Crisis Readiness: Future of Risk Response...

One of the key components of effective Operational Risk Management (ORM) is a robust Crisis and Incident Readiness Response Team. This team shall have practiced and exercised multiple scenarios over the course of their training together. Why?

The ability to adapt on the fly regardless of the kind or type of incident is the core of what OPS Risk professionals are able to do, time and time again. The more unknowns that are encountered in any space of time, requires the ability to Observe, Orient, Decide and Act.

Yet this is not so much about the use of the OODA Loop or any other process in effectively adapting to your new and rapidly changing environment. It is about having the right sensors and early warning capabilities in place to detect and to deter the potential for new threats and new vulnerabilities, that may disrupt your mission.

Why do you read about Global 500 organizations that have seen their stock price erode in a day, week or month due to the ineffective response to a crisis incident? In many cases, it is a simple fact. The Crisis and Incident Response Team was caught in a scenario that they had never imagined.

An unfolding situation that they had never thought of and simply didn't plan for because it's likelihood was just too low. This author has talked about this before and it deserves repeating that exercising for the low likelihood and high impact events is where you need to spend most of your time.

The 1-in-100 year events are no longer the case. They are 1-in-50 or less. Just ask your property and casualty insurance carrier about how their actuarial Quants are thinking about this very topic. Whether is it global climate change or unregulated nuclear power industries in emerging nations, the low likelihood and high impact events are becoming more of a risk.

So what is the answer? To begin, you must first start the culture change and mind set shift to the future and to your own Strategic Foresight Initiative. Looking into the future is not exactly the exercise. Pick a point in time, five years, ten or twenty-five years into the future. Select a scenario that you can't even fathom is a possibility of actually coming true that will impact your organization. Then start your own "Backwards from Perfect" strategic foresight initiative.

What this process will do, is to get all the focus on what you still need to accomplish between now and then to get yourself into a position so that your people, systems and organization will be able to withstand the scenario incident. Welcome to Global Enterprise Business Resilience.

Across every sector of society, decision-makers are struggling with the complexity and velocity of change in an increasingly interdependent world. The context for decision-making has evolved, and in many cases has been altered in revolutionary ways. In the decade ahead, our lives will be more intensely shaped by transformative forces, including economic, environmental, geopolitical, societal and technological seismic shifts.

The signals are already apparent with the re-balancing of the global economy, the presence of over seven billion people and the societal and environmental challenges linked to both. The resulting complexity threatens to overwhelm countries, companies, cultures and communities.

FLASHBACK TO THE:  Global Risks 2012 Seventh Edition

What if you happen to be a Non Governmental Organization (NGO)? What are some of the risks that may impact you from a "Geopolitical" perspective that today have a high likelihood?

• Global Governance Failure
• Terrorism
• Failure of Diplomatic Conflict Resolution
• Pervasive Entrenched Corruption
• Critical Fragile States
• Entrenched Organized Crime
• Widespread Illicit Trade

Crisis impact will be specific to your particular stakeholder group. These will be higher or lower depending on whether you are a:

• NGO
• Business
• Government
• International Organization
• Academia

There are however, three main cross cutting observations by all of the these stakeholders from the Global Risks 2012 report and even to present day:

• Decision-makers need to improve understanding of incentives that will improve collaboration in response to global risks
• Trust, or lack of trust, is perceived to be a crucial factor in how risks may manifest themselves. In particular, this refers to confidence, or lack thereof, in leaders, in the systems which ensure public safety and in the tools of communication that are revolutionizing how we share and digest information 
• Communication and information sharing on risks must be improved by introducing greater transparency about uncertainty and conveying it to the public in a meaningful way.

The way that the global citizen decides to digest information in five or twenty years will be different than it is today. The world has already started to see this with the proliferation of mobile smart phone technologies, GPS, cameras, and other Twitter-like knowledge systems networks such as FrontlineSMS and Ushahidi.

Do you really believe that CNN and AlJazeera will be the source of truth in the next two decades? Social Media is here to stay and the only reason that formal news organizations will exist, is to try to validate and verify.

Operational Risk Management (ORM) and Crisis Readiness shall continue to be one of the most dynamic and challenging places for global enterprises for years to come...

Symbiosis: Information Advantage in a Virtual Battlespace...

Symbiosis with machines to gain information advantage, is a challenging problem-set.  The magnitude of Operational Risks will now soar, as we pivot towards machines that are performing more as autonomous colleagues.  Pre-programmed instructions has been the standard for our software-based systems, until now.

The integration challenges ahead on the leading edge of "Information Advantage", produces a spectrum of new-born problems to solve.  User interfaces that are speech driven or by a new Virtual Reality (VR) capability, is just the dawn of a new era.  DARPA (BAA-16-51) is already headed this direction:

The symbiosis portfolio develops technologies to enable machines to understand speech and extract information contained in diverse media, to learn, to reason and apply knowledge gained through experience, and to respond intelligently to new and unforeseen events. Application areas in which machines will prove invaluable as partners include: cyberspace operations, where highly-scripted, distributed cyber attacks have a speed, complexity, and scale that overwhelms human cyber defenders; intelligence analysis, to which machines can bring super-human objectivity; and command and control, where workloads, timelines and stress can exhaust human operators.

"Technological surprise" is a complex area of research.  The problems to be solved are tremendous.  Information advantage in virtual environments has been developing for years.  15 plus years before the U.S. Department of Defense utilized the concept of a public "Bug Bounty" style program for vulnerability discovery on public-facing systems, Bug Bounties were used by the private sector.

Automated Testing tools and the ability to run software scripts that can simulate a human behind the keyboard, were invented more than a decade ago.  It is time for the next generation of information advantage to be addressed; combined with a strategic and policy focused initiative.

Why?

Principal Investigators understand the stakes within the cyber domains.  The myriad of adversaries have advanced far beyond current capabilities and are even utilizing our own infrastructure against us.  Their abilities to adapt and change direction, cloak their presence and attack from new locations is finally being understood in the Board Room.

Yet what is the business problem that is being addressed?  Who are going to be the primary beneficiaries of any new invention or solution?  More importantly, why will they continue to use it?

In between commercial-off-the-shelf (COTS) and military unique systems is the zone we shall be navigating to in the next few years.  Military adapted commercial technology is the place for tremendous opportunity and new innovation.

How will we get there?

Since there is no viable rapid acquisition structure in place, it means that new leadership and resources will be required to deploy these solutions.  The entrants to this area will prosper, if they are able to mobilize strategically and with speed.

Information advantage is a lofty goal and worth the ambition to achieve it soon.  The speed to attain even a slight edge over the adversary is a whole different strategy when you are talking about information operations.  Different than traditional air or sea domains, the speed and ability to scale, deploy and execute with COTS is exponential.

How long did it take start to finish, for physical solutions such as "PackBot", "TALON", "Sand Flea", "BigDog", "Cheetah", "Perdix", "RiSE", "BEAR" and "WASP" to make it onto the operational arena?  The ARGUS-IS camera on a "Global Hawk" UAS generates 1 million terabytes of data daily with a "persistent stare", to track all ground movements in a medium size city from 60,000 ft.  How long did the procurement take to get this capability into the physical domain?

The speed in the current information warfare domain is exponential using COTS and IoT.  Using existing Virtual Machines on AWS-like infrastructure, combined with IP-addressable CCTV cameras to launch a DDoS on a DNS provider in minutes or hours is just one example. The "Mirai botnet" is just another tool (weapon) in the information advantage virtual battlespace.

So what?

Symbiosis with machines to gain information advantage, is a challenging problem-set.  Think about the time it takes to design, procure and deploy a robot solution on the physical field of play.  Now think about the same, in the almost limitless virtual domains across the globe.  The challenges ahead are formidable and the really hard problems to be solved, remain endless...

Venture Capital: UAS Operational Risk Management...

When technology innovation in the military and clandestine community finally makes it's way out to the commercial landscape, venture capital is there to invest.  Operational Risk Management (ORM) is at the center of the strategic capabilities necessary, to accomplish the frontiers of the new markets.  The "Unmanned Aircraft System" (UAS) is now poised to launch new businesses, to address new solutions for identified problems of situational awareness.  18 months ago, The Washington Post highlights the future of the unmanned aerial vehicle (UAV):

As drones evolve from military to civilian uses, venture capitalists move in
By Olga Kharif, Published: November 1, 2013

Commercial drones will soon populate U.S. airspace, and venture capitalists like Tim Draper are placing their bets. 

Draper, an early investor in Hotmail, Skype and Baidu, is now backing DroneDeploy, a start-up that is building software to direct unmanned aircraft on land mapping and the surveillance of agricultural fields. Draper says he even expects drones to one day bring him dinner. 

“Drones hold the promise of companies anticipating our every need and delivering without human involvement,” Draper, 55, wrote in an e-mail. “Everything from pizza delivery to personal shopping can be handled by drones.” 

Venture investors in the United States poured $40.9 million into drone-related start-ups in the first nine months of this year, more than double the amount for all of 2012, according to data provided to Bloomberg News by PricewaterhouseCoopers and the National Venture Capital Association. Drones are moving from the military, where they’ve been used to spy on and kill suspected terrorists, to a range of civilian activities. 

Congress has directed the Federal Aviation Administration to develop a plan to integrate drones into U.S. airspace by 2015 and to move faster on standards for drones weighing less than 55 pounds.

As new commercial businesses invent new ways to adapt the use of a UAS, to replace a pilot inside a cockpit, there are tremendous risks.  Simultaneously there are substantial undiscovered opportunities for business and a new generation of UAS pilots.  The commercial decisions that are made to allow the use of an UAS in a particular air space, for a specific type of task or service, will be questioned and made into political television ads.  As Senators, House Representatives, County Supervisors and City Mayors across the United States, welcome the use of new automated platforms, the debate will be fierce.  The decisions evermore difficult.

From a business perspective the Operational Risk Management (ORM) strategy is essentially the same whenever a new product is launched.  Yet this debate will start much more different than the one we had, as the Personal Computer was launched or the Cellular Telephone.  Privacy was an after thought then. Not any longer.

You see, UAS platforms will be information collectors just as PC's and Smartphones.  So what has changed?  The public has now been more educated on how information can be collected by the businesses who operate these new inventions.  The public better understands how their own personal information may be used for purposes to serve advertisements or optimize a particular information-based service, such as mapping and activity-based intelligence.  They understand how governments may use the information to protect the homeland.

The Venture Capitalist markets for the introduction of UAS technologies have a myriad of Operational Risks, beyond just the privacy debate.  The liability and insurance markets will also be spinning up to address the potential of loss events.  This in itself, will complicate the launch of new products and services to the general public.  So what.  Now turn to the innovations that could be making a difference for mankind.  The marketplace is evidently ready according to this April 14th, 2015 WSJ article:

Chinese consumer drone maker DJI is in talks to raise funding at a valuation as high as $10 billion, according to people familiar with the matter, in what would be a sizable bet by investors that flying robots will overcome looming regulation and safety concerns.

Think about the possibilities.  Think about the ways that a customized UAS could save lives.  Think about how the information collected, with specific sensors may provide new insight.  Think about business decisions beyond those the Venture Capitalists have seen and thought about so far.  The adoption of services, to reduce human intervention and increase efficiency will come first.  But go farther.  Reach beyond these, to unlock how a third dimension of information, perspective, speed and agility may improve our planet.

Think humanitarian.  Think disaster management.  Think ecological. Think about how gaining timely information and applying it to good use, it changes everything.