Assessments & Summaries

An "Initial" Vendor "Summary"-type Assessment. 

• BLUF: To provide decision-makers with a high-level assessment summary of specific vendor products.

• STEPS:

  1. Title: 

  2. Speaker/Group:

  3. Summary:

     •  Short Summary

  4. Takeaways: 

     • Bullet points

  5. For Consideration: 

     • Bullet points 

• Use BARD AI: -- Copy the following... "Provide me (1) the Title (2) the Speaker/Group name (3) a Summary in narrative format, and Write 3 to 4 bullets under these categories: (4) Takeaways, and (5) For Consideration based on the information here: <cut/paste data information here or YouTube link>"

Overview.

• BLUF (5): -- An overview can be more useful when dealing with broader topics or when the audience needs more context  -- (1) Broader in scope; (2) Provides a general outline or introduction to a topic; (3) Can be more flexible in length and structure; (4) May include context, background information, or key themes; and (5) Can incorporate more interpretation or analysis.

• Use an Overview When (4): (1) Introducing a new or complex topic; (2) Providing context or background is important; (3) You want to give a broader perspective on a subject; and (4) The audience needs a general understanding before diving into details.

• Use Claude.AI: -- Copy the folling -- "Create an Overview on this information here: <cut/paste context here, No link>"

Summary.

• BLUF (5): -- A summary is often preferred for its conciseness and focus on key points  -- (1) More concise and focused; (2) Captures main points or conclusions; (3) Often shorter in length; (4) Typically follows the structure of the original content; and (5) Usually doesn't include personal interpretation or additional context.

• Use a Summary When (3): (1) You need to quickly convey the main points of a specific piece of content; (2) You're working with limited space or time; and (3) The audience is familiar with the topic and needs a quick refresh.

• Use Claude.AI: -- Copy the folling -- "Summarize this information here: <cut/paste context here. No link>"

• Writing a Paragraph of your Summary Actions:

  1. Slide Review, Q&A, and ETD -- 

     • Input

       1. Question to AI (Bard) when a "Summary" is already written: "I created a summary here <cut/paste summary-info here> for <POC> to review and gain insights more efficiently. Based on the information, I would like you to write me a condensed paragraph to describe my work, the research, and the analysis I did in creating this summary that makes me sound good.

     • Output:

       1. Question to AI (Bard): "My work reviewed 33 slides and I created a summary from those slides for Conrad to review and gain insights more efficiently. Based on this little information, I would like you to write me a longer paragraph to describe my work that makes me sound good."

       2. Answer from AI (Bard) to Leverage (LONG): "To expedite the review process and facilitate informed decision-making, I conducted a comprehensive analysis of <33 slides>. Through meticulous examination and careful synthesis, I distilled the key information into a concise and informative summary. This streamlined document provides <POC Name> with a clear and efficient overview of the presented material, enabling <him/her> to grasp essential concepts rapidly and make well-supported judgments. My work effectively bridged the gap between vast data and actionable insights. 

• Get Estimated Time of Deliverable (ETD): 

  1. Question to AI (Bard): I efficiently condensed <33 slides> into a clear summary to support <POC Name> in quickly understanding key points and making informed decisions. I did research, analysis, and summarized the slides. My work transformed complex information into actionable insights. Could you give me an estimated time frame for completion in minutes and hours?

     • 06 Slides = 45 minutes-1 hour

     • 12 slides = 1-2 hours

     • 20 slides = 2-3 hours

     • 33 slides = 2-5 hours (5 being the highest) 

  2. Common Answer: Given that you reviewed 33 slides (33+ being the highest) and created a summary, it's reasonable to estimate that this task would take between 2-5 hours (5 being the highest). This estimate assumes average slide complexity and some familiarity with the subject matter.

1st, 2nd, 3rd, & 4th Party Vendor Assessment Process (aka TPRM).

• BLUF: Organizations, not specific vendors, assess 1st, 2nd, 3rd, and 4th party vendors for security purposes. This process falls under the umbrella of Third-Party Risk Management (TPRM).

• The Organization Performs Assessments: Your company (or any organization) is responsible for assessing the security of vendors it interacts with, including 1st party (internal), 2nd party (direct suppliers), 3rd party (suppliers to your suppliers), and 4th party (sub-vendors of your 3rd party vendors).

• Tools and Processes To Assist Vendors: While you conduct the assessments, specialized vendors can offer tools and services to help. -- STEPS (4):

  1. Security questionnaires.

  2. Penetration testing of vendor systems (with permission).

  3. Vulnerability scanning of vendor software.

  4. Reviewing security certifications (like SOC 2). SOC 2 (System and Organization Controls 2). SOC 2 is a voluntary compliance framework, developed by the American Institute of Certified Public Accountants (AICPA), that focuses on security and data protection for service organizations.

• US Federal Government and TPRM: 

  1. The US government doesn't have a single mandate requiring TPRM assessments for all vendors. 

  2. However, some regulations like the Defense Federal Acquisition Regulation Supplement (DFARS) place specific security requirements on government contractors. 

  3. These contractors are then responsible for implementing TPRM to ensure their vendors meet security standards.

• Resources:

  1. Third-Party Risk Management (TPRM): https://www.upguard.com/product/vendorrisk

  2. Supply Chain Security and the Defense Department: https://breakingdefense.com/2023/07/to-help-supply-chain-challenge-dod-should-revive-second-sourcing-in-defense-acquisition/

Product Assessment (Evaluating Software) "Process." 

• BLUF: Evaluating software effectively requires a multifaceted approach. 

• Common and Standard Categories to Assess a Software Product: (7)

  1. Needs Analysis:

     • Start with the Why: Before diving into features, (1) define your specific needs and (2) pain points crucial for your workflow. (3) What problem are you trying to solve with this software?

       1. Use: Gartner. -- BLUF: Gartner, Inc. is an American technological research and consulting firm based in Stamford, Ct, that conducts research on technology and shares this research both through private consulting as well as executive programs and conferences.  

       2. Use: Forrester. -- BLUF: Forrester is a research and advisory company that offers a variety of services including research, consulting, and events.  

       3. Use: https://www.softwareadvice.com

          • Example: Crowdstrike Falcon: https://www.softwareadvice.com/security/crowdstrike-profile/ 

  2. Functional Requirements:

     • Must-Have Features: List the functionalities crucial for your workflow. Prioritize features that directly address your needs.

  3. Usability and Design:

     • User Experience (UX): Assess ease of use, interface clarity, and overall user experience. Can users navigate and perform tasks intuitively?

     • Software Evaluation Criteria: Review a more comprehensive checklist of usability criteria like learnability, efficiency, and error tolerance: https://www.ed.ac.uk/information-services/computing/desktop-personal/software

  4. Technical Considerations:

     • Performance and Scalability: Can the software handle your workload? Will it adapt to growth in users or data?

     • Security: Evaluate the software's security measures. Does it meet your data protection requirements?

  5. Cost and Value:

     • Total Cost of Ownership (TCO): Consider upfront costs, subscription fees, maintenance expenses, and potential training needs.

     • Software Evaluation checklist: Gain insights into hidden costs and effective TCO calculation https://www.spendflo.com/spendflo-for-it

  6. Vendor and Support:

     • Reputation and Stability: Research the vendor's track record, customer support quality, and future development plans.

  7. Additional Resources:

     • Free Trials and Demos: Utilize these to test the software firsthand and assess its fit for your needs.

     • Customer Reviews: Read user reviews on reputable platforms to gain real-world perspectives.

Product Assessment & DevOps using Measured Key Words.

• Understanding the question: When you say "measured key words," it is referring to metrics or key performance indicators (KPIs) used to evaluate a product's suitability for a company. These are quantifiable measures that help determine if a product aligns with the company's goals and delivers the desired value.

• Key Performance Indicators (KPIs) for Product Assessment. The specific KPIs will vary depending on the industry, company size, product type, and overall business objectives. 

• General Categories (Goals) and Examples (Obj.): It's essential to establish clear goals and metrics before launching a product to measure its success accurately.

  1. Financial Metrics:

     • Revenue: Total income generated from product sales.

     • Profit Margin: The percentage of revenue left after deducting costs.

     • Customer Lifetime Value (CLTV): The total revenue a customer generates over their lifetime.

     • Return on Investment (ROI): The net profit divided by the total investment.

  2. Market Performance Metrics:

     • Market Share: The percentage of the total market that a product captures.

     • Customer Acquisition Cost (CAC): The cost of acquiring a new customer.

     • Customer Churn Rate: The percentage of customers who stop using a product.

     • Net Promoter Score (NPS): A measure of customer satisfaction and loyalty.

  3. Product Performance Metrics:

     • Product Adoption Rate: The speed at which customers start using the product.

     • Product Usage Metrics: How frequently and for how long customers use the product.

     • Feature Utilization: How often specific product features are used.

     • Customer Satisfaction: How satisfied customers are with the product.

  4. Operational Metrics (DevOps)

     • Time to Market: The time it takes to develop and launch a product.

     • Product Development Costs: The total cost of developing the product.

     • Inventory Turnover: The rate at which inventory is sold and replaced.

     • Defect Rate: The number of defective products compared to total production.

  5. Additional Considerations

     • Alignment with Company Goals: Does the product contribute to the company's overall objectives?

     • Competitive Advantage: Does the product offer unique value compared to competitors?

     • Customer Needs and Preferences: Does the product meet customer needs and desires?

     • Scalability: Can the product be scaled to meet increasing demand?

     • Risk Assessment: What are the potential risks (security) associated with the product?

Assessment Process.

• BLUF (2): (1) The action or instance of making a judgment about something: the act of assessing something: an appraisal. assessment of a product, process, or damage. (2) By combining these categories from Well-Established Common Processes, NIST-FISMA, and PMI, you can create a comprehensive framework for assessing products and selecting the one that best addresses your organization's needs and delivers the most value. 

• Combination Approach of the below Processes (using a Well-Established Common Process; NIST-FISMA, PRINCE2, & PMI). -- This framework provides a standardized approach, leveraging established processes, industry best practices (NIST and FISMA), and project management principles (PMI) to objectively assess vendor programs.

  1. Define Needs and Criteria (Weight & Measurements): (Well-Established Common Process + PMI)

     • Functional Requirements (Needs): Align with PMI's "Project Requirements" principle. Clearly define your problems and functionalities needed in the software. (Focus on problem-solving.)

     • Non-Functional Requirements (Criteria): Consider factors like scalability, security, integrations, user interface, and compliance (similar to Well-Established Common Process). (Focus on usability and technical aspects)

     • Cost: Evaluate the total cost of ownership (TCO) (Well-Established Common Process + PMI). This includes licensing, implementation, maintenance, and training.

  2. Research and Shortlist: (Well-Established Common Process).

     • Vendor Reputation: Research the vendor's track record for customer support, ongoing development, and security practices.

     • Industry Reviews: Look for independent reviews from reputable sources (e.g., Gartner) and user testimonials relevant to your industry.

  3. Hands-on Evaluation: (Well-Established Common Process)

     • Demos and Free Trials: Get hands-on experience through demos and trials to understand how the program functions in your workflow.

     • Proof of Concept (POC): Consider a pilot program with a shortlisted vendor to test the software in a real-world scenario.

  4. Comparison and Scoring: (PRINCE2 + PMI)

     • Scoring Matrix: Utilize a pre-defined scoring matrix with weighted criteria (similar to Well-Established Common Process) to objectively compare shortlisted programs. Consider incorporating PMI aspects like "Schedule" (implementation timeline) and "Risks" (security vulnerabilities, vendor lock-in) into your scoring criteria.

  5. Security Assessment (NIST and FISMA):

     • Focus on the product's security features and compliance with relevant standards like NIST 800-53B. Evaluate aspects like:

       1. Security Controls: Access control, data encryption, incident response capabilities.

       2. System and Services Security: Vendor's infrastructure security, development practices, and vulnerability management.

       3. Protection of PII (if applicable): Data masking, access restrictions, breach notification procedures.

       4. Nonrepudiation and Authentication: Two-factor authentication, digital signatures, audit logging.

       5. Availability: Disaster recovery plans, system redundancy, performance metrics.

  6. Additional: (Well-Established Common Process).

     • Stakeholder Involvement/CAB: Involve key decision-makers and potential users in the evaluation process for successful implementation.

• Product Assessment Processes. (1+3) -- There isn't a single "most common" way to assess a vendor's program, but there's a well-established process that combines multiple methods to give a comprehensive picture/insight. 

  1. Well-Established Common Process: (4+1) 

     • ID Needs-Problems; Do Research; Test the Tool; Measure-Score.

       1. Define Needs and Criteria: (2)

          • (1) ID Needs & Problems: Start by clearly outlining your company's specific needs and challenges. What problems are you trying to solve with these software programs? What functionalities are essential? (2) Develop a scoring matrix with weighted criteria that reflect your priorities. This could include factors like features, pricing, scalability, security, integrations, customer support, and the user interface.

       2. Research and Shortlist: (2) 

          • (1) Conduct research on the program(s). Look for reviews from reputable sources (ex. Gartner), user testimonials, and case studies relevant to your industry. (2) ShortList of Products: Shortlist the programs that seem to best align with your needs and criteria.

       3. Evaluation Stages: (2)

          • (1) Request Demos and Free Trials: Most software vendors offer demos and free trials. This is a crucial step to get hands-on experience and see if the program intuitively fits your workflow. Utilize the demos to assess how well the features address your specific needs. (2) Proof of Concept (POC): Consider a pilot program with a shortlisted vendor. This allows a small team to test the software in a real-world scenario and identify any potential issues before full deployment.

       4. Comparison and Selection:

          • Comparison and Evaluation: After demos, trials, and potential POCs, go back to your scoring matrix. Evaluate each shortlisted program based on your defined criteria and assigned weights. This will help identify the program that delivers the most value for your company.

       5. Additional: (3)

          • Involve Stakeholders/CAB: Get key decision-makers and potential users involved in the evaluation process. Their input is crucial for a successful implementation.

          • Security Assessment: Ensure the software meets your company's security standards and data protection requirements. Passed the A&A RMF process to ATO.

          • Vendor Reputation: Research the vendor's reputation for customer support, ongoing development, and track record.

  2. National Institute of Standards and Technology (NIST) Special Publication 800-53B: Security and Privacy Controls for Federal Information Systems and Organizations (FISMA): (5)

     • STEPS:

       1. Security Controls: This category focuses on the product's security features and functionalities. It assesses how the product protects your organization's data and systems from unauthorized access, modification, or destruction. Consider aspects like access control, data encryption, incident response capabilities, and compliance with relevant security standards.

       2. System and Services Security: Evaluate the security posture of the underlying systems and services that the product relies on. This could include the vendor's infrastructure security, development practices, and vulnerability management processes.

       3. Protection of Personally Identifiable Information (PII): If your organization handles PII, assess how the product safeguards this sensitive data. This includes features like data masking, access restrictions for authorized personnel, and data breach notification procedures.

       4. Nonrepudiation and Authentication: Analyze how the product ensures the authenticity of users and transactions. This may involve two-factor authentication, digital signatures, and audit logging.

       5. Availability: Evaluate how well the product maintains consistent uptime and accessibility for authorized users. Consider factors like disaster recovery plans, system redundancy, and performance metrics.

• 3. Projects in a Controlled Environment, Ver. 2 (PRINCE2): (4)

     • PRINCE2 doesn't have a single process specifically for assessing a software product. However, several of its processes contribute to a comprehensive software product assessment:

       1. Initiating a Project (IP): This phase involves defining the product description which outlines the product's functionalities, target users, and quality expectations. This provides a baseline for assessment.

       2. Managing Product Delivery (MP): This process focuses on creating and managing the product breakdown structure (PBS). The PBS breaks down the product into smaller, manageable components, allowing for individual assessment of each component against the product description.

       3. Controlling a Stage (CS): Throughout the project lifecycle, stages are defined and authorized. During each stage, the project manager monitors progress and reviews completed work packages. This includes assessing the quality of deliverables against the product description.

       4. Directing a Project (DP): The project board, with oversight from the executive, reviews project progress reports which include information on product quality. This allows for ongoing assessment of the software product throughout the project.

• 4. Project Mgmt Institute (PMI). (5)

     • A Guide to the Project Mgmt Body of Knowledge (PMBOK Guide): (5)

       1. Project Requirements: Ensure the product aligns with your organization's specific needs and functionalities. Clearly define your requirements beforehand and assess how well the product meets them.

       2. Cost: Evaluate the total cost of ownership (TCO) of the product. This includes the initial purchase price, implementation costs, ongoing maintenance fees, and potential training costs.

       3. Schedule: Assess how well the product's implementation timeline aligns with your project schedule. Consider factors like product deployment time, vendor support availability, and integration complexity with existing systems.

       4. Risks: Identify and evaluate potential risks associated with the product. This could include security vulnerabilities, vendor lock-in, lack of scalability, or compatibility issues.

       5. Stakeholder Needs: Consider the needs and priorities of all stakeholders involved in the project. This might include users, IT personnel, management, and security teams.

1. VAST Data -- BLUF:  A data computing platform that allows users to train AI models by storing and synthesizing large amounts of unstructured data. 

Nutanix.

• Nutanix (https://www.nutanix.com/) -- (1) One Platform to Run Apps and Data Anywhere (2) Learn how our unified platform seamlessly integrates infrastructure and management to enable smooth operations across clouds.

• The Nutanix Bible: The purpose of the Nutanix Bible is to provide in-depth technical information about the Nutanix platform architecture. Feel free to use the menu to search for a topic or browse the various books below! You can also download the complete Nutanix Bible as a PDF.

What does an EA Tool do:

• BLUF: EA tools are software applications that help organizations document, analyze, and visualize their IT infrastructure and business processes. It provides a central repository for all the information about an organization's technology landscape, making it easier to understand how different systems interact with each other.

• Benefits: (5)

  1. Improved decision-making: EA tools can help organizations make better decisions about IT investments by providing a clear view of the current state and future goals of the IT infrastructure.

  2. Increased agility: EA tools can help organizations adapt to change more quickly by making it easier to identify and implement new technologies.

  3. Reduced costs: EA tools can help organizations save money by identifying and eliminating redundancies in their IT infrastructure.

  4. Improved compliance: EA tools can help organizations comply with regulations by providing a documented record of their IT infrastructure.

  5. Enhanced collaboration: EA tools can help different parts of an organization work together more effectively by providing a shared understanding of the IT infrastructure.

• EA Tools (Short List):

  1. Avolution:

  2. EA Solutions:

  3. IBM Rational System Architect:

  4. LeanIX:

  5. Lucid Charts (Cloud-base):

  6. MagicDraw:

  7. Miro.com -- Simple draw pad.

  8. Software AG:

  9. SparX EA:

  10. Visio (by Microsoft):

Keyfactor (Website) (FedRAMP by Feb 2025): Provides a single pane of glass across multiple types of machine identities by offering X.509 certificate management, SSH key management, and the management of symmetric keys using KMIP. Keyfactor offers a radically new, automated approach to PKI and certificate management that eliminates the manual processes, complexity, and organizational friction associated with traditional solutions. No spreadsheets, no homegrown scripts, and no legacy on-premises infrastructure. 

• X.509 Certificate Management -- Digital credentials that establish trust in online interactions. -- DOES (4): (1) Issuing: Creating and distributing new certificates. (2) Installation: Deploying certificates to servers, devices, or applications. (3) Renewal: Updating certificates before they expire to avoid security gaps. (4) Revocation: Deactivating compromised certificates to prevent their misuse. -- Azure Tools (2): (1) Azure Key Vault: A secure store for cryptographic keys and secrets, including certificates. (2) Azure Certificate Services (ACS): A managed PKI (Public Key Infrastructure) service that simplifies certificate issuance, renewal, and revocation within Azure. ACS integrates with Key Vault for secure storage.

• SSH Key Management -- (Secure Shell): A protocol for secure remote login to computer systems, that uses public-private key pairs.-- DOES (2): (1) Key Generation: You generate a key pair on your local machine. This consists of a public key and a private key. The public key is shared with the remote server (VM in Azure). (2) Authentication: When you attempt an SSH connection, the server checks if your local machine presents the corresponding private key. If it matches the public key stored on the server, access is granted. -- Azure Tools (3): ~ Note: Azure doesn't directly manage SSH keys itself. (1) Azure Portal: When creating a VM in the Azure portal, one can specify a public key during the deployment process. This automatically configures the VM to accept SSH connections using your key pair. (2) Azure CLI (Command-Line Interface): When creating VMs, one can manage SSH keys from the command line. One can use commands to generate key pairs, upload public keys to VMs, and manage VM access. (3) Azure Resource Manager templates: These templates offer a declarative approach to provisioning Azure resources, including VMs. You can include your public key within the template for automated deployment with SSH key authentication.

•  KMIP Symmetric Keys -- (2) 

  1. KMIP (Key Management Interoperability Protocol)  An industry-standard protocol that allows applications to securely communicate with various key management solutions. It provides a common interface for tasks like key creation, deletion, retrieval, and wrapping/unwrapping. -- DOES (4): (1) Secure creation: KMIP ensures keys are generated securely within a tamper-resistant hardware module. (2) Key storage: Keys are stored in encrypted form within the KMIP server. (3) Controlled access: KMIP facilitates granular access control policies to restrict who can manage or use the keys. (4) Key distribution: KMIP can securely distribute keys to authorized applications or users. -- Azure Tools: Azure Key Vault is the primary Azure tool that integrates with KMIP for managing cryptographic keys, including symmetric keys.  Here's how it works: (1) KMIP Clients: Applications or services requiring key management interact with Key Vault through the KMIP protocol. (2) Key Vault Server: Azure Key Vault acts as the KMIP server, handling all key management operations following the KMIP specifications.

  2. Symmetric Keys: Are cryptographic keys where the same key is used for both encryption and decryption. They are efficient for bulk encryption/decryption but require secure sharing between all parties involved. -- DOES: Same as KMIP. --  Azure Tools: Same as KMIP

Security Tools.

1. Crowdstrike Horizon -- Provide security endpoint monitoring capability on systems deployed in the cloud. -- Azure tools (3): 

   1. • Microsoft Defender for Cloud: A cloud security posture management (CSPM) solution offers a holistic view of your security posture across your entire Azure environment and on-premises assets. It includes features like:

        1. Vulnerability management identifies vulnerabilities in your cloud resources and recommends remediation steps.

        2. Threat detection and response: continuously monitors for suspicious activities and provides alerts to help you investigate and respond to potential threats.

        3. Regulatory compliance: To assess your compliance with various security regulations and standards.

      • Microsoft Defender for Endpoint: This endpoint protection platform (EPP) is deployed directly on your cloud VMs and provides real-time protection against malware, viruses, and other threats. It offers features like:

        1. Next-generation antivirus (NGAV): Detects and blocks both known and unknown threats.

        2. Endpoint detection and response (EDR): Provides advanced investigation and remediation capabilities for security incidents.

        3. Tamper protection: Protects critical system settings from unauthorized modifications.

      • Azure Security Center: This free service provides basic security monitoring and recommendations for your Azure resources. It offers features like: 

        1. Security recommendations: Identifies potential security misconfigurations and recommends best practices.

        2. Just-in-time (JIT) access: Grants temporary access to resources based on specific needs, reducing the attack surface.

        3. Log analytics: Provides insights into security events happening across your Azure resources.

2. SailPoint ILM (Identity Lifecycle Management) -- A software solution that helps organizations manage the entire lifecycle of user identities and access permissions within their IT infrastructure. 

3. Splunk -- A software platform used for searching, monitoring, and analyzing machine-generated data in real-time (does data analytics). It allows users to gather and analyze data from various sources, such as websites, applications, servers, and devices, to gain insights, troubleshoot problems, and make informed decisions.

4. Synack -- BLUF: Continuous Security Testing | Internal & External Pentesting. 

5. ZScaler -- A cloud-based security platform that provides secure access to the internet and cloud services, while also protecting against cyber threats. It offers services such as web filtering, threat protection, data loss prevention, and cloud application security. Ensures that users can securely access the internet and use cloud apps from any device and any location, without the need for traditional on-premises security infrastructure.