Overseeing the Intersection of Digital Transformation and Cybersecurity
Overseeing the Intersection of Digital Transformation and Cybersecurity
We’ve all heard the buzz word “digital,” and I am often asked questions about how to analyze and oversee the risks of enterprise-wide digital transformation. While a possible nuisance to the person asking, my first answer tends to be a question.
What do you believe it means for your enterprise to become digital?
Only once your company answers that question can the challenges and risks associated with a well-managed transformation be weighed. Invariably, the answers to this question are unique and divergent. The answers also, by necessity, should include insights into these added threads:
- How do we manage digital transformation risks without taking our focus off cybersecurity?
- What is the role that cybersecurity plays during digital transformation?
Cybersecurity and digital transformation are two areas that are rife with risk, and are shaping challenges around enterprise risk management (ERM) that are both divergent and orthogonal.
In order to reengineer the enterprise for digital excellence, cybersecurity risks must be considered hand-in-hand with the risks inherent in disparate digital infrastructures. Our consumers and stakeholders expect mobility, with just-in-time, just-in-context service. They also expect the digital experience to include interaction expected anywhere in the world the consumer may happen to be located, while at the same time responding immediately to changes in consumer behaviors.
No pressure, right?
Digital transformation is critical to most enterprises, but how can the board successfully oversee the management of these new risks? First, the board should consider the operational changes that come with digital transformation.
Defining Enterprise-Wide Digital Transformation
To achieve the new digital paradigm, enterprises embrace new technology models to deliver a digital experience for end consumers. These models often require vast adjustments to the organization, business, and technology operating models to be successful.
Consider this example. To meet consumer demands for digital experiences, enterprises are embracing cloud services as a platform to accelerate delivery of a product or service. This means that there is no physical data center lurking in a corner of your corporate headquarters where your technology operations team goes to provision, configure, and adjust wiring and floor space. There are no blinky-lighted servers on site that developers and the business historically have monitored.
What does this change bring?
- Operating model change.
- Technology model change.
- New risks.
Continuing with the example, infrastructure-as-a-service capabilities like the ones offered by Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform provide enterprises a “virtual data center,” an environment where developers can begin to create code for a new product immediately. This increases the speed to launching a new digital service.
What happens next? Everything changes again. The company would now need a development operations (DevOps) team with combined software development and information technology operations skills to shorten the systems development life cycle (SDLC)—all while delivering features, fixes, and updates frequently in close alignment with business objectives.
Where is the segregation of duties? Where is the old SDLC waterfall process of requirements (design, build, test, then deploy software) all run by separate teams with a set of controls that source documented evidence?
Oh yeah, we don’t do that anymore as a digital organization.
Once an organization begins the process of digital transformation, the technology operating and control models change, business objectives have to adjust to consumers’ digital demands, and the roles and talent requirments needed to function absolutely evolve.
We’ve seen too often that enterprises that rely on digital channels can be interrupted and burdened by cybersecurity missteps. Without an imperative to transform cybersecurity prior to operating the enterprise in a new digital format, disasters are bound to happen. As reported by Bloomberg, one example of many things that can go wrong with the shift to digital operations was the breach at Uber Technologies. The company was utilizing a private Github repository—a cloud-based development resource—for its code. A careless developer left logon credentials of users open to bad actors, allowing them to access Uber users’ data on AWS.
While this is a fairly simple illustration of the disconnect between digital transformation and cybersecurity practices, your cybersecurity program and controls need to evolve to a new method of operating digitally and provide an appropriate set of controls that enable strong risk management.
Don’t allow your management team to make the mistake of accelerating digital transformation without first analyzing the readiness of your company’s cybersecurity program to manage these new digital operating models and domains.
Sequencing Digital Change With Digital Cybersecurity
Cybersecurity risks and challenges are omnipresent, and the risk and threat landscape continue to evolve at the pace of our digital environments. Making the move to embrace digital operations only expands your company’s attack surface.
While your company once was operating out of a data center with its own server hardware, the move to the cloud means that the company’s data operations may now be functioning in “rented,” multi-platform environments such as native cloud, software as a service (such as Salesforce Cloud), or outsourced, provider-managed environments.
One essential question that directors can ask the technology and security leaders of their companies is, “Have we built new cybersecurity capabilities to secure our increasing attack surface and the new digital environments and channels?”
The answer in many cases is that your cybersecurity program has not transformed digitally and could be unprepared for a new digital paradigm.
The previously effective cybersecurity program you had in place was not purpose-built to enable a digital transformation. It was instead built for a world of data-center centricity and simple service offerings managed from a web application storefront—all solutions that are protected by on-premise firewalls, endpoint security, denial of service security, content filtering solutions, and a host of other appliances managed in the company’s data center.
Therefore, it’s important to consider a risk assessment to determine the readiness of the company’s cybersecurity program to secure its new digital domains and environments—on premise and off.
The companies that build a digitally-transformed enterprise that places the cybersecurity program first, will see greater success in enterprise digital transformation. They are able to demonstrate to the market that they are operating with a well-managed risk posture, and are able to move faster to achieve safe, sound digital success.
Overseeing How the Risk Is Managed: A Way Forward
Every enterprise believes that they have a winning strategy to thrive within the new digital market, but the hard truth is that they will not all be winners. Those that win will have a digitally enabled cybersecurity threat and risk management platform operating in harmony with their digital business strategy.
The risks of digital transformation and cybersecurity are clearly impacted by ensuring the right sequence of digital strategies while managing the risks during this transition. As board members, it’s our imperative to ask the questions of enterprise digital readiness for cybersecurity and having purpose-built cybersecurity for digital environments.
Here are my suggestions for questions to ask your management team to determine if the cyber- and enterprise-wide risks of digital transformation are being properly conceived of and managed:
- How are we defining digital transformation for our enterprise with regard to the business and technology operating models?
- What are the cultural impacts on the personnel and teams affected by digital transformation? How are we considering the organizational risks as we require new talent and roles to operate digitally and manage risk during the transition to digital operations?
- Have we performed a risk assessment to determine the impact of the changes to the business, technology, and cybersecurity operations required to become digital? How is our attack surface expanding with the movement to digital operations and how are we managing the risk?
- How are we sequencing required changes to digital operating models for cybersecurity, technology, and the business?
- How are we measuring the effectiveness of our cybersecurity program with the transformation to digital? Are we making the right investments in cybersecurity to manage digital cyber risk?
Like the nuisance question at the beginning of this statement, getting the right answers will be the key to sound oversight of a successful digital transformation program at your company.
