Posted on

Alin Kalam: Nurturing Growth and Innovation Through Data, AI, and Sustainability

The IT industry continues to grow and shift rapidly due to the pandemic and CIOs are constantly on the lookout for ways to foster and adopt new technologies into their organization. Whether it is sustainable transformations or implementing AI, change is necessary.

As the Head of International Market Intelligence & Data Strategy for UNIQA international, Alin Kalam shares with us his insights on the need for agility through AI, achieving business competence, and nurturing innovation.

 
Be part of Aurora Live, an exclusive members-only platform that’s tailored for CxOs seekng the latest industry insights, high-level networking opportunties, and more.
 

Finding Agility in Artificial Intelligence and Overcoming Disruptions

Businesses and IT leaders today need to be quicker to respond to the ever-changing landscape of their industry and overcome disruptions. Whether it’s to implement hybrid workplace models or to incorporate new technologies such as artificial intelligence and data analytics, there is a definite need for CIOs to strategize.

Kalam shares his insights on the key challenges that CIOs need to be aware of when incorporating new technology and how to effectively transition towards data-driven business models.

 

What are the key challenges for CIOs who are trying to adopt new technologies especially in the AI field?

 

Surely one of the major challenges of establishing AI technologies in companies is lack of trust and also limited knowledge existing. On the technical side, I see the IT productionizing & operational issues arising since 2019. 

Often it is not the number of best practices, that lack but the ability to align market circumstances with existing technologies with own true business needs. Therefore, I see the cultivation of AI-driven innovation much more as a strategic challenge nowadays than only a technological one.

 

What should CIOs be aware of in the transition towards data-driven business models that serve dehumanization of critical business fields?

 

On the one hand, dehumanization must be done quickly to address short-term issues e.g. through the implementation of RPA or AI products to combat challenges caused by Covid, and on the other hand, CIOs must balance strategically what and where they are automatizing/dehumanizing. I already have seen examples of cost reduction projects through dehumanization that are creating huge strategic risks for companies in the long run. 

For sure there will be someday an “after Covid” and using the current crisis as scapegoat for cost-cutting only without putting the focus on the product portfolio, customer needs, and above all operational risks of IT systems, can become a huge source of risk. 

Here I rather appeal to strategic long-term aspects than short-termed gains only and to address this concern CIOs must become business-driven more than ever!

 

The Need For Sustainability and Competent Business Intelligence

Companies were forced to change their policies, behaviors, and business strategy due to the prolonged coronavirus pandemic. The recent COP26 climate conference showed that companies are committed to making sustainable-focused organizational changes.

For Kalam, the need for sustainability in IT is clear highlights the challenges that many are still facing, in addition to incorporating competent business intelligence to ensure sustainable growth. 

 

Sustainable transformation in the IT & innovation field has become a key topic for upcoming years. What are the specific areas of action for CIOs in this field?

 

For sure sustainability as a topic is here to stay! Not only do we have the macro aspects of it addressing the major concerns of our time, but it has become also a business driver in so many sectors. 

With my initiated project Sustainista I, therefore, have tried to interconnect companies with the scientific community ensuring exchanging of data, know-how, best practices, and transparency. The biggest challenge in this field is the lack of market and scientific standards at the same time. ESGs might be known to many of us but breaking down its info business actions according to standard approaches/processes is the biggest challenge!

In an ideal world, CIOs and related roles are taking ownership of this topic and driving it to doable tasks, otherwise, I am afraid to see sustainability just as a cosmetic and marketing label without a true impact on business and how we do things.

A particular starting point is to understand macro goals as an organization and break them down to a very data level in organizations delivering measures and related actions with the help of existing data. Many companies I know from various sectors have started with external data sets 1st to deliver quick success that can feed this long-term topic.

 

How would you advise companies who are still struggling to incorporate Business Intelligence?

 

Here I clearly follow the storyline of failing fast succeed sooner. Instead of propagating a piece of technology IT must build a bridge with business and deliver quick wins. Even now I am often devastated whenever I see only PDFs and Excel Sheets with numbers/KPIs that do not reflect the fast reality of our businesses and data-driven decision-making across borders! 

Major issues companies face are data quality, integrity, and security issues. CIOs are hereby in the role of process enablers. Instead of being only technology-driven often the implementation of BI must be done in a joint-venture manner.

 

Ensuring Growth Through Data and Overcoming Legacy Challenges

One of the biggest hurdles for digital transformation efforts still stems from legacy systems that are often outdated and not integrated with modern solutions for business uses. Despite the fact that modernizing legacy IT systems is required for businesses to ensure growth, IT leaders are still faced with roadblocks and challenges.

For Kalam, however, legacy systems are not necessarily the main roadblock as it once was. Instead, the focus now for CIOs should be to apply best practices during data-driven business transformation and simplify their approach to nurturing experimentation.

 

With regards to data-driven business models, what are the best practices that CIOs and IT leaders need to keep in mind? 

 

In a matter of fact, the approach of data-driven business transformation is everything but only data-centric! It covers the end-to-end processes of entire product lines and the strategic setup of a company. After many years of data harmonization/migration projects, companies often find out their undone homework regarding “creating true business values to the company itself and its customers”. 

I myself often propagate the term “no business value without data, no data without a business case”. Between this symbiotic relationship lies the true success of transformation efforts. 

Aside from this core topic I often miss the foresight of wisdom! It means seeing the potential of data not only in core businesses but its extensions and added capacities. In my objective point of view, this foresight of wisdom and true added potential is often the key success factor to many.

 

One of the main challenges for organizations is to overcome legacy infrastructure. How can CIOs overcome the legacy obstacle? What are the skills and mindset needed to promote modernization for an organization?

 

To be honest I really do not see legacy infrastructure as the biggest road-blocker anymore. Especially throughout the last decade, there have been so many progressions in simplifications of legacy systems, that I have become more optimistic on that end out of my own experiences! 

I can´t remember when I have seen companies e.g. migrating legacy data systems into new all-in-one and all-ruling superior DWH, Data Lake, etc. Instead of searching for the holy grail, we have become more realistic about using data where they are at their best and being created. 

This Data Mesh approach has become a blueprint for software solutions as well just as agility was cultivated from the IT/Software world into day-to-day business & project management. But this process has just begun a couple of years ago, the community yet does not have a buzzword, but hey, never say never…!

 

Innovation and experimentation are at the heart of data-driven business models. How does one nurture an environment that promotes experimentation within their organization?

 

I rigorously follow the principle of K.I.S.S (Keep it simple, stupid) in the incubation phase of innovation projects. Instead of talking only and selling in this phase, organizations should apply these principles, aside from a minimum set-up of governance, risk mitigation process regarding GDPR, privacy, organizational risks, etc., and allow experimentation. 

Here the old wisdom of “too many rules & regulations kill true innovation & creativity” should be applied. 

If the internal challenges are too big, often I have guided companies and leading bodies into the world of entrepreneurship. 

The most successful CIOs & IT managers are those who run new innovation ideas or projects as a starting business operating from day 1. This can be a guarantee of nursing the true nature of innovation when nothing else is working.

Posted on

Siemens Mobility’s Bernhard Karollus: Mobilizing Digital Change Towards Hybrid Work Culture

At the heart of hybrid work culture and digital transformation in IT, CIOs play a pivotal role in nurturing these initiatives to ensure their organizations maintain consistent business growth in a volatile market. From data and analytics to cyber security and more, the CIO will push the Digital Strategy of organizations to the next level. 

As the Head of Regional IT EMEA2 for Siemens Mobility Austria, Bernhard Karollus shares with us his insights on digital transformations, post-pandemic growth, and the key technologies for organizations making the shift towards new work environments.

 
Want more insights from Bernhard Karollus? Join him and many other industry leaders in Management Events’ 600Minutes Executive IT event in Austria.
 

The Transition Towards Digital Transformation

Digital transformation and change culture continue to be the main focus for IT leaders across industries. The pandemic has shown that organizations that are agile enough to incorporate digital strategies while prioritizing flexibility will be the ones that survive.

For Bernhard, however, identifying the challenges shouldn’t be the focus. Instead, keeping the organizations focused on the big picture while understanding what it means to embrace change culture should be the priority of CIOs.

 

What remains as major challenges for companies in achieving digital transformation? How do you, and Siemens Mobility, approach these challenges?

 

Defining remaining challenges would mean we know a target state. I perceive this approach as wrong. We are playing the infinite game, tackling the challenges of today, realizing there are new ones just around the corner.

As part of Siemens, we are concentrating on the platform economy and digital ecosystems when looking at the very broad picture.

 

Are organizations still resistant to change? What can those in IT leadership roles do to nurture the culture of change?

 

Tough cookie, because there is no general response to this question. There is a wide range of positions towards change even within single organizations. 

Avoiding the view and prejudices of one’s own IT bubble helps to understand the pace that a specific organization can take when going through massive change. As a permanent activity, I like the approach of small life hacks to nudge diverse parts of the organization and single employees to embrace change.

 

New Work Culture and Hybrid Environments 

With over 60% of companies allowing or incentivizing remote work, it’s clear that the home office is here to stay. While there are still challenges in complete remote working, the idea of hybrid working culture is an area in which IT leaders need to consider seriously.

However, the transition towards new work culture comes with its unique pitfalls, and Karollus outlines the challenges and how Siemens Mobility approached the idea of a hybrid workplace environment.

 

What are the pitfalls the CIOs should be aware of when transitioning into and implementing new work cultures?

 

When the pandemic started, the challenge for IT was to act quickly and provide technology solutions. Implementing new work cultures is a different corporate challenge with employees and a complex mix of stakeholders involved.

Technology is part of the solution but considering the digital dexterity of your workforce, resistance to change, and close attention to the interests of other stakeholders should be carefully considered.

 

What was Siemens Mobility’s approach toward a hybrid workplace environment?

 

We are using a holistic new normal approach with our HR, real estate, IT, and EHS departments joining forces to provide a wide variety of components building the hybrid work environment of the future. It all started with top management attention when our CEO announced 3 of 5 days working outside of the office wherever legally possible. 

What should I add? Tone from the top plus all relevant organizational units working together simply is a successful approach.

 

Incorporating Emerging Tech and Modern CIO Traits

The journey towards a hybrid working world will require IT leaders to work hard to build and maintain team dynamics. At the same time, investing in tools that will help further strengthen their business strategy can go a long in establishing a solid foundation for a successful new landscape of work

From initiating small-scale PoCs to encouraging the adoption of emerging technologies, Bernhard shares his insights on how Siemens Mobility faced these challenges and what other IT leaders need to be aware of in their journey towards a new working world.

 

What are the key investments in emerging technologies that companies need to focus on in the transition towards hybrid work culture?

 

Companies should derive their investment focus from their business strategy using tools like technology radars and core technology definitions. Gladly, many technologies can be tested in small-scale PoCs or garage projects when looking further down the horizon, while others looking at industry or topic leaders can provide guidance.

There is only a very limited technology scope that Siemens in general is not active in when it comes to digitalization. Siemens Mobility is part of the Siemens innovation ecosystem and has defined corporate core technologies. 

 

What are the strategies for IT leaders to encourage team growth and collaboration while maintaining talent wellbeing in a hybrid environment?

 

There was never something like a one-fits-all solution in the productivity/wellbeing equilibrium. Even less, when it comes to growth and collaboration. Especially as managers of managers, IT leaders, in my opinion, are well-advised to be members or partners to decisions that influence the large picture of the new work environment, actively shaping it.

At the same time coaching your direct reports openly and inclusively, while carefully optimizing team structure will shape teams that grow and collaborate in a good way. 

A word of warning: all the teams within one’s organization are different, there can be conflicts between different areas of responsibility due to the more and more individual approach of leaders. These need to be sensitively managed or avoided.

 

Finally, in the post-pandemic world, what are the traits that CIOs and IT leaders should possess to lead the workforce and the overall organization’ into the new working world?

 

Closeness to all business and support functions units is key for sure. Being open and having a team that is open to challenges from whatever topic field will not only allow to lead the workforce into the new working world but also one’s organization.

And finally, nothing told us as the pandemic did, that continuous learning is key to overcoming the challenges from permanent change.

Posted on

Monica Verma, CISO of Helsedirektoratet: The Necessity of Resilience and How to Embed it in Your Organization

The rising number of cyber attacks has caused IT leaders across industries to take cybersecurity measures more seriously than ever before. This is reflected in our interviews with CIOs on cybersecurity investments who revealed cloud security and cybersecurity strategies as top priorities. A number of industries have also adopted digital twins to protect their digital assets, allowing cyber security platforms to perform at higher efficiency and accuracy.  

However, CIOs and CISOs face continuous challenges with implementing high-level cybersecurity due to limited budget and online security obstacles in a hybrid workforce.  

Monica Verma, CISO of Helsedirektoratet, podcast host of We Talk Cyber, and blogger on MonicaTalksCyber.com, shares valuable insights on operational and cyber resilience, effective cybersecurity programs for critical infrastructure, the evolution of the CISO role, and more.  

 

What are your top cybersecurity lessons learnt from the pandemic?  

There’s no absolute security. Things can and will go wrong. That’s true for both a pandemic and a cybersecurity crisis. The pandemic has shown us an increasing need for adaptive security as a part of building resilience and crisis management.  

Operational resilience is as much dependent on the human and communications aspect as the technical capabilities in place. It’s not a matter of “if”. It’s no longer even a matter of “when”. It’s a matter of: 

  • How long ago did attackers infiltrate? 
  • How quickly can/did we detect it? 
  • How quickly and effectively can we respond? 
  • How do we handle the unknowns? 
  • How do we adapt and continue critical services? 

Preventive controls are not enough. Effective crisis management requires planning for both the known-unknowns and the unknown-unknowns. 

 

How do you think the role of CIO/CISO has evolved in terms of ensuring the security of their organization?

Traditionally, the CISO role started as a technical role — a younger sibling or a distant cousin of the C-Suite. It’s mostly a title associated with a lack of budget, mandate, or even a seat at the grown-ups’ table. 
 
However, an effective CISO role is that of a business leader itself, an advisor to the board, top management, and the rest of the business. The role has evolved from a “glorified” security engineer to a business and organizational advisor. As data breaches and ransomware attacks have skyrocketed recently, particularly during the pandemic, more organizations look up to the CISO to help them identify, understand and manage their threats and risks better.  

Today, many organizations understand that a CISO’s job is not just to build an information security management system (ISMS) with a bunch of policies and other governing documents. Organizations are beginning to employ a CISO/CIO to rather effectively invest in security with timely risk management and provide sound advice tailored to the stakeholders.  

As a result of this evolution, there’s also been a shift in the skills required to be an effective CISO: 

  • Professional skills such as risk advisory and business understanding, which span very well outside the technical realm, and; 
  • Soft skills such as concise, clear, and effective communication, are a driving force behind the vision and strategy of an effective leader. 

There are many organizations that still see and employ a CISO role as a technical role, but we are seeing a shift in terms of budget, investments, and better mandate — transforming the CISO into a cross-functional advisory role worthy of an actual seat at the table. 

 

Today’s organizations have a higher risk of exposure due to a more complex and global digital footprint. What strategies can organizations implement to better prepare for cyber attacks?  

There are three critical aspects that need to be addressed in order to better manage the ever-increasing risk exposure and ever-complex digital footprint: 
 
a. Always have a holistic view of both the current state within the organization and its supply chain as a fundamental input to your cybersecurity strategy. You are as strong as your weakest link. It’s not your employees. It’s the weakest link in your entire supply chain. You need to be aware of the weakest link in your supply chain, in order to be better prepared for cyberattacks. 
 
b. Always have a risk-based approach when developing your strategy, operationalizing your cybersecurity plan, and investing in security controls (people, process, and technology). Your organization’s risk profile is affected by other risk profiles in your entire supply chain. A risk-based supplier management is as important as a risk-based security governance within your organization. Additionally, an effective risk-based approach will also take into account the threat landscape. 
 
c. Balance your security investment effectively between preventive controls, predictive controls, and adaptive and other response controls, based on your risk exposure. The more critical data, services, and infrastructure you have, the higher your exposure in case of a cyberattack. It’s the difference between an e-commerce website going down for weeks vs. critical data or service not available for even a few hours or days. Preventive controls and cyber hygiene are a must. But as there is no 100% security, these will fail. Your cybersecurity strategy must take into account effective crisis management and building operational resilience over time. 

 

Based on your cybersecurity adoption lifecycle model, how can an organization build cyber and operational resilience? 

Building cyber and operational resilience requires effective planning and response to manage both the known-unknowns and the unknown-unknowns. Additionally, this takes into account people, processes, and technical aspects. Here are the key things organizations can do to build resilience over time: 
 
a. Building resilience requires a clearly defined accountability at the top level as well as a resilient, collaborative, and prepared workforce. Accountability and awareness are key. Train your employees and train them regularly. It’s vital that the board and top-level management understand their accountability, as well as that every employee understands their role and responsibilities both during normal operations and an ongoing crisis. Test your preparedness and crisis management plans. Make sure your crisis management team works like a well-oiled machine. Run table-top exercises, learn and repeat. 
 
b. Map, understand, and have a comprehensive overview of the dependencies that your critical services have on the underlying assets within your entire supply chain. Do your homework to have effective planning and preparedness in place. Build your crisis management and preparedness plans based on disruption scenarios for your business and critical services towards society, dependencies within your organization and on your third parties, your risk exposure, and your risk tolerance. Your crisis management plan should also take into account the steps you execute in case an unknown scenario occurs.   
 
c. Invest in adaptive response management. As there are always unknown factors in play, an effective response management will include adaptive mechanisms, in addition to preventive controls. For example, can we activate certain policies in real-time as certain events or anomalies are detected? How can we fail-safe both within our IT and particularly our OT environments, while keeping critical services up and running? How do we adapt the use of our people, processes, and environment in real-time to reduce the impact? How quickly can we segment (parts of) our infrastructure, in order to contain the spread? How quickly do we predict a threat or detect an attack before it becomes a crisis? How do we reduce recovery time?   

 

What are some of the technological disruptors to cybersecurity?  

In my opinion, the top three technological disruptors to cybersecurity are: 

 
a. Cloud 
Cloud is no longer a new technology. However, the skyrocketed migration to cloud in recent years demands an urgent shift in mindset, especially when it comes to cybersecurity and privacy. Moving to the cloud is no longer just a lift and shift operation, even if that’s what you may be doing with some of your services and data. To effectively utilize the benefits of cloud computing, in a secure and privacy-friendly manner, a shift in the mindset is required right from the very beginning, integrated right from the planning stages of a migration, through operating in the cloud and all the way to the exit stage. 
 
b. Convergence of physical, biological, and digital worlds 
With the adoption of Internet of Things (IoT) and other emerging technologies, there is an even stronger convergence of the physical, biological, and digital worlds in progress. However, there is a big gap in understanding what risks this entails and the lack of management of these risks as a part of a cybersecurity strategy. As we go forward, there is a stronger need to address these issues at a strategy and business level to ensure that security, safety, and privacy continue to be a top priority. 
 
c. Machine Learning and Artificial Intelligence 
Machine learning and the emerging applications of artificial intelligence are some of the key technological disruptors, as ethics, safety, and other risks emerge along with it. We are already seeing Proof of Concept (PoC) cyberattacks enhanced by machine learning. As we go forward, these emerging technologies will be abused by cyber criminals and other threat attackers in various ways, including but not limited to, increased scale and effectiveness of cyberattacks, discovering new unknown vulnerabilities and exploits faster, bias, discrimination, and other ethical, security and privacy violations. As the threat landscape evolves, the use of machine learning and artificial intelligence within cybersecurity will be critical. 

 

What are the elements of an effective cybersecurity program for critical infrastructure?

Due to the ongoing convergence between Information Technology (IT) and Operational Technology (OT) environments including Industrial IoT (IIoT), along with accelerated digitalization as a result of the pandemic, we have seen a massive rise in cyberattacks, particularly ransomware, against critical infrastructure. The key with critical infrastructure is operational resilience both during normal operations and under crisis. An effective cybersecurity program for critical infrastructure addresses three key areas: 
 
a. Legacy systems within the OT environment 
As the threat landscape and attack vectors have evolved, the convergence has left the legacy OT systems even more vulnerable to cyberattacks. Additionally, the lack of visibility and the difficulty of maintenance pose an even bigger threat as both old and new vulnerabilities and attack vectors are discovered. The basic cybersecurity hygiene e.g. patching, awareness and other preventive controls are even more important in the OT environment, as these systems get connected to emerging technologies. Hence, the basics is still one of the key aspects.  
 
b. Over-increasing complexity and attack surface 
Due to technological disruptions and ever-increasing convergence, both the complexity and the attack surface of OT environments including the critical infrastructure are increasing drastically. This increases the likelihood of a successful cyberattack, as the threat actors now have a much larger attack surface to begin with. Going back to the point, it’s not if or even when you’ll get hacked, but rather how quickly we detect, adapt, and respond to an attack. Hence, building operational resilience is a critical aspect to be addressed in an effective cybersecurity program. 
 
c. Managing the consequences and risks to life, safety, and society 
As with every cyberattack, a key aspect is to understand and contain the impact, as early and efficiently as possible. To do that, it is vital to have a comprehensive overview of what risks are associated with critical infrastructure, along with how it impacts the business, the organization, and society at large. As we move from traditional IT to OT environments, we switch from just talking about downtime or data breaches to risks to life, safety, and functions with society as a whole. A good security investment is always risk-based. This is even more vital for critical services, as the impact can be tremendous. 

 

What are some of the key challenges with regards to diversity, inclusion, and equity within the cybersecurity industry and how can we address them?

We have seen an increasing awareness of diversity, inclusion, and equal rights over the last decades, both within society in general and in the cybersecurity industry. However, we still face massive challenges when it comes to pay grade, job requirements and hiring, reasons and motivations behind diversity and inclusion, as well as a lack of understanding of equity and the role it plays.
 
On one hand, we need to have continued conversations and take further actions for better representation within the cybersecurity industry. On the other hand, we need to do that while breaking down the labels and stereotypes. I am a CISO. Not a female CISO. My professional experience and contributions are independent of my gender, background, and other labels. 
 
That means, while on one hand, we need definitive actions to reduce the pay gap, include diversified talent, and ensure effective and streamlined hiring processes including neutrally worded job positions with realistic requirements, on the other hand, we need to break down the barriers to bring in a diversified workforce independent of their labels. That includes diversity in both what we see and what we hear,  i.e. diversity and inclusion of opinions.  
 
Equity is yet another term that is highly misunderstood. Equity is not the same as equality. While equality is important and talks about equal opportunities and resources, e.g. equal pay grade, equity is about fairness, i.e. giving people what they need in order to make things fair and level the playing field. Due to stereotypes and lack of a balanced representation over decades, there is a need for equity to ensure we can reach equality. Equality is the end goal, but equity is the means to reach it. Equity is not about giving too little to people who need it or too much to those who don’t, but rather to provide fairness in order to reduce the differences of inequalities and pave the way to a more equal society and cybersecurity industry. 

Posted on

How Can CIOs Implement Effective Change Management?

Change management is inevitable in the era of digital transformation — at individual and enterprise levels. Over the past year, organizations across the globe experienced some form of change management out of necessity.

Shona Elliot, best-selling author and executive management & leadership consultant, shared her insights on organizational change management in a recent Transformation Thursday session on Clubhouse hosted by Management Events.  

“COVID has completely moved the needle in terms of what change looks like beyond the proper change management processes of the past,” she says.  

 

All eyes are on CIOs to not only spearhead the adoption of new technologies, but to also become leaders in change management. Easier said than done, right? 

The modern CIO may find it difficult to focus their energies on the right areas with so many elements in flux — rapid digitalization, customer expectations, technology advancements, cyber security and shifting go-to-market strategies, among others.  

Therefore, it is essential that CIOs craft change management strategies that can withstand the volatility of current times, as well as help their organizations enable effective transformations in 2021. 

 

CIO: The New Change Agent 

 

“Change management is the art of making organizations work well – and continue to work well.” – Michael K. Levine, author of People Over Process: Leadership for Agility. 

CIOs wear many hats; the newest one being an agent of change. Digital advancements have propelled CIOs to the forefront of organizational change. As a key change agent, CIOs now have the responsibility to promote cultural shifts for successful transformation.  

As more IT organizations adopt agile and design thinking methods to align with overall business goals, CIOs must be able to manage the impact of this change successfully. According to Accenture, the efficacy of technical business transformations relies on strong change management leadership to guide teams through this process.  

 

Why is Change Management So Hard? 

 

70%. This is the percentage of change management initiatives that fail to meet their goal. Change management is hard to get right, and CIOs are forced to face the added challenge of a global pandemic and a remote workforce.  

The main reasons why change management efforts fail at enterprise level are: 

 
 

Often, C-levels prioritize technical capabilities over business capabilities when taking on new spending methodology projects. Majority of resources are utilized on data, tools and insights when it should be focused on the business process adaptations that stem from change management principles.  

Organizations must discard the “There’s an app for that!” philosophy where they become too reliant on packaged software applications to drive internal processes. This philosophy leads to the increasing difficulty of educating and convincing employees to use new technological systems, something CIOs should address urgently.

 

What is Change Fatigue? 

 

As humans, our brains are hardwired to resist change.  

According to Elliot, “I’ve heard senior leaders many times in their career say they are just going to be resisting change or a stakeholder group is just going to resist it.”, and nothing can be done except to move forward to something new. In addition, 92 % of participants in a Deloitte survey stated that resistance to change is an expected reaction from employees as well.  

The rapid pace of continuous change at organizations may take a toll on employees, also known as ”change fatigue”. This is on top of the stress caused by the pandemic and health concerns, economic issues and job uncertainty. If not addressed immediately, change fatigue can be a serious inhibitor of digital transformation. 

CIOs must keep this in mind when planning change management strategies. Change fatigue can result in C-level peers and employees becoming frustrated and resentful — which can get in the way of achieving company goals. 

 

What Makes a Good Change Manager? 

 

Forward-thinking change managers must redefine the concept of change management for their organizations. This is supported by Elliot, who recalls leaders with a traditional mindset having an awakening around the importance of their employees and building a people-centric culture.  

“It is looking at all of the decisions through the lens of ‘how does this impact our employees and teams?’ and ‘how do we talk to them about it?’”  

This shift in mindset will help with creating a simple and effective change management project plan, that should include: 

 
 

Furthermore, a change management project plan should be supported by these strategies: 

  • Assess change readiness of employees to determine overall stress and morale level as well as openness to change, 
  • Understand how the organization and working culture has been impacted by external events, 
  • Acknowledge the importance of aligning people, technology and processes, 
  • Translate overarching goals and objectives into specific transformational strategies, 
  • Ensure all internal stakeholders and executives are aligned and informed. 

With the rise of remote workforces, change management strategies are likely to succeed when CIOs take the time to utilize digital communication tools to connect with teams within the organization and listen to their concerns.  

Besides that, IT leaders can propel their teams to digital transformation with five pillars of change management success:  

 
 

They can tailor existing change management models to their organization’s needs, such as Lewin’s Change Management model, McKinsey 7-S model and Kotter’s theory.  

 

Why is Change Management Important for CIOs to Understand?

 

Valuable time and resources go into adopting new technologies and processes. Without change management, that time and money go to waste.  

According to Elliot, senior leadership needs to understand all the components to change and craft an approach to help spearhead successful change initiatives. CIOs should also note that change management plans are not a one-person job.  

“I look at it as a co-creation model, to be able to include stakeholders that are going to be responsible for delivering the change and include them in the conversation as early as possible.” 

Furthermore, IT leaders who involve employees in designing change management processes are more likely to succeed. Results from a Gartner survey reveal employee engagement and retention rate increased by 38% and 46% respectively with the integration of open source change management.   

A good change manager keeps their employees in mind and closely collaborates with stakeholders when building an impactful change management strategy.

Once seen as an isolated and ongoing project, change management is now reactive and necessary. CIOs must make their mark in the change management landscape and inspire their organization to be excited about change, instead of fearing it. 

Posted on

Pandora’s CIO Peter Cabello Holmberg: Building A Hub Of Agility And Digitalization

Pandora took the business world by storm this year as the renowned international jewelry retailer successfully drove digital transformation and innovation in the midst of COVID-19 and launched the much-talked-about Digital Hub.

To find out more about the Digital Hub and Pandora’s agile aspirations, Management Events interviewed Pandora’s CIO, Peter Cabello Holmberg, winner of CIO of the Year 2020, who shared the objectives of the ‘Hub’ and its importance in Pandora’s continued digital strategy.

 
(Photo: Mikael Rieck, from Computerworld)
 

THE DIGITAL HUB

 

The Digital Hub, also known as the Hub, opened its doors in Copenhagen in July 2020. But what exactly is the Digital Hub?

 

The Digital Hub is actually a place. It’s a physical location; a full floor in a building next to our global office, where we have room for some 200 headcounts. We initially called it ‘Global Office 2’, but as we wanted to create some hype around digital and our digital strategies, we decided on ‘Digital Hub’.

Also, we were running out of space in our global office, and we had pockets of digital talents – the IT, marketing, and e-commerce teams – sitting in different places globally. That wasn’t optimal so we wanted to consolidate our digital talents in Copenhagen.

We believe that having our digital talents in the same location would help our delivery speed, and our intention was to have a new layout of office space that could facilitate agile ways of working, where people can move around and sit in teams to exchange knowledge on a daily basis.

In the early phases, we discussed building it in New York or Amsterdam, but we decided to build it next to our global office in Copenhagen because there was a need for proximity with the rest of the senior executives there. We were super lucky that we could get the office space next to our global office.

 

How did the idea of the Hub come about?

 

We’ve been working with our thoughts and aspirations on digitizing across our value teams for a couple of years. And what we realized was that we had to orchestrate ourselves differently to deliver faster on our digital aspirations.

We’ve been relying on waterfall approaches, business cases, and other methods that were very slow for us to get things started and signed off, so we needed a different operating model and a different engine room.

It was that realization – for us to deliver on our digital aspirations, have more transactions on our online channels, and improve digital marketing, omnichannel, and in-store technology – that we felt the need to bring the technology, e-commerce, and marketing teams together and implement new, agile ways of working.

 

Projects like the Digital Hub are huge investments, and getting the stakeholders’ buy-in is always a challenge. How was the project presented for the executive buy-in?

 

I went to the CEO and the executive leadership teams a year and a half or 2 years ago and said that we needed to do an IT transformation. I said that I would save money for the company, build new career duties, and introduce agile working. And I got a sign-off on that.

The CEO bought into it because we – on top of the savings – also presented strong business cases for digitalization and data-driven consumer growth that were very attractive with significant incremental revenue.

 

AGILE WORKING AND CHANGE MANAGEMENT

 

After getting the sign off on introducing agile ways of working, how did you start its implementation?

 

We did a number of introduction sessions before we did anything else. We talked about what agile is, its meaning and principles, and the choice of methodology, and introduced the terminology. We also did a few proofs of concepts, small projects that we would normally put into an agile release train (ART), and applied agile ways of working, like scrum meetings.

Other than that, we had meticulous discussions about Spotify and SAFe, and supporting tools for agile ways of working. We initially made a decision to go with both models, which was a mess for us. Now we’re back to the principle of one model.

We made some decisions along the way that were just wrong. So when we went live, we went in knowing that we had to learn if the decisions and changes worked and asked everyone to give feedback so that we could adjust on areas that didn’t work.

 

Major organizational transformations can be difficult to execute smoothly. How did Pandora handle the change management?

 

This was a massive change management exercise, but we knew we had to shift our ways of working completely.

So we gave people a flavor of how this change would look. We started to talk about what an ART should be like and introduced new and different roles to both the business and organizations. We pieced it step by step, presenting increasingly more elements of agile working.

There was change management happening both bottom-up and top-down, but at some point, we came together and communicated to everyone involved that ‘This is how it’s going to look, and here are the members of the Arts’.

We communicated the incoming change to all parts of the organization with 50 to 70 lightning talks about agile working held for all the employees to participate. More than 1,200 people from the entire business signed up to learn about it.

Even when we went live with our first ART, we continued having lightning talks because more and more people wanted to know about it.”

We try to stay as open and transparent along the way so that everybody knows what was happening. It was a lot of communication on where we were, what was happening next, and what to expect.

 

HIRING AND TALENT MANAGEMENT

 

With all the transformation initiatives, what were the responses from the teams and employees?

 

The interesting thing is, as we implemented the agile ways of working, our churn rate of people in IT, marketing, and e-commerce leaving Pandora has gone down. Even though we did this massive transformation, the turnover rate has decreased.

From what I’ve seen and heard, people are actually quite excited to try agile working. They want to see how it works. Some have already tried it and are super happy with it. And those who have always worked in traditional waterfall approaches are keen to learn about agile ways of working because everyone’s talking about it.

 

With about 200 employees working on a collective digital strategy, how does the Hub ensure that decisions and responsibilities are delegated to the right people and teams?

 

We have a number of ARTs now, and the biggest and most mature one is our consumer ART.

Whatever the team does in this agile release train is tied to our business strategy, so there’s a link from the strategy to how we work with agile portfolio, lead portfolio management, and so on. So we can track from strategy to ARTs to APEX to features to use cases.

Since we have defined the ART with all the members and different roles, there’s full transparency on who’s responsible for what. Everyone knows what their role is in the whole process.

Furthermore, the tool that we use holds the overall description of the business strategy, and breaks down into the related ARTs and components, so that we’re constantly updated on the business timeline and deliveries. Hence, I would know exactly what’s going to be delivered and when. It’s pretty amazing.

 

It’s not news that Pandora has been actively hiring digital talents for the Hub. What talents are being seeked, and what hiring strategies are being used?

 

We’re hiring very different types of profiles into the Digital Hub from all over the world – Columbia, Argentina, the US, and Singapore. We want people who are creative, who have an opinion, who want to push things forward and make a difference. And because we also want to set them free with the business, we want them to be self-operating.

What we did with hiring was create hype around the Digital Hub. We had the CEO talk about the Hub when he was interviewed, and we sent out press releases and reached out to different media. We also talked to universities about what we were doing and trying to achieve and spread the word that we wanted to build a digital powerhouse in Pandora and be number 1 in our industry.

So we set the ambition level quite high, which is part of attracting talents while doing features and events and mobilizing all types of channels to spread the word.

 

What challenges did the Digital Hub encounter in terms of recruiting talents and managing the current workforce?

 

One of our bigger problems was that, when we got a ‘go’ for the Hub, it was the time when COVID-19 hit. So we had to hire these positions using Teams and Zoom since we couldn’t meet the candidates face-to-face.

We also had to go about the hiring processes in a different way because everybody was on lockdown globally, and we couldn’t fly them in and bring them to the Digital Hub. From Day One, they had to start from their home office. We sent PCs and laptops to them, and onboard them from their home and whichever country they were in.

 

Now that the Hub is completed, what initiatives is Pandora taking to ensure a functional communicative and collaborative culture?

 

The Hub initially was driven by the CDO, CIO, and our SVP for data analytics. Now that we have consolidated these functions under a CDTO then the Hub is anchored with the CDTO. We’re trying to create a community so that the Hub is seen as one team with one common purpose.

Now, the Digital Hub has its own dynamics, and there are social events, fireside chats, and town halls where people across different organizations can participate. We put these people together in one location, and what this has actually done is broken down the silos that we were experiencing previously.

We’ve been sitting on different floors, in different buildings, in different countries. Now that we have brought the teams together, they talk to each other every day – they literally sit next to each other – so it has broken down the silos between different functions. We’re much more aligned compared to before, and that is a huge improvement for us.

 

DATA AND DIGITALIZATION

 

In terms of technology and innovation, what challenges did you face with the Hub?

 

We didn’t have many challenges with our technologies and choice of technologies when we started the transformation.

We already had a roadmap on what to do with data. We had our online platform, our salesforce, e-commerce, and cloud. Our biggest challenges are with integrations, master data, and a scattered point of sales landscape. But overall, we are in fairly good shape.

 

What stage is the digital transformation of Pandora at the current moment? What other processes are underway to boost the brand’s digital experience?

 

What we have now is a pretty solid digital strategy that has been shaping up over the last 8 months or so.

We’re going all in on our user data for tips on marketing and personalization. We’re also considering communities for people who are interested in our type of jewelry, and planning to introduce a global loyalty program that will hopefully further drive brand loyalty.

The consumer ART is working with data, and working with the marketing team on digital marketing and personalization. In regards to data-driven consumer growth, we also set the teams free to use data to drive sales. By combining the different data sources that we have, such as our transactions and customer browsing data, the ART teams are free to make decisions on their own to allow faster decision-making.

 

What are the biggest differences between the company’s past and present data utilization?

 

It’s two different worlds before the Hub and after the Hub is live. The incremental revenue that is delivered from our data-driven consumer efforts is just outstanding.

We’ve built the integration between different sources in our stack, applied new technologies, and hired Ph.D.-titled profiles to work with data so that we can learn more about our consumers.

We didn’t have that data focus a year and a half ago. I think we had one person in Pandora working with data, but now we have 60+ people working only on advanced data analytics and the use of data.

 

SUCCESS AND THE FUTURE

 

What do you consider to be the key achievements of the Hub?

 
(Image: Peter Elmholt, from ZDNet)

What’s interesting is that the agile way of working that we implemented has really proven its value when the pandemic hit.

Our stock prices have gone up some 100% during 2020 when COVID-19 hit, and that’s quite amazing. It’s actually all down to our technology readiness and the shifts from physical stores to taking advantage of our online channels and digital initiatives.

We were able to step back and look at our priorities and completely change our focus, and now the rest of the business – HR, finance, and other parts of our commercial organization – want to embrace agile working because they see its value. This is just the start and we want to do even more.

Additionally, we see that we can move much faster now. Because the teams are dedicated to the agile release trains (ARTs), they’ve become very efficient and knowledgeable about their role, purpose, and responsibilities. So we’re able to come up with solutions to business strategies at a faster rate.

 

There are always expected ROIs for major projects. What is the anticipated ROI in 2021 due to the Hub?

 

When we first started, my focus, and marketing’s focus, was on revenue-generating and return on investment. It was clear when we went to our CEO that what we proposed was very attractive and that data-driven consumer growth, meaning advanced data analytics alone, would pay for our Digital Hub. And we still have many other initiatives that we’re driving.

In some cases, in terms of ROI, we’re talking about a factor of 10 of the investment. Also, our stock prices have gone up significantly because we took advantage of our online channels and digital initiatives. I think that alone shows the impact of getting digital right.

 

What are the upcoming plans and strategies for the Digital Hub and Pandora?

 

We are in the middle of finalizing our digital strategy for the next 3 to 5 years. We never had a digital strategy before, but now we have it, and it sets the direction for our technology investments across our value chain – where we want to invest our bodies and resources.

Also, we’re focusing on how we can take agile working and our technology operating model to the next level. Yes, we started out with Agile but we’ve only been live for a year or so. Now, how do we bring this further? What do we need to invest in? What kind of profiles, like what agile coaches or release train engineers, do we need to bring on board to further mature our agile ways of working?

 

What commercial goals does Pandora seek to achieve in 2021? What role does the Hub play in achieving these goals?

 

Our key focus right now, and into the next 3 to 5 years, will be on revenue-generating initiatives. We want to drive even more revenue through our online channels.

Aside from that, we’re also focusing on creating an even more seamless customer journey across our different channels. We want to engage with our consumers in a more meaningful way – be more precise in what and when we communicate so that we become more relevant.

Of course, we do all of these to drive revenue, and the Digital Hub is instrumental for us to proceed with the plans.

Posted on

CIO Investments: Which Tech Is Your Priority?

As the world crosses into 2021, the distribution of the COVID-19 vaccine has brought surges in global stocks and market optimism.

However, even with great hopes of economic recovery by the end of 2021, organizations still need to ensure that their business growth and plans continue positively. Chief Information Officers (CIOs) are playing a big part in achieving these goals by maximizing information technology (IT) investments and advancements.

 

What IT Investments To Focus On?

 

According to our Executive Trend Survey, 67% of CIOs placed data science as a top priority for 2021 with core focuses on analytics strategy, data management, and big data analytics. 

Meanwhile, cyber security and cloud were named as other top CIO priorities by 59% and 53% of surveyed leaders respectively.

 
 

But what does this mean for CIOs across the industries?

Based on feedback from CIOs and key IT executives, the majority (47%) of them are facing 2021 with slight changes in their goals and a lower budget for their function.

 
 

With limited budgets, CIOs need to pick and choose which goal takes priority over the others and select a solution that will truly give them the return on investment they seek.

Thus, even if CIO trends point towards analytics if their current end objectives don’t correspond with the need for data solutions, they should focus on more pressing investments.

Another key factor influencing their investment priorities lies in the current maturity levels of their technology and operations. For instance, some are still new in forming data strategies while others are more advanced in their data-driven processes, thus their focus areas in the use of data science differ greatly.

 

Investing In Data Science

 

Today, it’s uncommon to find any company that is not taking advantage of their data. From enhancing customer experience to improving predictive maintenance, business leaders are aware that data is critical to their organizational growth.

But which area of data analytics should your organization focus on? Between the different analytics applications and components, what should be the foremost priority?

In recent interviews with CIOs and other IT decision-makers, over 450 of them named analytics as their core focus. Even so, under the analytics umbrella, their interests ranged from big data analytics and predictive analytics to data warehousing and analytics strategy.

 
 

55% of them selected data management as their foremost investment in analytics, naming master data management (MDM) and product information management (PIM) implementation as some of their projects.

 
 

The MDM solution is largely adopted by the banking, financial services and insurance (BFSI) sector to manage massive amounts of transactional data on their customers. PIM, on the other hand, is seeing higher demand by the e-commerce industry and an anticipated fast growth in the media and entertainment sector.

In regards to data analytics strategy, some of the CIOs are investigating how they can make the business work more efficiently through analytics strategy while others are taking the next steps to improve data quality.

On the other hand, a number of the interviewed decision-makers are still setting up and realizing their data strategy, indicating that they’re still in the planning stages and concentrating on becoming a data-driven organization.

 

Investing in Cyber Security

 

Meanwhile, our most recent interviews with CIOs on cybersecurity investments discovered that cloud security is foremost on their priority list followed closely by cyber security strategy.

 
 

From our findings, a number of the interviewed decision-makers expressed interest in implementing security information and event management (SIEM) solutions.

 
 

Another hot spot in 2021 cyber security spending, according to Forbes, is identity and access management (IAM), which is a prime focus for 30% of business leaders investing in cyber security. Some of their projects regarding access and identity management include:

 
 

With uncertainties still forthcoming, some CIOs are worried about guaranteeing a high level of cyber security with a limited budget while facing challenges in approaching the topic of online security to a diversified and remote workforce.

 

Investing in Cloud

 

Based on CIO investment feedback from the interviews, most of them are still in the planning stage of their cloud strategy with cloud integration and migration as their core priorities.

 
 

Microsoft Azure, Amazon Web Services, and Google Cloud are three of the most popular cloud platforms in the market, and interviewed decision-makers are contemplating between the cloud computing services while some are even working with all three of the platforms.

Alternatively, a group of IT leaders and other key C-suites are working towards a hybrid cloud environment, which is commonly used in industries such as:

What is Your Focus Area?

 

As seen in our survey findings and interviews, each of the IT leaders is prioritizing a specific solution that best serves their target goals with consideration to their budget, their available expertise and IT talents, and current processes.

For some, the immediate focus is on surviving the consequences of the pandemic, “which has become the number one objective for most emerging technology investments”, according to KPMG’s research. For others, it’s an opportune time to shift to a more digital business model and accelerate their digital transformation.

Nevertheless, while benchmarking and taking note of emerging IT trends help your organization to measure business performance against other companies, the global situation and market uncertainty are still expected to significantly affect information technology investments.

The important thing is to have a solid focus on your strategic IT priorities, adopting agility and adaptability for business continuity, and making smart investments to prevail in the long term.

Posted on

IT Benchmark 2021: Where Do You Stand Among the CIOs?

CIO IT Benchmarking

The outbreak, evolving workscape, a volatile market, changing customer demands –  Chief Information Officers (CIOs) have their hands full in strategizing IT projects while maximizing the value of technology investments.

With the modern CIO role entailing more strategic decision-making, you need to identify key technologies that not only help advance the organization’s digital transformation, but that also increase its business value and competitive edge.

So how effective is your IT strategy compared to other organizations in your industry? Are there areas where your peers are ahead of you? Let’s dive into the IT benchmark data for the coming year.

Data Science Takes The Lead

In 2019, Management Events’ Executive Trend Survey found that 88% of CIOs across Europe were focusing on cyber security adoption for the coming years, followed by cloud and big data.

However, the pandemic has shuffled tech priorities with the latest survey discovering that data science and analytics have taken precedence over cyber security for 2021.

Although the findings point towards a higher importance of data science, the surveyed CIOs seem to be almost equally torn between data, cyber security and cloud investments. The close gaps indicate that these three technologies are vital parts of CIOs’ business continuity and recovery strategies.


The Rise Of Data

Based on our survey and interviews with IT decision makers, their core data focuses are on analytics strategy, data management and big data analytics, with the majority looking for data science and analytics to be scaling within their organization in 3 years.

Almost 82% of the surveyed leaders said they are updating data analytics models to accommodate changing market behavior. Furthermore, 73% agreed that they’re heavily investing in data-driven business models for post-COVID-19 survival.


Compared to the 2020 annual budget of between €100,000 and €250,000, the budget allocated by the CIOs for 2021 data analytics spending in their organization is higher, with the majority looking to spend in the €500,000 range.


As for data tech adoption, the majority of CIOs are currently building capabilities by hiring new talents with the required skills. However, in the future, they are looking to change their adoption strategy by investing in other companies to acquire the skills.

Diving deeper into the benchmark data, most of the IT leaders focusing on data analytics are from the retail and consumer industry, followed by the banking and financial services industry. Incidentally, aside from data analytics, the retail CIOs are also looking into e-commerce implementations.


Join the discussion on the latest IT trends with leading CIOs, CTOs and more at 600Minutes Executive IT  in Sweden, Austria, The Netherlands, Switzerland, Belgium, Denmark, Germany, and Norway.

Cyber Security Is Still A Priority

With cybercrimes on the rise, businesses around the world are working hard to prevent data breaches and system disruptions. At the same time, companies are in the midst of strengthening their security framework, from securing endpoints to stronger online protection.

So what are the cyber security benchmark and CIO cyber security focus areas for 2021?

In terms of security investments, data security and privacy is one of the core focal points among European CIOs along with a more robust cyber security strategy and emphasis on cloud security.


As COVID-19 saw increasing security breaches, it’s not a surprise that employee awareness training on cyber security is a top priority for 95% of IT leaders. Meanwhile,  89% of the IT C-executives are expecting a rise in predictive and behavioral detection to prevent cyber attacks.

Similar to data science, cyber security’s annual budget was also ranging between €100,000 and €250,000 for 2020, but has increased to €500,000 for 2021, according to the IT leaders in our survey.

Currently, 58% of the decision makers are partnering with vendors and consultancies for their cyber security solutions, but in the future, most of them are looking at partnering with organizations in other industries to create security ecosystems.

Incidentally, IT leaders from the manufacturing industry make up the majority of surveyed CIOs looking to invest in cyber security.

Cloud Increase On The Horizon

 

On cloud benchmark data, our survey found that cloud is the third topmost tech priority for 2021 with the majority interested in cloud migration coming from the banking and financial services industry.

88% of the cloud-focused respondents are currently looking to migrate their workload to the cloud for increased business efficiency, and the survey also discovered that cloud infrastructure and cloud platforms are primary aspects of the CIO cloud strategy.


Unlike the other aforementioned technologies, cloud migration seems to have different budget ranges. The CIO respondents are divided between spending less than €500,000 and between €500,000 and €1 million in the coming year, when in 2020, the annual budget for cloud was mostly less than €50,000 and between €100,000 and €250,000.

Currently, their cloud adoption approach is partnering with external vendors and training their employees, but 68% of the IT leaders are hoping to acquire the necessary cloud capabilities by investing in other companies in the near future.


How Should You Respond?

Before undertaking a benchmarking opportunity, there is much to consider:

  • Are you looking at industry benchmark data or more towards IT budget benchmarks?
  • What performance or process gaps are you seeking to enhance?
  • Do you have a clear objective for the tech implementation?

While the trends are pointing mainly towards data analytics, investing in this solution must be in line with your organizational and industry goals. As Datafloq puts it, companies need to “dig down to understand if [data analytics] is worth it”, and if it’ll bring them the return of investment (ROI) that they are looking for.

Data analytics use case of a CIO interviewee from a Dutch online travel agency:

  • What’s the objective of analyzing the data? To improve booking experience and behavior recognition
  • What data are they looking at? Online customer behavior
  • What are they using to process the data? Big data analytics and predictive analytics

The same goes for all innovations that are the focus of CIOs. Although market trends are pointing to a certain technology, it doesn’t mean that everyone must jump on the bandwagon.

Data benchmark is just one indicator of your organization’s performance that will potentially inform you on which areas you need to improve, but identifying the right elements to benchmark is the key. It’s vital to choose elements and technologies that will bring the most positive impact to your organization’s growth and revenue.

Posted on

600Minutes Executive IT: How IT Leaders Develop Agility In Times Of Crisis

The recent 600Minutes Executive IT held by Management Events revealed in-depth insights from over 300 top-level IT executives and solution providers from leading organizations in Sweden. 

In group discussions during the virtual event, CIOs across the industries lent their thoughts and opinions on leading in the virtual landscape and through times of crisis.


 

Virtual Leadership

As known the world over, the coronavirus outbreak has brought unprecedented circumstances to the business world, from urgent business continuity planning to lengthy operational disruptions.

As C-suites sought to keep their business operations running, remote working was widely established throughout organizations. But for many IT leaders, managing and leading a remote workforce is a novel experience, and they are faced with different levels of difficulties.

 

Obstacles and Challenges

There were multiple concerns expressed by the event attendees during the group discussions.

One IT executive mentioned that it’s a challenge to keep track of how employees are doing while another stated that it’s harder to pick up on what’s going on when they, as the leader, are working away from the team. Yet another participant expressed worry on the flow of information not reaching the teams.

But among the many hurdles, face-to-face communication and socialization seem to be the most worrying aspects of remote work. Participants were concerned on how to keep the teams together when they’re no longer physically meeting or interacting with each other.

This is especially the case for new hires, whereby organizations need to ensure proper onboarding of the employees and help in building relationships with the current teams. As an IT leader aptly explained, “Now, we are riding on the current company culture from the physical office, but for new hires, there’s a challenge to transfer the silent knowledge and culture that ‘sits in the walls’.”

Stagnancy is another worrying issue among leading IT directors and C-levels as teams don’t share as many ideas or brainstorm as much as before.

As one IT leader commented, “New ideas get lost as most meetings are within the same function. It’s important to keep in contact with decision makers in other functions in order to develop new ideas.”

Other worries and issues presented during the discussions were:

  • Investing more 1-to-1 time for the same output;
  • Difficulty in following up with their teams and getting concrete actions;
  • Lack of boundaries between work and non-work, resulting in potential burnout;
  • Struggles in starting new projects; and
  • Micromanagement.
 

Positive Outlook and Solutions

Even though there are concerns with coordinating a remote workforce, a number of participants are positive that working offsite, or telecommuting, can bring good results. As one attendee stated, “[Remote work] should not be seen as a cost, but an opportunity.”


 

For instance, a decision maker participating in the group discussions claimed that due to the outbreak and subsequent remote working situation, there’s now a stronger focus on innovation, which can help companies to discover business opportunities that were once neglected.

Others corroborated with his statement, saying that the coronavirus inadvertently led to the organization gaining momentum in digitalization, and they should use the ‘new normal’ as a chance to initiate strategic changes.

One example given is the use of iPads for the company’s operators for communication and training purposes, which in the past would have taken a very long time. Others mentioned how their organization now works more digitally and has increased efficiency in some areas, and how people are more innovative without so many contradictions.

 

As an IT director said, “Productivity increases during periods where we are forced to be more innovative.”

 

Additionally, it was a general agreement among the IT leaders that working remotely led to more efficient online meetings as staff seems more prepared, with specific agendas and smooth subsequent information flow and discussions.

Even though a number of attendees voiced out the challenges they’re facing in creating a successful digitalized workforce, they also suggested solutions to overcome the hurdles.

Some of the solutions for effective and progressive remote workforce management given by the participants include:

  • Developing policies and reinforcing them;
  • Raising morale through interactive and non-work-related activities, such as music quizzes;
  • Connecting more often with peers, teams and others from the company to gain different perspectives;
  • Having more dialogues with the workforce on handling the crisis and other work issues; and
  • Scheduling fun meetings and engaging sessions, such as a virtual coffee break, to replace physical socializing.

However, given the pros and cons of working remotely, quite a few of the top executives are looking to develop a hybrid solution of working from home and office.

 

Towards A Hybrid Landscape

“Remotely, productivity remains the same, or is even better, But for some cooperation and creative process work, there’s a need for physical meetings.”


“Virtual hiring is possible. However, physical meetup is still needed to hand over computers and phones, and to provide basic training on how to perform the job.”

 

The above statements are just a few comments from IT leaders who believe in having the best of both offsite and onsite worlds, and were discussing how to maximize value and efficacy in a hybrid office landscape.

Aside from providing possible solutions to the difficulties of building team relations and maintaining the innovation and development arenas, the hybrid solution also addresses the issue of trust.

As a participant mentioned, “If you don’t see your teammates and staff every day, more trust is required,” while another explained that, “In the past, it wasn’t part of leadership to ensure that their groups do their jobs from home.”

An IT executive in the discussion suggested a day or two per week working from home with the rest of the days in the office. Such a solution not only provides the flexibility for employees needing time to take care of family and personal business, but also answers the needs for department heads to have their teams for certain face-to-face tasks.

“A flexible workforce can lead to higher productivity,” a participant asserted.

 

Moving Forward

 As a top IT executive observed, “People react differently to the changing environment and working conditions.” However, overall, it seems that employees, and even customers, have adapted to the ‘new normal’ relatively fast, and companies are witnessing faster digital transformation and innovation than before.

Perhaps it’s true what a decision maker from the IT function said during the discussion – “We need more crises to develop further.”

Posted on

Endpoint Security and the Future of the Cyber Security Landscape

Establishing the Zero-Trust Cybersecurity Framework

In recent years, Cybersecurity has repeatedly been one of the leading anxieties for enterprises worldwide, and in 2020, that trend intensifies. Traditionally, it is easy to shirk the organization’s IT responsibilities and point fingers towards CIOs, CISOs, and the CTO. However, it would be imprudent not to acknowledge that most cybersecurity incidents have arisen due to employee negligence. As such, the culture of taking proactive security measures should be borne by the entire organization.

 

“Today, the only way to be sure your system is good enough from a security point of view is for the whole IT team to design everything with security in mind,” says Grossi. “It’s no longer okay to be only mobile first or cloud first; it’s got to be security first.”

– Piergiorgio Grossi (Former Chief Information (CIO) and Digital Transformation Officer at Italian motorcycle-maker Ducati)

 

A glance at today’s cybersecurity landscape

Cyber attacks alongside Deepfakes continue to increase year over year. According to the ISACA’s Global State of Cyber Security Survey—a survey of more than 2,000 information security professionals from more than 17 industries—looks at the threat landscape, the measures security professionals employ to keep their organizations safe, and key trends and themes in the practice of security.

The cybersecurity landscape presents a positive and negative outlook. On the positive side, at least 50% of fully or appropriately staffed teams are more confident in their abilities to respond to cyber threats. While on the negative side, 62% of survey participants agree that cybercrimes are severely under-reported, and 52% believe that it is very likely their enterprise will experience a cyber attack in the next 12 months. Nevertheless, Information security professionals still believe that real progress is being made against common threats.

The most common threat actors being Cyber Criminals (22%), Hackers (19%), Malicious Insiders (11%), Non-Malicious Insiders (10%), Nation-State Attackers (9%), and Hacktivists (8%). The most frequent attack methods being Social Engineering (15%), Advanced Persistent Threat (10%), Ransomware (9%), and Unpatched systems (9%). Other noteworthy methods are Distributed Denial of Service (DDoS) and Mobile Malware, especially via android.

Fortunately, Google is making more headway with its latest privacy-focused features and increased efforts toward security updates. Android 10 (Pie) introduced granular controls over app permissions, while the upcoming Android 11 (currently available as a developer preview) further conveys their commitment to improvements in security with the implementation of temporary one-time access, allowing an app to use, for example, your phone’s location or camera. Android 11 continues this security-focused expansion and uses biometrics (Face, Iris, and Fingerprint data) to authenticate apps and services. Android 11 will also support digital driver licenses and other identification documents.

The ISACA survey also shows that organizations that take longer to fill in their cybersecurity and related positions report an increase in cyber attacks. Enterprises that took less than 2 weeks experienced 26% more cyber-attacks this year. Those who took around three months experienced 35% more attacks this year. Those who took six months or more experienced 38% more attacks. While those who were or still finding it hard to fill the positions experienced 42% more cyber-attacks this year.

 

Why Endpoint Attacks Occur

There used to be a distinct difference between the inside and outside of an organization, with infrastructures possessing clearly defined roles and boundaries. Organizations would have offices with computers and servers running on-site, creating a physical firewall, and ensuring that data often never leaves the company.

However, with the rise in telecommuting, more employees were asked or forced to work from home where there is no apparent, easily guarded line that can keep all the data in and attackers out of the system.

Worse is that some organizations still have a legacy viewpoint of the boundaries. Combine that with the BYOD trend, and all these lead to an increasingly expanding frontline. Causing security personnel to deal with relatively easy to hack employee-owned devices. This is further compounded by the fact that most employees expect convenience—many opting to use free and popular services to bring their data outside the company and with them. The majority of these services are infamously insecure, as have been pointed out by several hacks lately.

One such cyber attack is the recent discovery of an additional six malicious Android apps (11 similarly malicious apps were discovered in July) that slipped through the Google Play Store’s safety net to plant malware on Android devices. Another phishing attack targeted government and security organizations, using a legitimate Box page with Microsoft 365 branding to trick the victims.

The attackers were careful to appear quite convincing. Botnets facilitated spam and malicious emails with sender names and domains from a legitimate third-party vendor, asking readers to view a sensitive financial document. Viewers who clicked the link were led through a series of pages till they landed on a phishing page, built to resemble the Office 365 login portal, where they were asked to log in with their corporate credentials.

According to the cybersecurity awareness and data analysis firm, CybSafe and data from the UK Information Commissioner’s Office (ICO), 90% of the 2376 cyber breaches reported to the ICO in 2019 were attributed to end-users’ errors. This was a significant increase from the years prior, with 61% in 2017 and 87% in 2018. The cybersecurity company reported phishing accounted for 45% of all reported cases, making them the primary cause in 2019 in the UK.

There is a general lack of public understanding around basic secure behavior, such as spotting fraudulent links and phishing emails, sending the wrong document to the wrong person, leaving a computer unlocked, or plugging in unidentified USB sticks. However, there are two sides to this human error issue.

  1. Passive Attacking: End-users and endpoints have become the primary targets for cyber attacks. This is because their behaviors and powerful devices are relatively easier to exploit, making them attractive targets. Security to most end-users is an untaught concept, and one they typically leave to the “experts.” Yet said experts are rarely the most communicative or most persuasive of tutors and thus, fail to communicate the pitfalls of not being security first effectively. Additionally, BYODs rarely include superior security, such as multifactor authentication (MFA), a system that can prevent the vast majority of data breaches by stopping unauthorized clients from accessing a corporate device. This all leads to the end-user becoming the weakest link, triggering a Supply Chain Attack.
  2. Increased IT Infrastructure Complexity: This second aspect encompasses the increasing complexity and distinctiveness of security tools. From intrusion detection, network monitoring, and encryption to security information and event management tools (SIEMs). Typically, more robust options are welcome; the issue is that all of these disparate tools need to be integrated effectively and correctly aligned to provide adequate and effective security. This also means that security teams have to know each tool, their uses, thresholds, and experience to create appropriate baselines. Unfortunately, teams are not trained well enough in the real world and most likely implement the tools with their default configurations. Doing this allows for an easier rollout but a risky and unsecured move, nonetheless. Such settings were predetermined by the manufacturer and basically put usability before all else.
 

“Though shocking, these statistics shouldn’t provoke a negative reaction. Employees of course pose a certain level of cyber risks to their employers, as seen in our findings thus far. Nevertheless, people also have an important role to play in helping to protect the companies they work for, and human cyber risk can almost always be significantly reduced by encouraging changes in staff cyber awareness, behavior, and culture.”

– Oz Alashe – (CEO and Founder at CybSafe)

 

Undoubtedly, cybersecurity has dramatically changed, and cybersecurity teams’ capabilities are being stretched past their limits. Fundamentally brought on by a ballooning attack surface blended with ill-informed and inappropriate consequential end-user behavior floated by some organizations that refuse to take security seriously.

 

Endpoint cybersecurity threats

Endpoint security is a critical aspect of the cybersecurity landscape, and it’s becoming increasingly important as the nature of work evolves. With more devices connecting to networks than ever before, from laptops and smartphones to IoT devices, the number of potential entry points for endpoint cyber security threats has multiplied. This makes endpoint cyber security a vital component of any comprehensive security strategy.

Endpoint cyber security threats are diverse and constantly evolving. They include malware, ransomware, phishing attacks, and zero-day exploits, among others. These threats can compromise individual devices, and from there, gain access to the broader network, leading to data breaches or system disruptions.

Malware and Ransomware: Malware is a broad term that encompasses various types of malicious software, including viruses, worms, and Trojans. Ransomware, a type of malware, encrypts a victim’s files and demands a ransom to restore access. These threats can infiltrate endpoints through malicious email attachments, infected software downloads, or malicious websites.

Phishing Attacks: Phishing attacks often come in the form of deceptive emails that trick users into revealing sensitive information, such as passwords or credit card numbers. They can also involve convincing users to click on a link or download an attachment that installs malware on their device.

Zero-Day Exploits: These are attacks that take advantage of software vulnerabilities that are unknown to the software vendor. Because these vulnerabilities haven’t been patched, they provide an open door for hackers to infiltrate systems and networks.

Advanced Persistent Threats (APTs): APTs are complex, stealthy threats in which an unauthorized user gains access to a network and remains undetected for a prolonged period. These threats are often state-sponsored and aim to steal information or disrupt operations.

To combat these threats, organizations need to adopt a multi-layered approach to endpoint security. This includes the use of antivirus and anti-malware solutions, firewalls, intrusion prevention systems, and endpoint detection and response (EDR) technologies. Additionally, organizations should regularly patch and update software to fix known vulnerabilities, and educate employees about safe online practices to prevent phishing and other user-targeted attacks.

 

The Future of the Cyber Security Landscape

The evolution of large-scale breaches symbolizes a growing trend of security violations both in numbers and their gravity. Data breaches recurrently expose sensitive information that often leaves users at risk for identity theft, ruin businesses’ reputations, and leave businesses liable for compliance violations. Cyber Observer, holistic cybersecurity management, and awareness solutions predict that damages from cyber crimes are projected to reach $6 trillion annually by 2021.

In other words, as enterprises gradually emerge from the current pandemic, we expect to see a surge in new demands. Reacting to these will require CIOs to formulate strategies based on two structural principles; understanding what customers need in a transforming landscape and leveraging technology to respond to these challenges in ways that acknowledge scope, cost, and scale objectives.

It is virtually impossible to write about the cybersecurity landscape’s future without citing Artificial intelligence (AI) and its role in securing endpoints. AI has existed for quite some time, and its use in our daily lives has become so common that we hardly ever stop to really think about it. From “Weak” AI programs such as “AlphaGo” developed by Goggle DeepMind that combined advanced search tree with deep neural networks, to Strong AI and machine learning systems used in flying Drones, Google Nest, and Tesla’s Autopilot. CIOs will carry on utilizing AI in various fields within cybersecurity. If anything, but to combat the numbers of attackers misusing AI and machine learning.

Looking to the future, the potential for new threat classes remains; ubiquitous and non-discriminatory in nature and to which there are currently no known catch-all countermeasures. Intrinsically, meticulous observations on malware features, abnormal acts, attackers’ attributes, and machine learning-based AI algorithms empower the defenders to deal with cyber threats, and in some cases, actually, go on offense. Regrettably, such observations also provide the attackers’ chances to invent novel attack techniques. Particularly as the risk of inputting false data and many other unsolved errors are relatively high in AI, defenders must always stay alert.

 

10 Simple Steps to Protect Your Business

Today, homeowners go beyond the typical door locks and automatic lights to a fully integrated security system that can prevent attacks and detect and respond to an intrusion and even accidents like a fire. Similarly, a business should deploy a multilayered cybersecurity strategy, one that includes.

Prevention: Firewalls, Anti-virus, Anti-malware, Password Management, Cybersecurity Awareness Training

Detection: SIEM, IDS, Threat Intelligence, and Log Monitoring

Response: 24/7 SOC Monitoring Response, Automated Threat Remediation, and Forensic Investigation.

These are all great tools, but in reality, not all businesses can afford top of the line and often proprietary security suites. Fortunately, you or businesses do not need to invest endlessly in new security tools to improve and elevate your current Cybersecurity posture and awareness for the reason that 80% of data breaches can be prevented with the following basic actions.

  1. Patching
  2. Regular vulnerability assessments
  3. Institute end-user security awareness
  4. Ensuring third-party vendor compliance
  5. Endpoint Detection and Response (EDR)
  6. Limiting access to your most valuable data
  7. Securing mobile devices and BYOD devices
  8. Proper device and or software configurations
  9. Conduct employee security awareness training
  10. Develop cyber breach prevention, detection, and response plan
 

Final Thoughts

Improving endpoint cyber security needs to be a top priority in 2020 and the foreseeable future. The border-less and seemingly non-discriminatory nature of cyber-attacks means it is of imperative importance that the cybersecurity industry shares their insights and work together to protect themselves and the wider population.

In today’s connected world, a breach of one organization can compromise an entire supply chain. Spelling disaster for businesses, eroding public trust and opinions, whilst leaving them in financial collapse, particularly with the General Data Protection Regulation (GDPR) in the EU. It is up to the legitimate security community to learn from each other, sharing what works and what does not. Most importantly, we all need to identify where to improve and ensure we leave no one behind.