('featured_article',0,81,683,'en',0,'<p>In the digital age, businesses must adopt an adaptive Enterprise Architecture to succeed. The vision, once realized, enables leveraging emerging technologies, scalability, agility, integration, cost optimization, regulatory compliance, and maximum business value.</p><p>Transitioning requires careful planning, change management, and a strategic vision. Partnering with experienced IT consultants facilitates the process. An adaptive Enterprise Architecture is the key for efficiency, agility, and innovation, empowering businesses to meet customer demands and stay competitive. By embracing this approach, organizations can streamline operations, enhance collaboration, create value for all stakeholders, and achieve sustainable growth.</p><p><strong>Introduction</strong></p><p>In today\'s dynamic business environment, the ability to quickly deploy new capabilities is a competitive necessity. However, organizations often fail to seize opportunities due to the perceived cost and risk of modernizing the systems that enable business capabilities. Information systems and technology platforms exist for a relatively simple set of reasons – to enable business operations and facilitate decision-making as the organization pursues evolving goals and opportunities.</p><p>Technology leaders must have a seat at the organization’s strategy table and allow for the inevitable changes of plan so that when requirements change, the business technology they manage is an enabler, not an impediment. Internal and external forces of change are permanent and pervasive. “Enterprise Architecture” sounds like something slow-moving, but today’s Enterprise Architects must design with continuous change in mind.</p><p><strong>Technological Forces of Change</strong></p><p>In 1965, Gordon Moore suggested the number of transistors on a typical computer chip would roughly double about every two years. Although we do not measure our progress in transistors per chip, Moore’s hypothesis has been validated in real life. In the ensuing 60 years, advances in computational capabilities have given mainstream businesses the ability to solve computational and information management problems at a scale that would have been considered far-fetched a generation ago.</p><p>In the first quarter of the 21st Century, we have seen an explosion of data – beyond a tsunami, more like a Big Bang. The good news is data management and processing capabilities have kept pace, allowing us to do interesting and useful things with all that data, enabling more efficient operations and facilitating informed decision-making.</p><p>Combined with the Internet, massive computing power and vast pools of information have created the real potential of a global data fabric and data marketplace based on broadly adopted cloud computing and democratized artificial intelligence. Nobody talks about data processing anymore. The daily conversations about automating operational and accounting processes to gain efficiency and reduce costs are a dim memory. Today we talk about information as a strategic asset and the ability to make the best use of it as a strategic capability.</p><p>In about ten years, Cloud computing has outgrown mere widespread adoption. It is now a standard feature of almost all enterprises’ information technology architecture. At the same time, Artificial Intelligence is advancing so rapidly that it has drawn the attention of ethicists and legislators. While they are thinking about the responsible use of AI, completely novel applications as well as spot solutions built into existing solutions appear in the marketplace almost daily.</p><p>The rapid pace of technological advancements requires businesses to constantly innovate and leverage new capabilities. Inflexible architectures and solutions hinder the adoption of emerging technologies such as artificial intelligence, machine learning, and the Internet of Things. These technologies have the potential to revolutionize operations, drive efficiency, and unlock valuable insights from data.</p><p><strong>Competitive Forces of Change</strong></p><p>Considering technological advances, competition has in no corner become less intense. Competitors are becoming more numerous, diverse, and global. In some markets the competition is consolidating, raising the barrier to entry, and making life increasingly difficult for independent players. Simultaneously, agile startups enter the market every day with new business models and game-changing technologies, challenging established firms to rethink the status quo, and in some cases, to adapt or perish.</p><p>In both mature and emerging markets architectural rigidity can lead to falling behind while competitors who have successfully integrated these technologies into their workflows, customer experiences, and decision-making processes.</p><p>An adaptive IT architecture that enables businesses to harness the power of emerging technologies and is a competitive necessity. The ability to seamlessly integrate innovative tools and systems empowers organizations to further automate processes, optimize resource allocation, and deliver personalized experiences to customers. The ability to quickly respond to market changes, customer demands, and disruptive forces is essential for sustained success in today\'s digital landscape.</p><p><strong>The Hybridization of Everything</strong></p><p>Thinking about the most successful organizations, and the most successful people in them, we can observe a trend: The Hybridization of Everything. Since the mid-1990s, hybridization has been seen as a necessity in organizations that want to do more, better, faster, and cheaper.</p><p>In the old organizations, the organizing principle was specialization: discrete departments, separate functions, independent projects. In the new organizations, it’s hybridization: inter-departmental meetings, cross-functional teams, integrated systems. Enterprise architectures must support pervasive hybridization.</p><p><strong>Hybrid Technology</strong></p><p>The Hybrid Cloud was one of the early materializations of this idea. It meant, some of our stuff is on premises and some of it in the cloud.” Today hybrid solutions take many forms, combining the benefits of disparate technologies for a single, mission-specific purpose. Information processing itself is becoming hybridized with traditional deterministic algorithms answering traditional questions alongside artificial intelligence which can suggest new questions.</p><p>AI-enhanced solutions are becoming commonplace, appearing in everything from office productivity suites to facial recognition solutions for border security, to large computational problems in climate science, economics, and more. The analog world in which we live is increasingly digitized by hybrid analog-digital devices that populate the Internet of Things, from talking (and listening) appliances to home security systems that allow you to close your garage door from the other side of the planet.</p><p>Adaptive Enterprise Architectures exploit hybrid technologies, both as a preference for the capabilities or adaptive technologies and as a response to the need to design for efficiency and responsiveness in today’s dynamic and competitive environment.</p><p><strong>The Demand for Modernization</strong></p><p>Several forces of change drive the demand for application modernization. Among them are…</p><ul><li><strong>Technical obsolescence of the infrastructure</strong> – The age of technology itself, and the aging of the workforce having the skills to support it can make a compelling case for replacement. Support gets more expensive and harder to find almost daily. Also known as Technical Debt, like most forms of debt it gets more expensive with the passage of time.</li><li><strong>Demand for a modern user experience</strong> – Some internal users of older information systems are often productive and happy doing their job by pressing F2 twice, typing something, and then pressing Enter twice. External users and most internal users expect a modern experience.</li><li><strong>Not Designed for Flexibility</strong> – Legacy applications were not based on today’s service-oriented design patterns and other innately adaptive frameworks. Even when they can be adapted to modern requirements, changes to monolithic applications can require extensive and widespread testing.</li></ul><p><strong>Enterprise Architecture and the Business of IT&nbsp;</strong></p><p>Technology Portfolio Management and Technology Business Management are closely related to Enterprise Architecture. Some consider them a discipline within Enterprise Architecture. They provide IT management frameworks that implement a standard IT spending taxonomy and process-enablement catalog.</p><p>Having a standard way to categorize IT costs, technologies, resources, applications, and services enables organizations to disaggregate IT spending into smaller, consistent categories to provide the leadership team with a more accurate and detailed understanding of their organization’s IT costs. This disciplined and business-like approach to managing IT enables enterprise architects to identify duplicate spending and redundant capabilities to make better informed decisions regarding future investments.</p><p>Organizations seeking to reduce IT sprawl or to rationalize their portfolio can develop a roadmap to deal with overspending and redundancy. Fully redundant applications can be retired. Other applications can be designated for migration to more cost-effective implementations. Some applications can be left alone. Those with the greatest potential for business value can be targeted for further investment as savings are achieved in other areas.</p><p><strong>The Adaptive Enterprise Architecture Response&nbsp;</strong></p><p>The core purpose of Enterprise Architecture is to apply holistic technology concepts to the enablement of business processes in furtherance of the organization’s mission. An Adaptive Enterprise Architecture perspective requires that flexibility and adaptability, without security compromises, are highly valued criteria for enterprise Information Technology decision-making.</p><p>Further, holistic Enterprise Architecture thinking encompasses the people and processes that plan, deploy, and operate Information Technology. Those people responsible for the architecture require a fulsome appreciation of the relationships between business goals, operational processes, to make informed decisions about information management systems and technology foundations. An Adaptive Enterprise Architecture strategy prioritizes pragmatism and flexibility not just in reaction to changing business needs but in anticipation of them.</p><p><strong>Threats&nbsp;</strong></p><p>The increasing number and sophistication of bad actors means changes the question from “Will I be attacked?” to “When will I be attacked?”. Cyber Security defenses must be incorporated into your technology blueprint with holistic architectural thinking. Every building block must be imagined as an element of the attack surface visible to bad actors.</p><p>An inflexible IT architecture based on monolithic systems poses a variety of related security and compliance risks. Older systems may lack the robust security measures needed to withstand advanced threats, making them vulnerable to cyber threats and data breaches. An adaptivity-focused architecture, having by nature a more complex attack surface poses a different of problems. In all cases, a holistic architectural approach based on Zero Trust principles and technologies like software-defined networks, and advanced vulnerability detection, along with a security-aware organizational culture, create a robust cyber immune system.</p><p>A strong perimeter defense is no longer good enough. Unless your systems are completely disconnected from the outside world, a bad actor will eventually penetrate even the strongest barriers. A holistic architecture incorporating Zero-Trust principles prevents free movement within your environment once that bad actor penetrates the perimeter.</p><p>Organizations must ensure that their IT architecture can adapt and withstand evolving security challenges. Non-compliance with industry regulations can result in substantial financial penalties and reputational damage. Adaptive IT architecture, on the other hand, allows for timely updates and enhancements to address emerging security and compliance requirements, providing organizations with peace of mind and a competitive advantage.</p><p><strong>The Adaptive Enterprise Architecture Journey – An Approach</strong></p><ol><li><p><strong>Define Business Objectives:</strong> The organization must articulate a strategy and business objectives, growth targets, and customer-centric goals.</p><p>Align IT strategies with these objectives to ensure that technology investments are aligned with business priorities. Engage key stakeholders from both IT and business units to gain a comprehensive understanding of the organization\'s strategic direction. The Enterprise Architecture function guides the evolution of the IT ecosystem to achieve and maintain alignment with organizational goals.</p><p>Identify the key areas where adaptive architecture can drive value, such as improving customer experience, enhancing operational efficiency, reducing costs, or enabling new revenue streams. By aligning your IT strategy with your business goals, you can ensure that your adaptive architecture initiatives have a meaningful impact on your organization\'s success.</p></li><li><p><strong>Assess the Current IT Landscape:</strong> Every passionate Enterprise Architect would love an opportunity to start with a clean sheet of paper. They rarely get one. Instead, they begin by conducting a thorough assessment of the existing IT infrastructure, systems, and applications.</p><p>Identify the strengths and weaknesses of your current architecture, using established frameworks for assessing architectural health to identify areas that hinder flexibility, scalability, and integration as well as apparent redundancies and potential areas of overspending. This assessment will provide valuable insights into the specific challenges your organization faces and help define the goals and objectives of your adaptive architecture.</p></li><li><p><strong>Develop a Future State Vision:</strong> Every good plan begins with the end in mind. Choose a foundation. Although adaptivity is the goal discussed here, stability is essential for effective support of business operations. Some long-term decision-making is unavoidable. The ability to swap components, redesign integrations, and so on is not a reason to avoid making big decisions about the core infrastructure and foundational technologies.</p><p>Design a sound foundation that innately supports swappable and scalable components. You might want to paint the house a new color every Spring. You will probably need to update the furniture appliances from time to time or even change the layout of the interior spaces, but build the house on a solid, long-lasting foundation.</p></li><li><strong>Develop a Roadmap:</strong> Create a comprehensive roadmap that outlines the steps, milestones, and timelines for transitioning to an adaptive IT architecture.<ol type=\"a\"><li>Don’t change everything at once! Segment the journey into manageable phases, prioritizing areas of critical need or areas that can provide immediate value. Consider the dependencies and interdependencies between different systems and processes, in-flight and planned projects, costs, and value and plan for effective change management to ensure a smooth transition and minimal disruption to ongoing operations.</li><li>Don’t set the roadmap in stone. Adaptivity involves continuous change in response to forces that are often unforeseen. It’s true that every well-managed program needs a roadmap, but in a future, adaptive world, there will be fewer roadmaps and more dynamic routing.</li></ol></li><li><p><strong>Continuously Monitor, Evolve and Adapt:</strong> Establish a framework for monitoring and evaluating the effectiveness of adaptive IT architecture. Regularly review performance metrics, customer feedback, and industry trends to identify areas for improvement and adapt strategies accordingly. Embrace a culture of continuous improvement and be open to feedback and suggestions from employees and customers.</p><p>An adaptive IT architecture is not a one-time implementation but an ongoing process of evolution and iteration. Continuously evaluate the effectiveness of your architecture, gather feedback from users, and adapt as needed. Embrace an agile mindset that embraces change and allows for iterative improvements. Regularly assess the alignment of your IT architecture with business goals and adjust strategies accordingly.</p></li><li><strong>Collaborate with Technology Partners:</strong> Engage with technology partners and vendors who can provide expertise, solutions, and support for your adaptive IT architecture journey. Leverage their knowledge and experience to accelerate implementation.</li></ol><p><strong>Five Reasons to Pursue Adaptive Architecture</strong></p><ol><li><strong>Enhanced Scalability and Agility:</strong> In a rapidly changing business environment, scalability and agility are essential for organizations to respond quickly to market demands and seize new opportunities. Adaptive IT architecture provides the flexibility to scale resources up or down as needed, accommodating fluctuating workloads and business requirements. This scalability enables businesses to handle increased customer demands, seasonal peaks, or sudden growth without disruptions or resource constraints. Additionally, adaptive architecture allows for agile development and deployment of new applications and services, enabling businesses to stay ahead of the competition by rapidly delivering innovative solutions.</li><li><strong>Improved Integration and Interoperability:</strong> In today\'s interconnected business landscape, integration and interoperability are critical for seamless data exchange and collaboration across systems, departments, and external partners. An adaptive IT architecture facilitates smooth integration of disparate systems and applications, enabling efficient data flow and real-time information sharing. By breaking down silos and promoting interoperability, businesses can optimize their operations, streamline workflows, and enhance productivity. This integration also paves the way for future growth and expansion, as businesses can easily incorporate new technologies, platforms, and partnerships into their ecosystem.</li><li><strong>Cost Efficiency and Resource Optimization:</strong> While transitioning to adaptive IT architecture requires initial investments, it can result in long-term cost savings and resource optimization. Outdated systems often require extensive maintenance, support, and upgrades, leading to high operational costs. In contrast, adaptive architecture enables businesses to adopt a more modular and scalable approach, allowing them to optimize resource allocation and reduce unnecessary expenses. Cloud-based solutions, for example, eliminate the need for on-premises infrastructure, reducing hardware and maintenance costs. Additionally, an adaptive architecture allows businesses to leverage automation and self-service capabilities, freeing up IT resources for more strategic initiatives and reducing labor costs.</li><li><strong>Enhanced Business Continuity and Resilience:</strong> An adaptive IT architecture provides organizations with the necessary tools to enhance business continuity and resilience in the face of disruptions or unforeseen events. Traditional architectures with single points of failure or limited redundancy are susceptible to downtime and data loss. By leveraging cloud technologies, virtualization, and distributed systems, businesses can ensure data redundancy, implement robust disaster recovery strategies, and achieve high availability. This enables businesses to minimize downtime, protect critical data, and quickly recover from disruptions, safeguarding their operations and reputation.</li><li><strong>Compliance and Security:</strong> In an era where data privacy and security are paramount, an adaptive IT architecture offers significant advantages in terms of compliance and data protection. Regulations such as the General Data Protection Regulation (GDPR) and industry-specific requirements impose strict guidelines on how businesses handle and secure sensitive data. An adaptive architecture enables organizations to implement advanced security measures, such as encryption, access controls, and audit trails, to protect data throughout their lifecycle. Furthermore, the ability to quickly update and patch systems ensures that businesses stay compliant with evolving regulations and industry best practices.</li></ol><p><strong>Additional Considerations</strong></p><ol><li><strong>Emphasize User Experience:</strong> As technology evolves, so do user expectations. Prioritize user experience in your adaptive IT architecture by designing intuitive interfaces, seamless workflows, and personalized interactions. Incorporate user feedback and conduct usability tests to refine your systems and ensure they align with user needs and preferences.</li><li><strong>Leverage Automation and Intelligent Workflows:</strong> Automation plays a crucial role in adaptive IT architecture. Identify repetitive and manual processes that can be automated to streamline operations, reduce errors, and free up resources for more strategic tasks. Embrace intelligent workflows powered by AI and machine learning to enhance decision-making, optimize resource allocation, and improve efficiency.</li><li><strong>Implement Agile Development Methodologies:</strong> Agile methodologies, such as Scrum or Kanban, can greatly enhance the adaptability of your IT architecture. By breaking projects into smaller, manageable chunks, you can deliver incremental value and respond quickly to changing requirements. Regularly review and adapt your development processes to foster collaboration, transparency, and continuous improvement.</li><li><strong>Embrace DevOps Practices:</strong> DevOps is a set of practices that emphasize collaboration and integration between development and operations teams. By adopting DevOps principles, you can accelerate software delivery, increase deployment frequency, and improve overall system stability. Encourage cross-functional collaboration, automate testing and deployment processes, and foster a culture of shared responsibility and continuous improvement.</li><li><strong>Establish an Architecture Governance Framework:</strong> To ensure the effectiveness and sustainability of your adaptive IT architecture, establish a robust governance framework. Regularly review and update governance policies to adapt to changing circumstances and emerging technologies.</li></ol><p><strong>Conclusion</strong></p><p>By adopting an adaptive IT architecture, organizations can proactively respond to market dynamics, seize new opportunities, and deliver exceptional value to customers. Embrace change, embrace innovation, and embark on the journey to building an adaptive IT architecture that will position your business for long-term success in the digital age.</p><p>The journey towards adaptive IT architecture requires careful planning, effective management, and ongoing evaluation. It is not a one-time effort but a continuous process of optimization and adaptation. However, the rewards are substantial – increased operational efficiency, accelerated innovation, reduced costs, enhanced customer satisfaction, and sustainable business growth. Embrace the potential of an adaptive IT architecture and position your organization for success in the digital era.</p><p>In today\'s rapidly evolving business landscape, adaptive IT architecture is the key to unlocking business potential, driving innovation, and maintaining a competitive edge. By embracing flexibility, modularity, and agility, organizations can navigate the complexities of the digital age and capitalize on emerging opportunities.</p><p>Building an adaptive IT architecture requires a holistic mindset, organizational commitment, and a willingness to invest in technology, talent, and cultural transformation. By following best practices such as embracing cloud computing and other innately adaptive technologies, fostering a culture of innovation, prioritizing integration, swappable components, interoperability, and staying abreast of technological advancements, businesses can create a robust foundation for future growth and success.</p><p>The journey towards adaptive IT architecture is not merely a technical transformation but a cultural shift that embraces change, continuous learning, and collaboration. By aligning technology with business goals, managing risks, and fostering a culture of adaptability, businesses can position themselves as agile, resilient, and future-ready entities capable of thriving in the dynamic digital landscape. Embrace the power of an adaptive IT architecture and unleash your business\'s full potential.</p><p><strong>About The Author</strong></p><p><a href=\"https://www.linkedin.com/in/dougpicirillo/\">Douglas Picirillo</a> is a Senior Enterprise and Solutions Architect and IT Program Management Consultant. He specializes in Business Transformation and Value Creation enabled by Information Technology, IT transformation and cost reduction, Enterprise Systems Development, and IT Integration and Separation in Mergers and Acquisitions.</p><p>Mr. Picirillo has more than 30 years of IT experience in the public and non-profit sectors and numerous private sector industries, from SMBs to the Fortune 500. Doug’s paper, \"Artificial Intelligence in Mainstream Enterprise Applications\", was published in the peer-reviewed World Complexity Science Academy Journal (ISSN online: 2724-0606) in 2020.<a href=\"https://www.wcsaglobal.org/volume-1-issue-2-2020/artificial-intelligence-in-mainstream-enterprise-applications/\">https://lnkd.in/dgQEr8VE</a></p><p>To know more about how DivIHN Integration Inc. can help you in your journey for deploying robust \"Adaptive Enterprise Architecture\" please get in touch with him at Doug. <a href=\"mailto:doug.picirillo@divihn.com\">doug.picirillo@divihn.com</a></p>','','full_html'),('blog',0,82,209,'en',0,'<p>In my last post we examined the Risk Manager role we each play in our daily lives, as well as in our professional lives. Seems simple, doesn’t it?</p><p><strong>From the Moment we are Born, we are Confronted by Risks</strong></p><p><strong>We survive from Birth because someone is Managing Risks to Protect Us</strong></p><p>In business, we have audit departments and others who assess risks, and we engage in supporting risk assessments. One of the annual rights of passage for any business and information technology group is participating in the annual risk assessment process and the production of the Annual Risk Report. As cybersecurity professionals and business leaders we may even present the results of our risk assessment to the company’s Board of Directors Audit Committee. A significant amount of time, effort, thought, and angst goes into creating these reports and presentations. We even become experts at preparing and interpreting classic management consulting 9X or 3×3 frameworks to map risks against Impacts and Probability. You may even use more sophisticated frameworks. Each of our traditional risk assessment frameworks ask us to identify risks, determine the potential impact of an identified risk, and also to assess a risk’s potential to occur or probability of occurrence. Using these graphical frameworks, we then plot individual risk and or categories of risk into an assessment box which labels a risk as low, medium, or high.</p><img src=\"/sites/default/files/inline-images/Impact.png\" data-entity-uuid=\"9f6f273a-9266-404b-9ac0-508d337a99d3\" data-entity-type=\"file\" width=\"750\" height=\"595\"><p>Today, however, the infusion of information technology into every aspect of our business, the interconnectedness of our business operations with hyper-connected suppliers, distributors, customers, and layers of third and fourth parties, spanning the world, has massively increased the Business / Cyber Risks we face.</p><img src=\"/sites/default/files/inline-images/Systemic-Business-Cyber-Risk.png\" data-entity-uuid=\"f77c4e2f-3e83-4994-849c-189d2d445b11\" data-entity-type=\"file\" width=\"766\" height=\"529\"><p>I believe that the ways we have assessed Risks to our Business in the past are no longer adequate to address the complex nature of the web of risks we now face. Simple low, medium, and high-risk assessments no longer suffice to inform our business leaders and board members about the true nature of cyber driven risks.</p><p><strong>Systemic Digital Risk in Complex Digital Environments</strong></p><p>Systemic Risk is the threat that component failure in a complex system will cascade and jeopardize the much larger system. Systemic risk is inherent in all modern digital business environments. Systemic risk has become more prevalent as digital disruption and transformation advance throughout every aspect of business planning and operations, as well as in every aspect of society. The ability of organizations to create, capture and preserve value in rapidly changing digital economic systems makes understanding systemic digital risk a priority for all business leaders and boardroom members.</p><p>There are eight digital domains that work together across complex digital systems to produce and preserve business value.</p><ol><li>Data</li><li>Information architecture</li><li>Risk Communications</li><li>Emerging Technology</li><li>Cybersecurity</li><li>Third Parties</li><li>IT Operations</li><li>Regulations</li></ol><p>These eight domains enable complex digital businesses. They work in integrated relationships of people, processes, and digital systems to produce and preserve value. In traditional risk assessments we would identify risks within each of these domains, without necessarily fully appreciating the potential for individual domain risks to directly impact other domains.</p><p>Systemic Risk in complex digital businesses is primarily caused by five elements which impact these domains. These five key systemic risk causes are:</p><ol><li>Replaceability</li><li>Interconnectedness</li><li>Size</li><li>Complexity</li><li>Cross or X-Jurisdictional</li></ol><p>I believe it to be imperative for business oversight to understand and comprehend risk within each of the eight domains of complex digital businesses and their systems, in conjunction with the compounding nature of Systemic Risk generated by the five key elements of systemic dependencies between and among these domains.</p><p>Any of the five key elements of Systemic Risk has the potential to trigger cascading contagion risk throughout and across not just a single business, but across every connected business in today’s complex<em> customer-business-supplier value chains.</em></p><p>In my next post I will expand upon this introduction to Systemic Digital Risk and lay a foundation to deep dive into Cybersecurity Driven Risks and the five key elements of Systemic Risk.</p><p>Note: Source Material for this post- “Systemic Digital Risk: Understanding and Overseeing Complex Digital Environments With The DiRECTOR™ And RISCX™ Frameworks”, Digital Directors Network.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,82,240,'en',0,'<p>In my last post we examined the Risk Manager role we each play in our daily lives, as well as in our professional lives. Seems simple, doesn’t it?</p><p><strong>From the Moment we are Born, we are Confronted by Risks</strong></p><p><strong>We survive from Birth because someone is Managing Risks to Protect Us</strong></p><p>In business, we have audit departments and others who assess risks, and we engage in supporting risk assessments. One of the annual rights of passage for any business and information technology group is participating in the annual risk assessment process and the production of the Annual Risk Report. As cybersecurity professionals and business leaders we may even present the results of our risk assessment to the company’s Board of Directors Audit Committee. A significant amount of time, effort, thought, and angst goes into creating these reports and presentations. We even become experts at preparing and interpreting classic management consulting 9X or 3×3 frameworks to map risks against Impacts and Probability. You may even use more sophisticated frameworks. Each of our traditional risk assessment frameworks ask us to identify risks, determine the potential impact of an identified risk, and also to assess a risk’s potential to occur or probability of occurrence. Using these graphical frameworks, we then plot individual risk and or categories of risk into an assessment box which labels a risk as low, medium, or high.</p><p><img src=\"/sites/default/files/inline-images/Impact.png\" data-entity-uuid=\"9f6f273a-9266-404b-9ac0-508d337a99d3\" data-entity-type=\"file\" width=\"750\" height=\"595\"></p><p>Today, however, the infusion of information technology into every aspect of our business, the interconnectedness of our business operations with hyper-connected suppliers, distributors, customers, and layers of third and fourth parties, spanning the world, has massively increased the Business / Cyber Risks we face.</p><p><img src=\"/sites/default/files/inline-images/Systemic-Business-Cyber-Risk.png\" data-entity-uuid=\"f77c4e2f-3e83-4994-849c-189d2d445b11\" data-entity-type=\"file\" width=\"766\" height=\"529\"></p><p>I believe that the ways we have assessed Risks to our Business in the past are no longer adequate to address the complex nature of the web of risks we now face. Simple low, medium, and high-risk assessments no longer suffice to inform our business leaders and board members about the true nature of cyber driven risks.</p><p><strong>Systemic Digital Risk in Complex Digital Environments</strong></p><p>Systemic Risk is the threat that component failure in a complex system will cascade and jeopardize the much larger system. Systemic risk is inherent in all modern digital business environments. Systemic risk has become more prevalent as digital disruption and transformation advance throughout every aspect of business planning and operations, as well as in every aspect of society. The ability of organizations to create, capture and preserve value in rapidly changing digital economic systems makes understanding systemic digital risk a priority for all business leaders and boardroom members.</p><p>There are eight digital domains that work together across complex digital systems to produce and preserve business value.</p><ol><li>Data</li><li>Information architecture</li><li>Risk Communications</li><li>Emerging Technology</li><li>Cybersecurity</li><li>Third Parties</li><li>IT Operations</li><li>Regulations</li></ol><p>These eight domains enable complex digital businesses. They work in integrated relationships of people, processes, and digital systems to produce and preserve value. In traditional risk assessments we would identify risks within each of these domains, without necessarily fully appreciating the potential for individual domain risks to directly impact other domains.</p><p>Systemic Risk in complex digital businesses is primarily caused by five elements which impact these domains. These five key systemic risk causes are:</p><ol><li>Replaceability</li><li>Interconnectedness</li><li>Size</li><li>Complexity</li><li>Cross or X-Jurisdictional</li></ol><p>I believe it to be imperative for business oversight to understand and comprehend risk within each of the eight domains of complex digital businesses and their systems, in conjunction with the compounding nature of Systemic Risk generated by the five key elements of systemic dependencies between and among these domains.</p><p>Any of the five key elements of Systemic Risk has the potential to trigger cascading contagion risk throughout and across not just a single business, but across every connected business in today’s complex<em> customer-business-supplier value chains.</em></p><p>In my next post I will expand upon this introduction to Systemic Digital Risk and lay a foundation to deep dive into Cybersecurity Driven Risks and the five key elements of Systemic Risk.</p><p>Note: Source Material for this post- “Systemic Digital Risk: Understanding and Overseeing Complex Digital Environments With The DiRECTOR™ And RISCX™ Frameworks”, Digital Directors Network.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,82,400,'en',0,'<p>In my last post we examined the Risk Manager role we each play in our daily lives, as well as in our professional lives. Seems simple, doesn’t it?</p><p><strong>From the Moment we are Born, we are Confronted by Risks</strong></p><p><strong>We survive from Birth because someone is Managing Risks to Protect Us</strong></p><p>In business, we have audit departments and others who assess risks, and we engage in supporting risk assessments. One of the annual rights of passage for any business and information technology group is participating in the annual risk assessment process and the production of the Annual Risk Report. As cybersecurity professionals and business leaders we may even present the results of our risk assessment to the company’s Board of Directors Audit Committee. A significant amount of time, effort, thought, and angst goes into creating these reports and presentations. We even become experts at preparing and interpreting classic management consulting 9X or 3×3 frameworks to map risks against Impacts and Probability. You may even use more sophisticated frameworks. Each of our traditional risk assessment frameworks ask us to identify risks, determine the potential impact of an identified risk, and also to assess a risk’s potential to occur or probability of occurrence. Using these graphical frameworks, we then plot individual risk and or categories of risk into an assessment box which labels a risk as low, medium, or high.</p><p><img src=\"/sites/default/files/inline-images/Impact.png\" data-entity-uuid=\"9f6f273a-9266-404b-9ac0-508d337a99d3\" data-entity-type=\"file\" width=\"750\" height=\"595\"></p><p>Today, however, the infusion of information technology into every aspect of our business, the interconnectedness of our business operations with hyper-connected suppliers, distributors, customers, and layers of third and fourth parties, spanning the world, has massively increased the Business / Cyber Risks we face.</p><p><img src=\"/sites/default/files/inline-images/Systemic-Business-Cyber-Risk.png\" data-entity-uuid=\"f77c4e2f-3e83-4994-849c-189d2d445b11\" data-entity-type=\"file\" width=\"766\" height=\"529\"></p><p>I believe that the ways we have assessed Risks to our Business in the past are no longer adequate to address the complex nature of the web of risks we now face. Simple low, medium, and high-risk assessments no longer suffice to inform our business leaders and board members about the true nature of cyber driven risks.</p><p><strong>Systemic Digital Risk in Complex Digital Environments</strong></p><p>Systemic Risk is the threat that component failure in a complex system will cascade and jeopardize the much larger system. Systemic risk is inherent in all modern digital business environments. Systemic risk has become more prevalent as digital disruption and transformation advance throughout every aspect of business planning and operations, as well as in every aspect of society. The ability of organizations to create, capture and preserve value in rapidly changing digital economic systems makes understanding systemic digital risk a priority for all business leaders and boardroom members.</p><p>There are eight digital domains that work together across complex digital systems to produce and preserve business value.</p><ol><li>Data</li><li>Information architecture</li><li>Risk Communications</li><li>Emerging Technology</li><li>Cybersecurity</li><li>Third Parties</li><li>IT Operations</li><li>Regulations</li></ol><p>These eight domains enable complex digital businesses. They work in integrated relationships of people, processes, and digital systems to produce and preserve value. In traditional risk assessments we would identify risks within each of these domains, without necessarily fully appreciating the potential for individual domain risks to directly impact other domains.</p><p>Systemic Risk in complex digital businesses is primarily caused by five elements which impact these domains. These five key systemic risk causes are:</p><ol><li>Replaceability</li><li>Interconnectedness</li><li>Size</li><li>Complexity</li><li>Cross or X-Jurisdictional</li></ol><p>I believe it to be imperative for business oversight to understand and comprehend risk within each of the eight domains of complex digital businesses and their systems, in conjunction with the compounding nature of Systemic Risk generated by the five key elements of systemic dependencies between and among these domains.</p><p>Any of the five key elements of Systemic Risk has the potential to trigger cascading contagion risk throughout and across not just a single business, but across every connected business in today’s complex<em> customer-business-supplier value chains.</em></p><p>In my next post I will expand upon this introduction to Systemic Digital Risk and lay a foundation to deep dive into Cybersecurity Driven Risks and the five key elements of Systemic Risk.</p><p>Note: Source Material for this post- “Systemic Digital Risk: Understanding and Overseeing Complex Digital Environments With The DiRECTOR™ And RISCX™ Frameworks”, Digital Directors Network.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,82,482,'en',0,'<p>In my last post we examined the Risk Manager role we each play in our daily lives, as well as in our professional lives. Seems simple, doesn’t it?</p><p><strong>From the Moment we are Born, we are Confronted by Risks</strong></p><p><strong>We survive from Birth because someone is Managing Risks to Protect Us</strong></p><p>In business, we have audit departments and others who assess risks, and we engage in supporting risk assessments. One of the annual rights of passage for any business and information technology group is participating in the annual risk assessment process and the production of the Annual Risk Report. As cybersecurity professionals and business leaders we may even present the results of our risk assessment to the company’s Board of Directors Audit Committee. A significant amount of time, effort, thought, and angst goes into creating these reports and presentations. We even become experts at preparing and interpreting classic management consulting 9X or 3×3 frameworks to map risks against Impacts and Probability. You may even use more sophisticated frameworks. Each of our traditional risk assessment frameworks ask us to identify risks, determine the potential impact of an identified risk, and also to assess a risk’s potential to occur or probability of occurrence. Using these graphical frameworks, we then plot individual risk and or categories of risk into an assessment box which labels a risk as low, medium, or high.</p><p><img src=\"/sites/default/files/inline-images/Impact.png\" data-entity-uuid=\"9f6f273a-9266-404b-9ac0-508d337a99d3\" data-entity-type=\"file\" width=\"750\" height=\"595\"></p><p>Today, however, the infusion of information technology into every aspect of our business, the interconnectedness of our business operations with hyper-connected suppliers, distributors, customers, and layers of third and fourth parties, spanning the world, has massively increased the Business / Cyber Risks we face.</p><p><img src=\"/sites/default/files/inline-images/Systemic-Business-Cyber-Risk.png\" data-entity-uuid=\"f77c4e2f-3e83-4994-849c-189d2d445b11\" data-entity-type=\"file\" width=\"766\" height=\"529\"></p><p>I believe that the ways we have assessed Risks to our Business in the past are no longer adequate to address the complex nature of the web of risks we now face. Simple low, medium, and high-risk assessments no longer suffice to inform our business leaders and board members about the true nature of cyber driven risks.</p><p><strong>Systemic Digital Risk in Complex Digital Environments</strong></p><p>Systemic Risk is the threat that component failure in a complex system will cascade and jeopardize the much larger system. Systemic risk is inherent in all modern digital business environments. Systemic risk has become more prevalent as digital disruption and transformation advance throughout every aspect of business planning and operations, as well as in every aspect of society. The ability of organizations to create, capture and preserve value in rapidly changing digital economic systems makes understanding systemic digital risk a priority for all business leaders and boardroom members.</p><p>There are eight digital domains that work together across complex digital systems to produce and preserve business value.</p><ol><li>Data</li><li>Information architecture</li><li>Risk Communications</li><li>Emerging Technology</li><li>Cybersecurity</li><li>Third Parties</li><li>IT Operations</li><li>Regulations</li></ol><p>These eight domains enable complex digital businesses. They work in integrated relationships of people, processes, and digital systems to produce and preserve value. In traditional risk assessments we would identify risks within each of these domains, without necessarily fully appreciating the potential for individual domain risks to directly impact other domains.</p><p>Systemic Risk in complex digital businesses is primarily caused by five elements which impact these domains. These five key systemic risk causes are:</p><ol><li>Replaceability</li><li>Interconnectedness</li><li>Size</li><li>Complexity</li><li>Cross or X-Jurisdictional</li></ol><p>I believe it to be imperative for business oversight to understand and comprehend risk within each of the eight domains of complex digital businesses and their systems, in conjunction with the compounding nature of Systemic Risk generated by the five key elements of systemic dependencies between and among these domains.</p><p>Any of the five key elements of Systemic Risk has the potential to trigger cascading contagion risk throughout and across not just a single business, but across every connected business in today’s complex<em> customer-business-supplier value chains.</em></p><p>In my next post I will expand upon this introduction to Systemic Digital Risk and lay a foundation to deep dive into Cybersecurity Driven Risks and the five key elements of Systemic Risk.</p><p>Note: Source Material for this post- “Systemic Digital Risk: Understanding and Overseeing Complex Digital Environments With The DiRECTOR™ And RISCX™ Frameworks”, Digital Directors Network.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,82,562,'en',0,'<p>In my last post we examined the Risk Manager role we each play in our daily lives, as well as in our professional lives. Seems simple, doesn’t it?</p><p><strong>From the Moment we are Born, we are Confronted by Risks</strong></p><p><strong>We survive from Birth because someone is Managing Risks to Protect Us</strong></p><p>In business, we have audit departments and others who assess risks, and we engage in supporting risk assessments. One of the annual rights of passage for any business and information technology group is participating in the annual risk assessment process and the production of the Annual Risk Report. As cybersecurity professionals and business leaders we may even present the results of our risk assessment to the company’s Board of Directors Audit Committee. A significant amount of time, effort, thought, and angst goes into creating these reports and presentations. We even become experts at preparing and interpreting classic management consulting 9X or 3×3 frameworks to map risks against Impacts and Probability. You may even use more sophisticated frameworks. Each of our traditional risk assessment frameworks ask us to identify risks, determine the potential impact of an identified risk, and also to assess a risk’s potential to occur or probability of occurrence. Using these graphical frameworks, we then plot individual risk and or categories of risk into an assessment box which labels a risk as low, medium, or high.</p><p><img src=\"/sites/default/files/inline-images/Impact.png\" data-entity-uuid=\"9f6f273a-9266-404b-9ac0-508d337a99d3\" data-entity-type=\"file\" width=\"750\" height=\"595\"></p><p>Today, however, the infusion of information technology into every aspect of our business, the interconnectedness of our business operations with hyper-connected suppliers, distributors, customers, and layers of third and fourth parties, spanning the world, has massively increased the Business / Cyber Risks we face.</p><p><img src=\"/sites/default/files/inline-images/Systemic-Business-Cyber-Risk.png\" data-entity-uuid=\"f77c4e2f-3e83-4994-849c-189d2d445b11\" data-entity-type=\"file\" width=\"766\" height=\"529\"></p><p>I believe that the ways we have assessed Risks to our Business in the past are no longer adequate to address the complex nature of the web of risks we now face. Simple low, medium, and high-risk assessments no longer suffice to inform our business leaders and board members about the true nature of cyber driven risks.</p><p><strong>Systemic Digital Risk in Complex Digital Environments</strong></p><p>Systemic Risk is the threat that component failure in a complex system will cascade and jeopardize the much larger system. Systemic risk is inherent in all modern digital business environments. Systemic risk has become more prevalent as digital disruption and transformation advance throughout every aspect of business planning and operations, as well as in every aspect of society. The ability of organizations to create, capture and preserve value in rapidly changing digital economic systems makes understanding systemic digital risk a priority for all business leaders and boardroom members.</p><p>There are eight digital domains that work together across complex digital systems to produce and preserve business value.</p><ol><li>Data</li><li>Information architecture</li><li>Risk Communications</li><li>Emerging Technology</li><li>Cybersecurity</li><li>Third Parties</li><li>IT Operations</li><li>Regulations</li></ol><p>These eight domains enable complex digital businesses. They work in integrated relationships of people, processes, and digital systems to produce and preserve value. In traditional risk assessments we would identify risks within each of these domains, without necessarily fully appreciating the potential for individual domain risks to directly impact other domains.</p><p>Systemic Risk in complex digital businesses is primarily caused by five elements which impact these domains. These five key systemic risk causes are:</p><ol><li>Replaceability</li><li>Interconnectedness</li><li>Size</li><li>Complexity</li><li>Cross or X-Jurisdictional</li></ol><p>I believe it to be imperative for business oversight to understand and comprehend risk within each of the eight domains of complex digital businesses and their systems, in conjunction with the compounding nature of Systemic Risk generated by the five key elements of systemic dependencies between and among these domains.</p><p>Any of the five key elements of Systemic Risk has the potential to trigger cascading contagion risk throughout and across not just a single business, but across every connected business in today’s complex<em> customer-business-supplier value chains.</em></p><p>In my next post I will expand upon this introduction to Systemic Digital Risk and lay a foundation to deep dive into Cybersecurity Driven Risks and the five key elements of Systemic Risk.</p><p>Note: Source Material for this post- “Systemic Digital Risk: Understanding and Overseeing Complex Digital Environments With The DiRECTOR™ And RISCX™ Frameworks”, Digital Directors Network.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,82,637,'en',0,'<p>In my last post we examined the Risk Manager role we each play in our daily lives, as well as in our professional lives. Seems simple, doesn’t it?</p><p><strong>From the Moment we are Born, we are Confronted by Risks</strong></p><p><strong>We survive from Birth because someone is Managing Risks to Protect Us</strong></p><p>In business, we have audit departments and others who assess risks, and we engage in supporting risk assessments. One of the annual rights of passage for any business and information technology group is participating in the annual risk assessment process and the production of the Annual Risk Report. As cybersecurity professionals and business leaders we may even present the results of our risk assessment to the company’s Board of Directors Audit Committee. A significant amount of time, effort, thought, and angst goes into creating these reports and presentations. We even become experts at preparing and interpreting classic management consulting 9X or 3×3 frameworks to map risks against Impacts and Probability. You may even use more sophisticated frameworks. Each of our traditional risk assessment frameworks ask us to identify risks, determine the potential impact of an identified risk, and also to assess a risk’s potential to occur or probability of occurrence. Using these graphical frameworks, we then plot individual risk and or categories of risk into an assessment box which labels a risk as low, medium, or high.</p><p><img src=\"/sites/default/files/inline-images/Impact.png\" data-entity-uuid=\"9f6f273a-9266-404b-9ac0-508d337a99d3\" data-entity-type=\"file\" width=\"750\" height=\"595\"></p><p>Today, however, the infusion of information technology into every aspect of our business, the interconnectedness of our business operations with hyper-connected suppliers, distributors, customers, and layers of third and fourth parties, spanning the world, has massively increased the Business / Cyber Risks we face.</p><p><img src=\"/sites/default/files/inline-images/Systemic-Business-Cyber-Risk.png\" data-entity-uuid=\"f77c4e2f-3e83-4994-849c-189d2d445b11\" data-entity-type=\"file\" width=\"766\" height=\"529\"></p><p>I believe that the ways we have assessed Risks to our Business in the past are no longer adequate to address the complex nature of the web of risks we now face. Simple low, medium, and high-risk assessments no longer suffice to inform our business leaders and board members about the true nature of cyber driven risks.</p><p><strong>Systemic Digital Risk in Complex Digital Environments</strong></p><p>Systemic Risk is the threat that component failure in a complex system will cascade and jeopardize the much larger system. Systemic risk is inherent in all modern digital business environments. Systemic risk has become more prevalent as digital disruption and transformation advance throughout every aspect of business planning and operations, as well as in every aspect of society. The ability of organizations to create, capture and preserve value in rapidly changing digital economic systems makes understanding systemic digital risk a priority for all business leaders and boardroom members.</p><p>There are eight digital domains that work together across complex digital systems to produce and preserve business value.</p><ol><li>Data</li><li>Information architecture</li><li>Risk Communications</li><li>Emerging Technology</li><li>Cybersecurity</li><li>Third Parties</li><li>IT Operations</li><li>Regulations</li></ol><p>These eight domains enable complex digital businesses. They work in integrated relationships of people, processes, and digital systems to produce and preserve value. In traditional risk assessments we would identify risks within each of these domains, without necessarily fully appreciating the potential for individual domain risks to directly impact other domains.</p><p>Systemic Risk in complex digital businesses is primarily caused by five elements which impact these domains. These five key systemic risk causes are:</p><ol><li>Replaceability</li><li>Interconnectedness</li><li>Size</li><li>Complexity</li><li>Cross or X-Jurisdictional</li></ol><p>I believe it to be imperative for business oversight to understand and comprehend risk within each of the eight domains of complex digital businesses and their systems, in conjunction with the compounding nature of Systemic Risk generated by the five key elements of systemic dependencies between and among these domains.</p><p>Any of the five key elements of Systemic Risk has the potential to trigger cascading contagion risk throughout and across not just a single business, but across every connected business in today’s complex<em> customer-business-supplier value chains.</em></p><p>In my next post I will expand upon this introduction to Systemic Digital Risk and lay a foundation to deep dive into Cybersecurity Driven Risks and the five key elements of Systemic Risk.</p><p>Note: Source Material for this post- “Systemic Digital Risk: Understanding and Overseeing Complex Digital Environments With The DiRECTOR™ And RISCX™ Frameworks”, Digital Directors Network.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,83,210,'en',0,'<p>Last month, I introduced Systemic Digital Risk in Complex Digital Environments.</p><p><strong>Systemic Digital Risk in Complex Digital Environments</strong></p><p>I shared the view that Systemic Risk is the threat that component failure in a complex system will cascade and jeopardize the much larger system, and identified five elements of systemic risk that can significantly impact eight digital domains that work together across complex digital systems to produce and preserve business value. These lead us to new models for Integrated Risk Management … the DIRECTOR™ and RISCX™ frameworks (Source: “Systemic Digital Risk: <em>Understanding and Overseeing Complex Digital Environments with The DiRECTOR™ And RISCX™ Frameworks</em>”, Digital Directors Network. Used with permission).</p><p>The <em>DiRECTOR™</em> framework shows us eight key domains that enable complex digital systems. From a corporate director’s perspective these domains represent the key risk areas within a business’s digital system. The domains are co-dependent and influence / control how a digital business system functions and supports business value</p><img src=\"/sites/default/files/inline-images/Picture-1.png\" data-entity-uuid=\"3b0a1d33-b719-46ef-aab5-d25254e255af\" data-entity-type=\"file\" width=\"514\" height=\"493\"><p><strong>Data: Digital systems create, store, process, update, and use data</strong> to create knowledge, insight, and business process action.</p><p><strong>iArchitecture:</strong> Information architecture is the technical design spine of digital systems. Information architecture defines how information and digital systems interact within a business and between businesses.<strong> Information architecture enables all components of a digital system to interact </strong>– software, data, people, processes, networks, hardware.</p><p><strong>Risk Communication:</strong> Leadership communication concerning strategic and tactical assessment, forecasting, planning and engagement of business and digital risk with all stakeholders, internal and external are <strong>key to protecting business value.</strong></p><p>Emerging Technology: All emerging technologies possess the ability to enable, threaten or redefine existing business value drivers. As new technologies are engaged and applied anywhere across a business’s value chain, <strong>new complexities and risks emerge and must be accounted for.</strong></p><p><strong>Cybersecurity:</strong> Wherever there is business value, bad actors will attack to find the weakest links in a digital system and seek to take advantage for their own gain. This reality places constant strain on digital systems, creating significant value protection and preservation challenges from people to technology, internally and externally.</p><p><strong>Third-Party:</strong> No business is an island. Every modern business, small or large, operates within a value chain of digital system inter-connecting other parties – Customers, Suppliers, Own Business operations. Extended businesses, digital systems and value chains are constantly connected and in motion creating inter-dependencies which can compound <strong>cascading contagion risk</strong> across all digital systems.</p><p><strong>Operation of IT: </strong>Change is the one constant in digital systems and information technology. The ability of a business organization and its digital operations to effectively adapt to this dynamic is <strong>critical to the health, sustainability, and resiliency of a business’s digital system.</strong></p><p><strong>Regulation:</strong> Digital regulation is accelerating and expanding. Compliance is a boardroom staple and understanding how emerging regulations impact digital risk and security is required to shape responsible digital governance and policy formulation.</p><img src=\"/sites/default/files/inline-images/Picture-2.png\" data-entity-uuid=\"e550f7d2-e8f2-4c01-815f-8aeaf5dadf31\" data-entity-type=\"file\" width=\"487\" height=\"358\"><p>The <em>RISCX™ </em>framework presents for us five drivers of risk which are unique to today’s massively complex and interconnected digital system. Traditional risk management frameworks and assessment models often fail to consider and address these unique drivers of risk which have been seen to be the cause of <strong>systemic risk contagion </strong>on a massive scale.</p><p><strong>Replaceability: </strong>How rare, irreplaceable, and important is a component within a complex digital system? Critical hard to replace components create significant risk and brittleness in complex systems. The more dependent a digital system is on a component, and the harder it is to replace or bring back to operational use if it fails, the greater the level of risk to the larger system.</p><p><strong>Interconnectedness:</strong> Our digital systems and business processes have never been more interconnected than they are now. Complex digital systems are highly connected both internally and externally. The more interconnection points across a system, both inbound and outbound, the greater the risk that a failure can spread and cascade. <strong>This is the highest systemic risk trigger for contagion risk in the event of cybersecurity attacks, allowing failures to spread and cascade.</strong></p><p><strong>Size: </strong>Size impacts total exposure across complex digital systems. Size factors include size of the data universe enabled by a digital system; number of end-users; number of third and fourth parties; number of interconnect digital systems; number of business entities involved and providing digital systems in extended value chains; number of digital system providers contracted (both software licensed, SaaS and Cloud). Scale creates more points of vulnerability, adds to digital complexity, and contributes to increased digital systemic risk.</p><p><strong>Complexity:</strong> Complexity in any environment makes it more difficult to understand how an environment functions and how it can be controlled. Digital complexity develops from multiple areas. These include the number of component elements and heterogeneity within the system and its operations. As the complexity of a digital system increases, so does the systemic risk to the digital system.</p><p><strong>X-jurisdictional:</strong> The more regulatory environments a digital system is exposed to and must comply with, the more difficult it is to oversee and manage regulatory risk. Jurisdictions include regulatory bodies and other policy jurisdictions such as rules imposed by third parties.</p><p>In my next post I will discuss the integration of the<em> DiRECTOR™ </em>and the <em>RISCX™ </em>frameworks to provide a more comprehensive approach to assessing risk which I believe is needed to better appreciate and understand the unique systemic risks our business face in our complex digital world.</p><p>Note:</p><p>Source Material for this post- <em>“Systemic Digital Risk: Understanding and Overseeing Complex Digital Environments with The</em> <em>DiRECTOR™ </em>And<em> RISCX™</em> Frameworks”, Digital Directors Network.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,83,239,'en',0,'<p>Last month, I introduced Systemic Digital Risk in Complex Digital Environments.</p><p><strong>Systemic Digital Risk in Complex Digital Environments</strong></p><p>I shared the view that Systemic Risk is the threat that component failure in a complex system will cascade and jeopardize the much larger system, and identified five elements of systemic risk that can significantly impact eight digital domains that work together across complex digital systems to produce and preserve business value. These lead us to new models for Integrated Risk Management … the DIRECTOR™ and RISCX™ frameworks (Source: “Systemic Digital Risk: <em>Understanding and Overseeing Complex Digital Environments with The DiRECTOR™ And RISCX™ Frameworks</em>”, Digital Directors Network. Used with permission).</p><p>The <em>DiRECTOR™</em> framework shows us eight key domains that enable complex digital systems. From a corporate director’s perspective these domains represent the key risk areas within a business’s digital system. The domains are co-dependent and influence / control how a digital business system functions and supports business value</p><img src=\"/sites/default/files/inline-images/Picture-1.png\" data-entity-uuid=\"3b0a1d33-b719-46ef-aab5-d25254e255af\" data-entity-type=\"file\" width=\"514\" height=\"493\"><p><strong>Data: Digital systems create, store, process, update, and use data</strong> to create knowledge, insight, and business process action.</p><p><strong>iArchitecture:</strong> Information architecture is the technical design spine of digital systems. Information architecture defines how information and digital systems interact within a business and between businesses.<strong> Information architecture enables all components of a digital system to interact </strong>– software, data, people, processes, networks, hardware.</p><p><strong>Risk Communication:</strong> Leadership communication concerning strategic and tactical assessment, forecasting, planning and engagement of business and digital risk with all stakeholders, internal and external are <strong>key to protecting business value.</strong></p><p>Emerging Technology: All emerging technologies possess the ability to enable, threaten or redefine existing business value drivers. As new technologies are engaged and applied anywhere across a business’s value chain, <strong>new complexities and risks emerge and must be accounted for.</strong></p><p><strong>Cybersecurity:</strong> Wherever there is business value, bad actors will attack to find the weakest links in a digital system and seek to take advantage for their own gain. This reality places constant strain on digital systems, creating significant value protection and preservation challenges from people to technology, internally and externally.</p><p><strong>Third-Party:</strong> No business is an island. Every modern business, small or large, operates within a value chain of digital system inter-connecting other parties – Customers, Suppliers, Own Business operations. Extended businesses, digital systems and value chains are constantly connected and in motion creating inter-dependencies which can compound <strong>cascading contagion risk</strong> across all digital systems.</p><p><strong>Operation of IT: </strong>Change is the one constant in digital systems and information technology. The ability of a business organization and its digital operations to effectively adapt to this dynamic is <strong>critical to the health, sustainability, and resiliency of a business’s digital system.</strong></p><p><strong>Regulation:</strong> Digital regulation is accelerating and expanding. Compliance is a boardroom staple and understanding how emerging regulations impact digital risk and security is required to shape responsible digital governance and policy formulation.</p><img src=\"/sites/default/files/inline-images/Picture-2.png\" data-entity-uuid=\"e550f7d2-e8f2-4c01-815f-8aeaf5dadf31\" data-entity-type=\"file\" width=\"487\" height=\"358\"><p>The <em>RISCX™ </em>framework presents for us five drivers of risk which are unique to today’s massively complex and interconnected digital system. Traditional risk management frameworks and assessment models often fail to consider and address these unique drivers of risk which have been seen to be the cause of <strong>systemic risk contagion </strong>on a massive scale.</p><p><strong>Replaceability: </strong>How rare, irreplaceable, and important is a component within a complex digital system? Critical hard to replace components create significant risk and brittleness in complex systems. The more dependent a digital system is on a component, and the harder it is to replace or bring back to operational use if it fails, the greater the level of risk to the larger system.</p><p><strong>Interconnectedness:</strong> Our digital systems and business processes have never been more interconnected than they are now. Complex digital systems are highly connected both internally and externally. The more interconnection points across a system, both inbound and outbound, the greater the risk that a failure can spread and cascade. <strong>This is the highest systemic risk trigger for contagion risk in the event of cybersecurity attacks, allowing failures to spread and cascade.</strong></p><p><strong>Size: </strong>Size impacts total exposure across complex digital systems. Size factors include size of the data universe enabled by a digital system; number of end-users; number of third and fourth parties; number of interconnect digital systems; number of business entities involved and providing digital systems in extended value chains; number of digital system providers contracted (both software licensed, SaaS and Cloud). Scale creates more points of vulnerability, adds to digital complexity, and contributes to increased digital systemic risk.</p><p><strong>Complexity:</strong> Complexity in any environment makes it more difficult to understand how an environment functions and how it can be controlled. Digital complexity develops from multiple areas. These include the number of component elements and heterogeneity within the system and its operations. As the complexity of a digital system increases, so does the systemic risk to the digital system.</p><p><strong>X-jurisdictional:</strong> The more regulatory environments a digital system is exposed to and must comply with, the more difficult it is to oversee and manage regulatory risk. Jurisdictions include regulatory bodies and other policy jurisdictions such as rules imposed by third parties.</p><p>In my next post I will discuss the integration of the<em> DiRECTOR™ </em>and the <em>RISCX™ </em>frameworks to provide a more comprehensive approach to assessing risk which I believe is needed to better appreciate and understand the unique systemic risks our business face in our complex digital world.</p><p>Note:</p><p>Source Material for this post- <em>“Systemic Digital Risk: Understanding and Overseeing Complex Digital Environments with The</em> <em>DiRECTOR™ </em>And<em> RISCX™</em> Frameworks”, Digital Directors Network.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,83,401,'en',0,'<p>Last month, I introduced Systemic Digital Risk in Complex Digital Environments.</p><p><strong>Systemic Digital Risk in Complex Digital Environments</strong></p><p>I shared the view that Systemic Risk is the threat that component failure in a complex system will cascade and jeopardize the much larger system, and identified five elements of systemic risk that can significantly impact eight digital domains that work together across complex digital systems to produce and preserve business value. These lead us to new models for Integrated Risk Management … the DIRECTOR™ and RISCX™ frameworks (Source: “Systemic Digital Risk: <em>Understanding and Overseeing Complex Digital Environments with The DiRECTOR™ And RISCX™ Frameworks</em>”, Digital Directors Network. Used with permission).</p><p>The <em>DiRECTOR™</em> framework shows us eight key domains that enable complex digital systems. From a corporate director’s perspective these domains represent the key risk areas within a business’s digital system. The domains are co-dependent and influence / control how a digital business system functions and supports business value</p><img src=\"/sites/default/files/inline-images/Picture-1.png\" data-entity-uuid=\"3b0a1d33-b719-46ef-aab5-d25254e255af\" data-entity-type=\"file\" width=\"514\" height=\"493\"><p><strong>Data: Digital systems create, store, process, update, and use data</strong> to create knowledge, insight, and business process action.</p><p><strong>iArchitecture:</strong> Information architecture is the technical design spine of digital systems. Information architecture defines how information and digital systems interact within a business and between businesses.<strong> Information architecture enables all components of a digital system to interact </strong>– software, data, people, processes, networks, hardware.</p><p><strong>Risk Communication:</strong> Leadership communication concerning strategic and tactical assessment, forecasting, planning and engagement of business and digital risk with all stakeholders, internal and external are <strong>key to protecting business value.</strong></p><p>Emerging Technology: All emerging technologies possess the ability to enable, threaten or redefine existing business value drivers. As new technologies are engaged and applied anywhere across a business’s value chain, <strong>new complexities and risks emerge and must be accounted for.</strong></p><p><strong>Cybersecurity:</strong> Wherever there is business value, bad actors will attack to find the weakest links in a digital system and seek to take advantage for their own gain. This reality places constant strain on digital systems, creating significant value protection and preservation challenges from people to technology, internally and externally.</p><p><strong>Third-Party:</strong> No business is an island. Every modern business, small or large, operates within a value chain of digital system inter-connecting other parties – Customers, Suppliers, Own Business operations. Extended businesses, digital systems and value chains are constantly connected and in motion creating inter-dependencies which can compound <strong>cascading contagion risk</strong> across all digital systems.</p><p><strong>Operation of IT: </strong>Change is the one constant in digital systems and information technology. The ability of a business organization and its digital operations to effectively adapt to this dynamic is <strong>critical to the health, sustainability, and resiliency of a business’s digital system.</strong></p><p><strong>Regulation:</strong> Digital regulation is accelerating and expanding. Compliance is a boardroom staple and understanding how emerging regulations impact digital risk and security is required to shape responsible digital governance and policy formulation.</p><img src=\"/sites/default/files/inline-images/Picture-2.png\" data-entity-uuid=\"e550f7d2-e8f2-4c01-815f-8aeaf5dadf31\" data-entity-type=\"file\" width=\"487\" height=\"358\"><p>The <em>RISCX™ </em>framework presents for us five drivers of risk which are unique to today’s massively complex and interconnected digital system. Traditional risk management frameworks and assessment models often fail to consider and address these unique drivers of risk which have been seen to be the cause of <strong>systemic risk contagion </strong>on a massive scale.</p><p><strong>Replaceability: </strong>How rare, irreplaceable, and important is a component within a complex digital system? Critical hard to replace components create significant risk and brittleness in complex systems. The more dependent a digital system is on a component, and the harder it is to replace or bring back to operational use if it fails, the greater the level of risk to the larger system.</p><p><strong>Interconnectedness:</strong> Our digital systems and business processes have never been more interconnected than they are now. Complex digital systems are highly connected both internally and externally. The more interconnection points across a system, both inbound and outbound, the greater the risk that a failure can spread and cascade. <strong>This is the highest systemic risk trigger for contagion risk in the event of cybersecurity attacks, allowing failures to spread and cascade.</strong></p><p><strong>Size: </strong>Size impacts total exposure across complex digital systems. Size factors include size of the data universe enabled by a digital system; number of end-users; number of third and fourth parties; number of interconnect digital systems; number of business entities involved and providing digital systems in extended value chains; number of digital system providers contracted (both software licensed, SaaS and Cloud). Scale creates more points of vulnerability, adds to digital complexity, and contributes to increased digital systemic risk.</p><p><strong>Complexity:</strong> Complexity in any environment makes it more difficult to understand how an environment functions and how it can be controlled. Digital complexity develops from multiple areas. These include the number of component elements and heterogeneity within the system and its operations. As the complexity of a digital system increases, so does the systemic risk to the digital system.</p><p><strong>X-jurisdictional:</strong> The more regulatory environments a digital system is exposed to and must comply with, the more difficult it is to oversee and manage regulatory risk. Jurisdictions include regulatory bodies and other policy jurisdictions such as rules imposed by third parties.</p><p>In my next post I will discuss the integration of the<em> DiRECTOR™ </em>and the <em>RISCX™ </em>frameworks to provide a more comprehensive approach to assessing risk which I believe is needed to better appreciate and understand the unique systemic risks our business face in our complex digital world.</p><p>Note:</p><p>Source Material for this post- <em>“Systemic Digital Risk: Understanding and Overseeing Complex Digital Environments with The</em> <em>DiRECTOR™ </em>And<em> RISCX™</em> Frameworks”, Digital Directors Network.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,83,483,'en',0,'<p>Last month, I introduced Systemic Digital Risk in Complex Digital Environments.</p><p><strong>Systemic Digital Risk in Complex Digital Environments</strong></p><p>I shared the view that Systemic Risk is the threat that component failure in a complex system will cascade and jeopardize the much larger system, and identified five elements of systemic risk that can significantly impact eight digital domains that work together across complex digital systems to produce and preserve business value. These lead us to new models for Integrated Risk Management … the DIRECTOR™ and RISCX™ frameworks (Source: “Systemic Digital Risk: <em>Understanding and Overseeing Complex Digital Environments with The DiRECTOR™ And RISCX™ Frameworks</em>”, Digital Directors Network. Used with permission).</p><p>The <em>DiRECTOR™</em> framework shows us eight key domains that enable complex digital systems. From a corporate director’s perspective these domains represent the key risk areas within a business’s digital system. The domains are co-dependent and influence / control how a digital business system functions and supports business value</p><img src=\"/sites/default/files/inline-images/Picture-1.png\" data-entity-uuid=\"3b0a1d33-b719-46ef-aab5-d25254e255af\" data-entity-type=\"file\" width=\"514\" height=\"493\"><p><strong>Data: Digital systems create, store, process, update, and use data</strong> to create knowledge, insight, and business process action.</p><p><strong>iArchitecture:</strong> Information architecture is the technical design spine of digital systems. Information architecture defines how information and digital systems interact within a business and between businesses.<strong> Information architecture enables all components of a digital system to interact </strong>– software, data, people, processes, networks, hardware.</p><p><strong>Risk Communication:</strong> Leadership communication concerning strategic and tactical assessment, forecasting, planning and engagement of business and digital risk with all stakeholders, internal and external are <strong>key to protecting business value.</strong></p><p>Emerging Technology: All emerging technologies possess the ability to enable, threaten or redefine existing business value drivers. As new technologies are engaged and applied anywhere across a business’s value chain, <strong>new complexities and risks emerge and must be accounted for.</strong></p><p><strong>Cybersecurity:</strong> Wherever there is business value, bad actors will attack to find the weakest links in a digital system and seek to take advantage for their own gain. This reality places constant strain on digital systems, creating significant value protection and preservation challenges from people to technology, internally and externally.</p><p><strong>Third-Party:</strong> No business is an island. Every modern business, small or large, operates within a value chain of digital system inter-connecting other parties – Customers, Suppliers, Own Business operations. Extended businesses, digital systems and value chains are constantly connected and in motion creating inter-dependencies which can compound <strong>cascading contagion risk</strong> across all digital systems.</p><p><strong>Operation of IT: </strong>Change is the one constant in digital systems and information technology. The ability of a business organization and its digital operations to effectively adapt to this dynamic is <strong>critical to the health, sustainability, and resiliency of a business’s digital system.</strong></p><p><strong>Regulation:</strong> Digital regulation is accelerating and expanding. Compliance is a boardroom staple and understanding how emerging regulations impact digital risk and security is required to shape responsible digital governance and policy formulation.</p><img src=\"/sites/default/files/inline-images/Picture-2.png\" data-entity-uuid=\"e550f7d2-e8f2-4c01-815f-8aeaf5dadf31\" data-entity-type=\"file\" width=\"487\" height=\"358\"><p>The <em>RISCX™ </em>framework presents for us five drivers of risk which are unique to today’s massively complex and interconnected digital system. Traditional risk management frameworks and assessment models often fail to consider and address these unique drivers of risk which have been seen to be the cause of <strong>systemic risk contagion </strong>on a massive scale.</p><p><strong>Replaceability: </strong>How rare, irreplaceable, and important is a component within a complex digital system? Critical hard to replace components create significant risk and brittleness in complex systems. The more dependent a digital system is on a component, and the harder it is to replace or bring back to operational use if it fails, the greater the level of risk to the larger system.</p><p><strong>Interconnectedness:</strong> Our digital systems and business processes have never been more interconnected than they are now. Complex digital systems are highly connected both internally and externally. The more interconnection points across a system, both inbound and outbound, the greater the risk that a failure can spread and cascade. <strong>This is the highest systemic risk trigger for contagion risk in the event of cybersecurity attacks, allowing failures to spread and cascade.</strong></p><p><strong>Size: </strong>Size impacts total exposure across complex digital systems. Size factors include size of the data universe enabled by a digital system; number of end-users; number of third and fourth parties; number of interconnect digital systems; number of business entities involved and providing digital systems in extended value chains; number of digital system providers contracted (both software licensed, SaaS and Cloud). Scale creates more points of vulnerability, adds to digital complexity, and contributes to increased digital systemic risk.</p><p><strong>Complexity:</strong> Complexity in any environment makes it more difficult to understand how an environment functions and how it can be controlled. Digital complexity develops from multiple areas. These include the number of component elements and heterogeneity within the system and its operations. As the complexity of a digital system increases, so does the systemic risk to the digital system.</p><p><strong>X-jurisdictional:</strong> The more regulatory environments a digital system is exposed to and must comply with, the more difficult it is to oversee and manage regulatory risk. Jurisdictions include regulatory bodies and other policy jurisdictions such as rules imposed by third parties.</p><p>In my next post I will discuss the integration of the<em> DiRECTOR™ </em>and the <em>RISCX™ </em>frameworks to provide a more comprehensive approach to assessing risk which I believe is needed to better appreciate and understand the unique systemic risks our business face in our complex digital world.</p><p>Note:</p><p>Source Material for this post- <em>“Systemic Digital Risk: Understanding and Overseeing Complex Digital Environments with The</em> <em>DiRECTOR™ </em>And<em> RISCX™</em> Frameworks”, Digital Directors Network.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,83,563,'en',0,'<p>Last month, I introduced Systemic Digital Risk in Complex Digital Environments.</p><p><strong>Systemic Digital Risk in Complex Digital Environments</strong></p><p>I shared the view that Systemic Risk is the threat that component failure in a complex system will cascade and jeopardize the much larger system, and identified five elements of systemic risk that can significantly impact eight digital domains that work together across complex digital systems to produce and preserve business value. These lead us to new models for Integrated Risk Management … the DIRECTOR™ and RISCX™ frameworks (Source: “Systemic Digital Risk: <em>Understanding and Overseeing Complex Digital Environments with The DiRECTOR™ And RISCX™ Frameworks</em>”, Digital Directors Network. Used with permission).</p><p>The <em>DiRECTOR™</em> framework shows us eight key domains that enable complex digital systems. From a corporate director’s perspective these domains represent the key risk areas within a business’s digital system. The domains are co-dependent and influence / control how a digital business system functions and supports business value</p><img src=\"/sites/default/files/inline-images/Picture-1.png\" data-entity-uuid=\"3b0a1d33-b719-46ef-aab5-d25254e255af\" data-entity-type=\"file\" width=\"514\" height=\"493\"><p><strong>Data: Digital systems create, store, process, update, and use data</strong> to create knowledge, insight, and business process action.</p><p><strong>iArchitecture:</strong> Information architecture is the technical design spine of digital systems. Information architecture defines how information and digital systems interact within a business and between businesses.<strong> Information architecture enables all components of a digital system to interact </strong>– software, data, people, processes, networks, hardware.</p><p><strong>Risk Communication:</strong> Leadership communication concerning strategic and tactical assessment, forecasting, planning and engagement of business and digital risk with all stakeholders, internal and external are <strong>key to protecting business value.</strong></p><p>Emerging Technology: All emerging technologies possess the ability to enable, threaten or redefine existing business value drivers. As new technologies are engaged and applied anywhere across a business’s value chain, <strong>new complexities and risks emerge and must be accounted for.</strong></p><p><strong>Cybersecurity:</strong> Wherever there is business value, bad actors will attack to find the weakest links in a digital system and seek to take advantage for their own gain. This reality places constant strain on digital systems, creating significant value protection and preservation challenges from people to technology, internally and externally.</p><p><strong>Third-Party:</strong> No business is an island. Every modern business, small or large, operates within a value chain of digital system inter-connecting other parties – Customers, Suppliers, Own Business operations. Extended businesses, digital systems and value chains are constantly connected and in motion creating inter-dependencies which can compound <strong>cascading contagion risk</strong> across all digital systems.</p><p><strong>Operation of IT: </strong>Change is the one constant in digital systems and information technology. The ability of a business organization and its digital operations to effectively adapt to this dynamic is <strong>critical to the health, sustainability, and resiliency of a business’s digital system.</strong></p><p><strong>Regulation:</strong> Digital regulation is accelerating and expanding. Compliance is a boardroom staple and understanding how emerging regulations impact digital risk and security is required to shape responsible digital governance and policy formulation.</p><img src=\"/sites/default/files/inline-images/Picture-2.png\" data-entity-uuid=\"e550f7d2-e8f2-4c01-815f-8aeaf5dadf31\" data-entity-type=\"file\" width=\"487\" height=\"358\"><p>The <em>RISCX™ </em>framework presents for us five drivers of risk which are unique to today’s massively complex and interconnected digital system. Traditional risk management frameworks and assessment models often fail to consider and address these unique drivers of risk which have been seen to be the cause of <strong>systemic risk contagion </strong>on a massive scale.</p><p><strong>Replaceability: </strong>How rare, irreplaceable, and important is a component within a complex digital system? Critical hard to replace components create significant risk and brittleness in complex systems. The more dependent a digital system is on a component, and the harder it is to replace or bring back to operational use if it fails, the greater the level of risk to the larger system.</p><p><strong>Interconnectedness:</strong> Our digital systems and business processes have never been more interconnected than they are now. Complex digital systems are highly connected both internally and externally. The more interconnection points across a system, both inbound and outbound, the greater the risk that a failure can spread and cascade. <strong>This is the highest systemic risk trigger for contagion risk in the event of cybersecurity attacks, allowing failures to spread and cascade.</strong></p><p><strong>Size: </strong>Size impacts total exposure across complex digital systems. Size factors include size of the data universe enabled by a digital system; number of end-users; number of third and fourth parties; number of interconnect digital systems; number of business entities involved and providing digital systems in extended value chains; number of digital system providers contracted (both software licensed, SaaS and Cloud). Scale creates more points of vulnerability, adds to digital complexity, and contributes to increased digital systemic risk.</p><p><strong>Complexity:</strong> Complexity in any environment makes it more difficult to understand how an environment functions and how it can be controlled. Digital complexity develops from multiple areas. These include the number of component elements and heterogeneity within the system and its operations. As the complexity of a digital system increases, so does the systemic risk to the digital system.</p><p><strong>X-jurisdictional:</strong> The more regulatory environments a digital system is exposed to and must comply with, the more difficult it is to oversee and manage regulatory risk. Jurisdictions include regulatory bodies and other policy jurisdictions such as rules imposed by third parties.</p><p>In my next post I will discuss the integration of the<em> DiRECTOR™ </em>and the <em>RISCX™ </em>frameworks to provide a more comprehensive approach to assessing risk which I believe is needed to better appreciate and understand the unique systemic risks our business face in our complex digital world.</p><p>Note:</p><p>Source Material for this post- <em>“Systemic Digital Risk: Understanding and Overseeing Complex Digital Environments with The</em> <em>DiRECTOR™ </em>And<em> RISCX™</em> Frameworks”, Digital Directors Network.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,83,638,'en',0,'<p>Last month, I introduced Systemic Digital Risk in Complex Digital Environments.</p><p><strong>Systemic Digital Risk in Complex Digital Environments</strong></p><p>I shared the view that Systemic Risk is the threat that component failure in a complex system will cascade and jeopardize the much larger system, and identified five elements of systemic risk that can significantly impact eight digital domains that work together across complex digital systems to produce and preserve business value. These lead us to new models for Integrated Risk Management … the DIRECTOR™ and RISCX™ frameworks (Source: “Systemic Digital Risk: <em>Understanding and Overseeing Complex Digital Environments with The DiRECTOR™ And RISCX™ Frameworks</em>”, Digital Directors Network. Used with permission).</p><p>The <em>DiRECTOR™</em> framework shows us eight key domains that enable complex digital systems. From a corporate director’s perspective these domains represent the key risk areas within a business’s digital system. The domains are co-dependent and influence / control how a digital business system functions and supports business value</p><img src=\"/sites/default/files/inline-images/Picture-1.png\" data-entity-uuid=\"3b0a1d33-b719-46ef-aab5-d25254e255af\" data-entity-type=\"file\" width=\"514\" height=\"493\"><p><strong>Data: Digital systems create, store, process, update, and use data</strong> to create knowledge, insight, and business process action.</p><p><strong>iArchitecture:</strong> Information architecture is the technical design spine of digital systems. Information architecture defines how information and digital systems interact within a business and between businesses.<strong> Information architecture enables all components of a digital system to interact </strong>– software, data, people, processes, networks, hardware.</p><p><strong>Risk Communication:</strong> Leadership communication concerning strategic and tactical assessment, forecasting, planning and engagement of business and digital risk with all stakeholders, internal and external are <strong>key to protecting business value.</strong></p><p>Emerging Technology: All emerging technologies possess the ability to enable, threaten or redefine existing business value drivers. As new technologies are engaged and applied anywhere across a business’s value chain, <strong>new complexities and risks emerge and must be accounted for.</strong></p><p><strong>Cybersecurity:</strong> Wherever there is business value, bad actors will attack to find the weakest links in a digital system and seek to take advantage for their own gain. This reality places constant strain on digital systems, creating significant value protection and preservation challenges from people to technology, internally and externally.</p><p><strong>Third-Party:</strong> No business is an island. Every modern business, small or large, operates within a value chain of digital system inter-connecting other parties – Customers, Suppliers, Own Business operations. Extended businesses, digital systems and value chains are constantly connected and in motion creating inter-dependencies which can compound <strong>cascading contagion risk</strong> across all digital systems.</p><p><strong>Operation of IT: </strong>Change is the one constant in digital systems and information technology. The ability of a business organization and its digital operations to effectively adapt to this dynamic is <strong>critical to the health, sustainability, and resiliency of a business’s digital system.</strong></p><p><strong>Regulation:</strong> Digital regulation is accelerating and expanding. Compliance is a boardroom staple and understanding how emerging regulations impact digital risk and security is required to shape responsible digital governance and policy formulation.</p><img src=\"/sites/default/files/inline-images/Picture-2.png\" data-entity-uuid=\"e550f7d2-e8f2-4c01-815f-8aeaf5dadf31\" data-entity-type=\"file\" width=\"487\" height=\"358\"><p>The <em>RISCX™ </em>framework presents for us five drivers of risk which are unique to today’s massively complex and interconnected digital system. Traditional risk management frameworks and assessment models often fail to consider and address these unique drivers of risk which have been seen to be the cause of <strong>systemic risk contagion </strong>on a massive scale.</p><p><strong>Replaceability: </strong>How rare, irreplaceable, and important is a component within a complex digital system? Critical hard to replace components create significant risk and brittleness in complex systems. The more dependent a digital system is on a component, and the harder it is to replace or bring back to operational use if it fails, the greater the level of risk to the larger system.</p><p><strong>Interconnectedness:</strong> Our digital systems and business processes have never been more interconnected than they are now. Complex digital systems are highly connected both internally and externally. The more interconnection points across a system, both inbound and outbound, the greater the risk that a failure can spread and cascade. <strong>This is the highest systemic risk trigger for contagion risk in the event of cybersecurity attacks, allowing failures to spread and cascade.</strong></p><p><strong>Size: </strong>Size impacts total exposure across complex digital systems. Size factors include size of the data universe enabled by a digital system; number of end-users; number of third and fourth parties; number of interconnect digital systems; number of business entities involved and providing digital systems in extended value chains; number of digital system providers contracted (both software licensed, SaaS and Cloud). Scale creates more points of vulnerability, adds to digital complexity, and contributes to increased digital systemic risk.</p><p><strong>Complexity:</strong> Complexity in any environment makes it more difficult to understand how an environment functions and how it can be controlled. Digital complexity develops from multiple areas. These include the number of component elements and heterogeneity within the system and its operations. As the complexity of a digital system increases, so does the systemic risk to the digital system.</p><p><strong>X-jurisdictional:</strong> The more regulatory environments a digital system is exposed to and must comply with, the more difficult it is to oversee and manage regulatory risk. Jurisdictions include regulatory bodies and other policy jurisdictions such as rules imposed by third parties.</p><p>In my next post I will discuss the integration of the<em> DiRECTOR™ </em>and the <em>RISCX™ </em>frameworks to provide a more comprehensive approach to assessing risk which I believe is needed to better appreciate and understand the unique systemic risks our business face in our complex digital world.</p><p>Note:</p><p>Source Material for this post- <em>“Systemic Digital Risk: Understanding and Overseeing Complex Digital Environments with The</em> <em>DiRECTOR™ </em>And<em> RISCX™</em> Frameworks”, Digital Directors Network.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,84,211,'en',0,'<p>My last blog posts have focused on introducing Systemic Digital Risk in Complex Digital Environments and exploring new frameworks with which to assess Risk in today’s business environments.</p><p><strong>Systemic Digital Risk in Complex Digital Environments</strong></p><p>I shared the view that <strong>Systemic Risk</strong> is the threat that component failure in a complex system will cascade and jeopardize the much larger system, and identified five elements of systemic risk that can significantly impact eight digital domains that work together across complex digital systems to produce and preserve business value. These lead us to new models for Integrated Risk Management … the DiRECTOR™ and RISCX™ frameworks (Source: <em>“Systemic Digital Risk: Understanding and Overseeing Complex Digital Environments with The DiRECTOR™ And RISCX™ Frameworks”</em>, Digital Directors Network. Used with permission).</p><p>As a quick start to the new year, let’s review the <em>DiRECTOR™</em> and the <em>RISCX™ </em>frameworks.</p><p>The <em>DiRECTOR™</em> framework shows us eight key domains that enable complex digital systems. From a corporate director’s perspective, these domains represent the key risk areas within a business’ digital system. The domains are co-dependent and influence/control how a digital business system functions and supports business value.</p><img src=\"/sites/default/files/inline-images/Picture-1%20%281%29.png\" data-entity-uuid=\"6156bae9-68f4-4eeb-a59e-960ec7b93339\" data-entity-type=\"file\" width=\"977\" height=\"495\"><p>The <strong>RISCX™</strong> framework presents for us five drivers of risk which are unique to today’s massively complex and interconnected digital system. Traditional risk management frameworks and assessment models often fail to consider and address these unique drivers of risk which have been seen to be the cause of system and systemic failure on a massive scale.</p><p>To fully understand, appreciate, and represent Systemic Digital Risk in the Complex Digital Environments with which we operate our businesses today calls for us to examine each of the five drivers of risk (<em>RISCX™ </em>framework) against each of the eight domains of complex digital systems (<em>DiRECTOR™</em> framework).</p><p><strong>Assess Complex Digital Systems for Systemic Risk Contagion Weakness</strong></p><p><img src=\"/sites/default/files/inline-images/Picture-1-1.png\" data-entity-uuid=\"f96f9591-cbc4-46b4-88ac-c91f674884ba\" data-entity-type=\"file\" width=\"506\" height=\"558\"></p><p>&nbsp;</p><p>Business value, the key digital domains that drive it, and the elements that can cause systemic risk combine as an integrated framework with which to fully view systemic risk in digital systems. By taking this approach to assessing risk we can reveal significant gaps in our understanding of component and systemic risk throughout our digital business systems. This is a risk model that can be applied at any level of an organization, including programs, projects, business units and enterprises. It is only when systemic risk in complex digital systems is understood, that it can be fully managed and mitigated.</p><p><img src=\"/sites/default/files/inline-images/Picture-1-2.png\" data-entity-uuid=\"6e9c1483-926f-4699-8849-44f86d93733f\" data-entity-type=\"file\" width=\"566\" height=\"502\"></p><p>This is an approach that reframes how executives and corporate directors comprehend complex systemic risk in digital business ecosystems. It is intended to provide a blueprint for how technology executives can communicate the complex issues they manage to the attention to their senior executive leadership and to the boardroom in a way that resonates with a senior executive’s and/or corporate director’s responsibilities and mindset.</p><p>Bringing these views together allows us to frame risk against business value, or rather, assessing risk to the business value of our organizations.</p><p>In my next series of posts, I will endeavor to explore with you the exploding Global Risk Ecosystem that threatens our businesses today and into the future, and to help you self-assess as you ask your organization the following question: <strong>Do you and your business have the ability to anticipate, prepare for, and adapt to changing conditions to withstand, respond to, and recover from a Cyber Business Disruption?</strong></p><p>Note: Source Material for this post- <em>“Systemic Digital Risk: Understanding and Overseeing Complex Digital Environments with The DiRECTOR™ And RISCX™ Frameworks”, </em>Digital Directors Network.</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html');
INSERT INTO `node_revision__body` VALUES ('blog',0,84,212,'en',0,'<p>My last blog posts have focused on introducing Systemic Digital Risk in Complex Digital Environments and exploring new frameworks with which to assess Risk in today’s business environments.</p><p><strong>Systemic Digital Risk in Complex Digital Environments</strong></p><p>I shared the view that <strong>Systemic Risk</strong> is the threat that component failure in a complex system will cascade and jeopardize the much larger system, and identified five elements of systemic risk that can significantly impact eight digital domains that work together across complex digital systems to produce and preserve business value. These lead us to new models for Integrated Risk Management … the DiRECTOR™ and RISCX™ frameworks (Source: <em>“Systemic Digital Risk: Understanding and Overseeing Complex Digital Environments with The DiRECTOR™ And RISCX™ Frameworks”</em>, Digital Directors Network. Used with permission).</p><p>As a quick start to the new year, let’s review the <em>DiRECTOR™</em> and the <em>RISCX™ </em>frameworks.</p><p>The <em>DiRECTOR™</em> framework shows us eight key domains that enable complex digital systems. From a corporate director’s perspective, these domains represent the key risk areas within a business’ digital system. The domains are co-dependent and influence/control how a digital business system functions and supports business value.</p><img src=\"/sites/default/files/inline-images/Picture-1%20%281%29.png\" data-entity-uuid=\"6156bae9-68f4-4eeb-a59e-960ec7b93339\" data-entity-type=\"file\" width=\"977\" height=\"495\"><p>The <strong>RISCX™</strong> framework presents for us five drivers of risk which are unique to today’s massively complex and interconnected digital system. Traditional risk management frameworks and assessment models often fail to consider and address these unique drivers of risk which have been seen to be the cause of system and systemic failure on a massive scale.</p><p>To fully understand, appreciate, and represent Systemic Digital Risk in the Complex Digital Environments with which we operate our businesses today calls for us to examine each of the five drivers of risk (<em>RISCX™ </em>framework) against each of the eight domains of complex digital systems (<em>DiRECTOR™</em> framework).</p><p><strong>Assess Complex Digital Systems for Systemic Risk Contagion Weakness</strong></p><p><img src=\"/sites/default/files/inline-images/Picture-1-1.png\" data-entity-uuid=\"f96f9591-cbc4-46b4-88ac-c91f674884ba\" data-entity-type=\"file\" width=\"506\" height=\"558\"></p><p>&nbsp;</p><p>Business value, the key digital domains that drive it, and the elements that can cause systemic risk combine as an integrated framework with which to fully view systemic risk in digital systems. By taking this approach to assessing risk we can reveal significant gaps in our understanding of component and systemic risk throughout our digital business systems. This is a risk model that can be applied at any level of an organization, including programs, projects, business units and enterprises. It is only when systemic risk in complex digital systems is understood, that it can be fully managed and mitigated.</p><p><img src=\"/sites/default/files/inline-images/Picture-1-2.png\" data-entity-uuid=\"6e9c1483-926f-4699-8849-44f86d93733f\" data-entity-type=\"file\" width=\"566\" height=\"502\"></p><p>This is an approach that reframes how executives and corporate directors comprehend complex systemic risk in digital business ecosystems. It is intended to provide a blueprint for how technology executives can communicate the complex issues they manage to the attention to their senior executive leadership and to the boardroom in a way that resonates with a senior executive’s and/or corporate director’s responsibilities and mindset.</p><p>Bringing these views together allows us to frame risk against business value, or rather, assessing risk to the business value of our organizations.</p><p>In my next series of posts, I will endeavor to explore with you the exploding Global Risk Ecosystem that threatens our businesses today and into the future, and to help you self-assess as you ask your organization the following question: <strong>Do you and your business have the ability to anticipate, prepare for, and adapt to changing conditions to withstand, respond to, and recover from a Cyber Business Disruption?</strong></p><p>Note: Source Material for this post- <em>“Systemic Digital Risk: Understanding and Overseeing Complex Digital Environments with The DiRECTOR™ And RISCX™ Frameworks”, </em>Digital Directors Network.</p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,84,238,'en',0,'<p>My last blog posts have focused on introducing Systemic Digital Risk in Complex Digital Environments and exploring new frameworks with which to assess Risk in today’s business environments.</p><p><strong>Systemic Digital Risk in Complex Digital Environments</strong></p><p>I shared the view that <strong>Systemic Risk</strong> is the threat that component failure in a complex system will cascade and jeopardize the much larger system, and identified five elements of systemic risk that can significantly impact eight digital domains that work together across complex digital systems to produce and preserve business value. These lead us to new models for Integrated Risk Management … the DiRECTOR™ and RISCX™ frameworks (Source: <em>“Systemic Digital Risk: Understanding and Overseeing Complex Digital Environments with The DiRECTOR™ And RISCX™ Frameworks”</em>, Digital Directors Network. Used with permission).</p><p>As a quick start to the new year, let’s review the <em>DiRECTOR™</em> and the <em>RISCX™ </em>frameworks.</p><p>The <em>DiRECTOR™</em> framework shows us eight key domains that enable complex digital systems. From a corporate director’s perspective, these domains represent the key risk areas within a business’ digital system. The domains are co-dependent and influence/control how a digital business system functions and supports business value.</p><img src=\"/sites/default/files/inline-images/Picture-1%20%281%29.png\" data-entity-uuid=\"6156bae9-68f4-4eeb-a59e-960ec7b93339\" data-entity-type=\"file\" width=\"977\" height=\"495\"><p>The <strong>RISCX™</strong> framework presents for us five drivers of risk which are unique to today’s massively complex and interconnected digital system. Traditional risk management frameworks and assessment models often fail to consider and address these unique drivers of risk which have been seen to be the cause of system and systemic failure on a massive scale.</p><p>To fully understand, appreciate, and represent Systemic Digital Risk in the Complex Digital Environments with which we operate our businesses today calls for us to examine each of the five drivers of risk (<em>RISCX™ </em>framework) against each of the eight domains of complex digital systems (<em>DiRECTOR™</em> framework).</p><p><strong>Assess Complex Digital Systems for Systemic Risk Contagion Weakness</strong></p><p><img src=\"/sites/default/files/inline-images/Picture-1-1.png\" data-entity-uuid=\"f96f9591-cbc4-46b4-88ac-c91f674884ba\" data-entity-type=\"file\" width=\"506\" height=\"558\"></p><p>&nbsp;</p><p>Business value, the key digital domains that drive it, and the elements that can cause systemic risk combine as an integrated framework with which to fully view systemic risk in digital systems. By taking this approach to assessing risk we can reveal significant gaps in our understanding of component and systemic risk throughout our digital business systems. This is a risk model that can be applied at any level of an organization, including programs, projects, business units and enterprises. It is only when systemic risk in complex digital systems is understood, that it can be fully managed and mitigated.</p><p><img src=\"/sites/default/files/inline-images/Picture-1-2.png\" data-entity-uuid=\"6e9c1483-926f-4699-8849-44f86d93733f\" data-entity-type=\"file\" width=\"566\" height=\"502\"></p><p>This is an approach that reframes how executives and corporate directors comprehend complex systemic risk in digital business ecosystems. It is intended to provide a blueprint for how technology executives can communicate the complex issues they manage to the attention to their senior executive leadership and to the boardroom in a way that resonates with a senior executive’s and/or corporate director’s responsibilities and mindset.</p><p>Bringing these views together allows us to frame risk against business value, or rather, assessing risk to the business value of our organizations.</p><p>In my next series of posts, I will endeavor to explore with you the exploding Global Risk Ecosystem that threatens our businesses today and into the future, and to help you self-assess as you ask your organization the following question: <strong>Do you and your business have the ability to anticipate, prepare for, and adapt to changing conditions to withstand, respond to, and recover from a Cyber Business Disruption?</strong></p><p>Note: Source Material for this post- <em>“Systemic Digital Risk: Understanding and Overseeing Complex Digital Environments with The DiRECTOR™ And RISCX™ Frameworks”, </em>Digital Directors Network.</p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,84,402,'en',0,'<p>My last blog posts have focused on introducing Systemic Digital Risk in Complex Digital Environments and exploring new frameworks with which to assess Risk in today’s business environments.</p><p><strong>Systemic Digital Risk in Complex Digital Environments</strong></p><p>I shared the view that <strong>Systemic Risk</strong> is the threat that component failure in a complex system will cascade and jeopardize the much larger system, and identified five elements of systemic risk that can significantly impact eight digital domains that work together across complex digital systems to produce and preserve business value. These lead us to new models for Integrated Risk Management … the DiRECTOR™ and RISCX™ frameworks (Source: <em>“Systemic Digital Risk: Understanding and Overseeing Complex Digital Environments with The DiRECTOR™ And RISCX™ Frameworks”</em>, Digital Directors Network. Used with permission).</p><p>As a quick start to the new year, let’s review the <em>DiRECTOR™</em> and the <em>RISCX™ </em>frameworks.</p><p>The <em>DiRECTOR™</em> framework shows us eight key domains that enable complex digital systems. From a corporate director’s perspective, these domains represent the key risk areas within a business’ digital system. The domains are co-dependent and influence/control how a digital business system functions and supports business value.</p><img src=\"/sites/default/files/inline-images/Picture-1%20%281%29.png\" data-entity-uuid=\"6156bae9-68f4-4eeb-a59e-960ec7b93339\" data-entity-type=\"file\" width=\"977\" height=\"495\"><p>The <strong>RISCX™</strong> framework presents for us five drivers of risk which are unique to today’s massively complex and interconnected digital system. Traditional risk management frameworks and assessment models often fail to consider and address these unique drivers of risk which have been seen to be the cause of system and systemic failure on a massive scale.</p><p>To fully understand, appreciate, and represent Systemic Digital Risk in the Complex Digital Environments with which we operate our businesses today calls for us to examine each of the five drivers of risk (<em>RISCX™ </em>framework) against each of the eight domains of complex digital systems (<em>DiRECTOR™</em> framework).</p><p><strong>Assess Complex Digital Systems for Systemic Risk Contagion Weakness</strong></p><p><img src=\"/sites/default/files/inline-images/Picture-1-1.png\" data-entity-uuid=\"f96f9591-cbc4-46b4-88ac-c91f674884ba\" data-entity-type=\"file\" width=\"506\" height=\"558\"></p><p>&nbsp;</p><p>Business value, the key digital domains that drive it, and the elements that can cause systemic risk combine as an integrated framework with which to fully view systemic risk in digital systems. By taking this approach to assessing risk we can reveal significant gaps in our understanding of component and systemic risk throughout our digital business systems. This is a risk model that can be applied at any level of an organization, including programs, projects, business units and enterprises. It is only when systemic risk in complex digital systems is understood, that it can be fully managed and mitigated.</p><p><img src=\"/sites/default/files/inline-images/Picture-1-2.png\" data-entity-uuid=\"6e9c1483-926f-4699-8849-44f86d93733f\" data-entity-type=\"file\" width=\"566\" height=\"502\"></p><p>This is an approach that reframes how executives and corporate directors comprehend complex systemic risk in digital business ecosystems. It is intended to provide a blueprint for how technology executives can communicate the complex issues they manage to the attention to their senior executive leadership and to the boardroom in a way that resonates with a senior executive’s and/or corporate director’s responsibilities and mindset.</p><p>Bringing these views together allows us to frame risk against business value, or rather, assessing risk to the business value of our organizations.</p><p>In my next series of posts, I will endeavor to explore with you the exploding Global Risk Ecosystem that threatens our businesses today and into the future, and to help you self-assess as you ask your organization the following question: <strong>Do you and your business have the ability to anticipate, prepare for, and adapt to changing conditions to withstand, respond to, and recover from a Cyber Business Disruption?</strong></p><p>Note: Source Material for this post- <em>“Systemic Digital Risk: Understanding and Overseeing Complex Digital Environments with The DiRECTOR™ And RISCX™ Frameworks”, </em>Digital Directors Network.</p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,84,484,'en',0,'<p>My last blog posts have focused on introducing Systemic Digital Risk in Complex Digital Environments and exploring new frameworks with which to assess Risk in today’s business environments.</p><p><strong>Systemic Digital Risk in Complex Digital Environments</strong></p><p>I shared the view that <strong>Systemic Risk</strong> is the threat that component failure in a complex system will cascade and jeopardize the much larger system, and identified five elements of systemic risk that can significantly impact eight digital domains that work together across complex digital systems to produce and preserve business value. These lead us to new models for Integrated Risk Management … the DiRECTOR™ and RISCX™ frameworks (Source: <em>“Systemic Digital Risk: Understanding and Overseeing Complex Digital Environments with The DiRECTOR™ And RISCX™ Frameworks”</em>, Digital Directors Network. Used with permission).</p><p>As a quick start to the new year, let’s review the <em>DiRECTOR™</em> and the <em>RISCX™ </em>frameworks.</p><p>The <em>DiRECTOR™</em> framework shows us eight key domains that enable complex digital systems. From a corporate director’s perspective, these domains represent the key risk areas within a business’ digital system. The domains are co-dependent and influence/control how a digital business system functions and supports business value.</p><img src=\"/sites/default/files/inline-images/Picture-1%20%281%29.png\" data-entity-uuid=\"6156bae9-68f4-4eeb-a59e-960ec7b93339\" data-entity-type=\"file\" width=\"977\" height=\"495\"><p>The <strong>RISCX™</strong> framework presents for us five drivers of risk which are unique to today’s massively complex and interconnected digital system. Traditional risk management frameworks and assessment models often fail to consider and address these unique drivers of risk which have been seen to be the cause of system and systemic failure on a massive scale.</p><p>To fully understand, appreciate, and represent Systemic Digital Risk in the Complex Digital Environments with which we operate our businesses today calls for us to examine each of the five drivers of risk (<em>RISCX™ </em>framework) against each of the eight domains of complex digital systems (<em>DiRECTOR™</em> framework).</p><p><strong>Assess Complex Digital Systems for Systemic Risk Contagion Weakness</strong></p><p><img src=\"/sites/default/files/inline-images/Picture-1-1.png\" data-entity-uuid=\"f96f9591-cbc4-46b4-88ac-c91f674884ba\" data-entity-type=\"file\" width=\"506\" height=\"558\"></p><p>&nbsp;</p><p>Business value, the key digital domains that drive it, and the elements that can cause systemic risk combine as an integrated framework with which to fully view systemic risk in digital systems. By taking this approach to assessing risk we can reveal significant gaps in our understanding of component and systemic risk throughout our digital business systems. This is a risk model that can be applied at any level of an organization, including programs, projects, business units and enterprises. It is only when systemic risk in complex digital systems is understood, that it can be fully managed and mitigated.</p><p><img src=\"/sites/default/files/inline-images/Picture-1-2.png\" data-entity-uuid=\"6e9c1483-926f-4699-8849-44f86d93733f\" data-entity-type=\"file\" width=\"566\" height=\"502\"></p><p>This is an approach that reframes how executives and corporate directors comprehend complex systemic risk in digital business ecosystems. It is intended to provide a blueprint for how technology executives can communicate the complex issues they manage to the attention to their senior executive leadership and to the boardroom in a way that resonates with a senior executive’s and/or corporate director’s responsibilities and mindset.</p><p>Bringing these views together allows us to frame risk against business value, or rather, assessing risk to the business value of our organizations.</p><p>In my next series of posts, I will endeavor to explore with you the exploding Global Risk Ecosystem that threatens our businesses today and into the future, and to help you self-assess as you ask your organization the following question: <strong>Do you and your business have the ability to anticipate, prepare for, and adapt to changing conditions to withstand, respond to, and recover from a Cyber Business Disruption?</strong></p><p>Note: Source Material for this post- <em>“Systemic Digital Risk: Understanding and Overseeing Complex Digital Environments with The DiRECTOR™ And RISCX™ Frameworks”, </em>Digital Directors Network.</p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,84,564,'en',0,'<p>My last blog posts have focused on introducing Systemic Digital Risk in Complex Digital Environments and exploring new frameworks with which to assess Risk in today’s business environments.</p><p><strong>Systemic Digital Risk in Complex Digital Environments</strong></p><p>I shared the view that <strong>Systemic Risk</strong> is the threat that component failure in a complex system will cascade and jeopardize the much larger system, and identified five elements of systemic risk that can significantly impact eight digital domains that work together across complex digital systems to produce and preserve business value. These lead us to new models for Integrated Risk Management … the DiRECTOR™ and RISCX™ frameworks (Source: <em>“Systemic Digital Risk: Understanding and Overseeing Complex Digital Environments with The DiRECTOR™ And RISCX™ Frameworks”</em>, Digital Directors Network. Used with permission).</p><p>As a quick start to the new year, let’s review the <em>DiRECTOR™</em> and the <em>RISCX™ </em>frameworks.</p><p>The <em>DiRECTOR™</em> framework shows us eight key domains that enable complex digital systems. From a corporate director’s perspective, these domains represent the key risk areas within a business’ digital system. The domains are co-dependent and influence/control how a digital business system functions and supports business value.</p><img src=\"/sites/default/files/inline-images/Picture-1%20%281%29.png\" data-entity-uuid=\"6156bae9-68f4-4eeb-a59e-960ec7b93339\" data-entity-type=\"file\" width=\"977\" height=\"495\"><p>The <strong>RISCX™</strong> framework presents for us five drivers of risk which are unique to today’s massively complex and interconnected digital system. Traditional risk management frameworks and assessment models often fail to consider and address these unique drivers of risk which have been seen to be the cause of system and systemic failure on a massive scale.</p><p>To fully understand, appreciate, and represent Systemic Digital Risk in the Complex Digital Environments with which we operate our businesses today calls for us to examine each of the five drivers of risk (<em>RISCX™ </em>framework) against each of the eight domains of complex digital systems (<em>DiRECTOR™</em> framework).</p><p><strong>Assess Complex Digital Systems for Systemic Risk Contagion Weakness</strong></p><p><img src=\"/sites/default/files/inline-images/Picture-1-1.png\" data-entity-uuid=\"f96f9591-cbc4-46b4-88ac-c91f674884ba\" data-entity-type=\"file\" width=\"506\" height=\"558\"></p><p>&nbsp;</p><p>Business value, the key digital domains that drive it, and the elements that can cause systemic risk combine as an integrated framework with which to fully view systemic risk in digital systems. By taking this approach to assessing risk we can reveal significant gaps in our understanding of component and systemic risk throughout our digital business systems. This is a risk model that can be applied at any level of an organization, including programs, projects, business units and enterprises. It is only when systemic risk in complex digital systems is understood, that it can be fully managed and mitigated.</p><p><img src=\"/sites/default/files/inline-images/Picture-1-2.png\" data-entity-uuid=\"6e9c1483-926f-4699-8849-44f86d93733f\" data-entity-type=\"file\" width=\"566\" height=\"502\"></p><p>This is an approach that reframes how executives and corporate directors comprehend complex systemic risk in digital business ecosystems. It is intended to provide a blueprint for how technology executives can communicate the complex issues they manage to the attention to their senior executive leadership and to the boardroom in a way that resonates with a senior executive’s and/or corporate director’s responsibilities and mindset.</p><p>Bringing these views together allows us to frame risk against business value, or rather, assessing risk to the business value of our organizations.</p><p>In my next series of posts, I will endeavor to explore with you the exploding Global Risk Ecosystem that threatens our businesses today and into the future, and to help you self-assess as you ask your organization the following question: <strong>Do you and your business have the ability to anticipate, prepare for, and adapt to changing conditions to withstand, respond to, and recover from a Cyber Business Disruption?</strong></p><p>Note: Source Material for this post- <em>“Systemic Digital Risk: Understanding and Overseeing Complex Digital Environments with The DiRECTOR™ And RISCX™ Frameworks”, </em>Digital Directors Network.</p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,84,639,'en',0,'<p>My last blog posts have focused on introducing Systemic Digital Risk in Complex Digital Environments and exploring new frameworks with which to assess Risk in today’s business environments.</p><p><strong>Systemic Digital Risk in Complex Digital Environments</strong></p><p>I shared the view that <strong>Systemic Risk</strong> is the threat that component failure in a complex system will cascade and jeopardize the much larger system, and identified five elements of systemic risk that can significantly impact eight digital domains that work together across complex digital systems to produce and preserve business value. These lead us to new models for Integrated Risk Management … the DiRECTOR™ and RISCX™ frameworks (Source: <em>“Systemic Digital Risk: Understanding and Overseeing Complex Digital Environments with The DiRECTOR™ And RISCX™ Frameworks”</em>, Digital Directors Network. Used with permission).</p><p>As a quick start to the new year, let’s review the <em>DiRECTOR™</em> and the <em>RISCX™ </em>frameworks.</p><p>The <em>DiRECTOR™</em> framework shows us eight key domains that enable complex digital systems. From a corporate director’s perspective, these domains represent the key risk areas within a business’ digital system. The domains are co-dependent and influence/control how a digital business system functions and supports business value.</p><img src=\"/sites/default/files/inline-images/Picture-1%20%281%29.png\" data-entity-uuid=\"6156bae9-68f4-4eeb-a59e-960ec7b93339\" data-entity-type=\"file\" width=\"977\" height=\"495\"><p>The <strong>RISCX™</strong> framework presents for us five drivers of risk which are unique to today’s massively complex and interconnected digital system. Traditional risk management frameworks and assessment models often fail to consider and address these unique drivers of risk which have been seen to be the cause of system and systemic failure on a massive scale.</p><p>To fully understand, appreciate, and represent Systemic Digital Risk in the Complex Digital Environments with which we operate our businesses today calls for us to examine each of the five drivers of risk (<em>RISCX™ </em>framework) against each of the eight domains of complex digital systems (<em>DiRECTOR™</em> framework).</p><p><strong>Assess Complex Digital Systems for Systemic Risk Contagion Weakness</strong></p><p><img src=\"/sites/default/files/inline-images/Picture-1-1.png\" data-entity-uuid=\"f96f9591-cbc4-46b4-88ac-c91f674884ba\" data-entity-type=\"file\" width=\"506\" height=\"558\"></p><p>&nbsp;</p><p>Business value, the key digital domains that drive it, and the elements that can cause systemic risk combine as an integrated framework with which to fully view systemic risk in digital systems. By taking this approach to assessing risk we can reveal significant gaps in our understanding of component and systemic risk throughout our digital business systems. This is a risk model that can be applied at any level of an organization, including programs, projects, business units and enterprises. It is only when systemic risk in complex digital systems is understood, that it can be fully managed and mitigated.</p><p><img src=\"/sites/default/files/inline-images/Picture-1-2.png\" data-entity-uuid=\"6e9c1483-926f-4699-8849-44f86d93733f\" data-entity-type=\"file\" width=\"566\" height=\"502\"></p><p>This is an approach that reframes how executives and corporate directors comprehend complex systemic risk in digital business ecosystems. It is intended to provide a blueprint for how technology executives can communicate the complex issues they manage to the attention to their senior executive leadership and to the boardroom in a way that resonates with a senior executive’s and/or corporate director’s responsibilities and mindset.</p><p>Bringing these views together allows us to frame risk against business value, or rather, assessing risk to the business value of our organizations.</p><p>In my next series of posts, I will endeavor to explore with you the exploding Global Risk Ecosystem that threatens our businesses today and into the future, and to help you self-assess as you ask your organization the following question: <strong>Do you and your business have the ability to anticipate, prepare for, and adapt to changing conditions to withstand, respond to, and recover from a Cyber Business Disruption?</strong></p><p>Note: Source Material for this post- <em>“Systemic Digital Risk: Understanding and Overseeing Complex Digital Environments with The DiRECTOR™ And RISCX™ Frameworks”, </em>Digital Directors Network.</p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,85,213,'en',0,'<p>Last month I closed my post by saying that in my next series of posts, I will endeavor to explore with you the exploding Global Risk Ecosystem which threatens our businesses today and into the future, and to help you self-assess as you ask your organization the following question:</p><p><strong>Do you and your business have the ability to anticipate, prepare for, and adapt to changing conditions to withstand, respond to, and recover from a Cyber Business Disruption?</strong></p><p>I will begin this series of posts with a quote from a recent an Opinion article published in the Washington Post on February 14, 2024:</p><blockquote><p><strong>“At this moment, … the United States faces escalating threats posed by China, Russia, Iran, foreign cartels, sophisticated hackers, WMD proliferators, spies, terrorists and more …”.</strong> Gen. Paul M. Nakasone</p></blockquote><p>(Article:<em> I was head of the NSA. In a world of threats, this is my biggest worry.</em> By Paul M. Nakasone, February 14, 2024, published in the Washington Post. General Paul M. Nakasone was commander of the U.S Cyber Command, Director of the national Security Agency and chief of the Central Security Service until February 2nd, 2024.)</p><p>Gen. Nakasone goes on in his article to speak about what remains his biggest worry concerning these continuing and escalating threats. He worries that we <strong>“make ourselves blind to external threats”</strong> by not sharing and connecting the dots of knowledge and intelligence we have available to prevent and block attacks. He continues to share his views on how we need to continue to work across and with all aspects of government, technology companies, businesses and suppliers to businesses and government whose services are increasingly being exploited by terrorists and other bad actors.</p><p><strong>Your business is under attack every day!</strong></p><p>Gen. Nakasone goes on in his article to speak very specifically about the various challenges and aspects of sharing risk and intelligence information across U.S. Intelligence Agencies. His perspectives remind me of the challenges of engaging in risk and threat dialogs within a business as a security officer. You are acutely aware of risks and threats to your business.<strong> Yet in the crush of business as usual you may not or do not have the attention of your leadership peers</strong> concerning the knowledge and intelligence you possess concerning the risk and threats your business faces.</p><p>It has been my experience that my greatest challenge has always been keeping the attention of my peers focused on the things that would harm our business. I am not speaking about the mundane operational tasks and activities of cybersecurity. I am speaking about the real risks <strong>–High Impact High Probability risks, </strong>the <strong>multiplicative effects of Low Impact High Probability risks,</strong> and actual unfolding attacks.</p><p>Why is this such a challenge? We are bombarded with bad news from all corners of online and traditional news and media every day. With most of the online news being sensationalized for clicks, it is hard for our peers to avoid being influenced into not knowing what to pay attention to or not to pay attention to. So why should they pay attention to you?</p><p>Let’s use an example:</p><p><strong>February 07, 2024: Cybersecurity &amp; Infrastructure Security Agency Advisory PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure Alert Code: AA24-038A</strong></p><p>The U.S. authoring agencies have confirmed that Volt Typhoon has compromised the IT environments of multiple critical infrastructure organizations—primarily in <a style=\"padding:0;\" href=\"https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/communications-sector\">Communications</a>,<a style=\"padding:0;\" href=\"https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/energy-sector\">Energy</a>,<a style=\"padding:0;\" href=\"https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/transportation-systems-sector\">Transportation Systems</a>,and <a style=\"padding:0;\" href=\"https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/water-and-wastewater-sector\">Water and Wastewater Systems Sectors</a>— in the continental and non-continental United States and its territories, including Guam. Volt Typhoon’s choice of targets and pattern of behavior is not consistent with traditional cyber espionage or intelligence gathering operations, and the U.S. authoring agencies assess with high confidence that Volt Typhoon actors are pre-positioning themselves on IT networks to enable lateral movement to OT assets to disrupt functions. The U.S. authoring agencies are concerned about the potential for these actors to use their network access for disruptive effects in the event of potential geopolitical tensions and/or military conflicts.</p><p>This is not fake news! This is real. The implications of this are staggering. China / Volt Typhoon is already pre-positioned inside these critical infrastructure Complex Digital Systems! This is not about defending against an attack. The attack has already happened. You may look at the list of critical infrastructure sectors above and say to yourself that you are not in those business sectors. Rest assured, though, that you will be dramatically impacted by any attack in any of these sectors.</p><p>I pray that the organizations penetrated and impacted are taking all appropriate actions to deal with this.</p><p>Now to make my closing point today. This amazing CISA Alert was in the major news feeds for one day. It was reported and reposted by many on Linked-In for a second day. I have seen no other posts after that, no continuing dialog, no follow up news articles. <strong>Creeping Normality strikes again.</strong> We have become so used to hearing about cybersecurity threats, breaches, data loss, etc., that the importance of such risk and threat intelligence is glossed over. This example forces me to ask this question: <strong>Has any senior leadership executive in your organization reached out to ask you about this (CISA Advisory Alert Code: AA24-038A)?</strong></p><p><strong>or</strong></p><p><strong>Have you reached out to any senior leadership executive in your organization to advise them about the ramification of this (CISA Advisory Alert Code: AA24-038A) to your organization?</strong></p><p>I am not in any way suggesting that you need to take any specific action at or within your business because of this CISA Advisory Alert. Only you would know if you should be communicating with your senior leadership about this. In the words of Gen. Nakasone, if you should be in dialog with your senior leadership about this cybersecurity intelligence <em>“failure to do so would be a self-inflicted wound of the highest order.”</em></p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,85,214,'en',0,'<p>Last month I closed my post by saying that in my next series of posts, I will endeavor to explore with you the exploding Global Risk Ecosystem which threatens our businesses today and into the future, and to help you self-assess as you ask your organization the following question:</p><p><strong>Do you and your business have the ability to anticipate, prepare for, and adapt to changing conditions to withstand, respond to, and recover from a Cyber Business Disruption?</strong></p><p>I will begin this series of posts with a quote from a recent an Opinion article published in the Washington Post on February 14, 2024:</p><blockquote><p><strong>“At this moment, … the United States faces escalating threats posed by China, Russia, Iran, foreign cartels, sophisticated hackers, WMD proliferators, spies, terrorists and more …”.</strong> Gen. Paul M. Nakasone</p></blockquote><p>(Article:<em> I was head of the NSA. In a world of threats, this is my biggest worry.</em> By Paul M. Nakasone, February 14, 2024, published in the Washington Post. General Paul M. Nakasone was commander of the U.S Cyber Command, Director of the national Security Agency and chief of the Central Security Service until February 2nd, 2024.)</p><p>Gen. Nakasone goes on in his article to speak about what remains his biggest worry concerning these continuing and escalating threats. He worries that we <strong>“make ourselves blind to external threats”</strong> by not sharing and connecting the dots of knowledge and intelligence we have available to prevent and block attacks. He continues to share his views on how we need to continue to work across and with all aspects of government, technology companies, businesses and suppliers to businesses and government whose services are increasingly being exploited by terrorists and other bad actors.</p><p><strong>Your business is under attack every day!</strong></p><p>Gen. Nakasone goes on in his article to speak very specifically about the various challenges and aspects of sharing risk and intelligence information across U.S. Intelligence Agencies. His perspectives remind me of the challenges of engaging in risk and threat dialogs within a business as a security officer. You are acutely aware of risks and threats to your business.<strong> Yet in the crush of business as usual you may not or do not have the attention of your leadership peers</strong> concerning the knowledge and intelligence you possess concerning the risk and threats your business faces.</p><p>It has been my experience that my greatest challenge has always been keeping the attention of my peers focused on the things that would harm our business. I am not speaking about the mundane operational tasks and activities of cybersecurity. I am speaking about the real risks <strong>–High Impact High Probability risks, </strong>the <strong>multiplicative effects of Low Impact High Probability risks,</strong> and actual unfolding attacks.</p><p>Why is this such a challenge? We are bombarded with bad news from all corners of online and traditional news and media every day. With most of the online news being sensationalized for clicks, it is hard for our peers to avoid being influenced into not knowing what to pay attention to or not to pay attention to. So why should they pay attention to you?</p><p>Let’s use an example:</p><p><strong>February 07, 2024: Cybersecurity &amp; Infrastructure Security Agency Advisory PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure Alert Code: AA24-038A</strong></p><p>The U.S. authoring agencies have confirmed that Volt Typhoon has compromised the IT environments of multiple critical infrastructure organizations—primarily in <a style=\"padding:0;\" href=\"https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/communications-sector\">Communications</a>,<a style=\"padding:0;\" href=\"https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/energy-sector\">Energy</a>,<a style=\"padding:0;\" href=\"https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/transportation-systems-sector\">Transportation Systems</a>,and <a style=\"padding:0;\" href=\"https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/water-and-wastewater-sector\">Water and Wastewater Systems Sectors</a>— in the continental and non-continental United States and its territories, including Guam. Volt Typhoon’s choice of targets and pattern of behavior is not consistent with traditional cyber espionage or intelligence gathering operations, and the U.S. authoring agencies assess with high confidence that Volt Typhoon actors are pre-positioning themselves on IT networks to enable lateral movement to OT assets to disrupt functions. The U.S. authoring agencies are concerned about the potential for these actors to use their network access for disruptive effects in the event of potential geopolitical tensions and/or military conflicts.</p><p>This is not fake news! This is real. The implications of this are staggering. China / Volt Typhoon is already pre-positioned inside these critical infrastructure Complex Digital Systems! This is not about defending against an attack. The attack has already happened. You may look at the list of critical infrastructure sectors above and say to yourself that you are not in those business sectors. Rest assured, though, that you will be dramatically impacted by any attack in any of these sectors.</p><p>I pray that the organizations penetrated and impacted are taking all appropriate actions to deal with this.</p><p>Now to make my closing point today. This amazing CISA Alert was in the major news feeds for one day. It was reported and reposted by many on Linked-In for a second day. I have seen no other posts after that, no continuing dialog, no follow up news articles. <strong>Creeping Normality strikes again.</strong> We have become so used to hearing about cybersecurity threats, breaches, data loss, etc., that the importance of such risk and threat intelligence is glossed over. This example forces me to ask this question: <strong>Has any senior leadership executive in your organization reached out to ask you about this (CISA Advisory Alert Code: AA24-038A)?</strong></p><p><strong>or</strong></p><p><strong>Have you reached out to any senior leadership executive in your organization to advise them about the ramification of this (CISA Advisory Alert Code: AA24-038A) to your organization?</strong></p><p>I am not in any way suggesting that you need to take any specific action at or within your business because of this CISA Advisory Alert. Only you would know if you should be communicating with your senior leadership about this. In the words of Gen. Nakasone, if you should be in dialog with your senior leadership about this cybersecurity intelligence <em>“failure to do so would be a self-inflicted wound of the highest order.”</em></p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,85,237,'en',0,'<p>Last month I closed my post by saying that in my next series of posts, I will endeavor to explore with you the exploding Global Risk Ecosystem which threatens our businesses today and into the future, and to help you self-assess as you ask your organization the following question:</p><p><strong>Do you and your business have the ability to anticipate, prepare for, and adapt to changing conditions to withstand, respond to, and recover from a Cyber Business Disruption?</strong></p><p>I will begin this series of posts with a quote from a recent an Opinion article published in the Washington Post on February 14, 2024:</p><blockquote><p><strong>“At this moment, … the United States faces escalating threats posed by China, Russia, Iran, foreign cartels, sophisticated hackers, WMD proliferators, spies, terrorists and more …”.</strong> Gen. Paul M. Nakasone</p></blockquote><p>(Article:<em> I was head of the NSA. In a world of threats, this is my biggest worry.</em> By Paul M. Nakasone, February 14, 2024, published in the Washington Post. General Paul M. Nakasone was commander of the U.S Cyber Command, Director of the national Security Agency and chief of the Central Security Service until February 2nd, 2024.)</p><p>Gen. Nakasone goes on in his article to speak about what remains his biggest worry concerning these continuing and escalating threats. He worries that we <strong>“make ourselves blind to external threats”</strong> by not sharing and connecting the dots of knowledge and intelligence we have available to prevent and block attacks. He continues to share his views on how we need to continue to work across and with all aspects of government, technology companies, businesses and suppliers to businesses and government whose services are increasingly being exploited by terrorists and other bad actors.</p><p><strong>Your business is under attack every day!</strong></p><p>Gen. Nakasone goes on in his article to speak very specifically about the various challenges and aspects of sharing risk and intelligence information across U.S. Intelligence Agencies. His perspectives remind me of the challenges of engaging in risk and threat dialogs within a business as a security officer. You are acutely aware of risks and threats to your business.<strong> Yet in the crush of business as usual you may not or do not have the attention of your leadership peers</strong> concerning the knowledge and intelligence you possess concerning the risk and threats your business faces.</p><p>It has been my experience that my greatest challenge has always been keeping the attention of my peers focused on the things that would harm our business. I am not speaking about the mundane operational tasks and activities of cybersecurity. I am speaking about the real risks <strong>–High Impact High Probability risks, </strong>the <strong>multiplicative effects of Low Impact High Probability risks,</strong> and actual unfolding attacks.</p><p>Why is this such a challenge? We are bombarded with bad news from all corners of online and traditional news and media every day. With most of the online news being sensationalized for clicks, it is hard for our peers to avoid being influenced into not knowing what to pay attention to or not to pay attention to. So why should they pay attention to you?</p><p>Let’s use an example:</p><p><strong>February 07, 2024: Cybersecurity &amp; Infrastructure Security Agency Advisory PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure Alert Code: AA24-038A</strong></p><p>The U.S. authoring agencies have confirmed that Volt Typhoon has compromised the IT environments of multiple critical infrastructure organizations—primarily in <a style=\"padding:0;\" href=\"https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/communications-sector\">Communications</a>,<a style=\"padding:0;\" href=\"https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/energy-sector\">Energy</a>,<a style=\"padding:0;\" href=\"https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/transportation-systems-sector\">Transportation Systems</a>,and <a style=\"padding:0;\" href=\"https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/water-and-wastewater-sector\">Water and Wastewater Systems Sectors</a>— in the continental and non-continental United States and its territories, including Guam. Volt Typhoon’s choice of targets and pattern of behavior is not consistent with traditional cyber espionage or intelligence gathering operations, and the U.S. authoring agencies assess with high confidence that Volt Typhoon actors are pre-positioning themselves on IT networks to enable lateral movement to OT assets to disrupt functions. The U.S. authoring agencies are concerned about the potential for these actors to use their network access for disruptive effects in the event of potential geopolitical tensions and/or military conflicts.</p><p>This is not fake news! This is real. The implications of this are staggering. China / Volt Typhoon is already pre-positioned inside these critical infrastructure Complex Digital Systems! This is not about defending against an attack. The attack has already happened. You may look at the list of critical infrastructure sectors above and say to yourself that you are not in those business sectors. Rest assured, though, that you will be dramatically impacted by any attack in any of these sectors.</p><p>I pray that the organizations penetrated and impacted are taking all appropriate actions to deal with this.</p><p>Now to make my closing point today. This amazing CISA Alert was in the major news feeds for one day. It was reported and reposted by many on Linked-In for a second day. I have seen no other posts after that, no continuing dialog, no follow up news articles. <strong>Creeping Normality strikes again.</strong> We have become so used to hearing about cybersecurity threats, breaches, data loss, etc., that the importance of such risk and threat intelligence is glossed over. This example forces me to ask this question: <strong>Has any senior leadership executive in your organization reached out to ask you about this (CISA Advisory Alert Code: AA24-038A)?</strong></p><p><strong>or</strong></p><p><strong>Have you reached out to any senior leadership executive in your organization to advise them about the ramification of this (CISA Advisory Alert Code: AA24-038A) to your organization?</strong></p><p>I am not in any way suggesting that you need to take any specific action at or within your business because of this CISA Advisory Alert. Only you would know if you should be communicating with your senior leadership about this. In the words of Gen. Nakasone, if you should be in dialog with your senior leadership about this cybersecurity intelligence <em>“failure to do so would be a self-inflicted wound of the highest order.”</em></p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,85,403,'en',0,'<p>Last month I closed my post by saying that in my next series of posts, I will endeavor to explore with you the exploding Global Risk Ecosystem which threatens our businesses today and into the future, and to help you self-assess as you ask your organization the following question:</p><p><strong>Do you and your business have the ability to anticipate, prepare for, and adapt to changing conditions to withstand, respond to, and recover from a Cyber Business Disruption?</strong></p><p>I will begin this series of posts with a quote from a recent an Opinion article published in the Washington Post on February 14, 2024:</p><blockquote><p><strong>“At this moment, … the United States faces escalating threats posed by China, Russia, Iran, foreign cartels, sophisticated hackers, WMD proliferators, spies, terrorists and more …”.</strong> Gen. Paul M. Nakasone</p></blockquote><p>(Article:<em> I was head of the NSA. In a world of threats, this is my biggest worry.</em> By Paul M. Nakasone, February 14, 2024, published in the Washington Post. General Paul M. Nakasone was commander of the U.S Cyber Command, Director of the national Security Agency and chief of the Central Security Service until February 2nd, 2024.)</p><p>Gen. Nakasone goes on in his article to speak about what remains his biggest worry concerning these continuing and escalating threats. He worries that we <strong>“make ourselves blind to external threats”</strong> by not sharing and connecting the dots of knowledge and intelligence we have available to prevent and block attacks. He continues to share his views on how we need to continue to work across and with all aspects of government, technology companies, businesses and suppliers to businesses and government whose services are increasingly being exploited by terrorists and other bad actors.</p><p><strong>Your business is under attack every day!</strong></p><p>Gen. Nakasone goes on in his article to speak very specifically about the various challenges and aspects of sharing risk and intelligence information across U.S. Intelligence Agencies. His perspectives remind me of the challenges of engaging in risk and threat dialogs within a business as a security officer. You are acutely aware of risks and threats to your business.<strong> Yet in the crush of business as usual you may not or do not have the attention of your leadership peers</strong> concerning the knowledge and intelligence you possess concerning the risk and threats your business faces.</p><p>It has been my experience that my greatest challenge has always been keeping the attention of my peers focused on the things that would harm our business. I am not speaking about the mundane operational tasks and activities of cybersecurity. I am speaking about the real risks <strong>–High Impact High Probability risks, </strong>the <strong>multiplicative effects of Low Impact High Probability risks,</strong> and actual unfolding attacks.</p><p>Why is this such a challenge? We are bombarded with bad news from all corners of online and traditional news and media every day. With most of the online news being sensationalized for clicks, it is hard for our peers to avoid being influenced into not knowing what to pay attention to or not to pay attention to. So why should they pay attention to you?</p><p>Let’s use an example:</p><p><strong>February 07, 2024: Cybersecurity &amp; Infrastructure Security Agency Advisory PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure Alert Code: AA24-038A</strong></p><p>The U.S. authoring agencies have confirmed that Volt Typhoon has compromised the IT environments of multiple critical infrastructure organizations—primarily in <a style=\"padding:0;\" href=\"https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/communications-sector\">Communications</a>,<a style=\"padding:0;\" href=\"https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/energy-sector\">Energy</a>,<a style=\"padding:0;\" href=\"https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/transportation-systems-sector\">Transportation Systems</a>,and <a style=\"padding:0;\" href=\"https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/water-and-wastewater-sector\">Water and Wastewater Systems Sectors</a>— in the continental and non-continental United States and its territories, including Guam. Volt Typhoon’s choice of targets and pattern of behavior is not consistent with traditional cyber espionage or intelligence gathering operations, and the U.S. authoring agencies assess with high confidence that Volt Typhoon actors are pre-positioning themselves on IT networks to enable lateral movement to OT assets to disrupt functions. The U.S. authoring agencies are concerned about the potential for these actors to use their network access for disruptive effects in the event of potential geopolitical tensions and/or military conflicts.</p><p>This is not fake news! This is real. The implications of this are staggering. China / Volt Typhoon is already pre-positioned inside these critical infrastructure Complex Digital Systems! This is not about defending against an attack. The attack has already happened. You may look at the list of critical infrastructure sectors above and say to yourself that you are not in those business sectors. Rest assured, though, that you will be dramatically impacted by any attack in any of these sectors.</p><p>I pray that the organizations penetrated and impacted are taking all appropriate actions to deal with this.</p><p>Now to make my closing point today. This amazing CISA Alert was in the major news feeds for one day. It was reported and reposted by many on Linked-In for a second day. I have seen no other posts after that, no continuing dialog, no follow up news articles. <strong>Creeping Normality strikes again.</strong> We have become so used to hearing about cybersecurity threats, breaches, data loss, etc., that the importance of such risk and threat intelligence is glossed over. This example forces me to ask this question: <strong>Has any senior leadership executive in your organization reached out to ask you about this (CISA Advisory Alert Code: AA24-038A)?</strong></p><p><strong>or</strong></p><p><strong>Have you reached out to any senior leadership executive in your organization to advise them about the ramification of this (CISA Advisory Alert Code: AA24-038A) to your organization?</strong></p><p>I am not in any way suggesting that you need to take any specific action at or within your business because of this CISA Advisory Alert. Only you would know if you should be communicating with your senior leadership about this. In the words of Gen. Nakasone, if you should be in dialog with your senior leadership about this cybersecurity intelligence <em>“failure to do so would be a self-inflicted wound of the highest order.”</em></p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,85,485,'en',0,'<p>Last month I closed my post by saying that in my next series of posts, I will endeavor to explore with you the exploding Global Risk Ecosystem which threatens our businesses today and into the future, and to help you self-assess as you ask your organization the following question:</p><p><strong>Do you and your business have the ability to anticipate, prepare for, and adapt to changing conditions to withstand, respond to, and recover from a Cyber Business Disruption?</strong></p><p>I will begin this series of posts with a quote from a recent an Opinion article published in the Washington Post on February 14, 2024:</p><blockquote><p><strong>“At this moment, … the United States faces escalating threats posed by China, Russia, Iran, foreign cartels, sophisticated hackers, WMD proliferators, spies, terrorists and more …”.</strong> Gen. Paul M. Nakasone</p></blockquote><p>(Article:<em> I was head of the NSA. In a world of threats, this is my biggest worry.</em> By Paul M. Nakasone, February 14, 2024, published in the Washington Post. General Paul M. Nakasone was commander of the U.S Cyber Command, Director of the national Security Agency and chief of the Central Security Service until February 2nd, 2024.)</p><p>Gen. Nakasone goes on in his article to speak about what remains his biggest worry concerning these continuing and escalating threats. He worries that we <strong>“make ourselves blind to external threats”</strong> by not sharing and connecting the dots of knowledge and intelligence we have available to prevent and block attacks. He continues to share his views on how we need to continue to work across and with all aspects of government, technology companies, businesses and suppliers to businesses and government whose services are increasingly being exploited by terrorists and other bad actors.</p><p><strong>Your business is under attack every day!</strong></p><p>Gen. Nakasone goes on in his article to speak very specifically about the various challenges and aspects of sharing risk and intelligence information across U.S. Intelligence Agencies. His perspectives remind me of the challenges of engaging in risk and threat dialogs within a business as a security officer. You are acutely aware of risks and threats to your business.<strong> Yet in the crush of business as usual you may not or do not have the attention of your leadership peers</strong> concerning the knowledge and intelligence you possess concerning the risk and threats your business faces.</p><p>It has been my experience that my greatest challenge has always been keeping the attention of my peers focused on the things that would harm our business. I am not speaking about the mundane operational tasks and activities of cybersecurity. I am speaking about the real risks <strong>–High Impact High Probability risks, </strong>the <strong>multiplicative effects of Low Impact High Probability risks,</strong> and actual unfolding attacks.</p><p>Why is this such a challenge? We are bombarded with bad news from all corners of online and traditional news and media every day. With most of the online news being sensationalized for clicks, it is hard for our peers to avoid being influenced into not knowing what to pay attention to or not to pay attention to. So why should they pay attention to you?</p><p>Let’s use an example:</p><p><strong>February 07, 2024: Cybersecurity &amp; Infrastructure Security Agency Advisory PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure Alert Code: AA24-038A</strong></p><p>The U.S. authoring agencies have confirmed that Volt Typhoon has compromised the IT environments of multiple critical infrastructure organizations—primarily in <a style=\"padding:0;\" href=\"https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/communications-sector\">Communications</a>,<a style=\"padding:0;\" href=\"https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/energy-sector\">Energy</a>,<a style=\"padding:0;\" href=\"https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/transportation-systems-sector\">Transportation Systems</a>,and <a style=\"padding:0;\" href=\"https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/water-and-wastewater-sector\">Water and Wastewater Systems Sectors</a>— in the continental and non-continental United States and its territories, including Guam. Volt Typhoon’s choice of targets and pattern of behavior is not consistent with traditional cyber espionage or intelligence gathering operations, and the U.S. authoring agencies assess with high confidence that Volt Typhoon actors are pre-positioning themselves on IT networks to enable lateral movement to OT assets to disrupt functions. The U.S. authoring agencies are concerned about the potential for these actors to use their network access for disruptive effects in the event of potential geopolitical tensions and/or military conflicts.</p><p>This is not fake news! This is real. The implications of this are staggering. China / Volt Typhoon is already pre-positioned inside these critical infrastructure Complex Digital Systems! This is not about defending against an attack. The attack has already happened. You may look at the list of critical infrastructure sectors above and say to yourself that you are not in those business sectors. Rest assured, though, that you will be dramatically impacted by any attack in any of these sectors.</p><p>I pray that the organizations penetrated and impacted are taking all appropriate actions to deal with this.</p><p>Now to make my closing point today. This amazing CISA Alert was in the major news feeds for one day. It was reported and reposted by many on Linked-In for a second day. I have seen no other posts after that, no continuing dialog, no follow up news articles. <strong>Creeping Normality strikes again.</strong> We have become so used to hearing about cybersecurity threats, breaches, data loss, etc., that the importance of such risk and threat intelligence is glossed over. This example forces me to ask this question: <strong>Has any senior leadership executive in your organization reached out to ask you about this (CISA Advisory Alert Code: AA24-038A)?</strong></p><p><strong>or</strong></p><p><strong>Have you reached out to any senior leadership executive in your organization to advise them about the ramification of this (CISA Advisory Alert Code: AA24-038A) to your organization?</strong></p><p>I am not in any way suggesting that you need to take any specific action at or within your business because of this CISA Advisory Alert. Only you would know if you should be communicating with your senior leadership about this. In the words of Gen. Nakasone, if you should be in dialog with your senior leadership about this cybersecurity intelligence <em>“failure to do so would be a self-inflicted wound of the highest order.”</em></p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,85,565,'en',0,'<p>Last month I closed my post by saying that in my next series of posts, I will endeavor to explore with you the exploding Global Risk Ecosystem which threatens our businesses today and into the future, and to help you self-assess as you ask your organization the following question:</p><p><strong>Do you and your business have the ability to anticipate, prepare for, and adapt to changing conditions to withstand, respond to, and recover from a Cyber Business Disruption?</strong></p><p>I will begin this series of posts with a quote from a recent an Opinion article published in the Washington Post on February 14, 2024:</p><blockquote><p><strong>“At this moment, … the United States faces escalating threats posed by China, Russia, Iran, foreign cartels, sophisticated hackers, WMD proliferators, spies, terrorists and more …”.</strong> Gen. Paul M. Nakasone</p></blockquote><p>(Article:<em> I was head of the NSA. In a world of threats, this is my biggest worry.</em> By Paul M. Nakasone, February 14, 2024, published in the Washington Post. General Paul M. Nakasone was commander of the U.S Cyber Command, Director of the national Security Agency and chief of the Central Security Service until February 2nd, 2024.)</p><p>Gen. Nakasone goes on in his article to speak about what remains his biggest worry concerning these continuing and escalating threats. He worries that we <strong>“make ourselves blind to external threats”</strong> by not sharing and connecting the dots of knowledge and intelligence we have available to prevent and block attacks. He continues to share his views on how we need to continue to work across and with all aspects of government, technology companies, businesses and suppliers to businesses and government whose services are increasingly being exploited by terrorists and other bad actors.</p><p><strong>Your business is under attack every day!</strong></p><p>Gen. Nakasone goes on in his article to speak very specifically about the various challenges and aspects of sharing risk and intelligence information across U.S. Intelligence Agencies. His perspectives remind me of the challenges of engaging in risk and threat dialogs within a business as a security officer. You are acutely aware of risks and threats to your business.<strong> Yet in the crush of business as usual you may not or do not have the attention of your leadership peers</strong> concerning the knowledge and intelligence you possess concerning the risk and threats your business faces.</p><p>It has been my experience that my greatest challenge has always been keeping the attention of my peers focused on the things that would harm our business. I am not speaking about the mundane operational tasks and activities of cybersecurity. I am speaking about the real risks <strong>–High Impact High Probability risks, </strong>the <strong>multiplicative effects of Low Impact High Probability risks,</strong> and actual unfolding attacks.</p><p>Why is this such a challenge? We are bombarded with bad news from all corners of online and traditional news and media every day. With most of the online news being sensationalized for clicks, it is hard for our peers to avoid being influenced into not knowing what to pay attention to or not to pay attention to. So why should they pay attention to you?</p><p>Let’s use an example:</p><p><strong>February 07, 2024: Cybersecurity &amp; Infrastructure Security Agency Advisory PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure Alert Code: AA24-038A</strong></p><p>The U.S. authoring agencies have confirmed that Volt Typhoon has compromised the IT environments of multiple critical infrastructure organizations—primarily in <a style=\"padding:0;\" href=\"https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/communications-sector\">Communications</a>,<a style=\"padding:0;\" href=\"https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/energy-sector\">Energy</a>,<a style=\"padding:0;\" href=\"https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/transportation-systems-sector\">Transportation Systems</a>,and <a style=\"padding:0;\" href=\"https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/water-and-wastewater-sector\">Water and Wastewater Systems Sectors</a>— in the continental and non-continental United States and its territories, including Guam. Volt Typhoon’s choice of targets and pattern of behavior is not consistent with traditional cyber espionage or intelligence gathering operations, and the U.S. authoring agencies assess with high confidence that Volt Typhoon actors are pre-positioning themselves on IT networks to enable lateral movement to OT assets to disrupt functions. The U.S. authoring agencies are concerned about the potential for these actors to use their network access for disruptive effects in the event of potential geopolitical tensions and/or military conflicts.</p><p>This is not fake news! This is real. The implications of this are staggering. China / Volt Typhoon is already pre-positioned inside these critical infrastructure Complex Digital Systems! This is not about defending against an attack. The attack has already happened. You may look at the list of critical infrastructure sectors above and say to yourself that you are not in those business sectors. Rest assured, though, that you will be dramatically impacted by any attack in any of these sectors.</p><p>I pray that the organizations penetrated and impacted are taking all appropriate actions to deal with this.</p><p>Now to make my closing point today. This amazing CISA Alert was in the major news feeds for one day. It was reported and reposted by many on Linked-In for a second day. I have seen no other posts after that, no continuing dialog, no follow up news articles. <strong>Creeping Normality strikes again.</strong> We have become so used to hearing about cybersecurity threats, breaches, data loss, etc., that the importance of such risk and threat intelligence is glossed over. This example forces me to ask this question: <strong>Has any senior leadership executive in your organization reached out to ask you about this (CISA Advisory Alert Code: AA24-038A)?</strong></p><p><strong>or</strong></p><p><strong>Have you reached out to any senior leadership executive in your organization to advise them about the ramification of this (CISA Advisory Alert Code: AA24-038A) to your organization?</strong></p><p>I am not in any way suggesting that you need to take any specific action at or within your business because of this CISA Advisory Alert. Only you would know if you should be communicating with your senior leadership about this. In the words of Gen. Nakasone, if you should be in dialog with your senior leadership about this cybersecurity intelligence <em>“failure to do so would be a self-inflicted wound of the highest order.”</em></p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,85,640,'en',0,'<p>Last month I closed my post by saying that in my next series of posts, I will endeavor to explore with you the exploding Global Risk Ecosystem which threatens our businesses today and into the future, and to help you self-assess as you ask your organization the following question:</p><p><strong>Do you and your business have the ability to anticipate, prepare for, and adapt to changing conditions to withstand, respond to, and recover from a Cyber Business Disruption?</strong></p><p>I will begin this series of posts with a quote from a recent an Opinion article published in the Washington Post on February 14, 2024:</p><blockquote><p><strong>“At this moment, … the United States faces escalating threats posed by China, Russia, Iran, foreign cartels, sophisticated hackers, WMD proliferators, spies, terrorists and more …”.</strong> Gen. Paul M. Nakasone</p></blockquote><p>(Article:<em> I was head of the NSA. In a world of threats, this is my biggest worry.</em> By Paul M. Nakasone, February 14, 2024, published in the Washington Post. General Paul M. Nakasone was commander of the U.S Cyber Command, Director of the national Security Agency and chief of the Central Security Service until February 2nd, 2024.)</p><p>Gen. Nakasone goes on in his article to speak about what remains his biggest worry concerning these continuing and escalating threats. He worries that we <strong>“make ourselves blind to external threats”</strong> by not sharing and connecting the dots of knowledge and intelligence we have available to prevent and block attacks. He continues to share his views on how we need to continue to work across and with all aspects of government, technology companies, businesses and suppliers to businesses and government whose services are increasingly being exploited by terrorists and other bad actors.</p><p><strong>Your business is under attack every day!</strong></p><p>Gen. Nakasone goes on in his article to speak very specifically about the various challenges and aspects of sharing risk and intelligence information across U.S. Intelligence Agencies. His perspectives remind me of the challenges of engaging in risk and threat dialogs within a business as a security officer. You are acutely aware of risks and threats to your business.<strong> Yet in the crush of business as usual you may not or do not have the attention of your leadership peers</strong> concerning the knowledge and intelligence you possess concerning the risk and threats your business faces.</p><p>It has been my experience that my greatest challenge has always been keeping the attention of my peers focused on the things that would harm our business. I am not speaking about the mundane operational tasks and activities of cybersecurity. I am speaking about the real risks <strong>–High Impact High Probability risks, </strong>the <strong>multiplicative effects of Low Impact High Probability risks,</strong> and actual unfolding attacks.</p><p>Why is this such a challenge? We are bombarded with bad news from all corners of online and traditional news and media every day. With most of the online news being sensationalized for clicks, it is hard for our peers to avoid being influenced into not knowing what to pay attention to or not to pay attention to. So why should they pay attention to you?</p><p>Let’s use an example:</p><p><strong>February 07, 2024: Cybersecurity &amp; Infrastructure Security Agency Advisory PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure Alert Code: AA24-038A</strong></p><p>The U.S. authoring agencies have confirmed that Volt Typhoon has compromised the IT environments of multiple critical infrastructure organizations—primarily in <a style=\"padding:0;\" href=\"https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/communications-sector\">Communications</a>,<a style=\"padding:0;\" href=\"https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/energy-sector\">Energy</a>,<a style=\"padding:0;\" href=\"https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/transportation-systems-sector\">Transportation Systems</a>,and <a style=\"padding:0;\" href=\"https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/water-and-wastewater-sector\">Water and Wastewater Systems Sectors</a>— in the continental and non-continental United States and its territories, including Guam. Volt Typhoon’s choice of targets and pattern of behavior is not consistent with traditional cyber espionage or intelligence gathering operations, and the U.S. authoring agencies assess with high confidence that Volt Typhoon actors are pre-positioning themselves on IT networks to enable lateral movement to OT assets to disrupt functions. The U.S. authoring agencies are concerned about the potential for these actors to use their network access for disruptive effects in the event of potential geopolitical tensions and/or military conflicts.</p><p>This is not fake news! This is real. The implications of this are staggering. China / Volt Typhoon is already pre-positioned inside these critical infrastructure Complex Digital Systems! This is not about defending against an attack. The attack has already happened. You may look at the list of critical infrastructure sectors above and say to yourself that you are not in those business sectors. Rest assured, though, that you will be dramatically impacted by any attack in any of these sectors.</p><p>I pray that the organizations penetrated and impacted are taking all appropriate actions to deal with this.</p><p>Now to make my closing point today. This amazing CISA Alert was in the major news feeds for one day. It was reported and reposted by many on Linked-In for a second day. I have seen no other posts after that, no continuing dialog, no follow up news articles. <strong>Creeping Normality strikes again.</strong> We have become so used to hearing about cybersecurity threats, breaches, data loss, etc., that the importance of such risk and threat intelligence is glossed over. This example forces me to ask this question: <strong>Has any senior leadership executive in your organization reached out to ask you about this (CISA Advisory Alert Code: AA24-038A)?</strong></p><p><strong>or</strong></p><p><strong>Have you reached out to any senior leadership executive in your organization to advise them about the ramification of this (CISA Advisory Alert Code: AA24-038A) to your organization?</strong></p><p>I am not in any way suggesting that you need to take any specific action at or within your business because of this CISA Advisory Alert. Only you would know if you should be communicating with your senior leadership about this. In the words of Gen. Nakasone, if you should be in dialog with your senior leadership about this cybersecurity intelligence <em>“failure to do so would be a self-inflicted wound of the highest order.”</em></p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,86,215,'en',0,'<p>I am going to begin this blog post with a provocative statement:</p><p>From a security perspective, the public internet is the weakest cybersecurity component of your business operations. <strong>It is literally the superhighway runway from which Cybersecurity attacks are launched.</strong></p><p>Now that I have your attention, let me return to my primary question for you last month:</p><p><strong>Do you and your business have the ability to anticipate, prepare for, and adapt to changing conditions to withstand, respond to, and recover from a Cyber Business Disruption?</strong></p><p>We often think of business disruptions as specific to our own company, firm, or organization. We seldom include risk assessments for the world at large. This has perplexed me for years. The reason this has perplexed me is our dependence upon the Internet as the backbone of our business operations. No local, regional, or global business operates today without relying upon the ubiquitous digital communication connectivity of the Internet.</p><p>Let me update and add to this post my question concerning your ability to withstand, respond to, and recover from a Cyber Business Disruption to:</p><p><strong>Do you and your business have the ability to anticipate, prepare for, and adapt to changing conditions to withstand, respond to, and recover from any disruption to your access or use of the Internet?</strong></p><p><strong>or more bluntly&nbsp;</strong></p><p><strong>Can you conduct business operations without the Internet?</strong></p><p>I have been acutely aware of the risks of operating commercial business operations with a reliance on the use of the public Internet since the 1990’s. It is pervasively risky! As Kevin Roose recently wrote in his NYTimes article <em>“Did One Guy Just Stop a Huge Cyberattack?</em></p><p><em>The internet, as anyone who works deep in its trenches will tell you, is not a smooth, well-oiled machine.</em></p><p><em>The internet, as anyone who works deep in its trenches will tell you, is not a smooth, well-oiled machine. It’s a messy patchwork that has been assembled over decades and is held together with the digital equivalent of Scotch tape and bubble gum. Much of it relies on open-source software that is thanklessly maintained by a small army of volunteer programmers who fix the bugs, patch the holes, and ensure the whole rickety contraption, which is responsible for trillions of dollars in global G.D.P., keeps chugging along.</em></p><p>In this article, Kevin Roose goes on to describe the nature of the Internet and World Wide Web and how it is a globally distributed network comprising many voluntarily interconnected autonomous networks. There is no central governing body. There is no central maintenance organization. Each component network sets and enforces its own policies without coordination with the whole. Yes, the Internet Engineering Task Force (IETF) oversees the Internet protocols, and the Internet Society that oversees the IETF, and the Internet Consortium for Assigned Names and Numbers (ICANN) controls the DNS hierarchy and the allocation of Internet Protocol (IP) addresses. Yes, the larger Internet Service Providers (ISPs) own and provide the largest parts of the Internet infrastructure, but … there are thousands of ISPs around the world (Note: IBIS World research indicates that there are 27,978 Global ISP businesses as of 2024), and the IETF / Internet Society and ICANN do not manage the physical manifestation of the Internet. The Internet backbone is physically owned by the various commercial, educational, government and military entities around the world who implement their networks and interconnections. <strong>The Internet is the most complex of digital environments, representing the highest level of systemic digital risk which your business organization faces every day.</strong></p><p>From a security perspective, the public Internet and your digital communication connections to it are the weakest cybersecurity component of your business operations.<strong> It is literally the superhighway runway from which Cybersecurity attacks are launched.</strong></p><p>This is why the foundations of Cybersecurity, and your awareness and specific knowledge of your organization’s Cyber Insecurity is so important. The Yang of the Internet is that it enables global digital commerce. The Yin of the Internet is that it enables and facilitates cybersecurity attacks.</p><p>Closing question for today:</p><p><strong>When you brief your senior Executive Leadership Team and Boad of Directors about Cybersecurity Risk, do you highlight that the Internet and your digital connections to it are the weakest cybersecurity component of your business operations?</strong></p><p>&nbsp;</p><p>In my upcoming posts I hope to share perspectives on the importance of protecting your Internet Connection Perimeter, Enterprise Critical Event Response as an Enterprise Process, and SEC Cybersecurity Incident Materiality determination and reporting.</p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,86,236,'en',0,'<p>I am going to begin this blog post with a provocative statement:</p><p>From a security perspective, the public internet is the weakest cybersecurity component of your business operations. <strong>It is literally the superhighway runway from which Cybersecurity attacks are launched.</strong></p><p>Now that I have your attention, let me return to my primary question for you last month:</p><p><strong>Do you and your business have the ability to anticipate, prepare for, and adapt to changing conditions to withstand, respond to, and recover from a Cyber Business Disruption?</strong></p><p>We often think of business disruptions as specific to our own company, firm, or organization. We seldom include risk assessments for the world at large. This has perplexed me for years. The reason this has perplexed me is our dependence upon the Internet as the backbone of our business operations. No local, regional, or global business operates today without relying upon the ubiquitous digital communication connectivity of the Internet.</p><p>Let me update and add to this post my question concerning your ability to withstand, respond to, and recover from a Cyber Business Disruption to:</p><p><strong>Do you and your business have the ability to anticipate, prepare for, and adapt to changing conditions to withstand, respond to, and recover from any disruption to your access or use of the Internet?</strong></p><p><strong>or more bluntly&nbsp;</strong></p><p><strong>Can you conduct business operations without the Internet?</strong></p><p>I have been acutely aware of the risks of operating commercial business operations with a reliance on the use of the public Internet since the 1990’s. It is pervasively risky! As Kevin Roose recently wrote in his NYTimes article <em>“Did One Guy Just Stop a Huge Cyberattack?</em></p><p><em>The internet, as anyone who works deep in its trenches will tell you, is not a smooth, well-oiled machine.</em></p><p><em>The internet, as anyone who works deep in its trenches will tell you, is not a smooth, well-oiled machine. It’s a messy patchwork that has been assembled over decades and is held together with the digital equivalent of Scotch tape and bubble gum. Much of it relies on open-source software that is thanklessly maintained by a small army of volunteer programmers who fix the bugs, patch the holes, and ensure the whole rickety contraption, which is responsible for trillions of dollars in global G.D.P., keeps chugging along.</em></p><p>In this article, Kevin Roose goes on to describe the nature of the Internet and World Wide Web and how it is a globally distributed network comprising many voluntarily interconnected autonomous networks. There is no central governing body. There is no central maintenance organization. Each component network sets and enforces its own policies without coordination with the whole. Yes, the Internet Engineering Task Force (IETF) oversees the Internet protocols, and the Internet Society that oversees the IETF, and the Internet Consortium for Assigned Names and Numbers (ICANN) controls the DNS hierarchy and the allocation of Internet Protocol (IP) addresses. Yes, the larger Internet Service Providers (ISPs) own and provide the largest parts of the Internet infrastructure, but … there are thousands of ISPs around the world (Note: IBIS World research indicates that there are 27,978 Global ISP businesses as of 2024), and the IETF / Internet Society and ICANN do not manage the physical manifestation of the Internet. The Internet backbone is physically owned by the various commercial, educational, government and military entities around the world who implement their networks and interconnections. <strong>The Internet is the most complex of digital environments, representing the highest level of systemic digital risk which your business organization faces every day.</strong></p><p>From a security perspective, the public Internet and your digital communication connections to it are the weakest cybersecurity component of your business operations.<strong> It is literally the superhighway runway from which Cybersecurity attacks are launched.</strong></p><p>This is why the foundations of Cybersecurity, and your awareness and specific knowledge of your organization’s Cyber Insecurity is so important. The Yang of the Internet is that it enables global digital commerce. The Yin of the Internet is that it enables and facilitates cybersecurity attacks.</p><p>Closing question for today:</p><p><strong>When you brief your senior Executive Leadership Team and Boad of Directors about Cybersecurity Risk, do you highlight that the Internet and your digital connections to it are the weakest cybersecurity component of your business operations?</strong></p><p>&nbsp;</p><p>In my upcoming posts I hope to share perspectives on the importance of protecting your Internet Connection Perimeter, Enterprise Critical Event Response as an Enterprise Process, and SEC Cybersecurity Incident Materiality determination and reporting.</p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,86,404,'en',0,'<p>I am going to begin this blog post with a provocative statement:</p><p>From a security perspective, the public internet is the weakest cybersecurity component of your business operations. <strong>It is literally the superhighway runway from which Cybersecurity attacks are launched.</strong></p><p>Now that I have your attention, let me return to my primary question for you last month:</p><p><strong>Do you and your business have the ability to anticipate, prepare for, and adapt to changing conditions to withstand, respond to, and recover from a Cyber Business Disruption?</strong></p><p>We often think of business disruptions as specific to our own company, firm, or organization. We seldom include risk assessments for the world at large. This has perplexed me for years. The reason this has perplexed me is our dependence upon the Internet as the backbone of our business operations. No local, regional, or global business operates today without relying upon the ubiquitous digital communication connectivity of the Internet.</p><p>Let me update and add to this post my question concerning your ability to withstand, respond to, and recover from a Cyber Business Disruption to:</p><p><strong>Do you and your business have the ability to anticipate, prepare for, and adapt to changing conditions to withstand, respond to, and recover from any disruption to your access or use of the Internet?</strong></p><p><strong>or more bluntly&nbsp;</strong></p><p><strong>Can you conduct business operations without the Internet?</strong></p><p>I have been acutely aware of the risks of operating commercial business operations with a reliance on the use of the public Internet since the 1990’s. It is pervasively risky! As Kevin Roose recently wrote in his NYTimes article <em>“Did One Guy Just Stop a Huge Cyberattack?</em></p><p><em>The internet, as anyone who works deep in its trenches will tell you, is not a smooth, well-oiled machine.</em></p><p><em>The internet, as anyone who works deep in its trenches will tell you, is not a smooth, well-oiled machine. It’s a messy patchwork that has been assembled over decades and is held together with the digital equivalent of Scotch tape and bubble gum. Much of it relies on open-source software that is thanklessly maintained by a small army of volunteer programmers who fix the bugs, patch the holes, and ensure the whole rickety contraption, which is responsible for trillions of dollars in global G.D.P., keeps chugging along.</em></p><p>In this article, Kevin Roose goes on to describe the nature of the Internet and World Wide Web and how it is a globally distributed network comprising many voluntarily interconnected autonomous networks. There is no central governing body. There is no central maintenance organization. Each component network sets and enforces its own policies without coordination with the whole. Yes, the Internet Engineering Task Force (IETF) oversees the Internet protocols, and the Internet Society that oversees the IETF, and the Internet Consortium for Assigned Names and Numbers (ICANN) controls the DNS hierarchy and the allocation of Internet Protocol (IP) addresses. Yes, the larger Internet Service Providers (ISPs) own and provide the largest parts of the Internet infrastructure, but … there are thousands of ISPs around the world (Note: IBIS World research indicates that there are 27,978 Global ISP businesses as of 2024), and the IETF / Internet Society and ICANN do not manage the physical manifestation of the Internet. The Internet backbone is physically owned by the various commercial, educational, government and military entities around the world who implement their networks and interconnections. <strong>The Internet is the most complex of digital environments, representing the highest level of systemic digital risk which your business organization faces every day.</strong></p><p>From a security perspective, the public Internet and your digital communication connections to it are the weakest cybersecurity component of your business operations.<strong> It is literally the superhighway runway from which Cybersecurity attacks are launched.</strong></p><p>This is why the foundations of Cybersecurity, and your awareness and specific knowledge of your organization’s Cyber Insecurity is so important. The Yang of the Internet is that it enables global digital commerce. The Yin of the Internet is that it enables and facilitates cybersecurity attacks.</p><p>Closing question for today:</p><p><strong>When you brief your senior Executive Leadership Team and Boad of Directors about Cybersecurity Risk, do you highlight that the Internet and your digital connections to it are the weakest cybersecurity component of your business operations?</strong></p><p>&nbsp;</p><p>In my upcoming posts I hope to share perspectives on the importance of protecting your Internet Connection Perimeter, Enterprise Critical Event Response as an Enterprise Process, and SEC Cybersecurity Incident Materiality determination and reporting.</p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,86,486,'en',0,'<p>I am going to begin this blog post with a provocative statement:</p><p>From a security perspective, the public internet is the weakest cybersecurity component of your business operations. <strong>It is literally the superhighway runway from which Cybersecurity attacks are launched.</strong></p><p>Now that I have your attention, let me return to my primary question for you last month:</p><p><strong>Do you and your business have the ability to anticipate, prepare for, and adapt to changing conditions to withstand, respond to, and recover from a Cyber Business Disruption?</strong></p><p>We often think of business disruptions as specific to our own company, firm, or organization. We seldom include risk assessments for the world at large. This has perplexed me for years. The reason this has perplexed me is our dependence upon the Internet as the backbone of our business operations. No local, regional, or global business operates today without relying upon the ubiquitous digital communication connectivity of the Internet.</p><p>Let me update and add to this post my question concerning your ability to withstand, respond to, and recover from a Cyber Business Disruption to:</p><p><strong>Do you and your business have the ability to anticipate, prepare for, and adapt to changing conditions to withstand, respond to, and recover from any disruption to your access or use of the Internet?</strong></p><p><strong>or more bluntly&nbsp;</strong></p><p><strong>Can you conduct business operations without the Internet?</strong></p><p>I have been acutely aware of the risks of operating commercial business operations with a reliance on the use of the public Internet since the 1990’s. It is pervasively risky! As Kevin Roose recently wrote in his NYTimes article <em>“Did One Guy Just Stop a Huge Cyberattack?</em></p><p><em>The internet, as anyone who works deep in its trenches will tell you, is not a smooth, well-oiled machine.</em></p><p><em>The internet, as anyone who works deep in its trenches will tell you, is not a smooth, well-oiled machine. It’s a messy patchwork that has been assembled over decades and is held together with the digital equivalent of Scotch tape and bubble gum. Much of it relies on open-source software that is thanklessly maintained by a small army of volunteer programmers who fix the bugs, patch the holes, and ensure the whole rickety contraption, which is responsible for trillions of dollars in global G.D.P., keeps chugging along.</em></p><p>In this article, Kevin Roose goes on to describe the nature of the Internet and World Wide Web and how it is a globally distributed network comprising many voluntarily interconnected autonomous networks. There is no central governing body. There is no central maintenance organization. Each component network sets and enforces its own policies without coordination with the whole. Yes, the Internet Engineering Task Force (IETF) oversees the Internet protocols, and the Internet Society that oversees the IETF, and the Internet Consortium for Assigned Names and Numbers (ICANN) controls the DNS hierarchy and the allocation of Internet Protocol (IP) addresses. Yes, the larger Internet Service Providers (ISPs) own and provide the largest parts of the Internet infrastructure, but … there are thousands of ISPs around the world (Note: IBIS World research indicates that there are 27,978 Global ISP businesses as of 2024), and the IETF / Internet Society and ICANN do not manage the physical manifestation of the Internet. The Internet backbone is physically owned by the various commercial, educational, government and military entities around the world who implement their networks and interconnections. <strong>The Internet is the most complex of digital environments, representing the highest level of systemic digital risk which your business organization faces every day.</strong></p><p>From a security perspective, the public Internet and your digital communication connections to it are the weakest cybersecurity component of your business operations.<strong> It is literally the superhighway runway from which Cybersecurity attacks are launched.</strong></p><p>This is why the foundations of Cybersecurity, and your awareness and specific knowledge of your organization’s Cyber Insecurity is so important. The Yang of the Internet is that it enables global digital commerce. The Yin of the Internet is that it enables and facilitates cybersecurity attacks.</p><p>Closing question for today:</p><p><strong>When you brief your senior Executive Leadership Team and Boad of Directors about Cybersecurity Risk, do you highlight that the Internet and your digital connections to it are the weakest cybersecurity component of your business operations?</strong></p><p>&nbsp;</p><p>In my upcoming posts I hope to share perspectives on the importance of protecting your Internet Connection Perimeter, Enterprise Critical Event Response as an Enterprise Process, and SEC Cybersecurity Incident Materiality determination and reporting.</p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,86,566,'en',0,'<p>I am going to begin this blog post with a provocative statement:</p><p>From a security perspective, the public internet is the weakest cybersecurity component of your business operations. <strong>It is literally the superhighway runway from which Cybersecurity attacks are launched.</strong></p><p>Now that I have your attention, let me return to my primary question for you last month:</p><p><strong>Do you and your business have the ability to anticipate, prepare for, and adapt to changing conditions to withstand, respond to, and recover from a Cyber Business Disruption?</strong></p><p>We often think of business disruptions as specific to our own company, firm, or organization. We seldom include risk assessments for the world at large. This has perplexed me for years. The reason this has perplexed me is our dependence upon the Internet as the backbone of our business operations. No local, regional, or global business operates today without relying upon the ubiquitous digital communication connectivity of the Internet.</p><p>Let me update and add to this post my question concerning your ability to withstand, respond to, and recover from a Cyber Business Disruption to:</p><p><strong>Do you and your business have the ability to anticipate, prepare for, and adapt to changing conditions to withstand, respond to, and recover from any disruption to your access or use of the Internet?</strong></p><p><strong>or more bluntly&nbsp;</strong></p><p><strong>Can you conduct business operations without the Internet?</strong></p><p>I have been acutely aware of the risks of operating commercial business operations with a reliance on the use of the public Internet since the 1990’s. It is pervasively risky! As Kevin Roose recently wrote in his NYTimes article <em>“Did One Guy Just Stop a Huge Cyberattack?</em></p><p><em>The internet, as anyone who works deep in its trenches will tell you, is not a smooth, well-oiled machine.</em></p><p><em>The internet, as anyone who works deep in its trenches will tell you, is not a smooth, well-oiled machine. It’s a messy patchwork that has been assembled over decades and is held together with the digital equivalent of Scotch tape and bubble gum. Much of it relies on open-source software that is thanklessly maintained by a small army of volunteer programmers who fix the bugs, patch the holes, and ensure the whole rickety contraption, which is responsible for trillions of dollars in global G.D.P., keeps chugging along.</em></p><p>In this article, Kevin Roose goes on to describe the nature of the Internet and World Wide Web and how it is a globally distributed network comprising many voluntarily interconnected autonomous networks. There is no central governing body. There is no central maintenance organization. Each component network sets and enforces its own policies without coordination with the whole. Yes, the Internet Engineering Task Force (IETF) oversees the Internet protocols, and the Internet Society that oversees the IETF, and the Internet Consortium for Assigned Names and Numbers (ICANN) controls the DNS hierarchy and the allocation of Internet Protocol (IP) addresses. Yes, the larger Internet Service Providers (ISPs) own and provide the largest parts of the Internet infrastructure, but … there are thousands of ISPs around the world (Note: IBIS World research indicates that there are 27,978 Global ISP businesses as of 2024), and the IETF / Internet Society and ICANN do not manage the physical manifestation of the Internet. The Internet backbone is physically owned by the various commercial, educational, government and military entities around the world who implement their networks and interconnections. <strong>The Internet is the most complex of digital environments, representing the highest level of systemic digital risk which your business organization faces every day.</strong></p><p>From a security perspective, the public Internet and your digital communication connections to it are the weakest cybersecurity component of your business operations.<strong> It is literally the superhighway runway from which Cybersecurity attacks are launched.</strong></p><p>This is why the foundations of Cybersecurity, and your awareness and specific knowledge of your organization’s Cyber Insecurity is so important. The Yang of the Internet is that it enables global digital commerce. The Yin of the Internet is that it enables and facilitates cybersecurity attacks.</p><p>Closing question for today:</p><p><strong>When you brief your senior Executive Leadership Team and Boad of Directors about Cybersecurity Risk, do you highlight that the Internet and your digital connections to it are the weakest cybersecurity component of your business operations?</strong></p><p>&nbsp;</p><p>In my upcoming posts I hope to share perspectives on the importance of protecting your Internet Connection Perimeter, Enterprise Critical Event Response as an Enterprise Process, and SEC Cybersecurity Incident Materiality determination and reporting.</p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,86,641,'en',0,'<p>I am going to begin this blog post with a provocative statement:</p><p>From a security perspective, the public internet is the weakest cybersecurity component of your business operations. <strong>It is literally the superhighway runway from which Cybersecurity attacks are launched.</strong></p><p>Now that I have your attention, let me return to my primary question for you last month:</p><p><strong>Do you and your business have the ability to anticipate, prepare for, and adapt to changing conditions to withstand, respond to, and recover from a Cyber Business Disruption?</strong></p><p>We often think of business disruptions as specific to our own company, firm, or organization. We seldom include risk assessments for the world at large. This has perplexed me for years. The reason this has perplexed me is our dependence upon the Internet as the backbone of our business operations. No local, regional, or global business operates today without relying upon the ubiquitous digital communication connectivity of the Internet.</p><p>Let me update and add to this post my question concerning your ability to withstand, respond to, and recover from a Cyber Business Disruption to:</p><p><strong>Do you and your business have the ability to anticipate, prepare for, and adapt to changing conditions to withstand, respond to, and recover from any disruption to your access or use of the Internet?</strong></p><p><strong>or more bluntly&nbsp;</strong></p><p><strong>Can you conduct business operations without the Internet?</strong></p><p>I have been acutely aware of the risks of operating commercial business operations with a reliance on the use of the public Internet since the 1990’s. It is pervasively risky! As Kevin Roose recently wrote in his NYTimes article <em>“Did One Guy Just Stop a Huge Cyberattack?</em></p><p><em>The internet, as anyone who works deep in its trenches will tell you, is not a smooth, well-oiled machine.</em></p><p><em>The internet, as anyone who works deep in its trenches will tell you, is not a smooth, well-oiled machine. It’s a messy patchwork that has been assembled over decades and is held together with the digital equivalent of Scotch tape and bubble gum. Much of it relies on open-source software that is thanklessly maintained by a small army of volunteer programmers who fix the bugs, patch the holes, and ensure the whole rickety contraption, which is responsible for trillions of dollars in global G.D.P., keeps chugging along.</em></p><p>In this article, Kevin Roose goes on to describe the nature of the Internet and World Wide Web and how it is a globally distributed network comprising many voluntarily interconnected autonomous networks. There is no central governing body. There is no central maintenance organization. Each component network sets and enforces its own policies without coordination with the whole. Yes, the Internet Engineering Task Force (IETF) oversees the Internet protocols, and the Internet Society that oversees the IETF, and the Internet Consortium for Assigned Names and Numbers (ICANN) controls the DNS hierarchy and the allocation of Internet Protocol (IP) addresses. Yes, the larger Internet Service Providers (ISPs) own and provide the largest parts of the Internet infrastructure, but … there are thousands of ISPs around the world (Note: IBIS World research indicates that there are 27,978 Global ISP businesses as of 2024), and the IETF / Internet Society and ICANN do not manage the physical manifestation of the Internet. The Internet backbone is physically owned by the various commercial, educational, government and military entities around the world who implement their networks and interconnections. <strong>The Internet is the most complex of digital environments, representing the highest level of systemic digital risk which your business organization faces every day.</strong></p><p>From a security perspective, the public Internet and your digital communication connections to it are the weakest cybersecurity component of your business operations.<strong> It is literally the superhighway runway from which Cybersecurity attacks are launched.</strong></p><p>This is why the foundations of Cybersecurity, and your awareness and specific knowledge of your organization’s Cyber Insecurity is so important. The Yang of the Internet is that it enables global digital commerce. The Yin of the Internet is that it enables and facilitates cybersecurity attacks.</p><p>Closing question for today:</p><p><strong>When you brief your senior Executive Leadership Team and Boad of Directors about Cybersecurity Risk, do you highlight that the Internet and your digital connections to it are the weakest cybersecurity component of your business operations?</strong></p><p>&nbsp;</p><p>In my upcoming posts I hope to share perspectives on the importance of protecting your Internet Connection Perimeter, Enterprise Critical Event Response as an Enterprise Process, and SEC Cybersecurity Incident Materiality determination and reporting.</p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,87,216,'en',0,'<p>The U.S. Cybersecurity and Infrastructure Security Agency defines “Secure by Design” to mean that technology products are built in a way that reasonably protects against malicious cyber actors successfully gaining access to devices, data, and connected infrastructure.</p><p>This is a very concise statement, with a focus on the design of technology-based systems. In the real and practical world we live in, focusing only on the security design aspects of complex digital systems or the components that complex digital systems are made of will ensure that your digital business world will be insecure.&nbsp;</p><p><strong>Security focusing only on Design aspects of Complex Systems will ensure Cyber Insecurity</strong></p><p>My personal views about Security by Design are well known by those who have worked with me or have been my clients throughout my career. Our digital systems do not stand alone as technology systems only. As soon as we deploy technology, the technology enters the realm of becoming a system, interconnecting, and interacting with other systems with which our business operates. These business systems are comprised of benevolent technology, people, and processes interconnecting our business with our customers and suppliers, as well as the shared open systems we use, such as the World Wide Web and the Internet. Unfortunately, bad actors also use the open and shared internet and World Wide Web systems with the sole purpose to compromise our business operations. So, … focusing only on the secure design of technology products is not enough to secure our Businesses by Design.</p><p><strong>Focusing only on the secure design of technology products is not enough to secure our Businesses by Design&nbsp;</strong></p><p>Securing our Business by Design requires hyper-attentiveness to the security of the complex digital systems environment of Technology, Data, Processes, and People.</p><p><img src=\"/sites/default/files/inline-images/Joe-Info.png\" data-entity-uuid=\"c51d7cb7-99e8-480c-b760-10e21822533e\" data-entity-type=\"file\" width=\"382\" height=\"374\"></p><p>By the very nature of how complex digital systems work, Security by Design requires that all aspects of security design and operations work in concert continually. Any gaps, mistakes, or lack of attentiveness by those who use, support, or operate our systems, including those responsible for oversight and assurance, will guarantee a cybersecurity compromise.</p><p><strong>Security by Design</strong></p><ul><li>Technology / Data</li><li>Technology / Process</li><li>Technology / People</li><li>People / Process</li><li>People / Data</li><li>Data / Process</li></ul><p>The February 2024 “cyberattack” triggered a shutdown of Change Health Care’s electronic medical claims processing systems, leaving doctors and other providers of medical care (pharmacies, rehabilitation facilities, etc.) without the ability to obtain insurance approval for patient services, and thus not receive payment for medical services, was a <em>failure of the People / Process / Technology aspects of Security by Design.</em> It has been reported that an absence of multi-factor authentication reportedly left a remote access application exposed. The actual bad actor access has been confirmed to have occurred using compromised user credentials via the remote access application. But I ask, is this the true or root failure in this incident?</p><p><strong>Is the lack of two-factor authentication the root cause of the Change in Health Care Cyber Attack?</strong></p><p>From my perspective, the root cause of this cybersecurity failure is found in the Process / People domain of Security by Design. This is a classic failure of people not utilizing audit/controls processes and/or using the appropriate process but not paying attention to the audit/controls information the process identified. Indeed, Change Health Care is a relatively recent acquisition of OPTUM, which is a subsidiary of United Health Care. Prior audits have reportedly highlighted the lack of two-factor authentication at Change Health Care, but this information, it seems, was not acted upon. This was highlighted by Andrew Witty, CEO of United Health Group, who testified at a U.S. Senate Finance Committee hearing examining cyber-attacks on health care and the Change Healthcare attack on May 01, 2024. The cyber-attack has become the costliest in U.S. history. Healthcare Financial Management Association, the auditor for financial analysis of the losses, so far is reporting an expected $6.87 billion in total losses from this breach (including equity loss, legal fees, regulatory fines, class action claims, PR expenses, notification costs, and other expenses). <strong>$6.87 Billion in Losses + nearly 1/3 of all Americans impacted!</strong></p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,87,217,'en',0,'<p>The U.S. Cybersecurity and Infrastructure Security Agency defines “Secure by Design” to mean that technology products are built in a way that reasonably protects against malicious cyber actors successfully gaining access to devices, data, and connected infrastructure.</p><p>This is a very concise statement, with a focus on the design of technology-based systems. In the real and practical world we live in, focusing only on the security design aspects of complex digital systems or the components that complex digital systems are made of will ensure that your digital business world will be insecure.&nbsp;</p><p><strong>Security focusing only on Design aspects of Complex Systems will ensure Cyber Insecurity</strong></p><p>My personal views about Security by Design are well known by those who have worked with me or have been my clients throughout my career. Our digital systems do not stand alone as technology systems only. As soon as we deploy technology, the technology enters the realm of becoming a system, interconnecting, and interacting with other systems with which our business operates. These business systems are comprised of benevolent technology, people, and processes interconnecting our business with our customers and suppliers, as well as the shared open systems we use, such as the World Wide Web and the Internet. Unfortunately, bad actors also use the open and shared internet and World Wide Web systems with the sole purpose to compromise our business operations. So, … focusing only on the secure design of technology products is not enough to secure our Businesses by Design.</p><p><strong>Focusing only on the secure design of technology products is not enough to secure our Businesses by Design&nbsp;</strong></p><p>Securing our Business by Design requires hyper-attentiveness to the security of the complex digital systems environment of Technology, Data, Processes, and People.</p><p><img src=\"/sites/default/files/inline-images/Joe-Info.png\" data-entity-uuid=\"c51d7cb7-99e8-480c-b760-10e21822533e\" data-entity-type=\"file\" width=\"382\" height=\"374\"></p><p>By the very nature of how complex digital systems work, Security by Design requires that all aspects of security design and operations work in concert continually. Any gaps, mistakes, or lack of attentiveness by those who use, support, or operate our systems, including those responsible for oversight and assurance, will guarantee a cybersecurity compromise.</p><p><strong>Security by Design</strong></p><ul><li>Technology / Data</li><li>Technology / Process</li><li>Technology / People</li><li>People / Process</li><li>People / Data</li><li>Data / Process</li></ul><p>&nbsp;</p><p>The February 2024 “cyberattack” triggered a shutdown of Change Health Care’s electronic medical claims processing systems, leaving doctors and other providers of medical care (pharmacies, rehabilitation facilities, etc.) without the ability to obtain insurance approval for patient services, and thus not receive payment for medical services, was a <em>failure of the People / Process / Technology aspects of Security by Design.</em> It has been reported that an absence of multi-factor authentication reportedly left a remote access application exposed. The actual bad actor access has been confirmed to have occurred using compromised user credentials via the remote access application. But I ask, is this the true or root failure in this incident?</p><p><strong>Is the lack of two-factor authentication the root cause of the Change in Health Care Cyber Attack?</strong></p><p>From my perspective, the root cause of this cybersecurity failure is found in the Process / People domain of Security by Design. This is a classic failure of people not utilizing audit/controls processes and/or using the appropriate process but not paying attention to the audit/controls information the process identified. Indeed, Change Health Care is a relatively recent acquisition of OPTUM, which is a subsidiary of United Health Care. Prior audits have reportedly highlighted the lack of two-factor authentication at Change Health Care, but this information, it seems, was not acted upon. This was highlighted by Andrew Witty, CEO of United Health Group, who testified at a U.S. Senate Finance Committee hearing examining cyber-attacks on health care and the Change Healthcare attack on May 01, 2024. The cyber-attack has become the costliest in U.S. history. Healthcare Financial Management Association, the auditor for financial analysis of the losses, so far is reporting an expected $6.87 billion in total losses from this breach (including equity loss, legal fees, regulatory fines, class action claims, PR expenses, notification costs, and other expenses). <strong>$6.87 Billion in Losses + nearly 1/3 of all Americans impacted!</strong></p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,87,235,'en',0,'<p>The U.S. Cybersecurity and Infrastructure Security Agency defines “Secure by Design” to mean that technology products are built in a way that reasonably protects against malicious cyber actors successfully gaining access to devices, data, and connected infrastructure.</p><p>This is a very concise statement, with a focus on the design of technology-based systems. In the real and practical world we live in, focusing only on the security design aspects of complex digital systems or the components that complex digital systems are made of will ensure that your digital business world will be insecure.&nbsp;</p><p><strong>Security focusing only on Design aspects of Complex Systems will ensure Cyber Insecurity</strong></p><p>My personal views about Security by Design are well known by those who have worked with me or have been my clients throughout my career. Our digital systems do not stand alone as technology systems only. As soon as we deploy technology, the technology enters the realm of becoming a system, interconnecting, and interacting with other systems with which our business operates. These business systems are comprised of benevolent technology, people, and processes interconnecting our business with our customers and suppliers, as well as the shared open systems we use, such as the World Wide Web and the Internet. Unfortunately, bad actors also use the open and shared internet and World Wide Web systems with the sole purpose to compromise our business operations. So, … focusing only on the secure design of technology products is not enough to secure our Businesses by Design.</p><p><strong>Focusing only on the secure design of technology products is not enough to secure our Businesses by Design&nbsp;</strong></p><p>Securing our Business by Design requires hyper-attentiveness to the security of the complex digital systems environment of Technology, Data, Processes, and People.</p><p><img src=\"/sites/default/files/inline-images/Joe-Info.png\" data-entity-uuid=\"c51d7cb7-99e8-480c-b760-10e21822533e\" data-entity-type=\"file\" width=\"382\" height=\"374\"></p><p>By the very nature of how complex digital systems work, Security by Design requires that all aspects of security design and operations work in concert continually. Any gaps, mistakes, or lack of attentiveness by those who use, support, or operate our systems, including those responsible for oversight and assurance, will guarantee a cybersecurity compromise.</p><p><strong>Security by Design</strong></p><ul><li>Technology / Data</li><li>Technology / Process</li><li>Technology / People</li><li>People / Process</li><li>People / Data</li><li>Data / Process</li></ul><p>&nbsp;</p><p>The February 2024 “cyberattack” triggered a shutdown of Change Health Care’s electronic medical claims processing systems, leaving doctors and other providers of medical care (pharmacies, rehabilitation facilities, etc.) without the ability to obtain insurance approval for patient services, and thus not receive payment for medical services, was a <em>failure of the People / Process / Technology aspects of Security by Design.</em> It has been reported that an absence of multi-factor authentication reportedly left a remote access application exposed. The actual bad actor access has been confirmed to have occurred using compromised user credentials via the remote access application. But I ask, is this the true or root failure in this incident?</p><p><strong>Is the lack of two-factor authentication the root cause of the Change in Health Care Cyber Attack?</strong></p><p>From my perspective, the root cause of this cybersecurity failure is found in the Process / People domain of Security by Design. This is a classic failure of people not utilizing audit/controls processes and/or using the appropriate process but not paying attention to the audit/controls information the process identified. Indeed, Change Health Care is a relatively recent acquisition of OPTUM, which is a subsidiary of United Health Care. Prior audits have reportedly highlighted the lack of two-factor authentication at Change Health Care, but this information, it seems, was not acted upon. This was highlighted by Andrew Witty, CEO of United Health Group, who testified at a U.S. Senate Finance Committee hearing examining cyber-attacks on health care and the Change Healthcare attack on May 01, 2024. The cyber-attack has become the costliest in U.S. history. Healthcare Financial Management Association, the auditor for financial analysis of the losses, so far is reporting an expected $6.87 billion in total losses from this breach (including equity loss, legal fees, regulatory fines, class action claims, PR expenses, notification costs, and other expenses). <strong>$6.87 Billion in Losses + nearly 1/3 of all Americans impacted!</strong></p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,87,405,'en',0,'<p>The U.S. Cybersecurity and Infrastructure Security Agency defines “Secure by Design” to mean that technology products are built in a way that reasonably protects against malicious cyber actors successfully gaining access to devices, data, and connected infrastructure.</p><p>This is a very concise statement, with a focus on the design of technology-based systems. In the real and practical world we live in, focusing only on the security design aspects of complex digital systems or the components that complex digital systems are made of will ensure that your digital business world will be insecure.&nbsp;</p><p><strong>Security focusing only on Design aspects of Complex Systems will ensure Cyber Insecurity</strong></p><p>My personal views about Security by Design are well known by those who have worked with me or have been my clients throughout my career. Our digital systems do not stand alone as technology systems only. As soon as we deploy technology, the technology enters the realm of becoming a system, interconnecting, and interacting with other systems with which our business operates. These business systems are comprised of benevolent technology, people, and processes interconnecting our business with our customers and suppliers, as well as the shared open systems we use, such as the World Wide Web and the Internet. Unfortunately, bad actors also use the open and shared internet and World Wide Web systems with the sole purpose to compromise our business operations. So, … focusing only on the secure design of technology products is not enough to secure our Businesses by Design.</p><p><strong>Focusing only on the secure design of technology products is not enough to secure our Businesses by Design&nbsp;</strong></p><p>Securing our Business by Design requires hyper-attentiveness to the security of the complex digital systems environment of Technology, Data, Processes, and People.</p><p><img src=\"/sites/default/files/inline-images/Joe-Info.png\" data-entity-uuid=\"c51d7cb7-99e8-480c-b760-10e21822533e\" data-entity-type=\"file\" width=\"382\" height=\"374\"></p><p>By the very nature of how complex digital systems work, Security by Design requires that all aspects of security design and operations work in concert continually. Any gaps, mistakes, or lack of attentiveness by those who use, support, or operate our systems, including those responsible for oversight and assurance, will guarantee a cybersecurity compromise.</p><p><strong>Security by Design</strong></p><ul><li>Technology / Data</li><li>Technology / Process</li><li>Technology / People</li><li>People / Process</li><li>People / Data</li><li>Data / Process</li></ul><p>&nbsp;</p><p>The February 2024 “cyberattack” triggered a shutdown of Change Health Care’s electronic medical claims processing systems, leaving doctors and other providers of medical care (pharmacies, rehabilitation facilities, etc.) without the ability to obtain insurance approval for patient services, and thus not receive payment for medical services, was a <em>failure of the People / Process / Technology aspects of Security by Design.</em> It has been reported that an absence of multi-factor authentication reportedly left a remote access application exposed. The actual bad actor access has been confirmed to have occurred using compromised user credentials via the remote access application. But I ask, is this the true or root failure in this incident?</p><p><strong>Is the lack of two-factor authentication the root cause of the Change in Health Care Cyber Attack?</strong></p><p>From my perspective, the root cause of this cybersecurity failure is found in the Process / People domain of Security by Design. This is a classic failure of people not utilizing audit/controls processes and/or using the appropriate process but not paying attention to the audit/controls information the process identified. Indeed, Change Health Care is a relatively recent acquisition of OPTUM, which is a subsidiary of United Health Care. Prior audits have reportedly highlighted the lack of two-factor authentication at Change Health Care, but this information, it seems, was not acted upon. This was highlighted by Andrew Witty, CEO of United Health Group, who testified at a U.S. Senate Finance Committee hearing examining cyber-attacks on health care and the Change Healthcare attack on May 01, 2024. The cyber-attack has become the costliest in U.S. history. Healthcare Financial Management Association, the auditor for financial analysis of the losses, so far is reporting an expected $6.87 billion in total losses from this breach (including equity loss, legal fees, regulatory fines, class action claims, PR expenses, notification costs, and other expenses). <strong>$6.87 Billion in Losses + nearly 1/3 of all Americans impacted!</strong></p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,87,487,'en',0,'<p>The U.S. Cybersecurity and Infrastructure Security Agency defines “Secure by Design” to mean that technology products are built in a way that reasonably protects against malicious cyber actors successfully gaining access to devices, data, and connected infrastructure.</p><p>This is a very concise statement, with a focus on the design of technology-based systems. In the real and practical world we live in, focusing only on the security design aspects of complex digital systems or the components that complex digital systems are made of will ensure that your digital business world will be insecure.&nbsp;</p><p><strong>Security focusing only on Design aspects of Complex Systems will ensure Cyber Insecurity</strong></p><p>My personal views about Security by Design are well known by those who have worked with me or have been my clients throughout my career. Our digital systems do not stand alone as technology systems only. As soon as we deploy technology, the technology enters the realm of becoming a system, interconnecting, and interacting with other systems with which our business operates. These business systems are comprised of benevolent technology, people, and processes interconnecting our business with our customers and suppliers, as well as the shared open systems we use, such as the World Wide Web and the Internet. Unfortunately, bad actors also use the open and shared internet and World Wide Web systems with the sole purpose to compromise our business operations. So, … focusing only on the secure design of technology products is not enough to secure our Businesses by Design.</p><p><strong>Focusing only on the secure design of technology products is not enough to secure our Businesses by Design&nbsp;</strong></p><p>Securing our Business by Design requires hyper-attentiveness to the security of the complex digital systems environment of Technology, Data, Processes, and People.</p><p><img src=\"/sites/default/files/inline-images/Joe-Info.png\" data-entity-uuid=\"c51d7cb7-99e8-480c-b760-10e21822533e\" data-entity-type=\"file\" width=\"382\" height=\"374\"></p><p>By the very nature of how complex digital systems work, Security by Design requires that all aspects of security design and operations work in concert continually. Any gaps, mistakes, or lack of attentiveness by those who use, support, or operate our systems, including those responsible for oversight and assurance, will guarantee a cybersecurity compromise.</p><p><strong>Security by Design</strong></p><ul><li>Technology / Data</li><li>Technology / Process</li><li>Technology / People</li><li>People / Process</li><li>People / Data</li><li>Data / Process</li></ul><p>&nbsp;</p><p>The February 2024 “cyberattack” triggered a shutdown of Change Health Care’s electronic medical claims processing systems, leaving doctors and other providers of medical care (pharmacies, rehabilitation facilities, etc.) without the ability to obtain insurance approval for patient services, and thus not receive payment for medical services, was a <em>failure of the People / Process / Technology aspects of Security by Design.</em> It has been reported that an absence of multi-factor authentication reportedly left a remote access application exposed. The actual bad actor access has been confirmed to have occurred using compromised user credentials via the remote access application. But I ask, is this the true or root failure in this incident?</p><p><strong>Is the lack of two-factor authentication the root cause of the Change in Health Care Cyber Attack?</strong></p><p>From my perspective, the root cause of this cybersecurity failure is found in the Process / People domain of Security by Design. This is a classic failure of people not utilizing audit/controls processes and/or using the appropriate process but not paying attention to the audit/controls information the process identified. Indeed, Change Health Care is a relatively recent acquisition of OPTUM, which is a subsidiary of United Health Care. Prior audits have reportedly highlighted the lack of two-factor authentication at Change Health Care, but this information, it seems, was not acted upon. This was highlighted by Andrew Witty, CEO of United Health Group, who testified at a U.S. Senate Finance Committee hearing examining cyber-attacks on health care and the Change Healthcare attack on May 01, 2024. The cyber-attack has become the costliest in U.S. history. Healthcare Financial Management Association, the auditor for financial analysis of the losses, so far is reporting an expected $6.87 billion in total losses from this breach (including equity loss, legal fees, regulatory fines, class action claims, PR expenses, notification costs, and other expenses). <strong>$6.87 Billion in Losses + nearly 1/3 of all Americans impacted!</strong></p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,87,567,'en',0,'<p>The U.S. Cybersecurity and Infrastructure Security Agency defines “Secure by Design” to mean that technology products are built in a way that reasonably protects against malicious cyber actors successfully gaining access to devices, data, and connected infrastructure.</p><p>This is a very concise statement, with a focus on the design of technology-based systems. In the real and practical world we live in, focusing only on the security design aspects of complex digital systems or the components that complex digital systems are made of will ensure that your digital business world will be insecure.&nbsp;</p><p><strong>Security focusing only on Design aspects of Complex Systems will ensure Cyber Insecurity</strong></p><p>My personal views about Security by Design are well known by those who have worked with me or have been my clients throughout my career. Our digital systems do not stand alone as technology systems only. As soon as we deploy technology, the technology enters the realm of becoming a system, interconnecting, and interacting with other systems with which our business operates. These business systems are comprised of benevolent technology, people, and processes interconnecting our business with our customers and suppliers, as well as the shared open systems we use, such as the World Wide Web and the Internet. Unfortunately, bad actors also use the open and shared internet and World Wide Web systems with the sole purpose to compromise our business operations. So, … focusing only on the secure design of technology products is not enough to secure our Businesses by Design.</p><p><strong>Focusing only on the secure design of technology products is not enough to secure our Businesses by Design&nbsp;</strong></p><p>Securing our Business by Design requires hyper-attentiveness to the security of the complex digital systems environment of Technology, Data, Processes, and People.</p><p><img src=\"/sites/default/files/inline-images/Joe-Info.png\" data-entity-uuid=\"c51d7cb7-99e8-480c-b760-10e21822533e\" data-entity-type=\"file\" width=\"382\" height=\"374\"></p><p>By the very nature of how complex digital systems work, Security by Design requires that all aspects of security design and operations work in concert continually. Any gaps, mistakes, or lack of attentiveness by those who use, support, or operate our systems, including those responsible for oversight and assurance, will guarantee a cybersecurity compromise.</p><p><strong>Security by Design</strong></p><ul><li>Technology / Data</li><li>Technology / Process</li><li>Technology / People</li><li>People / Process</li><li>People / Data</li><li>Data / Process</li></ul><p>&nbsp;</p><p>The February 2024 “cyberattack” triggered a shutdown of Change Health Care’s electronic medical claims processing systems, leaving doctors and other providers of medical care (pharmacies, rehabilitation facilities, etc.) without the ability to obtain insurance approval for patient services, and thus not receive payment for medical services, was a <em>failure of the People / Process / Technology aspects of Security by Design.</em> It has been reported that an absence of multi-factor authentication reportedly left a remote access application exposed. The actual bad actor access has been confirmed to have occurred using compromised user credentials via the remote access application. But I ask, is this the true or root failure in this incident?</p><p><strong>Is the lack of two-factor authentication the root cause of the Change in Health Care Cyber Attack?</strong></p><p>From my perspective, the root cause of this cybersecurity failure is found in the Process / People domain of Security by Design. This is a classic failure of people not utilizing audit/controls processes and/or using the appropriate process but not paying attention to the audit/controls information the process identified. Indeed, Change Health Care is a relatively recent acquisition of OPTUM, which is a subsidiary of United Health Care. Prior audits have reportedly highlighted the lack of two-factor authentication at Change Health Care, but this information, it seems, was not acted upon. This was highlighted by Andrew Witty, CEO of United Health Group, who testified at a U.S. Senate Finance Committee hearing examining cyber-attacks on health care and the Change Healthcare attack on May 01, 2024. The cyber-attack has become the costliest in U.S. history. Healthcare Financial Management Association, the auditor for financial analysis of the losses, so far is reporting an expected $6.87 billion in total losses from this breach (including equity loss, legal fees, regulatory fines, class action claims, PR expenses, notification costs, and other expenses). <strong>$6.87 Billion in Losses + nearly 1/3 of all Americans impacted!</strong></p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,87,642,'en',0,'<p>The U.S. Cybersecurity and Infrastructure Security Agency defines “Secure by Design” to mean that technology products are built in a way that reasonably protects against malicious cyber actors successfully gaining access to devices, data, and connected infrastructure.</p><p>This is a very concise statement, with a focus on the design of technology-based systems. In the real and practical world we live in, focusing only on the security design aspects of complex digital systems or the components that complex digital systems are made of will ensure that your digital business world will be insecure.&nbsp;</p><p><strong>Security focusing only on Design aspects of Complex Systems will ensure Cyber Insecurity</strong></p><p>My personal views about Security by Design are well known by those who have worked with me or have been my clients throughout my career. Our digital systems do not stand alone as technology systems only. As soon as we deploy technology, the technology enters the realm of becoming a system, interconnecting, and interacting with other systems with which our business operates. These business systems are comprised of benevolent technology, people, and processes interconnecting our business with our customers and suppliers, as well as the shared open systems we use, such as the World Wide Web and the Internet. Unfortunately, bad actors also use the open and shared internet and World Wide Web systems with the sole purpose to compromise our business operations. So, … focusing only on the secure design of technology products is not enough to secure our Businesses by Design.</p><p><strong>Focusing only on the secure design of technology products is not enough to secure our Businesses by Design&nbsp;</strong></p><p>Securing our Business by Design requires hyper-attentiveness to the security of the complex digital systems environment of Technology, Data, Processes, and People.</p><p><img src=\"/sites/default/files/inline-images/Joe-Info.png\" data-entity-uuid=\"c51d7cb7-99e8-480c-b760-10e21822533e\" data-entity-type=\"file\" width=\"382\" height=\"374\"></p><p>By the very nature of how complex digital systems work, Security by Design requires that all aspects of security design and operations work in concert continually. Any gaps, mistakes, or lack of attentiveness by those who use, support, or operate our systems, including those responsible for oversight and assurance, will guarantee a cybersecurity compromise.</p><p><strong>Security by Design</strong></p><ul><li>Technology / Data</li><li>Technology / Process</li><li>Technology / People</li><li>People / Process</li><li>People / Data</li><li>Data / Process</li></ul><p>&nbsp;</p><p>The February 2024 “cyberattack” triggered a shutdown of Change Health Care’s electronic medical claims processing systems, leaving doctors and other providers of medical care (pharmacies, rehabilitation facilities, etc.) without the ability to obtain insurance approval for patient services, and thus not receive payment for medical services, was a <em>failure of the People / Process / Technology aspects of Security by Design.</em> It has been reported that an absence of multi-factor authentication reportedly left a remote access application exposed. The actual bad actor access has been confirmed to have occurred using compromised user credentials via the remote access application. But I ask, is this the true or root failure in this incident?</p><p><strong>Is the lack of two-factor authentication the root cause of the Change in Health Care Cyber Attack?</strong></p><p>From my perspective, the root cause of this cybersecurity failure is found in the Process / People domain of Security by Design. This is a classic failure of people not utilizing audit/controls processes and/or using the appropriate process but not paying attention to the audit/controls information the process identified. Indeed, Change Health Care is a relatively recent acquisition of OPTUM, which is a subsidiary of United Health Care. Prior audits have reportedly highlighted the lack of two-factor authentication at Change Health Care, but this information, it seems, was not acted upon. This was highlighted by Andrew Witty, CEO of United Health Group, who testified at a U.S. Senate Finance Committee hearing examining cyber-attacks on health care and the Change Healthcare attack on May 01, 2024. The cyber-attack has become the costliest in U.S. history. Healthcare Financial Management Association, the auditor for financial analysis of the losses, so far is reporting an expected $6.87 billion in total losses from this breach (including equity loss, legal fees, regulatory fines, class action claims, PR expenses, notification costs, and other expenses). <strong>$6.87 Billion in Losses + nearly 1/3 of all Americans impacted!</strong></p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,88,218,'en',0,'<p><strong>On July 19, 2024 a Single Software Update was able to create IT Chaos Across the Entire World</strong></p><p>A faulty CrowdStrike channel file 291 software update to their Falcon End Point Threat Data file (Detection and Response endpoint device software) impacted (crashed) 9+ million computers. This created an immediate global IT outage affecting airlines, media outlets, banks, retailers and other organizations that use Microsoft Windows operating systems.</p><p><strong>“Largest IT Outage in History”</strong></p><p>The World Economic Forum is reporting this as possibly the “largest IT outage in history”, revealing the vulnerability and interconnections of <em>Complex Digital Systems</em>. This follows the continuing clean up and losses due to the Change Healthcare cyber attack which occurred on February 19th, 2024, with $6.87 billion in total losses expected (including equity loss, legal fees, regulatory fines, class action claims, PR expenses, notification costs and other expenses).</p><p>It is being reported that:&nbsp;<meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>Global Microsoft-CrowdStrike Outage Impact</title></p><ul><li>5+ million computers have been impacted.</li><li>Fortune 500 expect $5.4 billion in direct cost impacts.</li><li>Cyber Insurers expect to pay out $1.5 billion in claims.</li><li>Delta, America\'s second biggest airline, canceled 5,000 flights, disrupting travel for millions.</li><li>CrowdStrike’s cyber security services are used by 298 of the Fortune 500 companies, 538 of the Fortune 1000 companies, and 8 out of 10 of the top financial firms.</li><li>163 companies have been directly impacted by this outage hosted on Microsoft cloud services. (a full list of these companies can be found at <a href=\"https://www.techbusinessnews.com.au/news/list-of-companies-affected-by-the-microsoft-crowdstrike-outage/\">List Of Companies Affected By The Global Microsoft-Crowdstrike Outage - Tech Business News</a>) This does not include the companies impacted which host their own servers or who use other cloud services and CrowdStrike Falcon endpoint detection and response services.</li><li>At least one putative class action lawsuit from investors arguing they were misled by the company and told its technology was \"validated, tested and certified\" before a faulty update triggered a global IT outage.</li></ul><p><em><strong>“We got a taste of what a global cyberattack would look like.”</strong></em></p><p>Ian Thornton-Trump, CISO at Cyjax has commented:</p><p>\"We learned a valuable lesson about the fragility of our infrastructure,\" Thornton-Trump said.<strong> \"We also learned how dangerous - we got a taste of what a global cyberattack would look like</strong> … I feel like we are at one of those inflection moments.\"</p><p>As reported by Reach Chase DiFeliciantonio in the San Franciso Chronicle:</p><p><em>CrowdStrike’s widespread deployment across industry and government itself reflect a kind of critical security flaw, said Professor Ahmed Banafa at San Jose State University, who teaches courses on computer networking, operating systems, and cybersecurity. Friday’s incident appears to have been human error, “But what if this (had been) done intentionally?” he said.</em></p><p><em>“If you can bring millions of computers down, that is a single point of failure,” Banafa added. “I think Microsoft is really going to think about their relationship with CrowdStrike given what happened today.”</em></p><p><strong>Global IT Supply Chain Implications and Impacts</strong></p><p>Interros, a Supply Chain Risk Intelligence Company, in their CrowdStrike Outage Analysis reports:</p><p><em>CrowdStrike was involved in a global IT outage that has<strong> highlighted the vulnerability of interconnected global supply chains. The outage impacted 674,620 direct customer relationships of CrowdStrike and Microsoft, and over 49 million indirectly,</strong> according to Interros data. While the U.S. was the most affected country, with 41% of impacted entities, the disruption was also felt at major ports and air freight hubs in Europe and Asia. Ports from New York to Los Angeles and Rotterdam reported temporary shutdowns, while air freight suffered the hardest blow, with thousands of flights grounded or delayed. The outage exacerbates existing supply chain challenges amid rising global demand and freight prices, highlighting the potential long-term implications for global trade and finance.</em></p><p><em>Interros analyzed the extended supply chains of both CrowdStrike and Microsoft, whose Microsoft 365 systems were disrupted as part of a CrowdStrike update, leading to outages for Microsoft users across the world. When examining the direct customer relationships (Tier 1) of both Microsoft and CrowdStrike, Interros was able to identify 674,620 customer relationships.&nbsp;<strong> When expanding the scope of impact to include the customers of Microsoft and CrowdStrike’s customers (Tier 2), the number of customer relationships identified by Interros data grows to over 28 million, and when going one step further (Tier 3), that figure to over 49 million customer relationships.</strong></em></p><p><strong>Root Cause?</strong></p><p>There is ample reporting by CrowdStrike and the media as to the root cause of this cyber event being a bug / failure in CrowdStrike’s automated software testing which did not “catch” the software “bug” in their channel file 291 software update to their Falcon End Point Threat Data file (Detection and Response endpoint device software).</p><p><strong>REALLY?</strong></p><p>&nbsp;</p><p>A more discerning view should be asking these questions of CrowdStrike:</p><ul><li>As a prime top tier global supplier of cyber security services, why do you and did you push out a global patch to all your customers at the exact same instant?</li><li>Why did you not test your patch on target safe zone environments prior to pushing it out?</li><li>Why did you not push this update / patch out to you customers incrementally as a best practice, to minimize the potential impacts in the event of such a failure as this?</li><li>What are and where were your governance and controls for software quality test and assurance?</li></ul><p>A more discerning view should be asking these questions of customers of CrowdStrike:</p><ul><li>As a customer of CrowdStrike, why do you allow a third party to auto-push a patch directly onto your production operations servers?</li><li>Why do you not test third party software patches in a safe zone prior to widespread software update / patch deployment?</li><li>What are and where were your governance and controls for software quality test and assurance?</li></ul><p>&nbsp;</p><p>&nbsp;</p><p><strong>Security focusing only on Design aspects of Complex Systems will ensure Cyber Insecurity</strong></p><p>In my last post I commented that digital systems do not stand alone as technology systems only. As soon as we deploy technology, the technology enters the realm of becoming a system, interconnecting, and interacting with other systems with which our business operates. These systems and interconnections extend throughout our organizations, as well as throughout out our Ter 1 extended customer and supplier interconnections, our Tier 2 extended customer and supplier interconnections, our Tier 3 extended customer and suppler interconnections, and so on.</p><p>These business systems are comprised of benevolent technology, people, and processes interconnecting our business with our customers and suppliers, as well as the shared open systems we use, such as the world wide web and internet. Unfortunately, bad actors also use the open and shared internet and world wide web systems with the sole purpose to compromise our business operations. So, … focusing only on the secure design of technology products is not enough to Secure our Businesses by Design.</p><p>&nbsp;</p><p><strong>Cyber Events of minor and / or catastrophic consequences can also be triggered by non-bad actors from anywhere within our extended customer and supplier chains.</strong></p><p>The very nature of the complex interconnections of digital systems mandates that Security by Design requires that all aspects of security design and operations work in concert continually across all Tiers of our organization + customer + supplier chain. Any gaps, mistakes, or lack of attentiveness by those who use, support, or operate our systems, including those responsible for oversight and assurance, will guarantee a cybersecurity compromise, either by bad actors or by “own or customer or supplier” actors.</p><p>&nbsp;</p><img src=\"/sites/default/files/inline-images/Security%20by%20design%2012.png\" data-entity-uuid=\"2e2f4008-dba1-488b-baa4-8000d706ff93\" data-entity-type=\"file\" width=\"2342\" height=\"2300\"><p>&nbsp;</p><p><br><strong>Security by Design&nbsp;</strong></p><p>People / Process</p><p>People / Data</p><p>People / Technology</p><p>Process / People</p><p>Process / Data</p><p>Process / Technology</p><p>Technology / People</p><p>Technology / Data</p><p>Technology / Process</p><p>Data / Process</p><p>Data / People</p><p>Data / Technology</p><p>&nbsp;</p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>&nbsp;</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Special Advisor for Risk and Cybersecurity to DivIHN, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>&nbsp;</p><p>&nbsp;</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,88,219,'en',0,'<p><strong>On July 19, 2024 a Single Software Update was able to create IT Chaos Across the Entire World</strong></p><p>A faulty CrowdStrike channel file 291 software update to their Falcon End Point Threat Data file (Detection and Response endpoint device software) impacted (crashed) 9+ million computers. This created an immediate global IT outage affecting airlines, media outlets, banks, retailers and other organizations that use Microsoft Windows operating systems.</p><p><strong>“Largest IT Outage in History”</strong></p><p>The World Economic Forum is reporting this as possibly the “largest IT outage in history”, revealing the vulnerability and interconnections of <em>Complex Digital Systems</em>. This follows the continuing clean up and losses due to the Change Healthcare cyber attack which occurred on February 19th, 2024, with $6.87 billion in total losses expected (including equity loss, legal fees, regulatory fines, class action claims, PR expenses, notification costs and other expenses).</p><p>It is being reported that:&nbsp;<meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>Global Microsoft-CrowdStrike Outage Impact</title></p><ul><li>5+ million computers have been impacted.</li><li>Fortune 500 expect $5.4 billion in direct cost impacts.</li><li>Cyber Insurers expect to pay out $1.5 billion in claims.</li><li>Delta, America\'s second biggest airline, canceled 5,000 flights, disrupting travel for millions.</li><li>CrowdStrike’s cyber security services are used by 298 of the Fortune 500 companies, 538 of the Fortune 1000 companies, and 8 out of 10 of the top financial firms.</li><li>163 companies have been directly impacted by this outage hosted on Microsoft cloud services. (a full list of these companies can be found at <a href=\"https://www.techbusinessnews.com.au/news/list-of-companies-affected-by-the-microsoft-crowdstrike-outage/\">List Of Companies Affected By The Global Microsoft-Crowdstrike Outage - Tech Business News</a>) This does not include the companies impacted which host their own servers or who use other cloud services and CrowdStrike Falcon endpoint detection and response services.</li><li>At least one putative class action lawsuit from investors arguing they were misled by the company and told its technology was \"validated, tested and certified\" before a faulty update triggered a global IT outage.</li></ul><p><em><strong>“We got a taste of what a global cyberattack would look like.”</strong></em></p><p>Ian Thornton-Trump, CISO at Cyjax has commented:</p><p>\"We learned a valuable lesson about the fragility of our infrastructure,\" Thornton-Trump said.<strong> \"We also learned how dangerous - we got a taste of what a global cyberattack would look like</strong> … I feel like we are at one of those inflection moments.\"</p><p>As reported by Reach Chase DiFeliciantonio in the San Franciso Chronicle:</p><p><em>CrowdStrike’s widespread deployment across industry and government itself reflect a kind of critical security flaw, said Professor Ahmed Banafa at San Jose State University, who teaches courses on computer networking, operating systems, and cybersecurity. Friday’s incident appears to have been human error, “But what if this (had been) done intentionally?” he said.</em></p><p><em>“If you can bring millions of computers down, that is a single point of failure,” Banafa added. “I think Microsoft is really going to think about their relationship with CrowdStrike given what happened today.”</em></p><p><strong>Global IT Supply Chain Implications and Impacts</strong></p><p>Interros, a Supply Chain Risk Intelligence Company, in their CrowdStrike Outage Analysis reports:</p><p><em>CrowdStrike was involved in a global IT outage that has<strong> highlighted the vulnerability of interconnected global supply chains. The outage impacted 674,620 direct customer relationships of CrowdStrike and Microsoft, and over 49 million indirectly,</strong> according to Interros data. While the U.S. was the most affected country, with 41% of impacted entities, the disruption was also felt at major ports and air freight hubs in Europe and Asia. Ports from New York to Los Angeles and Rotterdam reported temporary shutdowns, while air freight suffered the hardest blow, with thousands of flights grounded or delayed. The outage exacerbates existing supply chain challenges amid rising global demand and freight prices, highlighting the potential long-term implications for global trade and finance.</em></p><p><em>Interros analyzed the extended supply chains of both CrowdStrike and Microsoft, whose Microsoft 365 systems were disrupted as part of a CrowdStrike update, leading to outages for Microsoft users across the world. When examining the direct customer relationships (Tier 1) of both Microsoft and CrowdStrike, Interros was able to identify 674,620 customer relationships.&nbsp;<strong> When expanding the scope of impact to include the customers of Microsoft and CrowdStrike’s customers (Tier 2), the number of customer relationships identified by Interros data grows to over 28 million, and when going one step further (Tier 3), that figure to over 49 million customer relationships.</strong></em></p><p><strong>Root Cause?</strong></p><p>There is ample reporting by CrowdStrike and the media as to the root cause of this cyber event being a bug / failure in CrowdStrike’s automated software testing which did not “catch” the software “bug” in their channel file 291 software update to their Falcon End Point Threat Data file (Detection and Response endpoint device software).</p><p><strong>REALLY?</strong></p><p>&nbsp;</p><p>A more discerning view should be asking these questions of CrowdStrike:</p><ul><li>As a prime top tier global supplier of cyber security services, why do you and did you push out a global patch to all your customers at the exact same instant?</li><li>Why did you not test your patch on target safe zone environments prior to pushing it out?</li><li>Why did you not push this update / patch out to you customers incrementally as a best practice, to minimize the potential impacts in the event of such a failure as this?</li><li>What are and where were your governance and controls for software quality test and assurance?</li></ul><p>A more discerning view should be asking these questions of customers of CrowdStrike:</p><ul><li>As a customer of CrowdStrike, why do you allow a third party to auto-push a patch directly onto your production operations servers?</li><li>Why do you not test third party software patches in a safe zone prior to widespread software update / patch deployment?</li><li>What are and where were your governance and controls for software quality test and assurance?</li></ul><p>&nbsp;</p><p>&nbsp;</p><p><strong>Security focusing only on Design aspects of Complex Systems will ensure Cyber Insecurity</strong></p><p>In my last post I commented that digital systems do not stand alone as technology systems only. As soon as we deploy technology, the technology enters the realm of becoming a system, interconnecting, and interacting with other systems with which our business operates. These systems and interconnections extend throughout our organizations, as well as throughout out our Ter 1 extended customer and supplier interconnections, our Tier 2 extended customer and supplier interconnections, our Tier 3 extended customer and suppler interconnections, and so on.</p><p>These business systems are comprised of benevolent technology, people, and processes interconnecting our business with our customers and suppliers, as well as the shared open systems we use, such as the world wide web and internet. Unfortunately, bad actors also use the open and shared internet and world wide web systems with the sole purpose to compromise our business operations. So, … focusing only on the secure design of technology products is not enough to Secure our Businesses by Design.</p><p>&nbsp;</p><p><strong>Cyber Events of minor and / or catastrophic consequences can also be triggered by non-bad actors from anywhere within our extended customer and supplier chains.</strong></p><p>The very nature of the complex interconnections of digital systems mandates that Security by Design requires that all aspects of security design and operations work in concert continually across all Tiers of our organization + customer + supplier chain. Any gaps, mistakes, or lack of attentiveness by those who use, support, or operate our systems, including those responsible for oversight and assurance, will guarantee a cybersecurity compromise, either by bad actors or by “own or customer or supplier” actors.</p><p>&nbsp;</p><img src=\"/sites/default/files/inline-images/Security%20by%20design%2012.png\" data-entity-uuid=\"2e2f4008-dba1-488b-baa4-8000d706ff93\" data-entity-type=\"file\" width=\"2342\" height=\"2300\"><p>&nbsp;</p><p><br><strong>Security by Design&nbsp;</strong></p><p>People / Process</p><p>People / Data</p><p>People / Technology</p><p>Process / People</p><p>Process / Data</p><p>Process / Technology</p><p>Technology / People</p><p>Technology / Data</p><p>Technology / Process</p><p>Data / Process</p><p>Data / People</p><p>Data / Technology</p><p>&nbsp;</p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>&nbsp;</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Special Advisor for Risk and Cybersecurity to DivIHN, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>&nbsp;</p><p>&nbsp;</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,88,220,'en',0,'<p><strong>On July 19, 2024 a Single Software Update was able to create IT Chaos Across the Entire World</strong></p><p>A faulty CrowdStrike channel file 291 software update to their Falcon End Point Threat Data file (Detection and Response endpoint device software) impacted (crashed) 9+ million computers. This created an immediate global IT outage affecting airlines, media outlets, banks, retailers and other organizations that use Microsoft Windows operating systems.</p><p><strong>“Largest IT Outage in History”</strong></p><p>The World Economic Forum is reporting this as possibly the “largest IT outage in history”, revealing the vulnerability and interconnections of <em>Complex Digital Systems</em>. This follows the continuing clean up and losses due to the Change Healthcare cyber attack which occurred on February 19th, 2024, with $6.87 billion in total losses expected (including equity loss, legal fees, regulatory fines, class action claims, PR expenses, notification costs and other expenses).</p><p>It is being reported that:&nbsp;<meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>Global Microsoft-CrowdStrike Outage Impact</title></p><ul><li>5+ million computers have been impacted.</li><li>Fortune 500 expect $5.4 billion in direct cost impacts.</li><li>Cyber Insurers expect to pay out $1.5 billion in claims.</li><li>Delta, America\'s second biggest airline, canceled 5,000 flights, disrupting travel for millions.</li><li>CrowdStrike’s cyber security services are used by 298 of the Fortune 500 companies, 538 of the Fortune 1000 companies, and 8 out of 10 of the top financial firms.</li><li>163 companies have been directly impacted by this outage hosted on Microsoft cloud services. (a full list of these companies can be found at <a href=\"https://www.techbusinessnews.com.au/news/list-of-companies-affected-by-the-microsoft-crowdstrike-outage/\">List Of Companies Affected By The Global Microsoft-Crowdstrike Outage - Tech Business News</a>) This does not include the companies impacted which host their own servers or who use other cloud services and CrowdStrike Falcon endpoint detection and response services.</li><li>At least one putative class action lawsuit from investors arguing they were misled by the company and told its technology was \"validated, tested and certified\" before a faulty update triggered a global IT outage.</li></ul><p><em><strong>“We got a taste of what a global cyberattack would look like.”</strong></em></p><p>Ian Thornton-Trump, CISO at Cyjax has commented:</p><p>\"We learned a valuable lesson about the fragility of our infrastructure,\" Thornton-Trump said.<strong> \"We also learned how dangerous - we got a taste of what a global cyberattack would look like</strong> … I feel like we are at one of those inflection moments.\"</p><p>As reported by Reach Chase DiFeliciantonio in the San Franciso Chronicle:</p><p><em>CrowdStrike’s widespread deployment across industry and government itself reflect a kind of critical security flaw, said Professor Ahmed Banafa at San Jose State University, who teaches courses on computer networking, operating systems, and cybersecurity. Friday’s incident appears to have been human error, “But what if this (had been) done intentionally?” he said.</em></p><p><em>“If you can bring millions of computers down, that is a single point of failure,” Banafa added. “I think Microsoft is really going to think about their relationship with CrowdStrike given what happened today.”</em></p><p><strong>Global IT Supply Chain Implications and Impacts</strong></p><p>Interros, a Supply Chain Risk Intelligence Company, in their CrowdStrike Outage Analysis reports:</p><p><em>CrowdStrike was involved in a global IT outage that has<strong> highlighted the vulnerability of interconnected global supply chains. The outage impacted 674,620 direct customer relationships of CrowdStrike and Microsoft, and over 49 million indirectly,</strong> according to Interros data. While the U.S. was the most affected country, with 41% of impacted entities, the disruption was also felt at major ports and air freight hubs in Europe and Asia. Ports from New York to Los Angeles and Rotterdam reported temporary shutdowns, while air freight suffered the hardest blow, with thousands of flights grounded or delayed. The outage exacerbates existing supply chain challenges amid rising global demand and freight prices, highlighting the potential long-term implications for global trade and finance.</em></p><p><em>Interros analyzed the extended supply chains of both CrowdStrike and Microsoft, whose Microsoft 365 systems were disrupted as part of a CrowdStrike update, leading to outages for Microsoft users across the world. When examining the direct customer relationships (Tier 1) of both Microsoft and CrowdStrike, Interros was able to identify 674,620 customer relationships.&nbsp;<strong> When expanding the scope of impact to include the customers of Microsoft and CrowdStrike’s customers (Tier 2), the number of customer relationships identified by Interros data grows to over 28 million, and when going one step further (Tier 3), that figure to over 49 million customer relationships.</strong></em></p><p><strong>Root Cause?</strong></p><p>There is ample reporting by CrowdStrike and the media as to the root cause of this cyber event being a bug / failure in CrowdStrike’s automated software testing which did not “catch” the software “bug” in their channel file 291 software update to their Falcon End Point Threat Data file (Detection and Response endpoint device software).</p><p><strong>REALLY?</strong></p><p>&nbsp;</p><p>A more discerning view should be asking these questions of CrowdStrike:</p><ul><li>As a prime top tier global supplier of cyber security services, why do you and did you push out a global patch to all your customers at the exact same instant?</li><li>Why did you not test your patch on target safe zone environments prior to pushing it out?</li><li>Why did you not push this update / patch out to you customers incrementally as a best practice, to minimize the potential impacts in the event of such a failure as this?</li><li>What are and where were your governance and controls for software quality test and assurance?</li></ul><p>A more discerning view should be asking these questions of customers of CrowdStrike:</p><ul><li>As a customer of CrowdStrike, why do you allow a third party to auto-push a patch directly onto your production operations servers?</li><li>Why do you not test third party software patches in a safe zone prior to widespread software update / patch deployment?</li><li>What are and where were your governance and controls for software quality test and assurance?</li></ul><p>&nbsp;</p><p>&nbsp;</p><p><strong>Security focusing only on Design aspects of Complex Systems will ensure Cyber Insecurity</strong></p><p>In my last post I commented that digital systems do not stand alone as technology systems only. As soon as we deploy technology, the technology enters the realm of becoming a system, interconnecting, and interacting with other systems with which our business operates. These systems and interconnections extend throughout our organizations, as well as throughout out our Ter 1 extended customer and supplier interconnections, our Tier 2 extended customer and supplier interconnections, our Tier 3 extended customer and suppler interconnections, and so on.</p><p>These business systems are comprised of benevolent technology, people, and processes interconnecting our business with our customers and suppliers, as well as the shared open systems we use, such as the world wide web and internet. Unfortunately, bad actors also use the open and shared internet and world wide web systems with the sole purpose to compromise our business operations. So, … focusing only on the secure design of technology products is not enough to Secure our Businesses by Design.</p><p>&nbsp;</p><p><strong>Cyber Events of minor and / or catastrophic consequences can also be triggered by non-bad actors from anywhere within our extended customer and supplier chains.</strong></p><p>The very nature of the complex interconnections of digital systems mandates that Security by Design requires that all aspects of security design and operations work in concert continually across all Tiers of our organization + customer + supplier chain. Any gaps, mistakes, or lack of attentiveness by those who use, support, or operate our systems, including those responsible for oversight and assurance, will guarantee a cybersecurity compromise, either by bad actors or by “own or customer or supplier” actors.</p><p>&nbsp;</p><img src=\"/sites/default/files/inline-images/Security%20by%20design%2012.png\" data-entity-uuid=\"2e2f4008-dba1-488b-baa4-8000d706ff93\" data-entity-type=\"file\" width=\"900\" height=\"884\"><p>&nbsp;</p><p><br><strong>Security by Design&nbsp;</strong></p><p>People / Process</p><p>People / Data</p><p>People / Technology</p><p>Process / People</p><p>Process / Data</p><p>Process / Technology</p><p>Technology / People</p><p>Technology / Data</p><p>Technology / Process</p><p>Data / Process</p><p>Data / People</p><p>Data / Technology</p><p>&nbsp;</p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>&nbsp;</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Special Advisor for Risk and Cybersecurity to DivIHN, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>&nbsp;</p><p>&nbsp;</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,88,221,'en',0,'<p><strong>On July 19, 2024 a Single Software Update was able to create IT Chaos Across the Entire World</strong></p><p>A faulty CrowdStrike channel file 291 software update to their Falcon End Point Threat Data file (Detection and Response endpoint device software) impacted (crashed) 9+ million computers. This created an immediate global IT outage affecting airlines, media outlets, banks, retailers and other organizations that use Microsoft Windows operating systems.</p><p><strong>“Largest IT Outage in History”</strong></p><p>The World Economic Forum is reporting this as possibly the “largest IT outage in history”, revealing the vulnerability and interconnections of <em>Complex Digital Systems</em>. This follows the continuing clean up and losses due to the Change Healthcare cyber attack which occurred on February 19th, 2024, with $6.87 billion in total losses expected (including equity loss, legal fees, regulatory fines, class action claims, PR expenses, notification costs and other expenses).</p><p>It is being reported that:&nbsp;<meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>Global Microsoft-CrowdStrike Outage Impact</title></p><ul><li>5+ million computers have been impacted.</li><li>Fortune 500 expect $5.4 billion in direct cost impacts.</li><li>Cyber Insurers expect to pay out $1.5 billion in claims.</li><li>Delta, America\'s second biggest airline, canceled 5,000 flights, disrupting travel for millions.</li><li>CrowdStrike’s cyber security services are used by 298 of the Fortune 500 companies, 538 of the Fortune 1000 companies, and 8 out of 10 of the top financial firms.</li><li>163 companies have been directly impacted by this outage hosted on Microsoft cloud services. (a full list of these companies can be found at <a href=\"https://www.techbusinessnews.com.au/news/list-of-companies-affected-by-the-microsoft-crowdstrike-outage/\">List Of Companies Affected By The Global Microsoft-Crowdstrike Outage - Tech Business News</a>) This does not include the companies impacted which host their own servers or who use other cloud services and CrowdStrike Falcon endpoint detection and response services.</li><li>At least one putative class action lawsuit from investors arguing they were misled by the company and told its technology was \"validated, tested and certified\" before a faulty update triggered a global IT outage.</li></ul><p><em><strong>“We got a taste of what a global cyberattack would look like.”</strong></em></p><p>Ian Thornton-Trump, CISO at Cyjax has commented:</p><p>\"We learned a valuable lesson about the fragility of our infrastructure,\" Thornton-Trump said.<strong> \"We also learned how dangerous - we got a taste of what a global cyberattack would look like</strong> … I feel like we are at one of those inflection moments.\"</p><p>As reported by Reach Chase DiFeliciantonio in the San Franciso Chronicle:</p><p><em>CrowdStrike’s widespread deployment across industry and government itself reflect a kind of critical security flaw, said Professor Ahmed Banafa at San Jose State University, who teaches courses on computer networking, operating systems, and cybersecurity. Friday’s incident appears to have been human error, “But what if this (had been) done intentionally?” he said.</em></p><p><em>“If you can bring millions of computers down, that is a single point of failure,” Banafa added. “I think Microsoft is really going to think about their relationship with CrowdStrike given what happened today.”</em></p><p><strong>Global IT Supply Chain Implications and Impacts</strong></p><p>Interros, a Supply Chain Risk Intelligence Company, in their CrowdStrike Outage Analysis reports:</p><p><em>CrowdStrike was involved in a global IT outage that has<strong> highlighted the vulnerability of interconnected global supply chains. The outage impacted 674,620 direct customer relationships of CrowdStrike and Microsoft, and over 49 million indirectly,</strong> according to Interros data. While the U.S. was the most affected country, with 41% of impacted entities, the disruption was also felt at major ports and air freight hubs in Europe and Asia. Ports from New York to Los Angeles and Rotterdam reported temporary shutdowns, while air freight suffered the hardest blow, with thousands of flights grounded or delayed. The outage exacerbates existing supply chain challenges amid rising global demand and freight prices, highlighting the potential long-term implications for global trade and finance.</em></p><p><em>Interros analyzed the extended supply chains of both CrowdStrike and Microsoft, whose Microsoft 365 systems were disrupted as part of a CrowdStrike update, leading to outages for Microsoft users across the world. When examining the direct customer relationships (Tier 1) of both Microsoft and CrowdStrike, Interros was able to identify 674,620 customer relationships.&nbsp;<strong> When expanding the scope of impact to include the customers of Microsoft and CrowdStrike’s customers (Tier 2), the number of customer relationships identified by Interros data grows to over 28 million, and when going one step further (Tier 3), that figure to over 49 million customer relationships.</strong></em></p><p><strong>Root Cause?</strong></p><p>There is ample reporting by CrowdStrike and the media as to the root cause of this cyber event being a bug / failure in CrowdStrike’s automated software testing which did not “catch” the software “bug” in their channel file 291 software update to their Falcon End Point Threat Data file (Detection and Response endpoint device software).</p><p><strong>REALLY?</strong></p><p>&nbsp;</p><p>A more discerning view should be asking these questions of CrowdStrike:</p><ul><li>As a prime top tier global supplier of cyber security services, why do you and did you push out a global patch to all your customers at the exact same instant?</li><li>Why did you not test your patch on target safe zone environments prior to pushing it out?</li><li>Why did you not push this update / patch out to you customers incrementally as a best practice, to minimize the potential impacts in the event of such a failure as this?</li><li>What are and where were your governance and controls for software quality test and assurance?</li></ul><p>A more discerning view should be asking these questions of customers of CrowdStrike:</p><ul><li>As a customer of CrowdStrike, why do you allow a third party to auto-push a patch directly onto your production operations servers?</li><li>Why do you not test third party software patches in a safe zone prior to widespread software update / patch deployment?</li><li>What are and where were your governance and controls for software quality test and assurance?</li></ul><p>&nbsp;</p><p>&nbsp;</p><p><strong>Security focusing only on Design aspects of Complex Systems will ensure Cyber Insecurity</strong></p><p>In my last post I commented that digital systems do not stand alone as technology systems only. As soon as we deploy technology, the technology enters the realm of becoming a system, interconnecting, and interacting with other systems with which our business operates. These systems and interconnections extend throughout our organizations, as well as throughout out our Ter 1 extended customer and supplier interconnections, our Tier 2 extended customer and supplier interconnections, our Tier 3 extended customer and suppler interconnections, and so on.</p><p>These business systems are comprised of benevolent technology, people, and processes interconnecting our business with our customers and suppliers, as well as the shared open systems we use, such as the world wide web and internet. Unfortunately, bad actors also use the open and shared internet and world wide web systems with the sole purpose to compromise our business operations. So, … focusing only on the secure design of technology products is not enough to Secure our Businesses by Design.</p><p>&nbsp;</p><p><strong>Cyber Events of minor and / or catastrophic consequences can also be triggered by non-bad actors from anywhere within our extended customer and supplier chains.</strong></p><p>The very nature of the complex interconnections of digital systems mandates that Security by Design requires that all aspects of security design and operations work in concert continually across all Tiers of our organization + customer + supplier chain. Any gaps, mistakes, or lack of attentiveness by those who use, support, or operate our systems, including those responsible for oversight and assurance, will guarantee a cybersecurity compromise, either by bad actors or by “own or customer or supplier” actors.</p><p>&nbsp;</p><img src=\"/sites/default/files/inline-images/Security%20by%20design%2012.png\" data-entity-uuid=\"2e2f4008-dba1-488b-baa4-8000d706ff93\" data-entity-type=\"file\" width=\"900\" height=\"884\"><p>&nbsp;</p><p><br><strong>Security by Design&nbsp;</strong></p><p>People / Process</p><p>People / Data</p><p>People / Technology</p><p>Process / People</p><p>Process / Data</p><p>Process / Technology</p><p>Technology / People</p><p>Technology / Data</p><p>Technology / Process</p><p>Data / Process</p><p>Data / People</p><p>Data / Technology</p><p>&nbsp;</p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>&nbsp;</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Special Advisor for Risk and Cybersecurity to DivIHN, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>&nbsp;</p><p>&nbsp;</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,88,234,'en',0,'<p><strong>On July 19, 2024 a Single Software Update was able to create IT Chaos Across the Entire World</strong></p><p>A faulty CrowdStrike channel file 291 software update to their Falcon End Point Threat Data file (Detection and Response endpoint device software) impacted (crashed) 9+ million computers. This created an immediate global IT outage affecting airlines, media outlets, banks, retailers and other organizations that use Microsoft Windows operating systems.</p><p><strong>“Largest IT Outage in History”</strong></p><p>The World Economic Forum is reporting this as possibly the “largest IT outage in history”, revealing the vulnerability and interconnections of <em>Complex Digital Systems</em>. This follows the continuing clean up and losses due to the Change Healthcare cyber attack which occurred on February 19th, 2024, with $6.87 billion in total losses expected (including equity loss, legal fees, regulatory fines, class action claims, PR expenses, notification costs and other expenses).</p><p>It is being reported that:&nbsp;<meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>Global Microsoft-CrowdStrike Outage Impact</title></p><ul><li>5+ million computers have been impacted.</li><li>Fortune 500 expect $5.4 billion in direct cost impacts.</li><li>Cyber Insurers expect to pay out $1.5 billion in claims.</li><li>Delta, America\'s second biggest airline, canceled 5,000 flights, disrupting travel for millions.</li><li>CrowdStrike’s cyber security services are used by 298 of the Fortune 500 companies, 538 of the Fortune 1000 companies, and 8 out of 10 of the top financial firms.</li><li>163 companies have been directly impacted by this outage hosted on Microsoft cloud services. (a full list of these companies can be found at <a href=\"https://www.techbusinessnews.com.au/news/list-of-companies-affected-by-the-microsoft-crowdstrike-outage/\">List Of Companies Affected By The Global Microsoft-Crowdstrike Outage - Tech Business News</a>) This does not include the companies impacted which host their own servers or who use other cloud services and CrowdStrike Falcon endpoint detection and response services.</li><li>At least one putative class action lawsuit from investors arguing they were misled by the company and told its technology was \"validated, tested and certified\" before a faulty update triggered a global IT outage.</li></ul><p><em><strong>“We got a taste of what a global cyberattack would look like.”</strong></em></p><p>Ian Thornton-Trump, CISO at Cyjax has commented:</p><p>\"We learned a valuable lesson about the fragility of our infrastructure,\" Thornton-Trump said.<strong> \"We also learned how dangerous - we got a taste of what a global cyberattack would look like</strong> … I feel like we are at one of those inflection moments.\"</p><p>As reported by Reach Chase DiFeliciantonio in the San Franciso Chronicle:</p><p><em>CrowdStrike’s widespread deployment across industry and government itself reflect a kind of critical security flaw, said Professor Ahmed Banafa at San Jose State University, who teaches courses on computer networking, operating systems, and cybersecurity. Friday’s incident appears to have been human error, “But what if this (had been) done intentionally?” he said.</em></p><p><em>“If you can bring millions of computers down, that is a single point of failure,” Banafa added. “I think Microsoft is really going to think about their relationship with CrowdStrike given what happened today.”</em></p><p><strong>Global IT Supply Chain Implications and Impacts</strong></p><p>Interros, a Supply Chain Risk Intelligence Company, in their CrowdStrike Outage Analysis reports:</p><p><em>CrowdStrike was involved in a global IT outage that has<strong> highlighted the vulnerability of interconnected global supply chains. The outage impacted 674,620 direct customer relationships of CrowdStrike and Microsoft, and over 49 million indirectly,</strong> according to Interros data. While the U.S. was the most affected country, with 41% of impacted entities, the disruption was also felt at major ports and air freight hubs in Europe and Asia. Ports from New York to Los Angeles and Rotterdam reported temporary shutdowns, while air freight suffered the hardest blow, with thousands of flights grounded or delayed. The outage exacerbates existing supply chain challenges amid rising global demand and freight prices, highlighting the potential long-term implications for global trade and finance.</em></p><p><em>Interros analyzed the extended supply chains of both CrowdStrike and Microsoft, whose Microsoft 365 systems were disrupted as part of a CrowdStrike update, leading to outages for Microsoft users across the world. When examining the direct customer relationships (Tier 1) of both Microsoft and CrowdStrike, Interros was able to identify 674,620 customer relationships.&nbsp;<strong> When expanding the scope of impact to include the customers of Microsoft and CrowdStrike’s customers (Tier 2), the number of customer relationships identified by Interros data grows to over 28 million, and when going one step further (Tier 3), that figure to over 49 million customer relationships.</strong></em></p><p><strong>Root Cause?</strong></p><p>There is ample reporting by CrowdStrike and the media as to the root cause of this cyber event being a bug / failure in CrowdStrike’s automated software testing which did not “catch” the software “bug” in their channel file 291 software update to their Falcon End Point Threat Data file (Detection and Response endpoint device software).</p><p><strong>REALLY?</strong></p><p>&nbsp;</p><p>A more discerning view should be asking these questions of CrowdStrike:</p><ul><li>As a prime top tier global supplier of cyber security services, why do you and did you push out a global patch to all your customers at the exact same instant?</li><li>Why did you not test your patch on target safe zone environments prior to pushing it out?</li><li>Why did you not push this update / patch out to you customers incrementally as a best practice, to minimize the potential impacts in the event of such a failure as this?</li><li>What are and where were your governance and controls for software quality test and assurance?</li></ul><p>A more discerning view should be asking these questions of customers of CrowdStrike:</p><ul><li>As a customer of CrowdStrike, why do you allow a third party to auto-push a patch directly onto your production operations servers?</li><li>Why do you not test third party software patches in a safe zone prior to widespread software update / patch deployment?</li><li>What are and where were your governance and controls for software quality test and assurance?</li></ul><p>&nbsp;</p><p>&nbsp;</p><p><strong>Security focusing only on Design aspects of Complex Systems will ensure Cyber Insecurity</strong></p><p>In my last post I commented that digital systems do not stand alone as technology systems only. As soon as we deploy technology, the technology enters the realm of becoming a system, interconnecting, and interacting with other systems with which our business operates. These systems and interconnections extend throughout our organizations, as well as throughout out our Ter 1 extended customer and supplier interconnections, our Tier 2 extended customer and supplier interconnections, our Tier 3 extended customer and suppler interconnections, and so on.</p><p>These business systems are comprised of benevolent technology, people, and processes interconnecting our business with our customers and suppliers, as well as the shared open systems we use, such as the world wide web and internet. Unfortunately, bad actors also use the open and shared internet and world wide web systems with the sole purpose to compromise our business operations. So, … focusing only on the secure design of technology products is not enough to Secure our Businesses by Design.</p><p>&nbsp;</p><p><strong>Cyber Events of minor and / or catastrophic consequences can also be triggered by non-bad actors from anywhere within our extended customer and supplier chains.</strong></p><p>The very nature of the complex interconnections of digital systems mandates that Security by Design requires that all aspects of security design and operations work in concert continually across all Tiers of our organization + customer + supplier chain. Any gaps, mistakes, or lack of attentiveness by those who use, support, or operate our systems, including those responsible for oversight and assurance, will guarantee a cybersecurity compromise, either by bad actors or by “own or customer or supplier” actors.</p><p>&nbsp;</p><img src=\"/sites/default/files/inline-images/Security%20by%20design%2012.png\" data-entity-uuid=\"2e2f4008-dba1-488b-baa4-8000d706ff93\" data-entity-type=\"file\" width=\"900\" height=\"884\"><p>&nbsp;</p><p><br><strong>Security by Design&nbsp;</strong></p><p>People / Process</p><p>People / Data</p><p>People / Technology</p><p>Process / People</p><p>Process / Data</p><p>Process / Technology</p><p>Technology / People</p><p>Technology / Data</p><p>Technology / Process</p><p>Data / Process</p><p>Data / People</p><p>Data / Technology</p><p>&nbsp;</p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>&nbsp;</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Special Advisor for Risk and Cybersecurity to DivIHN, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>&nbsp;</p><p>&nbsp;</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,88,406,'en',0,'<p><strong>On July 19, 2024 a Single Software Update was able to create IT Chaos Across the Entire World</strong></p><p>A faulty CrowdStrike channel file 291 software update to their Falcon End Point Threat Data file (Detection and Response endpoint device software) impacted (crashed) 9+ million computers. This created an immediate global IT outage affecting airlines, media outlets, banks, retailers and other organizations that use Microsoft Windows operating systems.</p><p><strong>“Largest IT Outage in History”</strong></p><p>The World Economic Forum is reporting this as possibly the “largest IT outage in history”, revealing the vulnerability and interconnections of <em>Complex Digital Systems</em>. This follows the continuing clean up and losses due to the Change Healthcare cyber attack which occurred on February 19th, 2024, with $6.87 billion in total losses expected (including equity loss, legal fees, regulatory fines, class action claims, PR expenses, notification costs and other expenses).</p><p>It is being reported that:&nbsp;<meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>Global Microsoft-CrowdStrike Outage Impact</title></p><ul><li>5+ million computers have been impacted.</li><li>Fortune 500 expect $5.4 billion in direct cost impacts.</li><li>Cyber Insurers expect to pay out $1.5 billion in claims.</li><li>Delta, America\'s second biggest airline, canceled 5,000 flights, disrupting travel for millions.</li><li>CrowdStrike’s cyber security services are used by 298 of the Fortune 500 companies, 538 of the Fortune 1000 companies, and 8 out of 10 of the top financial firms.</li><li>163 companies have been directly impacted by this outage hosted on Microsoft cloud services. (a full list of these companies can be found at <a href=\"https://www.techbusinessnews.com.au/news/list-of-companies-affected-by-the-microsoft-crowdstrike-outage/\">List Of Companies Affected By The Global Microsoft-Crowdstrike Outage - Tech Business News</a>) This does not include the companies impacted which host their own servers or who use other cloud services and CrowdStrike Falcon endpoint detection and response services.</li><li>At least one putative class action lawsuit from investors arguing they were misled by the company and told its technology was \"validated, tested and certified\" before a faulty update triggered a global IT outage.</li></ul><p><em><strong>“We got a taste of what a global cyberattack would look like.”</strong></em></p><p>Ian Thornton-Trump, CISO at Cyjax has commented:</p><p>\"We learned a valuable lesson about the fragility of our infrastructure,\" Thornton-Trump said.<strong> \"We also learned how dangerous - we got a taste of what a global cyberattack would look like</strong> … I feel like we are at one of those inflection moments.\"</p><p>As reported by Reach Chase DiFeliciantonio in the San Franciso Chronicle:</p><p><em>CrowdStrike’s widespread deployment across industry and government itself reflect a kind of critical security flaw, said Professor Ahmed Banafa at San Jose State University, who teaches courses on computer networking, operating systems, and cybersecurity. Friday’s incident appears to have been human error, “But what if this (had been) done intentionally?” he said.</em></p><p><em>“If you can bring millions of computers down, that is a single point of failure,” Banafa added. “I think Microsoft is really going to think about their relationship with CrowdStrike given what happened today.”</em></p><p><strong>Global IT Supply Chain Implications and Impacts</strong></p><p>Interros, a Supply Chain Risk Intelligence Company, in their CrowdStrike Outage Analysis reports:</p><p><em>CrowdStrike was involved in a global IT outage that has<strong> highlighted the vulnerability of interconnected global supply chains. The outage impacted 674,620 direct customer relationships of CrowdStrike and Microsoft, and over 49 million indirectly,</strong> according to Interros data. While the U.S. was the most affected country, with 41% of impacted entities, the disruption was also felt at major ports and air freight hubs in Europe and Asia. Ports from New York to Los Angeles and Rotterdam reported temporary shutdowns, while air freight suffered the hardest blow, with thousands of flights grounded or delayed. The outage exacerbates existing supply chain challenges amid rising global demand and freight prices, highlighting the potential long-term implications for global trade and finance.</em></p><p><em>Interros analyzed the extended supply chains of both CrowdStrike and Microsoft, whose Microsoft 365 systems were disrupted as part of a CrowdStrike update, leading to outages for Microsoft users across the world. When examining the direct customer relationships (Tier 1) of both Microsoft and CrowdStrike, Interros was able to identify 674,620 customer relationships.&nbsp;<strong> When expanding the scope of impact to include the customers of Microsoft and CrowdStrike’s customers (Tier 2), the number of customer relationships identified by Interros data grows to over 28 million, and when going one step further (Tier 3), that figure to over 49 million customer relationships.</strong></em></p><p><strong>Root Cause?</strong></p><p>There is ample reporting by CrowdStrike and the media as to the root cause of this cyber event being a bug / failure in CrowdStrike’s automated software testing which did not “catch” the software “bug” in their channel file 291 software update to their Falcon End Point Threat Data file (Detection and Response endpoint device software).</p><p><strong>REALLY?</strong></p><p>&nbsp;</p><p>A more discerning view should be asking these questions of CrowdStrike:</p><ul><li>As a prime top tier global supplier of cyber security services, why do you and did you push out a global patch to all your customers at the exact same instant?</li><li>Why did you not test your patch on target safe zone environments prior to pushing it out?</li><li>Why did you not push this update / patch out to you customers incrementally as a best practice, to minimize the potential impacts in the event of such a failure as this?</li><li>What are and where were your governance and controls for software quality test and assurance?</li></ul><p>A more discerning view should be asking these questions of customers of CrowdStrike:</p><ul><li>As a customer of CrowdStrike, why do you allow a third party to auto-push a patch directly onto your production operations servers?</li><li>Why do you not test third party software patches in a safe zone prior to widespread software update / patch deployment?</li><li>What are and where were your governance and controls for software quality test and assurance?</li></ul><p>&nbsp;</p><p>&nbsp;</p><p><strong>Security focusing only on Design aspects of Complex Systems will ensure Cyber Insecurity</strong></p><p>In my last post I commented that digital systems do not stand alone as technology systems only. As soon as we deploy technology, the technology enters the realm of becoming a system, interconnecting, and interacting with other systems with which our business operates. These systems and interconnections extend throughout our organizations, as well as throughout out our Ter 1 extended customer and supplier interconnections, our Tier 2 extended customer and supplier interconnections, our Tier 3 extended customer and suppler interconnections, and so on.</p><p>These business systems are comprised of benevolent technology, people, and processes interconnecting our business with our customers and suppliers, as well as the shared open systems we use, such as the world wide web and internet. Unfortunately, bad actors also use the open and shared internet and world wide web systems with the sole purpose to compromise our business operations. So, … focusing only on the secure design of technology products is not enough to Secure our Businesses by Design.</p><p>&nbsp;</p><p><strong>Cyber Events of minor and / or catastrophic consequences can also be triggered by non-bad actors from anywhere within our extended customer and supplier chains.</strong></p><p>The very nature of the complex interconnections of digital systems mandates that Security by Design requires that all aspects of security design and operations work in concert continually across all Tiers of our organization + customer + supplier chain. Any gaps, mistakes, or lack of attentiveness by those who use, support, or operate our systems, including those responsible for oversight and assurance, will guarantee a cybersecurity compromise, either by bad actors or by “own or customer or supplier” actors.</p><p>&nbsp;</p><img src=\"/sites/default/files/inline-images/Security%20by%20design%2012.png\" data-entity-uuid=\"2e2f4008-dba1-488b-baa4-8000d706ff93\" data-entity-type=\"file\" width=\"900\" height=\"884\"><p>&nbsp;</p><p><br><strong>Security by Design&nbsp;</strong></p><p>People / Process</p><p>People / Data</p><p>People / Technology</p><p>Process / People</p><p>Process / Data</p><p>Process / Technology</p><p>Technology / People</p><p>Technology / Data</p><p>Technology / Process</p><p>Data / Process</p><p>Data / People</p><p>Data / Technology</p><p>&nbsp;</p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>&nbsp;</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Special Advisor for Risk and Cybersecurity to DivIHN, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>&nbsp;</p><p>&nbsp;</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,88,488,'en',0,'<p><strong>On July 19, 2024 a Single Software Update was able to create IT Chaos Across the Entire World</strong></p><p>A faulty CrowdStrike channel file 291 software update to their Falcon End Point Threat Data file (Detection and Response endpoint device software) impacted (crashed) 9+ million computers. This created an immediate global IT outage affecting airlines, media outlets, banks, retailers and other organizations that use Microsoft Windows operating systems.</p><p><strong>“Largest IT Outage in History”</strong></p><p>The World Economic Forum is reporting this as possibly the “largest IT outage in history”, revealing the vulnerability and interconnections of <em>Complex Digital Systems</em>. This follows the continuing clean up and losses due to the Change Healthcare cyber attack which occurred on February 19th, 2024, with $6.87 billion in total losses expected (including equity loss, legal fees, regulatory fines, class action claims, PR expenses, notification costs and other expenses).</p><p>It is being reported that:&nbsp;<meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>Global Microsoft-CrowdStrike Outage Impact</title></p><ul><li>5+ million computers have been impacted.</li><li>Fortune 500 expect $5.4 billion in direct cost impacts.</li><li>Cyber Insurers expect to pay out $1.5 billion in claims.</li><li>Delta, America\'s second biggest airline, canceled 5,000 flights, disrupting travel for millions.</li><li>CrowdStrike’s cyber security services are used by 298 of the Fortune 500 companies, 538 of the Fortune 1000 companies, and 8 out of 10 of the top financial firms.</li><li>163 companies have been directly impacted by this outage hosted on Microsoft cloud services. (a full list of these companies can be found at <a href=\"https://www.techbusinessnews.com.au/news/list-of-companies-affected-by-the-microsoft-crowdstrike-outage/\">List Of Companies Affected By The Global Microsoft-Crowdstrike Outage - Tech Business News</a>) This does not include the companies impacted which host their own servers or who use other cloud services and CrowdStrike Falcon endpoint detection and response services.</li><li>At least one putative class action lawsuit from investors arguing they were misled by the company and told its technology was \"validated, tested and certified\" before a faulty update triggered a global IT outage.</li></ul><p><em><strong>“We got a taste of what a global cyberattack would look like.”</strong></em></p><p>Ian Thornton-Trump, CISO at Cyjax has commented:</p><p>\"We learned a valuable lesson about the fragility of our infrastructure,\" Thornton-Trump said.<strong> \"We also learned how dangerous - we got a taste of what a global cyberattack would look like</strong> … I feel like we are at one of those inflection moments.\"</p><p>As reported by Reach Chase DiFeliciantonio in the San Franciso Chronicle:</p><p><em>CrowdStrike’s widespread deployment across industry and government itself reflect a kind of critical security flaw, said Professor Ahmed Banafa at San Jose State University, who teaches courses on computer networking, operating systems, and cybersecurity. Friday’s incident appears to have been human error, “But what if this (had been) done intentionally?” he said.</em></p><p><em>“If you can bring millions of computers down, that is a single point of failure,” Banafa added. “I think Microsoft is really going to think about their relationship with CrowdStrike given what happened today.”</em></p><p><strong>Global IT Supply Chain Implications and Impacts</strong></p><p>Interros, a Supply Chain Risk Intelligence Company, in their CrowdStrike Outage Analysis reports:</p><p><em>CrowdStrike was involved in a global IT outage that has<strong> highlighted the vulnerability of interconnected global supply chains. The outage impacted 674,620 direct customer relationships of CrowdStrike and Microsoft, and over 49 million indirectly,</strong> according to Interros data. While the U.S. was the most affected country, with 41% of impacted entities, the disruption was also felt at major ports and air freight hubs in Europe and Asia. Ports from New York to Los Angeles and Rotterdam reported temporary shutdowns, while air freight suffered the hardest blow, with thousands of flights grounded or delayed. The outage exacerbates existing supply chain challenges amid rising global demand and freight prices, highlighting the potential long-term implications for global trade and finance.</em></p><p><em>Interros analyzed the extended supply chains of both CrowdStrike and Microsoft, whose Microsoft 365 systems were disrupted as part of a CrowdStrike update, leading to outages for Microsoft users across the world. When examining the direct customer relationships (Tier 1) of both Microsoft and CrowdStrike, Interros was able to identify 674,620 customer relationships.&nbsp;<strong> When expanding the scope of impact to include the customers of Microsoft and CrowdStrike’s customers (Tier 2), the number of customer relationships identified by Interros data grows to over 28 million, and when going one step further (Tier 3), that figure to over 49 million customer relationships.</strong></em></p><p><strong>Root Cause?</strong></p><p>There is ample reporting by CrowdStrike and the media as to the root cause of this cyber event being a bug / failure in CrowdStrike’s automated software testing which did not “catch” the software “bug” in their channel file 291 software update to their Falcon End Point Threat Data file (Detection and Response endpoint device software).</p><p><strong>REALLY?</strong></p><p>&nbsp;</p><p>A more discerning view should be asking these questions of CrowdStrike:</p><ul><li>As a prime top tier global supplier of cyber security services, why do you and did you push out a global patch to all your customers at the exact same instant?</li><li>Why did you not test your patch on target safe zone environments prior to pushing it out?</li><li>Why did you not push this update / patch out to you customers incrementally as a best practice, to minimize the potential impacts in the event of such a failure as this?</li><li>What are and where were your governance and controls for software quality test and assurance?</li></ul><p>A more discerning view should be asking these questions of customers of CrowdStrike:</p><ul><li>As a customer of CrowdStrike, why do you allow a third party to auto-push a patch directly onto your production operations servers?</li><li>Why do you not test third party software patches in a safe zone prior to widespread software update / patch deployment?</li><li>What are and where were your governance and controls for software quality test and assurance?</li></ul><p>&nbsp;</p><p>&nbsp;</p><p><strong>Security focusing only on Design aspects of Complex Systems will ensure Cyber Insecurity</strong></p><p>In my last post I commented that digital systems do not stand alone as technology systems only. As soon as we deploy technology, the technology enters the realm of becoming a system, interconnecting, and interacting with other systems with which our business operates. These systems and interconnections extend throughout our organizations, as well as throughout out our Ter 1 extended customer and supplier interconnections, our Tier 2 extended customer and supplier interconnections, our Tier 3 extended customer and suppler interconnections, and so on.</p><p>These business systems are comprised of benevolent technology, people, and processes interconnecting our business with our customers and suppliers, as well as the shared open systems we use, such as the world wide web and internet. Unfortunately, bad actors also use the open and shared internet and world wide web systems with the sole purpose to compromise our business operations. So, … focusing only on the secure design of technology products is not enough to Secure our Businesses by Design.</p><p>&nbsp;</p><p><strong>Cyber Events of minor and / or catastrophic consequences can also be triggered by non-bad actors from anywhere within our extended customer and supplier chains.</strong></p><p>The very nature of the complex interconnections of digital systems mandates that Security by Design requires that all aspects of security design and operations work in concert continually across all Tiers of our organization + customer + supplier chain. Any gaps, mistakes, or lack of attentiveness by those who use, support, or operate our systems, including those responsible for oversight and assurance, will guarantee a cybersecurity compromise, either by bad actors or by “own or customer or supplier” actors.</p><p>&nbsp;</p><img src=\"/sites/default/files/inline-images/Security%20by%20design%2012.png\" data-entity-uuid=\"2e2f4008-dba1-488b-baa4-8000d706ff93\" data-entity-type=\"file\" width=\"900\" height=\"884\"><p>&nbsp;</p><p><br><strong>Security by Design&nbsp;</strong></p><p>People / Process</p><p>People / Data</p><p>People / Technology</p><p>Process / People</p><p>Process / Data</p><p>Process / Technology</p><p>Technology / People</p><p>Technology / Data</p><p>Technology / Process</p><p>Data / Process</p><p>Data / People</p><p>Data / Technology</p><p>&nbsp;</p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>&nbsp;</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Special Advisor for Risk and Cybersecurity to DivIHN, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>&nbsp;</p><p>&nbsp;</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,88,568,'en',0,'<p><strong>On July 19, 2024 a Single Software Update was able to create IT Chaos Across the Entire World</strong></p><p>A faulty CrowdStrike channel file 291 software update to their Falcon End Point Threat Data file (Detection and Response endpoint device software) impacted (crashed) 9+ million computers. This created an immediate global IT outage affecting airlines, media outlets, banks, retailers and other organizations that use Microsoft Windows operating systems.</p><p><strong>“Largest IT Outage in History”</strong></p><p>The World Economic Forum is reporting this as possibly the “largest IT outage in history”, revealing the vulnerability and interconnections of <em>Complex Digital Systems</em>. This follows the continuing clean up and losses due to the Change Healthcare cyber attack which occurred on February 19th, 2024, with $6.87 billion in total losses expected (including equity loss, legal fees, regulatory fines, class action claims, PR expenses, notification costs and other expenses).</p><p>It is being reported that:&nbsp;<meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>Global Microsoft-CrowdStrike Outage Impact</title></p><ul><li>5+ million computers have been impacted.</li><li>Fortune 500 expect $5.4 billion in direct cost impacts.</li><li>Cyber Insurers expect to pay out $1.5 billion in claims.</li><li>Delta, America\'s second biggest airline, canceled 5,000 flights, disrupting travel for millions.</li><li>CrowdStrike’s cyber security services are used by 298 of the Fortune 500 companies, 538 of the Fortune 1000 companies, and 8 out of 10 of the top financial firms.</li><li>163 companies have been directly impacted by this outage hosted on Microsoft cloud services. (a full list of these companies can be found at <a href=\"https://www.techbusinessnews.com.au/news/list-of-companies-affected-by-the-microsoft-crowdstrike-outage/\">List Of Companies Affected By The Global Microsoft-Crowdstrike Outage - Tech Business News</a>) This does not include the companies impacted which host their own servers or who use other cloud services and CrowdStrike Falcon endpoint detection and response services.</li><li>At least one putative class action lawsuit from investors arguing they were misled by the company and told its technology was \"validated, tested and certified\" before a faulty update triggered a global IT outage.</li></ul><p><em><strong>“We got a taste of what a global cyberattack would look like.”</strong></em></p><p>Ian Thornton-Trump, CISO at Cyjax has commented:</p><p>\"We learned a valuable lesson about the fragility of our infrastructure,\" Thornton-Trump said.<strong> \"We also learned how dangerous - we got a taste of what a global cyberattack would look like</strong> … I feel like we are at one of those inflection moments.\"</p><p>As reported by Reach Chase DiFeliciantonio in the San Franciso Chronicle:</p><p><em>CrowdStrike’s widespread deployment across industry and government itself reflect a kind of critical security flaw, said Professor Ahmed Banafa at San Jose State University, who teaches courses on computer networking, operating systems, and cybersecurity. Friday’s incident appears to have been human error, “But what if this (had been) done intentionally?” he said.</em></p><p><em>“If you can bring millions of computers down, that is a single point of failure,” Banafa added. “I think Microsoft is really going to think about their relationship with CrowdStrike given what happened today.”</em></p><p><strong>Global IT Supply Chain Implications and Impacts</strong></p><p>Interros, a Supply Chain Risk Intelligence Company, in their CrowdStrike Outage Analysis reports:</p><p><em>CrowdStrike was involved in a global IT outage that has<strong> highlighted the vulnerability of interconnected global supply chains. The outage impacted 674,620 direct customer relationships of CrowdStrike and Microsoft, and over 49 million indirectly,</strong> according to Interros data. While the U.S. was the most affected country, with 41% of impacted entities, the disruption was also felt at major ports and air freight hubs in Europe and Asia. Ports from New York to Los Angeles and Rotterdam reported temporary shutdowns, while air freight suffered the hardest blow, with thousands of flights grounded or delayed. The outage exacerbates existing supply chain challenges amid rising global demand and freight prices, highlighting the potential long-term implications for global trade and finance.</em></p><p><em>Interros analyzed the extended supply chains of both CrowdStrike and Microsoft, whose Microsoft 365 systems were disrupted as part of a CrowdStrike update, leading to outages for Microsoft users across the world. When examining the direct customer relationships (Tier 1) of both Microsoft and CrowdStrike, Interros was able to identify 674,620 customer relationships.&nbsp;<strong> When expanding the scope of impact to include the customers of Microsoft and CrowdStrike’s customers (Tier 2), the number of customer relationships identified by Interros data grows to over 28 million, and when going one step further (Tier 3), that figure to over 49 million customer relationships.</strong></em></p><p><strong>Root Cause?</strong></p><p>There is ample reporting by CrowdStrike and the media as to the root cause of this cyber event being a bug / failure in CrowdStrike’s automated software testing which did not “catch” the software “bug” in their channel file 291 software update to their Falcon End Point Threat Data file (Detection and Response endpoint device software).</p><p><strong>REALLY?</strong></p><p>&nbsp;</p><p>A more discerning view should be asking these questions of CrowdStrike:</p><ul><li>As a prime top tier global supplier of cyber security services, why do you and did you push out a global patch to all your customers at the exact same instant?</li><li>Why did you not test your patch on target safe zone environments prior to pushing it out?</li><li>Why did you not push this update / patch out to you customers incrementally as a best practice, to minimize the potential impacts in the event of such a failure as this?</li><li>What are and where were your governance and controls for software quality test and assurance?</li></ul><p>A more discerning view should be asking these questions of customers of CrowdStrike:</p><ul><li>As a customer of CrowdStrike, why do you allow a third party to auto-push a patch directly onto your production operations servers?</li><li>Why do you not test third party software patches in a safe zone prior to widespread software update / patch deployment?</li><li>What are and where were your governance and controls for software quality test and assurance?</li></ul><p>&nbsp;</p><p>&nbsp;</p><p><strong>Security focusing only on Design aspects of Complex Systems will ensure Cyber Insecurity</strong></p><p>In my last post I commented that digital systems do not stand alone as technology systems only. As soon as we deploy technology, the technology enters the realm of becoming a system, interconnecting, and interacting with other systems with which our business operates. These systems and interconnections extend throughout our organizations, as well as throughout out our Ter 1 extended customer and supplier interconnections, our Tier 2 extended customer and supplier interconnections, our Tier 3 extended customer and suppler interconnections, and so on.</p><p>These business systems are comprised of benevolent technology, people, and processes interconnecting our business with our customers and suppliers, as well as the shared open systems we use, such as the world wide web and internet. Unfortunately, bad actors also use the open and shared internet and world wide web systems with the sole purpose to compromise our business operations. So, … focusing only on the secure design of technology products is not enough to Secure our Businesses by Design.</p><p>&nbsp;</p><p><strong>Cyber Events of minor and / or catastrophic consequences can also be triggered by non-bad actors from anywhere within our extended customer and supplier chains.</strong></p><p>The very nature of the complex interconnections of digital systems mandates that Security by Design requires that all aspects of security design and operations work in concert continually across all Tiers of our organization + customer + supplier chain. Any gaps, mistakes, or lack of attentiveness by those who use, support, or operate our systems, including those responsible for oversight and assurance, will guarantee a cybersecurity compromise, either by bad actors or by “own or customer or supplier” actors.</p><p>&nbsp;</p><img src=\"/sites/default/files/inline-images/Security%20by%20design%2012.png\" data-entity-uuid=\"2e2f4008-dba1-488b-baa4-8000d706ff93\" data-entity-type=\"file\" width=\"900\" height=\"884\"><p>&nbsp;</p><p><br><strong>Security by Design&nbsp;</strong></p><p>People / Process</p><p>People / Data</p><p>People / Technology</p><p>Process / People</p><p>Process / Data</p><p>Process / Technology</p><p>Technology / People</p><p>Technology / Data</p><p>Technology / Process</p><p>Data / Process</p><p>Data / People</p><p>Data / Technology</p><p>&nbsp;</p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>&nbsp;</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Special Advisor for Risk and Cybersecurity to DivIHN, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>&nbsp;</p><p>&nbsp;</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,88,643,'en',0,'<p><strong>On July 19, 2024 a Single Software Update was able to create IT Chaos Across the Entire World</strong></p><p>A faulty CrowdStrike channel file 291 software update to their Falcon End Point Threat Data file (Detection and Response endpoint device software) impacted (crashed) 9+ million computers. This created an immediate global IT outage affecting airlines, media outlets, banks, retailers and other organizations that use Microsoft Windows operating systems.</p><p><strong>“Largest IT Outage in History”</strong></p><p>The World Economic Forum is reporting this as possibly the “largest IT outage in history”, revealing the vulnerability and interconnections of <em>Complex Digital Systems</em>. This follows the continuing clean up and losses due to the Change Healthcare cyber attack which occurred on February 19th, 2024, with $6.87 billion in total losses expected (including equity loss, legal fees, regulatory fines, class action claims, PR expenses, notification costs and other expenses).</p><p>It is being reported that:&nbsp;<meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>Global Microsoft-CrowdStrike Outage Impact</title></p><ul><li>5+ million computers have been impacted.</li><li>Fortune 500 expect $5.4 billion in direct cost impacts.</li><li>Cyber Insurers expect to pay out $1.5 billion in claims.</li><li>Delta, America\'s second biggest airline, canceled 5,000 flights, disrupting travel for millions.</li><li>CrowdStrike’s cyber security services are used by 298 of the Fortune 500 companies, 538 of the Fortune 1000 companies, and 8 out of 10 of the top financial firms.</li><li>163 companies have been directly impacted by this outage hosted on Microsoft cloud services. (a full list of these companies can be found at <a href=\"https://www.techbusinessnews.com.au/news/list-of-companies-affected-by-the-microsoft-crowdstrike-outage/\">List Of Companies Affected By The Global Microsoft-Crowdstrike Outage - Tech Business News</a>) This does not include the companies impacted which host their own servers or who use other cloud services and CrowdStrike Falcon endpoint detection and response services.</li><li>At least one putative class action lawsuit from investors arguing they were misled by the company and told its technology was \"validated, tested and certified\" before a faulty update triggered a global IT outage.</li></ul><p><em><strong>“We got a taste of what a global cyberattack would look like.”</strong></em></p><p>Ian Thornton-Trump, CISO at Cyjax has commented:</p><p>\"We learned a valuable lesson about the fragility of our infrastructure,\" Thornton-Trump said.<strong> \"We also learned how dangerous - we got a taste of what a global cyberattack would look like</strong> … I feel like we are at one of those inflection moments.\"</p><p>As reported by Reach Chase DiFeliciantonio in the San Franciso Chronicle:</p><p><em>CrowdStrike’s widespread deployment across industry and government itself reflect a kind of critical security flaw, said Professor Ahmed Banafa at San Jose State University, who teaches courses on computer networking, operating systems, and cybersecurity. Friday’s incident appears to have been human error, “But what if this (had been) done intentionally?” he said.</em></p><p><em>“If you can bring millions of computers down, that is a single point of failure,” Banafa added. “I think Microsoft is really going to think about their relationship with CrowdStrike given what happened today.”</em></p><p><strong>Global IT Supply Chain Implications and Impacts</strong></p><p>Interros, a Supply Chain Risk Intelligence Company, in their CrowdStrike Outage Analysis reports:</p><p><em>CrowdStrike was involved in a global IT outage that has<strong> highlighted the vulnerability of interconnected global supply chains. The outage impacted 674,620 direct customer relationships of CrowdStrike and Microsoft, and over 49 million indirectly,</strong> according to Interros data. While the U.S. was the most affected country, with 41% of impacted entities, the disruption was also felt at major ports and air freight hubs in Europe and Asia. Ports from New York to Los Angeles and Rotterdam reported temporary shutdowns, while air freight suffered the hardest blow, with thousands of flights grounded or delayed. The outage exacerbates existing supply chain challenges amid rising global demand and freight prices, highlighting the potential long-term implications for global trade and finance.</em></p><p><em>Interros analyzed the extended supply chains of both CrowdStrike and Microsoft, whose Microsoft 365 systems were disrupted as part of a CrowdStrike update, leading to outages for Microsoft users across the world. When examining the direct customer relationships (Tier 1) of both Microsoft and CrowdStrike, Interros was able to identify 674,620 customer relationships.&nbsp;<strong> When expanding the scope of impact to include the customers of Microsoft and CrowdStrike’s customers (Tier 2), the number of customer relationships identified by Interros data grows to over 28 million, and when going one step further (Tier 3), that figure to over 49 million customer relationships.</strong></em></p><p><strong>Root Cause?</strong></p><p>There is ample reporting by CrowdStrike and the media as to the root cause of this cyber event being a bug / failure in CrowdStrike’s automated software testing which did not “catch” the software “bug” in their channel file 291 software update to their Falcon End Point Threat Data file (Detection and Response endpoint device software).</p><p><strong>REALLY?</strong></p><p>&nbsp;</p><p>A more discerning view should be asking these questions of CrowdStrike:</p><ul><li>As a prime top tier global supplier of cyber security services, why do you and did you push out a global patch to all your customers at the exact same instant?</li><li>Why did you not test your patch on target safe zone environments prior to pushing it out?</li><li>Why did you not push this update / patch out to you customers incrementally as a best practice, to minimize the potential impacts in the event of such a failure as this?</li><li>What are and where were your governance and controls for software quality test and assurance?</li></ul><p>A more discerning view should be asking these questions of customers of CrowdStrike:</p><ul><li>As a customer of CrowdStrike, why do you allow a third party to auto-push a patch directly onto your production operations servers?</li><li>Why do you not test third party software patches in a safe zone prior to widespread software update / patch deployment?</li><li>What are and where were your governance and controls for software quality test and assurance?</li></ul><p>&nbsp;</p><p>&nbsp;</p><p><strong>Security focusing only on Design aspects of Complex Systems will ensure Cyber Insecurity</strong></p><p>In my last post I commented that digital systems do not stand alone as technology systems only. As soon as we deploy technology, the technology enters the realm of becoming a system, interconnecting, and interacting with other systems with which our business operates. These systems and interconnections extend throughout our organizations, as well as throughout out our Ter 1 extended customer and supplier interconnections, our Tier 2 extended customer and supplier interconnections, our Tier 3 extended customer and suppler interconnections, and so on.</p><p>These business systems are comprised of benevolent technology, people, and processes interconnecting our business with our customers and suppliers, as well as the shared open systems we use, such as the world wide web and internet. Unfortunately, bad actors also use the open and shared internet and world wide web systems with the sole purpose to compromise our business operations. So, … focusing only on the secure design of technology products is not enough to Secure our Businesses by Design.</p><p>&nbsp;</p><p><strong>Cyber Events of minor and / or catastrophic consequences can also be triggered by non-bad actors from anywhere within our extended customer and supplier chains.</strong></p><p>The very nature of the complex interconnections of digital systems mandates that Security by Design requires that all aspects of security design and operations work in concert continually across all Tiers of our organization + customer + supplier chain. Any gaps, mistakes, or lack of attentiveness by those who use, support, or operate our systems, including those responsible for oversight and assurance, will guarantee a cybersecurity compromise, either by bad actors or by “own or customer or supplier” actors.</p><p>&nbsp;</p><img src=\"/sites/default/files/inline-images/Security%20by%20design%2012.png\" data-entity-uuid=\"2e2f4008-dba1-488b-baa4-8000d706ff93\" data-entity-type=\"file\" width=\"900\" height=\"884\"><p>&nbsp;</p><p><br><strong>Security by Design&nbsp;</strong></p><p>People / Process</p><p>People / Data</p><p>People / Technology</p><p>Process / People</p><p>Process / Data</p><p>Process / Technology</p><p>Technology / People</p><p>Technology / Data</p><p>Technology / Process</p><p>Data / Process</p><p>Data / People</p><p>Data / Technology</p><p>&nbsp;</p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>&nbsp;</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Special Advisor for Risk and Cybersecurity to DivIHN, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>&nbsp;</p><p>&nbsp;</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,89,222,'en',0,'<p>My blog posts here mostly focus on the complexity of systems supporting business operations, the complicating factors of our reliance on the internet for business communications and commerce, the extended risk and value chain of multiple layers of suppliers and customers engaged with our businesses, and the roles and methods of managing information security management in large and small interconnected businesses. <strong>Today I am going to focus narrowly on the role of the Chief Information Security Officer (CISO).</strong></p><p>I have been engaged in information technology for enough years to have witnessed the birth of the role of the Chief Information Security Officer. In the early days of my career, we did not have such a role in an IT organization. We had roles for Security Managers reporting to the Chief Information Officer (CIO) or Chief Technology Officer (CTO) and even lower in the hierarchy of Information Technology organizational structures. Indeed, I was once designated Security Manager for a large aerospace company back in the long-ago times of the 1980’s. In another stage of my career, I served as an SVP level Chief Security Officer for a large multi-national outsourcing firm with multiple CISOs and Security Officers (SOs) reporting to me. The reason I am turning to the CISO role today is that I recently read an article which declared that:</p><p><em><strong>“To put it bluntly, the CISO role is dead.”</strong></em></p><p>Quite a striking comment, especially if you hold a CISO title in an organization today. Normally when I include someone else’s words in one of my posts I include an attribution to that person as the source or author. In this case the article was attributed to an online forum for a for profit company, not an individual author, and I have chosen not to provide pro bono advertising.</p><p>When I read this comment, it really caught my attention.<strong> “The CISO role is dead” </strong>is a strong statement which resonates with what I am seeing and experiencing today in many organizations. Maybe the CISO role has outlived its purpose or is now facing a need to evolve.</p><p><em><strong>The threats and risks our businesses face today are at the highest level of systemic digital risk I have experienced in my +45 years in the Information Technology industry.</strong></em></p><p><em><strong>&amp;</strong></em></p><p><em><strong>Information Technology organizations no longer control all the information technology devices and systems in use in their organizations today.</strong></em></p><p>Maybe it is time for the CISO role to evolve or morph into something new, a role which truly addresses the need for a holistic approach to managing systemic information risk inherent in our complex digital systems. If so, what should this new role look like? Is it time to break out of the Information Technology organizational driven focus of Information Security and elevate a company’s focus on and treatment of Information Security Risk? Should this role be a part of an Information Technology function, or should it be part of a broader approach to managing business risk and reside elsewhere in a business organization?</p><p><em><strong>IT Risk = Business Risk</strong></em></p><p>If we accept that all IT risk is Business Risk, then we should logically accept that managing information risk should not reside solely within an information technology organization. Thus, I propose that two changes are needed to adequately address the inherent systemic risk in our complex digital systems. The first is a new role. The second is that the new role should not be placed inside the Information Technology organization.</p><p><strong>Digital Risk and Resilience Officer</strong></p><p>This role, Digital Risk and Resilience Officer (DRRO), should be part of a business’s Enterprise Risk Management (ERM) function and may or may not exist as the only senior role addressing information risk and security. I envision that many information Technology organizations may elect to maintain a traditional Chief Information Security Officer (CISO) role solely focused internally within the IT organization. If so, I suggest that the role should no longer be called a “Chief” role, but rather be titled as an Information Security Officer role. As many business organizations already embrace Enterprise Risk Management and have a senior leadership role for a Chief Risk Officer (CRO), I envision that the emerging DRRO role would report to the Chief Risk Officer and collaborate with both the CRO and the IT Information Security Officer (ISO). The Digital Risk and Resilience Officer role should represent a significant evolution in purpose, responsibility and vision for dealing with the threats and systemic risks our businesses now face every day.</p><p>I would encourage you all to think about the potential of a Digital Risk and Resilience Officer role and focus as an evolution needed in Information Security which will be more encompassing and vital to the success of your business’s future.</p><p>In my next bog post, I will expand on my thoughts concerning a Digital Risk and Resilience Officer role.</p><p>&nbsp;</p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Special Advisor for Risk and Cybersecurity to DivIHN, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,89,233,'en',0,'<p>My blog posts here mostly focus on the complexity of systems supporting business operations, the complicating factors of our reliance on the internet for business communications and commerce, the extended risk and value chain of multiple layers of suppliers and customers engaged with our businesses, and the roles and methods of managing information security management in large and small interconnected businesses. <strong>Today I am going to focus narrowly on the role of the Chief Information Security Officer (CISO).</strong></p><p>I have been engaged in information technology for enough years to have witnessed the birth of the role of the Chief Information Security Officer. In the early days of my career, we did not have such a role in an IT organization. We had roles for Security Managers reporting to the Chief Information Officer (CIO) or Chief Technology Officer (CTO) and even lower in the hierarchy of Information Technology organizational structures. Indeed, I was once designated Security Manager for a large aerospace company back in the long-ago times of the 1980’s. In another stage of my career, I served as an SVP level Chief Security Officer for a large multi-national outsourcing firm with multiple CISOs and Security Officers (SOs) reporting to me. The reason I am turning to the CISO role today is that I recently read an article which declared that:</p><p><em><strong>“To put it bluntly, the CISO role is dead.”</strong></em></p><p>Quite a striking comment, especially if you hold a CISO title in an organization today. Normally when I include someone else’s words in one of my posts I include an attribution to that person as the source or author. In this case the article was attributed to an online forum for a for profit company, not an individual author, and I have chosen not to provide pro bono advertising.</p><p>When I read this comment, it really caught my attention.<strong> “The CISO role is dead” </strong>is a strong statement which resonates with what I am seeing and experiencing today in many organizations. Maybe the CISO role has outlived its purpose or is now facing a need to evolve.</p><p><em><strong>The threats and risks our businesses face today are at the highest level of systemic digital risk I have experienced in my +45 years in the Information Technology industry.</strong></em></p><p><em><strong>&amp;</strong></em></p><p><em><strong>Information Technology organizations no longer control all the information technology devices and systems in use in their organizations today.</strong></em></p><p>Maybe it is time for the CISO role to evolve or morph into something new, a role which truly addresses the need for a holistic approach to managing systemic information risk inherent in our complex digital systems. If so, what should this new role look like? Is it time to break out of the Information Technology organizational driven focus of Information Security and elevate a company’s focus on and treatment of Information Security Risk? Should this role be a part of an Information Technology function, or should it be part of a broader approach to managing business risk and reside elsewhere in a business organization?</p><p><em><strong>IT Risk = Business Risk</strong></em></p><p>If we accept that all IT risk is Business Risk, then we should logically accept that managing information risk should not reside solely within an information technology organization. Thus, I propose that two changes are needed to adequately address the inherent systemic risk in our complex digital systems. The first is a new role. The second is that the new role should not be placed inside the Information Technology organization.</p><p><strong>Digital Risk and Resilience Officer</strong></p><p>This role, Digital Risk and Resilience Officer (DRRO), should be part of a business’s Enterprise Risk Management (ERM) function and may or may not exist as the only senior role addressing information risk and security. I envision that many information Technology organizations may elect to maintain a traditional Chief Information Security Officer (CISO) role solely focused internally within the IT organization. If so, I suggest that the role should no longer be called a “Chief” role, but rather be titled as an Information Security Officer role. As many business organizations already embrace Enterprise Risk Management and have a senior leadership role for a Chief Risk Officer (CRO), I envision that the emerging DRRO role would report to the Chief Risk Officer and collaborate with both the CRO and the IT Information Security Officer (ISO). The Digital Risk and Resilience Officer role should represent a significant evolution in purpose, responsibility and vision for dealing with the threats and systemic risks our businesses now face every day.</p><p>I would encourage you all to think about the potential of a Digital Risk and Resilience Officer role and focus as an evolution needed in Information Security which will be more encompassing and vital to the success of your business’s future.</p><p>In my next bog post, I will expand on my thoughts concerning a Digital Risk and Resilience Officer role.</p><p>&nbsp;</p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Special Advisor for Risk and Cybersecurity to DivIHN, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,89,407,'en',0,'<p>My blog posts here mostly focus on the complexity of systems supporting business operations, the complicating factors of our reliance on the internet for business communications and commerce, the extended risk and value chain of multiple layers of suppliers and customers engaged with our businesses, and the roles and methods of managing information security management in large and small interconnected businesses. <strong>Today I am going to focus narrowly on the role of the Chief Information Security Officer (CISO).</strong></p><p>I have been engaged in information technology for enough years to have witnessed the birth of the role of the Chief Information Security Officer. In the early days of my career, we did not have such a role in an IT organization. We had roles for Security Managers reporting to the Chief Information Officer (CIO) or Chief Technology Officer (CTO) and even lower in the hierarchy of Information Technology organizational structures. Indeed, I was once designated Security Manager for a large aerospace company back in the long-ago times of the 1980’s. In another stage of my career, I served as an SVP level Chief Security Officer for a large multi-national outsourcing firm with multiple CISOs and Security Officers (SOs) reporting to me. The reason I am turning to the CISO role today is that I recently read an article which declared that:</p><p><em><strong>“To put it bluntly, the CISO role is dead.”</strong></em></p><p>Quite a striking comment, especially if you hold a CISO title in an organization today. Normally when I include someone else’s words in one of my posts I include an attribution to that person as the source or author. In this case the article was attributed to an online forum for a for profit company, not an individual author, and I have chosen not to provide pro bono advertising.</p><p>When I read this comment, it really caught my attention.<strong> “The CISO role is dead” </strong>is a strong statement which resonates with what I am seeing and experiencing today in many organizations. Maybe the CISO role has outlived its purpose or is now facing a need to evolve.</p><p><em><strong>The threats and risks our businesses face today are at the highest level of systemic digital risk I have experienced in my +45 years in the Information Technology industry.</strong></em></p><p><em><strong>&amp;</strong></em></p><p><em><strong>Information Technology organizations no longer control all the information technology devices and systems in use in their organizations today.</strong></em></p><p>Maybe it is time for the CISO role to evolve or morph into something new, a role which truly addresses the need for a holistic approach to managing systemic information risk inherent in our complex digital systems. If so, what should this new role look like? Is it time to break out of the Information Technology organizational driven focus of Information Security and elevate a company’s focus on and treatment of Information Security Risk? Should this role be a part of an Information Technology function, or should it be part of a broader approach to managing business risk and reside elsewhere in a business organization?</p><p><em><strong>IT Risk = Business Risk</strong></em></p><p>If we accept that all IT risk is Business Risk, then we should logically accept that managing information risk should not reside solely within an information technology organization. Thus, I propose that two changes are needed to adequately address the inherent systemic risk in our complex digital systems. The first is a new role. The second is that the new role should not be placed inside the Information Technology organization.</p><p><strong>Digital Risk and Resilience Officer</strong></p><p>This role, Digital Risk and Resilience Officer (DRRO), should be part of a business’s Enterprise Risk Management (ERM) function and may or may not exist as the only senior role addressing information risk and security. I envision that many information Technology organizations may elect to maintain a traditional Chief Information Security Officer (CISO) role solely focused internally within the IT organization. If so, I suggest that the role should no longer be called a “Chief” role, but rather be titled as an Information Security Officer role. As many business organizations already embrace Enterprise Risk Management and have a senior leadership role for a Chief Risk Officer (CRO), I envision that the emerging DRRO role would report to the Chief Risk Officer and collaborate with both the CRO and the IT Information Security Officer (ISO). The Digital Risk and Resilience Officer role should represent a significant evolution in purpose, responsibility and vision for dealing with the threats and systemic risks our businesses now face every day.</p><p>I would encourage you all to think about the potential of a Digital Risk and Resilience Officer role and focus as an evolution needed in Information Security which will be more encompassing and vital to the success of your business’s future.</p><p>In my next bog post, I will expand on my thoughts concerning a Digital Risk and Resilience Officer role.</p><p>&nbsp;</p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Special Advisor for Risk and Cybersecurity to DivIHN, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,89,489,'en',0,'<p>My blog posts here mostly focus on the complexity of systems supporting business operations, the complicating factors of our reliance on the internet for business communications and commerce, the extended risk and value chain of multiple layers of suppliers and customers engaged with our businesses, and the roles and methods of managing information security management in large and small interconnected businesses. <strong>Today I am going to focus narrowly on the role of the Chief Information Security Officer (CISO).</strong></p><p>I have been engaged in information technology for enough years to have witnessed the birth of the role of the Chief Information Security Officer. In the early days of my career, we did not have such a role in an IT organization. We had roles for Security Managers reporting to the Chief Information Officer (CIO) or Chief Technology Officer (CTO) and even lower in the hierarchy of Information Technology organizational structures. Indeed, I was once designated Security Manager for a large aerospace company back in the long-ago times of the 1980’s. In another stage of my career, I served as an SVP level Chief Security Officer for a large multi-national outsourcing firm with multiple CISOs and Security Officers (SOs) reporting to me. The reason I am turning to the CISO role today is that I recently read an article which declared that:</p><p><em><strong>“To put it bluntly, the CISO role is dead.”</strong></em></p><p>Quite a striking comment, especially if you hold a CISO title in an organization today. Normally when I include someone else’s words in one of my posts I include an attribution to that person as the source or author. In this case the article was attributed to an online forum for a for profit company, not an individual author, and I have chosen not to provide pro bono advertising.</p><p>When I read this comment, it really caught my attention.<strong> “The CISO role is dead” </strong>is a strong statement which resonates with what I am seeing and experiencing today in many organizations. Maybe the CISO role has outlived its purpose or is now facing a need to evolve.</p><p><em><strong>The threats and risks our businesses face today are at the highest level of systemic digital risk I have experienced in my +45 years in the Information Technology industry.</strong></em></p><p><em><strong>&amp;</strong></em></p><p><em><strong>Information Technology organizations no longer control all the information technology devices and systems in use in their organizations today.</strong></em></p><p>Maybe it is time for the CISO role to evolve or morph into something new, a role which truly addresses the need for a holistic approach to managing systemic information risk inherent in our complex digital systems. If so, what should this new role look like? Is it time to break out of the Information Technology organizational driven focus of Information Security and elevate a company’s focus on and treatment of Information Security Risk? Should this role be a part of an Information Technology function, or should it be part of a broader approach to managing business risk and reside elsewhere in a business organization?</p><p><em><strong>IT Risk = Business Risk</strong></em></p><p>If we accept that all IT risk is Business Risk, then we should logically accept that managing information risk should not reside solely within an information technology organization. Thus, I propose that two changes are needed to adequately address the inherent systemic risk in our complex digital systems. The first is a new role. The second is that the new role should not be placed inside the Information Technology organization.</p><p><strong>Digital Risk and Resilience Officer</strong></p><p>This role, Digital Risk and Resilience Officer (DRRO), should be part of a business’s Enterprise Risk Management (ERM) function and may or may not exist as the only senior role addressing information risk and security. I envision that many information Technology organizations may elect to maintain a traditional Chief Information Security Officer (CISO) role solely focused internally within the IT organization. If so, I suggest that the role should no longer be called a “Chief” role, but rather be titled as an Information Security Officer role. As many business organizations already embrace Enterprise Risk Management and have a senior leadership role for a Chief Risk Officer (CRO), I envision that the emerging DRRO role would report to the Chief Risk Officer and collaborate with both the CRO and the IT Information Security Officer (ISO). The Digital Risk and Resilience Officer role should represent a significant evolution in purpose, responsibility and vision for dealing with the threats and systemic risks our businesses now face every day.</p><p>I would encourage you all to think about the potential of a Digital Risk and Resilience Officer role and focus as an evolution needed in Information Security which will be more encompassing and vital to the success of your business’s future.</p><p>In my next bog post, I will expand on my thoughts concerning a Digital Risk and Resilience Officer role.</p><p>&nbsp;</p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Special Advisor for Risk and Cybersecurity to DivIHN, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,89,569,'en',0,'<p>My blog posts here mostly focus on the complexity of systems supporting business operations, the complicating factors of our reliance on the internet for business communications and commerce, the extended risk and value chain of multiple layers of suppliers and customers engaged with our businesses, and the roles and methods of managing information security management in large and small interconnected businesses. <strong>Today I am going to focus narrowly on the role of the Chief Information Security Officer (CISO).</strong></p><p>I have been engaged in information technology for enough years to have witnessed the birth of the role of the Chief Information Security Officer. In the early days of my career, we did not have such a role in an IT organization. We had roles for Security Managers reporting to the Chief Information Officer (CIO) or Chief Technology Officer (CTO) and even lower in the hierarchy of Information Technology organizational structures. Indeed, I was once designated Security Manager for a large aerospace company back in the long-ago times of the 1980’s. In another stage of my career, I served as an SVP level Chief Security Officer for a large multi-national outsourcing firm with multiple CISOs and Security Officers (SOs) reporting to me. The reason I am turning to the CISO role today is that I recently read an article which declared that:</p><p><em><strong>“To put it bluntly, the CISO role is dead.”</strong></em></p><p>Quite a striking comment, especially if you hold a CISO title in an organization today. Normally when I include someone else’s words in one of my posts I include an attribution to that person as the source or author. In this case the article was attributed to an online forum for a for profit company, not an individual author, and I have chosen not to provide pro bono advertising.</p><p>When I read this comment, it really caught my attention.<strong> “The CISO role is dead” </strong>is a strong statement which resonates with what I am seeing and experiencing today in many organizations. Maybe the CISO role has outlived its purpose or is now facing a need to evolve.</p><p><em><strong>The threats and risks our businesses face today are at the highest level of systemic digital risk I have experienced in my +45 years in the Information Technology industry.</strong></em></p><p><em><strong>&amp;</strong></em></p><p><em><strong>Information Technology organizations no longer control all the information technology devices and systems in use in their organizations today.</strong></em></p><p>Maybe it is time for the CISO role to evolve or morph into something new, a role which truly addresses the need for a holistic approach to managing systemic information risk inherent in our complex digital systems. If so, what should this new role look like? Is it time to break out of the Information Technology organizational driven focus of Information Security and elevate a company’s focus on and treatment of Information Security Risk? Should this role be a part of an Information Technology function, or should it be part of a broader approach to managing business risk and reside elsewhere in a business organization?</p><p><em><strong>IT Risk = Business Risk</strong></em></p><p>If we accept that all IT risk is Business Risk, then we should logically accept that managing information risk should not reside solely within an information technology organization. Thus, I propose that two changes are needed to adequately address the inherent systemic risk in our complex digital systems. The first is a new role. The second is that the new role should not be placed inside the Information Technology organization.</p><p><strong>Digital Risk and Resilience Officer</strong></p><p>This role, Digital Risk and Resilience Officer (DRRO), should be part of a business’s Enterprise Risk Management (ERM) function and may or may not exist as the only senior role addressing information risk and security. I envision that many information Technology organizations may elect to maintain a traditional Chief Information Security Officer (CISO) role solely focused internally within the IT organization. If so, I suggest that the role should no longer be called a “Chief” role, but rather be titled as an Information Security Officer role. As many business organizations already embrace Enterprise Risk Management and have a senior leadership role for a Chief Risk Officer (CRO), I envision that the emerging DRRO role would report to the Chief Risk Officer and collaborate with both the CRO and the IT Information Security Officer (ISO). The Digital Risk and Resilience Officer role should represent a significant evolution in purpose, responsibility and vision for dealing with the threats and systemic risks our businesses now face every day.</p><p>I would encourage you all to think about the potential of a Digital Risk and Resilience Officer role and focus as an evolution needed in Information Security which will be more encompassing and vital to the success of your business’s future.</p><p>In my next bog post, I will expand on my thoughts concerning a Digital Risk and Resilience Officer role.</p><p>&nbsp;</p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Special Advisor for Risk and Cybersecurity to DivIHN, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,89,644,'en',0,'<p>My blog posts here mostly focus on the complexity of systems supporting business operations, the complicating factors of our reliance on the internet for business communications and commerce, the extended risk and value chain of multiple layers of suppliers and customers engaged with our businesses, and the roles and methods of managing information security management in large and small interconnected businesses. <strong>Today I am going to focus narrowly on the role of the Chief Information Security Officer (CISO).</strong></p><p>I have been engaged in information technology for enough years to have witnessed the birth of the role of the Chief Information Security Officer. In the early days of my career, we did not have such a role in an IT organization. We had roles for Security Managers reporting to the Chief Information Officer (CIO) or Chief Technology Officer (CTO) and even lower in the hierarchy of Information Technology organizational structures. Indeed, I was once designated Security Manager for a large aerospace company back in the long-ago times of the 1980’s. In another stage of my career, I served as an SVP level Chief Security Officer for a large multi-national outsourcing firm with multiple CISOs and Security Officers (SOs) reporting to me. The reason I am turning to the CISO role today is that I recently read an article which declared that:</p><p><em><strong>“To put it bluntly, the CISO role is dead.”</strong></em></p><p>Quite a striking comment, especially if you hold a CISO title in an organization today. Normally when I include someone else’s words in one of my posts I include an attribution to that person as the source or author. In this case the article was attributed to an online forum for a for profit company, not an individual author, and I have chosen not to provide pro bono advertising.</p><p>When I read this comment, it really caught my attention.<strong> “The CISO role is dead” </strong>is a strong statement which resonates with what I am seeing and experiencing today in many organizations. Maybe the CISO role has outlived its purpose or is now facing a need to evolve.</p><p><em><strong>The threats and risks our businesses face today are at the highest level of systemic digital risk I have experienced in my +45 years in the Information Technology industry.</strong></em></p><p><em><strong>&amp;</strong></em></p><p><em><strong>Information Technology organizations no longer control all the information technology devices and systems in use in their organizations today.</strong></em></p><p>Maybe it is time for the CISO role to evolve or morph into something new, a role which truly addresses the need for a holistic approach to managing systemic information risk inherent in our complex digital systems. If so, what should this new role look like? Is it time to break out of the Information Technology organizational driven focus of Information Security and elevate a company’s focus on and treatment of Information Security Risk? Should this role be a part of an Information Technology function, or should it be part of a broader approach to managing business risk and reside elsewhere in a business organization?</p><p><em><strong>IT Risk = Business Risk</strong></em></p><p>If we accept that all IT risk is Business Risk, then we should logically accept that managing information risk should not reside solely within an information technology organization. Thus, I propose that two changes are needed to adequately address the inherent systemic risk in our complex digital systems. The first is a new role. The second is that the new role should not be placed inside the Information Technology organization.</p><p><strong>Digital Risk and Resilience Officer</strong></p><p>This role, Digital Risk and Resilience Officer (DRRO), should be part of a business’s Enterprise Risk Management (ERM) function and may or may not exist as the only senior role addressing information risk and security. I envision that many information Technology organizations may elect to maintain a traditional Chief Information Security Officer (CISO) role solely focused internally within the IT organization. If so, I suggest that the role should no longer be called a “Chief” role, but rather be titled as an Information Security Officer role. As many business organizations already embrace Enterprise Risk Management and have a senior leadership role for a Chief Risk Officer (CRO), I envision that the emerging DRRO role would report to the Chief Risk Officer and collaborate with both the CRO and the IT Information Security Officer (ISO). The Digital Risk and Resilience Officer role should represent a significant evolution in purpose, responsibility and vision for dealing with the threats and systemic risks our businesses now face every day.</p><p>I would encourage you all to think about the potential of a Digital Risk and Resilience Officer role and focus as an evolution needed in Information Security which will be more encompassing and vital to the success of your business’s future.</p><p>In my next bog post, I will expand on my thoughts concerning a Digital Risk and Resilience Officer role.</p><p>&nbsp;</p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Special Advisor for Risk and Cybersecurity to DivIHN, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,90,223,'en',0,'<p>I began my last blog post by quoting from a business forum I had read:</p><p><em><strong>“To put it bluntly, the CISO role is dead.”</strong></em></p><p>And I closed my last post saying that I would encourage you all to think about the potential of a Digital Risk and Resilience Officer role and focus as an evolution needed in Information Security which will be more encompassing and vital to the success of your business’s future.</p><p>Some of you who read my last post may have dismissed my comment as out of hand. Others may have read a bit deeper into my comments and your reaction, at least internally, were that Joe has no clue what he is talking about. Just maybe, one or two of you may have thought about my comments and said to yourself, he may be onto something.</p><p>I do not claim to have all the clues, but I can assure you that throughout my career I have prided myself in working hard to ensure I had at least half a clue concerning what was going on around me in my professional domain.</p><p>It is a fair bet for me to say again today that:</p><p><em><strong>The threats and risks our businesses face today are at the highest level of systemic digital risk I have experienced in my 45+ years in the Information Technology industry.</strong></em></p><p><em><strong>&amp;</strong></em></p><p><em><strong>Information Technology organizations no longer control all the information technology devices and systems in use in their organizations today.</strong></em></p><p>Let me take this one step further:</p><p><em><strong>“Never in the history of modern business operations has there been a risk domain as impactful as Information Technology. Information Technology and Digital Business Systems are the only risk domain which can bring my company’s business operations to a complete standstill in an instant!”</strong></em></p><p>This is a quote from a discussion I recently had with the head of Enterprise Risk Management for a multi-billon dollar business. My conversations during the past year with many Chief Risk Officers, Enterprise Risk Managers and Chief Information Security Officers have all led me to form my opinion that it is time to start thinking about and acting on the notion that the CISO role as we know it today is past its shelf life, and it is time to seriously embrace a Digital Risk and Resilience Officer role.</p><p><strong>The CISO role as we know it today is past its shelf life.</strong></p><p><strong>It is time to embrace the</strong></p><p><strong>Digital Risk and Resilience Officer role.</strong></p><img src=\"/sites/default/files/inline-images/Security%20by%20design%2014.png\" data-entity-uuid=\"02ed5747-2c9b-41b1-8da1-f56c4f693797\" data-entity-type=\"file\" width=\"900\" height=\"394\"><p>&nbsp;</p><p>&nbsp;The traditional CISO role is intended to address the protection of an organization’s information technology, digital business systems, and data from attacks. This is often focused on external threats and can also include controls to address internal misuse of information systems and data. This is a narrow focus given the widespread use of digital systems, data, communications and workplace technologies in use throughout businesses, their customer chains and supply chains. While cybersecurity risk management focuses on cyber threats and recovery of information technology systems, it is a focus which rarely addresses the impacts to the rest of a business organization.</p><p>Enterprises Risk Management acknowledges cybersecurity threats and risks, but sees these risks through a CISO’s eye, usually not through the eyes of your business. I have found it rare when speaking with ERM leaders and Chief Risk Officers to find a fully integrative understanding of the true extent of digital disruption impacts and the need for a business integrative approach to ensure digital resilience when recovering from such business disruptions.</p><p>Another impediment to embracing Digital Resilience, a required new core competence, is what I call grade / position inflation in cybersecurity. Prior to 1995, I do not think there was any role in business for information technology entitled Chief Information Security Officer. There were roles in the 1970’s and 1980’s for information technology security and the role of information technology security manager was common. Steve Katz is credited as the first person appointed to a Chief Information Technology Officer role by Citi Bank in 1995 after Citi Bank suffered a series of successful cyber security attacks by Russian hackers. In the 1990’s and into the early 2000’s it was common to have an information technology security manager role reporting to a Chief Information Officer or a Chief Technology Officer. This role was often filled by a manager or director level position. As the frequency of cybersecurity attacks escalated through the 2000’s, and business impacts became larger, we begin to see the escalation of information technology security managers to higher grade levels. There was something Darwinian about the escalation of security managers to Chief Information Security Managers and further to Director and Officer roles. Today it is not uncommon to see CISO roles as Vice Presidents or Senior Vice Presidents reporting to Chief Information Officers and even to reporting lines directly to business Chief Executive Officers. Raising the position and salary levels of CISOs does not directly translate to significantly improved cybersecurity or digital resilience. Organization performance, in my experience, even for cybersecurity and digital resilience, is primary driven by organizational culture, strong governance, professional competence and employing a right role, right person approach.</p><p><strong>A Very Simple Equation</strong></p><p>My arriving at my realization for a Digital Risk and Resilience Officer role can be summarized as follows:</p><ul><li>Chief Risk Officer is a full-time role / Head of ERM is a full-time role.</li><li>CISO / ISO role is a full-time role.</li><li>CISO/ISO attention to Digital Risk and Resilience is a part-time role.</li><li>Digital Risk and Resilience calls for full-time attention given the potential for catastrophic business disruption impacts.</li><li>Thus … Digital Risk and Resilience should be a full-time role.</li><li>While maintaining the traditional Information Security Officer / Manger role.</li></ul><p><strong>The CISO / ISO role is not dead! It is time to embrace a new and improved role focused on</strong></p><p><strong>Digital Risk and Resilience.</strong></p><p>The Digital Risk and Resilience Officer role should represent a significant evolution in purpose, responsibility and vision for dealing with the threats and systemic risks our businesses now face every day. I again encourage you all to think about the potential of a Digital Risk and Resilience Officer role and focus as an evolution needed in Information Security which will be more encompassing and vital to the success of your business’ future.</p><p>In my next bog post, I will expand on what this might mean to CRO/ERM + DRRO integrative business approach to Enterprise Digital Risk and Resiliency.</p><p>&nbsp;</p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Special Advisor for Risk and Cybersecurity to DivIHN, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,90,231,'en',0,'<p>I began my last blog post by quoting from a business forum I had read:</p><p><em><strong>“To put it bluntly, the CISO role is dead.”</strong></em></p><p>And I closed my last post saying that I would encourage you all to think about the potential of a Digital Risk and Resilience Officer role and focus as an evolution needed in Information Security which will be more encompassing and vital to the success of your business’s future.</p><p>Some of you who read my last post may have dismissed my comment as out of hand. Others may have read a bit deeper into my comments and your reaction, at least internally, were that Joe has no clue what he is talking about. Just maybe, one or two of you may have thought about my comments and said to yourself, he may be onto something.</p><p>I do not claim to have all the clues, but I can assure you that throughout my career I have prided myself in working hard to ensure I had at least half a clue concerning what was going on around me in my professional domain.</p><p>It is a fair bet for me to say again today that:</p><p><em><strong>The threats and risks our businesses face today are at the highest level of systemic digital risk I have experienced in my 45+ years in the Information Technology industry.</strong></em></p><p><em><strong>&amp;</strong></em></p><p><em><strong>Information Technology organizations no longer control all the information technology devices and systems in use in their organizations today.</strong></em></p><p>Let me take this one step further:</p><p><em><strong>“Never in the history of modern business operations has there been a risk domain as impactful as Information Technology. Information Technology and Digital Business Systems are the only risk domain which can bring my company’s business operations to a complete standstill in an instant!”</strong></em></p><p>This is a quote from a discussion I recently had with the head of Enterprise Risk Management for a multi-billon dollar business. My conversations during the past year with many Chief Risk Officers, Enterprise Risk Managers and Chief Information Security Officers have all led me to form my opinion that it is time to start thinking about and acting on the notion that the CISO role as we know it today is past its shelf life, and it is time to seriously embrace a Digital Risk and Resilience Officer role.</p><p><strong>The CISO role as we know it today is past its shelf life.</strong></p><p><strong>It is time to embrace the</strong></p><p><strong>Digital Risk and Resilience Officer role.</strong></p><img src=\"/sites/default/files/inline-images/Security%20by%20design%2014.png\" data-entity-uuid=\"02ed5747-2c9b-41b1-8da1-f56c4f693797\" data-entity-type=\"file\" width=\"900\" height=\"394\"><p>&nbsp;</p><p>&nbsp;The traditional CISO role is intended to address the protection of an organization’s information technology, digital business systems, and data from attacks. This is often focused on external threats and can also include controls to address internal misuse of information systems and data. This is a narrow focus given the widespread use of digital systems, data, communications and workplace technologies in use throughout businesses, their customer chains and supply chains. While cybersecurity risk management focuses on cyber threats and recovery of information technology systems, it is a focus which rarely addresses the impacts to the rest of a business organization.</p><p>Enterprises Risk Management acknowledges cybersecurity threats and risks, but sees these risks through a CISO’s eye, usually not through the eyes of your business. I have found it rare when speaking with ERM leaders and Chief Risk Officers to find a fully integrative understanding of the true extent of digital disruption impacts and the need for a business integrative approach to ensure digital resilience when recovering from such business disruptions.</p><p>Another impediment to embracing Digital Resilience, a required new core competence, is what I call grade / position inflation in cybersecurity. Prior to 1995, I do not think there was any role in business for information technology entitled Chief Information Security Officer. There were roles in the 1970’s and 1980’s for information technology security and the role of information technology security manager was common. Steve Katz is credited as the first person appointed to a Chief Information Technology Officer role by Citi Bank in 1995 after Citi Bank suffered a series of successful cyber security attacks by Russian hackers. In the 1990’s and into the early 2000’s it was common to have an information technology security manager role reporting to a Chief Information Officer or a Chief Technology Officer. This role was often filled by a manager or director level position. As the frequency of cybersecurity attacks escalated through the 2000’s, and business impacts became larger, we begin to see the escalation of information technology security managers to higher grade levels. There was something Darwinian about the escalation of security managers to Chief Information Security Managers and further to Director and Officer roles. Today it is not uncommon to see CISO roles as Vice Presidents or Senior Vice Presidents reporting to Chief Information Officers and even to reporting lines directly to business Chief Executive Officers. Raising the position and salary levels of CISOs does not directly translate to significantly improved cybersecurity or digital resilience. Organization performance, in my experience, even for cybersecurity and digital resilience, is primary driven by organizational culture, strong governance, professional competence and employing a right role, right person approach.</p><p><strong>A Very Simple Equation</strong></p><p>My arriving at my realization for a Digital Risk and Resilience Officer role can be summarized as follows:</p><ul><li>Chief Risk Officer is a full-time role / Head of ERM is a full-time role.</li><li>CISO / ISO role is a full-time role.</li><li>CISO/ISO attention to Digital Risk and Resilience is a part-time role.</li><li>Digital Risk and Resilience calls for full-time attention given the potential for catastrophic business disruption impacts.</li><li>Thus … Digital Risk and Resilience should be a full-time role.</li><li>While maintaining the traditional Information Security Officer / Manger role.</li></ul><p><strong>The CISO / ISO role is not dead! It is time to embrace a new and improved role focused on</strong></p><p><strong>Digital Risk and Resilience.</strong></p><p>The Digital Risk and Resilience Officer role should represent a significant evolution in purpose, responsibility and vision for dealing with the threats and systemic risks our businesses now face every day. I again encourage you all to think about the potential of a Digital Risk and Resilience Officer role and focus as an evolution needed in Information Security which will be more encompassing and vital to the success of your business’ future.</p><p>In my next bog post, I will expand on what this might mean to CRO/ERM + DRRO integrative business approach to Enterprise Digital Risk and Resiliency.</p><p>&nbsp;</p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Special Advisor for Risk and Cybersecurity to DivIHN, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,90,232,'en',0,'<p>I began my last blog post by quoting from a business forum I had read:</p><p><em><strong>“To put it bluntly, the CISO role is dead.”</strong></em></p><p>And I closed my last post saying that I would encourage you all to think about the potential of a Digital Risk and Resilience Officer role and focus as an evolution needed in Information Security which will be more encompassing and vital to the success of your business’s future.</p><p>Some of you who read my last post may have dismissed my comment as out of hand. Others may have read a bit deeper into my comments and your reaction, at least internally, were that Joe has no clue what he is talking about. Just maybe, one or two of you may have thought about my comments and said to yourself, he may be onto something.</p><p>I do not claim to have all the clues, but I can assure you that throughout my career I have prided myself in working hard to ensure I had at least half a clue concerning what was going on around me in my professional domain.</p><p>It is a fair bet for me to say again today that:</p><p><em><strong>The threats and risks our businesses face today are at the highest level of systemic digital risk I have experienced in my 45+ years in the Information Technology industry.</strong></em></p><p><em><strong>&amp;</strong></em></p><p><em><strong>Information Technology organizations no longer control all the information technology devices and systems in use in their organizations today.</strong></em></p><p>Let me take this one step further:</p><p><em><strong>“Never in the history of modern business operations has there been a risk domain as impactful as Information Technology. Information Technology and Digital Business Systems are the only risk domain which can bring my company’s business operations to a complete standstill in an instant!”</strong></em></p><p>This is a quote from a discussion I recently had with the head of Enterprise Risk Management for a multi-billon dollar business. My conversations during the past year with many Chief Risk Officers, Enterprise Risk Managers and Chief Information Security Officers have all led me to form my opinion that it is time to start thinking about and acting on the notion that the CISO role as we know it today is past its shelf life, and it is time to seriously embrace a Digital Risk and Resilience Officer role.</p><p><strong>The CISO role as we know it today is past its shelf life.</strong></p><p><strong>It is time to embrace the</strong></p><p><strong>Digital Risk and Resilience Officer role.</strong></p><img src=\"/sites/default/files/inline-images/Security%20by%20design%2014.png\" data-entity-uuid=\"02ed5747-2c9b-41b1-8da1-f56c4f693797\" data-entity-type=\"file\" width=\"900\" height=\"394\"><p>&nbsp;</p><p>&nbsp;The traditional CISO role is intended to address the protection of an organization’s information technology, digital business systems, and data from attacks. This is often focused on external threats and can also include controls to address internal misuse of information systems and data. This is a narrow focus given the widespread use of digital systems, data, communications and workplace technologies in use throughout businesses, their customer chains and supply chains. While cybersecurity risk management focuses on cyber threats and recovery of information technology systems, it is a focus which rarely addresses the impacts to the rest of a business organization.</p><p>Enterprises Risk Management acknowledges cybersecurity threats and risks, but sees these risks through a CISO’s eye, usually not through the eyes of your business. I have found it rare when speaking with ERM leaders and Chief Risk Officers to find a fully integrative understanding of the true extent of digital disruption impacts and the need for a business integrative approach to ensure digital resilience when recovering from such business disruptions.</p><p>Another impediment to embracing Digital Resilience, a required new core competence, is what I call grade / position inflation in cybersecurity. Prior to 1995, I do not think there was any role in business for information technology entitled Chief Information Security Officer. There were roles in the 1970’s and 1980’s for information technology security and the role of information technology security manager was common. Steve Katz is credited as the first person appointed to a Chief Information Technology Officer role by Citi Bank in 1995 after Citi Bank suffered a series of successful cyber security attacks by Russian hackers. In the 1990’s and into the early 2000’s it was common to have an information technology security manager role reporting to a Chief Information Officer or a Chief Technology Officer. This role was often filled by a manager or director level position. As the frequency of cybersecurity attacks escalated through the 2000’s, and business impacts became larger, we begin to see the escalation of information technology security managers to higher grade levels. There was something Darwinian about the escalation of security managers to Chief Information Security Managers and further to Director and Officer roles. Today it is not uncommon to see CISO roles as Vice Presidents or Senior Vice Presidents reporting to Chief Information Officers and even to reporting lines directly to business Chief Executive Officers. Raising the position and salary levels of CISOs does not directly translate to significantly improved cybersecurity or digital resilience. Organization performance, in my experience, even for cybersecurity and digital resilience, is primary driven by organizational culture, strong governance, professional competence and employing a right role, right person approach.</p><p><strong>A Very Simple Equation</strong></p><p>My arriving at my realization for a Digital Risk and Resilience Officer role can be summarized as follows:</p><ul><li>Chief Risk Officer is a full-time role / Head of ERM is a full-time role.</li><li>CISO / ISO role is a full-time role.</li><li>CISO/ISO attention to Digital Risk and Resilience is a part-time role.</li><li>Digital Risk and Resilience calls for full-time attention given the potential for catastrophic business disruption impacts.</li><li>Thus … Digital Risk and Resilience should be a full-time role.</li><li>While maintaining the traditional Information Security Officer / Manger role.</li></ul><p><strong>The CISO / ISO role is not dead! It is time to embrace a new and improved role focused on</strong></p><p><strong>Digital Risk and Resilience.</strong></p><p>The Digital Risk and Resilience Officer role should represent a significant evolution in purpose, responsibility and vision for dealing with the threats and systemic risks our businesses now face every day. I again encourage you all to think about the potential of a Digital Risk and Resilience Officer role and focus as an evolution needed in Information Security which will be more encompassing and vital to the success of your business’ future.</p><p>In my next bog post, I will expand on what this might mean to CRO/ERM + DRRO integrative business approach to Enterprise Digital Risk and Resiliency.</p><p>&nbsp;</p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Special Advisor for Risk and Cybersecurity to DivIHN, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,90,408,'en',0,'<p>I began my last blog post by quoting from a business forum I had read:</p><p><em><strong>“To put it bluntly, the CISO role is dead.”</strong></em></p><p>And I closed my last post saying that I would encourage you all to think about the potential of a Digital Risk and Resilience Officer role and focus as an evolution needed in Information Security which will be more encompassing and vital to the success of your business’s future.</p><p>Some of you who read my last post may have dismissed my comment as out of hand. Others may have read a bit deeper into my comments and your reaction, at least internally, were that Joe has no clue what he is talking about. Just maybe, one or two of you may have thought about my comments and said to yourself, he may be onto something.</p><p>I do not claim to have all the clues, but I can assure you that throughout my career I have prided myself in working hard to ensure I had at least half a clue concerning what was going on around me in my professional domain.</p><p>It is a fair bet for me to say again today that:</p><p><em><strong>The threats and risks our businesses face today are at the highest level of systemic digital risk I have experienced in my 45+ years in the Information Technology industry.</strong></em></p><p><em><strong>&amp;</strong></em></p><p><em><strong>Information Technology organizations no longer control all the information technology devices and systems in use in their organizations today.</strong></em></p><p>Let me take this one step further:</p><p><em><strong>“Never in the history of modern business operations has there been a risk domain as impactful as Information Technology. Information Technology and Digital Business Systems are the only risk domain which can bring my company’s business operations to a complete standstill in an instant!”</strong></em></p><p>This is a quote from a discussion I recently had with the head of Enterprise Risk Management for a multi-billon dollar business. My conversations during the past year with many Chief Risk Officers, Enterprise Risk Managers and Chief Information Security Officers have all led me to form my opinion that it is time to start thinking about and acting on the notion that the CISO role as we know it today is past its shelf life, and it is time to seriously embrace a Digital Risk and Resilience Officer role.</p><p><strong>The CISO role as we know it today is past its shelf life.</strong></p><p><strong>It is time to embrace the</strong></p><p><strong>Digital Risk and Resilience Officer role.</strong></p><img src=\"/sites/default/files/inline-images/Security%20by%20design%2014.png\" data-entity-uuid=\"02ed5747-2c9b-41b1-8da1-f56c4f693797\" data-entity-type=\"file\" width=\"900\" height=\"394\"><p>&nbsp;</p><p>&nbsp;The traditional CISO role is intended to address the protection of an organization’s information technology, digital business systems, and data from attacks. This is often focused on external threats and can also include controls to address internal misuse of information systems and data. This is a narrow focus given the widespread use of digital systems, data, communications and workplace technologies in use throughout businesses, their customer chains and supply chains. While cybersecurity risk management focuses on cyber threats and recovery of information technology systems, it is a focus which rarely addresses the impacts to the rest of a business organization.</p><p>Enterprises Risk Management acknowledges cybersecurity threats and risks, but sees these risks through a CISO’s eye, usually not through the eyes of your business. I have found it rare when speaking with ERM leaders and Chief Risk Officers to find a fully integrative understanding of the true extent of digital disruption impacts and the need for a business integrative approach to ensure digital resilience when recovering from such business disruptions.</p><p>Another impediment to embracing Digital Resilience, a required new core competence, is what I call grade / position inflation in cybersecurity. Prior to 1995, I do not think there was any role in business for information technology entitled Chief Information Security Officer. There were roles in the 1970’s and 1980’s for information technology security and the role of information technology security manager was common. Steve Katz is credited as the first person appointed to a Chief Information Technology Officer role by Citi Bank in 1995 after Citi Bank suffered a series of successful cyber security attacks by Russian hackers. In the 1990’s and into the early 2000’s it was common to have an information technology security manager role reporting to a Chief Information Officer or a Chief Technology Officer. This role was often filled by a manager or director level position. As the frequency of cybersecurity attacks escalated through the 2000’s, and business impacts became larger, we begin to see the escalation of information technology security managers to higher grade levels. There was something Darwinian about the escalation of security managers to Chief Information Security Managers and further to Director and Officer roles. Today it is not uncommon to see CISO roles as Vice Presidents or Senior Vice Presidents reporting to Chief Information Officers and even to reporting lines directly to business Chief Executive Officers. Raising the position and salary levels of CISOs does not directly translate to significantly improved cybersecurity or digital resilience. Organization performance, in my experience, even for cybersecurity and digital resilience, is primary driven by organizational culture, strong governance, professional competence and employing a right role, right person approach.</p><p><strong>A Very Simple Equation</strong></p><p>My arriving at my realization for a Digital Risk and Resilience Officer role can be summarized as follows:</p><ul><li>Chief Risk Officer is a full-time role / Head of ERM is a full-time role.</li><li>CISO / ISO role is a full-time role.</li><li>CISO/ISO attention to Digital Risk and Resilience is a part-time role.</li><li>Digital Risk and Resilience calls for full-time attention given the potential for catastrophic business disruption impacts.</li><li>Thus … Digital Risk and Resilience should be a full-time role.</li><li>While maintaining the traditional Information Security Officer / Manger role.</li></ul><p><strong>The CISO / ISO role is not dead! It is time to embrace a new and improved role focused on</strong></p><p><strong>Digital Risk and Resilience.</strong></p><p>The Digital Risk and Resilience Officer role should represent a significant evolution in purpose, responsibility and vision for dealing with the threats and systemic risks our businesses now face every day. I again encourage you all to think about the potential of a Digital Risk and Resilience Officer role and focus as an evolution needed in Information Security which will be more encompassing and vital to the success of your business’ future.</p><p>In my next bog post, I will expand on what this might mean to CRO/ERM + DRRO integrative business approach to Enterprise Digital Risk and Resiliency.</p><p>&nbsp;</p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Special Advisor for Risk and Cybersecurity to DivIHN, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,90,490,'en',0,'<p>I began my last blog post by quoting from a business forum I had read:</p><p><em><strong>“To put it bluntly, the CISO role is dead.”</strong></em></p><p>And I closed my last post saying that I would encourage you all to think about the potential of a Digital Risk and Resilience Officer role and focus as an evolution needed in Information Security which will be more encompassing and vital to the success of your business’s future.</p><p>Some of you who read my last post may have dismissed my comment as out of hand. Others may have read a bit deeper into my comments and your reaction, at least internally, were that Joe has no clue what he is talking about. Just maybe, one or two of you may have thought about my comments and said to yourself, he may be onto something.</p><p>I do not claim to have all the clues, but I can assure you that throughout my career I have prided myself in working hard to ensure I had at least half a clue concerning what was going on around me in my professional domain.</p><p>It is a fair bet for me to say again today that:</p><p><em><strong>The threats and risks our businesses face today are at the highest level of systemic digital risk I have experienced in my 45+ years in the Information Technology industry.</strong></em></p><p><em><strong>&amp;</strong></em></p><p><em><strong>Information Technology organizations no longer control all the information technology devices and systems in use in their organizations today.</strong></em></p><p>Let me take this one step further:</p><p><em><strong>“Never in the history of modern business operations has there been a risk domain as impactful as Information Technology. Information Technology and Digital Business Systems are the only risk domain which can bring my company’s business operations to a complete standstill in an instant!”</strong></em></p><p>This is a quote from a discussion I recently had with the head of Enterprise Risk Management for a multi-billon dollar business. My conversations during the past year with many Chief Risk Officers, Enterprise Risk Managers and Chief Information Security Officers have all led me to form my opinion that it is time to start thinking about and acting on the notion that the CISO role as we know it today is past its shelf life, and it is time to seriously embrace a Digital Risk and Resilience Officer role.</p><p><strong>The CISO role as we know it today is past its shelf life.</strong></p><p><strong>It is time to embrace the</strong></p><p><strong>Digital Risk and Resilience Officer role.</strong></p><img src=\"/sites/default/files/inline-images/Security%20by%20design%2014.png\" data-entity-uuid=\"02ed5747-2c9b-41b1-8da1-f56c4f693797\" data-entity-type=\"file\" width=\"900\" height=\"394\"><p>&nbsp;</p><p>&nbsp;The traditional CISO role is intended to address the protection of an organization’s information technology, digital business systems, and data from attacks. This is often focused on external threats and can also include controls to address internal misuse of information systems and data. This is a narrow focus given the widespread use of digital systems, data, communications and workplace technologies in use throughout businesses, their customer chains and supply chains. While cybersecurity risk management focuses on cyber threats and recovery of information technology systems, it is a focus which rarely addresses the impacts to the rest of a business organization.</p><p>Enterprises Risk Management acknowledges cybersecurity threats and risks, but sees these risks through a CISO’s eye, usually not through the eyes of your business. I have found it rare when speaking with ERM leaders and Chief Risk Officers to find a fully integrative understanding of the true extent of digital disruption impacts and the need for a business integrative approach to ensure digital resilience when recovering from such business disruptions.</p><p>Another impediment to embracing Digital Resilience, a required new core competence, is what I call grade / position inflation in cybersecurity. Prior to 1995, I do not think there was any role in business for information technology entitled Chief Information Security Officer. There were roles in the 1970’s and 1980’s for information technology security and the role of information technology security manager was common. Steve Katz is credited as the first person appointed to a Chief Information Technology Officer role by Citi Bank in 1995 after Citi Bank suffered a series of successful cyber security attacks by Russian hackers. In the 1990’s and into the early 2000’s it was common to have an information technology security manager role reporting to a Chief Information Officer or a Chief Technology Officer. This role was often filled by a manager or director level position. As the frequency of cybersecurity attacks escalated through the 2000’s, and business impacts became larger, we begin to see the escalation of information technology security managers to higher grade levels. There was something Darwinian about the escalation of security managers to Chief Information Security Managers and further to Director and Officer roles. Today it is not uncommon to see CISO roles as Vice Presidents or Senior Vice Presidents reporting to Chief Information Officers and even to reporting lines directly to business Chief Executive Officers. Raising the position and salary levels of CISOs does not directly translate to significantly improved cybersecurity or digital resilience. Organization performance, in my experience, even for cybersecurity and digital resilience, is primary driven by organizational culture, strong governance, professional competence and employing a right role, right person approach.</p><p><strong>A Very Simple Equation</strong></p><p>My arriving at my realization for a Digital Risk and Resilience Officer role can be summarized as follows:</p><ul><li>Chief Risk Officer is a full-time role / Head of ERM is a full-time role.</li><li>CISO / ISO role is a full-time role.</li><li>CISO/ISO attention to Digital Risk and Resilience is a part-time role.</li><li>Digital Risk and Resilience calls for full-time attention given the potential for catastrophic business disruption impacts.</li><li>Thus … Digital Risk and Resilience should be a full-time role.</li><li>While maintaining the traditional Information Security Officer / Manger role.</li></ul><p><strong>The CISO / ISO role is not dead! It is time to embrace a new and improved role focused on</strong></p><p><strong>Digital Risk and Resilience.</strong></p><p>The Digital Risk and Resilience Officer role should represent a significant evolution in purpose, responsibility and vision for dealing with the threats and systemic risks our businesses now face every day. I again encourage you all to think about the potential of a Digital Risk and Resilience Officer role and focus as an evolution needed in Information Security which will be more encompassing and vital to the success of your business’ future.</p><p>In my next bog post, I will expand on what this might mean to CRO/ERM + DRRO integrative business approach to Enterprise Digital Risk and Resiliency.</p><p>&nbsp;</p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Special Advisor for Risk and Cybersecurity to DivIHN, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,90,570,'en',0,'<p>I began my last blog post by quoting from a business forum I had read:</p><p><em><strong>“To put it bluntly, the CISO role is dead.”</strong></em></p><p>And I closed my last post saying that I would encourage you all to think about the potential of a Digital Risk and Resilience Officer role and focus as an evolution needed in Information Security which will be more encompassing and vital to the success of your business’s future.</p><p>Some of you who read my last post may have dismissed my comment as out of hand. Others may have read a bit deeper into my comments and your reaction, at least internally, were that Joe has no clue what he is talking about. Just maybe, one or two of you may have thought about my comments and said to yourself, he may be onto something.</p><p>I do not claim to have all the clues, but I can assure you that throughout my career I have prided myself in working hard to ensure I had at least half a clue concerning what was going on around me in my professional domain.</p><p>It is a fair bet for me to say again today that:</p><p><em><strong>The threats and risks our businesses face today are at the highest level of systemic digital risk I have experienced in my 45+ years in the Information Technology industry.</strong></em></p><p><em><strong>&amp;</strong></em></p><p><em><strong>Information Technology organizations no longer control all the information technology devices and systems in use in their organizations today.</strong></em></p><p>Let me take this one step further:</p><p><em><strong>“Never in the history of modern business operations has there been a risk domain as impactful as Information Technology. Information Technology and Digital Business Systems are the only risk domain which can bring my company’s business operations to a complete standstill in an instant!”</strong></em></p><p>This is a quote from a discussion I recently had with the head of Enterprise Risk Management for a multi-billon dollar business. My conversations during the past year with many Chief Risk Officers, Enterprise Risk Managers and Chief Information Security Officers have all led me to form my opinion that it is time to start thinking about and acting on the notion that the CISO role as we know it today is past its shelf life, and it is time to seriously embrace a Digital Risk and Resilience Officer role.</p><p><strong>The CISO role as we know it today is past its shelf life.</strong></p><p><strong>It is time to embrace the</strong></p><p><strong>Digital Risk and Resilience Officer role.</strong></p><img src=\"/sites/default/files/inline-images/Security%20by%20design%2014.png\" data-entity-uuid=\"02ed5747-2c9b-41b1-8da1-f56c4f693797\" data-entity-type=\"file\" width=\"900\" height=\"394\"><p>&nbsp;</p><p>&nbsp;The traditional CISO role is intended to address the protection of an organization’s information technology, digital business systems, and data from attacks. This is often focused on external threats and can also include controls to address internal misuse of information systems and data. This is a narrow focus given the widespread use of digital systems, data, communications and workplace technologies in use throughout businesses, their customer chains and supply chains. While cybersecurity risk management focuses on cyber threats and recovery of information technology systems, it is a focus which rarely addresses the impacts to the rest of a business organization.</p><p>Enterprises Risk Management acknowledges cybersecurity threats and risks, but sees these risks through a CISO’s eye, usually not through the eyes of your business. I have found it rare when speaking with ERM leaders and Chief Risk Officers to find a fully integrative understanding of the true extent of digital disruption impacts and the need for a business integrative approach to ensure digital resilience when recovering from such business disruptions.</p><p>Another impediment to embracing Digital Resilience, a required new core competence, is what I call grade / position inflation in cybersecurity. Prior to 1995, I do not think there was any role in business for information technology entitled Chief Information Security Officer. There were roles in the 1970’s and 1980’s for information technology security and the role of information technology security manager was common. Steve Katz is credited as the first person appointed to a Chief Information Technology Officer role by Citi Bank in 1995 after Citi Bank suffered a series of successful cyber security attacks by Russian hackers. In the 1990’s and into the early 2000’s it was common to have an information technology security manager role reporting to a Chief Information Officer or a Chief Technology Officer. This role was often filled by a manager or director level position. As the frequency of cybersecurity attacks escalated through the 2000’s, and business impacts became larger, we begin to see the escalation of information technology security managers to higher grade levels. There was something Darwinian about the escalation of security managers to Chief Information Security Managers and further to Director and Officer roles. Today it is not uncommon to see CISO roles as Vice Presidents or Senior Vice Presidents reporting to Chief Information Officers and even to reporting lines directly to business Chief Executive Officers. Raising the position and salary levels of CISOs does not directly translate to significantly improved cybersecurity or digital resilience. Organization performance, in my experience, even for cybersecurity and digital resilience, is primary driven by organizational culture, strong governance, professional competence and employing a right role, right person approach.</p><p><strong>A Very Simple Equation</strong></p><p>My arriving at my realization for a Digital Risk and Resilience Officer role can be summarized as follows:</p><ul><li>Chief Risk Officer is a full-time role / Head of ERM is a full-time role.</li><li>CISO / ISO role is a full-time role.</li><li>CISO/ISO attention to Digital Risk and Resilience is a part-time role.</li><li>Digital Risk and Resilience calls for full-time attention given the potential for catastrophic business disruption impacts.</li><li>Thus … Digital Risk and Resilience should be a full-time role.</li><li>While maintaining the traditional Information Security Officer / Manger role.</li></ul><p><strong>The CISO / ISO role is not dead! It is time to embrace a new and improved role focused on</strong></p><p><strong>Digital Risk and Resilience.</strong></p><p>The Digital Risk and Resilience Officer role should represent a significant evolution in purpose, responsibility and vision for dealing with the threats and systemic risks our businesses now face every day. I again encourage you all to think about the potential of a Digital Risk and Resilience Officer role and focus as an evolution needed in Information Security which will be more encompassing and vital to the success of your business’ future.</p><p>In my next bog post, I will expand on what this might mean to CRO/ERM + DRRO integrative business approach to Enterprise Digital Risk and Resiliency.</p><p>&nbsp;</p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Special Advisor for Risk and Cybersecurity to DivIHN, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('blog',0,90,645,'en',0,'<p>I began my last blog post by quoting from a business forum I had read:</p><p><em><strong>“To put it bluntly, the CISO role is dead.”</strong></em></p><p>And I closed my last post saying that I would encourage you all to think about the potential of a Digital Risk and Resilience Officer role and focus as an evolution needed in Information Security which will be more encompassing and vital to the success of your business’s future.</p><p>Some of you who read my last post may have dismissed my comment as out of hand. Others may have read a bit deeper into my comments and your reaction, at least internally, were that Joe has no clue what he is talking about. Just maybe, one or two of you may have thought about my comments and said to yourself, he may be onto something.</p><p>I do not claim to have all the clues, but I can assure you that throughout my career I have prided myself in working hard to ensure I had at least half a clue concerning what was going on around me in my professional domain.</p><p>It is a fair bet for me to say again today that:</p><p><em><strong>The threats and risks our businesses face today are at the highest level of systemic digital risk I have experienced in my 45+ years in the Information Technology industry.</strong></em></p><p><em><strong>&amp;</strong></em></p><p><em><strong>Information Technology organizations no longer control all the information technology devices and systems in use in their organizations today.</strong></em></p><p>Let me take this one step further:</p><p><em><strong>“Never in the history of modern business operations has there been a risk domain as impactful as Information Technology. Information Technology and Digital Business Systems are the only risk domain which can bring my company’s business operations to a complete standstill in an instant!”</strong></em></p><p>This is a quote from a discussion I recently had with the head of Enterprise Risk Management for a multi-billon dollar business. My conversations during the past year with many Chief Risk Officers, Enterprise Risk Managers and Chief Information Security Officers have all led me to form my opinion that it is time to start thinking about and acting on the notion that the CISO role as we know it today is past its shelf life, and it is time to seriously embrace a Digital Risk and Resilience Officer role.</p><p><strong>The CISO role as we know it today is past its shelf life.</strong></p><p><strong>It is time to embrace the</strong></p><p><strong>Digital Risk and Resilience Officer role.</strong></p><img src=\"/sites/default/files/inline-images/Security%20by%20design%2014.png\" data-entity-uuid=\"02ed5747-2c9b-41b1-8da1-f56c4f693797\" data-entity-type=\"file\" width=\"900\" height=\"394\"><p>&nbsp;</p><p>&nbsp;The traditional CISO role is intended to address the protection of an organization’s information technology, digital business systems, and data from attacks. This is often focused on external threats and can also include controls to address internal misuse of information systems and data. This is a narrow focus given the widespread use of digital systems, data, communications and workplace technologies in use throughout businesses, their customer chains and supply chains. While cybersecurity risk management focuses on cyber threats and recovery of information technology systems, it is a focus which rarely addresses the impacts to the rest of a business organization.</p><p>Enterprises Risk Management acknowledges cybersecurity threats and risks, but sees these risks through a CISO’s eye, usually not through the eyes of your business. I have found it rare when speaking with ERM leaders and Chief Risk Officers to find a fully integrative understanding of the true extent of digital disruption impacts and the need for a business integrative approach to ensure digital resilience when recovering from such business disruptions.</p><p>Another impediment to embracing Digital Resilience, a required new core competence, is what I call grade / position inflation in cybersecurity. Prior to 1995, I do not think there was any role in business for information technology entitled Chief Information Security Officer. There were roles in the 1970’s and 1980’s for information technology security and the role of information technology security manager was common. Steve Katz is credited as the first person appointed to a Chief Information Technology Officer role by Citi Bank in 1995 after Citi Bank suffered a series of successful cyber security attacks by Russian hackers. In the 1990’s and into the early 2000’s it was common to have an information technology security manager role reporting to a Chief Information Officer or a Chief Technology Officer. This role was often filled by a manager or director level position. As the frequency of cybersecurity attacks escalated through the 2000’s, and business impacts became larger, we begin to see the escalation of information technology security managers to higher grade levels. There was something Darwinian about the escalation of security managers to Chief Information Security Managers and further to Director and Officer roles. Today it is not uncommon to see CISO roles as Vice Presidents or Senior Vice Presidents reporting to Chief Information Officers and even to reporting lines directly to business Chief Executive Officers. Raising the position and salary levels of CISOs does not directly translate to significantly improved cybersecurity or digital resilience. Organization performance, in my experience, even for cybersecurity and digital resilience, is primary driven by organizational culture, strong governance, professional competence and employing a right role, right person approach.</p><p><strong>A Very Simple Equation</strong></p><p>My arriving at my realization for a Digital Risk and Resilience Officer role can be summarized as follows:</p><ul><li>Chief Risk Officer is a full-time role / Head of ERM is a full-time role.</li><li>CISO / ISO role is a full-time role.</li><li>CISO/ISO attention to Digital Risk and Resilience is a part-time role.</li><li>Digital Risk and Resilience calls for full-time attention given the potential for catastrophic business disruption impacts.</li><li>Thus … Digital Risk and Resilience should be a full-time role.</li><li>While maintaining the traditional Information Security Officer / Manger role.</li></ul><p><strong>The CISO / ISO role is not dead! It is time to embrace a new and improved role focused on</strong></p><p><strong>Digital Risk and Resilience.</strong></p><p>The Digital Risk and Resilience Officer role should represent a significant evolution in purpose, responsibility and vision for dealing with the threats and systemic risks our businesses now face every day. I again encourage you all to think about the potential of a Digital Risk and Resilience Officer role and focus as an evolution needed in Information Security which will be more encompassing and vital to the success of your business’ future.</p><p>In my next bog post, I will expand on what this might mean to CRO/ERM + DRRO integrative business approach to Enterprise Digital Risk and Resiliency.</p><p>&nbsp;</p><p>&nbsp;</p><p><strong>Joseph F. Norton</strong> is a Risk, Security, and Crisis Management professional.</p><p>He is a founding member and Qualified Technology Executive of the Digital Directors Network, Special Advisor for Risk and Cybersecurity to DivIHN, Chair of the Advisory Board with Next Era Transformation Group, and Chief Security Officer with APF Technologies.</p><p>He has served as Chief Security Officer, SVP at Atos, Chief Technology Officer and Head of Operations, SVP at Philips, Chief Technology Officer, SVP at Novartis, Executive-in-Residence with McKinsey &amp; Company, and Chief Technology Officer at McDonald’s. He has also held professional roles during his career with JPMorgan Bank, Oracle, Sybase and Grumman Aerospace Corporation, and the United States Navy.</p>','','full_html'),('webinar',0,91,224,'en',0,'<p><strong>About Webinar</strong></p><p>AI is evolving into more autonomous, “agentic” systems capable of making independent decisions. This change is transforming the security landscape. For CISOs and security leaders, it means reevaluating strategies to balance innovation and risk. In this panel discussion, industry experts will share real-world use cases and practical ways to leverage Agentic AI for stronger defenses, improved threat detection, and resilient operations.</p>','','full_html'),('webinar',0,91,225,'en',0,'<p><strong>About Webinar</strong></p><p>AI is evolving into more autonomous, “agentic” systems capable of making independent decisions. This change is transforming the security landscape. For CISOs and security leaders, it means reevaluating strategies to balance innovation and risk. In this panel discussion, industry experts will share real-world use cases and practical ways to leverage Agentic AI for stronger defenses, improved threat detection, and resilient operations.</p>','','full_html'),('webinar',0,91,226,'en',0,'<p><strong>About Webinar</strong></p><p>AI is evolving into more autonomous, “agentic” systems capable of making independent decisions. This change is transforming the security landscape. For CISOs and security leaders, it means reevaluating strategies to balance innovation and risk. In this panel discussion, industry experts will share real-world use cases and practical ways to leverage Agentic AI for stronger defenses, improved threat detection, and resilient operations.</p>','','full_html'),('webinar',0,91,227,'en',0,'<p><strong>About Webinar</strong></p><p>AI is evolving into more autonomous, “agentic” systems capable of making independent decisions. This change is transforming the security landscape. For CISOs and security leaders, it means reevaluating strategies to balance innovation and risk. In this panel discussion, industry experts will share real-world use cases and practical ways to leverage Agentic AI for stronger defenses, improved threat detection, and resilient operations.</p>','','full_html'),('webinar',0,91,257,'en',0,'<p><strong>About Webinar</strong></p><p>AI is evolving into more autonomous, “agentic” systems capable of making independent decisions. This change is transforming the security landscape. For CISOs and security leaders, it means reevaluating strategies to balance innovation and risk. In this panel discussion, industry experts will share real-world use cases and practical ways to leverage Agentic AI for stronger defenses, improved threat detection, and resilient operations.</p>','','full_html'),('webinar',0,91,409,'en',0,'<p><strong>About Webinar</strong></p><p>AI is evolving into more autonomous, “agentic” systems capable of making independent decisions. This change is transforming the security landscape. For CISOs and security leaders, it means reevaluating strategies to balance innovation and risk. In this panel discussion, industry experts will share real-world use cases and practical ways to leverage Agentic AI for stronger defenses, improved threat detection, and resilient operations.</p>','','full_html'),('webinar',0,91,434,'en',0,'<p><strong>About Webinar</strong></p><p>AI is evolving into more autonomous, “agentic” systems capable of making independent decisions. This change is transforming the security landscape. For CISOs and security leaders, it means reevaluating strategies to balance innovation and risk. In this panel discussion, industry experts will share real-world use cases and practical ways to leverage Agentic AI for stronger defenses, improved threat detection, and resilient operations.</p>','','full_html'),('webinar',0,91,435,'en',0,'<p><strong>About Webinar</strong></p><p>AI is evolving into more autonomous, “agentic” systems capable of making independent decisions. This change is transforming the security landscape. For CISOs and security leaders, it means reevaluating strategies to balance innovation and risk. In this panel discussion, industry experts will share real-world use cases and practical ways to leverage Agentic AI for stronger defenses, improved threat detection, and resilient operations.</p>','','full_html'),('webinar',0,91,438,'en',0,'<p><strong>About Webinar</strong></p><p>AI is evolving into more autonomous, “agentic” systems capable of making independent decisions. This change is transforming the security landscape. For CISOs and security leaders, it means reevaluating strategies to balance innovation and risk. In this panel discussion, industry experts will share real-world use cases and practical ways to leverage Agentic AI for stronger defenses, improved threat detection, and resilient operations.</p>','','full_html'),('webinar',0,91,491,'en',0,'<p><strong>About Webinar</strong></p><p>AI is evolving into more autonomous, “agentic” systems capable of making independent decisions. This change is transforming the security landscape. For CISOs and security leaders, it means reevaluating strategies to balance innovation and risk. In this panel discussion, industry experts will share real-world use cases and practical ways to leverage Agentic AI for stronger defenses, improved threat detection, and resilient operations.</p>','','full_html'),('webinar',0,91,492,'en',0,'<p><strong>About Webinar</strong></p><p>AI is evolving into more autonomous, “agentic” systems capable of making independent decisions. This change is transforming the security landscape. For CISOs and security leaders, it means reevaluating strategies to balance innovation and risk. In this panel discussion, industry experts will share real-world use cases and practical ways to leverage Agentic AI for stronger defenses, improved threat detection, and resilient operations.</p>','','full_html'),('webinar',0,91,513,'en',0,'<p><strong>About Webinar</strong></p><p>AI is evolving into more autonomous, “agentic” systems capable of making independent decisions. This change is transforming the security landscape. For CISOs and security leaders, it means reevaluating strategies to balance innovation and risk. In this panel discussion, industry experts will share real-world use cases and practical ways to leverage Agentic AI for stronger defenses, improved threat detection, and resilient operations.</p>','','full_html'),('webinar',0,91,571,'en',0,'<p><strong>About Webinar</strong></p><p>AI is evolving into more autonomous, “agentic” systems capable of making independent decisions. This change is transforming the security landscape. For CISOs and security leaders, it means reevaluating strategies to balance innovation and risk. In this panel discussion, industry experts will share real-world use cases and practical ways to leverage Agentic AI for stronger defenses, improved threat detection, and resilient operations.</p>','','full_html'),('webinar',0,91,646,'en',0,'<p><strong>About Webinar</strong></p><p>AI is evolving into more autonomous, “agentic” systems capable of making independent decisions. This change is transforming the security landscape. For CISOs and security leaders, it means reevaluating strategies to balance innovation and risk. In this panel discussion, industry experts will share real-world use cases and practical ways to leverage Agentic AI for stronger defenses, improved threat detection, and resilient operations.</p>','','full_html'),('unique_template_pages',0,93,273,'en',0,'<p>Opportunities in the areas of Information Technology,&nbsp;<br>Life Sciences, Engineering, and more with our Enterprise,&nbsp;<br>mid-market and government clients.&nbsp;</p><p><a class=\"primary-btn contactUsBtn\" href=\"/careers/consultant-careers/open-jobs\" aria-label=\"View our Open Jobs\" tabindex=\"0\" role=\"link\" data-content=\"View our Open Jobs\" target=\"_blank\">View our Open Jobs</a></p>','','full_html'),('unique_template_pages',0,95,275,'en',0,'<p>At DivIHN, we believe meaningful work empowers,<br>meaningful lives. Join our passionate team of individuals<br>devoted to transforming lives and making a positive impact.</p><p><a class=\"primary-btn contactUsBtn\" href=\"/careers/internal-careers/open-positions\" aria-label=\"View our Open Positions\" tabindex=\"0\" role=\"link\" data-content=\"View our Open Positions\" target=\"_blank\">View our Open Positions</a></p>','','full_html'),('client_success',0,96,276,'en',0,'<p><strong>Our client, a leading independent producer of high-quality, specialty hydrocarbon products, agreed to sell a 50,000 barrel per day refinery, associated delivery terminals, and related assets to an unaffiliated energy company for $435 million.</strong></p>','','basic_html'),('client_success',0,96,291,'en',0,'<p>Our client, a leading independent producer of high-quality, specialty hydrocarbon products, agreed to sell a 50,000 barrel per day refinery, associated delivery terminals, and related assets to an unaffiliated energy company for $435 million.</p>','','basic_html'),('client_success',0,96,301,'en',0,'<p>Our client, a leading independent producer of high-quality, specialty hydrocarbon products, agreed to sell a 50,000 barrel per day refinery, associated delivery terminals, and related assets to an unaffiliated energy company for $435 million.</p>','','basic_html'),('client_success',0,96,336,'en',0,'<p>Our client, a leading independent producer of high-quality, specialty hydrocarbon products, agreed to sell a 50,000 barrel per day refinery, associated delivery terminals, and related assets to an unaffiliated energy company for $435 million.</p>','','basic_html'),('client_success',0,96,350,'en',0,'<p>Our client, a leading independent producer of high-quality, specialty hydrocarbon products, agreed to sell a 50,000 barrel per day refinery, associated delivery terminals, and related assets to an unaffiliated energy company for $435 million.</p>','','basic_html'),('client_success',0,96,363,'en',0,'<p>Our client, a leading independent producer of high-quality, specialty hydrocarbon products, agreed to sell a 50,000 barrel per day refinery, associated delivery terminals, and related assets to an unaffiliated energy company for $435 million.</p>','','basic_html'),('client_success',0,96,384,'en',0,'<p>Our client, a leading independent producer of high-quality, specialty hydrocarbon products, agreed to sell a 50,000 barrel per day refinery, associated delivery terminals, and related assets to an unaffiliated energy company for $435 million.</p>','','basic_html'),('client_success',0,96,573,'en',0,'<p>Our client, a leading independent producer of high-quality, specialty hydrocarbon products, agreed to sell a 50,000 barrel per day refinery, associated delivery terminals, and related assets to an unaffiliated energy company for $435 million.</p>','','basic_html'),('client_success',0,97,277,'en',0,'<p>DivIHN\'s solution fostered innovation in addition to objectively quantifying project priorities. This helped the CISO improve Service Levels while managing expectations of user/business communities.</p>','','basic_html'),('client_success',0,97,278,'en',0,'<p><strong>DivIHN\'s solution fostered innovation in addition to objectively quantifying project priorities. This helped the CISO improve Service Levels while managing expectations of user/business communities.</strong></p>','','basic_html'),('client_success',0,97,292,'en',0,'<p>DivIHN\'s solution fostered innovation in addition to objectively quantifying project priorities. This helped the CISO improve Service Levels while managing expectations of user/business communities.</p>','','basic_html'),('client_success',0,97,330,'en',0,'<p>DivIHN\'s solution fostered innovation in addition to objectively quantifying project priorities. This helped the CISO improve Service Levels while managing expectations of user/business communities.</p>','','basic_html'),('client_success',0,97,362,'en',0,'<p>DivIHN\'s solution fostered innovation in addition to objectively quantifying project priorities. This helped the CISO improve Service Levels while managing expectations of user/business communities.</p>','','basic_html'),('client_success',0,97,371,'en',0,'<p>DivIHN\'s solution fostered innovation in addition to objectively quantifying project priorities. This helped the CISO improve Service Levels while managing expectations of user/business communities.</p>','','basic_html'),('client_success',0,97,383,'en',0,'<p>DivIHN\'s solution fostered innovation in addition to objectively quantifying project priorities. This helped the CISO improve Service Levels while managing expectations of user/business communities.</p>','','basic_html'),('client_success',0,97,495,'en',0,'<p>DivIHN\'s solution fostered innovation in addition to objectively quantifying project priorities. This helped the CISO improve Service Levels while managing expectations of user/business communities.</p>','','basic_html'),('client_success',0,97,574,'en',0,'<p>DivIHN\'s solution fostered innovation in addition to objectively quantifying project priorities. This helped the CISO improve Service Levels while managing expectations of user/business communities.</p>','','basic_html'),('client_success',0,98,279,'en',0,'<p><strong>Our customer is a large County Government on the west coast of USA. The Cybersecurity Architecture work was carried out in the context of the overall review of the Technology Assets of the county.</strong></p>','','basic_html'),('client_success',0,98,293,'en',0,'<p>Our customer is a large County Government on the west coast of USA. The Cybersecurity Architecture work was carried out in the context of the overall review of the Technology Assets of the county.</p>','','basic_html'),('client_success',0,98,329,'en',0,'<p>Our customer is a large County Government on the west coast of USA. The Cybersecurity Architecture work was carried out in the context of the overall review of the Technology Assets of the county.</p>','','basic_html'),('client_success',0,98,346,'en',0,'<p>Our customer is a large County Government on the west coast of USA. The Cybersecurity Architecture work was carried out in the context of the overall review of the Technology Assets of the county.</p>','','basic_html'),('client_success',0,98,496,'en',0,'<p>Our customer is a large County Government on the west coast of USA. The Cybersecurity Architecture work was carried out in the context of the overall review of the Technology Assets of the county.</p>','','basic_html'),('client_success',0,98,575,'en',0,'<p>Our customer is a large County Government on the west coast of USA. The Cybersecurity Architecture work was carried out in the context of the overall review of the Technology Assets of the county.</p>','','basic_html'),('client_success',0,98,652,'en',0,'<p>Our customer is a large County Government on the west coast of USA. The Cybersecurity Architecture work was carried out in the context of the overall review of the Technology Assets of the county.</p>','','basic_html'),('client_success',0,99,280,'en',0,'<p>Our customer is a $ 18 B Multinational entity manufacturing Heating, Ventilating, and Air-conditioning systems. The clients needed to protect against third party risk and streamline a comprehensive program to protect against these risks.</p>','','basic_html'),('client_success',0,99,281,'en',0,'<p><strong>Our customer is a $ 18 B Multinational entity manufacturing Heating, Ventilating, and Air-conditioning systems. The clients needed to protect against third party risk and streamline a comprehensive program to protect against these risks.</strong></p>','','basic_html'),('client_success',0,99,294,'en',0,'<p>Our customer is a $ 18 B Multinational entity manufacturing Heating, Ventilating, and Air-conditioning systems. The clients needed to protect against third party risk and streamline a comprehensive program to protect against these risks.</p>','','basic_html'),('client_success',0,99,316,'en',0,'<p>Our customer is a $ 18 B Multinational entity manufacturing Heating, Ventilating, and Air-conditioning systems. The clients needed to protect against third party risk and streamline a comprehensive program to protect against these risks.</p>','','basic_html'),('client_success',0,99,328,'en',0,'<p>Our customer is a $ 18 B Multinational entity manufacturing Heating, Ventilating, and Air-conditioning systems. The clients needed to protect against third party risk and streamline a comprehensive program to protect against these risks.</p>','','basic_html'),('client_success',0,99,380,'en',0,'<p>Our customer is a $ 18 B Multinational entity manufacturing Heating, Ventilating, and Air-conditioning systems. The clients needed to protect against third party risk and streamline a comprehensive program to protect against these risks.</p>','','basic_html'),('client_success',0,99,382,'en',0,'<p>Our customer is a $ 18 B Multinational entity manufacturing Heating, Ventilating, and Air-conditioning systems. The clients needed to protect against third party risk and streamline a comprehensive program to protect against these risks.</p>','','basic_html'),('client_success',0,99,497,'en',0,'<p>Our customer is a $ 18 B Multinational entity manufacturing Heating, Ventilating, and Air-conditioning systems. The clients needed to protect against third party risk and streamline a comprehensive program to protect against these risks.</p>','','basic_html'),('client_success',0,99,576,'en',0,'<p>Our customer is a $ 18 B Multinational entity manufacturing Heating, Ventilating, and Air-conditioning systems. The clients needed to protect against third party risk and streamline a comprehensive program to protect against these risks.</p>','','basic_html'),('client_success',0,100,282,'en',0,'<p><strong>Our customer is a $11B Healthcare Manufacturer with Medical Devices, Nutrition and Renal solutions. &nbsp;With more than 7,000 suppliers across the global they had significant exposure their suppliers’ cybersecurity weaknesses.</strong></p>','','basic_html'),('client_success',0,100,295,'en',0,'<p>Our customer is a $11B Healthcare Manufacturer with Medical Devices, Nutrition and Renal solutions. &nbsp;With more than 7,000 suppliers across the global they had significant exposure their suppliers’ cybersecurity weaknesses.</p>','','basic_html'),('client_success',0,100,327,'en',0,'<p>Our customer is a $11B Healthcare Manufacturer with Medical Devices, Nutrition and Renal solutions. &nbsp;With more than 7,000 suppliers across the global they had significant exposure their suppliers’ cybersecurity weaknesses.</p>','','basic_html'),('client_success',0,100,361,'en',0,'<p>Our customer is a $11B Healthcare Manufacturer with Medical Devices, Nutrition and Renal solutions. &nbsp;With more than 7,000 suppliers across the global they had significant exposure their suppliers’ cybersecurity weaknesses.</p>','','basic_html'),('client_success',0,100,370,'en',0,'<p>Our customer is a $11B Healthcare Manufacturer with Medical Devices, Nutrition and Renal solutions. &nbsp;With more than 7,000 suppliers across the global they had significant exposure their suppliers’ cybersecurity weaknesses.</p>','','basic_html'),('client_success',0,100,379,'en',0,'<p>Our customer is a $11B Healthcare Manufacturer with Medical Devices, Nutrition and Renal solutions. &nbsp;With more than 7,000 suppliers across the global they had significant exposure their suppliers’ cybersecurity weaknesses.</p>','','basic_html'),('client_success',0,100,381,'en',0,'<p>Our customer is a $11B Healthcare Manufacturer with Medical Devices, Nutrition and Renal solutions. &nbsp;With more than 7,000 suppliers across the global they had significant exposure their suppliers’ cybersecurity weaknesses.</p>','','basic_html'),('client_success',0,100,498,'en',0,'<p>Our customer is a $11B Healthcare Manufacturer with Medical Devices, Nutrition and Renal solutions. &nbsp;With more than 7,000 suppliers across the global they had significant exposure their suppliers’ cybersecurity weaknesses.</p>','','basic_html'),('client_success',0,100,577,'en',0,'<p>Our customer is a $11B Healthcare Manufacturer with Medical Devices, Nutrition and Renal solutions. &nbsp;With more than 7,000 suppliers across the global they had significant exposure their suppliers’ cybersecurity weaknesses.</p>','','basic_html'),('client_success',0,100,649,'en',0,'<p>Our customer is a $11B Healthcare Manufacturer with Medical Devices, Nutrition and Renal solutions. &nbsp;With more than 7,000 suppliers across the global they had significant exposure their suppliers’ cybersecurity weaknesses.</p>','','basic_html'),('client_success',0,101,283,'en',0,'<p>A multi-concept home improvement franchise system with four consumer brands and more than 1,000 locations in the United States and Canada</p>','','basic_html'),('client_success',0,101,296,'en',0,'<p>A multi-concept home improvement franchise system with four consumer brands and more than 1,000 locations in the United States and Canada</p>','','basic_html'),('client_success',0,101,335,'en',0,'<p>A multi-concept home improvement franchise system with four consumer brands and more than 1,000 locations in the United States and Canada</p>','','basic_html'),('client_success',0,101,341,'en',0,'<p>A multi-concept home improvement franchise system with four consumer brands and more than 1,000 locations in the United States and Canada</p>','','basic_html'),('client_success',0,101,345,'en',0,'<p>A multi-concept home improvement franchise system with four consumer brands and more than 1,000 locations in the United States and Canada</p>','','basic_html'),('client_success',0,101,499,'en',0,'<p>A multi-concept home improvement franchise system with four consumer brands and more than 1,000 locations in the United States and Canada</p>','','basic_html'),('client_success',0,101,578,'en',0,'<p>A multi-concept home improvement franchise system with four consumer brands and more than 1,000 locations in the United States and Canada</p>','','basic_html'),('client_success',0,102,284,'en',0,'<p>A multi-concept home improvement franchise system with four consumer brands and more than 1,000 locations in the United States and Canada</p>','','basic_html'),('client_success',0,102,285,'en',0,'<p><strong>A multi-concept home improvement franchise system with four consumer brands and more than 1,000 locations in the United States and Canada</strong></p>','','basic_html'),('client_success',0,102,297,'en',0,'<p>A multi-concept home improvement franchise system with four consumer brands and more than 1,000 locations in the United States and Canada</p>','','basic_html'),('client_success',0,102,312,'en',0,'<p>A multi-concept home improvement franchise system with four consumer brands and more than 1,000 locations in the United States and Canada</p>','','basic_html'),('client_success',0,102,334,'en',0,'<p>A multi-concept home improvement franchise system with four consumer brands and more than 1,000 locations in the United States and Canada</p>','','basic_html'),('client_success',0,102,360,'en',0,'<p>A multi-concept home improvement franchise system with four consumer brands and more than 1,000 locations in the United States and Canada</p>','','basic_html'),('client_success',0,102,369,'en',0,'<p>A multi-concept home improvement franchise system with four consumer brands and more than 1,000 locations in the United States and Canada</p>','','basic_html'),('client_success',0,102,378,'en',0,'<p>A multi-concept home improvement franchise system with four consumer brands and more than 1,000 locations in the United States and Canada</p>','','basic_html'),('client_success',0,102,500,'en',0,'<p>A multi-concept home improvement franchise system with four consumer brands and more than 1,000 locations in the United States and Canada</p>','','basic_html'),('client_success',0,102,579,'en',0,'<p>A multi-concept home improvement franchise system with four consumer brands and more than 1,000 locations in the United States and Canada</p>','','basic_html'),('client_success',0,103,286,'en',0,'<p><strong>Our customer is a $10.5B Financial Services organization with services lines that include checking and savings accounts, personal loans, home equity loans, student loans and credit cards. While the organization already had a reputable presence in the American market, they had recently embarked on an initiative to expand into the APAC market.</strong></p>','','basic_html'),('client_success',0,103,298,'en',0,'<p>Our customer is a $10.5B Financial Services organization with services lines that include checking and savings accounts, personal loans, home equity loans, student loans and credit cards. While the organization already had a reputable presence in the American market, they had recently embarked on an initiative to expand into the APAC market.</p>','','basic_html'),('client_success',0,103,320,'en',0,'<p>Our customer is a $10.5B Financial Services organization with services lines that include checking and savings accounts, personal loans, home equity loans, student loans and credit cards. While the organization already had a reputable presence in the American market, they had recently embarked on an initiative to expand into the APAC market.</p>','','basic_html'),('client_success',0,103,326,'en',0,'<p>Our customer is a $10.5B Financial Services organization with services lines that include checking and savings accounts, personal loans, home equity loans, student loans and credit cards. While the organization already had a reputable presence in the American market, they had recently embarked on an initiative to expand into the APAC market.</p>','','basic_html'),('client_success',0,103,342,'en',0,'<p>Our customer is a $10.5B Financial Services organization with services lines that include checking and savings accounts, personal loans, home equity loans, student loans and credit cards. While the organization already had a reputable presence in the American market, they had recently embarked on an initiative to expand into the APAC market.</p>','','basic_html'),('client_success',0,103,359,'en',0,'<p>Our customer is a $10.5B Financial Services organization with services lines that include checking and savings accounts, personal loans, home equity loans, student loans and credit cards. While the organization already had a reputable presence in the American market, they had recently embarked on an initiative to expand into the APAC market.</p>','','basic_html'),('client_success',0,103,501,'en',0,'<p>Our customer is a $10.5B Financial Services organization with services lines that include checking and savings accounts, personal loans, home equity loans, student loans and credit cards. While the organization already had a reputable presence in the American market, they had recently embarked on an initiative to expand into the APAC market.</p>','','basic_html'),('client_success',0,103,580,'en',0,'<p>Our customer is a $10.5B Financial Services organization with services lines that include checking and savings accounts, personal loans, home equity loans, student loans and credit cards. While the organization already had a reputable presence in the American market, they had recently embarked on an initiative to expand into the APAC market.</p>','','basic_html'),('client_success',0,104,287,'en',0,'<p><strong>Our customer is a $10.5B Fortune 500 Healthcare company with a focus in the areas of BioScience and Medical Devices. In business for over 85 years, the company is directly responsible for products, technologies and therapies available in more than 100 countries across the world. DivIHN has served as a preferred supplier-partner to this organization since 2014.</strong></p>','','basic_html'),('client_success',0,104,299,'en',0,'<p>Our customer is a $10.5B Fortune 500 Healthcare company with a focus in the areas of BioScience and Medical Devices. In business for over 85 years, the company is directly responsible for products, technologies and therapies available in more than 100 countries across the world. DivIHN has served as a preferred supplier-partner to this organization since 2014.</p>','','basic_html'),('client_success',0,104,319,'en',0,'<p>Our customer is a $10.5B Fortune 500 Healthcare company with a focus in the areas of BioScience and Medical Devices. In business for over 85 years, the company is directly responsible for products, technologies and therapies available in more than 100 countries across the world. DivIHN has served as a preferred supplier-partner to this organization since 2014.</p>','','basic_html'),('client_success',0,104,325,'en',0,'<p>Our customer is a $10.5B Fortune 500 Healthcare company with a focus in the areas of BioScience and Medical Devices. In business for over 85 years, the company is directly responsible for products, technologies and therapies available in more than 100 countries across the world. DivIHN has served as a preferred supplier-partner to this organization since 2014.</p>','','basic_html'),('client_success',0,104,368,'en',0,'<p>Our customer is a $10.5B Fortune 500 Healthcare company with a focus in the areas of BioScience and Medical Devices. In business for over 85 years, the company is directly responsible for products, technologies and therapies available in more than 100 countries across the world. DivIHN has served as a preferred supplier-partner to this organization since 2014.</p>','','basic_html'),('client_success',0,104,377,'en',0,'<p>Our customer is a $10.5B Fortune 500 Healthcare company with a focus in the areas of BioScience and Medical Devices. In business for over 85 years, the company is directly responsible for products, technologies and therapies available in more than 100 countries across the world. DivIHN has served as a preferred supplier-partner to this organization since 2014.</p>','','basic_html'),('client_success',0,104,502,'en',0,'<p>Our customer is a $10.5B Fortune 500 Healthcare company with a focus in the areas of BioScience and Medical Devices. In business for over 85 years, the company is directly responsible for products, technologies and therapies available in more than 100 countries across the world. DivIHN has served as a preferred supplier-partner to this organization since 2014.</p>','','basic_html'),('client_success',0,104,581,'en',0,'<p>Our customer is a $10.5B Fortune 500 Healthcare company with a focus in the areas of BioScience and Medical Devices. In business for over 85 years, the company is directly responsible for products, technologies and therapies available in more than 100 countries across the world. DivIHN has served as a preferred supplier-partner to this organization since 2014.</p>','','basic_html'),('client_success',0,105,288,'en',0,'<p><strong>Our customer is a healthcare services organization that develops and delivers “point-of-care” technology to improve care coordination, compliance, and physician-patient interactions. Founded in 2006, the organization has doubled each year in its scale of technology implementation at outpatient healthcare facilities, business partnerships with global life sciences and medical device companies, product innovation and team growth. The organization’s point-of-care technology platform impacts 500M patient visits annually.</strong></p>','','basic_html'),('client_success',0,105,289,'en',0,'<p>Our customer is a healthcare services organization that develops and delivers “point-of-care” technology to improve care coordination, compliance, and physician-patient interactions. Founded in 2006, the organization has doubled each year in its scale of technology implementation at outpatient healthcare facilities, business partnerships with global life sciences and medical device companies, product innovation and team growth. The organization’s point-of-care technology platform impacts 500M patient visits annually.</p>','','basic_html'),('client_success',0,105,290,'en',0,'<p>Our customer is a healthcare services organization that develops and delivers “point-of-care” technology to improve care coordination, compliance, and physician-patient interactions. Founded in 2006, the organization has doubled each year in its scale of technology implementation at outpatient healthcare facilities, business partnerships with global life sciences and medical device companies, product innovation and team growth. The organization’s point-of-care technology platform impacts 500M patient visits annually.</p>','','basic_html'),('client_success',0,105,300,'en',0,'<p>Our customer is a healthcare services organization that develops and delivers “point-of-care” technology to improve care coordination, compliance, and physician-patient interactions. Founded in 2006, the organization has doubled each year in its scale of technology implementation at outpatient healthcare facilities, business partnerships with global life sciences and medical device companies, product innovation and team growth. The organization’s point-of-care technology platform impacts 500M patient visits annually.</p>','','basic_html'),('client_success',0,105,318,'en',0,'<p>Our customer is a healthcare services organization that develops and delivers “point-of-care” technology to improve care coordination, compliance, and physician-patient interactions. Founded in 2006, the organization has doubled each year in its scale of technology implementation at outpatient healthcare facilities, business partnerships with global life sciences and medical device companies, product innovation and team growth. The organization’s point-of-care technology platform impacts 500M patient visits annually.</p>','','basic_html'),('client_success',0,105,338,'en',0,'<p>Our customer is a healthcare services organization that develops and delivers “point-of-care” technology to improve care coordination, compliance, and physician-patient interactions. Founded in 2006, the organization has doubled each year in its scale of technology implementation at outpatient healthcare facilities, business partnerships with global life sciences and medical device companies, product innovation and team growth. The organization’s point-of-care technology platform impacts 500M patient visits annually.</p>','','basic_html'),('client_success',0,105,367,'en',0,'<p>Our customer is a healthcare services organization that develops and delivers “point-of-care” technology to improve care coordination, compliance, and physician-patient interactions. Founded in 2006, the organization has doubled each year in its scale of technology implementation at outpatient healthcare facilities, business partnerships with global life sciences and medical device companies, product innovation and team growth. The organization’s point-of-care technology platform impacts 500M patient visits annually.</p>','','basic_html'),('client_success',0,105,376,'en',0,'<p>Our customer is a healthcare services organization that develops and delivers “point-of-care” technology to improve care coordination, compliance, and physician-patient interactions. Founded in 2006, the organization has doubled each year in its scale of technology implementation at outpatient healthcare facilities, business partnerships with global life sciences and medical device companies, product innovation and team growth. The organization’s point-of-care technology platform impacts 500M patient visits annually.</p>','','basic_html'),('client_success',0,105,503,'en',0,'<p>Our customer is a healthcare services organization that develops and delivers “point-of-care” technology to improve care coordination, compliance, and physician-patient interactions. Founded in 2006, the organization has doubled each year in its scale of technology implementation at outpatient healthcare facilities, business partnerships with global life sciences and medical device companies, product innovation and team growth. The organization’s point-of-care technology platform impacts 500M patient visits annually.</p>','','basic_html'),('client_success',0,105,504,'en',0,'<p>Our customer is a healthcare services organization that develops and delivers “point-of-care” technology to improve care coordination, compliance, and physician-patient interactions. Founded in 2006, the organization has doubled each year in its scale of technology implementation at outpatient healthcare facilities, business partnerships with global life sciences and medical device companies, product innovation and team growth. The organization’s point-of-care technology platform impacts 500M patient visits annually.</p>','','basic_html'),('client_success',0,105,582,'en',0,'<p>Our customer is a healthcare services organization that develops and delivers “point-of-care” technology to improve care coordination, compliance, and physician-patient interactions. Founded in 2006, the organization has doubled each year in its scale of technology implementation at outpatient healthcare facilities, business partnerships with global life sciences and medical device companies, product innovation and team growth. The organization’s point-of-care technology platform impacts 500M patient visits annually.</p>','','basic_html'),('client_success',0,105,648,'en',0,'<p>Our customer is a healthcare services organization that develops and delivers “point-of-care” technology to improve care coordination, compliance, and physician-patient interactions. Founded in 2006, the organization has doubled each year in its scale of technology implementation at outpatient healthcare facilities, business partnerships with global life sciences and medical device companies, product innovation and team growth. The organization’s point-of-care technology platform impacts 500M patient visits annually.</p>','','basic_html'),('client_success',0,106,302,'en',0,'<p>A multi-concept home improvement franchise system with four consumer brands and more than 1,000 locations in the United States and Canada</p>','','basic_html'),('client_success',0,106,311,'en',0,'<p>A multi-concept home improvement franchise system with four consumer brands and more than 1,000 locations in the United States and Canada</p>','','basic_html'),('client_success',0,106,333,'en',0,'<p>A multi-concept home improvement franchise system with four consumer brands and more than 1,000 locations in the United States and Canada</p>','','basic_html'),('client_success',0,106,340,'en',0,'<p>A multi-concept home improvement franchise system with four consumer brands and more than 1,000 locations in the United States and Canada</p>','','basic_html'),('client_success',0,106,344,'en',0,'<p>A multi-concept home improvement franchise system with four consumer brands and more than 1,000 locations in the United States and Canada</p>','','basic_html'),('client_success',0,106,505,'en',0,'<p>A multi-concept home improvement franchise system with four consumer brands and more than 1,000 locations in the United States and Canada</p>','','basic_html'),('client_success',0,106,583,'en',0,'<p>A multi-concept home improvement franchise system with four consumer brands and more than 1,000 locations in the United States and Canada</p>','','basic_html'),('client_success',0,107,303,'en',0,'<p>A heavy equipment manufacturer had a need to assess security in applications as they developed services to collect real-time data from devices and enhance predictive maintenance capability.</p>','','basic_html'),('client_success',0,107,315,'en',0,'<p>A heavy equipment manufacturer had a need to assess security in applications as they developed services to collect real-time data from devices and enhance predictive maintenance capability.</p>','','basic_html'),('client_success',0,107,324,'en',0,'<p>A heavy equipment manufacturer had a need to assess security in applications as they developed services to collect real-time data from devices and enhance predictive maintenance capability.</p>','','basic_html'),('client_success',0,107,348,'en',0,'<p>A heavy equipment manufacturer had a need to assess security in applications as they developed services to collect real-time data from devices and enhance predictive maintenance capability.</p>','','basic_html'),('client_success',0,107,358,'en',0,'<p>A heavy equipment manufacturer had a need to assess security in applications as they developed services to collect real-time data from devices and enhance predictive maintenance capability.</p>','','basic_html'),('client_success',0,107,375,'en',0,'<p>A heavy equipment manufacturer had a need to assess security in applications as they developed services to collect real-time data from devices and enhance predictive maintenance capability.</p>','','basic_html'),('client_success',0,107,506,'en',0,'<p>A heavy equipment manufacturer had a need to assess security in applications as they developed services to collect real-time data from devices and enhance predictive maintenance capability.</p>','','basic_html'),('client_success',0,107,584,'en',0,'<p>A heavy equipment manufacturer had a need to assess security in applications as they developed services to collect real-time data from devices and enhance predictive maintenance capability.</p>','','basic_html'),('client_success',0,108,304,'en',0,'<p>A medical device manufacturer needed expertise to improve security controls associated with their medical devices and data management applications. This included understanding regulatory applicability and the impact on security controls.</p>','','basic_html'),('client_success',0,108,314,'en',0,'<p>A medical device manufacturer needed expertise to improve security controls associated with their medical devices and data management applications. This included understanding regulatory applicability and the impact on security controls.</p>','','basic_html'),('client_success',0,108,323,'en',0,'<p>A medical device manufacturer needed expertise to improve security controls associated with their medical devices and data management applications. This included understanding regulatory applicability and the impact on security controls.</p>','','basic_html'),('client_success',0,108,357,'en',0,'<p>A medical device manufacturer needed expertise to improve security controls associated with their medical devices and data management applications. This included understanding regulatory applicability and the impact on security controls.</p>','','basic_html'),('client_success',0,108,366,'en',0,'<p>A medical device manufacturer needed expertise to improve security controls associated with their medical devices and data management applications. This included understanding regulatory applicability and the impact on security controls.</p>','','basic_html'),('client_success',0,108,374,'en',0,'<p>A medical device manufacturer needed expertise to improve security controls associated with their medical devices and data management applications. This included understanding regulatory applicability and the impact on security controls.</p>','','basic_html'),('client_success',0,108,507,'en',0,'<p>A medical device manufacturer needed expertise to improve security controls associated with their medical devices and data management applications. This included understanding regulatory applicability and the impact on security controls.</p>','','basic_html'),('client_success',0,108,585,'en',0,'<p>A medical device manufacturer needed expertise to improve security controls associated with their medical devices and data management applications. This included understanding regulatory applicability and the impact on security controls.</p>','','basic_html'),('client_success',0,109,305,'en',0,'<p>A technology company specializing in wireless communications, with revenues of about $1.5 billion, sought growth within its industry through vertical acquisitions of entire operating companies.</p>','','basic_html'),('client_success',0,109,332,'en',0,'<p>A technology company specializing in wireless communications, with revenues of about $1.5 billion, sought growth within its industry through vertical acquisitions of entire operating companies.</p>','','basic_html'),('client_success',0,109,356,'en',0,'<p>A technology company specializing in wireless communications, with revenues of about $1.5 billion, sought growth within its industry through vertical acquisitions of entire operating companies.</p>','','basic_html'),('client_success',0,109,373,'en',0,'<p>A technology company specializing in wireless communications, with revenues of about $1.5 billion, sought growth within its industry through vertical acquisitions of entire operating companies.</p>','','basic_html'),('client_success',0,109,508,'en',0,'<p>A technology company specializing in wireless communications, with revenues of about $1.5 billion, sought growth within its industry through vertical acquisitions of entire operating companies.</p>','','basic_html'),('client_success',0,109,586,'en',0,'<p>A technology company specializing in wireless communications, with revenues of about $1.5 billion, sought growth within its industry through vertical acquisitions of entire operating companies.</p>','','basic_html'),('client_success',0,110,306,'en',0,'<p>An advertising organization grew through acquisition of several companies. The business entailed collecting and processing personal information from citizens in the U.S. and E.U. Regulations such as GDPR and the lack of visibility to cyber risk was a serious concern for their board.</p>','','basic_html'),('client_success',0,110,313,'en',0,'<p>An advertising organization grew through acquisition of several companies. The business entailed collecting and processing personal information from citizens in the U.S. and E.U. Regulations such as GDPR and the lack of visibility to cyber risk was a serious concern for their board.</p>','','basic_html'),('client_success',0,110,322,'en',0,'<p>An advertising organization grew through acquisition of several companies. The business entailed collecting and processing personal information from citizens in the U.S. and E.U. Regulations such as GDPR and the lack of visibility to cyber risk was a serious concern for their board.</p>','','basic_html'),('client_success',0,110,339,'en',0,'<p>An advertising organization grew through acquisition of several companies. The business entailed collecting and processing personal information from citizens in the U.S. and E.U. Regulations such as GDPR and the lack of visibility to cyber risk was a serious concern for their board.</p>','','basic_html'),('client_success',0,110,343,'en',0,'<p>An advertising organization grew through acquisition of several companies. The business entailed collecting and processing personal information from citizens in the U.S. and E.U. Regulations such as GDPR and the lack of visibility to cyber risk was a serious concern for their board.</p>','','basic_html'),('client_success',0,110,355,'en',0,'<p>An advertising organization grew through acquisition of several companies. The business entailed collecting and processing personal information from citizens in the U.S. and E.U. Regulations such as GDPR and the lack of visibility to cyber risk was a serious concern for their board.</p>','','basic_html'),('client_success',0,110,365,'en',0,'<p>An advertising organization grew through acquisition of several companies. The business entailed collecting and processing personal information from citizens in the U.S. and E.U. Regulations such as GDPR and the lack of visibility to cyber risk was a serious concern for their board.</p>','','basic_html'),('client_success',0,110,509,'en',0,'<p>An advertising organization grew through acquisition of several companies. The business entailed collecting and processing personal information from citizens in the U.S. and E.U. Regulations such as GDPR and the lack of visibility to cyber risk was a serious concern for their board.</p>','','basic_html'),('client_success',0,110,587,'en',0,'<p>An advertising organization grew through acquisition of several companies. The business entailed collecting and processing personal information from citizens in the U.S. and E.U. Regulations such as GDPR and the lack of visibility to cyber risk was a serious concern for their board.</p>','','basic_html'),('client_success',0,110,651,'en',0,'<p>An advertising organization grew through acquisition of several companies. The business entailed collecting and processing personal information from citizens in the U.S. and E.U. Regulations such as GDPR and the lack of visibility to cyber risk was a serious concern for their board.</p>','','basic_html'),('client_success',0,111,307,'en',0,'<p>A global legal process outsourcing (LPO) company providing eDiscovery, managed services and litigation support, agreed to purchase a provider of litigation support and information management solutions for law firms and corporate legal departments as a carveout from an unaffiliated enterprise. The transaction was the largest in the client’s history, substantially expanding its presence both inside the United States as well as in the United Kingdom, Ireland, Hong Kong, Singapore, New Zealand and Australia.</p>','','basic_html'),('client_success',0,111,331,'en',0,'<p>A global legal process outsourcing (LPO) company providing eDiscovery, managed services and litigation support, agreed to purchase a provider of litigation support and information management solutions for law firms and corporate legal departments as a carveout from an unaffiliated enterprise. The transaction was the largest in the client’s history, substantially expanding its presence both inside the United States as well as in the United Kingdom, Ireland, Hong Kong, Singapore, New Zealand and Australia.</p>','','basic_html'),('client_success',0,111,354,'en',0,'<p>A global legal process outsourcing (LPO) company providing eDiscovery, managed services and litigation support, agreed to purchase a provider of litigation support and information management solutions for law firms and corporate legal departments as a carveout from an unaffiliated enterprise. The transaction was the largest in the client’s history, substantially expanding its presence both inside the United States as well as in the United Kingdom, Ireland, Hong Kong, Singapore, New Zealand and Australia.</p>','','basic_html'),('client_success',0,111,510,'en',0,'<p>A global legal process outsourcing (LPO) company providing eDiscovery, managed services and litigation support, agreed to purchase a provider of litigation support and information management solutions for law firms and corporate legal departments as a carveout from an unaffiliated enterprise. The transaction was the largest in the client’s history, substantially expanding its presence both inside the United States as well as in the United Kingdom, Ireland, Hong Kong, Singapore, New Zealand and Australia.</p>','','basic_html'),('client_success',0,111,588,'en',0,'<p>A global legal process outsourcing (LPO) company providing eDiscovery, managed services and litigation support, agreed to purchase a provider of litigation support and information management solutions for law firms and corporate legal departments as a carveout from an unaffiliated enterprise. The transaction was the largest in the client’s history, substantially expanding its presence both inside the United States as well as in the United Kingdom, Ireland, Hong Kong, Singapore, New Zealand and Australia.</p>','','basic_html'),('client_success',0,112,308,'en',0,'<p>The client is an Illinois based organization dedicated to providing the information, knowledge and skills to the automotive repair industry in collaboration with manufacturers, insurance providers, and equipment manufacturers. The client required a modern platform to deliver their modernized recognition program designed to expand the knowledge and skill levels in the industry delivered through a subscription model. The new application replaces a homegrown solution that had reached its limits from the standpoint of usability, support for emerging standards, and extensibility.</p>','','basic_html'),('client_success',0,112,317,'en',0,'<p>The client is an Illinois based organization dedicated to providing the information, knowledge and skills to the automotive repair industry in collaboration with manufacturers, insurance providers, and equipment manufacturers. The client required a modern platform to deliver their modernized recognition program designed to expand the knowledge and skill levels in the industry delivered through a subscription model. The new application replaces a homegrown solution that had reached its limits from the standpoint of usability, support for emerging standards, and extensibility.</p>','','basic_html'),('client_success',0,112,337,'en',0,'<p>The client is an Illinois based organization dedicated to providing the information, knowledge and skills to the automotive repair industry in collaboration with manufacturers, insurance providers, and equipment manufacturers. The client required a modern platform to deliver their modernized recognition program designed to expand the knowledge and skill levels in the industry delivered through a subscription model. The new application replaces a homegrown solution that had reached its limits from the standpoint of usability, support for emerging standards, and extensibility.</p>','','basic_html'),('client_success',0,112,352,'en',0,'<p>The client is an Illinois based organization dedicated to providing the information, knowledge and skills to the automotive repair industry in collaboration with manufacturers, insurance providers, and equipment manufacturers. The client required a modern platform to deliver their modernized recognition program designed to expand the knowledge and skill levels in the industry delivered through a subscription model. The new application replaces a homegrown solution that had reached its limits from the standpoint of usability, support for emerging standards, and extensibility.</p>','','basic_html'),('client_success',0,112,353,'en',0,'<p>The client is an Illinois based organization dedicated to providing the information, knowledge and skills to the automotive repair industry in collaboration with manufacturers, insurance providers, and equipment manufacturers. The client required a modern platform to deliver their modernized recognition program designed to expand the knowledge and skill levels in the industry delivered through a subscription model. The new application replaces a homegrown solution that had reached its limits from the standpoint of usability, support for emerging standards, and extensibility.</p>','','basic_html'),('client_success',0,112,364,'en',0,'<p>The client is an Illinois based organization dedicated to providing the information, knowledge and skills to the automotive repair industry in collaboration with manufacturers, insurance providers, and equipment manufacturers. The client required a modern platform to deliver their modernized recognition program designed to expand the knowledge and skill levels in the industry delivered through a subscription model. The new application replaces a homegrown solution that had reached its limits from the standpoint of usability, support for emerging standards, and extensibility.</p>','','basic_html'),('client_success',0,112,511,'en',0,'<p>The client is an Illinois based organization dedicated to providing the information, knowledge and skills to the automotive repair industry in collaboration with manufacturers, insurance providers, and equipment manufacturers. The client required a modern platform to deliver their modernized recognition program designed to expand the knowledge and skill levels in the industry delivered through a subscription model. The new application replaces a homegrown solution that had reached its limits from the standpoint of usability, support for emerging standards, and extensibility.</p>','','basic_html'),('client_success',0,112,527,'en',0,'<p>The client is an Illinois based organization dedicated to providing the information, knowledge and skills to the automotive repair industry in collaboration with manufacturers, insurance providers, and equipment manufacturers. The client required a modern platform to deliver their modernized recognition program designed to expand the knowledge and skill levels in the industry delivered through a subscription model. The new application replaces a homegrown solution that had reached its limits from the standpoint of usability, support for emerging standards, and extensibility.</p>','','basic_html'),('client_success',0,112,589,'en',0,'<p>The client is an Illinois based organization dedicated to providing the information, knowledge and skills to the automotive repair industry in collaboration with manufacturers, insurance providers, and equipment manufacturers. The client required a modern platform to deliver their modernized recognition program designed to expand the knowledge and skill levels in the industry delivered through a subscription model. The new application replaces a homegrown solution that had reached its limits from the standpoint of usability, support for emerging standards, and extensibility.</p>','','basic_html'),('client_success',0,112,650,'en',0,'<p>The client is an Illinois based organization dedicated to providing the information, knowledge and skills to the automotive repair industry in collaboration with manufacturers, insurance providers, and equipment manufacturers. The client required a modern platform to deliver their modernized recognition program designed to expand the knowledge and skill levels in the industry delivered through a subscription model. The new application replaces a homegrown solution that had reached its limits from the standpoint of usability, support for emerging standards, and extensibility.</p>','','basic_html'),('client_success',0,113,309,'en',0,'<p>A leading full-service energy logistics company operating a network of over 3,500 miles of crude oil, refined products and natural gas pipelines, 28 crude oil and refined products, truck and marine terminals, natural gas processing complexes, and other facilities.</p>','','basic_html'),('client_success',0,113,321,'en',0,'<p>A leading full-service energy logistics company operating a network of over 3,500 miles of crude oil, refined products and natural gas pipelines, 28 crude oil and refined products, truck and marine terminals, natural gas processing complexes, and other facilities.</p>','','basic_html'),('client_success',0,113,347,'en',0,'<p>A leading full-service energy logistics company operating a network of over 3,500 miles of crude oil, refined products and natural gas pipelines, 28 crude oil and refined products, truck and marine terminals, natural gas processing complexes, and other facilities.</p>','','basic_html'),('client_success',0,113,349,'en',0,'<p>A leading full-service energy logistics company operating a network of over 3,500 miles of crude oil, refined products and natural gas pipelines, 28 crude oil and refined products, truck and marine terminals, natural gas processing complexes, and other facilities.</p>','','basic_html'),('client_success',0,113,351,'en',0,'<p>A leading full-service energy logistics company operating a network of over 3,500 miles of crude oil, refined products and natural gas pipelines, 28 crude oil and refined products, truck and marine terminals, natural gas processing complexes, and other facilities.</p>','','basic_html'),('client_success',0,113,372,'en',0,'<p>A leading full-service energy logistics company operating a network of over 3,500 miles of crude oil, refined products and natural gas pipelines, 28 crude oil and refined products, truck and marine terminals, natural gas processing complexes, and other facilities.</p>','','basic_html'),('client_success',0,113,512,'en',0,'<p>A leading full-service energy logistics company operating a network of over 3,500 miles of crude oil, refined products and natural gas pipelines, 28 crude oil and refined products, truck and marine terminals, natural gas processing complexes, and other facilities.</p>','','basic_html'),('client_success',0,113,590,'en',0,'<p>A leading full-service energy logistics company operating a network of over 3,500 miles of crude oil, refined products and natural gas pipelines, 28 crude oil and refined products, truck and marine terminals, natural gas processing complexes, and other facilities.</p>','','basic_html'),('unique_template_pages',0,115,386,'en',0,'<p>Digital technology adoption is vital for all organizations.<br>The Security in the Digital DNA of an organization is critical to their sustainable growth.</p><p><a href=\"/perspectives/overview\">Read more</a></p>','','basic_html'),('services',0,117,416,'en',0,'<p>We deliver elegant, right-sized solutions to meet your<br>business needs, from Strategy to Solution Conception, Implementation, and Support.</p>','','basic_html'),('services',0,117,417,'en',0,'<p>We deliver elegant, right-sized solutions to meet your<br>business needs, from Strategy to Solution Conception, Implementation, and Support.</p>','','basic_html'),('services',0,117,702,'en',0,'<p>We deliver elegant, right-sized solutions to meet your<br>business needs, from Strategy to Solution Conception, Implementation, and Support.</p>','','basic_html'),('services',0,117,704,'en',0,'<p>We deliver elegant, right-sized solutions to meet your<br>business needs, from Strategy to Solution Conception, Implementation, and Support.</p>','','basic_html'),('services',0,118,418,'en',0,'<p>As you drive your business with Digital Transformation,<br>we help make it Cyber Resilient across IT, OT, IoT, and People.</p>','','basic_html'),('services',0,118,419,'en',0,'<p>As you drive your business with Digital Transformation,<br>we help make it Cyber Resilient across IT, OT, IoT, and People.</p>','','basic_html'),('services',0,118,420,'en',0,'<p>As you drive your business with Digital Transformation,<br>we help make it Cyber Resilient across IT, OT, IoT, and People.</p>','','basic_html'),('services',0,118,429,'en',0,'<p>As you drive your business with Digital Transformation,<br>we help make it Cyber Resilient across IT, OT, IoT, and People.</p>','','basic_html'),('services',0,119,421,'en',0,'<p>We maximize value through streamlined and automated Operations<br>and Management support, ensuring High System Availability.</p>','','basic_html'),('services',0,119,422,'en',0,'<p>We maximize value through streamlined and automated Operations<br>and Management support, ensuring High System Availability.</p>','','basic_html'),('services',0,119,423,'en',0,'<p>We maximize value through streamlined and automated Operations<br>and Management support, ensuring High System Availability.</p>','','basic_html'),('services',0,119,424,'en',0,'<p>We maximize value through streamlined and automated Operations<br>and Management support, ensuring High System Availability.</p>','','basic_html'),('services',0,119,425,'en',0,'<p>We maximize value through streamlined and automated Operations<br>and Management support, ensuring High System Availability.</p>','','basic_html'),('services',0,119,426,'en',0,'<p>We maximize value through streamlined and automated Operations<br>and Management support, ensuring High System Availability.</p>','','basic_html'),('services',0,119,427,'en',0,'<p>We maximize value through streamlined and automated Operations<br>and Management support, ensuring High System Availability.</p>','','basic_html'),('services',0,119,428,'en',0,'<p>We maximize value through streamlined and automated Operations<br>and Management support, ensuring High System Availability.</p>','','basic_html'),('services',0,120,430,'en',0,'<p>In a rapidly shifting Talent Market, we help you achieve<br>enduring success by placing the Right people in the Right roles.</p>','','basic_html'),('services',0,120,431,'en',0,'<p>In a rapidly shifting Talent Market, we help you achieve<br>enduring success by placing the Right people in the Right roles.</p>','','basic_html'),('services',0,120,432,'en',0,'<p>In a rapidly shifting Talent Market, we help you achieve<br>enduring success by placing the Right people in the Right roles.</p>','','basic_html'),('services',0,120,433,'en',0,'<p>In a rapidly shifting Talent Market, we help you achieve<br>enduring success by placing the Right people in the Right roles.</p>','','basic_html'),('services',0,120,436,'en',0,'<p>In a rapidly shifting Talent Market, we help you achieve<br>enduring success by placing the Right people in the Right roles.</p>','','basic_html'),('services',0,120,437,'en',0,'<p>In a rapidly shifting Talent Market, we help you achieve<br>enduring success by placing the Right people in the Right roles.</p>','','basic_html'),('services',0,120,654,'en',0,'<p>In a rapidly shifting Talent Market, we help you achieve<br>enduring success by placing the Right people in the Right roles.</p>','','basic_html'),