Speaker 0 | 00:09.544
Hi, nerds. I’m Michael Moore hosting this podcast for Dissecting Popular IT Nerds. I’m here with George Horta, Vice President of Information Technology for ACS Industries Incorporated. Welcome to the program, George.
Speaker 1 | 00:21.090
Thank you for having me.
Speaker 0 | 00:24.211
You know. I think if you’ve heard this podcast before, you know it’s time for our random access memories segment. This is where we ask you three questions, and these questions are meant for answers to be just top of your head, and it’s fun. It’s just a nice breaker that we do. And your first question is, if all the computers in the world shut down tomorrow, what job would you do instead? creating novelty products like selling gag gifts okay okay what can you give me an example of a gag gift you would you would sell all right uh yeah so i got this idea so copyright before i’m gonna get some great ideas there you’re good you’ve got a little bit of time before this goes to air so you can just you know quickly run to the patent run out run out to the copyright patent office all right i would create a i
Speaker 1 | 01:21.502
think i would create a i would start with us a gag seasoning i would call it tastes like chicken and then it would be guaranteed to make any meat you prepared tastes like human flesh or or you double your money back and then the 1-800 number to get the number back would be directly to a call center to the police yeah somebody calls i’m like oh yeah you know what i tried it and you know what doesn’t taste like human oh really what’s your address yeah yeah let’s uh yeah yeah we’ll be out there the check’s coming right now i think
Speaker 0 | 01:52.052
I think you’re onto something. And if there’s any law enforcement listing, I think they’re going to be like, hmm.
Speaker 1 | 01:58.816
Yeah, I should have had that ready for it. So I’m going to plug that. Tastes like chicken. That’s what’s the name of it. So if you see it on the market, it’s me.
Speaker 0 | 02:08.001
Do you remember the first website that you ever visited?
Speaker 1 | 02:14.585
Oh, yeah. I was a young teenager and it took forever for those women. populate on a screen. I don’t remember what it was called. It doesn’t matter what it was called, but all young boys remember the first website we all visited when we were able to type in something.
Speaker 0 | 02:31.213
Well, man, that was a lot different than mine. I think mine was the hamster dance.
Speaker 1 | 02:36.895
Oh, okay.
Speaker 0 | 02:38.596
Remember that silly webpage?
Speaker 1 | 02:40.996
My website had dance in it, too.
Speaker 0 | 02:42.537
Okay. What was the name of the
Speaker 1 | 02:48.560
oldest piece of technology you still use regularly the oldest piece of technology that i still use regularly um that’s a tough one i know it is it is you know i still use i still listen to traditional radio music like already regular talk show like traditional broadcast i think a lot of people still rely when they drive on them um on you know streaming media from their phone or listening to spotify or things like that um i like talk radio it keeps me awake while i’m driving i tend to get you know zoned out too easily um it’s if it’s not something that does that’s not engaging so so
Speaker 0 | 03:34.778
so this so this type of stuff over here i don’t think you see this uh up here but these two are old school um radios oh yeah i’ve seen it you know unfortunately the listeners can’t see but just no no no no but i mean if george will tell you he can see in my background and he’s super impressed right now at these they’re amazing they’re museum quality yeah
Speaker 1 | 03:59.758
yeah so i would say that’s the most oldest traditional i mean if you think about it radios have been around for for years and um you know and i by no means am an audiophile uh But I think in terms of technology, what it still brings, I think the format for talk radio or talk or podcasting is still very, very, very, you know, fit for purpose.
Speaker 0 | 04:25.408
Oh, you know, it’s a good, good point. I mean, I don’t honestly I don’t think that podcast would be a thing unless talk radio was a long time ago. Right. Right. And it’s still here. I mean, that’s the amazing part of you still you can still. hear it and it’s still a big portion of this so yeah that’s a that’s a great point i i that was a really really good answer um george uh process first people second finally after the first two are aligned it’s all about technology that was on your headline in linkedin yes
Speaker 1 | 04:59.410
sir yes um Explain that. Well, I think a lot of companies historically would rely on, especially in IT, look for IT as an engine for major change without realizing that IT is just about automating and optimizing. And so if you have a really shitty process and you have really bad workflows or you can’t quantify the work your people do and how they do it, how they operate. IT is just going to get you there quicker. So if you’re not doing things great to begin with, IT is going to automate bad process. So you really need to understand how you’re working, how you’re operating, what your workflows are. And they need to be owned by somebody. And it starts with that right there, right? Somebody who’s going to take ownership because even the best ideas, even the best processes, even the best tools, if somebody doesn’t have ownership of it, right? and bring it to your front door, everything else is just going to die in a vine. And I’m sure a lot of IT folks out there that listen will realize, you know, what we’ve seen in their experience where they show up to a company, maybe they’ve inherited a network or an environment, and there might have been really great tools, you know, that were partially implemented or they got all this great technology with all these, you know, neat features. And they’re just… They’re just not being used. You know, it’s a case of the Lamborghini sitting in the driveway to go get the mail, right? But not get Null’s value out of it. Nobody understands how to get use out of it. They strategically designed a great service and just did a poor job in transition and leveraging it.
Speaker 0 | 06:41.574
Well, you know, let me interject for a minute because you made a great point and I want to hammer that home, right? And your point was, you know, you’ve got these great applications and products and things and they might just be spectacular. And we see this all the time with shadow IT, where people go out and they buy these amazing products or subscribe to these amazing SaaS applications that are out there. And because they don’t consult IT, because they don’t go and accurately work with them, they can end up getting the wrong subscription, not get the feature set they want, don’t know how to implement it. Right. base the processes, right, that get created into that new application. And ultimately, they could just tank the new solution and they end up spending money for something that they don’t use. So that was a great point you made. I want to just highlight that.
Speaker 1 | 07:42.645
Yeah. And I think the people part of it is, you know, at the end of the day, you know, as technologists and cybersecurity specialists, a lot of what we do, you know, isn’t really about the technology. right? It’s about enabling automation and process. And so, you know, the businesses don’t care about like RAM or containerization or servers, right? I mean, I would argue they don’t even care about cybersecurity, right? They’re worried about, does my email work? Will I get fined for something? How much is it going to cost me? And can you automate stupid out of my company, right? That’s really what they’re looking for. You know, and so it’s it’s in essence like I.T. is really more about the psychology of people and how we operate and how we work and how can we make it better? You know, and so that’s why it’s people process than technology. It’s just the tech should come last.
Speaker 0 | 08:40.689
You this. I think you just gave me one of the best quotes I’ve ever heard. Can you automate stupidity out of my company? That is a fantastic line.
Speaker 1 | 08:52.499
Yeah. And I’m a big proponent of ITIL. So I’ve always been a big reader proponent of IT as a service, right? I don’t care about whether or not Netflix hosts their product in AWS. I don’t care about the user interface, the user experience, to be honest. And quite frankly, it’s inconvenient. But yeah, they want me to not share my password anymore. I’m more than happy to kick the freeloaders off my account. Give me more episodes. sanctuary and shame on you for presenting that resident evil trash you put on there last year. So I only care about the service and the businesses only care about, can you do this securely? Am I going to be fine? Can you help me optimize?
Speaker 0 | 09:38.486
Yeah, I know. I think that’s a great point. So like I had mentioned, you’re currently with ACS Industries Incorporated. Do you want to give us a quick rundown on what ACS Industries means? does and what your role is.
Speaker 1 | 09:52.915
Yeah, so ACS design and manufacturers, they call it unique critical to function components. And in the products of in the products for companies that build bigger bigger things right so we’re we’re what’s inside right we’re not necessarily going to be the the center stage limelight product that you would see so you know they largely right now build filters for traditional fossil fuel um engines and components and they also build um metal mesh products for um filters for airbags right so you don’t get a flame a face full of flame you only get a face face full of bag explain the metal mesh um expanded metal so literally like if you were to look at a brillo pad that’s metal mesh right if you took a look at you know a filter like an oil filter or a certain filter and an engine that would be metal mesh um and so they’re they’re actually masters of the not just creating a product but optimizing the the operations like how do we get from point a to point b to point d and mass produce this product so that we can make it as cost-effective as possible for you to put as many of our products aside as many of your products as possible.
Speaker 0 | 11:07.403
That’s amazing too, because when you think about it, you know, making a product is, is fairly straightforward. It does have challenges, but it’s fairly straightforward. But when you’re making parts inside, we’re making a part that can go inside multiple different products, right? Right. That seems to be a little more challenging. uh because you have to make it in different ways to be able to fit all these different products and keep up with their um uh changes to to the to their products right i mean is that yeah exactly exactly and so they just started getting into for example um we’re
Speaker 1 | 11:45.937
building now this mesh product that filters water from hydrogen hydrogen from water for um a customer um that’s that’s good so we’re in hydrogen power another green power industry right you And so it’s one thing to produce like a single product, right? Like a single cyber truck. It’s quite another to figure out how to mass produce that cyber truck frame, you know, in mass so you can get all your shipping models out, right? Like that’s a completely different animal. So it may be very cost efficient or maybe very easy for you to produce one of something. Like now produce a million of it for the same cost. Do that one, right? That’s really… So it’s not so much just the product they produce that’s innovative and, you know, smart and well-designed. It’s the process to build a lot of it all at once. And so in this particular case, what I do for ACS is, you know, with their medium-sized company, I think by typical standards of gross revenue. But, you know, they have a global footprint. We have factories in Mexico, Romania, China. We’re opening up a new factory in India. And so, you know, they traditionally have, you know, your normal enterprise operations, those keeping the lights on types, things like Word, Office, you know, those tools, key ERP, MRP functions, you know, those tools that help them actually do the business, right? And then this new net, you know, this manufacturing network, you know, and a desire to go to manufacturing 4.0. So SCADA and PLCs and trying to get. That will technology stack into the 21st century by making it more interactive and get real-time information from there. And so what I’ve been helping them do is modernize their technology, do it securely, and also manage their costs. Because they’ve never necessarily had somebody come in and go, well, as a company, you should be operating within this bell curve of spend based on your gross revenue number of people. And oh, by the way, you seem to want to really do this on a shoestring. budget which is most companies do right it’s not a it’s not a indictment against any company i’ve never been with a company that goes yeah you know open up here’s your you know we we could spend anything you want right um and so managing lead and cultivate a team to operate internationally right so i have people that report to me in in india romania germany china uh you know we work so getting all those people away and produce that’s going to satisfy the business and you know coach people in other regions where the culture around professionalizing i.t and cyber and you know having somebody coach you on how to manage your career is not something that would be inherent maybe in those regions or necessarily you know historically within the company but you know and listening
Speaker 0 | 14:38.487
to you what i know is that from a um you know, I’ve had the pleasure of doing global IT as well, and the challenges and stuff that come around with it. Extremely amazing, because you get to work with all different sorts, and all different, you get to see a whole bunch of different things. It’s an amazing, but it’s also incredibly taxing and challenging, because your day never ends. You know,
Speaker 1 | 15:07.839
exactly. Really?
Speaker 0 | 15:10.217
When you’re trying to go to bed, somebody’s waking up and it’s like, you know, the sun never sets on IT, you know. So, and in fact, to hammer home this point, where are you right now?
Speaker 1 | 15:22.305
So I’m working from the autonomous region of Valencia, Spain, a little city called Xativa. Beautiful, old, historic, very ancient village. But I have fiber coming to my location. So let’s talk about a flat world. um got a view of a castle from my little trava um it was our um hgtv international you know uh dream to buy something um and have something um in a different country so um but you know what you said it’s 100 on the dot you know people hear that and they think you know they get the wrong impression they think you’re you’re you know they think you’re living a certain lifestyle and it’s like no you know it’s it’s a Everybody spends their money on different things. You know, some people have an old SS sitting in a garage. Some people collect ancient radios. And on top of that, you know, you work a lot harder. You work more in this capacity. You know, when I’m back in the States, my other home office is, I live on Cape Cod in Massachusetts, and I’m normally just focused on my ivory tower. You know, we operate, our headquarters is in Lincoln, Rhode Island, and I support our North American. offices in Mexico, really. So Mexico. And quite frankly, I have the luxury of not necessarily worrying as much about Asia and Europe. And we do, we still care very much about that. I have some good people in place now that I can rely on and sort of run operations there. But when I’m here working in this time zone, the GST time zone. Well, I’m up during normal working hours for Romania and convenient hours for India and China even. I actually can post a meeting during their working hours. But North America and Mexico aren’t rolling in online until noon to 1 p.m. my time. Yeah. Where I might go, well, I’ve been supporting these hours and focused on these hours these days for the site. and trying to get off and get dinner at 8 30 9 o’clock at night thank goodness the spanish people are you know they they live their lives much later in the day because it’s so ungodly hot sometimes um you meet my ceo might be go on green on teams you know i
Speaker 0 | 17:37.553
have no way i can jump up so it’s a longer day so it’s these days are grueling when i’m working um i i bet i bet just because you’re so accessible and i mean in europe uh i mean you’re probably uh i think
Speaker 1 | 17:52.029
what’s six hours from eastern time uh six hours during yeah during daylight daylight saving yeah so it switches depending on what time of the year i’m there yeah and um yeah more for mexico now mexico got rid of daylight savings time so whereas it used to be a one hour difference between eastern standards now two now two yeah
Speaker 0 | 18:13.723
so so they’re all so they’re operating almost in mountain it will be the states and mountain time exactly exactly so Wow. Well, yeah, that is a rough go. But, you know, IT is not without its challenges. And, you know, you had mentioned, you know, essentially this is a manufacturing, right? And so I also have some experience in doing IT with manufacturing. Right. And I have learned from that that that comes with a whole set of challenges. in dealing with proprietary equipment that may be using systems that are way far beyond end of life and running operating systems that are no longer supported and switching them out would cost an amazing amount of money. Are these some of the challenges that you see in that?
Speaker 1 | 19:14.465
Yeah, 100%. I would say a lot of the PLCs, for example, are 23 years old, and they were never designed to be internetworked and do everything they want. We talk about manufacturing 4.0, and they mean to be able to have the push-pull of data and the ability to remotely do things in a way that’s never been invested in before. You have this desire to get the most out of it and bring your network and your manufacturing environment into the 21st century. But, you know, companies that have been doing that on enterprise traditional networks for years can’t do that right. You know, they’re still working to get that done right. And so now you’re looking to do this in an environment and a culture where you’ve never invested money in. Right. So I don’t have necessarily a budget for a PLC guy.
Speaker 0 | 20:06.794
right i’m having to hire that now because i’m trying to explain to the business how right the the you know the environment is for us to actually you know to risk introducing you know connecting these systems into the environment to the network right 100 you know it is that you’re actually you’re on the nose on that it’s almost like hey listen don’t network these things up leave them be because that is a uh you know that is just a uh um target at that point yeah you you know yeah that’s a that’s a point of entry where you can get in there um speaking of cyber security right um so let’s apply cyber security to a global scale right because uh um you mentioned that you don’t have to deal much with a lot of the european pieces but you know gdpr is uh prevalent over in that region uh but even from uh uh even from other other different regions uh there are data and privacy and security, you know, changes and frameworks that just change from region to region, right? How do you keep up with that?
Speaker 1 | 21:16.297
Well, I think the challenge with a lot of companies that are global is, you know, even the best companies in the U.S. have failed to ever do like an SRTM, right? The security requirements traceability matrix. What do we actually have to do? How does it map together? So. I do get involved with our European and our Asia practices in terms of everything, cybersecurity. What I meant to suggest was that I have people I put in place that I trust so that they have somebody who’s real time. Yeah, because what happens, we’ve never had that person there with the authority and ability to make decisions during our off hours, right? They used to have to always wait for the U.S. to wake up and go, yeah, you know what? I understand what you’re trying to do. Go ahead and. make this change or make this executive decision. So, but that’s a result of us having control and visibility and understanding of exactly what those needs are and growing the ability to support them in a way that, that makes sense without maybe necessarily handing the keys to the kingdom to maybe our new guy in China, right. Or our new factory in India, where they don’t, they’re not familiar with our processes. Right. And identifying those right skill sets and those right characters that are going to be able to. to play the role we need them to play and operate the way we expect them to and what we lay out there. So I think from our perspective for cybersecurity and more specific compliance, so where a lot of our products are automotive, we have to meet TIS-X. TIS-X is an automotive specific cybersecurity framework where you get certified, but it’s ISO 27001 derived. And so I think, you know, one of the biggest challenges is explaining that process to the business and how it operates because you’re, you know, you’re, you’ve been in the same position where you’re doing a lot with a little, right. And so you’re having a nine times out of 10, you have a great, well laid out plan, but you’re having to be a lot more tactical more often than you realize versus strategic, right? Like, well, I got to do these six things now because yes, we want to be TISACs to ISO 27001, but we got to go pursue now our ransomware insurance and they, they really want you to get these four things done first. So let’s prioritize them because it’s not wasted effort. We got to do it anyway. We’ll just do it to a manner that achieves this standard so that when we get to it and that, you know, for that framework or that goal, it it’s, we could, yeah, we did it already. Let’s move on to the next thing. Right.
Speaker 0 | 23:42.975
I love that. And that’s, that’s a great approach because that’s that allows you to, to do the homework upfront and understand, you know, you’re not going to be able to do it all by yourself. what your, you know, what, what, what different security, you know, frameworks you need to follow. Right. Right. And then see which ones line up, compare them all and then go, OK, let’s take the ones that are giving me the biggest bang for the buck. And then you’ll be able to knock out quicker, get get them in there. Let’s prioritize them and let’s put together this mitigation plan so that we can kind of keep running through it. But you understand that you have limited resources and you can’t do it all. you know so uh it’s hey i i understand what we got to do and it’s just uh it’s just running through it and and that fits along with something i always kind of mention to people which is security is not really a destination it’s a journey uh it’s a continued journey so you’re when people think wow i want to be secure i’m like okay well you just want to be more secure than you were yesterday and just keep doing that.
Speaker 1 | 24:44.281
It’s a life cycle activity that people don’t realize you own it. Right. So it’s, you’re perpetually measured, measuring, quantifying what you’re doing a lot of time. You spend a lot of time having, especially at our level, you know, your director VP, you’re having to educate these leaders, explain to them exactly what it is they’re doing. You have to explain to, well, listen, NIST, you know, is this control stack from NIST is basically like your refrigerator in a restaurant. You know, it’s giving you all the revenue, the quality of the food, core component you need to to to give a recipe or a menu item to a customer and that menu item might be tisac certification all right let’s grab what we need for let’s grab everything we need and give it to there you know and and by the way itils the method by which we serve the food and prepare the food and identify quality and manage it over the life cycle of it being in our fridge right um and so trying to make it understandable in a way so they they see why things take so long yes It makes sense, right? Configuration management, you know, operating systems on your computers, they all should be the same. They should be updated and patched. That’s sort of kind of one-on-one asset management, right? Well, if you spend years neglecting refreshing these computers and they’re so old, I can’t update them to the operating system. That’s a project. Now your cost has gone up. The time to deliver this solution for you has now expanded. And it’s tough to make the business understand sometimes that’s. Your earlier five, seven, eight years of looking to be more economical and lean with the way you did things, you know, has come back to roost. You’re going to have to pay later or today, but you’re going to have to pay something.
Speaker 0 | 26:20.316
You know, gosh, I love that response because that is such a I deal with this on a daily basis because I talk to multiple companies. And, you know, you see companies that don’t invest in their infrastructure. Hey, it’s still working. Why would I touch it? You know, I paid for it. I’m going to get all the use out of it. I can. And they use that thought process. And what they what they tend to miss is, OK, but all the means now all this stuff is going to come all at you at once. Right. You’re not you’re not being proactive. You’re not creating a life cycle for this equipment and refreshing it over a period of time, which, by the way, would lead into what I was going to ask you about, which is budgeting. Right. If you create a life cycle for your equipment, then you can effectively budget it and amortize it over a certain period of time. And that will make your budget, you know, roughly static in that regard. It kind of equalizes it. But that’s just one thing we can do from a budgeting standpoint. I’m a big proponent. And I’m glad you earlier mentioned this about budgeting because I’m a big proponent of working with finance teams and helping to reduce cost in IT so that we can turn around and reinvest it and do some amazing things, strategic things. What are some of the items and stuff that you’ve worked on from a budgeting standpoint that you feel that may be overlooked in this arena and that you could help our listeners out with?
Speaker 1 | 28:03.264
Yeah, I mean, I think the first challenge always is in order for IT to be able to demonstrate value, the company needs to be able to quantify the value of the business their workers are delivering to begin with, right? And, you know, and I think this just sort of translates to a bunch of other topics like work remote, right? It’s sort of been, I’ve been very interested in the psychology of work remote, how that happens. Because for me… Yes, my headquarters is in the U.S., but most of my customer base is in every other country except the U.S. So I’m always perpetually to everybody else 100% remote anyway, right?
Speaker 0 | 28:39.690
Yep.
Speaker 1 | 28:40.490
So, and I think a lot of companies, when they’re establishing a budget and what they’re spending, you know, they don’t really know how to go about determining, like, what should we spend, you know, and where should we spend it? Because they don’t understand, you know, what the value is of automating a certain workflow or giving somebody more. you know more availability or enabling them to do their job better faster well what does that mean do you save money can you quantify that in a way that makes sense right a lot of us that come in and you know inherit somebody else’s you know network or infrastructure you know 1910 you’re really joining a company building from the scratch up right your nine times coming in and taking over what somebody else did right um when you’re doing that budget and looking at the spend you sort of have to go in and look at see uh you know what systems and applications have been orphaned, what weren’t fit for purpose, what didn’t scale, right? What made sense at a company at 100 that doesn’t make sense out of a thousand. And what is your core objective, right? Keeping in mind that most companies, their core competency is in IT. I work for a marine robotics company, right? High tech, they are not an IT company. That’s a different skill set, different engineering source, right? And so I would say go into it with understanding and starting with understanding your industry. Like what industry are you in? And there are already metrics out there. A lot of smart companies will help you figure out what your peers are doing in terms of spend. Like I know comfortably I’m within like, I’m at the bottom tail end of that bell curve for other manufactured companies that are global with my number of users and my number of computers and my number of M2s. IDS, I know what my spend is based as a metric for gross revenue, the percentage of my gross revenue. And understand that it’s just a beginning, a starting point for having that conversation to begin with. I can go and say, well, listen, we’re on the bottom tail end. So does that mean that we need to just automatically spend more to bring us to the median? No. But if you have these several objectives that you want to hit, we’re not doing it. you shouldn’t maybe feel so bad about spending to grow the business or to add functionality you may never had before and realize that it’s always a trade-off right um and understanding what you’re going to get for that spend you know on as technologists we’ve historically done a really bad job with collaborating with the business and saying you know what this is what you’re going to get for and simplifying it for them right they don’t care about ram they don’t care about cpu they don’t care about none of that look at this tiny server i got they don’t care
Speaker 0 | 31:14.112
they know don’t and now and now things are intangible even even more so like hey we’re going to pay a bunch of money it’s not you’re not going to see this shiny server or or sand in the computer room you’re going to see nothing no no but we need this money right yeah and for me i would rather manage slas and i would rather people and technology be quite frank i’d rather say
Speaker 1 | 31:35.892
hey we’re hosting our erp in the cloud you handle everything you know, you will help us mitigate our liability or risk because you now own that. We will consume it as a service. And then all I need to do is make sure that you hit the SLAs that we established and that, you know, that we can get audited and we can pass that audit, right?
Speaker 0 | 31:55.867
I, the shared security model and audits, you know, they just work so well together.
Speaker 1 | 32:04.931
You know,
Speaker 0 | 32:05.191
hey. hey, let me point you over to these folks that are working on this, and look, they have everything already set for you. And then we handle this piece, and here’s how we make sure that our data going in is secure and how we’re controlling access to that data and all these items. No, I agree with you. For anybody that gets audited frequently or works in a… works with companies that get audited frequently and then get the audit back to them as a third party. This is the shared security model is such a time saver and such a I don’t know, it makes me sleep better at night.
Speaker 1 | 32:48.957
Yeah. No, you know, but I would even go so far in terms of the budgeting aspect of it. I would say as technologists, right, if you really want to grow your career, you know, it’s I would say the IT part is always the easiest part. right but speaking the language of business and people right historically i think people haven’t been people people you know being able to have that discussion and really understand and explain it simply this is how we figure out what our budget is and it’s not just you know what are we spending but are we spending what we have on the right things right what buckets should we be putting our spend in and understanding that there’s going to be a trade-off like you know you you It doesn’t make sense to spend $100 million on security to protect $50 million worth of asset, right? So, you know, what’s that right spend mix look like? And I think, you know, in terms of longevity in your chosen career field, that’s where we still lack as an industry. You know, there’s not enough people that can speak the language of the business.
Speaker 0 | 33:49.790
And it’s so important because I think you meant like going back to what you said about the process and people. and then technology you notice how technology is last in that mix right you know and i tell people all the time i said you know tell me what you want to do uh let’s talk about you know the process and how and who we’re going to put on it and then we can layer the technology on top of that uh and and so it’s it it aligns really well with what you said and that’s why i kicked off with that um with that line because i thought it was it was dead on um you the technology You know, and I look at this too, we’re information technology, right? If technology didn’t exist, we’d be helping people organize information and moving it around. I mean, that’s essentially what we do. If, you know, if the information didn’t exist, why, you know, the technology would be useless. We live in an information society right now, and understanding how to get that information from A to B and securely as cheap as possible is a big deal. So, no, it’s interesting. And I guess I go back to this global piece, because if you’re used to just doing IT within one country, you get very familiar with that. um even it’s even starting to get tricky in the united states because even all the different states have their own uh um cyber security and privacy difference texas just passed the new privacy act um obviously california has been way ahead of the game with that with their privacy act that kind of rivals gdpr in some cases um and uh and so you you get to see all these disparate um you know changes and stuff happen And so that’s the real trick of the trick of the trade there with with what we what we do. Right. Is figuring out the best pathway to make sure that a company stays compliant, they stay secure and they get all this done. Well, within what you said, which was a fantastic way to put it within their budget for the budget that makes sense for their business. And you’re right. You’re not going to spend an exorbitant amount in. in cybersecurity, toward cybersecurity. Yeah. If, if your company isn’t making that type of money, right? Right. And then you should probably rethink your model and your clientele at that point too, you know? So.
Speaker 1 | 36:27.320
And, you know, and I think the SRTM is, you know, always underlooked or overlooked, right? Your security requirements, traceability matrix, you know, if you’re going in and you invest, the challenge you have where you’re geographically dispersed. then just collect all your known standards. I got a standard for a cyber that’s associated with how we handle finance data in India. I have another set of standards that are established in the business that we want to adopt because we know it checks the box. So that’s ISO 27001. Nine out of 10, all those controls that you need to achieve are mapped. to each other because they have an industry it’s matured we know right yep so you know nine to the ten you normally would you go assuming it doesn’t add too much cost you would go well listen they all tell me i need to manage and introduce mfa but but you know nist is the most you know paranoid so let’s do this because then we’ll subsequently track the box off for every other you know for other requirement and so you know it’s a good approach to have it you just need to know what’s in front of you And be able to understand, you know, your objectives are usually shared across your different frameworks. You just need to know what they are.
Speaker 0 | 37:34.422
Well, and interesting, too, the other thing I usually see is a misinterpretation of security because clients don’t have their data classified and don’t know where their data is. Right. You know, I’m just going to let you speak to it because I can tell by your expression you had something to say on top of that.
Speaker 1 | 37:56.364
Yeah, no, no. I mean, I think data loss prevention is huge for a lot of companies, right? But they don’t know what it is they want to protect. You know, we spent a lot of time in a more recent project that I delivered, introducing the concept of DLP. And, you know, and it was, here are all the tools we’re going to be able to electronically watermark. And we had several challenges as a global company that I think other companies don’t have, you know, but one that’s shared is that a lot of companies don’t know what they want to protect, you know, and they don’t realize, you know, even more. you know, confusing and more of a challenge is that our customers may have a requirement for you to protect certain data types. Well, they are not clearly identifying it. And I came historically from a DOD federal government environment where they are, they mastered this, like bureaucracy is what they do. And so you would get a, yeah, you would get a classification guideline. They will tell you, and when in doubt, you don’t know the answer, assume this and label it this way. And so it really, there was no question, but in a private sector, they’re not. dare you automotive even more so right so um and then that’s you know that’s just the customer data where they’re looking to really clear you know clarify what it is what about proprietary data that’s a that’s a hard thing for a company to determine what is proprietary and then uh then want to secure because a lot of the workflows they’ve developed over you know organically over years has relied on workflows that that are contrary to cyber security best practices you I want to be able to email a copy of this drawing to any one of these other engineers throughout the company. And it’s like, yeah, you know what? No, you know, that’s not going to happen if you want to be. You know, they’re usually contradictory goals and objectives. Right. You know, with cybersecurity usually comes a lot of breaking stuff and breaking workflows. And. You know, and it’s an even bigger challenge when you’re trying to meet cybersecurity on a schedule, because you normally, when you start applying those controls and pulling those levers to secure things, you want to go at it with a scalpel so you don’t break the business, right? But, you know, but at the same time, you want to go at it with a hatchet because they’re trying to clear under the gun. You got to get it done quickly. It’s like, all right, fine, I’ll turn on everything we know. We want to stop happening. But watch, you’re going to realize that there are people in your. your plants that need to videotape what they’re doing. And now we’re going to stop them from sending videotapes across the network. Or by the way, you have OneDrive, SharePoint, Draw, Manage. But guess what? Now I turned off Google Drive and Dropbox because that’s not supported by the business. And how many of your workflows now have been relying on that for 10 years, right? Or, you know, BYOD is big, right? How many companies have all these things they want to protect, but their employees are synchronizing? You know, all that email data, whichever, but you know, email is basically a file server. We all know it, right? It’s no longer just email. It’s a file server. And they’re storing all these emails and copies of the attachments in their personal iCloud account. You know what I mean? Baseball fans, 62 at, you know, whatever, iCloud.com. Now I have a full copy of everything that you’ve been developing over the last 10 years of the company, right?
Speaker 0 | 41:05.068
Yeah. And you have no control over it.
Speaker 1 | 41:06.669
And no control over it, right? So I think defining it. a big challenge. But I think also a global company, that IT cyber, we’ve been under attack in America, in North America for decades. We’ve been playing this game of cybersecurity. I can tell you the cybersecurity culture is not as well developed. And that’s not to suggest you don’t have highly skilled people in other countries. I’m just not going to get them at a tier one level work at a manufacturing company. They’re not coming to work for my company, right? So India, China, I have to now coach that and really train those people. how to think that way strategically and have that cybersecurity mindset, because that’s not something that, that, you know, you’re, you’re going to see as, I mean, it’s not ubiquitous here in the States, let alone in, you know, maybe Romania and let alone in a very where we would operate a plant, which is in a very rural area in Romania, where you also have sheep farmers and dogs sleeping in the middle of the road, you know, you’re not going to be able to have that same level of, of, you know, experience.
Speaker 0 | 42:05.698
you know so that that’s a big challenge in cyber security as well well no doubt and that’s a that’s a that’s a great uh um perception a great uh perspective from uh uh from that because uh anybody that hasn’t done any global i.t uh um they probably wouldn’t understand that they probably wouldn’t wouldn’t have taken a thought to that so it’s a it’s a it’s a really really good uh piece um i I wanted to take a moment here and go to our last segment, which is the IT crystal ball. And you had mentioned earlier, you talked about it a few times that you’re really kind of into it. When you talked about your IT… kind of escaping me here but uh you were talking about uh i.t and uh the diving into the oh yeah people the processes and uh and the uh technology and so in those in those those three pieces in that order right i find it interesting right because uh um we have such a right now just a com a changing dynamic of with so many different new emerging technologies happening over the past several years. Lots of shakeups happening, a lot of cybersecurity changes, privacy changes happening, all of these things all happening all at once. And we go back to you mentioned process, people, technology. And I wonder, and I want you to apply this to… to the IT crystal ball for the future. Is that a long-lasting, is that a feel like we can hang our hats on that methodology? Or do you see that methodology evolving in the future?
Speaker 1 | 44:20.907
Yeah, I mean, no, I think it will always be people, process, and technology. You’re not going to, no company operates the same. And so there may be a series of tools that are shared across multiple businesses. You know, everybody has Microsoft Office, X percentage of network switching equipment in the back end is going to be Cisco, right? But how you make it all work together and then, you know, also optimize for your particular workflows. You know, let’s go back to cybersecurity. We’ve been talking a lot about that, right? Yeah, I can go to any school or any, you know, cert mill and go, hey, give me a bunch of, you know, security plus people or people with CISPs, right? And, you know, go to people that have worked, you know, even in implementing governance and compliance frameworks, right? That’s one thing, right? But most companies, the biggest risks aren’t associated with things that they’re not necessarily checking off on a box for a compliance objective, even though they might be a very good practice. It’s understanding the workflows within your business to really go, oh, but wait a minute, you know, in this particular building in this country, everybody likes to write their password underneath their keyboard. That’s a unique risk to me, right? Or understanding of the workflow, oh, I need to spend this much more on switches because in our environment, we rely on video a lot more. So there’s a lot more East-West trapping. So we need to be able to have more bandwidth, right? That’s a functionality that only comes from somebody who’s been with the company with any amount of time will understand. And that’s traditionally not been the strength in IT in general, right? A lot of IT people, they go from company to company pretty quickly because they know that you can often get a better payday somewhere else. And so they’re not necessarily there with the company long enough to understand the workflows or always the unique risks. You need somebody who can come in real quick and then understand that. And Having that people part of it, right? At the end of the day, when you’re trying to make significant change, especially in a leadership role, consensus building is key, right? Because at the end of the day, no matter what technology you want to implement, I guarantee that AI solution that’s going to help you automate a bunch of people out of their job is going to cost money. You know, right? It’s true. Even to get that, you need somebody there that’s going to be able to help you justify that and build a bunch, get a bunch of people on the same page. and, you know, put a cap on it and what it means to be introduced.
Speaker 0 | 46:46.247
Manage the plugins, manage the integrations, oversee the entire thing, make it so it’s secure.
Speaker 1 | 46:51.950
Right. And so, yeah, I think that’s always going to be the case. I don’t think you’re ever going to come at it with, and I challenge you to find one company that’s through technology at a problem and fixed it. And that was it, right? No, it’s, if you don’t take it from that order, you might. muddle through and get it done at some point. I find sometimes implementing an IT solution will give you an idea into framework and how to set something up and go, oh, wait a minute, they used an ITIL framework for the way they built together their change release program. All right, all right, that’s a good idea. We should do that too. I didn’t think we could apply it in this format, right? But if you don’t have the right people to implement and sell the idea and build a culture, right? And one of my signature taglines, right? Culture eats strategy for breakfast. then it’s going to fail. It’s just not going to work, right? I think that’s Dr. Deming that said that with regards to culture. And then if you don’t have process to understand what you’re doing and what you’re automating, well, then, you know, I don’t care who you have working on it. They’re not going to be able to do anything because they don’t understand what the tools they’re looking to implement are supposed to drive and change. It’ll be the never-ending project with scope creep. And we’ve all worked on those, right? Where you get a project, you don’t really know what you’re doing. There’s no clear beginning or end to what you’re trying There’s, oh yeah, let’s do this. Like, you know, if you even have somebody that’s going to be the final authority to go, oh yeah, we won. We did this, right? We checked the box off, right? Not that there’s never going to be a need to go back and, you know, go back and tweak and do a lessons learned, right? And then even when you do implement, you get to the point where you’re implementing technology, right? If you don’t have people to help you manage it and manage the life cycle and go on with the approach that it’s a product, it’s a product with an expiration date. what’s fit for purpose today for the company may not be fit tomorrow right then then you know it’s going to fail at some point it just may not be today right so i think it’s all i don’t i would be hard pressed to look in a into a future where that’s not always going to be the case wow
Speaker 0 | 48:53.619
i that’s a i mean that’s a a great response to uh um you know to that uh um future uh it you know the future it uh because Here, what you see is essentially the basic principles are the same. The technology changes, some environmental factors change, but sticking with the basic principles still work. And that holds true as well to a lot of the work that Deming did, by the way, in quality management. So I agree with you in that mix. I mean, it’s evolved, but it’s still going pretty strong. So,
Speaker 1 | 49:34.692
well.
Speaker 0 | 49:36.214
Nerds, it’s Michael Moore, and I’ve been hosting this podcast for Dissecting Popular IT Nerds. George Horta, Vice President of Information Technologies for ACS Industries Incorporated. Thank you, George, for stopping by the program. I really appreciate it.
Speaker 1 | 49:51.778
Yeah. Thank you for being a great host. I appreciate it too.
Speaker 0 | 49:54.305
Have a good one.
Speaker 1 | 49:55.208
Yeah. You too. Take it easy.
