Year: 2022

Jamf officially completed its acquisition of Zecops this week. Why is this important and what might it mean to enterprise mobile security? Potentially, a lot.

Security beyond the perimiter

To get an answer to the question, think about how security has evolved. as the proliferation of mobile devices has made traditional security protections even less effective than they used to be.

Mobile devices now account for 59% of global website traffic. But almost half (45%) of companies surveyed in the most recent Verizon Mobile Security Index say they have suffered a compromise involving a mobile device in the past 12 months.

Company firewalls only protect those inside the wall, and retrospective malware checkers by nature don’t detect an attack until it’s taken place.

Traditional security models have now been replaced by the concept of endpoint security, in which security is applied on a device, user, location, and even application basis. It’s this evolving understanding of security that contributes to today’s security industry buzzwords, things like zero trust, multi-factor authentication, and password-free security — all are components of the new approach.

But can devices protect themselves?

Another tactic is the continued attempt to evolve security protection on the device itself, kind of like the Secure Enclave on Apple’s products. But it involves even more: developing systems that are smart enough to recognize whether they have been attacked.

But being able to deliver that kind of machine intelligence self-awareness requires access to a little information first, in the form of telemetry data.

Jamf already has a security solution for Macs that shows this direction of travel, called Jamf Protect. It can detect threats, monitor compliance, and automatically respond to some security incidents. When it was introduced in 2019, it showed a future for security protection. The ZecOps deal means the company now has technology it might be able to use to provide similar protection to iPhones and iPads, too.

Delivering that level of security is complex and requires access to telemetry, which is the kind of information Zecops is very good at grabbing. That explains why its security solutions are already used by governments, enterprises, and high-net-worth individuals to accelerate mobile security investigations. The solution is very good at taking data and identifying attacks and compromises at a deep scale.

The idea is that if a breach has taken place, the software will spot it, which is invaluable to the protection of corporate data. However, the goal must be that eventually the device itself will recognize and protect itself against any visibly recognize attack, making systems even more secure.

“ZecOps is the only available tool that provides the capability to extract, deliver, and analyze mobile device logs for signs of compromise or malicious activity,” said one “Department of State, a G7 government” customer, according to the company.

How it works

The tool works by capturing and analyzing logs from both iOS and Android devices at the operating system layer. It explores this telemetric data to identify suspicious events and has been designed to catch hidden zero- and one-click attacks. It will identify whether a device is attacked, how and when that attack took place, what impact it has, and then help inform effective incident response.

It’s a threat hunter for iPhones.

It’s important also to consider the kind of threats this solution may be able to fend off. This isn’t just a virus checker. It is smart and capable enough to identify some of the state-sponsored threats Apple built Lockdown Mode to protect devices against. The acquisition essentially gives Jamf a technology sufficiently robust to protect against espionage.

And at a deeply paranoid time in our global history, this level of protection is the degree of security every iPhone user requires.

Please follow me on Mastodon, Twitter, or join me in the AppleHolic’s bar & grill and Apple Discussions groups on MeWe. 

The crash last week of FTX, one of the world’s leading cryptocurrency exchanges, is likely to push lawmakers to create central oversight of an otherwise unregulated marketplace.

And while cryptocurrencies like those traded on FTX are different from others backed by fiat money or other assets, the meltdown of the exchange looks likely to cool a burgeoning number of efforts to adopt digital currencies by industries and governments.

Bahamas-based FTX Trading filed for bankruptcy last week after cryptocurrency prices dropped sharply and the company, once valued at $32 billion, found itself billions of dollars in debt. The exchange was founded in 2019 by MIT graduates Sam Bankman-Fried and Gary Wang. It quickly grew into the third-largest cryptocurrency trading platform, raising almost $2 billion in venture capital from high-profile investors.

FTX is not the first cryptocurrency exchange to fail. Some 42% of exchange failures have occurred without any explanation to consumers, while 9% were due to scams, according to one report. After FTX announced its bankruptcy filing, reports surfaced that the exchange and users of its online wallet services had been hacked.

“I sincerely hope that regulators finally take action,” said Martha Bennett, a principal analyst and vice president at Forrester Research. “Yes, it can be a challenge when the entities involved are specifically designed to evade regulatory oversight. But as the first steps in the insolvency process for FTX demonstrate, where there’s a will, there’s a way.” 

Howard Fischer, a former senior trial counsel at the US Securities and Exchange Commission (SEC), believes the cryptocurrency marketplace is at an “inflection point” where many want oversight to restore “some semblance of trust.”

“There [are] likely to be significant proposals aimed at both creating greater transparency into how crypto exchanges operate, including regulatory oversight into their balance sheets, calls to impose rules for segregation and protection of customer assets, and impetus to prohibit exchanges from operating jointly with investment operations,” Fischer said.

The regulations, Fischer said, are likely to be similar to the 1933 Glass-Steagall Act, which prohibited banks from using deposits to fund high-risk investments.

In the wake of such a high-profile crypto exchange failure, financial services and governments are also likely to take a second look at their own cryptocurrency and exchange projects.

“At this point, there is too much reputational risk from being associated with such a volatile asset — at least not until government regulation makes it a safer space, both reputationally and operationally,” Fischer said.

SEC Chairman Gary Gensler has been pushing for greater regulation of crypto assets over the past few years. In a similar way as stock exchanges, cryptocurrency exchanges such as FTX, Coinbase, and Binance, process trades for customers. But unlike the New York Stock Exchange or NASDAQ, crypto exchanges operate in a regulatory gray area and without explicit SEC approval.

Oversight of the exchanges and other crypto businesses has been an ongoing process, much of which is developed through court case precedence. For example, the SEC charged crypto exchange Coinbase with insider trading earlier this year. Earlier this month, the SEC won a case against blockchain-based payment network LBRY Inc. because it offered cryptocurrency as digital assets.

There are four main types of crypto currency, all of which are built atop a blockchain cryptographic ledger: cryptocurrency, such as bitcoin and Ether; stablecoins, or fiat-backed crypto such as Facebook’s Libra ; fungible and non-fungible digital tokens representing goods, financial assets, securities, and services; and central bank digital currency (CBDCs) or digital dollars created by governments.

Governments around the globe, including the US, are developing or already piloting CBDCs. Stablecoins are being created and piloted by financial services firms, such as JP Morgan’s JPM Coin and Wells Fargo Digital Cash, as well as companies such as Facebook’s Libra, for peer-to-peer transactions, which avoid slower and more expensive financial networks such as SWIFT.

In particular, stablecoins should eventually have to meet a number of regulatory conditions, according to Bennett.

“The backing of the coin has to be regulator-approved; attestations will have to be replaced by continuous audit, or the equivalent, of the backing assets; and consumer protections will have to be put in place,” she said.

Cryptocurrencies like bitcoin and Ether have no intrinsic value or backing of assets. They’re created “ex nihilo” or out of nothing. They’re “mined” by computers running special algorithms and their value is determined simply by the cost of producing them (i.e., the computer processing power) and market demand.

Eclipse Images / Getty Images

Even before the FTX collapse, mainstream interest in cryptocurrencies was already cooling, both on the institutional side (including mainstream banking) and among consumers, due to a combination of continued regulatory uncertainty and the crypto crash earlier this year, according to Forrester’s Bennett.

“The FTX debacle will, in my view, pretty much keep away anybody who’s not already involved,” Bennett said. “This is unlikely to change until the implications and fall-out from the FTX bankruptcy are obvious, and there’s some clarity around regulatory action.”

Regulatory moves by Congress and the SEC will impact tokens, but the degree to which they’re affected will depend on the type of token (i.e., fungible or non-fungible), its provable backing (unless that backing is fiat currency), and the blockchain on which it runs, according to Bennett. For example, tokens on centrally managed or “permissioned blockchains” won’t be affected.

Bu stablecoin digital currencies will have to be regulated, “or be kept away from mainstream financial services,” Bennett said.

CBDC developments aren’t affected by the fall-out from FTX, as they don’t touch cryptocurrencies or public blockchains, according to Bennett.

“Put simply, we need to separate between digital currencies whose focus is on utility — whether issued by a central bank, government or a private entity — and those who function mainly as speculative assets, or the on-ramp to participating in speculative DeFi [decentralized finance] markets, which is what most stablecoins are used for today,” Bennett said.

Microsoft on Tuesday released a tightly focused but still significant update that addresses 68 reported (some publicly) vulnerabilities. Unfortunately, this month brings a new record: six zero-day flaws affecting Windows. As a result, we have added both the Windows and Exchange Server updates to our “Patch Now” schedule. Microsoft also published a “defense in depth” advisory (ADV220003) to help secure Office deployments. And there are a small number of Visual Studio, Word, and Excel updates to add to your standard patch release schedule.

You can find more information on the risks of deploying these Patch Tuesday updates in our infographic.

Known issues

Each month, Microsoft includes a list of known issues that relate to the operating system and platforms included in this update cycle. There are two major reported issues with Windows 11 — both related to deploying and updating Windows 22H2 machines:

1. Users updating to Windows 22H2 and the update or the Out of Box Experience may not complete successfully. Provisioning packages applied during initial setup are most likely to be affected. For more information, see Provisioning packages for Windows.
2. Network transfers of large (multi-gigabyte) files might take longer than expected to finish on the latest version of Windows 11. You are more likely to experience this issue copying files to Windows 11 22H2 from a network share via Server Message Block (SMB), but local file copy might also be affected.

In addition to these issues, Microsoft SharePoint Server has experienced two issues with the November and September updates:

• Web Part Pages Web Service methods may be affected by the September 2022 security update. For more information, see KB5017733.
• Some SharePoint 2010 workflow scenarios may be blocked. For more information, see KB5017760.

Major revisions

Technically speaking, Microsoft published eight revisions this month, all for the Chromium Edge browser. In practice, these “revisions” were standard updates to the Microsoft Edge browser and have been included in our Browser section. No other revisions to previous patches or updates were released this month.

Mitigations and workarounds

A single work-around has been published for the November Patch Tuesday: 

• CVE-2022-37976: Active Directory Certificate Services Elevation of Privilege Vulnerability. A system is vulnerable only if both the Active Directory Certificate Services role and the Active Directory Domain Services role are installed on a server in the network. Setting LegacyAuthenticationLevel – Win32 apps | Microsoft Docs to 5= RPC_C_AUTHN_LEVEL_PKT_INTEGRITY might protect most processes on the machine against this attack. For more information see the following section on Setting System-Wide Security Using DCOMCNFG.

No other mitigations or workarounds for Microsoft platforms were released.

Each month, the Readiness team analyzes the patches applied to Windows, Microsoft Office, and related technology/development platforms. We look at each update, the individual changes and the potential impact on enterprise environments. These testing scenarios offer some structured guidance on how to best deploy Windows updates to your environment.

High Risk: This month, Microsoft did not report any high-risk functionality changes, meaning it has not updated nor made major changes to core APIs, functionality or any of the core components or applications included in the Windows desktop and server ecosystems.

More generally, given the broad nature of this update (Office and Windows), we suggest testing the following Windows features and components:

• Hyper-V Update: a simple test of starting and stopping VMs and isolated containers will suffice for this minor update.
• Microsoft PPTP VPN: exercise your typical VPN scenarios (connect/disconnect/restart) and try to simulate a disruption. Contrary to previous recommendations, no extended trials are required.
• Microsoft Photo App: ensure that your RAW image extensions work as expected.
• Microsoft ReFS and ExFat: a typical CRUD test (Create/Rename/Update/Delete) will suffice this month.

There were several updates to how group policies are implemented on  Windows platforms this month. We suggest spending some time ensuring that the following features are working:

• GPO policy creation/deployment and deletion.
• Editing GPO policies, with a validation check to see whether these updated policies have been applied to the entire OU.
• Ensure that all symbolic links are working as expected (redirects to user data).

And, with all testing regimes required when making changes to Microsoft GPOs, remember to use the “gpupdate /force” command to ensure that all changes have been committed to the target system.

Who uses the Windows Overlay Filter Feature?

System engineers, that’s who. If you have had to build client machines for large automated enterprise deployments you may have to work with the Windows Overlay Filter (WoF) driver for WIM boot files. WoF  allows for significantly better compression ratios of installation files and was introduced in Windows 8. If you are in the middle of a large client-side deployment effort this month, ensure that your WIM files are still accessible after the November update. If you’re looking for more information on this key Windows deployment feature, check out this blog post on WoF data compression.

Unless otherwise specified, we should assume that each Patch Tuesday update will require testing of core printing functions including:

• printing from directly connected printers;
• large print jobs from servers (especially if they are also domain controllers);
• remote printing (using RDP and VPN).

Each month, we break down the update cycle into product families (as defined by Microsoft) with the following basic groupings:

• Browsers (Microsoft IE and Edge);
• Microsoft Windows (both desktop and server);
• Microsoft Office;
• Microsoft Exchange Server;
• Microsoft Development platforms ( ASP.NET Core, .NET Core and Chakra Core);
• Adobe (retired???, maybe next year).

Browsers

Including last week’s mid-cycle update to Microsoft Edge (Chromium) there are 10 updates to the Chromium core and eight patches to Edge, for a total of 18 changes. For the 10 Chrome updates, you can refer to the Chrome Security page for more details. You can find links to all of the Microsoft updates here: CVE-2022-3652, CVE-2022-3653, CVE-2022-3654, CVE-2022-3655, CVE-2022-3656, CVE-2022-3657, CVE-2022-3660, CVE-2022-3661. All 18 updates are low-profile, low-impact updates to the browser stack and can be added to your standard desktop update schedule.

Microsoft Windows

There’s good and bad news this month for Windows. The bad news is we have six Windows zero-days with both publicly reported vulnerabilities and reported exploits in the wild. The good news is that only one of the vulnerabilities (which is incredible) is rated critical by Microsoft. This month’s update covers the following Windows features:

• Windows Scripting (the Windows scripting host or object);
• Networking (particularly how HTTPS is handled);
• Windows Printing (the print spooler, again);
• ODBC (the least of our worries this month).

We are seeing some reports of problems this month with Kerberos. In response, Microsoft has provided two Knowledge Base articles on how to handle the November changes:

Given the nature of these reported zero-days, and accounting for the relatively narrow change profile this month, we recommend immediate patching for all Windows systems. Add these Windows updates to your “Patch Now” schedule — and this time we really mean it.

Microsoft Office

Microsoft released eight updates to the Office platform, affecting Word, Excel and SharePoint server. There were no critical updates this month (no preview pane vulnerabilities), with each patch rated important by Microsoft. In addition, Microsoft released a “Defense in Depth” advisory (ADV220003) for Office. These Microsoft advisories cover the following enhanced protection features:

These features are worth further examination; you can read more about these and other preventative security measures here. Add these low-impact Microsoft Office updates to your standard release schedule.

Microsoft Exchange Server

Unfortunately, we have Microsoft Exchange Server updates back on the roster this month. Microsoft released four updates; one (CVE-2022-41080) was rated as critical and the other three as important. The critical elevation of privilege vulnerability in Exchange has a rating of CVSS 8.8 and though we don’t see reported exploits, this is a serious low-complexity network accessible issue. Exchange administrators need to patch their servers this weekend. Add this to your “Patch Now” release schedule.

Microsoft development platforms

Microsoft released four updates, all rated important, to its Visual Studio platform. Both the Visual Studio and Sysmon tools are low profile, non-urgent updates to discrete Microsoft developer tools. Add these to your regular developer patch schedule.

Adobe (really, just Reader)

No updates from Adobe for November. Given the number of patches released last month, this is no surprise. We may see another big update from Adobe in December, given its normal update/release cadence.

Remember when everybody used to obsess over productivity? That conversation has fallen out of fashion in recent years. But it’s time to bring it back.

The reason is that productivity crashed this year.

A productivity decline in the second quarter of this year was the largest ever recorded by the Bureau of Labor Statistics. (It recovered very slightly in the third quarter.)

Changes in productivity appear to shed light on the remote work/work-from-home trends. A simplistic view is that productivity went up when more people worked from home, then crashed when many were forced to come to work again.

I’m a strong advocate for remote work, but I think this conclusion is wrong.

For starters, it’s hard to really assess what’s happening with the relationship between employee and employer, given how unusual everything has been lately.

The pandemic ushered in remote work on a scale neither companies nor employees were prepared for. The experience of lockdown, combined with the stresses of fearing COVID-19 itself, was weird for many people.

Remote workers got used to working from home. And now some are being brought back to the office. In other words, the employee experience has been one new situation after the other for two and a half years.

Why productivity fell

The productivity crash was almost certainly not caused by office work. On the contrary, productivity was much higher before the pandemic when far more people worked in offices.

The most likely culprit, in my view, is that employee management hasn’t adapted to the new reality of work.

The best example is that many companies have deployed surveillance software in response to fear that employees are slacking off at home — it’s called “productivity paranoia.”

As a result, for workers accustomed to working autonomously and with greater independence from home, the office feels a lot like working from home while under surveillance software scrutiny.

The natural human response to “productivity paranoia” — and the in-person or software-based monitoring and surveillance focused on the appearance of productivity — is “productivity theater.”

In other words, instead of focusing on doing good work efficiently, employees are focusing more on the appearance of working hard. In-person and software-based monitoring — what we used to call “micro-managing” — disempowers employees and refocuses their attention from substance to perception.

In the new world of work, we have a brand-new set of dysfunctions, with shiny new buzzwords to go with them: quiet quitting, the Great Resignation, and now, productivity theater.

Unfortunately, all these trends appear to point to lower employee effort — abandoning the aim of maximizing productivity.

But if you look carefully at what’s behind all this, you’ll find a profound new belief that ambition-fueled hard work threatens, rather than assures, a better life.

Workers are now more likely to focus on living a good life — one with work-life balance — than on pretending to be productive to appease the boss’s “productivity paranoia.”

How to return to productivity

Today’s workplace disorders are not about lazy workers and mean bosses. They’re about uncertainty.

Workers are uncertain about what’s expected of them and whether the rewards are worth the effort. Likewise, managers and other leaders are uncertain whether employees are slacking off.

The solution to workplace productivity and the end of quiet quitting, great resigning, productivity paranoia, and productivity theater is to attack uncertainty.

It’s time to hyper-clarify the specific results expected of employees in greater detail — in writing — what constitutes success on the job.

Forget about whether or not employees are slacking off. Instead, ignore the appearance of productivity and focus on results.

Place far more effort on mentoring, training, and employee advancement. Make sure every employee has a clear path forward in their career.

And most importantly, partner with your employees on work-life balance and flexibility, enabling them to have a better quality of life.

Uncertainty is killing productivity. It’s time to bring clarity back to the workplace.

Zoom has announced a host of new innovations to its collaboration platform, including new email and calendar integrations and conversational AI features in Zoom’s contact center.

In addition to the updates, Zoom is also launching Zoom Spots, a virtual co-working space designed to help to drive employee connection and collaboration.

The latest platform innovations were announced at Zoom’s annual Zoomtopia conference, which kicked off Tuesday.

Speaking at a briefing before the event, Joseph Chong, head of product, solutions and industry marketing at Zoom, said that one of today’s biggest challenges facing businesses of all sizes is how to stay nimble and adapt to customers’ evolving needs, while trying to figure out what hybrid work means to their organisations and find new ways to make employees feel more connected.

“As organizations shift and move more deeply into flexible work, our mission becomes all the more important,” Chong said. “We’re listening to customers, and we’re deeply focused on creating revolutionary innovations that deliver a connected communications experience on a single cloud platform.”

Empowering hybrid work through unified communications

Although Zoom became synonymous with videoconferencing during the COVID-19 pandemic, as workers started to emerge from lockdown the company has pivoted towards offering customers a more unified approach to collaboration and facilitating hybrid work efforts.

As a result, most of the announcements made at this year’s conference don’t relate to Zoom’s videoconferencing solution at all, instead focused on offering users “continuous collaboration” across all of Zoom’s platforms.

A primary example of this is the announcement relating to connected workstreams across Zoom One, Zoom’s all-in-one communication and collaboration offering that brings together Team Chat, Phone, Whiteboard, Meetings, and more.

Among the new capabilities announced at Zoomtopia is a new integration between Team Chat and In-Meeting Chat, allowing users to move between Team Chat and Meetings to reduce information silos and continue conversations once meetings have ended.

For customers who are looking for enhancements to their video meetings, Zoom has added more video and recording capabilities, including smart recordings to make meeting recordings more consumable, customizable meeting templates, new animal, human and Meta avatars, and the ability to create and share short video clips.

Also announced Tuesday are new email and calendar integrations that aim to cut down on the time spent toggling among apps by allowing users to access their email and calendar directly in Zoom.

Outlook, Gmail integrate with Zoom

Cari Dick, senior product marketing manager at Zoom, explained that popular email and calendar services such as Outlook and Gmail will be integrated directly into Zoom, meaning users can quickly access their communications and scheduling. 

Additionally, for businesses that don’t have dedicated IT services but are focused on privacy and security, Zoom has also launched a new Zoom-hosted email and calendar services, also directly integrated with the Zoom platform.

“Zoom Mail Service provides end to end encrypted email, when messages are sent directly between active Zoom Mail Service users,” Dick said. Zoom Mail and Calendar Services will launch in beta in 2023. 

Finally, Zoom Spots is a new virtual co-working space, set to launch in early 2023. Described by Zoom as a “video-enabled persistent space,” Zoom Spots integrates with the Zoom platform to help facilitate conversations, keep colleagues connected, and bring the benefits of in-person interactions to distributed, hybrid teams.

Dick said that at companies where employees are working in disparate locations, there’s a desire for connection, with colleagues often missing those serendipitous conversations that used to happen in the office.

“We’re recreating that connection, virtually, with Zoom Spots,” Dick said, explaining that users will be able to join in conversations or catch up with colleagues in an ad-hoc and organic way.

“Our vision is that Zoom Spots will help foster inclusive discussions, keep colleagues connected on projects and bring the fluid organic interactions of in person work to distributed hybrid teams throughout the day,” Dick said.

Updates to Zoom Contact Center

Having announced its intention to move into the contact center market at Zoomtopia in 2021, the failed acquisition of cloud-contact center company Five9 a month later saw Zoom press pause on its plans. Then, in February 2022, Zoom launched its own “video-optimized” contact center platform.

Since then, Zoom acquired Solvy, a startup that specializes in conversational AI and automation solutions for the contact center, in May 2022. The fruits of that acquisition now appear to be paying off. The biggest update to the Zoom Contact Center comes in the form of a new virtual agent, a chatbot that uses natural language processing and machine learning to understand and quickly resolve issues for customers.

Called Zoom Virtual Agent, the new capability provides around-the-clock multiple support channels to deliver fast, personalized customer experiences, with the aim of reducing call volumes to human agents and drive operational efficiencies for businesses. Zoom Virtual Agent will be available in early 2023 and can be fully integrated with Zoom Contact Center or purchased as a standalone chatbot solution.

A new integration with Zoom Kiosk will allow users to walk up to a kiosk and use the touch screen to step though the path they need to access the Contact Center resource. Zoom has also announced new integrations with tools like Zendesk and ServiceNow.

Small and mid-sized businesses (SMBs) seeking unified device and identity access management often take a multi-vendor approach. JumpCloud, a company that helps centralize management across users and devices, recently introduced its free cloud-based Remote Assist solution to provide a missing link to remote tech support.

I caught up with Principal Product Manager Tom Bridge to find out more.

What does Remote Access do?

Remote Assist reflects the company’s mission to provide IT teams and MSPs with a single space from which to manage identities, devices, and access. Rather than cobbling together a variety of point solutions, IT teams can now reduce cost, while increasing productivity and security, with a modern cloud directory.

The solution integrates with a range of device management systems, including Jamf, and can handle macOS, Windows, and (soon) Linux.

Remote Access enables an admin with perhaps a user in the field having a difficult time to see the screen of a remote system through an encrypted channel.

Admins can guide users to resolve issues by seeing their screen, or they can take control of the device with the user’s permission. Admins will have exactly what they need to support workers no matter where they — or their admin — happens to be.

Apple’s enterprise story

Apple continues to build market share in the enterprise.

JumpCloud

“Apple has nearly doubled its market share in the enterprise over the last five years due to a lot of hard work from Cupertino on usability, manageability, and security,” Bridge said. “There’s no question that they’ve made major strides in working with Enterprise IT and Security departments, but they still have a lot to learn about how large businesses manage their IT resources.”

It’s clear that Apple is investing in enterprise functionalities, starting with Platform SSO, which is a new way for users of Apple devices to link their accounts with Identity Providers like JumpCloud. There’s a huge amount of activity taking place in the Apple/enterprise space.

There’s room for even more growth, he said, pointing out that Macs now outperform most other laptops in both battery life and computational power at a competitive price to PCs. (And they are steadily gobbling increased PC market share.)

“Honestly, the hardest part of Apple’s job is continuing to overcome a history of expensive products without justifying their value in terms that corporate finance can handle and digest,” he said.

New enterprise, new skill base

In the new world of work, IT has had to deliver support to remote employees. “Handling remote work for macOS as opposed to Windows is little different, but for organizations with employee-choice programs, supporting a second major platform means cross-training and hiring people with different skills,” he said.

That emerging skills gap drove Apple to develop free training courses and to support programs such as the Mac Admins Foundation to help resolve these staffing issues.

Will we return to the office?

The huge disconnect between presenteeism-obsessed managers and the needs of the new workforce means many employers continue to try to corral people back to the office, despite ample evidence that doing so is actually bad for business.

“There’s a concerted movement by management to get workers back into the offices they’re paying to rent, either out of a need to justify their existence, or out of a desire to return to the pre-pandemic office experience,” Bridge said. “There’s absolutely benefits to working in the same space — team building, group planning, serendipitous meetings —but they’re not required every day, and I’d argue that it creates a healthy separation between work and life to not be together all the time.

“We’ve developed some incredible tools for collaboration that don’t require everyone crammed into an open plan office with tiny desks, uncomfortable chairs…. More flexible office life is a way of broadening the abilities and outlooks of your staff by not confining them to a 2-hour drive to your office. Get together, for sure, but make it mean something, please.”

Why is now the right time for Remote Access?

“There’s a saying about planting trees: The best time to plant a tree is 20 years ago,” he said. “The second best time is right now. We’re excited to be entering the remote access market as a part of a more mature and capable JumpCloud.

“Admins are clamoring for tools that serve the entirety of their needs, and adding Remote Access, as we’ve added Password Manager, is a way of providing tools that Admins need in contexts they already understand.”

JumpCloud Remote Assist will be free for any organization to use, at any scale, for any number of devices, without any limits on time.

Please follow me on Twitter, or join me in the AppleHolic’s bar & grill and Apple Discussions groups on MeWe.

Hosts Ken Mingis and Michael Simon talk with guests about the latest tech trends and news.

Audio

Join Macworld’s Michael Simon and Computerworld’s Ken Mingus as they discuss Apple product lineup as we head into the all-important holiday shopping season.

Copyright © 2022 IDG Communications, Inc.

7 inconvenient truths about the hybrid work trend

For knowledge workers, location flexibility significantly improves outcomes related to innovation, wellbeing, burnout, and perceptions of organizational culture, according to the 2022 State of Teams report from work management company Atlassian.

The research consisted of responses from 1710 knowledge workers across Australia and the U.S.,  between 21 and 65 years old, operating in teams. The sample comprised 43% women and 57% men.

The main findings outlined that teams have an equal shot at success regardless of where they work, with the improved outcomes regarding wellbeing and innovation creating a ripple effect that yields even more favorable outcomes.

The report further stated that flexibility is linked to positive perceptions of an organization’s culture, which in turn is strongly associated with higher employee retention rates. Plus, people from hybrid and distributed companies are more likely to identify their teams as innovative.

However, providing employees with the ability to work in a distributed way is not without its challenges. Atlassian’s research also found that when people have different schedules, it can be harder for teams to stay aligned on the specific tasks under way.

The research also found that people with greater location flexibility are more susceptible to imposter syndrome, perhaps because they’re less likely to get incidental positive feedback and cues from colleagues when they’re physically separated.

Annie Dean, head of Team Anywhere at Atlassian, said that while the responses were collected in the U.S. and Australia, Atlassian suspects most global teams can relate to the trends identified in the report.

Dean added that since Atlassian announced its own distributed work policy over two years ago, the company has reaped many of the benefits that come from giving employees more flexibility. However, Dean said that this doesn’t mean Atlassian hasn’t also faced many of the same challenges that surfaced in the research.

“As the makers of collaboration software, we make it our job to understand the challenges of distributed work, share what we learn along the way, and then bake those learnings into our product innovation,” Dean said. As a result, Dean added that it was “no coincidence” that many of the new products and features Atlassian has recently introduced directly address the pain points identified by this research.

Despite benefits, distributed workforces still face challenges

While location flexibility is linked to improved company culture, which in turn is often associated with higher employee retention rates, the report found that there are still a number of challenges facing distributed workforces.

Among the positive workplace trends that were highlighted by the research, 78% of people surveyed said they’re enthusiastic about their work, up 9% from last year’s survey, with 75% of respondents stating that respect for different views and perspectives is the norm on their team. In Atlassian’s 2021 survey, that figure was 66%.

Another statistic that has also improved from last year was the percentage of respondents reporting that they have visibility into how decisions are being made—63% in this year’s survey, compared to 51% in 2021. Furthermore, this trend appears to track in line with increased trust in leadership, which rose by 11% year over year.

However, there continues to be a number of challenges facing distributed teams, and Atlassian found that more people are now pointing to factors in their personal lives that make it harder to do their work—33% this year compared to 26% last year. The report suggests that this indicates that mental health and financial challenges caused by the pandemic persist.

Additionally, the research found that among teams that were self-described as being “innovative,” 42% of respondents acknowledge they exhibit at least one sign of impostor syndrome. Since  Atlassian’s data also shows strong links between impostor syndrome and reduced engagement, the company noted that it’s “vital for leaders to make sure the merits and limitations of an idea get equal airtime.”

Atlassian also reported a challenge related to virtual meetings. While office-only workers have around five hours of meetings in an average week, for people on distributed and hybrid teams that figure is closer to eight hours. As a result, the research found that spending more time in meetings is linked with a significantly higher risk of burnout, with 31% of respondents who had over 20 hours of meetings scheduled per week expressed that they were experiencing one or more signs of burnout, compared to 23% of those who had 15 hours of meetings or less.

Dean said that after collating the research, many of the trends did hold true, based on conversations Atlassian has had with customers, alongside the company’s own experiences as a distributed team.

“One of the data points that did raise my eyebrows was related to imposter syndrome,” Dean said, highlighting the surprisingly high percentage of respondents reporting this feeling.

Dean said that where this is caused, at least in part, by a culture that emphasizes brainstorming, critique, and providing instant feedback, its important leaders use tools and practices that allow all ideas to be shared in both synchronous and asynchronous manners.

“It’s also important to find opportunities for spontaneous high-fives and other incidental positive feedback when we work distributed,” Dean said.