21 April 2019

Easter 2019: Another Day to Remember & to Be Proactive...

“Blessed be the God and Father of our Lord Jesus Christ, which according to his abundant mercy hath begotten us again unto a lively hope by the resurrection of Jesus Christ from the dead,”  1 Peter 1:3

COLOMBO (Reuters) - Over 200 people were killed and at least 450 injured in bomb blasts that ripped through churches and luxury hotels in Sri Lanka on Easter Sunday, the first major attack on the Indian Ocean island since the end of a civil war 10 years ago.


On this Easter Sunday 2019, the world mourns the news from Sri Lanka. Across the globe people are reminded that evil remains a constant in our society today and for the future. Our prayers today are evident in every language and every continent...

Looking around your religious venue today you may notice a heightened presence of security and law enforcement.  Our public safety and first responders are on high alert.

So what can you do as a public citizen to learn, prepare and perhaps spring into action if you are ever needed?  How can you train and learn what to do, in the event of a mass casualty incident?  At your place of worship, place of education, place of business or place of recreation.

You can attend a training similar to this one, being offered in a community near you:

"ACTIVE SHOOTER (PAR) TRAINING WITH A FOCUS ON (Your Venue):"

Preparation – Action – Recovery

Mass shootings seem to be more and more prevalent nowadays. As the world focuses all its attention on the “why”, we must focus our attention on how we can better prepare our critical infrastructure sectors and communities alike. Learn about the signs and pre-incident indicators (PII’s) of an active shooter before it’s too late. And learn life-saving techniques during and after an active shooting such as how to use a tourniquet and other items in a “stop the bleed” kit.

PART 1 - PREPARATION: INTELLIGENCE SME - Pre-Incident Indicators / behavioral indicators of potential subjects prior to a terrorism or criminal related incident & how to be situationally aware and prepare for such incidences.

PART 2 - ACTION: SWAT SME - To address run-hide-fight, appropriate response for when law enforcement arrives on scene and active shooter survival kit.

PART 3 – RECOVERY: TACTICAL MEDIC SME: Trauma and treatment post active shooting incident. Use of trauma kit, chest seals and current industry standards. Tourniquet drills will be a part of this training.


If you are a Father, Mother, Brother, Sister or just a good friend, you must continue to think about being proactive.  To be ready.  To be more aware.

Take a moment this Sunday in your prayers for Sri Lanka and soon plan to be more prepared...volunteer at your church, school or business to be a proactive advocate and responder for Preparation, Action and Recovery.

Godspeed...

13 April 2019

Digital Trust: Transparency in a World of Cyber War...

"British police arrested Wikileaks founder Julian Assange on Thursday. He had been hiding in the Ecuadorian Embassy in London since 2012 and was arrested after the Ecuadorian government invited the Metropolitan Police Service into the embassy to remove him. Assange was initially arrested for jumping bail in 2012, but the Metropolitan Police Service subsequently announced that he had been "further arrested on behalf of the United States authorities."

After Assange's arrest, the US Justice Department unsealed its indictment against him. The indictment focuses on Assange's role in helping Chelsea Manning steal classified information from the US military."
  Wikileaks — Julian Assange arrested, charged with conspiracy to hack US computers Assange had been holed up in the Ecuadorian Embassy in London since 2012.  Timothy B. Lee - 4/11/2019, 7:05 AM


Someday in the future, there will be a documentary on the timeline and journey of Julian Assange, beyond what has already been produced about his life and his behavior.

It is going to be years before the U.K. legal system finishes the process it has demonstrated in the past with people and issues such as this one.

Yet transparency remains an important topic here.  Whether you are arguing for greater disclosure on what is going on inside government or within the R&D practices of a Global Fortune 1000 public company, transparent communications to the public and shareholders is vital.

The justice systems will finally have the opportunity to produce the information, that will allow every world citizen, to read about the true facts in the Assange case.

Meanwhile, the use of sophisticated exploit tools by nation states and rogue non-state actors continues to disrupt our international e-commerce.  Many variations of these tools are now in the wild as a result of the actions of Wikileaks and are being utilized in nefarious ways.  Here is just one example:

Canadian Police Raid ‘Orcus RAT’ Author
"Canadian police last week raided the residence of a Toronto software developer behind “Orcus RAT,” a product that’s been marketed on underground forums and used in countless malware attacks since its creation in 2015. Its author maintains Orcus is a legitimate Remote Administration Tool that is merely being abused, but security experts say it includes multiple features more typically seen in malware known as a Remote Access Trojan." Krebs on Security

This latest phase of legal justice is about a digital world that exists underground and unknown to the naive "John Q. Citizen" on the street.  Brian Krebs own transition from journalism at the Washington Post to creating his own blog, is only part of this transparency topic.  The Dark Web and all that is comprised of it, is still growing exponentially.

Remember that only about 4-5% of the world wide web (WWW) is what you are seeing in the searchable "Google" Internet.  The other 95% of the Deep and Dark web, is indeed another virtual world.

The international entrepreneur today who has that new great idea, product or service will be operating on the Internet and the World Wide Web.  No different from years before the Internet when you set up your office/business on Mainstreet, in the skyscraper or in the Mall, yet now your reach is instantaneously global.  Your inventory display, banking, accounting, order entry, distribution and delivery is done with software and global communications networks.

Today and since the dawn of the Internet, every new online entrepreneur has a digital spectrum of Operational Risks that must be addressed as part of your daily business.  Those digital trust factors have created new dimensions of risk and resilience strategies, to counter the size and scope of the expanding cyber crime and terrorism enterprises.

So what?

There are several analogies that could be used here to illustrate the issues associated with selling cyber weapons online or the theft and distribution of those digital weapons in our modern society.  Yet the truth is, international commerce is here to stay and it will require new and more rapid action by business and governments.

Simultaneously, the future of our digital trust and the lack of manpower and enforcement resources is spelled out daily in the public press.  How many times have we heard, that there is a shortage of Cyber Security and Risk professionals in the commercial and government workforce?  There is a reason for this.

Transparency of reporting is vital for the public, so they can make more informed decisions.

Balancing the nightly television news with politics, business earnings reports, weather events and the reality of our expanding "Cyber World War," will soon become the new normal...

07 April 2019

Preemption: An Operational Risk Perspective...

"The global regulation of cybersecurity is one of the most contentious topics on the international legal plane. States, the actors primarily responsible for arranging most other international regulatory regimes, have so far been incapable of reaching a consensus on how to govern international cyberspace. For example, in 2017, the United Nations Group of Governmental Experts, arguably the most promising effort to create international norms for cyberspace, collapsed. In this vacuum, private tech companies are seizing the opportunity to create norms and rules for cyber operations, essentially creating a privatized version of cybersecurity law."  LawfareBlog Ido Ikilovaty

Preemption - A Knife That Cuts Both Ways by Alan M. Dershowitz should be considered for the professional Operational Risk Managers reference library:

Decisions to act preemptively generally require a complex and dynamic assessment of multiple factors. These factors include at least the following:
  1. The nature of the harm feared.
  2. The likelihood that the harm will occur in the absence of preemption.
  3. The source of the harm--deliberate conduct or natural occurrence?
  4. The possibility that the contemplated preemption will fail.
  5. The costs of a successful preemption.
  6. The cost of a failed preemption.
  7. The nature and quality of the information on which these decisions are based.
  8. The ratio of successful preemptions to unsuccessful ones.
  9. The legality, morality, and potential political consequences of the preemptive steps.
  10. The incentivizing of others to act preemptively.
  11. The revocability or irrevocability of the harms caused by the feared event.
  12. The revocability or irrevocability of the harms caused by contemplated preemption.
  13. Many other factors, including the inevitability of unanticipated outcomes (the law of unintended consequences).
Regardless of the agreement or bias of the reader, this book makes you think upside down and sideways about decisions you have made, and will make.

While Mr. Dershowitz takes time to make his own opinions known, his mastery of building the foundation for transformation is unequaled on such a topic; controlling dangerous and destructive human behavior and how to confront terrorism, crime and warfare.

During the course of a single day in the life of the Operational Risk Manager there are dozens if not hundreds of preemptive or preventive decisions to be made.

Private Sector vs. Public Sector is not so much the issue here. Whether you are the Chief Operational Risk Officer at a major banking institution or the Commander in the local Emergency Operations Center, you both have the same dilemma.

A decision must be made quickly and you must be able to live with the implications of either decision.

31 March 2019

Operational Risk Management: Discipline and Professional Development...

You know that the discipline of Operational Risk Management has finally reached the minds of global executives and Board of Directors, when you see growth in the organizations that have established a Board-level Executive in charge of Operational Risk Management (ORM).

The ORM discipline has now spanned several primary critical infrastructure sectors of the global economy for over a decade, including Energy, Financial Services, Information Technology, Defense Industrial Base and others who are highly regulated by government.

Global organizations such as BP as one example, have found the necessity of new Operational Risk capabilities. This is to produce a prudent and consistent strategy after a Gulf of Mexico Macondo Blowout, in other parts of the planet where deep water drilling is still a vital solution.

Goldman Sachs and the other band of brothers in the global financial crisis of the decade past, have reinvested in more prudent Operational Risk Management strategies. The books that have been written outlining the risks of people taking on derivatives of one type or another to hedge the marketplace have been prolific.

IBM, Google, Apple, AWS and Cisco have capitalized on "Operational Risk Management" and its focus on business continuity planning (BCP), continuity of operations planning (COOP) and the facilitation of utilizing cloud computing to enhance the resilience factor of critical systems.
The pervasive growth of people however, utilizing social networking in the workplace, has created its own set of OPS Risk challenges.

Spear phishing, targeted fraud schemes such as Business E-mail Compromise (BEC) and sophisticated software exploits, can be attributed in many cases to the plethora of personal information the criminals and intelligence activities have to work with.

Social engineering, economic espionage and other transnational criminal activities are continually perpetuated by the security and privacy failures of the critical infrastructure industries.

The Defense Industrial Base including the US Navy, US Marines, US Army, US Air Force and our Coast Guard, know the value of effective Operational Risk Management. The discipline is a core aspect of their cultures and is continuously tested and measured on a daily basis.

On the flight line or on the base, these branches of the military use ORM to save lives and protect valuable assets worth millions of dollars every day.

As the Board of Directors focus on ORM across the globe, one can only wait and see how it will impact the discipline of the individuals themselves.

We trust that our practitioners will continue their own quest for expanding the portfolio of thinking and to see that the right people are at the table, to assist in ORM direction and continued global success.

24 March 2019

Operational Threat Matrix: The Mission Ready Many...

"Five years after the release of the Framework for Improving Critical Infrastructure Cybersecurity, organizations across all sectors of the economy are creatively deploying this voluntary approach to better management of cybersecurity-related risks. The U.S. Department of Commerce’s National Institute of Standards and Technology (NIST) issued what is now widely known simply as the “NIST Cybersecurity Framework” on February 12, 2014."

Measuring an incident first requires defining a taxonomy on what an "incident is" and what an "incident is not". In other words, how can you measure something that has not been sufficiently defined in your organization. How do you know when an incident has occurred?

Our corporate assets are under attack by a continuous barrage of new laws, new employees, new competitors and new exploits.

Business survival in the next decade will require a more effective and robust risk strategy to deter, detect and defend against a myriad of new threats to the organization.

Modern day attackers include hackers, spies, terrorists, corporate raiders, professional criminals, vandals and voyeurs. Simply said, these attackers use tools to exploit vulnerabilities. They create an action on a target that produces an unauthorized result. They do this to obtain their objective.

The Mission

The organization shall develop, implement, maintain and continually improve a documented operational risk management system:
  • Identify a method of risk assessment that is suited for the organizations business assets to be protected, regulatory requirements and corporate governance guidelines. 
  • Identify the assets and the owners of these assets. Identify the threats to those assets.
  • Identify the vulnerabilities that might be exploited by the threats.
  • Identify the impacts that losses of confidentiality, integrity and availability may have on the assets.
Assess the risks. Identify and evaluate options for the treatment of risks. Select control objectives and controls for treatment of risks. Implement and operate the system. Monitor and review the system. Maintain and improve the system.

The Take Away

While you were in the Board of Directors meeting, your Operational Risk Profile changed. When you were asleep last night it changed again. The people, processes, systems and external events are interacting to create a new and dynamic threat matrix for your organization.

Who is responsible for Operational Risk Management in your business? Everyone is. You see, if everyone in the organization was able to understand and perform the mission flawlessly, then the business could stay in constant control of how much incidents are costing the enterprise.

Only a guarded few understand the mission of operational risk management in your company. Only a guarded few can do it flawlessly.

If you want to protect your corporate assets better than you do today, then turn those guarded few into the mission ready many.

16 March 2019

Private Sector Mentoring: Operational Risk Specialists to the Rescue...

The international spectrum of Operational Risk Management (ORM) is playing out before us on a global stage.  Nation states and the airline industry are in full crisis management collaboration.

And while all of this, is distracting our attention, the operational risks associated with volatility on a financial world stage continues to unfold.

What will the future hold for global business commerce and the military personnel transitioning from regions of conflict?  Syria. Yemen. Iraq. Afghanistan.

This is where our next generation of "Operational Risk Specialists" will come from, to assist us in our most challenging future of global incidents, crisis and humanitarian requirements.

Yet these men and women will be competing in an economy that is ultra-competitive. There are however, innovative ways for us to hedge the risks for future U.S. veterans as they look for their next mission in the private sector. The first step is an old and very effective method called mentoring:

men·tor

noun

1. a wise and trusted counselor or teacher.

2. an influential senior sponsor or supporter.

verb (used without object)

3. to act as a mentor: She spent years mentoring to junior employees.

verb (used with object)

4. to act as a mentor to

Origin:
1740–50; after Mentor (Greek Méntōr )

Related forms

men·tor·ship, noun

Synonyms
1. adviser, master, guide, preceptor.


It would be in the best interest of the private sector in a world that is challenged by so much change, volatility and uncertainty to have a cadre of "Operational Risk Specialists" who are there at a moments notice.

Working 24 x 7 in concert with all critical business functions, to enhance the resilience of the enterprise. Yet it will take thousands of mentors to assist these veterans, as they transition to this important role and mission.

Are you a CxO that relies now on a small team of risk minded people, tasked with your supply chain, personnel security, information security, facilities or even insider incidents? You are the perfect catalyst to get a new program going at your organization.

Begin the process of identifying and tasking the right people in your organization, to be mentors for the new "Operational Risk Specialists," that you should hire over the next few years.

What would happen, if you created a whole new way for you to mentor, hire, mentor, train, mentor and grow, a new generation of risk management professionals for your organization?

How might the performance and the resiliency of your enterprise improve, with the ongoing mentoring of veterans as they begin to understand the business of the private sector. A different and yet similar environment for the management of operational risks.

Your vision should be to create a "VetAccelerator" for each of your organizational business units. To engage mentors with new veterans returning and transitioning from almost 2 decades of war.

We have done this before in our U.S. history and it will not be the last. Let all of us embrace the opportunity to strengthen our business engine and to improve our resilience in the new world order.

Finally, never forget how all of this latest chapter started. And how it still continues to play out on a daily basis. Our vigilance is an imperative and veterans will be our Go-To "Operational Risk Specialists" for years to come.

09 March 2019

Trust: In Pursuit of Implicity...

RSA 2019 was another event for the vast spectrum of security and privacy professionals to reflect on, regardless of the color of hat you wear.  One word seemed to be prevalent in this years atmosphere:


trust (trŭst)n.

1. Firm reliance on the integrity, ability, or character of a person or thing.
—Related forms
trust·a·ble, adjective
trust·a·bil·i·ty, noun
truster, noun

—Synonyms 1. certainty, belief, faith. Trust, assurance, confidence imply a feeling of security. Trust implies instinctive unquestioning belief in and reliance upon something: to have trust in one's parents.
To have real trust in something or someone, you don't even think about it. It's implicit.

If you start to think about it, then it is not really trust in it's purest form. In Operational Risk Management (ORM), we are always in pursuit of trust. We want to trust our sensors, monitors and fail safe process.

Yet we know that this is why we train for contingencies. Because failure is always a possibility, even if it has a .00000000000099 probability.

As a true Operational Risk professional, you train for the remote possibility of failure and create alternative scenarios to test your contingencies. And when you find what works through exercises and experimentation, you put that in your memory bank or cache of alternatives. Never knowing when you will have to use it again.

And when it comes to trust and human beings, there is only one way we know you can get to implicity. It is through testing, training and observable behaviors.

And when this person or software algorithm has demonstrated that they are able to repeat the tasks, actions and behaviors with a .00000000000099 probability of failure, that is when trust begins to become inherent.
"Trust will not be accomplished 100% through AI / ML technologies when humans are still creating and writing the code. Nor the convergence of information in a database. It can only be forged through actions and observable behaviors."
Outcomes based upon sound planning, training, testing and continuous contingency operations. Only then will we reach the level of implicity we seek.

23 February 2019

OPS Risk: Military Lesson for Wall Street...

Historically, privacy was almost implicit, because it was hard to find and gather information. But in the digital world, whether it's digital cameras or satellites or just what you click on, we need to have more explicit rules - not just for governments but for private companies. Bill Ga
Read more at: https://www.brainyquote.com/quotes/bill_gates_626047?src=t_privacy
 "There is no avoiding the realities of the information age.  Its effects manifest differently in different sectors, but the drivers of speed and interdependence will impact us all.  Organizations that continue to use 20th-century tools in today's complex environment do so at their own peril."  Stanley A. McChrystal
Historically, privacy was almost implicit, because it was hard to find and gather information. But in the digital world, whether it's digital cameras or satellites or just what you click on, we need to have more explicit rules - not just for governments but for private companies.
Read more at: https://www.brainyquote.com/quotes/bill_gates_626047?src=t_privacy
Almost ten years ago, Air Force Brig. Gen. Mark W. Graper, the 354th Fighter Wing commander at EIELSON AIR FORCE BASE Alaska, quoted the essence of Operational Risk Management.

Corporate Executives and mid-level management should have this made into a poster for their office and hanging in every hallway:
"Summer is just around the corner, and many of us are planning for our favorite warm weather activities - fishing, hunting, hiking, motorcycling, camping and more. All of our summer plans can be fun if we keep in mind the basics of operational risk management: Accept risk when benefits outweigh the cost; accept no unnecessary risk; anticipate and manage risk by planning; make risk decisions at the right level; assess and mitigate risk. Stated more simply, have a (prudent) plan, have a backup plan and have a Wingman."
Whether you are focused on the safety and security of your personnel, the integrity and confidentiality of your information or the continuity of your business operations, consider this.

Effective "Operational Risk Management" will improve your organizations resilience factor.

The brilliance of Brig. Gen. Graper's emphasis on this subject away from the flight line or "The Office" is his understanding, that most of us will become more complacent the minute we hit the parking lot.

You see, OPS Risk is not just something being advocated in the Wall Street workplace. It should be just as pervasive at home or in our own leisure activities. Whether you are climbing "Denali" or entertaining friends around the backyard pool, you have to be continuously in OPS Risk mode, or it could bring harm to life, limb or your own reputation.

Operational Risk includes the risk of litigation and there is one item you can be certain that is a threat to your corporate integrity. Employees, partners and suppliers to your organization:

What most organizations the size and complexity of Facebook under estimate, are the speed of change and the socially "connected" market economy. The blur of business combined with the "Holistic Blindness" of what privacy risks are a threat today or this week, can bring an enterprise to it's knees and then to it's ultimate demise.

"Facebook Inc. (FB - Get Report) and the Federal Trade Commission currently are negotiating details of a settlement related to the Cambridge Analytica scandal, the Washington Post reported, citing people familiar with the matter.

The penalty imposed by the FTC likely would be a multi-billion dollar fine, which would easily be the largest fine ever issued to a tech company by the FTC. In 2012, Alphabet Inc.'s (GOOGL - Get Report) Google was fined $22.5 million by the agency for user privacy offenses.

The two sides are still negotiating the amount of the fine. If no agreement is reached, the FTC could take the issue to court, according to the Washington Post.

Facebook's privacy issues date back to 2012. Facebook settled a case with the FTC in August 2012, when the two parties reached an agreement that "Facebook must obtain consumers' consent before sharing their information beyond established privacy settings," according to a press release from the FTC published at the time the deal was made.

Facebook's privacy issues continued last March when news broke that Cambridge Analytica, a political research company, had harvested user data beyond what was acceptable. It later became evident that Facebook likely was aware of Cambridge's actions on the platform" 


Whether it's collecting user data to sell to your supply chain or keeping your F-22 Raptor in the air to defeat hostiles, OPS Risk is the differentiator. Your survival depends on it...

17 February 2019

Powerbase: Information Operations in the Workplace...

How robust is your organizations "Information Operations"(IO) capabilities? The degree to which the threat to your institution escalates in a war of words is going to be in direct proportion to your ability to monitor and counter the "Powerbase" within your Information-centric community.

Operational Risk within the institution, the city or the country is a factor of the likelihood of a particular threat and the ability to deter, detect, defend and document the threat.

However, the overt abilities to sensor, block or suppress your particular community from communicating freely, will be difficult if not impossible. Or will it?

Nations states have for years been subjected to the technology innovation of proxy servers and other methods for obtaining blocked Internet content.

The human element of the insatiable pursuit of information will continuously provide for the innovation to obtain that information that has been withheld from the community.

Whether that community is a corporation or a country, the employees or the citizens will find a way to gain the access and obtain the information they seek.

The ability to utilize ubiquitous devices such as camera enabled wireless smart phones has changed the landscape for "Information Operations" within your company and your local community.

Operational Risk professionals are keenly aware of the requirements to monitor and detect the use of rogue communications devices in the workplace, including unauthorized broadband hot spots (simple and effective).

Yet the state of business and politics precludes these individuals from truly understanding what their real role should be in this fight for zero's and one's. The fight is not about learning who has unauthorized access, it is about understanding human behavior and the "Powerbases" within a particular community.

Even the use of more sophisticated wireless mesh networks has been pervasive for years within the context of the USIC and where U.S. defense forces need to operate in areas with little or no telecommunications infrastructure.

The questions begs then, to what degree are these same kinds of capabilities being utilized within the context of industrial espionage and foreign intelligence services within the skyscrapers of downtown Washington, DC, Chicago, New York or Los Angeles?

"Having a better understanding of the powerbase of each actor, the number and types of dimensions of that power, which elements of the powerbase are inherent or inferred, and whether it is growing or shrinking through cooperation or conflict, are all essential elements of information in stability operations and prerequisites for effective influence operations. Understanding Local Actor Bases of Power" - Col. Patrick D. Allen, USA (Ret.)

So how easy or difficult would it be to set up a relatively effective mesh network? Look to one of the leaders in the technology itself for guidance.

If the City of Houston or the country of Singapore can utilize these capabilities to create their own information networks for voice, video and data applications, then so too could any private enterprise with the right funding and the people to operate these systems.

Your organizations "Information Operations" capabilities go far beyond the IT department and their ability to sweep for rogue "Wi-Fi Hotspots" in the workplace. It could mean the difference between the safety and security of your municipality or the entire academic R&D campus.

In either case, the Powerbase of information will still have to be analyzed and understood. Without this Powerbase insight your organizational "Operational Risks" will remain unknown and your ability to mitigate these risks unknowable.

09 February 2019

Givers: The Master Plan for Grit...

"Of course, natural talent also matters, but once you have a pool of candidates above the threshold of necessary potential, grit is a major factor that predicts how close they get to achieving their potential. This is why givers focus on gritty people: it’s where givers have the greatest return on their investment, the most meaningful and lasting impact."  Grant Ph.D., Adam M.. Give and Take (p. 106). Penguin Publishing Group. Kindle Edition.
This quote is in chapter 4, Finding the Diamond in the Rough - The Fact and Fiction of Recognizing Potential.

Having passion and perseverance in any endeavor is worthwhile.  In this chapter of Adam Grant's book, he is talking about "Givers".  You will have to read the book to better understand the research of 30,000 people behind who you are and the difference between "Givers and Takers".

Flashback to your early years as a kid in elementary school.  Now think about all of the activities and endeavors your parent(s) had you involved with, in or outside the classroom.  Were you involved in the scouting or other after school activities?  What about your local church or synagogue?  Maybe your parents were even Boy or Girl Scouts themselves?  Did they achieve "Eagle" or the "Gold Award"?

Flashback to your years in Middle and High School.  Were you involved in Sports Teams or maybe the Marching Band?  Or perhaps the more academic or creative teams like "Debate" or the "Thespian Club".

What about in University or College?  Did your passion and perseverance for sports or other skill-building endeavors, keep you gaining more of what is called "Grit", a firmness of mind or spirit, unyielding courage in the face of hardship or danger.  Were you able to graduate within 4 years and then obtain a decent job or commission to start your career?

If you accomplished all of this and are now well on your way to discovering and building a life full of rewarding experiences, you probably need to say "Thank You".  To your Mother, Father, Teacher, Boy/Girl Scout Leader, Coach, Commander or Professor.  They are the ones that got you to where you are today.

Yet if someone ever calls you a "Diamond in the Rough" you should consider that a complement.

And you should also consider what they meant by that reference.  It means that they as a "Giver" who focus on gritty people, have found what they are always searching for.  They have recognized that you too are someone that stands out, that has the knowledge and the skills and that extra perseverance they are always in search of.

You may be wondering when your time will come.  When you will finally feel like you have "Made It" in life.  That you are truly happy.  Guess what, you are not there yet...

Why?

It is because you have not reached all of your potential, designed just for you.  The "Master Plan" for you is unique and you must realize that there is no visible finish line.  There are only more opportunities, tests, more challenges, significant success and substantial road blocks.

Being a "Giver" in your life means that you seek a path that puts you in pursuit of others just like you.  You know when you have found your Tribe, your calling and you know that they will be there to help you through the tough times and to persevere.

Now it is time, for you to contribute.  Your knowledge.  Your skills.  Your passion...yet do not fear asking for help.  The "Givers" in your community are searching for you now...

Godspeed!

02 February 2019

Transparency: "Square One" in ORM...

Operational Risk Management (ORM) has been evolving for over a decade. There are new insights into why effective business process management coupled with Operational Risk architecture makes sense, through the lens of the Board of Directors. Transparency.

Still to this day, the questions remain:
  • What can my organization do about the risk of loss resulting from inadequate processes, people, or systems?
  • To what extent should my organization link employee compensation or job performance with operational risk management?
  • How is operational risk taken into consideration when new products or technology solutions are designed or acquired, deployed, and executed?
  • Does my organization have an inventory of its key business processes with documented controls and designated senior managers responsible?
Can these questions be answered in a book of 308 pages from 2008? It was a good start, to say the least. The authors understood, that to really embed a culture of (ORM) into the enterprise, you have to begin at the architecture level, the business process level.

This is far in advance of the governance of information and the business rules coded into software systems, even for such mundane corporate tasks as expense report or travel request review and sign-off.

You see, some companies still think that they are just doing fine with their Safety and Security Team, Continuity of Operations and Crisis Team, Chief Information Officer (CIO), General Counsel (GC), Chief Financial Officer (CFO) and in limited cases the Travel Risk Management department all working autonomously. They think that having a few dedicated investigators to look into corporate malfeasance, is all they require in a corporate population of tens of thousands.

What do we mean by autonomous? Not what you may think. There is no doubt that the leaders of these organizational departments are cooperating and coordinating functionally. They have each other on speed dial. They share high level red alert Intel with each other.

The question is, what is being done at the metadata level of the Operational Risk Enterprise Architecture (OREA)?

How are they designing Operational Risk Management systems to answer key questions at the speed of business? To continuously adapt to an organization’s changing global environment, executives must know about, keep in balance, and communicate several vital components:
  • What are the organizational strategies (Strategic Intent) and how these should be implemented (Strategy Development and Organizational Change)
  • What organizational processes are executed and why, how they are integrated, and how they contribute to the strategy of the organization (Business Process Management)
  • How human resource utilization is working and whether there is optimum use of skills and resources available across processes and functions (Human Resource Management)
  • To what extent the enterprise organizational chart is cognizant of appropriate roles and responsibilities, in order to effectively and efficiently carry out all work (Organization Management)
  • What IT applications exist and how they interface with what processes and functions they support (IT Portfolio Management)
  • How the performance of each process, each function and each individual adds up to the organization’s performance (Performance Management)
  • What projects are currently underway, how they effect and impact change, what processes and IT applications they change and how this contributes to the strategy of the organization (Project & Program Management) 
Is Operational Risk Management (ORM) about "Big Data Analytics"?

Only if your organization values better transparency, governance and regulatory compliance. Ask the Board of Directors their answer on this question to determine whether ORM is a "Big Data Analytics" issue. How big is big?

The momentum for transparency is now at the U.S. government level of commitment.   It is the law. Big Data Analytics will mean nothing, without increased transparency. Now we can ask the questions that we all want answers to.

The Operational Risk Management (ORM) architecture of your enterprise will now begin with transparency, as the fundamental "Square One".

26 January 2019

Davos 2019: A War on Trust...

As the World Economic Forum Annual Meeting comes to a close in Switzerland, "Trust Decisions" are on our mind.
"The corporate, political and cultural elite gathered in Davos are expressing worries about a disturbing trend: The erosion of public trust in institutions and companies.

World Economic Forum attendees said the lack of faith in everything from governments to social media platforms is hampering innovation and contributing to widening inequality."
 Why?

Over five years ago the new rules for business and the Net were in plain sight.  Articulated in a way that most business owners, CEO's of global enterprises and even our politicians could understand.

Yet at this years Annual Meeting, trust is becoming a buzzword in the panel discussions and around the dinner tables in Davos.  How might the institutions attending the World Economic Forum, strive to build a planet where "Achieving Digital Trust," is the basis for starting a business or at ground zero of creating a new product?

In 2015, Jeffrey Ritter published his book:

"In reading this book, you will explore and acquire an entirely new portfolio of tools and strategies to help shift the momentum of that war. As in any combat or battle, to succeed, it is essential for you to understand what is at stake. What we are facing is more than a war to control information. It is a war on our ability to trust information. Yes, a war on trust." Achieving Digital Trust by Jeffrey Ritter

To presume the trustworthiness of information is now a continuous question. GDPR and other forward leaning regulations are beginning to shape the way we design our systems.

So what?

How will those citizens and consumers that are devouring information from that electronic photography and RF device in the palm of their hand, think differently in the next few years?

How will the designers and engineers of Samsung, Apple, IBM, Amazon, Google, Facebook and others architect their new software and solutions with trust embedded in all that they produce?

When will our citizens understand that not selling your data, does not actually mean that your data has not been given away for free?

The future of our institutions, governments, products and relationships must be built on trust.  As you sit across the table from your editor, your CEO, your elected official or your senior software engineer you must ask the question, how will we achieve digital trust?

What if there was a Green, Yellow, or Red banner across the top of the display screen, as a quick identifier whether the information being delivered and displayed was in compliance with the new "World Digital Trust Standard"?

Yet we know that "Green Padlocks" in front of our URL and the "Privacy Essentials" grade in the top of our browser, just isn't enough.  Especially when we know that there are U.S. DHS Emergency Directives such as 19-01 in place:

"In coordination with government and industry partners, the Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) is tracking a series of incidents1 involving Domain Name System (DNS) infrastructure tampering." 


Jeffrey Ritter is correct.  It is a war on our ability to trust information.  Do you understand what is at stake in your nation state?  Your organization?  Your household?  Yes, a "War on Trust"...

19 January 2019

International Risk: Cyberwarfare Rules of Engagement...

When the financial private sector views the actions of government, in terms of regulation and compliance, it is often considered another risk to its operations. Why? More rules and the need to report on oversight, creates new obstacles to other more valuable revenue producing activities.

CDOs were a focus in the movie "The Big Short" and is an example of a financial product that explains why the government regulation mechanisms continue to exist. Yet the implementation of internal controls, to thwart the embezzlement of funds or the theft of proprietary intellectual secrets, is something that is encouraged and welcomed in the banking community. This paradox is something that continues to occur in the cyber risk management domain.

The dawn of Internet banking, spawned many of the Operational Risks associated with using public networks for our various banking transactions. The oversight of cyber risk management in the financial institution, is still a major challenge yet becoming more mature by the day.

Government is more effectively learning how to apply the right oversight with private sector institutions, through the use of International Standards such as ISO 27001 and NIST best practices to protect Critical Infrastructure.

The newest strategies for cyber risk management have been a robust topic of global conversation. New reports on the origin of state sponsored hacking and cyber crime data breach incidents, has produced some new theories on how to address these international Operational Risks:

"Deadly force against organized hackers could be justified under international law, according to a document created by a panel of legal and cyber warfare experts. Use of lethal force on those behind a cyberattack on a nation would be legal if the virtual attack meets criteria similar to those currently accepted for real-world warfare, said Michael N. Schmitt, chairman of the International Law Department at the U.S. Naval War College in Newport, R.I. Schmitt is the editor of the Tallinn Manual on the International Law Applicable to Cyber Warfare, a 300-page book put together by a score of experts at the request of NATO and published by Cambridge University Press."

Even the most knowledgeable cyber experts, are at odds over the topic of "Active Defense" and the use of asymmetric cyber force, to retaliate against a so called attack or denial of service. A kinetic response is much more clear, based upon the source or attribution evidence of the attack. In the cyber domain, the word "Attribute" has some very interesting ramifications.

The State-of-Play will remain the same and for good reason. The governments of the world do not have issue with each other performing reciprocal cyber espionage. This practice is just a new version of intelligence collection and the next manifestation of Tinker Tailor Soldier Spy. However, if there should be any visible or kinetic damage to infrastructure, then the Tallinn Manual will be a vital resource for all. The question remains, what is a cyberattack? Jim Lewis said over five years ago:
“Cyberattack” is one of the most misused terms in the discussion of Chinese hackers. With very few exceptions, China has not used force against the United States in cyberspace. What it has been doing is spying. And spying, cyber or otherwise, is not an attack or grounds for war, even if military units are the spies. Spying isn’t even a crime under international law, and it wouldn’t be in Washington’s interest to make it so."
  Cyberwarfare Rules of Engagement remains a significant international Operational Risk...

12 January 2019

4th Generation Warfare: Insider Risk...

Flashback to 2010.  Over 8 years ago, this author discussed the situational awareness and the implications of the "Stuxnet" malware that was being investigated by international authorities. In January 2011, the New York Times published a more detailed set of facts and a hypothesis that the sophisticated "worm code" was tested in Israel:

William J. Broad, John Markoff and David E. Sanger.
The Dimona complex in the Negev desert is famous as the heavily guarded heart of Israel’s never-acknowledged nuclear arms program, where neat rows of factories make atomic fuel for the arsenal.

Over the past two years, according to intelligence and military experts familiar with its operations, Dimona has taken on a new, equally secret role — as a critical testing ground in a joint American and Israeli effort to undermine Iran’s efforts to make a bomb of its own.

Behind Dimona’s barbed wire, the experts say, Israel has spun nuclear centrifuges virtually identical to Iran’s at Natanz, where Iranian scientists are struggling to enrich uranium. They say Dimona tested the effectiveness of the Stuxnet computer worm, a destructive program that appears to have wiped out roughly a fifth of Iran’s nuclear centrifuges and helped delay, though not destroy, Tehran’s ability to make its first nuclear arms.
4th Generation Warfare (4GW) and the implications for global critical infrastructure organizations is obvious. The Operational Risks associated with targeted infiltration of systems that control machines, manufacturing processes and software that manages transportation, has now changed the baseline for where to begin mitigating this asymmetric threat.

Executives then and to this day, realize the continuous requirement for improved focus on the "Insider Threat" to their systems operations. Why?
This particular worm was initially delivered by a USB Thumb Drive according to various reports. This means that someone would have to have been inside the facility targeted for the attack, to actually introduce the malware to the actual system controller. A person within the perimeter of the organization with this single device, could set the chain reaction in motion.

Whether you are a major manufacturer or an electric utility doesn't matter. The person you trust to access systems inside the organization, is the basis for mitigating this type of attack. Most important is the scrutiny associated with the extended supply chain of semi-trusted contractors or others known to the organization. 
All of the back ground checks and other methods for determining someone's character will not be the major deterrent to a worm introduced internally to an Intranet, with the use of a USB thumb drive.

So what is the answer to address this threat?
A TSA-style check, scan and pat down at the entrance to every commercial enterprise that has computers inside with open USB ports? This is very unlikely in the near term for most facilities.

What about disablement of the technology itself, that turns off the ports themselves on each system inside the organization perimeter? This solution is more likely to deter many opportunities for this type of USB style attack to occur, yet still doesn't remove all of the risks against another possible vector to the network through a CD drive as an example.
Regardless of the method or the controls you employ to mitigate this risk, it will not eliminate the entire threat from your organization. Even the use of a "Digital Sandbox", Endpoint security measures or other methods to disable ports on systems will entirely lock down your organization.

There is only the ability to create a more resilient and durable environment to survive a significant business disruption. The mind set shift to durability and the latency to recover, now becomes the new strategy for these kinds of risks.
Using a strategy for "Business Resilience" is one that requires significant resources, a Global Security Operations Center (GSOC) and a committed management team. The ability to survive is the first part of the process and how soon you return to full operational capability is the metric. How long does it take to bounce back to normal from a major crisis, in your organization?

The ability to manage emerging risks, anticipate the interactions between different types of risk, and bounce back from disruption or crisis, will be a competitive differentiator for companies and countries alike in the 21st century.

Homeland security is often seen as a protective, even defensive, posture. But Maginot lines are inherently flawed. Fences and firewalls can always be breached. Rather, the national focus should be on risk management and resilience, not security and protection.
Resilience—the capability to anticipate risk, limit impact and bounce back rapidly—is the ultimate objective of both economic security and corporate competitiveness...

05 January 2019

Quantum Governance: The Rules of Trust...

People are learning to trust an AI, to make decisions on their behalf.  This will change our world exponentially in the next 10 years.

Now that we have reached connectivity to the Net with 50% of the human connected population, the AI of the IoT will be a growing trust factor in our daily lives.

We are accelerating beyond the simple tools of trusting that the answers to our questions are correct from "Siri" or "Alexa."  Accepting the trusted route from Google Maps on the most ideal navigation to our destination is already a given.

Beyond the consumer, the "Algo Bots" and Algorithmic Trading have already replaced the previous years of approximately 600 Goldman Sachs traders with 2 people, to oversee daily operations on the floor.  There are others who have already predicted the replacement of other human operators in various public and private decision-making bodies.

So what?

Trust Decisions in the next decade will be augmented by "Artificial Intelligence" on a more frequent basis.  That is already a given for many groups of decision makers across the globe.  The question is, how will governments begin to regulate AI?

Who will be in charge of making sure that the code and the algorithmic activity is correct?  That the rules behind the Trust Decisions are correct?

You see, as the software becomes more invasive in an individuals daily life and we rely on it for the truth, governments will be involved.  They already are.

The "rules for composing the rules, that lead to millions of peoples trusted decisions is at stake.  Maybe even more so, the evolution of "Quantum Law."  For those thought leaders such as Jeffrey Ritter who have for years been so keen to articulate the emergence of the thought of governance of unstructured data, there is this:
"We are moving from a time in which we presume that all electronic information is true to a time in which we can affirmatively calculate what it is and know the rules by which it is governed on the fly," Ritter said. "That's quantum governance."
You realize that the words will live on for eternity and for others to always contemplate.  That is a given, that all of us shall be considering for our future, sooner than later.

So how might decision making bodies such as the U.S. National Security Council (NSC) utilize AI?  Greg Lindsay and August Cole have already addressed this years ago with METIS:

"The result is a national security apparatus capable of operating at, as you like to say, “at the speed of thought”—which is still barely fast enough to keep up with today’s AI-enhanced threats. It required a wrenching shift from deliberative policymaking to massively predictive analysis by machines, with ultimate responsibility concentrated in your hands at the very top."

In 2019, begin thinking deeper and longer about your TrustDecisions...

30 December 2018

Year 2019: Accelerating Towards Resilience...

The year 2019 is upon us and your time for reflection on the past year should provide new insights.

As you review all the major events and milestones of your life in 2018, focus on what you have learned.  Write down at least three areas of your life that will improve or be better, as a result of some new insights or lessons, that are being applied from your past 12 months.

Consider the application of a new online tool or process, to improve your daily tasks such as a simple calendar or even Trello.  Perhaps you even found a new routine to help you get a better nights sleep, so you feel rested and more effective in your role or specialty each day.

How might you change the way you approach your relationship building, with the use of a more transparent and direct communication style?

Launching into 2019 is a daunting challenge and yet so multidimensional from an "Operational Risk" perspective.  Here is a quick review:
Operational risk is defined as the risk of loss resulting from inadequate or failed processes, people, and systems or from external events. These risks are further defined as follows:

*
Process risk – breakdown in established processes, failure to follow processes or inadequate process mapping within business lines.

*
People risk – management failure, organizational structure or other human failures, which may be exacerbated by poor training, inadequate controls, poor staffing resources, or other factors.

*
Systems risk – disruption and outright system failures in both internal and outsourced operations.

*
External event risk – natural disasters, terrorism, and vandalism.

The definition includes
Legal risk, which is the risk of loss resulting from failure to comply with laws as well as prudent ethical standards and contractual obligations. It also includes the exposure to litigation from all aspects of an institution’s activities.
Now with Operational Risk in mind, begin your journey map for 2019.  Left to right on a 8.5 x 11 sheet of paper, start sketching out your timeline.  Draw some square bubbles of major work or life tasks that you will be involved with or places that you will be traveling to across the globe.

In advance of these square bubbles of activity, what needs to be accomplished in general, that you need to do or prepare for, to help insure the success or minimize the risk of a potential failure?  Draw some small circle bubbles around those squares in advance, to give you a more visual perspective of the "Operational Risk" areas that should be considered.

Maybe you are embarking on a new career or major work project.  Maybe you will be traveling overseas to new countries.  Maybe you will be creating a new business unit or product.  Maybe you will be growing your social network.  Maybe you have a son or daughter getting married.  Maybe you have a loved one who is now transitioning to an "Assisted Living" facility or moving in with you for care.

Now that you are looking at your sketch, it is time to embark on your upcoming Operational Risk missions.  There is always time that can be devoted to your advance work.  Your preparation.  Your "What if" scenario thinking.

"What if" you asked your team, your group, your family, your company to devote just a few more hours this year to Operational Risk Management (ORM)?  How might your fellow workers, team mates or family members benefit from fewer Surprises,  Unknowns,  Significant Disruptions, even  Outliers?  How might this bring all of you greater confidence?

You see, 2019 and beyond will be even more challenging and multifaceted.  Our world is accelerating.  We have grown less patient with rapid change itself.  The chaos you feel and the anxiety that our human emotions are experiencing, is simply a factor of our readiness.  Our ability to adapt and to pivot just at the right moment.  Accelerating us towards greater Resilience...

23 December 2018

Christmas 2018: What Do You Believe...

In a day or so, you will be communicating with or traveling towards your loved ones, your family.

We celebrate Christmas across the globe and billions of people give our time and our resources to those who are in need.  Why?
"She will bear a son, and you shall call his name Jesus, for he will save his people from their sins." - Matthew 1:21
When you think about life and the journey it takes you on, there are so many "What if's" that could have made it so different.  Your history and the decisions that your family made and that you have made in life, is all before you.

Starting with "What do you believe"?

Flash back in your life to your first ten years.  Where were you?  What did you and your family do around Christmas?  Are you still doing some or all of those same activities and do you have the same beliefs?

As you touch those you wish to share time with this Christmas, think back to where your journey started.  What have you accomplished since then?  How many others are you with now, to celebrate?

All of us have been born with the ability to believe.  The choices you have made in life so far and the choices ahead, will navigate your particular path in life.

Those decisions, may not have been the right ones at the time.  Perhaps human emotion overwhelmed you at the moment and now you wish you could reverse it and go back in time.

You can't alter history and the "Trust Decisions" you have already made in your life so far.  Yet you can be forgiven.  Asking for forgiveness is possible for everyone.  You can be saved from your sins and your own behavior, just by believing.

Are you a Daughter or Son?  A Sister or Brother? A Wife or Husband?  A Mother or Father?  A Cousin?  A best friend or colleague?

And for all of those "Who Serve" and are too many miles away from your loved ones right now, we are thinking of you and praying for your safe return.  You know who you are.

You most likely have someone else you care about and who you can pray for or with, this Christmas season.  Take a few minutes now, and do this...

16 December 2018

Organizational Pulse: Digital Teams Building Trust...

"We needed to enable a team operating in an interdependent environment to understand the butterfly-effect ramifications of their work and make them aware of the other teams with whom they would have to cooperate in order to achieve strategic--not just tactical--success."  --Stanley McChrystal, Team of Teams-New Rules of Engagement For A Complex World

Does this sound familiar?  Your organization has been becoming more decentralized for decades.  You have key executives and teams working and operating from places you never imagined.  This is why learning from others who have been there before might be a wise exercise.

General Stan McChrystal (U.S. Army, Retired) and his collaborators know a thing or two about the challenges of teams, operating towards a single mission in multiple geographic locations, including the cultural realities operating from an ultra-competitive management network.

Think for a moment about your own organizational design and how it has evolved over the course of your growth.   Why does it look that way, when you stare at the latest version of the "Organizational Chart"?

Now this chart may very well be a factor of your age, especially if you are an organization that had substantial growth prior to the year 2000.  Yet if you have been building a company or your own "Team-of-Teams" in the last decade, your abilities and organizational design will be a factor of the digital era.

If you had the opportunity to start from scratch, in 2019, how would you build your company so that you could achieve Digital Trust? What platforms, tools and applications would you standardize your future growth on? How will you insure that as you scale up and grow the organization, that the complex interdependencies will be able to sustain the velocity?
"Building for digital trust must become a priority of the nation-state and its components. Once ubiquitous computing is achieved, digital trust will become the competitive differential within the global space of the Net. Nation-states that position their regulatory rules to enable private sector companies to build digital trust more effectively will generate genuine advantage for both the public and private sector. But nation-states must also invest in building digital trust in their own infrastructures and services."  --Jeffrey Ritter
 So what?
If true, that "digital trust will become the competitive differential within the global space of the Net" then how will you proceed?  Have you already answered "What is your "Why"?

The Information Technology (IT) choices are vast and the operating standards for privacy, security and architecture are already published.  Your greatest challenge ahead still remains in front you.

The "Leadership of Security Risk Professionals" (LSRP) is more than just raising awareness, utilizing trusted digital methods and testing operational processes.  It is about "Organizational Pulse" and "Asking," "Listening" and the time to "Verify/Clarify."  Guess what General Stan McChrystal understood about building a successful "Team of Teams"?

Operating day-to-day in crisis and chaos requires something new.  Something different.  A "Crisis Communications" dialogue, that has achieved digital trust.  A shared consciousness that can be learned and implemented with your own "Security Risk Professionals" leadership...

Onward!

09 December 2018

Waves of Discourse: The Pursuit of Context...

As you contemplate your next activities in your new evolving startup, business unit or innovation cell, you may have lost some sleep.  You wonder what the next set of narratives and efforts shall be, to get your team aligned, not just vertically yet even more so horizontally.

The mission could be well defined and the vision articulated in just a few sentences.  Now the real question of Operational Risk Management (ORM) remains.

How effective will we execute the activities across our entire domain expertise, so there is exceptional horizontal communication, coordination, cooperation and continuous team context?
Context noun
con·​text | \ˈkän-ˌtekst
Definition of context
1 : the parts of a discourse that surround a word or passage and can throw light on its meaning

2 : the interrelated conditions in which something exists or occurs : environment, setting the historical context of the war
As the manager, leader, chief or key executive in your organization, what are you doing to provide your team continuous context?  How are you implementing the narratives and the tools to enable the development of and rapid understanding of contextualization for your team?

You see, they may understand the hierarchy.  They can see it on the organizational chart you created and e-mailed to everyone.  They might even have some grasp of the particular area of specialty or expertise that each department or "Line of Business" has for the delivery of their product or solution.

Now think about the "Waves" of discourse that exist in the environment that you are operating in today.

What is the current state of the setting or conditions that you will be executing your duties and tasks to achieve the mission this hour, this day or this week?
  • The "Waves" of change in "Location 1" are no doubt quite different than the change going on in "Location 2", such as the weather.  That is why you have multiple tools and methods to constantly observe the geographic anomalies that are occurring in these places, in almost real-time.
  • The "Waves" of change in the team supply chain for energy, data, fuel, resources and communications speed is continuously being monitored by sensors, that are both automated and human-based.
  • The "Waves" of change of the target market are continuous and requires substantial resources and analysis to gather, synthesize and report a contextual understanding of the current state of the environment.
The Mission.

Getting your team "Horizontally Aligned" is the real mission.  Think about it.  How does your organization provide context between business units, innovation cells or your particular product or solutions, to enable you to begin to achieve the shared mission?

On almost every successful journey, those individuals who are traveling across terrain, in the oceans or in our digitally-based stratosphere, there is utilization of some kind of navigational tools.  Whether it be the compass, a GPS or even the Domain-Name-System (DNS).

Yet what are you using to navigate your own organization?  What visually oriented ways are you providing context to your employees and other stakeholders so they can be more effective?

Begin the exercise with your team, by asking each of them to bring their own "handout" to the next quarterly meeting.  The handout should encompass their current business unit purpose, market approach and how it fits into the larger mosaic of the organization.

What is the likelihood that each person will end up bringing the same type of "handout"?  Will each bring a document full of words.  A document full of numbers.  Or will someone bring a map?  Is it one page, or many?

If your team ends up with all three and there is not any single method or tool that has created the handout, you will now understand why you are currently experiencing these significant "Waves" in your organization.  You are simply not in horizontal alignment.

It all begins with a map.  Now the question is, what kind of maps?

This is your first moment of contextualization.  You have clearly demonstrated that everyone is out of synch with each other on their understanding and perception of how the mosaic looks and "works" in your organization.

The Take Away.

Once you think you know and understand the vertical and horizontal set of solid and dotted line relationships in your organization, take a step back.

Now as you look at your new single journey map, realize that all these people and locations or processes or hubs are not equal. Regardless of rank or title, their influence or "Powerbase" of each, is a completely different factor in your "Waves of Discourse"...

01 December 2018

Survival: Experiential Learning to the Rescue...

Change is in the wind.  You have heard this before and the truth is, that this is not anything new.  We have only started to understand however, how the accelerating pace of change, is impacting us.

The number of App's staring at you in the palm of your hand should be one indicator.  How many are you using on a daily basis now?  No longer are we spending a work day logged into an e-mail client, our word processor and maybe the spreadsheet or database application.

The pace of change and the number of places we access our valuable daily information is rapidly taking over our lives.  We have seen the growth of Fortnite now at exponential proportions and little did Potomac Computer Systems, now Epic Games know what was ahead of them upon their founding in 1992.

In the gaming industry they have genre(s) and Fortnite is a survival game:
Survival games are a subgenre of action video games set in a hostile, intense, open-world environment, where players generally begin with minimal equipment and are required to collect resources, craft tools, weapons, and shelter, and survive as long as possible. Many survival games are based on randomly or procedurally generated persistent environments; more-recently created games are often playable online, allowing multiple players to interact in a single persistent world. 
Wake up corporate management.  As you proceed to continue your growth in your particular industry over the next decade, think about the pace of change.  How fast will you be able to pivot, adapt and survive in your persistent environment?

Think about your latest strategic endeavors that you have launched in the past year.  Has the process and goals been achieved, without some level of challenge, disruption or even misdeeds?  The likelihood is, that somewhere along the way, the project, the business or the endgame was at risk.  Perhaps not a total failure, yet not the envisioned outcome.

It is this game of perceived survival and the new pace of change in our lives, that is the greatest Operational Risk before us.  How will we mitigate the risk of such rapid change?

Experiential business learning is a vital way forward.

"Experiential business learning is the process of learning and developing business skills through the medium of shared experience. The main point of difference between this and academic learning is more “real-life” experience for the recipient.[31][32][33]

This may include for example, learning gained from a network of business leaders sharing best practice, or individuals being mentored or coached by a person who has faced similar challenges and issues, or simply listening to an expert or thought leader in current business thinking.

Providers of this type of experiential business learning often include membership organisations who offer product offerings such as peer group learning, professional business networking, expert/speaker sessions, mentoring and/or coaching."

How are you capitalizing on the people in your organization who are part of an external group or other network of like-minded professionals?  It's difficult if you don't even understand who or where your own employees are interacting on a daily basis outside your company.

So what?

Perhaps the place to start is by asking people.  Ask them over coffee in the corporate food court or that new Open Space floor plan with the "Bistro" on every other floor.  What if they told you, that they were a member of an external or virtual organization because they could not find the information or the people with the expertise inside your own organization?

Your goal is to figure out how to capitalize on all of these external groups, organizations and "Experiential Business Learning," that is going on within your own company today.
 How might you capture that passion and the excitement this individual has for the network or "Virtuous Insurgency" they are learning from everyday?
The Operational Risks before you, spans the number of people in your team who are learning somewhere else X the number of other networks they are affiliated with.

Who on your team is gaining new insight somewhere else?  Who are building valuable relationships outside the perimeter.  Who are living in a new unpredictable world of survival...without you even knowing about it.

What could you be learning today?