BlackBerry’s Uphill Battle

So, tomorrow’s the big day.

Research In Motion is formally introducing its BlackBerry 10 operating system.

Will the industry yawn and wonder what part of the mobile wilderness that RIM the BlackBerry has been wandering, or will it welcome the potential for new innovation with open arms?

We shall see, but there’s been no end of speculation and expectation appearing in the blogosphere.

For IT professionals, The Wall Street Journal’s Clint Boulton indicated CIOs should be prepared to ask (and get answered) a few key questions.

They center around pricing, upgradability of BlackBerry’s Enterprise Server, interoperability with iPhone and Android, and the like.

The broader question is what will drive demand? Will the market be receptive to the new phones and software behind BlackBerry 10, or are iPhones and Androids “good enough?”

Plenty of tech and mobile companies have had their time “in the wilderness,” and there’s nothing to focus innovation and R&D like dwindling market share.

I was a faithful BlackBerry subscriber for several years, before the lure of the more user-friendly environment of the iOS operating system drew me away from my last RIM device, the BlackBerry Bold.

Looking back, there were a few things I especially liked about RIM’s earlier offerings.

Most notably, the real-time, secure email capability. At a time when I was traveling extensively, there was nothing like being able to walk off the plane and crank up my Bold to find out what had happened in my world the prior 10 hours I was in the air.

I also liked the ability to synchronize with my work calendar — nothing like missing a meeting because you didn’t know it was even happening.

What I didn’t like? The inability to easily introduce new applications and content, most notably music and video (vis a vis iTunes), and yes, that all important road warrior time killer, games. I could only take so many bouts of “Bricks” or “Breakout” (It’s been so long, I forgot what the game was called!)

The application universe also always seemed so limited with RIM, so if they are going to “break out” of the wilderness, that app ecosystem is going to be key.

But only if the OS is up to the task.

CNET’s Roger Cheng explains we can expect two new devices at least, the Z10 and X10, a touchscreen and keyboard version, respectively, and that they’ll be available in February.

As far as apps are concerned, Cheng indicates BB 10 will launch with 70,000 apps.

Though that pales compared to the number of iOS and Android apps currently available, it’s a start, and the real key will be are they the RIGHT apps (the ones that help the mobile warrior stay productive, informed, entertained, and sane on the road, and yet have enough attraction to pull in other demographics).

Creating awareness through marketing will also be key to RIM’s renaissance. The “mindspace” for mobile has been increasingly dominated by the Apple and Google juggernauts over these past few years, and we can hardly turn our heads without seeing Samsung’s TV spots suggesting the iPhone is your our parent’s geriatric mobile device.

RIM hasn’t been part of the conversation for…well, years.

But I think RIM’s challenges are much bigger than awareness. The proof is going to be in the pudding, or in their case, in the user experience.

Design of a useful, attractive and compelling user experience may not have been MORE important in a new product launch in eons, because despite having the early advantage in the mobile smartphone space, now every new experience (including the BB 10 is) going to inevitably be compared to another, existing experience like iOS and Android.

Between that, the desire for a rich apps ecosystem, and getting the word out to a skeptical public — well, over the next few months, let’s just say we’re going to find out how much Motion their Research has as they try to convince loyal, “pry this mobile device out of my cold, dead hands” users out of their comfort zone and into the land of the unknown BlackBerry.

Holiday Shopping And Streaming

Santa brought Turbo a new (used) set of vintage 1988 Ben Hogan “Redline” blade golf clubs…whether or not they’ll do anything to help lower his handicap remains to be seen!

Well, I hope you and yours are having a happy holiday season, wherever in the world you may be.

I just returned from a wonderful visit to see my parents and some extended family up in my hometown of Denton, Texas, where we were treated to our first white Christmas in three years, the snow billowing down starting around mid-day Christmas Day, and plunging the Dallas/Ft. Worth roads into a virtual ice skating rink.

As for the Christmas holiday shopping season, Sarah Perez with TechCrunch just reported that Amazon.com once again came out on top, in terms of online satisfaction.

No big surprise there.  I conducted a large portion of my own holiday shopping via Amazon, and received everything I ordered within a few days. I also treated myself to a set of Ben Hogan 1988 “redline” blade golf clubs, which I discovered on eBay for a very agreeable price. Unfortunately, the weather in Texas has kept me off the golf course (now back in Austin, I hope for that to change in the next few days!).

Of course, if you were trying to watch movies on Netflix on Monday, you might have found yourself watching a blank screen. Due to an Amazon Web Services outage, Netflix viewers were treated to bags full of coal starting around 3:30 PM on Monday, AWS’s third major outage this year.

Myself, I went on a “Redbox” binge over the holiday, discovering some recent titles for $1.20 a pop (including the latest Spiderman!), only to discover they’ll be bringing some competition to the streaming realm with the introduction of “Redbox Instant,” expected to go into private beta sometime soon. Redbox Instant is expected to match Netflix’s monthly streaming subscription price of $8 U.S.

Whatever your preference, it certainly looks like more and more Americans will be viewing filmed entertainment on devices other than their TVs. Another TechCrunch story reports that one in four Americans now owns a tablet computing device, with such devices now even having overtaken the number of e-reading devices like the Kindle (again, I did my fair share here over the holidays, giving out two Kindle Fire HDs as family gifts. Now I can only cross my fingers my family will use them!)

Regardless of your preference, the story goes on to say that one in three people in the U.S. now owns some kind of tablet or e-reading device, and this data before the full gamut of holiday shopping data has hit analysts’ spreadsheets.

One such analyst, Strategy Analytics, has Apple’s iPad still leading the pack, with Amazon and Samsung quickly narrowing that lead.

So what did Santa bring YOU for Christmas, and better yet, what did Santa YOU give others???

(Not) Home For The Holidays

I’m pretty happy I don’t have to travel today.  I’m going to wait until tomorrow, when all the turkeys have gotten off the road.

Of course, watch out for Wal-Mart and other big retail parking lots.  The consternation about having to work on Thanksgiving is pervasive, and I wouldn’t want to see any customers attempt to play Frogger in those big parking lots.  It’s dangerous enough just trying to get through the doors and into the store!

As always, my wise counsel is to shop from the comfort of your couch.

Walt Mossberg, the ever-dependable tech journalist with The Wall Street Journal, has written an article about “Making Sense of All the New Laptop Flavors.”

He goes on about the various flavors of Windows 8 PCs and tablets, before concluding that the “least costly Mac laptop” is the 11-inch MacBook Air, for $999.

I bought one just about a year ago, and I maintain it’s still the best, fastest, lightest, most dependable computer I’ve ever owned, and I’ve owned plenty.

If I had to do it all over again, I would have splurged for more SSD, but that’s it.

If you want to make sure your personal shopping engine is fully revved before Black Friday, Gizmodo’s providing its Ultimate Black Friday guide for geeks, grouping deals by category, and offering a list of when every retailer is slated to be open on Black Friday, just in case you prefer shopping in a mosh pit.

As for an update on my new Apple Mini-me “mini,” otherwise known as the 5th generation iPod touch, I can only say I have no buyer’s remorse, even now after having seen the iPad mini in the flesh.

The retina screen and the small form factor on the newest touch are working perfectly for me thus far. I bought a new “Need for Speed” racing game just to be able to check out the graphics in full force, and the retina screen is simply stunning (as are movies and Netflix streams). I’ve always read what a great gaming platform the touch is, but playing that racing game has cemented it.

Over the next several days, if you want to keep pace with IBM’s annual holiday campaign “Digital Analytics” benchmark, just follow IBM’s e-shopping analytics guru, @jay_henderson (a fellow Texan!).

Jay and his team will be working and posting reports throughout the weekend and into next week to keep us all informed how the holiday e-retail season is going. Jay’s already indicated we can expect to see growing numbers on the mobile and tablet shopping footprint this year.  You can read Jay’s holiday set up piece here.

That said, don’t ignore those retail emails piling up in your in-box — email continues to be the e-retail Trojan Horse, with lots of Black Friday and Cyber Monday deals already being distributed. From Amazon to Golfsmith, I’ve received a number of holiday email deals, and it’s all I can do to keep my credit card filed away in my anti-scanning wallet!

If you’re looking for gainful employment this pre-Thanksgiving Wednesday, you might want to try somewhere other than LinkedIn. LinkedIn’s Website had a “service unavailable” message this morning, and TechCrunch has been reporting a LinkedIn site outage.

As for me, I’ll be (mostly) disappearing from the cyber maze over the course of the next week. It’s my parent’s 50th wedding anniversary, and I’m taking them on a cruise in the Caribbean to celebrate. I may send a post or two via email if I’m so inspired, but mostly I’ll be spending some quality time with my parents and some extended family, and gazing out at the Gulf of Mexico in a pina colada-induced haze (virgin pina coladas, of course).

For all of my readers here in the United States, I wish you a very happy and restful holiday weekend. For those of you outside the U.S., enjoy the email and conference call silence from your U.S. colleagues…it won’t last long!

iPhone 5 Highway Robbery

So I followed some of the liveblogging for the Apple announcements earlier today, with the Apple iPhone 5 being the headline announcement.

I hope to later go back and watch the video webcast, as much interested in the theater of it as the details.

Overall, I walked away with the impression that it was a relatively impressive update from the iPhone 4, but I wasn’t convinced it was enough to compel people to upgrade.

I mentioned in a post a while back I’ve gone native, now using a “dumb phone” (an LG), because I had left AT&T, toyed with an Android on Virgin Mobile, before deciding on the LG dumb phone primarily for phone usage.

I still have my iPhone 4, which I use sometime for checking email and calendar, and reading or watching a movie on plane rides, but because I’m not as mobile as I used to be (not traveling as much), I didn’t feel compelled to need a smartphone.

Back to the 5. I didn’t see a compelling reason to upgrade with the new features — the bigger 4″ screen, the thinner form factor, LTE support, the new camera (including the admittedly cool panorama mode).

But just for grins, I clicked on the Apple application that let me checked what it would cost to go ahead and upgrade ahead of my current pre-rebate date (the date for which I could upgrade with the device actually being subsidized by Verizon).

Here’s what I found in the graphic you see here…hold on for the sticker shock:

I couldn’t get into a 5 for less than $649 until December 9, 2013…by that time, I suspect there will be an iPhone 6.

Even jumping back to the 4 would cost me $375!!!

And therein lies my distaste with the current mobile phone economics in these United States.

Hey, if I was traveling all the time and depending on those services the iPhone could offer remotely, I would consider it.

But recognizing I have other devices (the iPhone 4 using wi-fi, an Android tablet AND an iPad), no way, no how.

I suspect many Apple fan boys and girls will pay the pre-rebate price, and more power to them.

But my money would be better invested in a new mini iPad (apparently coming in October) or even the new iPod Touches also announced today.

But if you get an iPhone 5, be sure to give me a demo the next time you see me.

Waiting For The New iPhone 5?

So tomorrow’s the day.

We find out what the Apple iPhone 5 is all about.

Before we discover what the details behind the new Apple smartphone are, I thought it might be interesting to provide a quick glimpse at the state of the mobile marketplace here in the U.S.

I unearthed a blog post from TechCrunch from September 4th, citing the “latest data” from comScore that suggests Apple’s smartphone market share has grown to just over 33 percent, up 2 percent since April of this year.

That study surveyed over 30,000 U.S. mobile phone subscribers, which revealed that Google’s Android continues to keep the pace, holding 52 percent share, a 1.4 percent increase since April.

RIM, the maker of the BlackBerry, decline some 2.1 percent, down from 11.6 percent to 9.5 percent.

Microsoft’s Windows Mobile platform also saw a 0.4 percent decline in the same data, dropping from 4.0 percent to 3.6 percent.

And Symbian brings up the rear, down 0.5 percent, from 1.3 percent to 0.8 percent.

Despite the recent patent verdict, device maker Samsung is holding steady for smartphone device share at 25.6 percent in the latest period while Apple stood at 16.3 percent.

So what does Apple’s introduction of the iPhone 5 portend for the device market?

AppleInsider’s Neil Hughes wrote earlier today that the new iPhone will have “major implications throughout the personal electronics markets,” suggesting that existing LTE smartphones will come to be seen as “bulky and subpar” while stealing share not only from other smartphone makers, but also from PC makers like Dell and HP.

Hughes also cites J.P. Morgan analyst Mark Moskovitz in suggesting that the iPhone 5 “will offer better battery performance in a smaller form factor.”

In finding its way to new customers, Apple is also moving away from existing GPS service providers, and will instead transition to the new Maps application for iOS 6.

But will extended battery life and an Apple-owned GPS service be enough to lure loyal iPhone users to the new device, never mind Android loyalists happy with their current devices?

The answer to that question probably lies more in the emergence of new cloud and application offerings than the device characteristics themselves.

More interesting to me this past week, for example, was the report from The Wall Street Journal that Apple was looking to build its own streaming radio service, a move that seems to have helped drive Pandora’s share price down from a recent $12 high to just under $10.

Or consider the expectation Apple will introduce further synchronization between its iCloud offerings into the iOS mobile sphere, apps like Reminders, Notes, Mail, Calendar, and a new “Lost Mode,” which helps itinerant iPhone users find their lost phones.

I know I’ve found that Web-based services like Evernote and Remember the Milk, which synch across multiple devices and/or computers, provide much more utility than those dependent upon a single platform or device.

Whatever the details of the iPhone 5, the world will be watching closely, but my recommendation as one who’s used smartphones across the range of top competitors, including Apple, Android, and RIM, is to look beyond the device and underneath that larger intersection of IP-based services which transcend platform and help unearth the riches of true and unbound universal computing.

Pay As You Go

Thus far, this has been a pretty “mobilized” summer, with news breaking every day about the increasingly important role mobile computing is playing in our business and personal lives.

Today, we heard about the new Samsung Galaxy 10.1 tablet (even Walt Mossberg kinda likes it!), and TechMeme has early screenshots and guestimates about what the newer, smaller iPad’s going to look like.

But devices aren’t the whole picture. Infrastructure, application lifecycle management, security and privacy, and other related issues are key to mobile success. And, until these devices are enabled with an easier payment capability, money will be left on the table.

Lots of it.

Ironically, it’s been Apple that has been the closest to providing such a system thus far, with their Apple ID linkage to our credit cards.  But that’s just for the stuff I buy from Apple…what about everybody else?

So today, the Wall Street Journal’s Robin Sidel explained that more than a dozen big merchants are expecting to announce their plans to develop a mobile-payments network that would go up against the likes of Google.

Called the “Merchant Customer Exchange,” the new venture is being led by Wal-Mart, Target, 7-Eleven Inc., and Sunoco, and will attempt to find its way to a more standarized mobile payment system.

Though this may move may be an intended counter to Google’s Wallet capability on the Android platform, Sidel’s story reminds us we also have another joint venture called Isis, led by a number of telcos, as well as the recent $25 million investment by Starbucks in mobile payment start-up Square, also in the running.

And of course, let’s not forget some of those other existing systems which have millions of credit card accounts, including Amazon, whose 1-Click payment capability stands apart, and PayPal, with their unique person-to-person payments capability.

In this emerging roulette wheel of mobile payments, I’m not quite sure where I’d place my bets just yet, as the wheel’s just getting going.

But there’s a lot at stake.

I just attended comScore’s quarterly webcast on the “State of the U.S. Online Retail Economy.” For the second quarter of this year, nearly one in ten of all e-commerce dollars spent were done so via a mobile or tablet device.

Moreover, nearly two in five tablet owners have purchased something online via their device in the past month (a number more than double of that of smartphone owners).

One wonders if that smartphone purchasing number might not be a few percentage points higher were it easier to hand over one’s payment information via smartphone handsets.

Looking at the bigger picture for a moment, comScore also reported in the webcast that the channel shift to online appears to be accelerating, with online sales overall up 15 percent for the quarter, while on a comparable category basis, offline sales only increased two percent.

At the forthcoming IBM Smarter Commerce Global Summit in Orlando (see this post for more details), IBM has some 20+ sessions that contain a mobile component, including one entitled “Mobile Payments, An IBM POV” (IB-3440).

That event will be held September 5-7 at the Walt Disney Swan and Dolphin Resort in Orlando, Florida, and you can learn more about it here.

All About The Content Razorblades

The Interwebs platform wars continue to escalate.

Not days after I read Ken Auletta’s fine New Yorker piece on the U.S. antitrust suit against Apple and several book publishers for alleged price fixing — a scheme that clearly had Amazon and its Kindle Fire in its gunsights — do we discover that Amazon is working with Foxconn on its own mobile mousetrap, one that, like the Fire, would presumably provide easy access to all kinds of compelling content from Amazon’s vast cloud of digital entertainment.

Books, movies, gaming apps…Amazon’s play suggests that the Internet industry is moving into the razor/razorblade club, with the devices being the razors, and the razorblades being all that vast digital content.

I, personally, mostly don’t care which razor I use. I’ve owned tablets and smartphones both Android and iOS now, and most recently have given a Kindle (not the Fire) a test drive.

The most important element for me in the digital content wars are the depth and sophistication of the content libraries themselves.

That is to say, help me move beyond Amazon and Apples’  57 Channels On Demand and Nothing On!

Amazon’s bookstore, of course, has virtually the world’s book population at your disposal, so no complaints when it comes to reading (although I do agree we need healthy, competitive alternatives to the Amazon reading ecosystem).

But when I go into my Amazon Prime movie library, which lets me watch some movies for free with my Prime subscription, it’s like dragging the bottom of the movie barrel.

To some degree, I see the same problem with Netflix, although Netflix has seemed to have worked more diligently to expand its library.  Amazon Prime, on the other hand,  just added a bunch of new episodes of William F. Buckley’s “Firing Line.”

Woo hoo, where do I renew my subscription??!

The cloud providers may be lining to try and lock in as many denizens as they can via their device and subscription services, but the form factor is less important than the catalog function.

What’s kept me from cutting my own cord on the TV is the fact that the Netflix’s and Amazons of the world don’t have enough diversity of content (never mind live event access to major sporting events, which for my money are msotly worth the high cost of monthly cable subscriptions alone).

So if the Apples and Googles and Amazons really want to move these markets, they need to quickly hire some sophisticated business development executives and hard-driving attorneys who can  make some negotiation headway in the hills of Hollywood’s film libraries  rather than try to draw lines around the device footprints.

It’s never about the razors, always about the razorblades.

Google’s New “Jelly Bean”

So did anybody else watch that Google I/O keynote earlier today from the Moscone Center in San Francisco?

Apparently, so, because at one point there were nearly 100,000 concurrent viewings on YouTube.

Yes, I said, 100,000.  Pretty impressive for a developer’s conference.

I’ll get to some of the key Android announcements momentarily…first, the show stealer, which for my money (and of which there’s not a whole lot), one-upped Apple’s keynotes in a way they’ll likely never be able to match.

As the team was preparing to introduce the much-discussed Google Glasses (which I hope, one day, I’ll be able to wear on the golf course and announce to my technophobe father exactly how many yards his shot is to the pin without missing a beat), Sergey Brin cut away to an airplane flying high over the skies of San Francisco, all featured in a Google Events Hangout.

I presumed the cutaway was Memorex, but soon found out differently.

The skydivers jumped from the plane, flew in their birdsuits a little ways, then opened their chutes and landed safely on a roof by or at the Moscone Center.

They delivered the Google Glasses to some manic BMX mountain bikers, who jumped a couple of roofs before handing them over to some dudes who were hanging by some ropes.

Before too long, they all came busting into the live keynote and up on the stage to deliver the glasses.

I’ll never think of my FedEx delivery guy the same again.

I guess everyone at Google Marketing and PR was pretty confident all their skydivers’ chutes would open and no Google Glasses were going to go splat along with their mules.  That, or they had a contingency plan to cutaway to poor voice-challenged CEO Larry Page trying to pick up the slack via ASL.

Like I said, the whole stunt got my attention.

There were a range of interesting announcements, including the Glasses (available to developers attending I/O sometime next year), the new Google streaming media player (Yawn), and Google’s own Nexus 7 (is that one step behind Windows8?) tablet.

But the new Android, 4.1, AKA “Jelly Bean,” was the storyline I found most interesting.

Google announced “Project Butter” as the new innovation in 4.1, which helps make transitions and animations in the Android OS run more smoothly (at a cool 60 frames per second).

Googlers also demonstrated more responsive widgets (I hate to wait on any mobile device app!), which users can drag and drop and move around on their home screen.

Android Heavens, open up and save me from thith mobile lag!

The Google voice recognition engine is now going offline, which means you can transcribe to your heart’s content without being connected to the Interwebs.

“Android, go beat up Siri and then send me some funny pics of such that I can view on my newfangled Android 4.1 home screen and share them via my non-lagging new Facebook app on Jelly Bean!”

The new “Google Now” was also a cool new feature, which allows you tor bring up new “cards” that contain relevant and timely information (“How tall is the Empire State Building?”).

If Trivial Pursuit ever makes a comeback, I want to play the Google Now-assisted edition!

Google Now also takes advantage of temporal and physical data it knows to make friendly suggestions to you.  For example, when it’s lunchtime, Google Now could suggest some local restaurants nearby and let you easily make reservations to go there.

I’d suggest you view the video below to learn more about Google Now, but despite my preference to stick with the Apple iPlatforms, me likey the new “Jelly Bean” and hope Apple responds with some similar features in a future iOS release.

Get Real With Your Mobile Strategy

As someone who regularly monitors and communicates key trends in the digital marketing environment with IBM, I obviously have to keep pace (as best I can!) with those emerging arenas that I think are going to have an impact in our (IBM’s), and the industry’s, ability to communicate effectively, efficiently, and to the right audience.

The emerging mobile space is a good example of one of those trends.  With the advent of the iPhone in 2007, and later the Android platform and, more recently, the rapid adoption of tablet computers like the iPad and now Microsoft’s “Surface,” the opportunity to market and communicate through these devices is enormous.

But the opportunity doesn’t just end with marketing. Companies around the globe are also realizing mobile computing can change business in fundamental ways.

Enterprise Mobility: A Top Strategic Priority

In our recent CIO study of more than 3,000 CIOs, IBM discovered that 75 percent of respondents asserted that mobility is a top priority in their business strategy.

But, there are significant challenges.  New platforms and operating systems are emerging all the time, security and privacy are critical issues of concern to business leaders, and there’s a need to maximize development investments for the mobile platform.

IBM has been communicating more aggressively about this opportunity, and our own Bob Sutor has been a critical thought leader for IBM in this space.

As some of you may remember, Scott Laningham and I interviewed Bob recently about IBM’s mobile strategy at the Impact 2012 event back in May.  You can find that interview below:

Bob’s blog is a must read for you mobile adherents, and you may also be interested in a specific post in which Bob articulated IBM’s mobile strategy.

Continuing IBM’s mobile drumbeat, we most recently partnered with eWeek to produce a short slide show that articulates some best practices in mobile deployment that Bob and his team developed, best practices based on extensive experience with real (and recent) customer engagements.

I’ll hit the wave tops for you below, but to read all the details, you’ll need to visit the full slideshow over at eWeek.

1. Don’t Compromise on User Experience. Good apps are engaging. They are designed for performance and customized to deliver the functionality your users need in a simple and easy-to-use manner.
2. Support Different Development Approaches. Mobile apps are no longer an experiment. Companies are quickly realizing their value to different lines of business, both as productivity tools for employees and engagement channels facing customers.  Choosing a development approach for these apps entails many parameters such as budget, project timeframe, target audience and application functionality.
3. Build for Performance. Recent reports show that already today, mobile users are spending more time using apps than mobile browsers. Combined with projections that more than 50 percent of users will access the Web through mobile devices by the end of 2013, application performance has never been more crucial for your mobile initiative.
4. Enable Collaboration, Efficiency. Modern business applications are constantly changing, and they are rarely developed by a single person anymore.
5. Ensure Proper Authentication and Address Security Concerns. Whether employee- or customer-facing, mobile applications are quickly assuming the roles of many mission-critical systems in the enterprise. It is no wonder that authentication and security have become the top concerns of the mobile enterprise.
6. Close the HTML5 Gap. Commitment from all major mobile vendors, active standardization efforts and a growing ecosystem of third-party tools has been fueling recent success and adoption of HTML5.
7. Connect With Back-End and Cloud-Based Systems. Mobile business apps are not independent entities. They should be tightly connected to a variety of existing back-end and cloud-based systems.
8. Manage Mobile Apps, Devices, Data. Managing applications after they are downloaded and installed on devices has become critical, with the bring-your-own-device (BYOD) trend specifically challenging IT departments. A growing number of organizations are starting to adopt a combination of management approaches, both on the application level and the device level.
9. Evaluate Supporting Services. The mobile channel is transforming the way companies are doing business, and with that transformation, new challenges arise on both the business and the IT levels.
10. Protect Your Investment. As the mobile landscape develops, success lies in the ability to adapt to change.

IBM: Goin’ Mobile…and Then Some

IBM has been steadily investing in the mobile space over the past decade — not as a device manufacturer, but as a provider of mobile enterprise application and platform technologies, including tools for developing software in the mobile realm, and also to provide endpoint management (management of all those various and sundry devices your employees are now bringing to the office and expecting you in IT to support!).

We acquired Worklight in February to help more quickly deliver mobile application management capabilities across a range of industries, and as eWeek observes, Worklight’s software “enables organizations to efficiently create and run HTML5, hybrid and native applications for smartphones and tablets with industry-standard technologies and tools.”

If you’re looking to get into the mobile game, a good place to start is our webcast, “Harnessing the Power of Mobile in the Enterprise.” (Registration required)

Warning Against Your Insecurities: The 2011 IBM X-Force Trend And Risk “Poltergeist”

WARNING: This is an exceptionally long post intended for security and privacy geeks everywhere, including sys admins, Internet security hawks, CIOs, and innocent but interested bystanders everywhere.  No web servers were hacked in the preparation of this report: at least, none by me!

Okay, troopers, it’s that time of year again.  You know, the time when IBM releases its report card for security incidents, the X-Force Trend and Risk Report.

Google has the search “Zeitgeist” every year, we have the security “poltergeist!”

This time around, we’re looking back at the wild and wacky 2011, a year which showed surprising improvements in several areas of Internet security. Improvements, you ask?  Surely you jest, Turbo.

This figure from the 2011 IBM X-Force Trend And Risk Report shows a steady decline in the instances of input control related vulnerabilities such as cross-site scripting (XSS) and SQL injection since X-Force began recording these statistics in 2007. In 2011, the statistics suggest that the likelihood of encountering XSS in a given test continues to decrease but shows signs of leveling out at approximately a 40 percent chance of occurring. Injection vulnerabilities and specifically SQL injection appears to have leveled out at around a 20 percent chance of occurring in a given test.

No, no, there IS some good news.  Like a reduction in application security vulnerabilities, exploit code and spam.

But, good news leads to less good news on this front, as many of you who follow security well know, because the bad guys are being forced to rethink their tactics by targeting more niche IT loopholes and emerging technologies such as social networks and mobile devices.

The Top Line: Less Spam, More Adaptation

To get specific, the X-Force 2011 Trend and Risk Report demonstrated a 50 percent decline in spam email compared to 2010.

2011’s poltergeist saw a diligent patching of security vulnerabilities by software vendors, with only 36 percent of those vulnerabilities remaining unpatched in 2011 (compared to 43 percent in 2010).  The year also saw a higher quality of software application code, as seen in web-app vulnerabilities called “cross-site scripting” that were half as likely to exist in clients’ software as they were four years ago.

So, the net is, the bad guys are adapting their techniques to the changing tech environment. The report uncovered a rise in emerging attack trends including mobile exploits, automated password guessing, and a surge in phishing attacks.

It also witnessed an increase in automated shell command injection attacks against web servers, which may well be a response to successful efforts to close off other kinds of Web app vulnerabilities.

The Security Landscape Glass Half Full: Decrease In Unpatched Vulnerabilities, Exploit Code, And Spam

Getting even more specific, according to the report, there are several positive trends as companies adjusted their security policies in 2011:

• Thirty percent decline in the availability of exploit code. When security vulnerabilities are disclosed, exploit code is sometimes released that attackers can download and use to break into computers. Approximately 30 percent fewer exploits were released in 2011 than were seen on average over the past four years. This improvement can be attributed to architectural and procedural changes made by software developers that help make it more difficult for attackers to successfully exploit vulnerabilities.
• Decrease in unpatched security vulnerabilities. When security vulnerabilities are publicly disclosed, it is important that the responsible software vendor provide a patch or fix in a timely fashion. Some security vulnerabilities are never patched, but the percentage of unpatched vulnerabilities has been decreasing steadily over the past few years. In 2011 this number was down to 36 percent from 43 percent in 2010.
• Fifty percent reduction in cross site scripting (XSS) vulnerabilities due to improvements in software quality. The IBM X-Force team is seeing significant improvement in the quality of software produced by organizations that use tools like IBM AppScan OnDemand service to analyze, find, and fix vulnerabilities in their code.  IBM found XSS vulnerabilities are half as likely to exist in customers’ software as they were four years ago. However, XSS vulnerabilities still appear in about 40 percent of the applications IBM scans. This is still high for something well understood and able to be addressed.
• Decline in spam. IBM’s global spam email monitoring network has seen about half the volume of spam email in 2011 that was seen in 2010. Some of this decline can be attributed to the take-down of several large spam botnets, which likely hindered spammers’ ability to send emails. The IBM X-Force team witnessed spam evolve through several generations over the past seven years as spam filtering technology has improved and spammers have adapted their techniques in order to successfully reach readers.

The Security Landscape Glass Half Empty: Attackers Adapt Their Techniques in 2011

Even with these improvements, there has been a rise in new attack trends and an array of significant, widely reported external network and security breaches.

This figure from the 2011 IBM X-Force Trend And Risk Report shows an increase in mobile operating system exploits in 2011 due to an uptick in malicious activity targeting mobile devices. Because of the two-tiered relationship between phone end users, telecommunications companies, and mobile operating system vendors, disclosed mobile vulnerabilities can remain unpatched on phones for an extended period of time, providing a large window of opportunity to attackers.

As malicious attackers become increasingly savvy, the IBM X-Force documented increases in three key areas of attack activity:

• Attacks targeting shell command injection vulnerabilities more than double. For years, SQL injection attacks against web applications have been a popular vector for attackers of all types. SQL injection vulnerabilities allow an attacker to manipulate the database behind a website. As progress has been made to close those vulnerabilities – the number of SQL injection vulnerabilities in publicly maintained web applications dropped by 46 percent in 2011– some attackers have now started to target shell command injection vulnerabilities instead. These vulnerabilities allow the attacker to execute commands directly on a web server. Shell command injection attacks rose by two to three times over the course of 2011. Web application developers should pay close attention to this increasingly popular attack vector.
• Spike in automated password guessing – Poor passwords and password policies have played a role in a number of high-profile breaches during 2011. There is also a lot of automated attack activity on the Internet in which attacks scan the net for systems with weak login passwords. IBM observed a large spike in this sort of password guessing activity directed at secure shell servers (SSH) in the later half of 2011.
• Increase in phishing attacks that impersonate social networking sites and mail parcel services – The volume of email attributed to phishing was relatively small over the course of 2010 and the first half of 2011, but phishing came back with a vengeance in the second half, reaching volumes that haven’t been seen since 2008. Many of these emails impersonate popular social networking sites and mail parcel services, and entice victims to click on links to web pages that may try to infect their PCs with malware. Some of this activity can also be attributed to advertising click fraud, where spammers use misleading emails to drive traffic to retail websites.

Emerging Technologies Create New Avenues for Attacks

New technologies such as mobile and cloud computing continue to create challenges for enterprise security.

• Publicly released mobile exploits rise 19 percent in 2011. This year’s IBM X-Force report focused on a number of emerging trends and best practices to manage the growing trend of “Bring your Own Device,” or BYOD, in the enterprise. IBM X-Force reported a 19 percent increase over the prior year in the number of exploits publicly released that can be used to target mobile devices. There are many mobile devices in consumers’ hands that have unpatched vulnerabilities to publicly released exploits, creating an opportunity for attackers. IT managers should be prepared to address this growing risk.
• Attacks increasingly relate to social media – With the widespread adoption of social media platforms and social technologies, this area has become a target of attacker activity. IBM X-Force observed a surge in phishing emails impersonating social media sites. More sophisticated attackers have also taken notice. The amount of information people are offering in social networks about their personal and professional lives has begun to play a role in pre-attack intelligence gathering for the infiltration of public and private sector computing networks.
• Cloud computing presents new challenges – Cloud computing is moving rapidly from emerging to mainstream technology, and rapid growth is anticipated through the end of 2013. In 2011, there were many high profile cloud breaches affecting well-known organizations and large populations of their customers. IT security staff should carefully consider which workloads are sent to third-party cloud providers and what should be kept in-house due to the sensitivity of data. Cloud security requires foresight on the part of the customer as well as flexibility and skills on the part of the cloud provider. The IBM X-Force report notes that the most effective means for managing security in the cloud may be through Service Level Agreements (SLAs) because of the limited impact that an organization can realistically exercise over the cloud computing service. Therefore, careful consideration should be given to ownership, access management, governance and termination when crafting SLAs. The IBM X-Force report encourages cloud customers to take a lifecycle view of the cloud deployment and fully consider the impact to their overall information security posture.

The IBM X-Force 2011 Trend and Risk Report is based on intelligence gathered by one of the industry’s leading security research teams through its research of public vulnerability disclosures findings from more than 4,000 clients, and the monitoring and analysis of an average of 13 billion events daily in 2011.

“In 2011, we’ve seen surprisingly good progress in the fight against attacks through the IT industry’s efforts to improve the quality of software,” said Tom Cross, manager of Threat Intelligence and Strategy for IBM X-Force. “In response, attackers continue to evolve their techniques to find new avenues into an organization. As long as attackers profit from cyber crime, organizations should remain diligent in prioritizing and addressing their vulnerabilities.”

You can learn more about IBM Security Solutions here.