A Tale of Concentration Risk

Part One

The Banana Ecosystem

It took me three times to voice-type the title of this blog post.  I suffer from what they call Concentration Risk, in vendor management systems.

Love at First Bite

I’ve been training Siri since about 2010, when I traded my Droid (the original android smart phone) in for an iPhone.   You’d think she would recognize my words by now, but our relationship did not start out as shaky as it is these days.

Jailbreaking was still common in 2010, though we actively discouraged it.  Our first mobile security policy prohibited.  And it was impractical on iOS.

So I would tell my Android-leaning friends, when they wondered why I switched to Apple – “hey, the one thing I like about iPhones is, they actually work!”

“Voice-type” was not an oft-used term back then.  Neither was smart watch.  Neither was airdrop, airpods, MacAir, or airplay.   Though we liked the new iCloud, at least conceptually, we simply didn’t use phrases like “Apple Ecosystem.”

Back when people still had Blackberries. . . when we were just starting to “invent” vendor management systems . . . iPhones were the safest of the smart phones.  You didn’t even need AVS on your iPhone.  We installed an AVS anyway, just so we could check it off our compliance checklist, but that system rarely updated its data, if at all.

But in those days we would NEVER have thought that vendor management systems should focus on the makers of smart phones.  And we certainly didn’t see the concentration risk we would eventually all suffer from.

We were focused on newness.  The merger of technologies.  The fact that “non-geeks” were now knee-deep in accepting and adopting information technology.  The cybersecurity aspects of technology risk.

Fraudulent apps were rampant on the other platforms, but Apple’s quality controls required developers to register, and iOS would not execute unregistered apps.  Security seemed to be built-in, not bolted-on.

Sure, you needed to learn how Apple wanted you to do things, and they weren’t as customizable as Android, but they worked.   Apple had a reputation for being cool, but what I found cool about Apple was simple – they worked.

And by 2015, I was committed to building my “Apple ecosystem.”  I stopped using a Windows laptop.  I considered my Surface Pro to be more of a toy than my MacBook.  I was a loyal Apple User.

And I was not really concerned about . . . not even aware of . . . concentration risk.

I’m Not in Love (10cc)

In 2011, the first time my “warranty” was up and offered me a fake discount on my next apple phone, there was no deliberation.  I immediately signed up for the latest and greatest next version of the iPhone the 4s. I actually waited for its release.

I didn’t trade in my first iPhone.  Instead, I turned it into a “Todd Podd,” putting every last song of my Rundgren collection onto the device and then locking it down.  I still have that Todd Podd, though whenever I want to listen to Todd I just use YouTube now.  All my CDs are merely an exhibition.

In the following months, I expressed loyalty to Apple by buying hundreds of dollars’ worth of accessories, iMusic, Logic Pro and Apple Loops.  Not a super loyal, Apple-fanboy type of commitment.

Locked-in?  Maybe.  But fan-boy?

I’m a businessperson, and I know most other business people use Microsoft.  I recognize that most banking applications would never run on an Apple server.

Seriously.  I didn’t drink the Apple Kool-Aid.  Cool isn’t my thing. Really.

And hey – I remained Microsoft savvy.

Except on endpoints.

—-

Papa was a Rolling Stone

In the early 1970’s, music expressed the last amazing iteration of the style we’ve come to call rock ‘n’ roll that was not influenced by the musical instrument digital interface.

Song titles became an important part of our memory.

At that same time, my parents felt dependent upon a company they called “Ma Bell.”  AT&T was a monopoly telephone company that literally tethered people to a wall in their kitchen.

A music group named Electric Light Orchestra released a song that started with the sound of a telephone ringing.  Had somebody told us what was coming, we all would have believed that something like the internet would be a good thing.  We would have rejoiced had we learned we could choose from several providers for our telecommunication needs.

But most of us didn’t even know what the word, “telecommunication,” meant.

Nor did we understand that monopolies merely represent concentration risk.

—-

The Wedding Song (There Is Love)

By the beginning of 2024, I was dependent upon an Apple Watch, several iPhones including my active calling phone, two iPads, an iMac, and two MacBooks.  I’ve got Apple accessories out the wazoo, and I truly do enjoy the fact that I can transfer my work from one device to another so seamlessly.

Not the wearable, super loyal, Apple fanboy type accessories.  Okay, the watch is a wearable.  But it measures my sleep and gets within 15% of my step count.

But I don’t have a bunch of Apple logo clothes bags.   I “invested” in the productive accessories- extra power supplies, watch chargers, phone chargers.   Docks.  Apple Raid Backups.  AirPods.  Magnet chargers.  Smart Keyboard Folio.

Let’s put it this way – for those of you who think I might have been an apple fanboy. I threw away the original boxes!

Go Your Own Way (Rumours Version)

No wait —

—-

The Thrill is Gone (BB King Version)

Something happened to Apple.

Over time.

Like a frog in boiling water, we didn’t really notice it happening until, I’m surmising, around 2021.  I think that was when I started saying, usually in frustration because something wasn’t working, “Steve Jobs is dead.”

But quality stopped being the distinguishing factor.  Microsoft started aggressively hiring cybersecurity professionals in 2018, so security was no longer a distinguishing factor.

In fact, forced emergency upgrades, continuous compatibility struggles with Microsoft, and things just not working became as commonplace as they were when I left Microsoft.  And I had to wonder if Microsoft was improving their endpoint designs, all the time Apple was eroding.  Meanwhile, my friends were carrying really cool Google phones.

Did I say cool?

Recently, I’ve been interrupted from time to time by Siri, reminding me that she’s always listening.  That’s just not cool.  And she never interrupted me before.  What’s up with that?

The Apple ecosystem is no longer as amazing as it was in 2015.  Finally, after two outrageous incidents, I broke down and bought a Windows laptop.  By the pandemic I was more than used to addressing the persistent translation problems every time I went to give a talk at a conference.  You’d think that by 2020 compatibility wouldn’t be such an issue.  Then, two hours prior to giving a virtual talk during the pandemic, my laptop took an hour and forty minutes to update.   I almost missed presenting my virtual talk.

Then, in 2022 I failed to give as good of a talk as I wanted to give, because one minute before the talk started, the venue and I gave up trying to get my Apple to work with the venue’s equipment.  I started my talk about five minutes late because we were forced to move it to a windows laptop . . . that did not recognize the audio.

So I went out and got myself a Windows laptop.  For two years, I’ve referred to it as my Speaker’s Laptop, meaning I never really used it for anything except delivering my talks.  No use putting anything confidential on a laptop meant to deliver publicly classified information.

It’s hard to blame Apple for the compatibility problems. I know a lot of speakers with Apple laptops and we really should be respected more than we are by than you who just want windows.  But should isn’t is.

Like any big company, quality is relative, and goes up and down overtime.  But Apple has been presiding over an erosion in quality that is now noticeable.  And it’s trouble with smooth updates could be an indicator of hidden security issues.

And . . . what started this article . . . in 2024 Siri still, from time to time, can’t recognize a word like banana.

This ends part one of  “A Tale of Concentration Risk.”   Read part two to learn what we can do about concentration risk!

Original article by Dan Hadaway CRISC CISA CISM. Founder and Information Architect, infotex


Dan’s New Leaf – a fun blog to inspire thought in  IT Governance.

Audit & Assessment

Policies & Procedure Development

Endpoint Detection and Response

Managed SIEM

Consulting Services

Network Monitoring

Leave a Reply

Your email address will not be published. Required fields are marked *

Related Posts

The Magnificent Seven 2023

Seven Trends . . . …that small bank Information Security Officers face in 2023 Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . . Welcom...