Hi, this is Tom Field, editorial director with Information Security Media Group. We're talking today about the state of governance of Enterprise IT, and pleased to be talking with Robert Stroud, his international vice president with both ISACA and the IT Governance Institute. Robert, it's a pleasure to talk with you again. Hi Tom, it's great to be back again.
For our audience who's not familiar with you or the IT Governance Institute, Robert, why don't you tell us a little bit about yourself and the organization? Sure, thanks Tom. So the association is focused as a member-based organization, focused on delivering value to our members. Our tagline is Trust in and Value from Information Services or Information Systems.
And we focus on serving the assurance, audit, management and security professionals globally with chapters in almost every country. We have many meetings and we develop intellectual property and then leverage that within our memberships to help them in their careers and gain value out of the systems that they run for their employers. Robert, we hear a lot about governance these days. What would you say is the global state of governance of Enterprise IT today?
Yeah, there's a couple of interesting issues here. Certainly we all are aware with things like Southern Docksley, Compliance, Legislation, Grand Bleachley and all the other aspects of that. And that kind of brought governance to the forefront over the last few years. And another aspect of that I think that's come even further forward over the last couple of years is the notion of risk, which really supports the security consistency, understanding their role and their value to the organization.
So what happened over the last couple of years, and just in the last short period, is we've understood or identified that governance is certainly top of mind of organization as they go to drive value out of their innovation stage that they're going through after the global recession. There's a couple of interesting aspects that I'd probably like to share a few thoughts with you on right now. And the first is that we're continuing to see cloud computing dominate the topic and the discussion. Now, we'll talk more about some of the other security aspects at the moment.
But one of the things we're seeing that one of the things that's recent survey we undertook found is that cloud computing is certainly top of mind of organizations trying to understand how to leverage it, or understand how to mitigate the risk. We're also seeing continuing expense management and expense watching, as we call it, become an issue in the open world. And that leads to organizations having to understand where to invest their IT dollars to drive value. But the other interesting concept is that in terms of governance, when we look at governance of enterprise IT in a recent survey that we undertook, only 5% identified as they did not consider it important.
So what I'm seeing or believing now is that governance is becoming a fundamental and primary issue for CIOs and organizations as they move forward. Well, interesting that you mentioned this survey. I wanted to talk with you about that, Robert, because I know the Institute has just conducted a survey. What would you say are some of the key findings of particular interest to our security audience?
Yes, so there's two aspects of the findings that will be very interesting to the security audience. You know, first is where the industry's going. And then I think the second part of that is where the security professional really needs to focus on to ensure that they're driving value out of the work they do and communicating that value of their organization. So as I touched on before, the emerging technology such as Bring Your Own Device, which is one emerging technology, cloud computing, and other industry trends such as the proliferation of the various devices we're seeing in the organization, is certainly highlighting the fact that there is a new delivery model being adopted by many organizations.
This new delivery model introduces new opportunities, I didn't say I didn't call it risk for our security professionals, because we need to understand how we're going to integrate security and other aspects into these devices and leverage them so that we can ensure that our people and organizations are doing the correct things at the correct times with these devices. The next interesting aspect of that is that the governance is now becoming an assumed area, an assumed process, something that's just happening as part of an organization. As we move forward in this economic background, I think our security professionals really need to understand that they will probably be called on to justify the investments in security as they move forward in terms of business value, not just necessarily simply mitigation of risk. I think that that key aspect there is that there are instances where we need to really coach the business on the value that security adds.
The third thing I just wanted to mention quickly is that the first thing is what we call like a leading or following. There's an interesting correlation company happening in the US survey where we found that 70% of respondents noted that the head of IT is a member of the senior management team. That's a really interesting statistic, but I think it increased to 80% where enterprises had an IT, where IT had a very proactive role, proactive role. I think that's an interesting concept we need to understand, and I think we're thinking of many of the security professionals here, where we understand the security is part of the end-to-end business process, not part of just IT.
And instead of doing that, we can ensure that we understand the value that security can add through the whole value chain. The other aspect I just wanted to quickly touch on is social networking. Now, social networking by the respondents was not probably priced in terms of Facebook and Twitter. You know, we're a lot of security professionals.
I have identified that the benefits of employees using social networking outweigh the risks. That said, organisations might be farmers asking exceptional value in using the social media. Well, very interesting findings, Robert, based on those, what are some of the recommendations you have? There's a number of recommendations, and I think they go into a few areas that we want to look at.
And the first area of recommendations is really, I think, understand the value that security offers to the organisation. You know, one of the parallels that I often use is that security needs to be a positive word, not a negative word in the organisation. So we really need to ensure that security adds value to the organisation by understanding where the appropriate components in place, where to identify the risks, and where not to cry wolf. And I think that's a really interesting parallel.
We've all heard the stories a little boy who cried wolf, and a little girl who cried wolf, and the child called wolf so many times that when the wolf was really at the door, nobody listened. And I think that's one of the areas that we really need to focus on in terms of the security aspects going forward. The second issue is understanding the value. You've got to really understand the value of security.
You've got to communicate it in terms of business value, not just saving money or not just losing money, but also how you add value in terms of the organisation growing and moving forward. So I think the next aspect into drive value is to be proactive. We need to leverage the governance mechanisms in our organisation to be proactive. We need to ensure that IT has a proactive role in the organisation.
One of the concepts there is instead of IT just listening to the business requirements and just going by way and then delivering it in some sort of black box, there needs to be a clear relationship between the IT membership and the executive leadership, a clear relationship between the organisation's business values and strategy. And I think security professionals can really address that by getting deeply involved in end delivery of service and understanding the business value and then understanding how to drive that forward. The second thing is helping enterprises address the current issues. Now once you've got the close relationship with the business, you can then focus on the key aspects of the business and the key considerations.
Most IT professionals know the security professionals know the key things. In an economic downturn, which you've just been through, you're going to do things like reduce the number of staff, remove number of consultants and things like that. Security professionals are very good at ensuring that things like access is removed, that we've got our systems in place. Right back up some restoration, staff aren't leading with appropriate data.
But I think the value for security professionals is really to grow beyond that and really add value in areas where they can add significant impact, such as ensuring that the delivery of service and the right partners are used for service. So one of the aspects that I can put on there are things like cloud computing. Cloud computing coming forward is going to really drive value and drive opportunity. And what needs to happen with security professionals is we need to work, that is cloud providers we may or may not use, into the system of security that we have, so that our security requirements for the organisation to protect our data, our people, our investments and privacy are maintained.
The third thing is going back to the first thing really, supporting the organisation's business strategy. And that I think is a great guide to security professionals. Once we understand the strategy, we know where to support it, we know where to put our resources, we know where to put our people and help them and have them drive value moving forward. You know, a lot of work there, a lot of opportunities.
But for security professionals, I believe what we've found is the track that they're on typically is the right track and we need to keep moving forward. And of course at the same time ensure that we understand the variables in the economy, the variables in our business, the changes in strategy, and adjust a tweak where we go with security at the same time. However, let's leverage some of your global perspective. As you look at some of the key trends that interest you the most, how do these governance trends differ, if at all, in the various global regions?
Yeah, so governance trends differ, you know, in companies with large compliance, legislation for instance, we see a strong focus on complying with the law, putting the rules in place to meet those requirements. But one of the clear aspects for security considerations globally right now is privacy, you know, personal information. What do we do with that? How do we secure that?
How do we manage that? How do you understand the persona of, you know, Robert Stroud, for instance, and ensure that he is adequately protected and his personal information managed across a global scale? Interesting conundrum for us at the moment, because we've become totally transparent so you can find anything anywhere, and social media has accelerated that. So in terms of this aspect of the security professional's role, you see very strong protection of private and personal information happening in Europe, for instance, right now.
Where that information is strongly guarded, strongly protected, and certainly strongly managed. You know, and you'll go to other countries in the world, but that's not so such a high topic. The second aspect is in terms of investment and value. You know, organisations that are in the growth economy now and growth markets are looking for business value and business opportunity.
So while they're doing that, they may be prepared to accept some level of risk as they grow that business and evaluate the opportunity before it becomes mainstream and comes under control. The third aspect of governance that's changing global is the adoption and use of cloud computing. That introduces its own security issues which have been well communicated and talked about, and you know, just a simple aspect of that is data privacy laws. The security professional must be aware of what those data privacy laws are, so they can guide their organisation.
So for instance, you may be in Europe once again, which has strong laws in terms of data privacy, data storage, and where that data is stored. So the adoption of cloud computing, although inevitable, I believe, from many businesses and many organisations, may be changed in terms of the evaluation process of cloud providers in that region of geography. And I think as you look at those aspects of the governance professional or the industry professional, we have so much that we need to be cognizant of. But once again, to go from geography, to geography, that will change.
So, you know, one of the things I've clearly seen is back in North America, where of course I live and breed and work, is that you can see in terms of the governance and governance processes mandated by the health industry and the finance industry are getting tighter and tighter and stronger. Whereas another industry may be looser and not so tight, and then even those requirements will vary by geography. And I think that's an interesting aspect that we need to be aware of, especially in this global economy where the barriers and the walls of geography have been reduced. The internet has taken a trip on plane, might take 24 hours, and taken it to 2.4 milliseconds.
Therefore, we need to be cognizant of these aspects and work it into our plan. You know, I remember the elder analogy, you know, measured twice, cut once. And I clearly believe that as we move forward, we're going to have to consider that in terms of how we deliver value, only to ensure equality and consistency of service as to deliver IT services that we may not have done so in the past. Rob, but a few minutes ago, use the term risk.
In terms of governance of enterprise IT, what are the key areas of risk that information security leaders need to be most mindful of today? Yes, so risk is a great topic, and it's a great component of the security professionals role. So the first aspect of risk is that we are seeing risk move or now be assumed by IT that formerly was managed by the business. So what do I mean by that?
In the past, risk was totally managed by the business, the business could understand the business process, understand where the risk was, make risk decisions, then direct IT into delivery of systems. And typically the risk reporting was still held within the business. Today, more and more, we are seeing decisions and systems delivered faster, quicker. A business process enabled through IT, not just within IT, but through partners and various delivery mechanisms.
So one of the aspects of risk that I've seen is that they need to really understand the business risk now, the business implications. It's not just about, you know, the ability to deliver the disaster recovery, so the system falls over. It's more than that now. If the risk of personal information being compromised, the risk of where our data is stored and how it's stored, is it effectively backed up?
Are we storing data for the right period of time? As you can see here, I'm using the word data or information a lot. That hasn't changed in my time in the industry. But I think what has changed is the time we have to make decisions, is compressing dramatically.
Therefore, the key elements of risk that an IT organisation needs to understand. We need to understand where the compliance risk is and where it's mandatory versus optional. They need to understand what the business continuity risk is in terms of delivery of systems. How long can we survive without delivery of systems?
If it's a, you know, do we accept the risk? Because we're 99.5% reliable, that we can actually live with a 0.5% outage level. We want direct people to invest in business continuity, which is not always a good idea. Other aspects of risk of the people we have, which is the risk we've always had.
And then the new element of risk is our expanded network. The network that we're going to have now is we extend into using multiple out sources, whether we use multiple cloud providers, whether we use multiple components in a value chain to deliver the service. The one quick parallel I'll give you where we're going is if you look at the manufacturing industry. In the past, we manufactured, we, many organisations, actually developed from the raw materials, you get right to risk the finished product.
That actually may be processed the raw materials, set it into the components required, assembled the components required and delivered the product. IT used to be like that. Today, we're morphing with changing. We're moving into an area where we are actually assembling the finished product and the components are coming from a multitude of sources.
That introduces the supply chain risk, a risk that we may not have had in the past. We actually need to understand what the aspects of the supply chain are, how we group those components together, how we ensure that those components are being delivered at the right time, in the right way, at the right fashion. We need to ensure the quality of those components. We need to ensure that we're paying for the correct cost.
These are all governance functions that we have. The manufacturing industry has mastered this, but even the manufacturing industry can't allow for the events in Japan of late, where that causes the supply chain to be broken by natural disaster. You can't de-risk everything, but you can de-risk the majority of circumstances that you will see in normal operations. One of the things manufacturers do today, what do manufacturers do today if they make a two supplier apart?
We're going to have to start considering that in IT. Are we going to need multiple supplies to be able to switch or throttle up or throttle back? These are all governance questions. These are all risk questions as well.
Do we trust the supply? Can we ensure that they will deliver? Are they delivering on time? Are they looking after our personal information?
I think it's a great opportunity for IT. It's an exciting time. It's an exciting time for a risk for a security professional. Because as the very existence of being in nature of IT changes, it's going to open up a lot of new opportunities.
And we've certainly seen that within IFA right now, as we've seen the number of security and risk professionals, who are in our association grow dramatically. And they are looking for similar guidance and discussion as we've just talked about. Well, Robert, that segues nicely into my final question, which is four of these professionals that want to get into the field today or make a switch while they're in the field, and they want to get into governance. What's your advice to them to be successful when either starting or restarting a career here?
Yeah, look, I've reached out of my career or changed tracks multiple times, and each time it's been more rewarding than the time before. Professionals moving into risk or governance, there's a couple of interesting opportunities to open to. Number one, the IFACO and the IT Governance Institute, we offer a network of industry professionals, like-minded industry professionals, local meetings, local chapter meetings in your area. You can also go to the website, www.isaka.org, and of course have a look at where your local chapters and how to get involved.
In doing that, one of the things I strongly recommend is read some of the freely available or easily available documents we have on our website, associate with members, and then of course take the opportunity to look at education and certification in the areas of risk and governance, which IFA and other organisations offer, of course. But I think as you go through this task, you're going to look through education and training that drive you through and help you understand that it's a couple of quick tips, so anybody in the governance area. Number one is realise that you're going to be learning business language. IT language is great and it's important to enroll, which you're going to start to need to be able to walk a mile in the shoes of the business.
So you're going to start to need to understand the terms they use, the issues that are important to them, the opportunities are important to them. Number two, you'll need to get training and certification. We certainly understood our recent certification, which we call Seagate, certified governance and enterprise information technology, is one step in that way. You can gain that certification without exams twice a year, and that requires practical experience in the domain as well before you can get that certification.
We also offer a seagrass certification as well, so that if you're a risk professional, you can gain that certification and ensure that you continue education, so that you are considered and recognised as an industry professional. And more importantly than that, I think you need to look at the opportunities that are in the marketplace. Obviously risk professionals are extending or seeing a lot of opportunities there, but my friends who are IT audited and moved into risk, while my friends who are security professionals, have moved into that area as well. A lot of information out there.
Best place to start, of course, is our website, which I mentioned before. Robert Rico has been excellent insight on a very keen topic to appreciate your time and your thoughts. Thank you very much, and it's great to speak to you and the listeners again. We've been talking about governance of Enterprise IT.
We've been talking with Robert Stroud, International Vice President of Osaka and the IT Governance Institute. For Information Security Media Group, I'm Tom Field. Thank you very much.