Proposed Government Policy Changes Prove GRC More Relevant Than Ever

Bruce Romney

It’s been an interesting political roller coaster, to say the least, in the U.S. over the past several months. While things seem to be settling just a little, I’m sure a day won’t pass without a news story or press release that doesn’t cause significant pause for some, and cautious optimism for others.

Regardless of which way the political winds blow, whenever leadership shifts in the White House and Congress, proposed policy changes that will affect businesses worldwide come under the microscope. And of these policies, it seems clear that governance, risk, and compliance (GRC) issues will be front and center for CEOs committed to driving growth in the years ahead.

A CEO’s point of view

I very much appreciated listening in to an interview with Dow Chemical’s CEO, Andrew Liveris, on Neil Cavuto’s “Coast to Coast” business program. Mr. Liveris had just been part of a gathering of CEOs advising the new administration on the opportunity to grow the U.S. economy beyond the 2% growth rate, especially in the area of bringing back manufacturing.

Source: PwC CEO Survey

Mr. Liveris is active in the geopolitical space as a significant influencer on the global stage. He has relationships with leaders in many, many other countries and regions worldwide. (Dow Chemical, for example, operates in more than 160 countries). Australian by nationality and party neutral as a leader of a large multinational, Mr. Liveris considers himself neither “red” nor “blue,” but “purple” when it comes to U.S. politics.

I appreciate this pragmatic approach, as it allows him to contribute in a meaningful way to everyone, and indeed he has advised the both the Obama and Trump Administrations, in addition to being personal friends with the Clintons. The world continues to move forward, and helping to shape tomorrow’s direction and vision is not an insignificant influence he wields.

Winds of policy change and GRC

Considering how quickly a stroke of a pen can roll back years of prior policy or institute new requirements that seem to even flirt with evading courts or legislative bodies, organizations must be nimbler and quicker than ever to anticipate and respond to the new risks and opportunities that are presented by changes in governmental administrations.

When Mr. Liveris talked about all the areas of focus for him as a CEO in driving this new growth, he didn’t bring up topics such as machine learning, or blockchain—however important these emerging technologies may be. Instead, he highlighted the following topics, in this order: 1. regulatory change 2. changes in tax policy 3. trade 4. infrastructure 5. education 6. energy and others.

I don’t think it’s a small coincidence that the top three drivers for this agenda are front-and-center GRC topics. And although not mentioned in this interview, other GRC topics like cybersecurity risk and governance are also top of mind across the globe for CEOs for all sizes of organizations. (See the graph below from the PwC CEO Survey.)

As a GRC “practitioner,” this excites me and gives me renewed appreciation for the fact that we’re in a space that is driving change and will continue to be highly relevant. We’re challenged to help the broader organization see these and other GRC topics as not just a cost of doing business, but as driving the CEO’s growth agenda in 2017 and beyond.

An agile GRC platform is essential

What’s needed is an agile GRC platform covering the wide array of GRC requirements demanded to ensure growth, including regulatory change management and the three lines of defense. This platform should enable your organization to institute the right combination of access governance and data protection, manage cyber threats on a daily basis, and manage new tax and global trade requirements.

And don’t forget the potential every four years in the U.S. for the next pen—whether blue or red—to keep those winds of change blowing.

Learn more

SAP offers a tremendous vision and capability for organizations to navigate the rapid pace of change. Read the other blogs in our GRC Tuesdays series to learn more about topics like these.

This article, originally titled “GRC Tuesdays: Proposed Government Policy Changes Prove GRC More Relevant Than Ever,” originally appeared on the SAP BusinessObjects Analytics blog and has been republished with permission.

Follow SAP Finance online: @SAPFinance (Twitter)  | LinkedIn | FacebookYouTube

Comments

Apathy, Not Hackers: The Real Enemy Of The Cloud And Emerging Tech

Paul Kurchina

The cloud is quickly moving past the hype to deliver tangible and transformational value. Across the board, cloud-based products and services are growing to the point where more than 92% of all workloads will be processed in cloud data centers by 2020. The cloud is also enabling heavy-hitter, emerging technology along the way, including advanced analytics, containers, artificial intelligence, cognitive computing, and virtual reality. And even the Internet of Things (IoT) is gaining momentum in the cloud as it sets to impact the world in the next decade 5-10x more than the entire existence of the Internet.

According to Mark Weatherford, senior vice president and chief cybersecurity strategist of vArmour, there are no signs of the cloud’s influence slowing down. In his upcoming Webcast “The Cloud, IoT, and Critical Infrastructure: It’s Not Too Late for the Cyber,” sponsored by Americas’ SAP Users’ Group (ASUG), he will share a much-needed reality check:

“Today is the slowest day in your life in terms of technology. If you think the pace is frantic now, just wait until Q4 … or 2018 … or 2020. The rate of change in business is going to be faster every year for the rest of your working life.”

Even though there is so much potential, very few business leaders understand how the cloud – and the technology it supports – will impact their company. Why? It’s most likely because their organizations are still outmatched in their ability to combat cyberattacks of any kind.

The truth about the cloud, virtualization, and cybersecurity

In no other area of the business are companies fighting to protect their business from so many ill-intended actors, ranging from international organized crime rings to terrorist organizations, politically charged hacktivists, and cyberspies acting on behalf of global nation states. Although there are high-stakes risks in the cloud, this doesn’t mean that locking down your IT systems and data to limit information-sharing and real-time insight is the answer.

Thomas Friedman, American journalist, author, and three-time Pulitzer Prize winner, poetically laid out the dangers of this lack of know-how in one of his recent New York Times columns:

“We’re moving into a world where computers and algorithms can analyze (reveal previously hidden patterns); optimize (tell a plane which altitude to fly each mile to get the best fuel efficiency); prophesize (tell you when your elevator will break or what your customer is likely to buy); customize (tailor any product or service for you alone); and digitize and automatize more and more products and services. Any company that doesn’t deploy all six elements will struggle, and this is changing every job and industry.”

To realize Friedman’s vision, businesses must somehow whittle down a seemingly infinite number of digital options to find technology that best fits their needs. But, as Weatherford suggests, the key to investing in the right technology is focusing on nine fundamental areas of strategic security:

  • Identity and access: Monitor privileged-account usage while allowing only authorized users to access critical systems and countering threats.
  • Network: Ensure that all networks in the IT landscape are secure.
  • Applications: Identify risks to all applications.
  • Security breaches: Understand the threat landscape and plan the right strategy to protect the business.
  • Compliance: Adhere to all application obligations as the company reduces its compliance burden.
  • Supplier risk: Track whether suppliers are adequately safeguarding organizational assets.
  • Business continuity: Strengthen protections to ensure continuous operations during a crisis.
  • Mobility: Secure mobile applications.
  • Cloud: Assess any security risks as a result of a cloud migration.

Weatherford also warns that insiders need to be better trained to prevent unintended security breaches. “The real danger is the uneducated user who is more likely to click on a link or push a button that shouldn’t be touched in the first place,” he said. “Educate, educate, educate. Drill, drill, drill. This is all necessary to raise the bar on security.”

In our increasingly digital world, hope is not a strategy, but a reasonable security program is. Maybe, one day within the next 10 years, security will become a top priority that everyone understands and acquires as a natural skill. But until then, let’s put a little more attention, time, and care into the security of the IT architecture and data while engaging technology that can drive significant competitive advantage.

For more cybersecurity insights and advice from Mark Weatherford, senior vice president and chief cybersecurity strategist of vArmour, join us on October 23 for the Americas’ SAP Users’ Group (ASUG) Webcast “The Cloud, IoT, and Critical Infrastructure: It’s Not Too Late for the Cyber.”

Comments

Paul Kurchina

About Paul Kurchina

Paul Kurchina is a community builder and evangelist with the Americas’ SAP Users Group (ASUG), responsible for developing a change management program for ASUG members.

Will A Digital Renaissance Man Save Cybersecurity?

Derek Klobucher

The cyberattacks we’ve seen to date have been child’s play relative to what’s possible, according to a government expert. We could soon see how bad it can get – and our best defense may be highly capable cyber warriors.

Organizations are scrambling to react in the wake of high-profile attacks, such as a devastating ransomware attack on the UK’s National Health Service in May. Recently Equifax’s interim CEO took to The Wall Street Journal as a sort of mea culpa for a massive data breach of the American consumer credit reporting agency this summer, and the U.S. Securities and Exchange Commission announced a new cyber unit. “Sometime in the next few years, we’re going to have our first category one cyber-incident,” Ian Levy, technical director at the UK’s National Cybersecurity Centre, said at an information security event in September, referring to an attack so severe it would require a national government response.

“Cyber-related threats to trading platforms and other critical market infrastructure” are among the unit’s jurisdiction. And that’s good because plenty of threats exist.

There’s a vulnerable app for that

Stock trading is among your smartphone’s myriad capabilities. But many of the most popular trading apps are susceptible to cyberattack, according to Seattle-based security adviser IOActive.

 “Cybersecurity has not been on the radar of [the people within] the fintech space in charge of developing trading apps,” said Alejandro Hernández, an IOActive cybersecurity consultant. “Security researchers have disregarded these apps as well, probably because of a lack of understanding of money markets.”

These apps enable users to monitor market performance, as well as conduct bank transfers, make purchase orders, and more. But the 21 apps that Hernández evaluated – available via the Apple Store and Google Play – included four that sent passwords in cleartext and others that did not sufficiently encrypt data, among other issues. But the good news is that some people are learning their lesson.

“Innovate to stay ahead of the hackers,” a recent cybersecurity study recommends. “The app developed by a brokerage firm who suffered a data breach many years ago was shown to be the most secure one,” Hernández stated.

Think like a cyber criminal

Cyber-weaknesses are still prevalent where banks, payment systems, and messaging networks meet, according to a Committee on Payments and Market Infrastructures study. And the financial burdens of cyberattacks on businesses around the world seem to be growing, research from Accenture and the Ponemon Institute indicates.

This year’s average cost of cybercrime globally jumped by 22.7% over last year to $11.7 million per organization – or a whopping 62% increase from five years ago, according to the research. Financial services bore the brunt of cyberattacks, averaging annual costs of $18.28 million.

“Innovate to stay ahead of the hackers,” the study recommends. “Invest in the ‘brilliant basics,’ such as security intelligence and advanced access management … [and] spend on new technologies, specifically analytics and artificial intelligence.”

Layer up

Staving off a “category one cyber-incident” will require organizations to focus on risk management – and putting faith in their people, according to the NCC’s Levy. “People create the value at these organizations … [so] build technical systems for normal people.”

That’s important because your organization may not be up against a simple hacker – or an unscrupulous competitor. The complexity, duration, and skill sets necessary for the cyberattacks against the SEC, Equifax, and others hint at the possibility of state sponsorship, said Joshua Douglas, Raytheon’s chief strategy officer of cyber services, on Fox Business.

Thwarting tomorrow’s cyberattacks will require Renaissance men and women, highly capable cyber workers who are well versed in ethics and technology, as well as contextual thinking and clear communications, according to a cybersecurity expert.

“I think most companies are focused on the outside very heavily, which is good,” Douglas said. “But I think that we fail to realize that once an outsider makes it in, that you don’t have that second tier or third tier of support and security to protect the most important assets.”

Renaissance to the rescue

Massive cyberattacks – category one or otherwise – should inspire us to a higher level of innovation, akin to the 20th Century space race, according to national security news website Defense One. Echoing Levy’s call for faith in people, cybersecurity will demand highly capable cyber workers who are well versed in ethics and technology, as well as contextual thinking and clear communications.

“As we expose cyber operators to ever-more vast amounts of sensitive information – and entrust them with some of the most destructive digital tools imaginable – we must continue to ensure that their technical skills are matched by character traits such as integrity and loyalty,” Defense One said. “Only such digital-age Renaissance men and women will be able to rise to the cyber challenges of our time.”

Lackadaisical approaches to security may create long-term problems for your business. See The Future of Cybersecurity: Trust as Competitive Advantage.

Follow me @DKlobucher.

Comments

About Derek Klobucher

Derek Klobucher is a Brand Journalist, Content Marketer and Master Digital Storyteller at SAP. His responsibilities include conceiving, developing and conducting global, company-wide employee brand journalism training; managing content, promotion and strategy for social networks and online media; and mentoring SAP employees, contractors and interns to optimize blogging and social media efforts.

Diving Deep Into Digital Experiences

Kai Goerlich

 

Google Cardboard VR goggles cost US$8
By 2019, immersive solutions
will be adopted in 20% of enterprise businesses
By 2025, the market for immersive hardware and software technology could be $182 billion
In 2017, Lowe’s launched
Holoroom How To VR DIY clinics

Link to Sources


From Dipping a Toe to Fully Immersed

The first wave of virtual reality (VR) and augmented reality (AR) is here,

using smartphones, glasses, and goggles to place us in the middle of 360-degree digital environments or overlay digital artifacts on the physical world. Prototypes, pilot projects, and first movers have already emerged:

  • Guiding warehouse pickers, cargo loaders, and truck drivers with AR
  • Overlaying constantly updated blueprints, measurements, and other construction data on building sites in real time with AR
  • Building 3D machine prototypes in VR for virtual testing and maintenance planning
  • Exhibiting new appliances and fixtures in a VR mockup of the customer’s home
  • Teaching medicine with AR tools that overlay diagnostics and instructions on patients’ bodies

A Vast Sea of Possibilities

Immersive technologies leapt forward in spring 2017 with the introduction of three new products:

  • Nvidia’s Project Holodeck, which generates shared photorealistic VR environments
  • A cloud-based platform for industrial AR from Lenovo New Vision AR and Wikitude
  • A workspace and headset from Meta that lets users use their hands to interact with AR artifacts

The Truly Digital Workplace

New immersive experiences won’t simply be new tools for existing tasks. They promise to create entirely new ways of working.

VR avatars that look and sound like their owners will soon be able to meet in realistic virtual meeting spaces without requiring users to leave their desks or even their homes. With enough computing power and a smart-enough AI, we could soon let VR avatars act as our proxies while we’re doing other things—and (theoretically) do it well enough that no one can tell the difference.

We’ll need a way to signal when an avatar is being human driven in real time, when it’s on autopilot, and when it’s owned by a bot.


What Is Immersion?

A completely immersive experience that’s indistinguishable from real life is impossible given the current constraints on power, throughput, and battery life.

To make current digital experiences more convincing, we’ll need interactive sensors in objects and materials, more powerful infrastructure to create realistic images, and smarter interfaces to interpret and interact with data.

When everything around us is intelligent and interactive, every environment could have an AR overlay or VR presence, with use cases ranging from gaming to firefighting.

We could see a backlash touting the superiority of the unmediated physical world—but multisensory immersive experiences that we can navigate in 360-degree space will change what we consider “real.”


Download the executive brief Diving Deep Into Digital Experiences.


Read the full article Swimming in the Immersive Digital Experience.

Comments

Kai Goerlich

About Kai Goerlich

Kai Goerlich is the Chief Futurist at SAP Innovation Center network His specialties include Competitive Intelligence, Market Intelligence, Corporate Foresight, Trends, Futuring and ideation. Share your thoughts with Kai on Twitter @KaiGoe.heif Futu

Tags:

Blockchain: Much Ado About Nothing? How Very Wrong!

Juergen Roehricht

Let me start with a quote from McKinsey, that in my view hits the nail right on the head:

“No matter what the context, there’s a strong possibility that blockchain will affect your business. The very big question is when.”

Now, in the industries that I cover in my role as general manager and innovation lead for travel and transportation/cargo, engineering, construction and operations, professional services, and media, I engage with many different digital leaders on a regular basis. We are having visionary conversations about the impact of digital technologies and digital transformation on business models and business processes and the way companies address them. Many topics are at different stages of the hype cycle, but the one that definitely stands out is blockchain as a new enabling technology in the enterprise space.

Just a few weeks ago, a customer said to me: “My board is all about blockchain, but I don’t get what the excitement is about – isn’t this just about Bitcoin and a cryptocurrency?”

I can totally understand his confusion. I’ve been talking to many blockchain experts who know that it will have a big impact on many industries and the related business communities. But even they are uncertain about the where, how, and when, and about the strategy on how to deal with it. The reason is that we often look at it from a technology point of view. This is a common mistake, as the starting point should be the business problem and the business issue or process that you want to solve or create.

In my many interactions with Torsten Zube, vice president and blockchain lead at the SAP Innovation Center Network (ICN) in Potsdam, Germany, he has made it very clear that it’s mandatory to “start by identifying the real business problem and then … figure out how blockchain can add value.” This is the right approach.

What we really need to do is provide guidance for our customers to enable them to bring this into the context of their business in order to understand and define valuable use cases for blockchain. We need to use design thinking or other creative strategies to identify the relevant fields for a particular company. We must work with our customers and review their processes and business models to determine which key blockchain aspects, such as provenance and trust, are crucial elements in their industry. This way, we can identify use cases in which blockchain will benefit their business and make their company more successful.

My highly regarded colleague Ulrich Scholl, who is responsible for externalizing the latest industry innovations, especially blockchain, in our SAP Industries organization, recently said: “These kinds of use cases are often not evident, as blockchain capabilities sometimes provide minor but crucial elements when used in combination with other enabling technologies such as IoT and machine learning.” In one recent and very interesting customer case from the autonomous province of South Tyrol, Italy, blockchain was one of various cloud platform services required to make this scenario happen.

How to identify “blockchainable” processes and business topics (value drivers)

To understand the true value and impact of blockchain, we need to keep in mind that a verified transaction can involve any kind of digital asset such as cryptocurrency, contracts, and records (for instance, assets can be tangible equipment or digital media). While blockchain can be used for many different scenarios, some don’t need blockchain technology because they could be handled by a simple ledger, managed and owned by the company, or have such a large volume of data that a distributed ledger cannot support it. Blockchain would not the right solution for these scenarios.

Here are some common factors that can help identify potential blockchain use cases:

  • Multiparty collaboration: Are many different parties, and not just one, involved in the process or scenario, but one party dominates everything? For example, a company with many parties in the ecosystem that are all connected to it but not in a network or more decentralized structure.
  • Process optimization: Will blockchain massively improve a process that today is performed manually, involves multiple parties, needs to be digitized, and is very cumbersome to manage or be part of?
  • Transparency and auditability: Is it important to offer each party transparency (e.g., on the origin, delivery, geolocation, and hand-overs) and auditable steps? (e.g., How can I be sure that the wine in my bottle really is from Bordeaux?)
  • Risk and fraud minimization: Does it help (or is there a need) to minimize risk and fraud for each party, or at least for most of them in the chain? (e.g., A company might want to know if its goods have suffered any shocks in transit or whether the predefined route was not followed.)

Connecting blockchain with the Internet of Things

This is where blockchain’s value can be increased and automated. Just think about a blockchain that is not just maintained or simply added by a human, but automatically acquires different signals from sensors, such as geolocation, temperature, shock, usage hours, alerts, etc. One that knows when a payment or any kind of money transfer has been made, a delivery has been received or arrived at its destination, or a digital asset has been downloaded from the Internet. The relevant automated actions or signals are then recorded in the distributed ledger/blockchain.

Of course, given the massive amount of data that is created by those sensors, automated signals, and data streams, it is imperative that only the very few pieces of data coming from a signal that are relevant for a specific business process or transaction be stored in a blockchain. By recording non-relevant data in a blockchain, we would soon hit data size and performance issues.

Ideas to ignite thinking in specific industries

  • The digital, “blockchained” physical asset (asset lifecycle management): No matter whether you build, use, or maintain an asset, such as a machine, a piece of equipment, a turbine, or a whole aircraft, a blockchain transaction (genesis block) can be created when the asset is created. The blockchain will contain all the contracts and information for the asset as a whole and its parts. In this scenario, an entry is made in the blockchain every time an asset is: sold; maintained by the producer or owner’s maintenance team; audited by a third-party auditor; has malfunctioning parts; sends or receives information from sensors; meets specific thresholds; has spare parts built in; requires a change to the purpose or the capability of the assets due to age or usage duration; receives (or doesn’t receive) payments; etc.
  • The delivery chain, bill of lading: In today’s world, shipping freight from A to B involves lots of manual steps. For example, a carrier receives a booking from a shipper or forwarder, confirms it, and, before the document cut-off time, receives the shipping instructions describing the content and how the master bill of lading should be created. The carrier creates the original bill of lading and hands it over to the ordering party (the current owner of the cargo). Today, that original paper-based bill of lading is required for the freight (the container) to be picked up at the destination (the port of discharge). Imagine if we could do this as a blockchain transaction and by forwarding a PDF by email. There would be one transaction at the beginning, when the shipping carrier creates the bill of lading. Then there would be look-ups, e.g., by the import and release processing clerk of the shipper at the port of discharge and the new owner of the cargo at the destination. Then another transaction could document that the container had been handed over.

The future

I personally believe in the massive transformative power of blockchain, even though we are just at the very beginning. This transformation will be achieved by looking at larger networks with many participants that all have a nearly equal part in a process. Today, many blockchain ideas still have a more centralistic approach, in which one company has a more prominent role than the (many) others and often is “managing” this blockchain/distributed ledger-supported process/approach.

But think about the delivery scenario today, where goods are shipped from one door or company to another door or company, across many parties in the delivery chain: from the shipper/producer via the third-party logistics service provider and/or freight forwarder; to the companies doing the actual transport, like vessels, trucks, aircraft, trains, cars, ferries, and so on; to the final destination/receiver. And all of this happens across many countries, many borders, many handovers, customs, etc., and involves a lot of paperwork, across all constituents.

“Blockchaining” this will be truly transformational. But it will need all constituents in the process or network to participate, even if they have different interests, and to agree on basic principles and an approach.

As Torsten Zube put it, I am not a “blockchain extremist” nor a denier that believes this is just a hype, but a realist open to embracing a new technology in order to change our processes for our collective benefit.

Turn insight into action, make better decisions, and transform your business. Learn how.

Comments

Juergen Roehricht

About Juergen Roehricht

Juergen Roehricht is General Manager of Services Industries and Innovation Lead of the Middle and Eastern Europe region for SAP. The industries he covers include travel and transportation; professional services; media; and engineering, construction and operations. Besides managing the business in those segments, Juergen is focused on supporting innovation and digital transformation strategies of SAP customers. With more than 20 years of experience in IT, he stays up to date on the leading edge of innovation, pioneering and bringing new technologies to market and providing thought leadership. He has published several articles and books, including Collaborative Business and The Multi-Channel Company.