New Wine, Old Skins?
New Wine, Old Skins?
Managing the risks associated with the new wave of technology innovation
What an exciting period of technology we are in. Following the millennium bug debacle and the dot-com bust, it almost seemed that the technology wave was slowing down, leading some pundits to suggest that IT was becoming a pure commodity, adding little business value. From this standing start, IT has become exciting again: as we discuss below, there are a number of developments that are significantly impacting organisations large and small. However, technology is a sword that can cut both ways. The purpose of this article is to consider what impact new technologies are having on our business lives, and what we might do to address the inherent risks.
To start with, we need to revisit what we mean by risk. There are many types of risk, and while IT may have some specific risks of its own (technical risks associated with incompatible or poorly patched software, for example), these often translate into risks that are directly felt by the business, such as:
-
Financial risk – where business is lost, or unnecessary costs are incurred as business users are unable to get on with the job.
-
Compliance risk – where the organisation becomes liable with respect to regulation or corporate standards.
-
Reputational and brand risk – where an organisation faces bad press, with potential loss of business as a result.
The risk landscape is more of a jungle than a green field, however. Several examples of high-impact failures have not had the effect that might have been expected – while the Wifi blunder that caused the leak (or to be frank, the outright flood – 45 million records were taken) of credit card data from TK-Maxx may have resulted in $128M of losses to the company, but the retail organisation has not seen any significant impact on its trade. Meanwhile, the lessons from the HMRC incident where two CD’s of child benefit records (25 million of them) are still to be learned – to quote UK Information Commissioner Richard Thomas in April 2008, "It is particularly disappointing that the HMRC breach has not prevented other unacceptable security breaches from occurring.“
It is worth mentioning both of these examples to illustrate that the discipline known as ‘risk management’ is far more complex than that simple term might imply. Such complexities include understanding what exactly is meant by risk, where the real likelihood of business damage is to be felt, and perhaps most importantly, the fact that no organisation, large or small, is operating in isolation from what is a much larger, rather shaky ecosystem. It is against this background that the smaller business needs to decide its strategy for how it uses IT.
Despite the somewhat gloomy picture pained by examples such as these, there are still a great many potential benefits to be had from how technology is evolving. Right now a number of trends are driving considerable change across many businesses, such as:
-
Broadband mobile technologies such as 3G wireless are becoming more affordable and therefore prevalent, these are running alongside higher bandwidth fixed broadband to homes and offices, and enabling a wider variety of home working and remote working practices.
-
The Internet is increasingly becoming a platform for collaboration, with consumer-oriented social networking sites such as Facebook and Myspace sitting alongside more business-oriented sites like LinkedIn and Ecademy.
-
We are also seeing a resurgence in Web-based applications and online hosting facilities, driven by such organisations as Google. Microsoft and Amazon.
Behind all of this, no doubt catalysed by such advances but equally driving them, is a more demographic change across business, towards increased collaboration and open-ness. In general terms, we are seeing organisations of all sizes increasingly looking to move away from the traditional employer-employee hierarchical model towards more of a network-based approach where organisations collaborate on the creation and delivery of business services.
In retail this may be a more familiar story, where business to business (B2B) and supply chain activities are seeing more of an evolution than a revolution. In other sectors, such as the research side of pharmaceuticals, the collaborative approach is far newer. While smaller organisations are more likely to be brought into a collaboration rather than acting as the hub, there are still a number of new business opportunities to be had, aided and abetted by the use of IT. New opportunity yields new risks, not least because existing systems and processes were unlikely to have been designed with the future in mind.
Keeping up with technology change, and integrating the new with the old, is a massive challenge across the organisations we research. At a recent security event in London, a number of Chief information Security Officers (CISOs) from different verticals expressed that one of the biggest problems they faced was how the new risks caused by new applications and infrastructure, now had to be treated in the context of increased business collaboration.
We therefore need to consider risk both in terms of the changes we are driving, and the changes in which we are mere participants. In smaller organisations, the challenge is further exacerbated by the fact that there are less likely to be the skills or the bandwidth in-house. So, what to do? Given that there are no easy answers, how should such businesses put their best foot forward and reap the rewards of the business opportunities while still addressing the risks, so you don’t come unstuck in the process? From our research and conversations with a wide variety of organisations we have distilled a number of guidelines, as follows.
Make IT work anywhere. There are two technology-related consequences of the open, collaborative world we are moving towards. One is that much activity is taking place outside the organisation’s IT boundary, and a two-tier system which treats connected devices and applications differently depending on which side of the firewall they sit is becoming increasingly untenable. The second concerns the ‘who’ rather than the ‘what’ – business partners, subcontractors, consultants and so on are requiring access to corporate systems and data. This may bring up a number of questions around data protection, vetting and so on, but it is better to treat these up front, than sleep walk into later problems.
Manage access by identity. The increased fragmentation of the corporate boundary makes it necessary to implement other control mechanisms than just, “he’s inside the building, so he must be OK.” Increasing attention is turning towards the management of individual identities, and provisioning access and facilities based on role. This does not translate into buying an identity management system, as realistically, this is one area where technology is lagging behind the need. A good start however is to start documenting who has access to which systems and data, whether they are employees or partners. If you find this a challenge, then you may already be at risk.
Classify information by risk. The traditional approach to risk management involves gaining an understanding of risks, then treating them accordingly. Given what we have already seen however, this is akin to mapping the jungle: it is still important but it can only be one part of what is done. At the same time, activities around reviewing what information exists, how important it is to the organisation and how well it is protected, provides a different viewpoint which enables the subset of high-risk information to be treated as a priority. Some organisations are adopting a traffic light system as a starting point: what information do you have that would cause the business to fail if it were compromised?
Bring in the experts. The brave new world of online collaboration can also be applied to how we understand and reduce risk. It will always be necessary to run and maintain some security capabilities in house, for example, but it can equally make sense to look to how security can be delivered ‘in the cloud’. Equally, there is no honour in ignoring security risks, nor shame in bring in third parties who have a better grasp of how IT is moving forward. From our research we understand that the key to successful use of third party services is in the decision making process: adopting a business perspective enables more light to be shed on what skills add significant business value and should be kept in-house, compared to what should be sourced from third parties – the same applies to risk management.
More best practice, less policy. While policy is important, it often focuses on the ‘what’ rather than the ‘how’. Best practice is more about the latter – and in this context, we’re thinking about how risk management best practice applies to all aspects of IT management and delivery. This often boils down to review checklists – has a given application been security tested before it is deployed, for example, or has the code been peer reviewed? Has the consultant who has been brought in for a day, been cleared to access the information he or she requires? It is all too easy for what are often very simple checks to be forgotten; far simpler is to ensure that the default behaviour involves running through the appropriate checklist.
Guidelines such as these are not exhaustive, but they offer a good starting point for thinking about some of the challenges. At the same time, they should not distract from one of the key principles of risk management: that is, to be vigilant. An uncomfortable truth about IT-related risk is that whatever new innovations the technology world may come up with, each will in some way be exploitable by a spectrum of ‘bad guys’ – there are the relatively innocuous practices of building a picture of a prospective client by browsing around the Internet, and at the other end of the scale, seasoned hackers are using leading-edge technologies to launch focused attacks on high-profile individuals. Perhaps this yields the biggest lesson of them all: that, even if it ever was, doing nothing and hoping the risks will go away is simply no longer an option.