Information Management and Governance, Information protection, Uncategorized

The Role of the CDO in Counter Industrial Espionage

When one thinks of spies and espionage, our imaginations usually turn to James Bond and Jason Bourne stories.  But with the end of the cold war, many former intelligence officers found more lucrative opportunities in the private sector, offering their services to non-government organizations that were perfectly willing to leverage the research and development capabilities of their competitors.

Fast forward to a time where the economic competition between companies affects political tension between nations, where some nations see nothing wrong with applying techniques developed during cold and shooting wars to provide their own companies with ill-gotten advantages – even at the expense of political allies.

Politico recently published this article that discusses how companies in the Bay Area have become targets for industrial espionage originating from China, Russia and other nation-states.  The article touches on the breadth and depth of the problem, including making a very interesting point that many companies choose not to prosecute espionage cases.  Its remarkable that even when faced with irrefutable evidence, many corporate leaders choose to ignore the facts and fail to notify stakeholders, for fear of how it will reflect on them or affect share price.

There is no doubt that building defenses against industrial espionage is a complicated task, made harder because (1) information has to remain available and usable by the organization, and (2) the organization has to anticipate a wide range of attack “vectors” whereas the intruder only needs one to work.  And if this wasn’t complicated enough already, industrial spies don’t just target computer systems, they target people.  If truly successful, the organization won’t know they’ve been hit until they see a foreign version of their new product, far too similar to the original to be coincidence.

This is not an IT problem

Most organizational leaders equate information to technology, conclude this is an IT problem, and assign responsibility to the CISO to implement appropriate protections.  This logic is flawed for many reasons, not the least of which is the CISO typically has little to no ability to enforce security policies for systems not “owned” by the CIO, nor have the organizational scope to address the behaviors of people.

Although information theft frequently include IT and cyber vectors, people are often near or at the epicenter of an espionage case.  People enable the theft either by actively participating, or by carelessly allowing it to happen.  Professionals who study espionage have determined that people are motivated to betray their employer (or country) for one of 4 reasons, using the acronym “MICE”:

  1. Money – the actor either sees this as a way to get rich, or are financially distressed (in debt, recently divorced, have a gambling problem, etc).
  2. Ideology – the actor believes the organization is somehow evil, and betrayal is a way for the actor to cause harm or suffering, thinking it was deserved,
  3. Coercion (or Compromise) – the actor has a secret that makes them vulnerable to extortion, or are threatened with physical harm to themselves or their loved ones,
  4. Ego – the actor thinks they are smarter than the organization, and can get way with it, or are enticed to spy believing it makes them more important.

None of these touch the ways in which people through their actions, innocently permit espionage to occur.  People are helpful and hold the door for others – especially if their hands are full.  Or take calls wanting to assist the caller (who they assume are authorized to ask what they are asking).  People are reluctant to challenge strangers in the hallways, and a startling number of companies don’t require employees and visitors to display ID badges while on-site.  Doors and drawers are left unlocked and clean-desk policies are seen as burdensome.  There is widespread belief that “it can’t happen to us.”

Where does the CDO fit in?

Industrial spies seek to steal information to gain economic or competitive advantage, and work tirelessly on creative ways to get it.

In basic economic terms, its worth stealing information if theft is cheaper than developing it — assuming ethics aren’t an issue, and the risk of getting discovered is acceptable.  So defending against the theft can be thought of as making it more expensive to steal information than it is to develop or acquire it through other means.

The CDO fits in because they are at the intersection of information use, protection and quality.  They should be in the best position to understand what information is most valuable, or put another way, what information, if lost or stolen, would cause what degree of harm to the organization.  And by understanding where and how information is stored and processed, they are in a good position to provide input on how to protect it.

The CDO’s strategy includes elements that are helpful to guard against industrial espionage.  Some steps the CDO can take include

  1. Classify information as an asset (even if informally, and not captured in the financial statements), and assign economic value, so that protections can be developed that are proportional to the value.
  2. Inventory information and work with the Data Governance Council to identify those broad categories that are most vulnerable and attractive to a spy.  They might include the obvious — patents, methods, formulas, algorithms — as well as some less obvious — executive contacts information, network diagrams, or even payroll information (knowing how much people are paid help know who may be vulnerable to financial pressure).
  3. Liaise with corporate security to gain an understanding of how they are working to protect the organization.  Many of these leaders are former law enforcement professionals, often don’t have an appreciation of the relative value of information within the organization, and will welcome allies on the “business side” to help raise awareness and improve corporate posture.
  4. There is no doubt that nowadays, cyber is a vector frequently exploited to steal information.  Liaise with the CISO to convey proper information protection requirements that need to be reflected in IT systems, proportional to the value of the information in question.
  5. Again, working with the CISO and compliance groups, adjust data loss prevention (DLP) tools to monitor for exfiltration of the most sensitive information.  These procedures need to include investigative and response processes, and may already exist (e.g., privacy rules often include requirements for breach management procedures, and these are very leverageable for this purpose).
  6. A significant part of a risk mitigation plan includes raising awareness among the organization’s people — employees as well as contractors and third-parties.  The CDO can spearhead this themselves, or collaborate with the group responsible for promulgating policy and procedures covering actions and behavior.
  7. Some spies have figured out that if their primary target (say, a high-tech company) is too hard to penetrate, they will instead shift focus to the target’s advisors (legal, auditors, consultants, professional services), since they are trusted by the primary target, but are often more vulnerable and may have weaker controls.  The CDO should understand what business partners and third parties have access or custody of information and — and along with the TPO (Third Party Oversight) function — can mitigate the relative information risk associated with them.

Protecting an organization against industrial espionage is very difficult for a wide range of reasons.  And since the asset sought after by the spies is information, the CDO is central to implementing protections and managing risk.  Success can’t be measure in absolute terms, but instead in increments — implementing small steps puts the organization in a better position than not having the small steps.

Contact me at james@jhoward.us

CDO, Information Management and Governance

CDO: Leveraging AND Protecting Data

A lot is written about the important role the CDO has in promoting, monetizing and leveraging data in an organization. There is no doubt this is their primary function, and failing to fulfill the role can cost the organization in terms of revenue, competitiveness and market position. But the CDO has an equally important role in overseeing governance of data, and failing to embrace that part can lead to similarly negative outcomes.

I’m going to make a provocative statement: the data leverage market is charging ahead and the data governance disciplines are not keeping up. We will continue to see headlines describing data-related issues. Like opposite ends of a rubber band being pulled tighter and tighter, we are facing an increasing risk of a significant, potentially catastrophic, event. The risks aren’t only that data might lost or breached, but also that the organization might fail to gain full benefit from their data. The CDO plays a key role in managing the risk, avoiding issues, which in turn positions the organization to move faster and more nimbly.

Lets talk about the data:

A majority of companies are leveraging Big Data, with Financial Services and Healthcare leading the charge, and nearly 80% of executives believe that failing to embrace Big Data will cause companies to lose their competitive edge. Use cases range from customer and clickstream analysis, to fraud detection and predictive maintenance. The statistics go on and on, all pointing to an accelerating pace of growth and adoption.

  • Tools are becoming more sophisticated, and evolving to where increasingly, end-users can can pursue data tasks without involvement of IT staff. The analytics software and services market is $42B this year, expected to grow to $103B over the next 9 years.
  • And 59% of executives believe that their use of Big Data would be improved through the use of AI – often itself dependent upon the quality of data.
  • How much data? One estimate puts at 44 zettabytes by 2020 (44 TRILLION gigabytes)!

Point being, we are continuing the trajectory of very high growth in the use of data, and no end in sight as far as how much data there is to manipulate and leverage.

OK. So how is it being managed?

Increasingly, where in place, responsibility to establishing the vision and executing the strategy for data use falls to the Chief Data Officer. However, less that 20% of the top 2,500 companies have named CDOs, and they are often focused on the market-facing and revenue aspects of data. But even for those CDO’s whose responsibilities include governance (covering data protection and quality), there are no standard frameworks to employ to manage data.

By framework, I mean the mechanisms to manage data through it’s lifecycle the way one would manage any other asset. Gartner observes that while the traditional business disciplines provide some analogs to manage information as an asset, nothing has emerged tailored to information, let alone adopted as a standard. In fact, accounting standards don’t even include “information” on financial statements.

Within any governance framework should be Protection against reasonably foreseeable threats. There should be a model where protection of data is proportional to data (asset) value, relevant risks and threats, and which takes into account compliance obligations. To be sure, there are many sets of obligations, supporting methodologies with varying levels of adoption and maturity to address data protection along verticals (e.g., GDPR, HIPAA/HITECH, etc), and respectable frameworks to help ensure information security (ISO27001, for example). But these are rarely within the responsibility scope of the CDO. The CDO has to navigate different organizations to engage with one or more CIOs, CISOs and/or CPOs to help implement protections — and those other leaders’ priorities are often on other imperatives, and politics frequently interfere. So it’s difficult to see how an organization can simultaneously position itself to leverage data as a key asset, while also ensuring proper and proportional protection.

Stepping back looking at the bigger picture, I’m describing a market environment where opportunities for leveraging and profiting from data are exploding, while the mechanisms to manage and protect that data are lagging.

What can go wrong?

This pattern points to scenarios where data is breached, questionable data becomes over relied-upon, or where momentum builds to leverage and profit from data, but due to the lack of proportional governance, an event occurs (or worse, issues go undetected until outsiders raise the alarm) resulting in a loss or process failure, leading to financial and/or brand damage and regulatory intervention. A quick review of headlines reminds us this happens on an all too regular basis, leading to the inevitable questions such as, “how could this have happened?” or “you should have seen that coming”.

Is it avoidable? 

Black swan events are – by definition – unanticipated.  However, organizations can take significant steps to anticipate and either avoid or plan for these events, and prepare for potential outcomes by embracing information management and governance techniques. Remember, a data event – whether a breach or a perceived abuse of data – affects not only the organization in question, but also those around it, emanating outwards.

Data leverage and data management can be thought of as opposing forces pulling opposite ends of a rubber band — they will reach a breaking point, and the tension needs to be released in a controlled fashion. The CDO plays a key role, since they should be looking at the “big picture” of “big data”.

  • The CDO needs to be empowered and adopt a posture that balances pursuit of opportunity with proper governance – protection, quality, accuracy.
  • The CDO should be prominent in an organization, to begin addressing the many cultural barriers to information management.
  • The market needs to settle on a framework to manage information as an asset, recognizing it has value and utility to be exploited.

We are living in a world where data is everywhere and the ability to manipulate it for benefit is growing at an incredible pace. Market disruptions are occurring on a daily basis, often enabled by creative use of technologies that analyze data. Forward looking companies wanting to play in this space are looking to CDOs to help, and they need to be properly enabled. Now is the time to engage.