As the sun sets less than a mile from the Pacific ocean, dozens of
security researchers from across Los Angeles are converging on this
modern technology office park. The meeting presentation this evening,
will be focused on unveiling vulnerabilities within one of sixteen U.S.
Critical Infrastructures. Why?
Operational Risk Management (ORM) is a discipline that is a dynamic matrix, of columns and rows of the architecture and intersections of your entire enterprise. The places and ways that the organization is exposed to potential failures of people, processes, systems or other external events.
Think about how many people you have working with you, the number of locations they work and travel, the number of technology devices running software to compute algorithm operations to enable your particular mission. Think about all the potential ways that adverse weather and natural disasters or the simple loss of electrical power or communications in a few square blocks of your city, will impact you today.
Security researchers are also converging into a conference room somewhere in your organization this week, to discuss and show evidence of your organizations vulnerabilities today. They might be experts in "Ruby on Rails" or how to optimize "SecDevOps".
They might be experts in counterintelligence or the detection of rogue/activist human behavior by analyzing open source social media. They might be experts in using offensive tools, operating armored vehicles and flying aircraft into hostile environments. Among them are also your legal experts in privacy and regulatory compliance.
Why these individual professionals are working 24x7 to expose, document and provide evidence of your vulnerabilities is complex. Yet you should know, that they are doing it because they understand that your adversaries are also hard at work, to do the same. Is it a competitor or a nation state? Is it a disgruntled employee or an external extremist? Is it the next tornado, hurricane or earthquake? The landscape is vast and is continuously changing by the minute.
As an executive within your organization, when was the last time you devoted an hour or even two, to lock yourself in the same room with your Operational Risk professionals. To see what they are working on to Deter, Detect, Defend and Document, all that is happening in their environment today.
What if you had that hour to turn off your busy executive life and so what might you learn?
The question is necessary to get to the bottom line. It helps to define the purpose for why you have these resources working with you. The reason that they are working 24x7 to keep you and your organization even more aware and resilient. Why they are converging on a conference room in Los Angeles after working all day to learn about new vulnerabilities?
Take the time this week to meet with them. Ask them the question. Listen to their answers. You might be surprised at what you hear. You will probably learn something new. Work with them to improve the Operational Risk Management (ORM) capabilities and functions within the enterprise.
Operational Risk Management (ORM) is a discipline that is a dynamic matrix, of columns and rows of the architecture and intersections of your entire enterprise. The places and ways that the organization is exposed to potential failures of people, processes, systems or other external events.
Think about how many people you have working with you, the number of locations they work and travel, the number of technology devices running software to compute algorithm operations to enable your particular mission. Think about all the potential ways that adverse weather and natural disasters or the simple loss of electrical power or communications in a few square blocks of your city, will impact you today.
Security researchers are also converging into a conference room somewhere in your organization this week, to discuss and show evidence of your organizations vulnerabilities today. They might be experts in "Ruby on Rails" or how to optimize "SecDevOps".
They might be experts in counterintelligence or the detection of rogue/activist human behavior by analyzing open source social media. They might be experts in using offensive tools, operating armored vehicles and flying aircraft into hostile environments. Among them are also your legal experts in privacy and regulatory compliance.
Why these individual professionals are working 24x7 to expose, document and provide evidence of your vulnerabilities is complex. Yet you should know, that they are doing it because they understand that your adversaries are also hard at work, to do the same. Is it a competitor or a nation state? Is it a disgruntled employee or an external extremist? Is it the next tornado, hurricane or earthquake? The landscape is vast and is continuously changing by the minute.
As an executive within your organization, when was the last time you devoted an hour or even two, to lock yourself in the same room with your Operational Risk professionals. To see what they are working on to Deter, Detect, Defend and Document, all that is happening in their environment today.
What if you had that hour to turn off your busy executive life and so what might you learn?
You might learn that your organization is being attacked every day by "Spear Phishing" experts from the other side of the globe. More importantly, the source of the attacks is by an organized cadre of criminal experts in social engineering and SQL injection.So what?
You might learn that one of your employees has set up a Twitter account with an anonymous user name and identity. The daily "Tweets" are telegraphing your corporate strategy to your competitors or leaking proprietary internal protected information about rogue co-workers behavior.
You might learn that the Commercial-Off-The-Shelf (COTS) sensor you utilize within your flagship transportation vehicle, is being exploited by a highly trained clandestine military unit from another country.
You might learn that a key manufacturing location is about to be surrounded by environmental activists who are planning to camp out on your entrance until their demands are met.
The question is necessary to get to the bottom line. It helps to define the purpose for why you have these resources working with you. The reason that they are working 24x7 to keep you and your organization even more aware and resilient. Why they are converging on a conference room in Los Angeles after working all day to learn about new vulnerabilities?
Take the time this week to meet with them. Ask them the question. Listen to their answers. You might be surprised at what you hear. You will probably learn something new. Work with them to improve the Operational Risk Management (ORM) capabilities and functions within the enterprise.
"If you want to Go Fast go alone. If you want to Go Far, go together".
--African Proverb
No comments:
Post a Comment