – Stress the practices of carefully reviewing URL links before clicking to make sure the company and site name are spelled correctly. Cybercriminals will often blast out links that are very similar to a real address adding, subtracting or rewording parts to differentiate them.
  8. Utilize antivirus and security software – . No matter how careful a user is, there’s always the risk of accidentally engaging with a malicious link – and just one unfortunate click can lead to months of recovery time.
  9. Don’t friend people you do not know – Companies should encourage employees to thoroughly vet a friend request before hitting “accept”. They should check to see if other colleagues are also connected to the account. If the account seems suspicious or you don’t know the individual, ignore or report the user, and refrain from clicking on any links they may have sent.
  10. Validate and verify – just because it is on the Internet does not make it true.

Top 10 WYOD Best Practices

Top 10 WYOD Best Practices expand beyond BYOD

Tio 10 WYOD Best Practices - Policy
WYOD Policy that address all of the issues generated by this technology.

Top 10 WYOD Best Practices – Employees bringing their own smartphones into the workplace started the BYOD trend requiring enterprises to deal with the serious security implications that come from these devices. The decision for employees to wear their own device (WYOD), such as an apple watch that can link to your Wi-Fi; capture audio, video and data; store; and transmit poses similar problems for IT departments.  Employees and individuals outside of the enterprise can use these devices, sometimes discretely, to access and share business content.

This puts corporate data and infrastructure at risk, and reinforces the need for IT managers to focus on securing the content, rather than the device that’s in use. Wearable devices simply add another level of access and security concern to what we’ve already seen with the BYOD trend.

Here are top 10 best practices for WYOD:

  1. Have a strategy for how, when and why WYOD devices can be used
  2. Implement an acceptable use policy
  3. Identify the connectivity options that are available to both internal and external users
  4. Approved devices should be easily connected to the available secure access points
  5. Define a management process for the WYOD devices
  6. Plan for the activity WYOD devices will add to the network
  7. Make collaboration tools a priority
  8. Secure the end points and isolate sensitive/confidential information and locations
  9. Be prepared for little to no advance notice on upgrades
  10. Formalize your 7 x 24 support

For more information on this go to WYOD Policy.

Why H-1B is Wrong Solution

Why H-1B is wrong solution – a question that we have been asked

Why H-1B is wrong solution – a question that we have been asked by a number of reporters (see press release).  Below are two tables that  Janco has created in getting the answer to that question.

Why H-1B is Wrong Solution
H-1B Visas 2015 – 2017 – What is wrong with the H-1B visa program
Why H-1B is Wrong Solution base on who get the visas
Number of H-1B visas issued for IT related jobs is 78.5% of the total – Is a lottery the right way to allocate the visas

Below are some of the questions that we were asked by a reporter for a national publication.

General Questions

Reporter: Is the Information Security Analysts job the only H-1B security job in your findings?

Janulaitis: Yes, that is the only pure security role.  However, there are individuals who have those skills and are classified as Network and Computer Systems Administrators. They fill some of the roles of the security analysts.

Reporter: Do you have any insights into whether that number is so low because. A) no company’s are looking abroad for security skills. or B) people with these skills are applying but not getting accepted? 

Janulaitis: First there has to be demand for that role.  Many C-Level executives do not feel comfortable with security being done by non-US workers who are not on shore and/or are outsourced.

When C-Level executives have a choice, the idea that an H-1B is responsible for security is not one they relish. They need some assurance that H-1B employees will remain with the company.  There have been too many hacks that have taken place where immediate response is required. There is less control when the individual is an H-1B employee that is a contractor.  Companies like Microsoft and Apple (vs Tata’s) offer real opportunities for security specialists. These are US companies, not outsourcers, and have a long term view.  I know both Microsoft and Apple have good internal training programs in place with real career paths for the “best of breed” technologist that they hire with H-1Bs.

Reporter: Do you think that IT security and cyber-security skills should be given special consideration for H-1B visas? Under the proposed revamping of the program that may include moving to merit-based selection program rather than a pure lottery system.

Janulaitis: In general, all H-1B visas should be merit based.  My feeling is that the first choice for jobs should be US nationals who are qualified, then foreign nationals who are graduates of US Universities and want to become US residents and lastly, graduates of foreign Universities who want to become US residents.  The idea that there is a lottery and companies like Tata win a large number of positions that they then use to “replace” US workers does not make any sense at all.  The purpose of the program is to give the US a competitive edge in technology not reduce cost for US corporations.

Reporter: The question is being raised because the global demand for cyber-security workers is expected to reach 6 million by 2019. There is a projected shortfall of 1.5 million qualified security pros. More than half of organizations today say that finding and recruiting talented IT security staff with the right skill sets is a “significant” or “major” challenge.

Janulaitis: First we start to educate our IT pros in the disciplines required. Then have jobs for them when they graduate and there will be much less of a need for “foreign” workers.  It should be a H-1B requirement that these individuals have a “desire” to become full time US residents.  If companies like Tata game the system, they should be penalized. Perhaps they could be required to post a bond of say 20% of the annual salary be put in trust.  That would be returned when the individual qualifies to be a permanent resident.  If they do become full time residents within a specified period, then the bond would be forfeited and the individual would have to leave the US. We need to take the profit out of gaming the H-1B program.

Other Observations

Reporter: Any other insight you might have into this would be greatly appreciated.

Janulaitis: Companies like Tata should not be allowed to get the number of H-1B visas they do.  They are gaming the system by creating US subsidiaries that are just a shell to get revenue out of the US and not necessarily help the US to be a technology leader. The focus of the H-1B program should be to get foreign nationals that are world class to come to the US, become full time residents, and contribute to our society.  Currently students come to the US and take the limited number of advanced degree slots available we have and are capping the number of US nationals who can fill them.  It is not the US’s role to educate the world.  We need to do everything possible to have H-1B visa holders stay here.  It is not good when over 75% graduates leave and go back to place like China and India.

I believe much of the problem we have is due to our educational system.  We need to have more of a focus on math and science and less on social engineering.  As a county we spend more on education but rank behind Poland. We have a bias towards foreign nationals in our graduate and doctoral programs.  We need an educated population of college graduates who focus on both math and the science. Then we need to have jobs for the individuals that have STEM (Science, Technology, Engineering and Math) degrees. That includes undergraduate as well as masters and doctoral degrees.  It is much easier to grow our skill base if we have the professors who can teach those subjects.  China, for example, is graduating more students from it universities in robotics on an annual basis than we have in total.

 

 

Changing H-1B visa

Changing H-1B visa

IT Job Descriptions in MS WORD format
IT Job Descriptions

Changing H-1B visa program should be a priority.  There are too many companies that need top IT talent.  We should not waste H-1B visas on companies that want to reduce costs.  It would be better to pay foreign nationals who bring value to The US economy.  There is no way that we can maintain a leadership position in IT by cutting costs and eliminating US based jobs and resulting experience and training.

The current H-1B system is being gamed by outsources. That just has to stop. Suggestions for changes that should be made are:

  1. Eliminate the lottery.
  2. Give priority to only those companies who have graduates from US universities.  Do not allow companies to use foreign nationals who have not attended US universities.  At the same time allow for exceptions for individuals who command salaries in excess of US median salaries for positions in question. Include a bond equal to 20% of annual salaries. Refunded to companies after individual becomes a full time resident.

3. Certify companies are NOT just replacing US nationals for profit.  If they are, do not allow them to get any future H-1Bs and have them re- justify any existing H-1Bs. Use industry groups for the justification process not govt employees or agencies.

These are simple changes to the H-1B program but they need to be made if we are to maintain our technical leadership.

IT Job Market to expand

IT Job Market to expand as CIO and CFO confidence is high

Year to year comparisons show IT Jobs increased at double the rate of 2017 – Janco’s forecast of 136,500 new IT jobs stays firm

Information Technology job market spiked up with double the number new jobs in January of this year versus January of last year.  The CEO of Janco Associates said, “This increased demand for Information Technology professions remains firm with more hiring on tap for at least the next several months.  From our conversations with many CIOs, CFOs, and CEOs we feel this is the start of a boom in demand for IT professionals. Janco’s forecast of 136,500 new Information Technology jobs for 2017 is on track with 11,800 new jobs added in January. ”

Projected IT job market growth
Janco forecasts that over 124,700 new Information Technology Jobs will be added in the remaining 11 months of 2017
YTD IT Job Market growth
January 2017 had double he number of Information Technology jobs created than January 2016
Order Salary SurveyDownload Selected PagesDownload Selected Pages

Electronic Forms are released by Janco

Electronic Forms are now available for download

Electronic FormsJanco Associates has just released its 100 IT Infrastructure Electronic Forms .  Victor Janulaitis the CEO of Janco Associates, Inc. said, “Over 1,000 companies in over 120 countries have selected the Janco’s CIO IT infrastructure Policy Bundle with electronic forms.” He added, “Forms include all areas of IT including Disaster Recovery/Business Continuity, IT Service Management, Records Management, Records Retention, Safety Program and Threat/Risk Assessment.”

The CEO added, “Many of the best features  are that they comply with US state and federal mandates, EU requirements, and ISO standards.  Best practices are followed on all of the forms product.”

The Infrastructure Electronic Forms are delivered electronically and comes as an easily modifiable Microsoft WORD and PDF documents.  They include everything needed to implement a seamless electronic document management system which works on Smartphones, tablets, and desktops.  The forms can be acquired with Janco’s CIO IT Infrastructure Policy bundle or a as a standalone item.  Janco also offers and subscription update service for 12 or 24 months.

The CEO said, “Enterprises around the world are moving away from paper files to electronic ones.  CIO who are on the top of their games have already started this implementation.  It will only be a short time until electronic forms will be a best practice.

OrderDownload Selected Pages