HNHacker News
TopNewBestAskShowJobs

robterrin

291 karma · joined July 27, 2015

www.robterrin.com www.tailrisk.com robert.terrin@tailrisk.com
submissionscomments
robterrin··on To become a software consultant, avoid letting clients pay you for code (2017)
As a Deloitte alumnus and a current cofounder of my own cybersecurity services and advisory firm, I hope I am qualified to weigh in here.

First, lumping all consulting firms together is a mistake. The main lists here cover the big brands, and I've added a couple more. Each has their strengths, weaknesses and approach to the market:

- Pure technology consulting: Accenture, IBM, Cap Gemini, Tata, Cognizant and Infosys

These firms usually win because of their reputation for solving large scale technical problems. They can mobilize large teams of relatively qualified people and often have exclusive or at least preferential treatment from software providers who are eager to sell into their distribution channel.

- Prestige strategy firms: McKinsey, Bain, BCG

Very little technical knowledge. Almost no implementation. Usually bought for political reasons that require "hiring the best." A true Veblen service. Still, they often are the right choice for a question that has an unknowable answer and requires panache and persuasion.

- Big Four: Deloitte, EY, KPMG, PwC

Outside of government practices, these firms win because they have a monopoly on the CFO relationship. This entree into board conversations around audit and financials is powerful enough to build a relationship that can lead to strategy, technology, supply chain or myriad other consulting projects (SarbOx made it illegal to sell both audit and consulting at once, but once Deloitte made it clear that some hand waving and compliance measures were sufficient to fend of regulators, as long as services weren't sold at the same time, the rest jumped back into consulting).

- Niche players: Aon, WTW, AT Kearney, CapCo, ATT, Verizon, Marsh, Sapient and Booz

This heterogenous group often wins because of a specific strength, relationship or reputation. For Aon, Marsh and WTW it is around insurance and the CRO. For ATK, they are known for logistics.

Finally, to address the article itself, one of my earliest observations about the corporate world is that the less work one does, the more one gets paid. Partners delegate work and even proposal writing to focus on selling. Those who get promoted most quickly are those who sell the most work. Relationships are what lands deals and working is in conflict with schmoozing, so it is important to do very little actual work.

Furthermore, what people are saying about bureaucracy and management being inherent to an organization is correct, although I'm less jaded on this point than I was while working for somebody else. Sclerotic organizations need third parties to make change because inertia is such a powerful force, and a combination of risk aversion and other fallacies can do harm to one's career unless there is somebody else to blame. See Rene Girard on this point to fully understand why scapegoating is a feature, not a bug.

The last thing I would say, is that having real expertise and experience is crucial to making a convincing sale. My field, cybersecurity, is still professionalizing so credentials don't mean as much as past work experience. Social proof is everything and competing on price in markets with information asymmetry is a sign of bad quality.

There are a few ways to get to the place that was laid out by the OP. The first, and most desperately needed, is somebody with deep technical knowledge who can develop and implement processes. The second, and almost as important is somebody who can create documentation that ties everything together and explains code, networks, data and systems at various levels of granularity (C-suite, middle management, engineering lead, devs, network engineers, etc.). While the latter should be the responsibility of a good engineer, it often gets left behind and is almost never prepared for different audiences. Third and final is where we are positioned, risk management. We assess, mitigate and quantify risk in terms leadership can understand and act on. Whether a bank is worried about regulatory pressure and needs to demonstrate a good faith effort to comply or a due diligence team needs a financial quantification of the current cybersecurity risk in an acquisition, the greatest value here is being fluent in business and technology. Translating between lingo, goals and most importantly culture is easier said than done.

robterrin··on Economics Nobel laureate Paul Romer is a Python programming convert
This is a myth: http://blog.revolutionanalytics.com/2012/06/fda-r-ok.html

https://www.fda.gov/downloads/forindustry/datastandards/stud...

robterrin··on On the Law of Diminishing Specialization
"Why don't more executives hire really good programmers and analysts to be their assistants?"

They do. Usually they have a title like "Chief of Staff" or "Speechwriter" or "Associate." My friend occupied just such a role after working in investment banking and private equity. He was paid in the low-mid six figures and ended up doing tons of research, analysis and writing for the CEO of one of the most successful private equity firms. The position was stepping stone to Harvard Business School and nobody stayed in the role for much more than a year or two, so they are constantly rotating in fresh, hungry and smart people.

I like the idea of adding automation to the mix, but realistically, if there is a task the CEO wants automated, he/she can tap any engineering manager and pull their team onto that project. The value add would be automation of tasks for the assistant rather than automation that benefits the CEO directly.

robterrin··on Business school grads and quants are winning the battle to create the next P&G
Micah is an HBS alumnus. I'm not saying he's wrong, but he brings his own biases to the table, as we all do. I also went to business school, and while I wouldn't say it was worthless as a founder, the things that are valuable are not always what people believe are valuable.

There are three reasons to go to business school: knowledge, network and brand. People go for many reasons, such as feeling insecure, wanting insurance and taking a break from their job. These are not good reasons. Here is my evaluation of the good reasons:

- Knowledge (overall grade C-) Yes, you will learn things if you study. Could you learn these on your own? Sure. Will you? Likely not. If you weren't an accounting/economics/finance major in undergrad you may find the academics particularly valuable. Some of the classroom experience is useful for things like negotiations, management and other "soft" skills. My experience was that the greatest intellectual advancement I found was through cross registering in the engineering and statistics departments. Go to a large research university, particularly if you went to a small liberal arts school for undergrad, and make the best use of a world class institution!

- Network (Depends mostly on the competition to get in, B+) This is the biggest reason and often cited as the true reason people go. Academics are a joke and going for the brand seems gross, so people default to this answer, which is cronyism, but at least it's not as superficial as branding. In my experience, this was incredibly useful. I've landed three of my seven clients through business school classmates. The alumni network is good too, although not terribly strong unless you go to a smaller program, which lowers your odds that the alumni will be usefully placed for your purposes.

- Brand (depends entirely on prestige, A+) This is vastly underrated, at least in polite conversation. Nobody like a braggart, and playing the "I went to Stanford GSB" card is an ugly move, so savvy MBAs resort to more subtle signaling. It's hard to measure the value here because it makes everything easier, from pitching and starting conversations, to being taken seriously and getting access to programs and resources.

Finally, a word on digital vertical native brands. Developing a valuable brand is low probability event (that's why people buy a brand by going to business school!). That is not to say it's difficult, or any more difficult than winning the lottery, but it is rare. Intentionally creating a brand can be hard, but I doubt there's much correlation between effort and success. Besides brand, these digitally native vertical brands have no sustainable competitive advantage, and I fully expect their profits to get competed away. The market, however, can stay irrational long enough for many people to get rich. Best of luck to anybody starting or investing in a digital brand!

robterrin··on America's Startup Scene Is Looking Anemic
At first I thought this comment was right on the money, but then I read the article.

"... the decline in new retail businesses isn’t an acute crisis. More worrying, however, is the decline in high-tech business formation. Tech businesses, unlike corner stores, tend to be high-growth businesses...."

Sonnyblarney, did you read the article before posting?

One big trend I've noticed is that small businesses (startups and slow growth businesses alike) are much more likely to do business with startups. A decline in small business is a positive (not good) feedback loop that adversely affects startups.

Consolidation in many sectors is out of control, not just tech. Finance, media, healthcare come to mind, but it's really endemic because fewer small businesses means fewer customers, longer sales cycles, more bureaucracy to navigate and therefore fewer startups.

Putting this in the broader geopolitical context, government antitrust actions are nowhere in sight. National champions, a la Putin & Xi Jinping, and subsidized state-owned enterprises (SOE) will eat the free market's lunch, in the short run, every time. Economic liberalism is really in a difficult spot because globalization has opened our markets to this kind of exploitation.

robterrin··on The more of everything problem
Thank you imartin2k for posting this. I just came across it on www.marginalrevolution.com, and I'm glad somebody shared it here. Should be on the front page!
robterrin··on How to Find Product Market Fit – founder of Segment (2017) [video]
Respectfully disagree with _pdp_ here. Many ideas are not low hanging in retrospect. The three pre-internet businesses I cite are obvious needs (trade, oil refining & transportation) and yet had requirements that made them untenable business ventures for people without the specific advantages required by those business models. Government support, a superior position in the supply chain or access to vast amounts of capital provided barriers to entry for potential competitors. Having demonstrated that the second claim is false, I will not address the first claim.

Something that has not been done before is not low hanging fruit. To be sure, it is difficult to know if there are fewer good businesses to be started today, but the economic evidence has been stacking up for 30 some years now. Here are some papers showing the slowdown in productivity and new starts:

- http://www.nber.org/papers/w21974

- https://www.brookings.edu/wp-content/uploads/2016/03/ByrneEt...

- https://www.nytimes.com/2017/09/20/business/economy/startup-...

Part of this is a sclerotic antitrust regulator that has been defanged by lobbyists. Part of it is the internet removing information asymmetries, leading to natural monopolies. Part of it is probably the cheap "bits" businesses crowding out "atoms" investments in VC. Another part is probably that we are simply running out of easy defensible businesses to create. This is ok! People will have to get more creative and humanity will progress more slowly, but from a higher base.

robterrin··on How to Find Product Market Fit – founder of Segment (2017) [video]
throwaway84742, you are correct. That is why I said, "thing that customers wanted" and not "idea." Even having the kernel of the idea was insufficient.
robterrin··on How to Find Product Market Fit – founder of Segment (2017) [video]
Really great video and lots to learn here. I think this may be the third time I've seen it, and I'm still getting more out of it.

The biggest thing that hits me this go round is that staying alive is key. PG may have said, you burned $500k and have nothing to show for it, but if they had quit then, they would never have made it through the Great Startup Filter(tm) https://en.wikipedia.org/wiki/Great_Filter. The lack of great businesses (90% failure rate) reveals that the hardest part of building a company is starting a company.

In earlier times when there was more low hanging fruit, the hardest part of starting a company was scaling it. You had to have government backing (e.g. East India Company) or sit in an important part of the supply chain (e.g. Standard Oil) or cover really high capital expenditure (e.g. FedEx). Now that it's easier than ever to start a company, the good ideas are mostly already picked, so finding one is harder.

In economics, this called the explore/exploit or multi-armed bandit problem. What is so interesting to me on this viewing is that Peter Reinhardt's unrelenting enthusiasm and self delusion were a feature, not a bug. There is no way they would have stayed in the game long enough to find product market fit without that. Even though the kernel of the idea existed early on, they needed to taste true desperation to humble themselves enough to do the simplest, stupidest thing that customers wanted.

robterrin··on Ask HN: Freelancer? Seeking freelancer? (February 2018)
SEEKING WORK - New York, US - Local preferred, open to remote and travel opportunities.

Information Security and Compliance expert with nearly a decade of experience assessing, monitoring and building security solutions.

I work with information security, operations and risk management teams at financial institutions (banks, lenders, broker/dealers and insurance companies) to help prioritize security objectives, comply with rules/regulations and implement technology solutions. Policies, network security, IDS, SIEM, PKI, IDAM, AWS security, project management, systems integration and vulnerability assessments.

Past Projects:

- Vendor selection and implementation of Security Incident and Event Manager (SIEM) for a Managed Services Provider (MSP). Developed a scoring method and a risk-based selection process for network and device monitoring software at an IT services provider with 100+ clients.

- Modified and improved legacy IT financial controls and trading systems for a Fortune 500 energy trading company. Detected errors and remediated mistakes in a custom Value at Risk (VaR) system and trading platform, leading to a reduction of time to address tickets from an average of 10 to 3 days.

- Developed statistical model for incident detection and likelihood of breach. Performed research and produced a unique solution integrating threat vectors specific to the client's needs.

- Designed and architected a visitor management system for a large U.S. Federal client. Managed 16+ development team and delivered project on time and under budget. Custom Java frontend, Oracle backend and various customized off-the-shelf tools in-between.

Website: https://www.tailriskconsulting.com

Email: rob.terrin@tailriskconsulting.com

LinkedIn: https://www.linkedin.com/in/robert-terrin-430ab28

robterrin··on Bayesian analysis of ego-depletion studies favours null hypothesis
This might answer your question: http://www.stat.columbia.edu/~gelman/research/published/avoi...
robterrin··on Buffett Says Stock Ownership Became More Attractive With Tax Cut
Check out Bill Miller's track record to see what a wild ride he takes his investors on: https://www.cnbc.com/2017/05/10/legendary-investor-bill-mill...
robterrin··on Cybersecurity Today Is Treated Like Accounting Before Enron
Nate Fick's op-ed is well written but misdiagnoses the problem. Having spent my whole career in cybersecurity, years studying public policy, and prior work at a big four accounting firm, I believe that while legislative action is necessary, it is not sufficient. Let's examine the success of the law Fick hopes to model, Sarbanes-Oxley (SOX).

The Enron fraud, which precipitated SOX, was pretty simple at it's core. Arthur Anderson, Enron's auditor, traded weak accounting oversight for lucrative consulting contracts. In the wake of Enron, all remaining big four accounting firms, except Deloitte sold off their consulting businesses to avoid an appearance of conflict of interest. Since then, they have all either bought or grown their consulting businesses back.

In the six years following SOX, only three CEO's were charged with violating provisions of SOX. A full 60 of the 63 CFO's charged, were charged with violating previously existing legislation (http://ww2.cfo.com/risk-compliance/2007/08/count-em-63-cfos-...).

The problems are in the executive and judicial branches. The NYS DFS Cybersecurity Law is a good start, but companies will not change behavior until a case is brought and executives face real risk. Until then, no amount of legislation, Federal or otherwise will be sufficient. In fact, a patchwork of state and Federal regulations that cover some companies according to how they are chartered and which industries they are in (e.g. Healthcare and HIPAA) will only create a race to the bottom, where companies arbitrage regulatory regimes and confusion reigns. This was the state of financial regulation prior to the creation of the SEC (https://en.wikipedia.org/wiki/Blue_sky_law).

An interesting historical footnote is that the era of blue sky laws was the early 1900's, which coincided with a period of technological innovation (electrification and the combustion engine), falling demand for labor, and was punctuated by manias and panics. Sound familiar?

It wasn't until after the United States experienced the Great Depression, awoke from it's fever dream and established a body to enforce the recently passed security exchange act, that Wall Street was temporarily cleaned up. Unfortunately, regulatory capture has resulted in modern day financial regulation becoming a competitive advantage for big banks that can afford the lobbying and compliance overhead.

robterrin··on NSA’s top talent is leaving because of low pay, flagging morale, unpopular reorg
https://www.quora.com/Why-is-the-salary-of-Singapores-Prime-...
robterrin··on What the SATs Taught Us about Finding the Perfect Fit
They used Stan! http://mc-stan.org/

Gelman and the rest of the crew at Columbia are doing great work. Check out https://www.generable.com/ too.

robterrin··on Founders are terrible CEOs
Did nobody read the underlying research of the centerpiece study supporting this hypothesis? How did this headline and the article get written?

"We investigate these issues using the World Management Survey (WMS), an international data set providing detailed information on the management practices for a large sample of medium and large MANUFACTURING [emphasis added] firms (Bloom et al. 2014; Bloom and Van Reenen 2007) in thirty- two countries."

Sure, it seems relatively believable that large and medium sized manufacturing firms are better run by professional managers than their original founders, given the dynamics of that particular industry. Medium and large manufacturing firms require relatively common knowledge, have repeatable processes, are high volume/low margin, use commoditized inputs and outputs, as well as many other factors that make it ripe for bean counting as opposed to risk taking and vision. This is a straw man if I ever saw one.

[Edited typo]

robterrin··on How We Bootstrapped Our SaaS Startup to Ramen Profitability
C corps pay taxes on operating profits which are gross revenues (that is, revenue less cost of goods sold, which for software companies is usually 0) minus operating expenses. Operating expenses include salaried employees. Then you take out interest from any debt you have and pay a percentage on that towards taxes, to get your net profit. Net profit is the amount available to actually take home for shareholders. Once you make your distributions to shareholders, you are left with retained earnings.

https://en.wikipedia.org/wiki/Net_profit#Example

robterrin··on Accenture left a huge trove of highly sensitive data on exposed servers
I used to work in Deloitte's Federal cybersecurity practice. Nobody I sent articles to had heard of the recent email server breaches before I told them, and they are still waiting for leadership to make a practice wide statement. Then it came out that some of the emails were from clients and teams I worked with. Still nada.
robterrin··on Dangers of CSV Injection
On a consulting project a few years ago, I was brought in to help a Fortune 500 energy company make sense of the value at risk model that one guy had built over 20 years in VBA. Most of it was pulling from excel spreadsheets brokers would send daily with prices. What. A. Nightmare.

It was hard to decide what I hated most about the project. The mind numbing stupidity of it. That fact that managers had allowed this single point of failure, and then let the guy leave. Or... that it was all a fictitious dance, pursued because spinning off their trading operations, would get them millions in tax subsidies.

robterrin··on A Data-Driven Guide to Becoming a Consistent Billionaire
Thanks for your interest! Press w for widescreen mode and f to go full screen. Sorry it was a presentation for class so it wasn't designed to be super user friendly.

I also reknit and uploaded a pdf version, it just doesn't look as pretty. http://robterrin.com/MissingData/Final_Project.pdf

robterrin··on A Data-Driven Guide to Becoming a Consistent Billionaire
Thanks Rosebud! This is a cool analysis, and I really appreciate you sharing the code. There are a ton of ways to pick apart the interpretations, but I feel that you were pretty up front about the difficulties of inferring much. I can empathize with the level of data cleaning fatigue you must have felt. Here's an analysis of VC backed enterprise startups that I did for a stats class: http://robterrin.com/MissingData/index#1

By the end, I was pretty much burnt out on this data set to draw many strong conclusions. Still, you busted some myths and flagged some interesting observations for further research. Thank you!

P.S. Oops, I realize the OP is not the author, but cool nonetheless.

robterrin··on Amazon is hiring the most MBAs in tech, and it’s not really close
I think it is a vague idiom by intent, but here's one definition: "To behave in a way that is accepted or demanded by those in authority"(http://idioms.thefreedictionary.com/play+the+game)

I view this skill as anticipating not just what your boss tells you to do, but also the things they don't make explicit, because you recognize subtle social cues and understand their incentives. It can be nefarious or just empathetic. How it is deployed determines the morality of its use, in my consequentialist opinion.

robterrin··on Amazon is hiring the most MBAs in tech, and it’s not really close
As a recent MBA grad of one of the schools listed in the article I would like to note a few things:

First, Amazon is 3x the size of any of the tech companies it is compared to. Google actually hires more MBA's per capita and Amazon hires about as many as Apple and Microsoft, per capita.

Second, I keep a close eye on these things, and 72% of my class went to finance or consulting. Consulting is still the biggest draw and has been since the financial crisis.

Third, this is good news for tech. See the HBS Indicator for more on why: http://www.investopedia.com/terms/h/harvardmba_indicator.asp I'm not going to defend or bash the MBA degree. It doesn't say much about you except that you are a competent professional that likes money and can play the game. Those traits are often enough to make an employee worth their salary, but many MBAs have additional skills, analytical or otherwise. Sometimes it means you hire somebody a little too slick. This is probably why tech has such a phobia of the MBA. Fair, but overgeneralizing, in my opinion.

Finally, I think the reason you see more MBAs in tech these days isn't necessarily Bezos' finance background or the need for analytics, but that tech companies are maturing and they need middle managers. MBAs tend to be predictable worker bees that do a great job at filling out the ranks of a large bureaucracy. Most business is really about project planning, reporting, managing expectations, coordinating teams and delivering on time. It's not terribly rewarding or creative work, but it's what MBAs can reliably produce.

*edited typo in last paragraph

robterrin··on Betting on the Web – Why I Build PWAs
Surprised I didn't find this comment up higher. This is my first thought every time. Good observation!
robterrin··on Redefine statistical significance
Uh oh. If you don't watch out you'll end up a Bayesian. http://www.stat.columbia.edu/~gelman/research/unpublished/p_...

Is this along the lines of what you were hoping to find? Here's more: http://andrewgelman.com/2016/12/13/bayesian-statistics-whats...

robterrin··on Amazon to Build Second HQ in North America
Everybody (except Amazon) will probably end up worse off. See Thaler's famous paper on the "Winner's Curse." http://econweb.ucsd.edu/~jandreon/Econ264/papers/Thaler%20JE...

I'm not sure what to make of this overall. The Federal Government should probably regulate this kind of behavior or at least sweeten the payoff of state cooperation. Our anti-trust regulators are really asleep at the wheel.

robterrin··on Olin College Produces Founders at Five Times the Rate of Stanford
Two comments:

1. First and foremost, go Olin College! It sounds like a really special place where liberal arts and engineering are valued. I wish more colleges followed this model.

2. It's not very surprising and likely a statistical quirk that their per capita founding rate is so high. After reading this piece on why the highest and lowest cancer rates by county in the US are in rural counties, I am seeing this statistical phenomenon everywhere: https://books.google.com/books?id=JRueDgAAQBAJ&pg=PA14&lpg=P...

robterrin··on Ex-CIA Agent Raises $40M to Find Every 'Thing' on the Web in Just One Hour
I learned about Qadium last spring. Not sure how under the radar they were then, but I heard about it through a referral of a referral working on cyber risk.

If they are able to credibly provide a baseline for number of connected devices and percentage that are vulnerable, it won't be a huge step up from zmap, but it could provide some interesting data for security pros, regulators and insurance. Not sure how they get to the part about vulnerability of devices.

The cyber kill chain provides a nice jumping off point for a hierarchical model, but the kind of data necessary to really flesh it out is just so damn hard to find at the quality levels necessary.

robterrin··on How Canada became an education superpower
I appreciate your view point and wish it were true, but Canada is way less diverse than the United States. (https://en.wikipedia.org/wiki/Demographics_of_Canada)

Research shows that as diversity increases, so do political difficulties. Homogeneity is credited for a lot of policy successes in Scandinavia. Canada is simply another example of this, plus it is one of the earth's biggest petro-states.

It is less a cosmopolitain melting pot and more like Minnesota with the oil wealth of Texas. Vancouver and Toronto are admirable exceptions.

robterrin··on Underrated Startup Success Factors
Thank you for this comment Leo. My cybersecurity company (http://tailriskconsulting.com/) was spun up to help small and medium sized financial institutions doing business in New York State deal with new regulations (http://www.dfs.ny.gov/legal/regulations/adoptions/dfsrf500tx...). If you anybody is interested, we've written a guide to help understand the law: http://tailriskconsulting.com/TailRisk_NYSDFS_RR500_Guide.pd...
← PreviousPage 2 of 3Next →