Security: The Backstory to Home Depot

The class action lawsuit filed in court against Home Depot reveals a telling backstory that made a hacker's dream come true, and it started with a new chief of IT security in 2011:

• hired an "enforcer" manager
• "bullying" and "abrasive" - descriptions of Jeff Mitchell, CISO (Chief Information Security Officer)
• high attrition
• around 50% loss of IT security employees after 3 months of Mitchell's promotion to CISO in 2011
• additional talent loss continuing to 2013

• perceived IT security as discretionary spending 
• "We sell hammers." Matthew Carey, CIO
• Mr. Carey focused on technological improvements in the company’s supply chain
• "it’s going to interrupt the business”, Jeff Mitchell, CISO
• cost cutting in IT security
• loss of ability to hire top talent
• suspension of computer asset inventorying (Symantec Control Compliance Suite)
• suspension of regular risk analysis & reporting
• shelving IT security projects
• deferred POS encryption project
• suspended privileged computer account access auditing system (Cyber-Ark Software purchased but not implemented)
• ignored advanced intrusion detection firewall (Symantec NTP purchased but functionality never enabled)

• ignored IT security risks
• ignoring (and penalizing) a whistleblower in 2011
• both legal and IT security departments made no-action when an employee  reported critical vulnerabilities in retails stores, except to dismiss the employee
• non-action on confidential POS vulnerability reports
• from FBI in early 2014
• from VISA in 2013
• non-action on remediation recommended by 3rd party IT auditors
• auditors / consultants flagged company software as outdated and unpatched
• FishNet Security consulted
• Symantec Corp consulted
• random & incomplete internal security audits

• computer systems "desperately out of date" - Francis Drake, CEO 
• near EOL (End Of Life) softwares in production
• the POS machines targeted by hackers used Microsoft Windows XPe "XP Embedded", an OS that was 13 years old
• the version of anti-virus, Symantec EndPoint, was 7 years old at the time of the hacking
• routine software patching replaced with ad hoc updates

Investing: Comparing Online Advisors

Comparing Online Investment Advisors

So much investment advice, so little time (and money).  There's many personal investment advisors online now using analytics to give cookie-cutter advice.  The upside to these online services is the promise of greater transparency and a consolidated "pane of glass" view of your accounts across multiple brokers or institutions.  I think those promises are valuable for self-driven (or un-managed) investing, even if they can't replace a professional personal investor.

I wanted to compare these "online advisors" side by side.  My comparison is based on (my) typical use of their interfaces and it's been an enlightening review.  After each of them sucked in my investement accounts, it was visually obvious which ones were differentiators.  I list each advisor's 6 month returns for my personal investments -- not for bragging rights -- to indicate that some large variances exist even in the "hard" numbers.  This makes any of their numbers or advice suspect, so buyer beware.

From the chart below, it's pretty clear to me that I'll be keeping PersonalCapital around.  Openfolio has a nifty crowdsourcing type of approach that will be fun to watch too.

Advisor	6mon Return Sample	Advice Sample	Big Differentiators	Worst Detractors
SigFig	9.7%	buy bonds, sell high expense ratio position	manage accounts (free upto $10k)	short performance analysis (1yr)
FutureAdvisor	9.4%	buy bonds, buy US stock	manage accounts (paid service)	short performance analysis (6mon), no mobile app
NextCapital	9.4%	not offered	long performance analysis (start of holdings), calculates α (paid service), calculates account and holding fees / taxes (paid service), discloses algorithm for calculating returns**, granular asset class differentiation***	no personalized advice or management service, no mobile app
Personal Capital	11.5%*	buy US stocks, sell international stock	connects to P2P accounts*, historical performance extrapolation back to 1992, calculates account and holding fees / taxes, granular asset class differentiation***, multi-factor authentication
Openfolio	9.8%	increase Sharpe ratio, sell high expense ratio positions	compare to other investor porfolios	short performance analysis (Jan '14), no mobile app

* PersonalCapital can calculate performance including P2P lending returns
** https://www.nextcapital.com/pdfs/return_calculation_details_linked_daily_return.pdf
*** examples: PersonalCapital differentiates international bonds from US bonds, NextCapital & PersonalCapital differentiate industry type