CDO, CPO, Information Management and Governance, Information protection, Privacy

Role of a CDO Supporting Boards of Directors

Executive Summary:

Companies are increasingly looking to leverage data as a new revenue stream or a way to increase efficiency.  However, risks related to data breach continue to figure prominently on Board agendas. A Chief Data Officer acting as an advisor can help Boards and Executive Leadership understand the risks and opportunities around data, which in turn, helps Boards fulfill their responsibilities to the organizations they oversee.

Introduction

Boards of Directors have an important and challenging role.  Among other duties, they are responsible to stakeholders for the performance of the organization they oversee.  This includes not only helping to enable business directions and objectives, but also ensuring Management properly identifies, manages and mitigates risks.

Two areas stand out among the ways that information and data figure prominently:  First, business opportunities created by rapid developments in data science and related computing platforms, and second, risks relating to data breach and loss, often under the heading “Cyber risks”.

Business opportunities

Business opportunities tied to information are becoming more important to companies.  Specifically, the significant increase in the role information re-use, leverage and monetization plays in many companies’ strategic plans, increasingly tied to AI and Digital Strategy.  These are outlined in terms of leveraging data science and the abundant range of available data to:

  • Create net-new products and services, including monetizing data, or
  • Enhance and augment existing products and services, or
  • Enrich management information to drive efficiencies.

These initiatives are not trivial, and the potential benefits are huge, whether as new revenue streams, or optimizing operations; many organizations view leveraging information at the strategic level as critical to their continued success – a matter of survival.  Paraphrasing George Orwell, “whoever controls the data, controls the future.”

And momentum is building at a remarkable rate, both in terms of the volume and breadth of usable data, as well as the sophistication of the tools designed to analyze and leverage data.  

Information risks and obligations

Information-related risk presented to Boards and senior executive leadership are often grouped together under the broader topic of Cyber.  These are generally risks related to breach of systems, theft or unauthorized disclosure of data, intrusions, threats to the integrity of systems and data, and the risk of system outages and disaster recovery.  Many recent incidents are where data is exposed on the internet and where the company realistically has no idea whether an actual loss has occurred.

A second category of information risk is also rapidly emerging with increasing consequence, and that relates to compliance with privacy-related information handling obligations and regulations.  These include, for example, the recently enacted EU GDPR (affecting the handling of personal information belonging to EU citizens), HIPAA/HITECH (affecting the handling of health information), and California’s CCPA (affecting the handling of personal information belonging to residents of California).  

Beyond the regulations, there are increasingly explicit requirements for handling data belonging to other stakeholders, spelled out in contracts or other “data use agreements”.  

Consequences for violating information-handling obligations include,

  • Financial: lost productivity, loss of customers, loss of competitive positioning, etc.,
  • Regulatory: fines or other measures imposed by regulators, if the company was at fault.  In the case of GDPR, fines can be as much as 4% of revenue.
  • Brand: loss of customer trust and confidence in the company’s ability to deliver, or to protect information entrusted to them.

Key questions

When evaluating company’s use of data, Board members and executive leadership should ask themselves certain key questions around how data is being leveraged and managed.  These include:

  • What approach is the company taking to leverage data?  What is the vision? The strategy? Is governance a component of the strategy?  Many companies are racing to implement data leverage plans, and in their haste to make headway, many have been hiring data scientists in leadership roles to drive tactical plans ahead.  As a result, governance is often overlooked. However, without proper governance, it will be hard to create a credible strategy reflecting the needs of the business, as well as identify all the opportunities, priorities, costs and risks.
  • Is the data leverage team (“data scientists”) following elements of the Scientific Method?  Many people calling themselves Data Scientists are proposing initiatives where they requisition increasing volumes of data so they can see what opportunities they can come up with.  By itself, this approach introduces risk, since the company may not have a clear idea what they are getting for their investment in big data. By analogy, pharmaceutical companies wouldn’t fund researchers to “play” in the lab letting them see what new drugs they can invent.  Companies pursuing plans to leverage data should do so following some formal methodology which includes articulating and testing hypotheses.
  • Has a data inventory been performed?  What obligations are tied to the data?  Most companies have sizeable volumes of data on hand, and many are asking how they can monetize and leverage the data.  An inventory is critical if the company is going to leverage or monetize data, and knowing obligations is key to understanding what you can do with data and structuring protections.
  • What is the most valuable data and where is it?  Most data classification schemes are very basic — only 2 or 3 classifications.  While these are simpler to implement for security purposes, they aren’t useful for determining relative value of data or what data is key, and can interfere with otherwise appropriate use and access.
  • Who has access to data, and is that access appropriate?  Without proper data governance, you can’t reliably know whether access to data is appropriate.  Being able to answer this question is required under certain privacy and banking regulations.
  • Is it available to the people who need it, and are safeguards appropriate?  Leveraging data requires that the right people can gain access to the data.  But even while its being processed, certain safeguards still need to be in place, and these may be different than for data “at rest”.
  • Have risks to information been assessed along IT and non-IT lines?  Risks should be assessed based on the business processes that manipulate data — not just IT repositories holding data, or applications touching data.  People are the biggest cause of data incidents, and are responsible — in some way — for most “insider threat” incidents.
  • If information were lost, stolen or exposed, how would you know?  Most companies invest in preventing theft or misuse of data, but its extraordinarily difficult to know when data has actually been breached.  Most of the time, companies find out when an outside agency — such as law enforcement, the press, or a “hacktivist” group tells them. Proper data governance and inventory can help reduce the risk of data loss, and allow the company to focus protection efforts on more important data assets.

Step back

Many enterprise risks concerning data elevated to the Board focus on the technology aspects of the risks.  This is often because that is how the company is organized — anything loosely connected to “data” is directed to the CIO and CISO.  Digging into the risks, however, often reveals that the underlying concern is data: it’s use and the consequence of an incident. Taking a step back, if the concern is data, it may be helpful to separate the data from the IT platform it sits on, and from there, zero-in on the issues – both opportunities and risks.

The role of CDO

Increasingly, companies are appointing CDO’s — Chief Data Officer — tasked with implementing governance over the data initiatives, and aligning activity to execute data strategy.   The responsibilities of the CDO vary across organizations, but in general, they should be looked to by the Boards to help understand and navigate data-related matters.

A good CDO focuses on all aspects data – opportunity, risks and obligations.  They are conversant on the technology tools that process, store and transmit data, and can help the Board members understand the topic with clarity so they can engage with executive leadership.  Board members should consider seeking support and advice from experienced CDOs to help them navigate data-related matters in the organizations they oversee.

Conclusion

Data has always been critical to organizations.  In recent years, its increasingly being recognized and treated as an asset that can be leveraged to provide added benefit to organizations, whether through increased revenue or operational efficiencies, and that benefit is tied to the rapidly evolving field of data science as well as the incredible growth in available data.  With the increased prominence of data at the strategic level, Boards of Directors and Senior Executive Leadership are expected to understand and provide direction around the use of data and management of related risks. CDO’s can serve as a valuable resource to help Boards in fulfilling their responsibilities.  

Contact me at james@jhoward.us

Information Management and Governance, Information protection, Uncategorized

The Role of the CDO in Counter Industrial Espionage

When one thinks of spies and espionage, our imaginations usually turn to James Bond and Jason Bourne stories.  But with the end of the cold war, many former intelligence officers found more lucrative opportunities in the private sector, offering their services to non-government organizations that were perfectly willing to leverage the research and development capabilities of their competitors.

Fast forward to a time where the economic competition between companies affects political tension between nations, where some nations see nothing wrong with applying techniques developed during cold and shooting wars to provide their own companies with ill-gotten advantages – even at the expense of political allies.

Politico recently published this article that discusses how companies in the Bay Area have become targets for industrial espionage originating from China, Russia and other nation-states.  The article touches on the breadth and depth of the problem, including making a very interesting point that many companies choose not to prosecute espionage cases.  Its remarkable that even when faced with irrefutable evidence, many corporate leaders choose to ignore the facts and fail to notify stakeholders, for fear of how it will reflect on them or affect share price.

There is no doubt that building defenses against industrial espionage is a complicated task, made harder because (1) information has to remain available and usable by the organization, and (2) the organization has to anticipate a wide range of attack “vectors” whereas the intruder only needs one to work.  And if this wasn’t complicated enough already, industrial spies don’t just target computer systems, they target people.  If truly successful, the organization won’t know they’ve been hit until they see a foreign version of their new product, far too similar to the original to be coincidence.

This is not an IT problem

Most organizational leaders equate information to technology, conclude this is an IT problem, and assign responsibility to the CISO to implement appropriate protections.  This logic is flawed for many reasons, not the least of which is the CISO typically has little to no ability to enforce security policies for systems not “owned” by the CIO, nor have the organizational scope to address the behaviors of people.

Although information theft frequently include IT and cyber vectors, people are often near or at the epicenter of an espionage case.  People enable the theft either by actively participating, or by carelessly allowing it to happen.  Professionals who study espionage have determined that people are motivated to betray their employer (or country) for one of 4 reasons, using the acronym “MICE”:

  1. Money – the actor either sees this as a way to get rich, or are financially distressed (in debt, recently divorced, have a gambling problem, etc).
  2. Ideology – the actor believes the organization is somehow evil, and betrayal is a way for the actor to cause harm or suffering, thinking it was deserved,
  3. Coercion (or Compromise) – the actor has a secret that makes them vulnerable to extortion, or are threatened with physical harm to themselves or their loved ones,
  4. Ego – the actor thinks they are smarter than the organization, and can get way with it, or are enticed to spy believing it makes them more important.

None of these touch the ways in which people through their actions, innocently permit espionage to occur.  People are helpful and hold the door for others – especially if their hands are full.  Or take calls wanting to assist the caller (who they assume are authorized to ask what they are asking).  People are reluctant to challenge strangers in the hallways, and a startling number of companies don’t require employees and visitors to display ID badges while on-site.  Doors and drawers are left unlocked and clean-desk policies are seen as burdensome.  There is widespread belief that “it can’t happen to us.”

Where does the CDO fit in?

Industrial spies seek to steal information to gain economic or competitive advantage, and work tirelessly on creative ways to get it.

In basic economic terms, its worth stealing information if theft is cheaper than developing it — assuming ethics aren’t an issue, and the risk of getting discovered is acceptable.  So defending against the theft can be thought of as making it more expensive to steal information than it is to develop or acquire it through other means.

The CDO fits in because they are at the intersection of information use, protection and quality.  They should be in the best position to understand what information is most valuable, or put another way, what information, if lost or stolen, would cause what degree of harm to the organization.  And by understanding where and how information is stored and processed, they are in a good position to provide input on how to protect it.

The CDO’s strategy includes elements that are helpful to guard against industrial espionage.  Some steps the CDO can take include

  1. Classify information as an asset (even if informally, and not captured in the financial statements), and assign economic value, so that protections can be developed that are proportional to the value.
  2. Inventory information and work with the Data Governance Council to identify those broad categories that are most vulnerable and attractive to a spy.  They might include the obvious — patents, methods, formulas, algorithms — as well as some less obvious — executive contacts information, network diagrams, or even payroll information (knowing how much people are paid help know who may be vulnerable to financial pressure).
  3. Liaise with corporate security to gain an understanding of how they are working to protect the organization.  Many of these leaders are former law enforcement professionals, often don’t have an appreciation of the relative value of information within the organization, and will welcome allies on the “business side” to help raise awareness and improve corporate posture.
  4. There is no doubt that nowadays, cyber is a vector frequently exploited to steal information.  Liaise with the CISO to convey proper information protection requirements that need to be reflected in IT systems, proportional to the value of the information in question.
  5. Again, working with the CISO and compliance groups, adjust data loss prevention (DLP) tools to monitor for exfiltration of the most sensitive information.  These procedures need to include investigative and response processes, and may already exist (e.g., privacy rules often include requirements for breach management procedures, and these are very leverageable for this purpose).
  6. A significant part of a risk mitigation plan includes raising awareness among the organization’s people — employees as well as contractors and third-parties.  The CDO can spearhead this themselves, or collaborate with the group responsible for promulgating policy and procedures covering actions and behavior.
  7. Some spies have figured out that if their primary target (say, a high-tech company) is too hard to penetrate, they will instead shift focus to the target’s advisors (legal, auditors, consultants, professional services), since they are trusted by the primary target, but are often more vulnerable and may have weaker controls.  The CDO should understand what business partners and third parties have access or custody of information and — and along with the TPO (Third Party Oversight) function — can mitigate the relative information risk associated with them.

Protecting an organization against industrial espionage is very difficult for a wide range of reasons.  And since the asset sought after by the spies is information, the CDO is central to implementing protections and managing risk.  Success can’t be measure in absolute terms, but instead in increments — implementing small steps puts the organization in a better position than not having the small steps.

Contact me at james@jhoward.us

Information Management and Governance, Information protection, Uncategorized

Data Ethics and the CDO

A wise man once told a cheeky arachnid, “With great power comes great responsibility!”

This is a particularly relevant quote in the context of the evolving data economy. CDO’s may think of themselves as caped crusaders saving mankind, and the truth is they are indeed playing an increasingly critical role to help ensure that organizations can successfully transition to their rightful place in the new data economy.

Consider the following:

  • Overwhelmingly, CEOs believe leveraging data as an asset will be more than a game-changer, and will soon become a critical differentiator to remain successful and relevant – and not all companies will make it;
  • Available data – both volume and variety – continues to grow at an impressive rate;
  • Data science and tools are moving in lock-step with the data growth, finding new ways to derive value from data, creating transformative and disruptive opportunities;
  • Data events – intrusions, breaches and exposures – are also growing at an alarming rate; in 2018 alone, hundreds of millions of people-related records have been targeted, exposed or breached (and that’s just the ones detected); and
  • Regulators – notably the EU and the State of California – are responding with complicated requirements, that will impact a great majority of organizations, and more jurisdictions will follow.

What is the role of the CDO?

The CDO’s primary responsibility is to establish the vision and execute a strategy to leverage data in a responsible way.  This ranges from monetizing data directly, through sale or licensing data, to creating new or enhancing existing products and services with data, to optimizing operations by augmenting decision-making with data.  This is a tall order, and needs to combine insights into available opportunities, maturity of the organization to embrace change, and expectations of organizational Leadership with the support they provide.  After all, if leadership isn’t on-board, a data program is not likely to be successful.

The other responsibility addresses meeting the obligations tied to the data, which starts with data ethics.   Just because we can do certain things with data, should we?  Consider some inputs to that decision:

  • Harm– As with medicine, and as the business person overseeing data initiatives, the CDO should start from the commitment to “do no harm”. The CDO should have a methodology for analyzing and socializing potential data solutions to understand the potential consequential impacts.
  • Legality– The CDO should collaborate with counsel to develop a clear understanding of where legal boundaries lie. As with “do no harm”, organizations should not break the law.  The CDO has an important role, because sometimes there is legal risk (heightened probability that a law will be – or perceived to be – broken), and analysis presented to decision-makers should be clear.  As with other cutting edge sciences, senior leadership may not be as data-literate as the CDO or the data scientists.
  • Expectations– An initiative may be “legal” – technically – and even cause no actual harm, but the organization should be comfortable that stakeholders or clients would not be so disappointed with an outcome that the organization’s brand is impacted or clients go elsewhere. A consumer-client has a different tolerance level than client-companies; consumers take reactionary queues from society, media and social-networks, often with unpredictable results.  Client companies have their own stakeholders, regulators and clients to look out for, which drive their reaction.  Moreover, an un-harmful but “creepy” initiative may draw unwanted scrutiny from a regulator, resulting in the organization expending resources to address.
  • Profit – will the initiative make money, even if risks are mitigated and obligations are met, and expectations are intact? A CDO will be presented (pitched?) with dozens of cool ideas, and has to know how to analyze them for fit within the organization. This is trickier than it seems, because data science presents data-oriented opportunities in organizations not used to the data economy.   The decision-making process around investing in a new plant or product in, say, a manufacturing company may be very different than deciding to invest in a data-driven feature or capability.  And simply “willing it to happen” isn’t enough.
  • Consequences– Suppose the organization bets wrong.  What if the initiative fails to deliver on the planned profit, or simply doesn’t work?  This is manageable through various pathways – insurance, hedges, accounting treatment, etc.  But what if the organization creates a proverbial monster?  Recent debate around AI comes to mind, with AI appearing to evolving in lab settings.  What if, in hindsight, the organization realizes they did something deeply wrong or harmful – should they have been expected to anticipate and alter course?  Recently, companies have ceased to exist because they pursued what seemed like sanctioned or low-risk data-driven initiatives, failing to anticipate social and political outrage.

The data economy presents opportunities never before available to business.  Some organizations will choose to gamble risk against profit.  Others will take a step back and forego immediate opportunities, adopting a wait-and-see attitude.  Some from each group will succeed while others fail.

Like any new science that affects humanity, data science should adopt a canon of ethics that balances achieving benefit against the risk of harm.

No doubt the CDO plays a central role in making or orchestrating decisions and administering data.  As the steward of the data vision and strategy, the CDO must be able to think through the upsides and downsides with balance and objectivity and be willing to stand behind the ethics of decisions, after the fact.

Contact me at james@jhoward.us