Zuna

zuna

This paper is available on arxiv under CC BY-NC-SA 4.0 DEED license. Authors: (1) Ke Hong, Tsinghua University & Infinigence-AI; (2) Guohao Dai, Shanghai Jiao Tong University & Infinigence-AI; (3) Jiaming Xu, Shanghai Jiao Tong University & Infinigence-AI; (4) Qiuli Mao, Tsinghua University & Infinigence-AI; (5) Xiuhong Li, Peking University; (6) Jun Liu, Shanghai Jiao Tong University & Infinigence-AI; (7) Kangdi Chen, Infinigence-AI; (8) Yuhan Dong, Tsinghua University; (9) Yu Wang, Tsinghua University. Table of Links Abstract & Introduction Backgrounds Asynchronized Softmax with Unified Maximum Value Flat GEMM Optimization with Double Buffering Heuristic Dataflow with Hardware Resource Adaption Evaluation Related Works Conclusion & References 8 Conclusions We propose FlashDecoding++, a fast Large Language Model inference engine in this paper. FlashDecoding++ accelerates mainstream LLMs with multiple hardware backend support. FlashDecoding++ proposes three novel designs: the asynchronized softmax with unified max value, the flat GEMM optimization with double buffering, and the heuristic dataflow with hardware resource adaption, achieving up to × and × speedup on NVIDIA and AMD GPUs compared with Hugging Face implementations. FlashDecoding++ also achieves an average of × speedup compared with state-of-the-art LLM inference engines, FlashDecoding, on various LLMs. 4.86 2.18 1.37 References [1] Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. Llama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288, 2023. [2] Arun James Thirunavukarasu, Darren Shu Jeng Ting, Kabilan Elangovan, Laura Gutierrez, Ting Fang Tan, and Daniel Shu Wei Ting. Large language models in medicine. Nature medicine, 29(8):1930–1940, 2023. [3] Rohan Anil, Andrew M. Dai, Orhan Firat, Melvin Johnson, Dmitry Lepikhin, Alexandre Passos, Siamak Shakeri, Emanuel Taropa, Paige Bailey, Zhifeng Chen, Eric Chu, Jonathan H. Clark, Laurent El Shafey, Yanping Huang, Kathy Meier-Hellstern, Gaurav Mishra, Erica Moreira, Mark Omernick, Kevin Robinson, Sebastian Ruder, Yi Tay, Kefan Xiao, Yuanzhong Xu, Yujing Zhang, Gustavo Hernandez Abrego, Junwhan Ahn, Jacob Austin, Paul Barham, Jan Botha, James Bradbury, Siddhartha Brahma, Kevin Brooks, Michele Catasta, Yong Cheng, Colin Cherry, Christopher A. Choquette-Choo, Aakanksha Chowdhery, Clément Crepy, Shachi Dave, Mostafa Dehghani, Sunipa Dev, Jacob Devlin, Mark Díaz, Nan Du, Ethan Dyer, Vlad Feinberg, Fangxiaoyu Feng, Vlad Fienber, Markus Freitag, Xavier Garcia, Sebastian Gehrmann, Lucas Gonzalez, Guy Gur-Ari, Steven Hand, Hadi Hashemi, Le Hou, Joshua Howland, Andrea Hu, Jeffrey Hui, Jeremy Hurwitz, Michael Isard, Abe Ittycheriah, Matthew Jagielski, Wenhao Jia, Kathleen Kenealy, Maxim Krikun, Sneha Kudugunta, Chang Lan, Katherine Lee, Benjamin Lee, Eric Li, Music Li, Wei Li, YaGuang Li, Jian Li, Hyeontaek Lim, Hanzhao Lin, Zhongtao Liu, Frederick Liu, Marcello Maggioni, Aroma Mahendru, Joshua Maynez, Vedant Misra, Maysam Moussalem, Zachary Nado, John Nham, Eric Ni, Andrew Nystrom, Alicia Parrish, Marie Pellat, Martin Polacek, Alex Polozov, Reiner Pope, Siyuan Qiao, Emily Reif, Bryan Richter, Parker Riley, Alex Castro Ros, Aurko Roy, Brennan Saeta, Rajkumar Samuel, Renee Shelby, Ambrose Slone, Daniel Smilkov, David R. So, Daniel Sohn, Simon Tokumine, Dasha Valter, Vijay Vasudevan, Kiran Vodrahalli, Xuezhi Wang, Pidong Wang, Zirui Wang, Tao Wang, John Wieting, Yuhuai Wu, Kelvin Xu, Yunhan Xu, Linting Xue, Pengcheng Yin, Jiahui Yu, Qiao Zhang, Steven Zheng, Ce Zheng, Weikang Zhou, Denny Zhou, Slav Petrov, and Yonghui Wu. Palm 2 technical report, 2023. [4] Jan Clusmann, Fiona R Kolbinger, Hannah Sophie Muti, Zunamys I Carrero, Jan-Niklas Eckardt, Narmin Ghaffari Laleh, Chiara Maria Lavinia Löffler, Sophie-Caroline Schwarzkopf, Michaela Unger, Gregory P Veldhuizen, et al. The future landscape of large language models in medicine. Communications Medicine, 3(1):141, 2023. [5] Can Cui, Yunsheng Ma, Xu Cao, Wenqian Ye, and Ziran Wang. Receive, reason, and react: Drive as you say with large language models in autonomous vehicles. arXiv preprint arXiv:2310.08034, 2023. [6] OpenAI. Openai pricing. [Online], 2023. https://openai.com/pricing. [7] Nerdynav. Up-to-date chatgpt statistics and user numbers [oct 2023]. [Online], 2023. https://nerdynav.com/ chatgpt-statistics. [8] AFZAL AHMAD DYLAN PATEL. The inference cost of search disruption - large language model cost analysis. [Online], 2023. https://www.semianalysis.com/p/the-inference-cost-of-search-disruption. [9] Reza Yazdani Aminabadi, Samyam Rajbhandari, Ammar Ahmad Awan, Cheng Li, Du Li, Elton Zheng, Olatunji Ruwase, Shaden Smith, Minjia Zhang, Jeff Rasley, et al. Deepspeed-inference: enabling efficient inference of transformer models at unprecedented scale. In SC22: International Conference for High Performance Computing, Networking, Storage and Analysis, pages 1–15. IEEE, 2022. [10] Ying Sheng, Lianmin Zheng, Binhang Yuan, Zhuohan Li, Max Ryabinin, Beidi Chen, Percy Liang, Christopher Re, Ion Stoica, and Ce Zhang. Flexgen: High-throughput generative inference of large language models with a single gpu. 2023. [11] Woosuk Kwon, Zhuohan Li, Siyuan Zhuang, Ying Sheng, Lianmin Zheng, Cody Hao Yu, Joseph Gonzalez, Hao Zhang, and Ion Stoica. Efficient memory management for large language model serving with pagedattention. In Proceedings of the 29th Symposium on Operating Systems Principles, pages 611–626, 2023. [12] Sensetime. Openppl: A high-performance deep learning inference platform. [Online], 2023. https://openppl. ai/home. [13] Tri Dao, Daniel Haziza, Francisco Massa, and Grigory Sizov. Flash-decoding for long-context inference. [Online], 2023. https://crfm.stanford.edu/2023/10/12/flashdecoding.html. [14] Neal Vaidya, Fred Oh, and Nick Comly. Optimizing inference on large language models with nvidia tensorrt-llm, now publicly available. [Online], 2023. https://github.com/NVIDIA/TensorRT-LLM. [15] Sensetime. A light and fast inference service for llm. [Online], 2023. https://github.com/ModelTC/ lightllm. [16] Text generation inference: Fast inference optimize for llms. [Online], 2023. https://github.com/ huggingface/text-generation-inference/. [17] Mlc llm: Machine learning compilation for large language models. [Online], 2023. https://github.com/ mlc-ai/mlc-llm. [18] Tri Dao, Dan Fu, Stefano Ermon, Atri Rudra, and Christopher Ré. Flashattention: Fast and memory-efficient exact attention with io-awareness. Advances in Neural Information Processing Systems, 35:16344–16359, 2022. [19] Tri Dao. Flashattention-2: Faster attention with better parallelism and work partitioning. arXiv preprint arXiv:2307.08691, 2023. [20] Aaron Pham, Chaoyu Yang, Sean Sheng, Shenyang Zhao, Sauyon Lee, Bo Jiang, Fog Dong, Xipeng Guan, and Frost Ming. OpenLLM: Operating LLMs in production, June 2023. [21] Zihang Dai, Zhilin Yang, Yiming Yang, Jaime Carbonell, Quoc V Le, and Ruslan Salakhutdinov. Transformer-xl: Attentive language models beyond a fixed-length context. arXiv preprint arXiv:1901.02860, 2019. [22] Z Dong, T Tang, L Li, and WX Zhao. A survey on long text modeling with transformers. arxiv 2023. arXiv preprint arXiv:2302.14502. [23] Guangxuan Xiao, Yuandong Tian, Beidi Chen, Song Han, and Mike Lewis. Efficient streaming language models with attention sinks. arXiv preprint arXiv:2309.17453, 2023. [24] NVIDIA. cublas: Basic linear algebra on nvidia gpus. [Online], 2017. https://developer.nvidia.com/ cublas. [25] NVIDIA. Cutlass: Cuda templates for linear algebra subroutines. [Online], 2017. https://github.com/ NVIDIA/cutlass. [26] Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances in neural information processing systems, 30, 2017. [27] Vinod Nair and Geoffrey E Hinton. Rectified linear units improve restricted boltzmann machines. In Proceedings of the 27th international conference on machine learning (ICML-10), pages 807–814, 2010. [28] Dan Hendrycks and Kevin Gimpel. Gaussian error linear units (gelus). arXiv preprint arXiv:1606.08415, 2016. [29] Prajit Ramachandran, Barret Zoph, and Quoc V Le. Searching for activation functions. arXiv preprint arXiv:1710.05941, 2017. [30] John Bridle. Training stochastic model recognition algorithms as networks can lead to maximum mutual information estimation of parameters. Advances in neural information processing systems, 2, 1989. [31] Stephen Merity, Caiming Xiong, James Bradbury, and Richard Socher. Pointer sentinel mixture models, 2016. [32] NVIDIA. Nvidia tensor core. [Online], 2023. https://www.nvidia.com/en-us/data-center/ tensor-cores/. [33] NVIDIA. Fastertransformer: About transformer related optimization, including bert, gpt. [Online], 2017. https://github.com/NVIDIA/FasterTransformer. [34] Siping Wang. Fastgemv: High-speed gemv kernels. [Online], 2023. https://github.com/wangsiping97/ FastGEMV. [35] Thomas Wolf, Lysandre Debut, Victor Sanh, Julien Chaumond, Clement Delangue, Anthony Moi, Pierric Cistac, Tim Rault, Remi Louf, Morgan Funtowicz, Joe Davison, Sam Shleifer, Patrick von Platen, Clara Ma, Yacine Jernite, Julien Plu, Canwen Xu, Teven Le Scao, Sylvain Gugger, Mariama Drame, Quentin Lhoest, and Alexander Rush. Transformers: State-of-the-art natural language processing. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing: System Demonstrations, pages 38–45, Online, October 2020. Association for Computational Linguistics. [36] Susan Zhang, Stephen Roller, Naman Goyal, Mikel Artetxe, Moya Chen, Shuohui Chen, Christopher Dewan, Mona Diab, Xian Li, Xi Victoria Lin, Todor Mihaylov, Myle Ott, Sam Shleifer, Kurt Shuster, Daniel Simig, Punit Singh Koura, Anjali Sridhar, Tianlu Wang, and Luke Zettlemoyer. Opt: Open pre-trained transformer language models, 2022. [37] Zhengxiao Du, Yujie Qian, Xiao Liu, Ming Ding, Jiezhong Qiu, Zhilin Yang, and Jie Tang. Glm: General language model pretraining with autoregressive blank infilling. In Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 320–335, 2022. [38] NVIDIA. Nvidia tensorrt: An sdk for high-performance deep learning inference. [Online]. https://developer. nvidia.com/tensorrt.

FlashDecoding++: Faster Large Language Model Inference on GPUs: Conclusion & References

The market for Non-Fungible Tokens (NFTs) is growing rapidly. NFTs are unique digital assets, and no one can theoretically replicate them. Creators may use them to represent a variety of things, from virtual assets to real-world objects. As the demand for NFTs increases, so does the need for investors to understand how these tokens work. Here are five projects working on solutions for the NFT space that investors will monitor in the coming months. ZunaVerse and the ZunaNauts Collection Users of , a decentralized marketplace, may purchase and trade NFTs, which are digital assets with certain characteristics. The BNB Chain powers these assets, promising quick transactions with cheap costs. The objective of the marketplace is to provide services on par with Opensea. ZunaVerse For investors, the novelty and originality of Zunaverse's digital asset trading platform is a major selling point. Users of the platform can bypass middlemen and transact directly with one another to buy and sell NFTs. As a result, the marketplace presents itself as more productive and less expensive than alternatives. Zunaverse also hopes to increase its user base in the following years. The project also issued a proprietary token named “ZUNA.”  There are fewer costs and quicker transaction times for creators utilizing ZUNA. The ZunaNauts represent an innovative class of collectibles that promise to provide financial returns to their buyers. This collection only features 1969 different astronauts.  Its long-term reward structure aims to win over collectors and financial backers. Those who choose to mint and hold a ZunaNaut NFT will receive 12 months of $ZUNA rewards + “partial ownership” of ZUNAVERSE.io by earning a percentage of every BNB/BSC transaction that takes place on the NFT Marketplace. VeeFriends When Gary Vaynerchuk decided to create , he explained he had a clear vision in his mind. Specifically, his main goal was to provide a platform for people to connect and engage with each other. VeeFriends With VeeFriends, each NFT has a specific message and meaning. The metadata attached to it gives holders access to different levels of activities and content. VeeFriends bets on a decentralized platform that allows users to interact directly with one another. This is in contrast to centralized platforms like Facebook and other similar Web2 portals. On these websites, users can only communicate with other users whom the platform has approved. With VeeFriends, there are no restrictions on whom people can communicate with. In other words, investors can freely connect with people from all over the world. Another feature of VeeFriends is that it uses the Ethereum blockchain. This means that all NFTs rely on ERC-721 compliant contracts, which is the "gold standard" for digital collectibles. Additionally, the project records all transactions on the blockchain in an attempt to enhance investment security. Kibatsu Mecha is an animated series of NFTs on the Ethereum blockchain. They inhabit Megacity Kibatsu and its surrounding territories, fighting in the Ataki Arena. Each character is hand-generated and uniquely animated. Kibatsu Mecha The lore of Kibatsu Megacity is rich and detailed, with each character having their motivations for fighting. The artist, Jerry Liu, is a motion graphics specialist who has dedicated his time to developing the Kibatsu Corp. brand and story. The Kibatsu Mecha are strange and wacky creatures, each with a combination of 7 traits. They are meticulously hand-generated and designed with care and intention. No two Kibatsu Mecha are alike, and some are rarer than others. The Mechas are an integral part of the lore of Megacity Kibatsu, and their pilots fight for many different reasons. The Mechas represent the artist's hard work and dedication to developing the Kibatsu Corp. brand. Moonbirds " " is a rare and unique collection designed for collectors and investors. Moonbirds have various features, including private club membership and exclusive access to upcoming PROOF projects. Moonbirds Moonbirds are popular because they offer a wise combination of features and benefits. In addition to private club membership and exclusive access to upcoming projects, Moonbirds also offer enhanced drops and rewards. This makes them an appealing investment for anyone interested in this sector. There are different reasons why people invest in Moonbirds. First and foremost, crypto enthusiasts believe these NFTs offer a unique and valuable investment opportunity. As mentioned above, Moonbirds come with various features and benefits that make them an attractive project for collectors and investors. In addition to their investment potential, Moonbirds are also a way to support the PROOF metaverse project. By investing in Moonbirds, traders will be helping to finance the development of the PROOF metaverse. Creature World The is an upcoming virtual dimension for NFTs created by Danny Cole. Danny is a young artist with an impressive resume, and the Creature World project has been developing for several years. Creature World The project is unique because there is no roadmap or mission statement for all to see. Instead, the project exists purely as artwork. In other words, the value of the NFTs entirely comes from their rarity and collectibility. Many people are hesitant to invest in projects like Creature World. This is because they don't see any value in such a seemingly messy NFT project. However, other investors believe that this collection will be successful due to the passion and creativity of Danny Cole. Danny Cole is free to explore new ideas by not having a set plan. This trick allows him to add value to the project in ways he could never have imagined. This flexibility will be crucial for Creature World to stay ahead of the competition and continue to grow in popularity. Danny Cole has exhibited his artwork at numerous art shows and festivals and worked with Kanye West's stage designer. Bottom Line There are various projects to invest in when it comes to NFTs. The bottom line is that the NFT market is so large that there is a collection for everyone. Roadmap-free initiatives, marketplaces, metaverse-based projects: this sector is trying to appeal to a large audience. Each of these projects has the potential to be successful, but traders should run their research before investing any money. Only those who understand what each project entails and the perks it offers can build a . great NFT strategy

5 NFT Projects For NFT Enthusiasts in 2022

The HackerNoon Newsletter: Zuzalu is Dead. Long Live Zuzalu! - Metamorphosis Commenced v3 (11/6/2024)

Zuzalu is Dead. Long Live Zuzalu! - Metamorphosis Commenced v3

Zuzalu is dood. Lank lewe Zuzalu! - Metamorfose begin v3

Зузалу мёртвы. Жыве Зузалу! - Метамарфоза пачалася v3

Ο Ζουζαλού είναι νεκρός. Ζήτω ο Ζουζαλού! - Metamorphosis Commenced v3

Zuzalu ha muerto. ¡Viva Zuzalu! - Metamorfosis comenzada v3

Zuzalu Hil da. Bizi Zuzalu! - Metamorfosia hasita v3

زوزالو مرده است زنده باد زوزالو - Metamorphosis Commenced v3

Zuzalu è morto. Lunga vita a Zuzalu! - Metamorfosi iniziata v3

ズザルは死んだ。ズザル万歳！ - 変身開始 v3

Zuzalu ແມ່ນຕາຍ. ອາຍຸຍືນ Zuzalu! - Metamorphosis ເລີ່ມ v3

Zuzalu yra miręs. Tegyvuoja Zuzalu! - Metamorfozė prasidėjo v3

Zuzalu a murit. Trăiască Zuzalu! - Metamorfoza a început v3

Zuzalu Öldü. Yaşasın Zuzalu! - Metamorfoz Başladı v3

Apparate: Early-Exit Models for ML Latency and Throughput Optimization - Conclusion, References

Metamorphosis Commenced, vol2: Crecimiento Aleph Review & Q4 in Lisbon and Thailand

Metamorphosis Commended, vol2: Crecimiento Aleph Review & Q4 v Lisabonu a Thajsku

Metamorphosis Commenced, τόμος 2: Crecimiento Aleph Review & Q4 στη Λισαβόνα και την Ταϊλάνδη

Metamorfosis iniciada, vol. 2: Revisión y cuarto trimestre de Crecimiento Aleph en Lisboa y Tailandia

Metamorphosis Commenced, vol2: Crecimiento Aleph Review & Q4 en Lisboa e Tailandia

変身開始、第2巻：クレシミエント・アレフのレビューとリスボンとタイでの第4四半期

Метаморфоз басталды, 2-том: Crecimiento Aleph шолуы және Лиссабондағы және Таиландтағы 4-тоқсан

Metamorphosis ເລີ່ມຕົ້ນ, vol2: Crecimiento Aleph Review & Q4 ໃນ Lisbon ແລະປະເທດໄທ

میټامورفوسس پیل شوی، vol2: Crecimiento Aleph Review & Q4 په لیزبون او تایلینډ کې

Metamorfosis qallarisqa, vol2: Crecimiento Aleph Revisión & Q4 Lisboapi, Tailandiapipas

Metamorphosis Yakatangwa, vol2: Crecimiento Aleph Ongororo & Q4 muLisbon neThailand

Metamorfoza filloi, vëll 2: Crecimiento Aleph Review & Q4 në Lisbonë dhe Tajlandë

Metamorphosis bắt đầu, tập 2: Đánh giá Crecimiento Aleph & Q4 tại Lisbon và Thái Lan

This will be my last entry on the topic for a while. For context, I introduced the idea that folks don’t care about security; they care about outcomes in this post, and then I began exploring ways we, as IT practitioners, can shift the focus to the results and, therefore, contextualize the actions needed as something other than “security for the sake of security.” In this post, I’m continuing with that line of discussion. What can we DO to make our environments more secure, and how can we get our colleagues to understand and want to do it? Focus on Actual Risks and Realistic Outcomes (or: Don’t let “perfect” be the enemy of “good”) When doing your homework to build those aforementioned risk profiles, you need to be open to the possibility that whatever you’re trying to fix doesn’t represent a material risk or isn’t as big of a deal as you initially thought. On the other hand, sometimes the risk really *IS* that bad, yet the company seems unwilling to discuss it. There are two things to keep in mind: Remember that “accept” is one of the options for risk management. The trick is getting someone to sign off on that acceptance formally. Implicit acceptance is the worst kind of risk acceptance and is usually a sign of a communication breakdown. If the best you can get is a verbal “It’ll be fine; you worry too much!” then you might have a much more considerable risk on your hands:
Second, consider that the organization didn’t really hear (or internalize) what you’ve been saying. They’re refusing to listen now because they haven’t been part of the journey up to this point. Your next step isn’t to throw your hands up but rather to retrace your steps and discover where the disconnect happened. I won’t lie; this is where the politics and interpersonal element can be its most frustrating – it’s incredibly difficult to go back and reiterate everything you’ve already said, to go through the act of what feels like smoothing ruffled feathers and soothing fragile egos. But like ANY relationship, communication (and its lack) always sits at the point between moving forward and getting caught endlessly in the past. That doesn’t mean you have to be everyone’s punching bag. But just as I suggested at the beginning of this section, you need to be open to the reality that an issue you perceive to be a risk might not be that big of a deal; so to do you need to be open to the possibility that your first attempt to communicate didn’t work that well, and you need to admit that to everyone and try again. “We’re from the government, and we’re here to help.” As I hinted at earlier, NIST is aware of this issue and is attempting to bridge the gap between organizational/leadership goals and objectives and the value that infosec can provide. One of the primary outputs of this effort is the “Integrating Cybersecurity and Enterprise Risk Management” document. One of the authors, Bob Gardner, calls it “making the connection from the adversary to the wiring closet to the board room.” This document (along with other content in the 8286 series) underscores NIST’s understanding that what businesses want from cybersecurity is a contribution to risk management in terms of mitigation, avoidance, transfer, etc. The NIST series extends (and aligns with) an earlier plan, OMB Circular A-123, which directs Federal agencies to develop a formal “risk profile” (sound familiar?) and use it to combat cybersecurity threats. But the assistance and insight doesn’t end there. Sometimes, the answer to “what are we supposed to do about this” is hidden within the very security policies and frameworks companies are bound to comply with. Whether you’re talking about HIPAA, PCI-DSS, SOX, GDPR, or any one of the many other acts, provisions, or guidelines; there are usually goals and achievable objectives described. In this regard, Samuel Svarc points out: “These schemes don’t mandate specific technical steps (e.g., Advanced AV, password manager, etc.) but rather broad categories of requirements (“company will create reasonable password policies,” “company will take reasonable measures to secure computers from common threats,” etc.) that are open to interpretation… ” and yet provide a reasonably clear path forward. Furthermore, Svarc says, “…if a company can show that they conducted a real risk assessment which was then substantially followed, they will be treated differently than a company that didn’t. A company that has a current firewall, Advanced AV on workstations, ZTNA for remote workers, Bitlocker on all laptops, password managers, and FIDO keys with 2FA, normal logging monitored by competent SOC, is in a totally different place security-wise than a company that has laptops running around unencrypted, or without 2FA turned on (to mention two low hanging security steps).” Security by any other name A long-running discussion I’ve had with Kymberlee Price revolves around the definition of security and why we are (or should be) concerned about it at an organizational level. Security continues to be presented as a technology in its own right when, in fact, it’s truly about improving quality. “Quality code,” Price states with the authority of someone who’s spent over 25 years working in the security space, “is reliable. Quality code is secure.” She’s championed for a while, and it’s gaining traction in the industry at large. Tell a developer their code has a security issue, and you will not likely get more than a passing glance. After all, “shift left” was recognized as corporate double-speak for “one programmer does the work of two people for the same pay,” shortly after Larry Smith coined the term in 2001. Using it to mean developers should test their own code for security only increases the resistance. However, tell a developer their code has a quality issue, and you’ll have their full attention. “Security is actually quality by a different name” is more than a marketing spin; it’s a message meant for more than the coding crowd. If a business’ processes, policies, or products have overlooked or under-emphasized security, it’s highly likely that other aspects got short shrift as well. And that speaks to low quality. Conversely, if security has been fully considered, it’s far more likely the other aspects have also been reviewed and confirmed – if for no other reason than the fact that the job of security teams is to ensure those elements have been reviewed in the first place. What I’m getting at is that security is one of the fundamental aspects of any business, tightly bound to everything from design to delivery. Pretending otherwise and treating security as some completely separate discipline that’s divorced from poor outcomes in success, velocity, and even profitability is how we ended up in the current situation in the first place. Summary It’s difficult, if not impossible, to argue that backups aren’t important for the simple reason that the value they provide (i.e., the ability to restore data) is intuitively obvious to every level of the business, from executives on down. Security has failed to enjoy organizational support simply because the methods of creating a secure environment are much more complex, the types of threats are much more varied, and the surety of the outcomes is much less assured. In my opinion, this is due to the fact that the focus of so much of the infosec narrative has been on the technology and its delivery. This is equivalent to the backup operators making their case by describing the differences in DAT tapes vs. optical vs cloud or the benefits of full backups vs. incremental vs differential. Again, nobody cares about that stuff. Instead, infosec practitioners should shift their narrative to emphasize the business benefits of quality, resilience, and increased value. Put succinctly: Nobody cares about security, but they sure as hell care about increasing revenue, reducing cost, and removing risk. Your job is to champion the truth that, in order to have those things (revenue, etc), the business needs to invest in security across the organization. This will be my last entry on the topic for a while. For context, I introduced the idea that folks don’t care about security; they care about outcomes in this post , and then I began exploring ways we, as IT practitioners, can shift the focus to the results and, therefore, contextualize the actions needed as something other than “security for the sake of security.” In this post, I’m continuing with that line of discussion. What can we DO to make our environments more secure, and how can we get our colleagues to understand and want to do it? in this post then I began exploring ways Focus on Actual Risks and Realistic Outcomes (or: Don’t let “perfect” be the enemy of “good”) (or: Don’t let “perfect” be the enemy of “good”) When doing your homework to build those aforementioned risk profiles, you need to be open to the possibility that whatever you’re trying to fix doesn’t represent a material risk or isn’t as big of a deal as you initially thought. On the other hand, sometimes the risk really *IS* that bad, yet the company seems unwilling to discuss it. There are two things to keep in mind: Remember that “accept” is one of the options for risk management. The trick is getting someone to sign off on that acceptance formally. Implicit acceptance is the worst kind of risk acceptance and is usually a sign of a communication breakdown. If the best you can get is a verbal “It’ll be fine; you worry too much!” then you might have a much more considerable risk on your hands: Second, consider that the organization didn’t really hear (or internalize) what you’ve been saying. They’re refusing to listen now because they haven’t been part of the journey up to this point. Your next step isn’t to throw your hands up but rather to retrace your steps and discover where the disconnect happened. Remember that “accept” is one of the options for risk management. The trick is getting someone to sign off on that acceptance formally. Implicit acceptance is the worst kind of risk acceptance and is usually a sign of a communication breakdown. If the best you can get is a verbal “It’ll be fine; you worry too much!” then you might have a much more considerable risk on your hands: Second, consider that the organization didn’t really hear (or internalize) what you’ve been saying. They’re refusing to listen now because they haven’t been part of the journey up to this point. Your next step isn’t to throw your hands up but rather to retrace your steps and discover where the disconnect happened. I won’t lie; this is where the politics and interpersonal element can be its most frustrating – it’s incredibly difficult to go back and reiterate everything you’ve already said, to go through the act of what feels like smoothing ruffled feathers and soothing fragile egos. But like ANY relationship, communication (and its lack) always sits at the point between moving forward and getting caught endlessly in the past. That doesn’t mean you have to be everyone’s punching bag. But just as I suggested at the beginning of this section, you need to be open to the reality that an issue you perceive to be a risk might not be that big of a deal; so to do you need to be open to the possibility that your first attempt to communicate didn’t work that well, and you need to admit that to everyone and try again. “We’re from the government, and we’re here to help.” As I hinted at earlier, NIST is aware of this issue and is attempting to bridge the gap between organizational/leadership goals and objectives and the value that infosec can provide. One of the primary outputs of this effort is the “ Integrating Cybersecurity and Enterprise Risk Management ” document. Integrating Cybersecurity and Enterprise Risk Management One of the authors, Bob Gardner, calls it “making the connection from the adversary to the wiring closet to the board room.” This document (along with other content in the 8286 series ) underscores NIST’s understanding that what businesses want from cybersecurity is a contribution to risk management in terms of mitigation, avoidance, transfer, etc. other content in the 8286 series The NIST series extends (and aligns with) an earlier plan, OMB Circular A-123 , which directs Federal agencies to develop a formal “risk profile” (sound familiar?) and use it to combat cybersecurity threats. OMB Circular A-123 But the assistance and insight doesn’t end there. Sometimes, the answer to “what are we supposed to do about this” is hidden within the very security policies and frameworks companies are bound to comply with. Whether you’re talking about HIPAA , PCI-DSS , SOX , GDPR , or any one of the many other acts, provisions, or guidelines; there are usually goals and achievable objectives described. security policies and frameworks HIPAA PCI-DSS SOX GDPR In this regard, Samuel Svarc points out: “These schemes don’t mandate specific technical steps (e.g., Advanced AV, password manager, etc.) but rather broad categories of requirements (“company will create reasonable password policies,” “company will take reasonable measures to secure computers from common threats,” etc.) that are open to interpretation… ” and yet provide a reasonably clear path forward. Furthermore, Svarc says, “…if a company can show that they conducted a real risk assessment which was then substantially followed, they will be treated differently than a company that didn’t. A company that has a current firewall, Advanced AV on workstations, ZTNA for remote workers, Bitlocker on all laptops, password managers, and FIDO keys with 2FA, normal logging monitored by competent SOC, is in a totally different place security-wise than a company that has laptops running around unencrypted, or without 2FA turned on (to mention two low hanging security steps).” Security by any other name A long-running discussion I’ve had with Kymberlee Price revolves around the definition of security and why we are (or should be) concerned about it at an organizational level. Security continues to be presented as a technology in its own right when, in fact, it’s truly about improving quality. “Quality code,” Price states with the authority of someone who’s spent over 25 years working in the security space, “is reliable. Quality code is secure.” She’s championed for a while, and it’s gaining traction in the industry at large. Kymberlee Price gaining traction Tell a developer their code has a security issue, and you will not likely get more than a passing glance. After all, “shift left” was recognized as corporate double-speak for “one programmer does the work of two people for the same pay,” shortly after Larry Smith coined the term in 2001. Using it to mean developers should test their own code for security only increases the resistance. Larry Smith coined the term However, tell a developer their code has a quality issue, and you’ll have their full attention. “Security is actually quality by a different name” is more than a marketing spin; it’s a message meant for more than the coding crowd. If a business’ processes, policies, or products have overlooked or under-emphasized security, it’s highly likely that other aspects got short shrift as well. And that speaks to low quality. Conversely, if security has been fully considered, it’s far more likely the other aspects have also been reviewed and confirmed – if for no other reason than the fact that the job of security teams is to ensure those elements have been reviewed in the first place. What I’m getting at is that security is one of the fundamental aspects of any business, tightly bound to everything from design to delivery. Pretending otherwise and treating security as some completely separate discipline that’s divorced from poor outcomes in success, velocity, and even profitability is how we ended up in the current situation in the first place. Summary It’s difficult, if not impossible, to argue that backups aren’t important for the simple reason that the value they provide (i.e., the ability to restore data) is intuitively obvious to every level of the business, from executives on down. Security has failed to enjoy organizational support simply because the methods of creating a secure environment are much more complex, the types of threats are much more varied, and the surety of the outcomes is much less assured. In my opinion, this is due to the fact that the focus of so much of the infosec narrative has been on the technology and its delivery. This is equivalent to the backup operators making their case by describing the differences in DAT tapes vs. optical vs cloud or the benefits of full backups vs. incremental vs differential. Again, nobody cares about that stuff. Instead, infosec practitioners should shift their narrative to emphasize the business benefits of quality, resilience, and increased value. Put succinctly: Nobody cares about security, but they sure as hell care about increasing revenue, reducing cost, and removing risk. Your job is to champion the truth that, in order to have those things (revenue, etc), the business needs to invest in security across the organization.

ACTING (like we care about) Securityms: Focusing on Risks, Outcomes, and Business Value

Textbooks Are All You Need: Conclusion and References

Bottling Trust: How Manufacturers Can Use QR Codes to Stamp Out Fake Drinks

One of the consequences of keeping your employees out of your marketing strategy is missing out on audience engagement and losing advantage to a major competitor, as was the case with the fast food giant. A valuable lesson in this regard can be learned from Chick-fil-A’s recent blunder of banning their employees from making viral content. In fact, your employees should be a driving force in your marketing strategy—not only serving as brand ambassadors but also helping your organization publish content that resonates with target audiences. Notably, siloed teams can be disastrous for business outcomes. According to a recent Forbes article, 67% of managers cite silos as the biggest obstacle to cross-team collaboration. A lack of collaboration among teams can prevent innovation, employee frustration, and disengagement. This can also mean your organization misses out on great business opportunities because of a lack of collaboration across teams. Here’s why you should include your employees in your marketing activities and how they can elevate your organization’s brand strategy. Far-removed technical teams Marketing strategies are often delegated to the marketing department alone, with employees in more technical roles (such as engineers and product managers) never getting the chance to contribute. From the marketing perspective, this can lead to disastrous consequences, such as not capturing the full potential of your offering’s value. More specifically, this alienation can disrupt workflows for producing content. For instance, a marketer not as familiar with the technical aspects of a newly launched product may lose valuable time researching and chasing the correct information. Another serious potential problem is not marketing the product or idea to its full potential. Another risk arises with team capabilities. Some employees don’t feel like venturing out of their comfort zones, which also raises the threat of hitting the glass ceiling of their full potential to develop skills spanning multiple areas. For example, an engineer could learn a thing or two from a marketer about powerfully communicating a product’s benefits. Nurturing a culture of cross-collaboration Some employees need that extra nudge to broaden their involvement beyond the strict remits of their roles. This incentivization could be in the form of bonuses or name exposure through published articles they can share on LinkedIn. Competitions are a fantastic way to encourage technical team members to get involved with your organization’s content strategy. Depending on your strategy, these could be held monthly or quarterly as blogs around trending topics or subjects that may be relevant to existing and potential clients. To get employees to flex their creative muscles, blogs can be selected based on various criteria, such as the topic’s novelty in relation to other industry discussions and the demonstrated prowess in writing style and eloquence. For example, Trond Røvang and John Oxenby from SAP have amassed over 22,000 followers from their engaging content around the company’s products and services. Another example is Gramener’s initiative called the CoCreate Blog Competition: Individuals from various teams, such as data scientists and product engineers, have been contributing to knowledge-sharing and vocalizing their perspectives on the most interesting discussions in the industry. Since the initiative gained PR exposure for the company, Gramener will be continuing it for a second run. Unlocking new growth potential among teams What do employees stand to gain from getting involved with an organization’s content strategy? Not only are they broadening their skill set and enhancing their career growth, but they’re also gaining name exposure. This is great for their networking potential, whether online or in person. For instance, employees can share their authored posts on their LinkedIn profiles, which may ignite interesting conversations with leads and industry acquaintances. Organizational benefits include enhanced collaboration between teams and reducing the risk of siloing. Additionally, this incentivization can be hugely helpful for marketing teams to keep pace with trending industry topics and ensure they’re tapping into the right narratives and talking points that will resonate with audiences. Moreover, technical employees can indicate to marketers and business development teams, through their contributed blog posts, which subject areas they need to explore. This helps uncover potential business opportunities. Involving your technical teams in your organization’s marketing content strategy can reap wider, longer-term business benefits, including having a closer ear to the ground on what’s trending industry-wise. What’s more, you’re expanding your workforce’s skills across multiple areas, which nurtures better adaptability and cross-functional collaboration. Zena Al Maskari, Writer, The Sociable One of the consequences of keeping your employees out of your marketing strategy is missing out on audience engagement and losing advantage to a major competitor, as was the case with the fast food giant. A valuable lesson in this regard can be learned from Chick-fil-A’s recent blunder of banning their employees from making viral content. recent blunder In fact, your employees should be a driving force in your marketing strategy—not only serving as brand ambassadors but also helping your organization publish content that resonates with target audiences. Notably, siloed teams can be disastrous for business outcomes. According to a recent Forbes article, 67% of managers cite silos as the biggest obstacle to cross-team collaboration. A lack of collaboration among teams can prevent innovation, employee frustration, and disengagement. 67% of managers This can also mean your organization misses out on great business opportunities because of a lack of collaboration across teams. Here’s why you should include your employees in your marketing activities and how they can elevate your organization’s brand strategy. Far-removed technical teams Marketing strategies are often delegated to the marketing department alone, with employees in more technical roles (such as engineers and product managers) never getting the chance to contribute. From the marketing perspective, this can lead to disastrous consequences, such as not capturing the full potential of your offering’s value. More specifically, this alienation can disrupt workflows for producing content. For instance, a marketer not as familiar with the technical aspects of a newly launched product may lose valuable time researching and chasing the correct information. Another serious potential problem is not marketing the product or idea to its full potential. Another risk arises with team capabilities. Some employees don’t feel like venturing out of their comfort zones, which also raises the threat of hitting the glass ceiling of their full potential to develop skills spanning multiple areas. For example, an engineer could learn a thing or two from a marketer about powerfully communicating a product’s benefits. Nurturing a culture of cross-collaboration Some employees need that extra nudge to broaden their involvement beyond the strict remits of their roles. This incentivization could be in the form of bonuses or name exposure through published articles they can share on LinkedIn. Competitions are a fantastic way to encourage technical team members to get involved with your organization’s content strategy. Depending on your strategy, these could be held monthly or quarterly as blogs around trending topics or subjects that may be relevant to existing and potential clients. To get employees to flex their creative muscles, blogs can be selected based on various criteria, such as the topic’s novelty in relation to other industry discussions and the demonstrated prowess in writing style and eloquence. For example, Trond Røvang and John Oxenby from SAP have amassed over 22,000 followers from their engaging content around the company’s products and services. Another example is Gramener’s initiative called the CoCreate Blog Competition: Individuals from various teams, such as data scientists and product engineers, have been contributing to knowledge-sharing and vocalizing their perspectives on the most interesting discussions in the industry. Since the initiative gained PR exposure for the company, Gramener will be continuing it for a second run. Trond Røvang and John Oxenby from SAP gained PR exposure Unlocking new growth potential among teams What do employees stand to gain from getting involved with an organization’s content strategy? Not only are they broadening their skill set and enhancing their career growth, but they’re also gaining name exposure. This is great for their networking potential, whether online or in person. For instance, employees can share their authored posts on their LinkedIn profiles, which may ignite interesting conversations with leads and industry acquaintances. Organizational benefits include enhanced collaboration between teams and reducing the risk of siloing. Additionally, this incentivization can be hugely helpful for marketing teams to keep pace with trending industry topics and ensure they’re tapping into the right narratives and talking points that will resonate with audiences. Moreover, technical employees can indicate to marketers and business development teams, through their contributed blog posts, which subject areas they need to explore. This helps uncover potential business opportunities. Involving your technical teams in your organization’s marketing content strategy can reap wider, longer-term business benefits, including having a closer ear to the ground on what’s trending industry-wise. What’s more, you’re expanding your workforce’s skills across multiple areas, which nurtures better adaptability and cross-functional collaboration. Zena Al Maskari, Writer, The Sociable Zena Al Maskari, Writer, The Sociable Zena Al Maskari , Writer, The Sociable Zena Al Maskari

The Essential Role of Employee-Generated Content in Modern Marketing

Stories, News & Mentions about ZUNA

Zuna’s Stories on HackerNoon