Flashback ! 15 years on, security breaches have only gotten worse

Rummaging through my archives I came across a presentation I had made in a large IT conference fifteen years back to the date. The subject line had me wondering if I had made a fool of myself in the gathering considering that the topic was not my core expertise, though I was a bit enamored by the discipline. Memory is kind and there is no recollection of being booed off stage or being in an uncomfortable position. The presumptuous title of the presentation was “How to protect your enterprise from being hacked”!

Organizations get hacked for many reasons, though most of the hacks in recent times were attributable to human error, lapse in controls, malice towards existing or ex-coworkers or bosses and finally social engineering resulting in compromised data which allowed nefarious elements to gain access and control of information assets for potential future misuse. There were also few brute force attacks as well as skilled hackers who could break the firewall and other technologies that protect the digital ecosystem.

The past decade and half has seen exponential growth in devices connecting to the internet; what started as basic email on mobile, extranets and the surge with the dotcom bubble has grown beyond the predictions of all kind of futurists and consultants surviving the blips due to dot bust and many years later the subprime crisis. M2M, IoT and connected consumer devices have already added to the exposed digital fabric available, vulnerable to attacks as well as errors and omissions by people who configure and monitor.

Back then before the turn of the century reported security incidents were a handful; current reality is 10X of that and for clarity these are reported numbers. Guestimates on the actual number portray a similar multiplier on the reported number. The difference lies in BYOD which has removed the mobile end user compute from purview of the enterprise subduing the number. Smartphones and Tablets, wireless hotspots, public internet kiosks and free terminals at airports, all have helped in accessing information anytime, anywhere.

For IT organizations threat vectors multiplied sending them on a quest for better security and balancing the demand and need for access to corporate systems. Controls and checks soon became bureaucratic with everyone wanting to connect as a result of undue corporate pressures. The number of breaches continues to rise with IT security playing catchup. MDM anyone ? Locked USB ports, containerized phones, IRM enabled documents, the world has changed while we continue to stay exposed with cookies/mobile app trackers.

Globally, Governments have giving a thrust to digital e-governance and citizen services; identities and records of interactions with Government, tax filing, health records, bank statements, what have you, almost everything is digitized across most countries with varied degrees of information security policies, processes and technology. Access via mobiles and apps is the base expectation which needs to be fulfilled; feature phones too have been enabled using USSD (Unstructured Supplementary Service Data) which can be compromised.

Interestingly time to uncover a breach has now increased from weeks to many months and in rare cases more than a year; this rise is despite availability of plethora of solutions. Software is getting bulkier, crammed with features; integration with other solutions is now the norm exposing solutions with potentially unfixed or insecure APIs (application programming interface) from third parties. Unfortunately security wrappers and multi-factor authentication make solutions unwieldy or complex to end users.

Fifteen years back the discussion was about security policies, management endorsement and budget allocation; it was about protection from insiders – disgruntled employees and contractors. One of the key elements of an information security strategy was education of involved stakeholders, their responsibilities, dos and don’ts. Today is still about security policies, more controlled that clearly separate the personal from enterprise; earlier digital access was controlled by hierarchy and exception, today exceptions to the rule for business is the norm.

I wish I could give a presentation today with the same confidence and aplomb that I did decade and a half back; technology has swamped our lives with blurring boundaries between technology at work and personal use. The continuum with high dependence on devices and tether to the internet for almost everything, logs our daily activities in the background only to be used against us. Enterprises struggle to create a balance between storing data on the cloud and enterprise vaults only to discover that neither are safe.

Reality is that most of your data is out there available for pennies to whosoever wants it whether you like it or not !

One step forward, two steps back, managing change with new software implementations !

The need was dire, the staff wanting and IT team willing, but the company management for some reason did not take a decision to approve the project. Almost everyone in the industry had the tools required for the tasks, it was basic hygiene to say the least; growth despite not having the tools set in a belief that they did not need them. When a new IT head came onboard, he was pushed into a corner to take up the cause on behalf of the Sales & Marketing team and try his luck in getting approval for the investment.

It is not that they did not have any technology solution running; they were among the early ones to deploy laptops for majority of their teams though the solution they were using required replacement yesterday. Everyone had given up on the solution which was supported by a small time vendor who had built it about a score of years back and had continued to patch it just enough to keep it alive and going; rumor had it that he was related to someone at the top. The newbie decided to take a shot and worked to gather the data meticulously to support his case for change.

He stepped out into the field to first-hand experience the angst and pain, validate the hearsay and the extent of change required. Spending time with the young and the experienced, walking the streets, having a cup of coffee on the streets, quickly the empathy built and he heard stories of long hours spent, favoritism and management apathy, the dam had broken – he was flooded with their emotion. He was informed that it is probably the first time in a decade that any CXO had descended to the trenches.

Upset but in a controlled way he presented the facts to the group in the Boardroom seeking their flirting eyes to make contact and press for a decision. Outlining the stark reality he appealed to the Management to wake up and face the reality of slowly diminishing market share. The S&M head added his weight and sought resolution to the long standing impasse. He did manage to get a conditional approval, the condition surprisingly to involve the Finance team in the evaluation ! Finance for a S&M solution ?

So they set together a team to formulate the functional selection criteria – more of an aspirational list of functionality in comparison to current reality and in-line with external reality. The options were known and well understood, so the run through happened quickly, the recommendation based on market leadership and ease of use and deployment. The Finance team reviewed the cost against current outflow and found it to be higher, unwilling to take into consideration the better capability, efficiency gain and superior technology.

Escalation to the CFO brought in a new dimension to benchmark with global systems; the team turned around the evaluation in record time and presented the same. A fashion parade followed with lofty claims and global metrics, some of which did not matter, but in the end based on extraneous factors the CFO declared the evaluation closed and selected a global solution with a much higher budgetary allocation and timeline. This was finally presented to the Management as the best course of action.

The decision disconnected from reality was shot down, the CFO smarting the turndown attempted to gain an upper hand by taking the popular choice and setting unreasonable demands on time, functionality and cost. The IT Head and the S&M team could see through the charade; no one however dared to raise the red flag and to whom ? Despite this adversity, the project started in earnest, everyone giving it their best effort; usage increased as the new was far superior to the old and offered succor to the underserved.

Fault had to be found in the unwelcome success, and the Finance team did by challenging the data, the authenticity of inputs, denying the outcome, the project started losing credibility. Repeating a lie consistently sowed the seeds of doubt and put to rest an initiative that could have succeeded overcoming all challenges. They reverted back to the old faithful shoe with holes, hobbling back to their painful existence and journey. An opportunity to regain market leadership was lost in egoist behavior and lack of protest.

One step forward, two steps back; a year and more spent in the entire exercise, precious time and resources allotted for a naught, the loser was the enterprise in the war of the old versus the new, misplaced metrics for business and project that would have brought in business transformation. Many years later the organization has continued to remain under the shadow of the failed venture, the will broken, confidence missing, and the experience bitter. The CFO and IT Head have moved on leaving behind a case study !