After over a decade of working with startups, private equity, and over the last 5 years of deep big 4 client services acting in different executive roles (CISO, CIO Advisor, Board of Directors support) I am certain there is a need and lack of implementation for adapted information security that is reflective of the size, maturity, and capabilities of the business. This applies independently to the the product and the enterprise as a whole. To that end, I have begun building models of activities to match each level of maturity to try and bring clarity or at least a set of guidelines.
As I share with my clients … in some cases a founder is deciding between EATING and NOT. So every function and feature, including security habits, must contribute to the current needs!
I have begun working with several partners and venture capital firms on this model, but wanted to share a nice post that highlights some very informative ‘Patterns in Hyper-growth Organizations‘ and what needs to be considered (employee type, tools, etc..). Please check it out and I look forward to working with the community on these models.
A snippet on her approach and great details:
We’re going to look at the framework for growth. The goal is to innovate on that growth. In terms of methods, the companies I’ve explored are high-growth, technology-driven and venture-backed organizations. They experience growth and hyper-growth (doubling in size in under 9 months) frequently due to network effects, taking on investment capital, and tapping into a global customer base.
Every company hits organizational break-points. I’ve seen these happening at the following organizational sizes:
via Mapping the Startup Maturity Framework | Likes & Launch.
Posted in Boards, Business Agility, Governance, Management, mergers and acquisitions
Tagged @br_ttany, angel, cio, ciso, founders, fund, hyper-growth, information security, james deluccia, jdeluccia, organization, private equity, Security, series a, series b, startup
ENISA released a study with a methodology identifying critical infrastructure in communication networks. While this is important and valuable as a topic, I dove into this study for a particularly selfish reason … I am SEEKING a methodology that we could leverage for identifying critical connected infrastructure (cloud providers, SAAS, shared services internally for large corporations, etc..) for the larger public/private sector. Here are my highlights – I would value any additional analysis, always:
- Challenge to the organization: “..which are exactly those assets that can be identified as Critical Information Infrastructure and how we can make sure they are secure and resilient?”
- Key success factors:
- Detailed list of critical services
- Criticality criteria for internal and external interdependencies
- Effective collaboration between providers (internal and external)
- Interdependency angles:
- Interdependencies within a category of service
- Interdependencies between categories of services
- Interdependencies among data assets
- Establish baseline security guidelines (due care):
- Balanced to business risks & needs
- Established at procurement cycle
- Regularly verified (at least w/in 3 yr cycle)
- Tagging/Grouping of critical categories of service
- Allows for clean tracking & regular security verifications
- Enables troubleshooting
- Threat determination and incident response
- Methodology next steps:
- Partner with business and product teams to identify economic entity / market value
- Identify the dependencies listed about and mark criticality based on entity / market value
- Develop standards needed by providers
- Investigate how monitoring to standards can be managed and achieved (in some cases contracts can support you, others will be a monopoly and you’ll need to augment their processes to protect you)
- Refresh and adjust annually to reflect modifications of business values
I hope this breakout is helpful. The ENISA document has a heavy focused on promoting government / operator ownership, but businesses cannot rely or wait for such action and should move accordingly. The above is heavily modified and original thinking based on my experience with structuring similar business programs. A bit about ENISA’s original intent of the study:
This study aims to tackle the problem of identification of Critical Information Infrastructures in communication networks. The goal is to provide an overview of the current state of play in Europe and depict possible improvements in order to be ready for future threat landscapes and challenges. Publication date: Feb 23, 2015 via Methodologies for the identification of Critical Information Infrastructure assets and services — ENISA.
Posted in Boards, Business Agility, information security, Management, Risk Management, Security
Tagged business value, cloud, Compliance, enisa, information security, irr, isp, james deluccia, jdeluccia, research, roi, saas, study, supply chain, united states
Longues Sur Mer
At this location on the coast of Normandy you can see the immense naval guns setup to attack oncoming ships in World War II. The Germans expended resources and relied heavily upon on these guns in their defensive strategy. Unfortunately for the Germans, the treatment of the workers and locals, the sheer lack of natural intelligence, and exposure of building such vast emplacements was their downfall.
The Allies often received intelligence on the exact positions of German construction. This was provided by those building and living in the area. Specifically, a local farmer boy who was blind and actually counted each step precisely and then supplied locations through the French resistance and Allied intelligence networks.
The result was a gap in the German defensive strategy, a waste of resources, and ultimately, a failure to defend the coast.
Business Reflections: Innovating and Penetrating the market…
- How are you establishing a product development strategy and running your business as a whole?
- Are there defensible attributes that you deem critical, and how can they be routed?
Practical example: In the information security and intellectual property sector, there are very real threats and running a secure business requires constant new methods of defense. How have you reevaluated these based on the shifts internally of your business and the known threats in the market itself? How did this analysis compare to prior years, and how have the effectiveness of your defenses proven?
From a product innovation perspective – are you developing in features from the highest and lowest levels? What are the high impact:low development efforts underway, and what could be added. Product and innovation requires views on the long and short run – to often we make complexity because we are able to handle complexity, when sometimes the user really only needs something less complex.
Leadership requires action:
Simply acknowledging the risks and accepting the situation does not prevent disastrous outcomes.
What is Battlefield Leadership and what is this series about …
As part of my pursuit to learn and grow, I sought out the excellent management training team at Battlefield Leadership. I am professionally leveraging this across multi-million dollar projects I am overseeing (currently I am the lead executive building global compliance and security programs specifically in the online services / cloud leader space). Personally I am bringing these lessons to bear within my pursuits to cross the chasm. To often I see brilliant technical individuals fail to communicate to very smart business leaders and to the common person on the street. My new book – How Not to be hacked seeks to be a first step in bringing deep information security practices beyond the technologist.
Most exciting the Battlefield group for this training placed it in Normandy France. This allowed for senior executives to be trained in a setting where serious decisions were placed by both sides, and each provided a lesson. This series represents my notes (that I could take down) and takeaways. I share to continue the conversation with those great individuals I met, and with the larger community.
Posted in Boards, Business Agility, Governance, Management
Tagged allies, battlefield leadership, cloud practices, cloud strategy, customers, D-Day, france, innovation, insight, leadership, Management, normandy, outcomes, risks, Security, strategy
ComplianceWeek has two examples of implementing ITGRC solutions in two multi-billion dollar organizations. Each interestingly deployed in two unique fashions and had different takeaways from the experience. The article speaks directly about SAP technology, but the successful GRC implementation practices apply to any organization.
In fact, evolving an organization’s risk framework through the adoption of an IT-GRC solution is a benefit to any size organization and even individual lines of business within an organization. Additional support for GRC and it’s business benefits I discussed here for additional insight, and with registration the OCEG documents are quite insightful.
A key point within the article is the focus beyond the risk and security and or compliance benefits that are generally listed for GRC. There are numerous benefits to GRC that help improve profitability, lower failure rates within operations, and enhance business communications – among other benefits. The simple reality is having greater clarity and effective automated systems is a strategic advantage in every business.
The article highlights a few specific GRC implementation tips and can be found here at this link. Below are my ‘next’ three tips to consider:
- Do your pre-planning: Just as in a marathon one does not simply walk to the start line and figure it out as they go. Similarly organizations seeking to integrate an important technology such as GRC (one that will become ingrained into the critical business operations), must consider how things should happen out of the gate. Business leaders and technologists need to identify the specific objectives, parties, and input/outputs required. Such specifics will ensure targeted project management and prevent scope creep. The secondary benefit of this adherence to a plan (and there can be many cycles where the process is enhanced continuously) is the absolute recognition of achieving targeted goals and objectives. An effect that will certainly help to maintain the momentum of the project.
- Training and Paperwork: In order to successfully integrate the technology into your organization it is necessary to know how it is currently being accomplished today, or how it should be done based on the culture and business objectives. Therefore it is best to first work through the components of the GRC program on paper and in collaborative work sessions prior to sitting down in front of an administrative console. These work sessions should produce specific ‘paper’ on how such things as permissions, authorization, business core metrics, and such are to be enabled in the application. The technical specifics of how such will be done should be considered afterward. In most cases – this type of program design can occur prior to the selection of any actual vendor product, and therefore could be used as purchasing criteria when such are defined.
- Seek Professional Help: The article highlighted the benefits of leveraging third parties to augment the business staff to successfully launch these programs. It is critical that such third parties be brought onboard for such work. In lieu of these specialty teams a business could hire individuals with deep experience in the technology and specialty. In either case – focus on experience, targeted delivery, and proper teaming with business teams; tech teams; and other service providers.
The Two Reviews of GRC Software Implementations from ComplianceWeek can be found here.
Other best practices / thoughts?
James DeLuccia IV
KPMG put out a 10 to-do items for Audit Committees that defines excellent areas that should receive attention given the economic and competitive environments. You can find the press release here. Upon reading it I was struck by possible Information Technology business to-do items related to security and risk management, and wanted to share those that struck me.
- IT Strategy should be reset – Nearly all budgets were changed in 2008/9 and required massive shifts from the original 1/2/5 year plans. This shift to the immediate short term to avoid becoming terminal has passed enough to pick our heads up and assess the landscape. Goals should be reviewed; priorities re-evaluated, and teams adjusted to fit the new operating norms. This is not an endorsement to double budgets or blindly return to old plans, but instead a call to refocus and consider the business and operating realities BEFORE moving into new initiatives.
- What was lost during the cutting? – As organizations went through mergers and shrunk budgets certain information safeguards were impacted. They may have been impacted by staff reductions or lapses in maintenance of systems. An inventory of the technology and process canvas is necessary to see what assets exist within the organization. Assets does not only mean hardware, but software, process, and the people that form the glue!
- Consider the Risk Landscape – As the business evolved and adjusted to the challenges of the past 2 years, many changes occurred to the operations and the structure of the business. These may include such things as divestitures; consolidations; new partnerships; outsourcing; cloud computing, and other strategic cost saving strategies. The end result is the creation of new logical relationships and inter-dependencies that require consideration. An enterprise risk analysis can uncover these newly formed risks, and ensure that they are satisfied with the appropriate and necessary safeguards.
- Duck and Cover – An unfortunate consequence of a challenging year (or two) for companies is the natural response for team members to literally put their heads down and avoid making sudden moves that may draw attention. This negatively impacts the business directly – a loss of innovation, good-will, and full engagement of each associate. Leaders can address this by communicating the state of the business and take demonstrable actions that solidify the message.
The most important aspect for IT strategy and business is to re-center, focus on the people, and push/pull/drag the organization to a stronger more secure future.
James DeLuccia IV
Posted in audit, auditing, Business Agility, Compliance, GLBA, Governance, iia, information security, IT Controls, Management, mergers and acquisitions, Payment Card Industry Data Security Standard, PCI DSS, Risk Management, Security
A short piece in the Wall Street Journal the other day focused on the challenges that firms face with the introduction of new technology, and how these new gadgets can complicate an organization’s controls. The article highlights the difficulties faced by investment firms as there are specific regulations to capture all traffic relating to financial transactions. In the context of this mandate, the article raises the issue when employees purchase iPhones and other smartphones, and the resulting difficulty in meeting regulatory mandates.
This issue is not reserved only for financial firms, but is applicable to any firm. New technologies – such as smart phones, Instant Messenger, Peer to Peer, Torrents, and VOIP are all initially resisted by firms until an ROI and business case justifies the added management expense. Beyond the adoption of these technologies organizations that adhere to standards, such as PCI DSS, must be aware of the implications regarding these tools:
- Sensitive Data may be transferred to these devices increasing the scope of an audit
- Transmission, Storage, or processing of sensitive data through these newer technologies requires a re-evaluation of the risks, controls, and procedures
- Deployment and enhanced control environments are required as the technology expands the platform, geography, and dimension of the data itself
- Management direction must be re-evaluated to ensure that extended operations resulting from newer technologies are aligned and consistent with the strategic efforts of the organization
- Updates to policies and procedures are necessary
- Modifications to disaster recovery and backup systems must include these newly introduced technologies that emerge as part of the business processes.
Avoidance of technology leaps and enhancements can damage a firms competitiveness, but blind adoption can result in far greater financial and legal penalties.
Update: Book Release is now March 19th 2008!! Pre-Order Today