TSG Training

Blog

  • Don’t Forget The Fundamentals of Security

    Ian Edwards MBCS, Head of Information Security & Risk at MEDICA Group reminds us about not losing sight of the fundamentals of security, amongst the backdrop of a technology-driven world.
    I was born in the mid-1980s a few years before the first worm and anti-virus tool was created. They were harmless and borne out of a research project by Bob Thomas and developed further by Ray Tomlinson, the inventor of email. I always find it exciting to look back and see how far technology and associated threats have come. I’ve been privileged to grow up and see the digitisation of the world around me.
    If we fast forward, security threats and actors have caused significant damage to industry, public services and commercial organisations. This has become more prominent and the peak of this is not yet visibly clear.

    Information security fundamentals: Part 1: Principles

    When thinking about information and cyber security fundamentals we are often drawn to our underlying principles. The confidentiality, integrity and availability of information or the CIA triad as it is often referred to. These principles are well established and should form the backbone of any security programme or framework.

    Security technology and culture

    I recently attended one of the larger security conferences in London and it touched a nerve for me. Although I’ve seen the vast maps of established vendors and start-ups, I’d not previously attended a conference with over 400 brands on show. Now, I am not aiming to vendor bash here. Each business provides one or more solutions and ultimately target specific risks. A large portion of these solutions tend to be pure technology and will be seen as shiny and attractive to IT and security professionals.
    Over the years, I believe the industry has developed a ‘sheep like’ culture that can be likened to our everyday lives. I entered my teens in the late 1990s and there was a strong culture of association with brands. If you weren’t wearing the latest Nike, Kappa or Adidas track suits, you were often looked down on. I’m very proud of my parents as they never succumbed to the pressure (and ludicrous prices).
    Fortunately, I was a grounded young person and mature enough to develop my own identity. I was the kid who would wear generic jeans and a t-shirt instead of a tracksuit and was comfortable wearing a less common ‘brand’. My parents’ approach to life has been an inspiration to me. They focused on getting the basics in life right. This predominantly consisted of managing the family finances to ensure we could live, enjoy our time together and enable my sister and I to grow up positively.
    This leads me onto the point I am trying to make here. Whether your business is young or established there is no specific ‘brand’ of security or technology that you should follow. However, and this is a big however; there are certain fundamentals that apply to all.

    Information security fundamentals: Part 2: What do we consider fundamentals to be?

    Earlier, I reminded you of the traditional CIA principles. If we look at our security programmes or frameworks, what do we really consider as the fundamentals? If I think of the word fundamentals, I’m led towards ‘basic’ or ‘essentials’. No matter the context, the fundamentals is about getting the basics or essentials right. In our personal lives this usually means:

    • Generating a steady income.
    • Providing for oneself or a family.
    • Protecting ourselves and our family.
    • Supporting those closest to us.

    If we consider this in the business context:

    • Generating revenue.
    • Providing a reliable service or product.
    • Protecting business assets.
    • Supporting staff and customers.

    The two themes are very similar. If we look at the security context:

    • Enable the business to generate revenue
    • Enable the business to provide a reliable service or product.
    • Enable the business to protect its most important assets.
    • Enable the business to support staff and customers.

    You can see this is all about enablement, advice and providing layers for the business context to be successful. Obviously this is highly simplified and there is of course much else to factor in. You’ll be expecting to see ‘Information security fundamentals: Part 3’ coming up. Instead, I’ve broken down some key examples that I consider as security fundamentals…

    The human factor (people)

    There is a revival in the industry at the moment. I’ve met a number of passionate individuals whose goals are to advocate the importance of the human factor. I personally believe this is one of (if not the most) important areas of information security. As people we are always targeted by threat actors at home, work or when out and about. Phishing, as an example, still remains one of the largest attacks against us, yet general awareness and understanding of this still remains a huge issue globally.
    Developing the human firewall is often one of the lowest cost security controls. It is more than just providing annual refresher training, though. Knowledge and understanding can only be acquired over time. If you are forcing your staff to take 60+ minute training in one go, stop. It’s ineffective and probably more damaging than doing nothing at all.
    As an industry, do we want people to relate security to boring, laborious training?
    No, we want the opposite. We want people who are engaged and empowered to deal with security threats. Look at regular bite-sized learning materials, videos and games. Make the content about the individual and not your business. Focus on threats at home and you’ll see people apply it in the workplace too.
    I’m not going to bang-on about building a ‘security culture’ as I believe this can generate more problems. We should aim to make security a part of existing company cultures and this requires a tailored approach because every business is different.

    System patches, bug fixes, updates

    The rate at which technology develops is often hard to follow at times. It has enabled organisations through digital transformation, but at a cost. As we strive for the latest technology, we often leave behind older systems and solutions. They may be in run-off or in the background running critical business processes.
    This has historically led to technical debt and the associated costs to maintain them. More importantly, these technologies are prone to receiving less security patches. We may also find the business enjoying their shiny new tech and forgetting what’s hiding in the closet. You only have to look back to 2017 for the impact caused by WannaCry and NotPetya to the NHS and Maersk respectively.
    The key takeaway here is that irrespective of the age of the system, security patches need to be applied within a reasonable timescale. The process should be foundational and embedded into day-to-day practice. I have first-hand experience of system patching and yes, it can get ugly. There are tools out there than can and will automate much of it. There are no excuses for not getting it right and IT resources need to be ring-fenced and made available.
     

    Policy

    Nobody enjoys reading policy but there is a reason why it forms the backbone of security standards such as ISO 27001. Ultimately, it is about setting out the approach to security and boundaries for individuals to follow.
    From a business perspective, policy is important as it’s one area to lean back on when building a defensible position. Questions to ask yourself; can your policies be enforced? Are they simple and straightforward? Do you use layman terms and appropriate language? Can you reasonably expect staff to understand and abide by them?
     

    Process

    Security should be embedded into business processes and not just a layer that is placed on top. This can only be achieved if security teams and officers embed themselves within the business. This can only be done if the time is taken to understand what the organisation does and how they do it. Naturally there are processes that are similar to all businesses. Starters and leavers is an obvious example here and highlights the interaction between security, HR, IT and managers across the business.
     

    Think twice before you sign the order for the latest vendor tech

    Make sure you have covered the fundamentals before you engage with new security tech vendors. In most cases, you will already have the tools you need to achieve this. Before you make a case to purchase that shiny solution boasting AI capability, make a case to ring-fence IT resource to patch critical systems regularly.
    Instead of buying a solution that protects you from 1% of known threats, focus on the human factor where larger percentages of security incidents and breaches are attributed to. There are other security fundamentals that I haven’t touched on. These will feature in popular frameworks or standards (NIST, ISO 27001, Cyber Essentials as examples).
    The technology driven world is exciting and continues to move at a phenomenal pace. We must remain grounded to ensure we don’t lose sight of the fundamentals.
     

    See More on Information Security Management Principles from TSG Training

    Download Security Versus Virtual Working Here

  • Improve Business Processes with Agile

    A well-known start-up in the UK, Moonpig is all about making someone’s day brilliant, writes Amanda Colpoys Lean, Agile & Growth Coach.
    An ecommerce business, it enables people to create personalised cards online which are then printed and sent to recipients. In addition, they offer a range of gifts and flowers.
    Moonpig was founded in 1999, before lean and agile methodology had become mainstream in the UK. It was not until about 2013 that Moonpig first began to adopt agile practices. As with most organisations, it began in product engineering. More unusually, having recognised the benefits of agile working, Moonpig’s leadership team were keen to see if the wider organisation could also benefit from this approach.

    ‘Let’s try this agile thing’

    While this post focuses primarily on organisational agility, it’s worth covering the early beginnings in technology as those successes paved the way for widespread adoption.
    Moonpig began its agile transformation by establishing a Product Management team and cross-functional teams of developers and QAs. Like many, we used the Scrum framework to start optimising the software development process and we increased the emphasis on quality, adopting software craftsmanship and XP practices. We also sought to build cross-functional skills within the teams, gradually phasing out the dedicated QA role and developing all engineers to design, write, test and deploy code.
    One key challenge we faced, was a monolithic legacy codebase. It was clear that agile management practices could deliver only some improvements in efficiency – to really deliver at pace, we needed to improve our technology. Over the next two years, we focused on re-architecting the codebase, moving from a monolith to a service orientated architecture. In parallel, we invested in continuous integration and deployment. As deployment frequency increased, we migrated from Scrum to Kanban and emphasis shifted from tracking velocity to optimising cycle time.
    That investment in technology is ongoing, but the combination of those early investments combined with improved working practices delivered considerable benefits. We reduced deployments from once every three weeks to 3-4 times per day and average cycle time dropped from 16 days to five days. Improvements in speed enabled us to adopt lean product development practices, testing and validating iterative changes. Collectively these efforts resulted in substantial business growth. As well as the financial benefits, product engineering teams demonstrated much healthier results in the annual staff survey:

    • 40% higher engagement
    • 46% higher enablement
    • 27% higher alignment

    Consequently lean and agile practices were seen to be delivering benefits in speed, ROI and engagement. Encouraged by these results, the leadership team asked me to explore the possibility of extending lean and agile working across the wider organisation.

    The context for change

    My first step was to understand the challenges faced within our business functions. Having been firmly rooted in product engineering since joining Moonpig, I had little knowledge about the wider business operation. I spent many months getting to know the teams, what they did, their processes and their challenges and frustrations. The feedback I received will, I imagine, be familiar to most:

    • ‘Everyone works in silos.’
    • ‘There’s no communication within teams.’
    • ‘We have too many objectives.’
    • ‘Lack of trust to let people do their jobs.’
    • ‘There’s no collaboration across teams.’
    • ‘We have conflicting objectives.’

    This coupled with my own observations lead me to identify some core problems:

    • Lack of alignment between teams
    • Lack of visibility, communication and collaboration
    • Lack of speed
    • Ineffective processes
    • Limited use of data and experimentation to optimise outcomes.

    However, I could see no reason why the working practices we’d used successfully in product engineering couldn’t be adapted to different contexts, and I started to formulate a plan to introduce change.

    What and how?

    What…
    It’s worth briefly outlining what exactly I hoped to achieve and what positive outcomes I anticipated.Essentially, I sought to create a system of work that would optimise performance across the whole organisation, allowing us to innovate and move fast at scale, whilst being a great place to work.The specific outcomes I hoped to achieve were improved business outcomes leading to higher ROI, reduced cycle time across all value streams and higher levels of employee engagement. Inspired byJonathan SmartI refer to these outcomes as ‘better, faster, happier’.
    How…
    To achieve these outcomes, I formulated a high level plan to:

    • Align relevant people around key outcomes, removing conflicting priorities and dependencies.
    • Leverage lean working practices€Š – €Švisualising work, reducing work in progress and focusing on finishing.
    • Embed a customer-focused, data-driven, experimental approach to minimise wasted investment.
    • Create a culture of autonomy where teams are empowered to deliver the best outcomes.

    Getting started – aligning the teams

    This was the most disruptive change. Like most businesses we had organised ourselves by function, but I’d observed that this prevented us from aligning and collaborating effectively. I proposed that instead of aligning ourselves by skill set – by what we did – that we organise our teams around what we wanted to achieve.
    To accomplish this, I worked with the leadership team to define a long lived set of metrics that represented growth for our business. This was very much about the ‘why’ rather than the ‘what’. An outcome like retention, for example, will always matter. What we do to influence retention will change relatively often, but the outcome itself is constant. I believed this mattered, as it would help us create long lived teams. There is an overhead to commissioning and decommissioning teams, so it was helpful to develop a structure with some long term stability.
    With a set of long lived metrics in place, we were then able to work out which people and skills we needed to achieve those outcomes and thus our new team structure emerged. Inevitably we didn’t get this 100% right the first time, so we did adapt it once we’d seen the new teams in action.
    Like many organisations we were influenced by Spotify’s approach; whilst we ended up with something quite different, it shared the same principles and we adopted their terminology. As we evolved our cross-functional model, we defined three tribes around core product and service, growth and foundations.Each tribe contained multiple squads with outcomes which supported the higher level tribe objectives.

    Squad principles

    As ‘squads’ have become well known, people have developed preconceptions about what a squad is. I’ll clarify the definition of a Moonpig squad and the underlying principles. A Moonpig squad is:

    • Organised around an outcome and a value stream – it has a clear purpose.
    • Resourced to achieve that outcome – it is independent.
    • Empowered to decide how best to achieve an outcome – it is autonomous.

    Our squads are not, as is commonly assumed, ‘an engineering thing’. If a squad’s outcome doesn’t rely on technology, there won’t be any product engineering in the squad. Conversely, a mission which is product or tech led may not need support from any business function. The mission and outcome determine the composition of the squad.

    Functions in a cross functional world

    It’s worth noting that functions are not obsolete in a cross-functional world, indeed they have a critical role. Functions provide the guidelines and principles within which members of a function can operate autonomously across multiple squads. The engineering function, for example, will be responsible for defining preferred technology and coding standards. A creative or brand function will define clear brand guidelines. Functions provide the boundaries which enable autonomous working in cross-functional teams without compromising quality or consistency.

    Getting better, faster and happier

    Once our cross-functional squads were in place, we were able to start leveraging lean and agile working practices to optimise performance. These will be very familiar to anyone working in the agile space.

    Getting faster…

    Aligning teams delivered instant improvements in cycle time, but there was still much room to improve.Rather than adopt specific frameworks, I used the concept of ‘minimum viable agility’. I encouraged each team to visualise their workflow, hold a daily stand-up and a retrospective every two weeks. With these core practices in place, we were then free to support each team to tailor and optimise their own processes.
    Over and above this, we put in place ways to measure cycle time and bottlenecks across all workflows, so we were able to provide squads with real data to help them optimise speed of delivery.

    Getting better…

    Alongside improved delivery capability we wanted to encourage a more data-driven, experimental approach. Experimenting increased in all areas, helping to optimise everything from marketing content to product range. It is still early days and there is plenty of scope to increase the tempo, but the widespread adoption is encouraging.
    Cross-functional working supported the growth in experimentation as skills and experience in this area cross-pollinated within squads.

    Getting happier…

    You’ll recall at the beginning of this post I described how product engineering teams had shown much higher levels of engagement, enablement and alignment. By extending the same way of working to all of our teams we hoped to see scores in these areas increase across the board.

    Outcomes

    Before I discuss outcomes, it’s worth putting them in context. The changes I’ve described took place over 6-8 months, so we are still at the Minimum Viable Product (MVP) stage! However, as with an MVP, we are looking for early validation of the approach, and the signs thus far give us reason to be confident.
    Getting faster…We saw more dramatic gains in speed, particularly in delivery of our marketing content where we saw cycletimes reduced from months to days.
    Getting better…Whilst I can’t reveal actual numbers, the squads delivered very healthy growth during the first six months. A less scientific, but no less revealing, indicator was that the leadership team were extremely pleased with the squads’ results!
    Getting happier…Happiness was difficult to measure as we had no baseline. However, I was able to extrapolate some results by comparing annual staff surveys from before and after the change. These saw marked improvements in areas such as alignment & involvement (+13%) and enablement (+21%).
    While this is the beginning of a journey and there is still much room to improve, the early signs have given me confidence in the approach. It has also convinced me personally of the potential of business agility. As long as agile remains a ‘tech thing’ we consign ourselves to optimising a single corner of an organisation. Lean and agile comprise a set of principles which are ultimately agnostic of technology€Š-€Ševery part of the organisation can benefit.
    Before you make any transition of model, you should be prepared to have the following in place to help specify what is wanted from change, monitoring and progress and measuring results.
    See more from TSG Training on Agile, DevOps, Service Management and all life cycle courses:

    • Classroom & Virtual here.
    • Online, Self-Study here.

    Download Security Versus Virtual Working Here

  • Why Collaboration Makes Cybersecurity Stronger

    While the last few years have been defined by nation states untangling long-standing international collaborations on cybersecurity, 2021 will see security vendors and professionals step up and collaborate to fill the void, writes Neil Thacker, CISO EMEA at Netskope.
    Cybersecurity professionals have agreat record of collaboration. Cybercrime pays no regard to international borders and so fighting it is a process that has always relied upon countries collaborating and sharing data. It is for this reason, perhaps, that many in this sector have felt a degree of trepidation this year, as geopolitical manoeuvres have cast uncertainty around some of our established mechanisms for collaboration.
    Clarification of the frameworks and regulationsthat will replace some of the tried, tested but outgoing agreements have been drip-fed through to IT and security leaders; however, many of us are still feeling confused about both obligations and opportunities for cyber defence tactics.
    Brexit has been one of the more pressing concerns for organisations, but obligations are being clarified. For example, in May 2020, the European Commission issued a statement clarifying which areas of the NIS Directive will, and will not, continue to apply to UK businesses after Brexit. Nevertheless, collaboration around cyber and data defence isn’t just about obligations.
    Figure 1 – Collaborative Teamworking for Security

    A collaborative past

    Historically, the UK has been the second biggest contributor toEuropol Information Systems. This is undoubtedly one of the reasons why Michel Barnier, the European Commission’s top Brexit negotiator, told attendees at Web Summit 2019 that the EU and the UK must join forces after Brexit to fight cyber-threats:
    ‘Our new partnership should include the exchange of information on cyber incidents, attackers’ techniques, threat analysis and best practice, including when those target the correct functioning of democratic systems. Crucially, we need to have capacity to respond jointly to such attacks.’
    So, while (after 20 years of involvement) the UK no longer has a place on the team that manages Europol, we know there’s both appetite for collaboration to continue and a natural inclination among cybersecurity professionals to work together. The opportunities for collaboration have not gone away.

    A collaborative enemy

    The bad news, however, is that collaboration is also something that threat actors do very effectively. In recent years, we have seen no abatement to the increasing levels of organisation and collaboration among malicious actors. They are a sophisticated adversary. We know that when government agencies manage to flip cyber criminals and get them to provide intelligence on the networks in which they operate, we find a tangled, well-funded and profitable web of recruiters, programmers, hosting providers and distributors.

    Why collaboration is so powerful in cybersecurity

    Collaboration comes in many forms. The exchange of information through Interpol is just one, very top-level example, but not necessarily one that we cybersecurity professionals will be involved with day to day. But, our forms of collaboration are no less effective.

    Figure 2 – The Power Of Collaborative Connection
    We can work with our colleagues from non-tech departments more effectively; we can form better connections with our peers from other organisations; and we can insist upon our technology partners working in a much less siloed manner. All of these efforts will see significant reward.
    Let’s start with the last of those three: in the past, security vendors worked in pursuit of a vision of their brand being the sole or primary provider of a customer organisation’s security estate. If other vendors had to be involved, there was a clear hierarchy and these ‘competitors’ were kept at arms’ length by the bigger vendor who wanted to own the ear of the CISO.
    Thebenefits of collaborationbetween vendors are, however, undisputable and fortunately now being understood.
    Yonatan Striem-Amit, Chief Technology Officer and Cofounder of Cybereason, says that ‘Intelligence gathering and information sharing is vitally important to detecting, preventing and mitigating risks and hardening our cyber resiliency.’
    Collaboration reduces the time between new threat discovery and protection implementation, allowing organisations to keep up with the ever-evolving threat landscape. Interpol is working hard to identify and stop the malicious actors, but in the meantime, those of us who are tasked with protecting our organisation from these threats still need information on the latest threats to avoid falling foul of them.
    Speeding the delivery and dissemination of threat intelligence is crucial for building a strong cybersecurity programme and vendors need to make it as easy as possible to break down the silo walls between security disciplines and automate the exchange of threat indicators.
    Let’s put this into context. According toNetskope’s August 2020 Cloud and Threat Report, cybercriminals are continuing to use the cloud as an attack vector in new ways, and this has only been exacerbated by the surge in remote working caused by the COVID-19 pandemic. Between January 1 and June 30 2020, cloud malware delivery and cloud phishing were the two most common types of cloud threats and 63% of malware was delivered over cloud applications.
    Mitigating these types of attacks requires multiple defences with unique capabilities and focus points, all sharing timely threat intelligence. A threat actor may combine multiple types of attacks including phishing, malware and data theft. An organisation improves their capabilities to stop such an attack by sharing details of the threats across all of their protections.

    Barriers to collaboration

    Driven by the traditional approach of security vendors, historically, there have been multiple barriers to sharing threat intelligence, which made it difficult to implement at scale. For example, vendors might use APIs or data formats that require proprietary tools or plug-ins to commercial products for translation.
    In addition, the tools were typically built in a hub and spoke manner, making it possible for a single vendor (the hub) to benefit from multiple sources of threat intelligence (spokes), but lacking the ability to set up any other type of threat sharing arrangement.

    Collaboration in action

    In the autumn of 2020, Netskope announced theCloud Threat Exchange (CTE), a free tool that can be used by any member vendor and their customers to exchange threat intelligence. At launch there was already a strong list of certified members, including Netskope, VMware Carbon Black, CrowdStrike, Cybereason and SentinelOne. This ecosystem was designed to help organisations maximise the benefit of their protections by leveraging threat intelligence across multiple enforcement points.
    The goal of collaboration between vendors in this way is to rise above competitive attempts to work in isolation and combine knowledge of indicators of compromise (IOCs) to enable customer organisations to improve their overall threat prevention posture. It is a noble goal.
    In practice, the approach sees the ingestion, curation and real-time sharing of threat intelligence across enterprise security enforcement points. It automates the delivery and distribution of high-value, actionable threat intelligence, thus reducing the time to protection and eliminating gaps in coverage. Threat indicators that are shared include file hashes, malicious URLs, and DLP file signatures.
    Crucially, this model is not hub and spoke – communication can flow directly between vendors and customer organisations and does not require intermediation by any one central ‘master’ vendor. All vendors that have signed up to the CTE will be able to notify each other’s systems of any attack that their technology identifies.
    A web gateway can identify a threat, share the information to the CTE central repository and the other solutions within the security architecture will be able to draw down that information. This is designed to vastly improve joint customers’ speed of response to threats and avoid intelligence sitting in silos.

    CISO collaboration

    Vendor-driven collaboration isn’t the only positive sign of a new appetite for working together among the cybersecurity profession. The unique challenges facing CISOs amid the COVID-19 pandemic in 2020 have been a driver for stronger peer support among user organisations too.
    Perhaps ironically, given face-to-face networking was not an option, there have been reports of a growing openness to knowledge and idea sharing in CISO forums such as (ISC)2, ISACA, ENISA and ISF.
    These networks enable security leaders to share best practice and discuss their challenges in a safe space, because two heads are always better than one for problem solving. These sorts of peer networks can, in time, also become powerful influences in driving security vendors to further collaboration for the benefit of customers.

    Conclusion

    Over the last few years, we have seen a lot of changes which have the potential to make our jobs as cybersecurity professionals more difficult to carry out day to day. And these challenges have emerged while we have seen the malicious actors – against whom we do daily battle – benefit from greater funding and closer operational collaboration. But there are clear signs that we are learning good lessons, both from our previous successes and those of our enemies. Security professionals are successful when we collaborate and I am confident that none of the challenges we have seen in 2020 and beyond will thwart us in our natural inclination to work together.

    See more on Security Training from TSG Training

    Download PDF Version of the Whitepaper Here

  • Understanding AI and Human Interaction

    Jyoti Choudrie FBCS, Professor of Information Systems at the University of Hertfordshire, talks to Johanna Hamilton AMBCS about COVID-19, sanity checking with seniors, robotics and how AI is shaping our world.

    As an information systems specialist, Professor Choudrie FBCS is well versed in how information sources work together. However, it was a recent project that made her explore the possibilities and limitations of AI.
    Professor Choudrie begins: ‘If you ask anyone what artificial intelligence is, people will talk about the fact that it’s a combination of different technologies. You’ve got your neural networks in there, you’ve got machine learning in there, you’ve got deep learning in there, so in a way it’s a bit like an information system – a combination of people, technology and processes.’

    AI preserving and protecting the population

    In her most recent study, Professor Choudrie recently joined forces with Ketan Kotecha and Rahee Walambe, colleagues at the Symbiosis International University, India, to explore how AI could help in thefight against COVID-19 misinformation.
    Choudrie continues: ‘My colleagues in India said, “You are a social scientist. We are the technical people. Why don’t we see if we can merge things together?” At the time, the COVID-19 pandemic was striking and so, we started to talk about the true and false information that was coming out.’
    It’s no exaggeration to state that bad information in times as dangerous as the COVID pandemic can cost lives. Knowing whom you can trust is very hard. The internet is alive with people producing ideas, opinions and facts. But, which facts are truly science based? This, Choudrie says, spurred the World Health Organization (WHO) into action. It urged countries to take stronger action tostop the spread of harmful information.
    ‘The WHO started to talk about the infodemic and how it was not just the virus, but the misinformation that was going to start hurting people,’ she says. ‘So, my friends in Symbiosis and I started to share updates and links. People will not always be able to identify what is true or false and they could be going down the false path more easily than the true one. So, I sent them news links fromThe Guardian, or BBC and they told me “Yes, we’ve looked intoThe New York Times” and such newspapers too, they also looked intoChina Daily.’

    The problem with AI

    Misinformation and COVID-19 prevention and cure is still an emerging and new area of research, so the three scientists took 143 different posts from across the globe and started to train the computers to identify what was true and what was false. Out of the sample, the team identified 81 false posts, or those touting misinformation. However, in training the computer, there were always going to be some false positives.
    ‘What we have realised, is that artificial intelligence also cannot recognise what is true or false very easily. I have seen examples ofchihuahuas and muffins. When you look really close up, it can get confusing. Even humans cannot tell if it is a muffin or a chihuahua for sure. So, if a human brain finds it confusing, then what about the computer we’re training?’

    Questions about AI’s wider place

    AI is associated with a bias. To ensure minimal to no bias was associated with the AI results, Choudrie explored the decision making of humans versus the technology in its very widest sense. How will it fit into society? Whom will it benefit?
    The question of who decides the route AI or machine learning will take, is still in its infancy, she says. By way of illustration, Choudrie points to theEU’s Shaping Europe’s Digital Future policy paperon artificial intelligence. It begins:
    ‘The European Commission puts forward a European approach to Artificial Intelligence and Robotics. It deals with technological, ethical, legal and socio-economic aspects to boost EU’s research and industrial capacity and to put AI at the service of European citizens and economy.’
    The critical notion, Professor Choudrie says, is to put AI ‘at the service’ of its people – but people, by nature, are all very different. This led Choudrie and her team to think closely about who will benefit most from AI. Will it be young, well-off people – early tech adopters?
    ‘We decided to interview older adults,’ she explains. ‘Why older adults? Older adults are people who are very cautious. They are not easily influenced by online social networks. They are living in the real world. They do come across newspapers, hard copy newspapers and online newspapers. But, they’re not easily influenced. So, when I interviewed them, I discovered that actually, awareness is a very important issue for artificial intelligence.
    ‘A computer being trained by us, can be influenced by what we are consciously aware of and not. So, if we are aware of a story, we’ll say “this is true” and yet it may be false. I will give you an example: there was a news link fromChina Dailyand it was a true story. But when I showed it to the older adults, all of them told me it was false. Why? Because of where it was from. The older people didn’t believe it could be true.’

    Will older people accept the pace of change?

    While older people were used to validate ‘true’ or ‘false’ throughout the experiments, it did lead to questions, not just about misinformation, but about how accepting seniors are of the technology itself. Many people accept the tablet, online shopping and even WhatsApp calling relatives on different continents. But are they ready to accept the pace of change?
    Exploring the point, she says: ‘Society is very scared of AI and robotics. But what we have discovered is, just as when computers first came and we were very scared of them, but now we work with them every day, I believe the same will happen with AI.’

    AI – making the laws fit the situation.

    Along with exploring and studying how accepting people might be of AI, Professor Choudrie also sees the law as another potential hurdle for AI to navigate. ‘How the legalities work, could affect innovation. Likein Germany autonomous cars should still have a driver, but if there is an accident, the blame will lie not only with the “driver” but with the car manufacturer – if it’s a product fault. So, there are new challenges and changes taking place in law.’
    The use of tech also needs to be considered carefully to take into account, not only legalities, but how ethical it is, which will vary from state to state.
    ‘For instance, in Sharia law, the lawmakers need to assess where AI falls within five categories of obligatory, encouraged, unrestricted, discouraged, and forbidden. Some believe only God should have the power to create, others that AI is good because it provokes debate.
    ‘I know Dubai has been working a lot on drones and has an emerging robotics sector that’s really taking off, but I think they will have to look at all these new technologies in combination with their culture and religion. So, for instance there are very strict laws governing where the drones can fly.’

    What does the future hold?

    While we do give a lot of emphasis to fears that the data will be sexist or racist, that it will not take into account geography or might bring out our inner snob, there are a lot of amazing innovations that we might miss if we focus too much on the negatives, Professor Choudrie believes.
    ‘There are going to be evolutions of it across the world and it’s going to lead to so many other outcomes that I don’t think even we’ve envisaged,’ she says. ‘Like with the online digital platforms, now we have Uber, Deliveroo etc., I don’t think we ever envisaged that we would have these sorts of platforms. As we evolve the artificial intelligence arena, we are going to find new ways of using it. But humans and machines will have to work together.’

    Will AI ever be truly inclusive?

    Will data ever be truly representative of gender, ethnicity, religion – the list is as vast as the billions of people on the planet. Can the dataset ever truly serve society? Will datasets be deliberately homogenised for societies with less diversity? How will that influence the outcomes?
    ‘AI is going to have to include everyone. That’s the only way we can all have access, and the bias will go down. There are certain people who will put their prejudices and biases into the data. We have only to look at the A-level situation here in the summer. Disadvantaged communities may not have had such good results because the data was being supplied by people with those prejudices.
    ‘Our biases still remain with us, unconsciously or consciously. That is not something to be fearful of but something we can use, understand and apply to get data out with the different perspectives.
    ‘As the years go by, we are becoming more diverse. We are no longer in this continent and have only these people. All our policies need to be informed of all these different types of people and situations, otherwise it will be only certain groups of people who are driving the data and how the gaps will occur.’

    Will we accept robots?

    In an interesting social experiment, the Japanese have been tackling the social demands of an ageing population for decades. As the workforce shrinks and the number of people actually able to work in care homes decreases, the Japanese have started to introduce robots tocare for, stimulate and exercise the elderly. Will it succeed here in the UK?
    ‘It’s already happening,’ Professor Choudrie is matter of fact. ‘At the moment, Bedfordshire and if I’m not wrong, Middlesex, have got robots in care homes. They’re testing them out to see whether older adults will accept them.
    ‘If they were completely like robots and very cold, people probably wouldn’t accept them. But apparently, they are very nice; they speak well and are soft to the touch, so people are accepting them much more.’
    This idea of machines working with humans, doing the jobs we don’t want to do has been the stuff of science fiction for many years. And although we haven’t got to the stage of every house having a robot housekeeper, we are certainly in the realm of having machines to autonomously vacuum the carpets and cut the grass. Little by little, science fiction has become science fact. Machines are now used in mainstream retail to recommend books on Amazon or suggest what we might like to watch next on Netflix. But what about innovations that feel more ‘dangerous’ to society, such as driverless cars?
    ‘There is also the challenge of getting people to accept it, for instance in Singapore they’ve got driverless buses. How are they getting people to accept it? They’re still trying it out in Nanyang and other universities, but older adults actually do like them, because they go very slowly.’

    Can training Help?

    Although in its infancy, AI is a huge subject that already benefits from a major programme of education defined by the BCS. Ig depends, though, how much knowledge you want and how deeply you want to delve and specialise in the many differ aspects of AI. See more on the BCS Programme and the support provided by TSG Training.

    Download Understanding AI and Human Interaction Whitepaper Here

  • Cybersecurity Needs to Be Led From The Top

    Benjamin Donnachie, Senior Vice President in the Digital Practice at AlixPartners LLP, explains why the cybersecurity agenda needs to be led from the boardroom.
    In our experience executive teams often perceive cybersecurity as a singularly technical rather than broadly commercial matter and therefore leave it to their IT teams to manage. What then follows is a classic bottom-up approach with an emphasis on compliance and ‘box-ticking’ in which the technology function is left to assess performance against their own strategy, effectively marking their own homework.
    While many cyberattacks may subsequently be prevented, and their impacts significantly reduced, organisations all too often have scarce resources that need to be selectively, and strategically, allocated. Quantifying and ranking cyber-risk in terms of the potential financial, reputational, and compliance-related impacts in case of a data confidentiality, availability, or integrity issue empowers a business’s leadership to understand the problem and address it like any other business risk. In short, it must be incorporated into the organisation’s existing enterprise-wide risk management framework.
    It is also essential to carefully map business processes, business assets, and technical assets, making sure to classify them by potential risk level and determining their level of criticality. This is the key connection between cybersecurity and business continuity and allows any investment in cybersecurity to be linked directly to the business’s value and the importance of its information.
    As senior management’s appreciation of the cyber agenda develops, they will need to examine the company’s wider risk appetite and identify any trade-offs. Any business processes or assets that demonstrate risk levels above the organisation’s thresholds require defined mitigation activities involving an appropriate mix of people, processes, and technology.
    Ultimately, it is up to the CEO and the board to define the strategic allocation of ‘capital at risk’ to mitigate cyber risks. The company can then design a detailed plan and investment – including capital expenditure and operating expenses – in which each cybersecurity investment is prioritised and, crucially, justified by the reduction in business risk thus defining cybersecurity return on investment.
    Rather than keeping cybersecurity at arm’s length, the c-suite needs to recognise it as a top-down issue that must be managed by a team of key people:

    • CEO Clearly outline the policies, processes, and the roles and responsibilities of key stakeholders.
    • CRO Provide the risk management perspective as well as appropriate metrics and risk analysis.
    • CFO Assist with regulatory requirements and analysis of the economic capital implications and allocations.
    • COO Embed the approach into IT operations and HR culture of the company.

    Along with Benjamin, we recommend that chief executives establish a quarterly security advisory board that enables executives, risk and IT managers to discuss fundamental security issues, challenge existing protocols, and, crucially, include their business judgements. The agenda should focus on risk, continuous improvement, and the enterprise’s overall operating model.
    Framing the discussion in terms of commercial and operational risk reduction makes cybersecurity significantly more accessible and understandable to a business’s leadership team. It allows investments to be focussed on areas of high risk and the return on those investments to be more easily understood, avoiding the perception that cybersecurity is a burdensome additional cost to the business.
    In summary, to build the most effective cybersecurity programme possible, it needs to be grounded in the human component of the business and that begins with the boardroom.

    Download the Cybersecurity Needs to Be Led From The Top Whitepaper Here

  • 6 Skills To Become A Software Engineer

    A bit like a magician who turns a dream into a reality, software engineers have the ability to transform simple thoughts into tangible products.
    Responsible for building, developing, launching and maintaining systems, applications and platforms; software engineers are skilled enough to make the impossible, possible – a trait that is hugely attractive. According toa report from Glassdoor, nearly a fifth (19%) of all Generation Z (those born after 1997) job applications are for software engineer roles.
    Given that we live in the modern world where our lives evolve around technology and smart devices, this influx of candidates will be welcomed with open arms in an industry that has been plagued in recent years by vast skills shortages.
    If you are looking to further your career in the world of software engineering, you need to first master these key skills to make your application stand out:

    1. Formal qualifications

    Building a career as a software engineer has a minimum entry-level education, which typically involves a bachelor’s degree. The most common of these are awarded in computer software engineering or within the fields of computer science or mathematics.
    Once you enter the world of software engineering, there are several career paths open to you, themost popular career pathsbeing:

    • Blockchain engineer
    • Security engineer
    • Embedded engineer
    • Data engineer
    • Back end engineer

    After deciding what area of software engineering you want to carve your career in, you should look for formal certifications in order to demonstrate you have attained a certain level of competence and make yourself a more desirable candidate.
    Why choose to certify with BCS? Simple, they offer over 70 certifications in 12 core subject areas, including:

    • Software testing: learn how to adapt and contribute to fast-changing environments within an agile business.
    • Solution development and architecture: support your career progression with an international benchmark of skills and experience.
    • User experience: acquire suitable knowledge of the core concepts, common tools, techniques and methods.

    BCS certification offers formats to suit your preferred learning style, including self-study and classroom training.
    Discover more about the portfolio of qualifications from the BCS,many of which are provided by TSG Training as an accredited provider of the BCS.

    2. Coding skills

    You can’t really be a software engineer without knowing how to programme – it’s a prerequisite of the job. With so many programming languages in existence, you might feel worried about whether you’ll ever be able to learn them all.
    Don’t.
    While it is essential that you familiarise yourself with different programming languages and operating systems, you should choose one to master and a further 2-3 to be fluent in. In asurvey from HackerRank, the most common programming language is JavaScript, cited by 73% of developers. While the 4 most popular languages they wish to learn are Go, Kotlin, Python and TypeScript.
    The other important consideration is knowing how to code for mobile. In the digital world, smartphones and devices seem to have become an extension of our bodies – we run our lives on those little shiny black boxes. Sharpening those mobile skills ensures you’re futureproofing your career options now, rather than being forced to play catch up later.

    1. Testing skills

    Thebiggest bug in productionis deploying untested or broken code or systems that do not met requirements or underpin the business in the manner intended. Therefore, one of the greatest skills you can possess is the ability to test and debug your own code. There are currently10 methods of product testingand simply mastering 3 of them will have a huge impact on your reputation and employability.However, testing code is but one small part of a software testing engineers job. The absolute best value of testing is not from bug detection, but from bug prevention. As a software testing engineer, a costly mistake you could make is not testing acceptance criteria, requirement and specifications, before things are signed off and built. After all, why build things that are wrong when with a little effort you could prove that development is on the right footing and track to deliver in line with business need?
    Testing your software often requires you to think logically, because the smallest of errors can lead to the biggest problems. By structuring your thinking, you can follow the process through, step-by-step to unpick what you have done in order to find the problem.
    If you are aiming to be the best software engineer, you need an edge – and that edge is curiosity. Curiosity is what creates new innovations and enables people to continuously improve. By questioning, experimenting and testing your ideas, you are more likely to hit upon something truly spectacular. A real good place to imbue these skills is through the industry acknowledged software testing engineer development programme from TSG Training.

    4. Communication skills

    Forget the stereotypical image of a geek hammering away on a keyboard, quietly in the corner. As a software engineer, your job is far more than just writing code. To achieve the best results, you need to work well as part of the team – and that means clearly communicating with your colleagues.
    Being able to clearly express your ideas means that others may be able to spot how to improve them for a better end result. And if you’re up against a challenging bug, asking your team for help will enable you to problem solve in new and interesting ways.
    Once the project’s finished, it’s all about that user documentation. Yes, it sometimes feels like a chore, but it needs to be done. Theno.1 pet peevefor many organisations is badly written documentation. Master the skill of the written word and you’ll stand head and shoulders above your peers, as well as helping to create a better end user experience.

    5. Organisational skills

    Planning is an essential skill for a software engineer. The ability to understand the requirements and project scope to then prioritise the key tasks, set deadlines and maintain high levels of performance are necessary if you’re to release a quality product on time.
    Furthermore, attention to detail is important, particularly when it comes to fixing issues since you’ll have to wade through reams of code to identify the tiniest of glitches. And then patience when dealing with your customer – either internal or external – when they want to make a change, there’s a new ‘priority’ and ‘ghost’ bugs appear.
    Having the ability to organise your workload and manage expectations so that people know when you’re available and when you’ll be focusing on deep work, is the key to avoid feelings of frustration and complete overwhelm when tackling the task at hand.

    6. Continuous professional development

    The technology landscape moves fast – for example, in recent months, there’s been huge developments in encryption and cryptography, blockchain and artificial intelligence. A good software engineer will keep abreast of the technological changes, seeking opportunities to learn more and continuously develop their skillset.
    Just like a web designer would critique different websites and an English scholar would read endless literature, anyone studying software engineering should study good source code to identify the techniques for improving their own skillset.
    In addition, seeking out opportunities to learn from your peers, through research reports, industry events, local meetups and articles are perfect ways to hone your craft.
    As a BCS member, you gain access to a CPD tool to track and monitor your career development so you’re always aware of the next step and what you need to achieve it. And, through SFIAplus, you can see the available courses that will help you secure those new skills.
    SFIA is the industry leading ‘Skills Framework for the Information Age’. All BCS courses align to the framework, which means your new qualification will be recognised across 200 countries worldwide. Because BCS holds a unique position in the tech community, able to offer critical insight and impartial guidance, they have developed the framework into SFIAplus. The ‘plus’ meaning that each skill level is supplemented with 6 additional task definitions and 8 additional skills resources (all of which are supported by TSG Training)
    Discover more about SFIAplus from the BCS.

    Download the 6 skills to become a software engineer here

  • The 10 Most Important Skills Of A Business Analyst

    The 10 Most Important Skills Of A Business Analyst

    A Business Analyst plays a vital role in helping organisations improve performance, enhance efficiency, and achieve strategic goals. Whether you are new to the field or seeking to advance your career, developing the key skills of a Business Analyst is essential.

    At its core, business analysis involves understanding complex business processes, identifying challenges, and designing solutions that deliver measurable value. To succeed, a Business Analyst must master a broad combination of technical, analytical, and interpersonal skills.

    In this guide, we explore the ten most important skills of a Business Analyst, along with insights on how to strengthen them through TSG Training’s Business Analysis courses.

    1. Technology Skills

    A Business Analyst must be confident working with technology. They use various software tools for data collection, process modelling, and workflow automation.

    From enterprise systems to emerging technologies such as artificial intelligence and automation, Business Analysts need to stay current with developments that can improve business performance.

    Gaining technical skills through structured learning, such as the BCS Foundation Certificate in Business Analysis, can help you understand how technology underpins modern business operations.

    2. Research Skills

    Strong research skills are fundamental to effective business analysis. Business Analysts gather data, assess industry trends, and evaluate internal processes to identify areas for improvement.

    Research provides the foundation for sound recommendations and helps communicate findings clearly to stakeholders. You can build these skills through TSG Training’s Business Analysis Foundation course, which focuses on investigative and analytical techniques.

    3. Data and Statistics Skills

    Data-driven decision making is at the heart of business analysis. Analysts must be able to collect, interpret, and present data in meaningful ways.

    Key competencies include data modelling, risk analysis, forecasting, and financial reporting. Understanding statistics helps Business Analysts make informed recommendations that are backed by evidence.

    Learning data management techniques through the BCS Data Management Essentials course can significantly enhance your ability to interpret business data accurately.

    4. Financial Skills

    Financial literacy is another critical skill of a Business Analyst. Analysts must understand how projects impact budgets, profit margins, and overall business performance.

    They are often involved in cost-benefit analysis, investment evaluation, and return on investment forecasting. Having strong financial skills ensures that proposed solutions are both practical and economically viable.

    5. Organisation Skills

    Organisation and documentation are key components of effective business analysis. Analysts manage multiple projects, stakeholders, and deliverables simultaneously.

    Clear documentation allows others to follow the analysis process, review decisions, and implement recommendations efficiently. Organised analysts ensure smoother collaboration and reduce miscommunication across departments.

    6. Problem Solving Skills

    Business Analysts are professional problem solvers. They identify issues, explore root causes, and design effective solutions.

    This requires creativity, analytical thinking, and the ability to adapt when priorities change. Strong problem solving skills often distinguish excellent analysts from good ones.

    Developing these skills through practical exercises in TSG Training’s Business Analysis Practice course helps you apply critical thinking to real business challenges.

    7. Decision Making Skills

    Business Analysts regularly make decisions that influence strategy, processes, and people. They assess data, evaluate alternatives, and choose the most effective solution.

    Good decision making relies on both analytical reasoning and intuition developed through experience. Analysts must balance stakeholder expectations with organisational goals to ensure their decisions are sustainable and effective.

    8. Management Skills

    Management and leadership abilities are essential for Business Analysts involved in large projects. They coordinate teams, manage stakeholders, and ensure timely project delivery.

    Strong management skills also involve delegation, motivation, and accountability. A Business Analyst must lead by example, guiding teams toward shared business outcomes.

    Courses like BCS Business Analysis Practice teach valuable project coordination and stakeholder management techniques.

    9. Communication Skills

    Communication is at the centre of business analysis. Analysts act as the link between technical teams, management, and end users.

    They must communicate requirements, insights, and recommendations clearly and concisely, both in writing and through presentations. Effective communication fosters trust, understanding, and collaboration among diverse teams.

    Business Analysts who excel in communication are more likely to influence decision making and gain stakeholder support.

    10. Negotiation Skills

    Negotiation is one of the most strategic skills of a Business Analyst. Analysts often mediate between different departments, clients, or vendors to reach mutually beneficial agreements.

    Strong negotiation ensures that everyone’s needs are considered without compromising the project’s goals or deadlines. Successful Business Analysts are skilled at balancing diplomacy with assertiveness to achieve results.

    Business Analyst Training with TSG Training

    To develop and strengthen these skills, structured training and certification are essential. At TSG Training, we offer a complete range of Business Analysis courses designed to support professionals at every stage of their career.

    Popular options include:

    Each course is led by expert instructors with real-world experience, ensuring that learners build practical, transferable skills.

    Why These Skills Matter

    The skills of a Business Analyst go beyond technical expertise. They reflect an ability to understand people, processes, and performance. Developing these capabilities will help you become a more confident, strategic, and impactful professional.

    Whether you want to start a new career or advance your current one, building these skills through TSG Training’s accredited Business Analysis programmes is a smart investment in your future.

  • Artificial Intelligence – The Next Great Opportunity Or The Next Greatest Skill Shortage?

    Artificial Intelligence – The Next Great Opportunity Or The Next Greatest Skill Shortage?

    Artificial Intelligence and automation have been huge leaps into our new technology-driven world. Today we live in a time where cars can drive themselves, chatbots can respond intelligently to customer service inquiries, and business intelligence has been automated.

    While Artificial Intelligence has bought with it many opportunities, it is not without its challenges and risks as well. This new technology-driven world increases productivity and improves our lives in general, but with the widespread adoption of these new technologies, there is a displacement of human activity.

    While some have been concerned that this will leave a shortage of jobs in the future, the truth is that it is more likely to result in a serious skill gap. But is Artificial Intelligence an excellent opportunity for our innovative world, or a troubling skill shortage?

    The Many Opportunities Of Artificial Intelligence

    The new opportunities that Artificial Intelligence has brought to the world cannot be ignored. Particularly for businesses, AI opens up many new avenues and has immense potential. Artificial Intelligence can help to maximise marketing budgets by provided valuable insights into which activities deliver the highest return.

    Big data can be unlocked to reveal information that is actionable, helping businesses to make informed, data-driven decisions. The opportunities that Artificial Intelligence brings to customer support is undeniable, with the rise of automated chatbots, and AI managed support tickets. Even the smallest of businesses can scale up their customer service efforts without expensive resources.

    The more we learn about Artificial Intelligence and the more ways we find to use it, the more opportunities we develop for both businesses and individuals.

    The Artificial Intelligence Skills Shortage

    It is a common concern that Artificial Intelligence will eliminate the need for many jobs, such as customer service operatives, call centre staff and more. However, the fact is that Artificial Intelligence is not destroying jobs but displacing them elsewhere.

    The World Economic Forum (WEF) revealed that Artificial Intelligence would create more new jobs than the ones it destroys. It has predicted that by 2022, 75 million jobs will be displaced because of Artificial Intelligence and automation, but a huge 133 million new jobs will be created.

    The problem the world faces is that the many new jobs created by Artificial Intelligence are in different industries and require different skillsets than the ones it is destroying. There needs to be a major revolution to retrain and educate the workforce in the skills needed to support Artificial Intelligence.

    Without this, there is going to be a very serious talent shortage as not enough workers will have the necessary AI skills to fill the new roles. The number of individuals choosing to train and work within Artificial Intelligence roles is rising rapidly, but it still remains a job-seekers market.

    Currently, there are thousands of engineers with Artificial Intelligence skills across the globe, but as technologies increase in popularity, millions will be required. There is no shortage in demand for AI products and services, and companies producing these need the talent to be able to scale rapidly. The number of companies hiring Artificial Intelligence roles is increasingly quickly, but the number of workers with the required skills is lacking. We are now looking at an alarming situation where the AI skills shortage is a major barrier to the adoption of these new technologies. Overcoming this skills shortage hurdle is essential for Artificial Intelligence technologies to be implemented more widely.

    The Artificial Intelligence Talent Pool

    The talent pool of workers with Artificial Intelligence skills and knowledge is shallow, with very few individuals appropriately trained and ready to work in the industry. Recent reports have shown that the countries which are most committed to training Artificial Intelligence skills are also the ones that are leading in employment.

    The United States is ahead of the rest of the world when it comes to Artificial Intelligence skills, followed by China, the UK and Germany. The same countries are leading the way when it comes to employing AI talent, and universities employ the majority of AI experts.

    Another key finding from these reports was that women are massively underrepresented when it comes to Artificial Intelligence roles.

    Currently, nearly every company in the world is considering Artificial Intelligence tools and how they can improve their business. Many now consider AI and automation to be top business priorities and are planning new Artificial Intelligence projects in the future. It is because of this excitement around Artificial Intelligence prospects that the demand for AI professionals is growing.

    Training and development in Artificial Intelligence are more popular than ever, but in some cases, training programmes are struggling to keep up with the pace of innovations.

    AI experts require not only AI training but first-hand experience working with Artificial Intelligence.

    Artificial Intelligence Training

    Here at TSG Training, we are specialists in providing training courses for Artificial Intelligence. Our range of online and virtual courses cover all levels of AI training, from Foundation courses to advanced options. BCS Essentials In Artificial Intelligence is a popular course among learners with a keen interest in Artificial Intelligence.

    It is a great way to get a solid understanding of what AI is, how it works and what it can be used for. Our BCS Foundation Course In Artificial Intelligence is the latest of our AI courses and takes place over three days. During the course, learners will build on the essentials certification and discover how AI delivers business, engineering and knowledge benefits.

    In addition to our online courses, we offer free Webinars which provide an insight into our courses and subjects. The Artificial Intelligence Webinar Recording covers all the basics of Artificial Intelligence, the machine learning process and the benefits and challenges these can bring. Our AI training courses and AI webinars are perfect for those looking to begin a career in Artificial Intelligence, automation or machine learning.

  • What Is Mobile Application Testing In Software Testing?

    Mobile phones have transformed the way we live our lives. They have evolved from simple devices which had the sole purpose of communication, to impressive gadgets that can do everything we could dream of.
    Today, we use our humble mobile phone to turn down our heating, order a takeaway, read a book, play our favourite games or navigate our way to our next destination. All of this is only possible because of powerful mobile applications. These applications are a type of software, but they work quite differently to traditional web applications.
    The rise of mobile applications has changed the world of software testing and introduced an entirely new dimension; mobile application testing.

    What Is A Mobile Application?

    A mobile application, or app, is software that has been built specifically for use on a mobile device. This could be a smartphone, tablet or wearable. There are three main types of mobile applications;

    • Mobile Web Applications

    You can access these applications on a mobile web browser, so they don’t have to be downloaded onto a device. They work similarly to web applications and are usually built in HTML5, CSS or JavaScript.
    Mobile web applications are often much easier to build and also easier to test; however, their functionality is often more primitive than other application types.

    • Native Applications

    Native mobile applications run on the mobile device itself, making them more advanced. You would need to download these types of apps for you to use them on your device. Native applications are platform-specific, and so are built using specific languages.
    For example, Apple devices require apps to be built in Objective-C or Swift using XCode. Android devices require apps developed using Java or Kotlin in Android Studio or Eclipse IDE. Native applications are often more challenging to produce and test, but because they integrate perfectly with the hardware, the UI/UX experience is much better.

    • Hybrid Applications

    Hybrid applications are a combination of both mobile web apps and native apps. They are developed using the standard web stack (CSS, JavaScript and HTML5), and then wrapped within a native environment. This means that you can use the same code for various platforms. These applications are often easier to build, but they are slower and have less advanced features than native apps.

    What Is Mobile Application Testing?

    All software requires thorough testing, to ensure it works as it should, and there are no bugs. The same goes for all types of mobile applications. Mobile application testing is when apps are tested for usability, functionality and consistency.
    Developers require testing to take place during production, and once the app is complete, and mobile application testing is imperative to an app’s success. The differences between traditional software testing and mobile application testing are vast, and some of the key considerations in mobile app testing are;

    Internet Connectivity

    Mobile web applications generally will not function when the device is offline. Unlike with computer systems, mobile devices’ internet connectivity can fluctuate greatly. This means that thorough testing for mobile applications is essential to see how they perform with different internet speeds.
    You can configure native and hybrid apps to work in an offline mode. This also requires thorough testing to ensure there are no issues if a device has an interrupted connection.

    User Interaction

    The way users interact with a mobile application is very different from a desktop-based application. On traditional software, all operations could take place using the keyboard and mouse. When it comes to mobile applications, users have a much wider range of interaction options. This includes tapping, pulling, pinching, swiping and more, which all need to be tested.
    Not only that but with the rise in voice control, that is another interaction that requires thorough testing.

    Compatibility

    Web-based applications need to be tested in various different browsers, which is fairly straightforward for a software tester to do. However, mobile applications have a much more complicated testing procedure. This is because there is a wide range of mobile devices available to users.
    New mobile devices are constantly being released, each with expanded functionality. Mobile applications must work for each mobile device, and some characteristics to consider include battery life, screen size and capacity.

    What Mobile Application Testing Approaches Are There?

    Just like with software testing, there are two key approaches to mobile application testing;

    Manual Testing

    Manual software testing uses human input, analysis and evaluation. It is a user-centric approach that focuses on exploring how a mobile app meets user requirements. All mobile applications should be manually tested for the look and feel as well as the usability and ensuring it is as user friendly as possible. It is often a bad idea to rely on manual testing alone when testing a mobile application as it can be easy to make mistakes this way.

    Automated Testing

    Automated testing allows you to create endless scenarios for your mobile app and test them all very quickly. Automating the testing process is essential for tests that have predictable results, are tedious to test manually or are impossible to test manually.

    How To Learn More About Mobile Application Testing?

    At TSG Training, we offer a range of training courses to help you learn more about software testing and mobile application testing. If you are new to software testing, we recommend our ISTQB Software Testing Foundation Course, which covers all the fundamentals of software testing. It will provide you with the foundations needed to pursue a career as a software tester.
    If you are specifically interested in learning about mobile application testing, then our ISTQB Foundation – Certified Mobile App Tester course is for you. It is designed for software testing professionals working with mobile technology.
    We also offer a range of free webinars covering various different subjects. They provide insights into our training courses and various topics, including software testing and mobile application testing. On 8th December, we will be holding a free webinar on our BCS Certificate in Software Testing. The event will discuss the new 3-day course and explain what you can expect from the course.

  • 20 Items That Must Be On Your Cybersecurity Checklist

    Cybersecurity is a top priority for businesses of all shapes and sizes, and it is vital you get it right. There is no way to be 100% protected from IT security threats, but there are various best practices you can implement. Following these items on your cybersecurity checklist can significantly reduce your risk of becoming a hacker’s next target.

    1.Implement A Strong Password Policy

    Within your businesses IT policies, you should make a complex password mandatory for all users. Passwords should ideally be eight characters or more, a mix of lower case and upper case letters, numbers and special characters. Not only that, but you should change all passwords every three months.

    2.Update Operating Systems

    No matter which operating systems your employees are using, they must be kept up to date to ensure security. Make sure to set all systems to automatically update. Furthermore, encourage everyone to shut down and reboot every night to trigger regular updates.

    3.Set Automatic Screen Locks

    Any computer, laptop or mobile device that are not in active use should automatically lock its screen. This can be configured in settings and, as such, is vital for keeping data and information that could be on screen safe.

    4.Track All Equipment

    Every piece of IT equipment that belongs to your company could potentially have data residing on it. This includes computers, laptops, mobiles, thumb drives and even cloud locations. Make sure you limit access of these systems to staff members that really need them. What’s more, keep track of where they are at all times.

    5.Update Antivirus

    It is wise to set all antivirus software so that it updates automatically when a new update is released. It can be worthwhile configuring reports that can check the status of antivirus updates on all computers in the business.

    6.Dispose Of Data Properly

    As a business, you are legally responsible for the data you hold on your customers and employees. Any physical documents with data on should be securely shredded and IT equipment should be reformatted and cleared.

    7.Minimise Administrator Rights

    When you allow a computer to operate in administrator mode, it can open that system up to security threats. This could lead to a compromise on your entire network. Ensure administrator mode is disabled on all but essential devices, and never do regular work on a system in administrator mode.

    8.Secure Your Devices

    All IT devices should be both physically and digitally secured to avoid cybersecurity threats. Servers, computers, mobile devices, and data drives should all be safely locked and secured when not in use.

    9.Send Securely

    If you and your employees need to send data digitally to one another or to clients or suppliers, then you should standardise tools for secure sending. This could be a dedicated portal for team members to use or an encrypted email solution.

    10. Encrypt Your Back-Ups

    Having back-ups of your systems and data is essential in case something does go wrong. However, these back-ups must be properly encrypted to ensure they are secure. It is a good practice to regularly review back-ups to check they are complete and you can restore them if necessary.

    11. Review IT Policies

    The world of IT is everchanging, and your IT policies need to reflect that. Be sure to regularly review and update your policies where necessary, and remind employees when you make changes so they can review them. Your IT policy should include details on remote access, encryption and privacy.

    12. Protect Mobile Equipment

    Any IT equipment that is often carried around and used in various locations, such as laptops, tablets and mobiles, should have adequate protection. These items are most at risk of theft. Consequently, it would be best to encrypt and secure devices with mandatory passwords. Make sure you have a process in place for employees to report lost or stolen devices so that they can be erased immediately.

    13. Use Secure Connections

    All members of your team should be able to and know how to, connect to resources in a secure way. This could be through a Virtual Private Network (VPN) or other secure connection. Remind all staff that they should not use public WiFi networks for any confidential work.

    14. Screen Contractors And Employees

    Before giving anyone access to any of your data and resources, you should make sure they have robust screening and background checking. This includes any contractors you are working with or potential employees. It can be very easy for a hacker to copy thousands of files in seconds once they have been granted access.

    15. Promote Email Awareness

    Everyone in your company should be well aware of the dangers of email. Train your staff to recognise the signs of a suspicious email, such as the sender’s email address and strange-looking attachments. Be sure that your team know to flag up suspicious emails to your IT team and not to click on any links or attachments that they aren’t sure about.

    16. Have Adequate Insurance

    As well as doing everything you can to prevent a cybersecurity breach, it is also worth having insurance in place should the worst happen. No cybersecurity plan is 100% effective, and there is always a risk that you could fall foul to hackers.

    17. Create A Breach Response Plan

    You should make sure that you have a response plan in place to deal with a data breach should it happen. This means you and your employees know exactly how to handle the situation, and it should include things like informing customers and notifying any external IT support.

    18. Greet All Visitors

    A very simple way to boost your cybersecurity is to remind all team members to greet anyone they don’t recognise in the office. Not only can this improve your customer service levels, but it helps you to recognise if any visitors appear suspicious.

    19. Hire Experts

    Having experts on your team means that you can implement your cybersecurity plans properly. Make sure your IT teams are knowledgeable and up to date with the latest best practices.

    20. Educate Your Employees

    Cybersecurity education among your team is often the most crucial part of your plans. If your team don’t know how to deal with a security breach or prevent one, then you can leave yourself open to risks. Invest in training for your staff to ensure they are all informed about cybersecurity and how to deal with it.
    Here at TSG Training, we offer our BCS Certificate In Information Security Management Principles course and our ISTQB Advanced Security Tester course to help team members stay educated on cybersecurity. We also offer a range of free webinars that cover various cybersecurity subjects.