Intel Analysis: Executive Risk Fusion Center...

How often do you try and prove that a risk hypothesis is true? Is it possible that each piece of evidence that you collect or information you process is utilized to try and prove that your hypothesis is correct.

Analysis of executive Operational Risk Intelligence in your corporation is typically being processed within the organizational silos of your enterprise business units. How it is being shared, how often and then how it is being analyzed, compared and used to confirm or refute multiple hypotheses, can make the difference in your corporate business survival.

The ACH methodology developed by Richards J. Heuer, Jr., is a vital component of Operational Risk Management (ORM).  It can be utilized with your internal Executive "Risk Fusion" Center where the Board of Directors, Senior Management and corporate risk directors determine the correct strategic course for the future:

Analysis of Competing Hypotheses (ACH) is a simple model for how to think about a complex problem. It is an analytic process that identifies a complete set of alternative hypotheses, systematically evaluates data that is consistent and inconsistent with each hypothesis, and rejects hypotheses that contain too much inconsistent data. ACH takes you through a process for making well-reasoned, analytical judgments. It is particularly useful for issues that require a careful weighing of alternative explanations of what has happened or is happening. ACH can also be used to provide early warning or help you evaluate alternative scenarios of what might happen in the future. ACH helps you overcome, or at least minimize, some of the cognitive limitations that make prescient intelligence analysis so difficult; it helps clarify why analysts are talking past one another and do not understand each other’s interpretation of the data. ACH is grounded in basic insights from cognitive psychology, decision analysis, and the scientific method.

What is the likelihood that the General Manager, Global Security of your enterprise is looking at surveillance information on a rogue employee today to assess workplace threat and to help keep the company safe? Simultaneously, the Chief Information Security Officer (CISO) is analyzing the latest log data from various intrusion systems to determine if the "Advanced Persistent Threat" (APT) has changed it's cyber tactics to steal the latest software R&D architecture from the office suite business unit. The Chief Financial Officer (CFO) and Head of Internal Audit are analyzing the latest revenue reports with the Vice-President of Sales & Marketing to determine why the Asia Pacific team have been losing 8 out of 10 business deals in the forecast pipeline.

The likelihood is high. Each is formulating a hypothesis independently of each other and in most cases they will never know that there is a risk related nexus to the entire enterprise. The reason is that your Executive "Risk Fusion" Center does not exist or is unable to analyze competing questions that are being asked about potential areas of concern. So when do you use this approach and the ACH methodology?

Use ACH when the judgment or decision is so important that you can't afford to be wrong. Use it to record and organize relevant evidence prior to making an analytical judgment or decision. Use it to identify and then question assumptions that may be driving your thinking, perhaps without realizing it. Use it when the evidence you are working with may be influenced by denial and deception. Use it when gut feelings are not good enough, and you need a more systematic approach that raises questions you had not thought of. Use it to prevent being surprised by an unforeseen outcome. Use it when an issue is particularly controversial and you want to highlight the precise sources of disagreement. Use it to maintain a record of how and why you reached your conclusion.

The human mind needs modern software analytics, proven cognitive tools and vetted processes of thinking to arrive at the answer. While the answer may not be what you seek, it is the answer to the question, without a doubt. Live with it or discard it. This does not matter.

What does matter is that the Executive "Risk Fusion" Center brought together the best of all these operational risk components and whether the human chooses to accept it or ignore it could be our corporate prosperity or peril. What do you think AI?

Proactive Measures: Beyond the Perimeter...

Operational Risk Management requires both proactive and passive measures that encompass a comprehensive organizational strategy. Odds are that you have devoted a majority of your time and resources to this point on the passive mode of preparedness and defense. A reactive and alert oriented focus. The time has come to change the priorities and to increase the allocation of strategy on the "Active Measures." Why?

Stuxnet is and was ground zero for a new generation of digital infrastructure cyber weapons.

The attribution game is still going on with several suspects on who actually developed, tested and deployed "Stuxnet." This is not as important as the realization that sitting back and waiting for the next variant or hybrid cyber weapon to attack your critical infrastructure assets in passive mode.

"The most advanced organizations are now taking the "Proactive" stance to not only detect changes in their environment in a more real-time mode, but they are starting to hunt down the attackers."

There is a decision point where you realize that the passive mode will not buy you time nor will it redirect your attackers to other more vulnerable assets. Your organization will continue to operate with the goal of serving your clients, members or customers yet simultaneously a "SpecOPS" team of internal experts will be monitoring, measuring and exercising tactics to legally neutralize the threat before them.

Commercial and non-governmental entities are creating the means and the capabilities to deter, detect and document who is attacking their digital systems and where they can be found. This intelligence is being shared within the private sector organizations to determine fingerprints, modus operandi and other evidence that is required to effectively hunt down the attackers. The next challenge will be how to package this and make sure that the proper authorities are notified in a timely manner.

There is no longer a solution that is wide enough or in depth enough to be distributed across a whole spectrum of companies or organizations. The answers will be specific, customized to the unique environment and infrastructure that comprises a particular enterprise.

In order for that specification to be developed internally and provided to the correct people, you have to have the internal mechanisms in place to know in real-time what is changing and how fast it is changing from the normal state.

Is your view beyond your own perimeter? Are you looking for the anomalies that are over the horizon and could impact your network soon? It's one thing to look at the changes to your own perimeter but what about the intelligence on providers and ISP's somewhere on the other side of the planet? Do you know where your packets are going and how they are being routed?

"In a savvy Operational Risk Management enterprise, the "Corporate Intelligence Unit” (CIU) is alive and thriving."

A proactive intelligence-led investigation doesn't begin with a phone call from someone who say's, "My system is down" or "What does this Blue Screen mean”?

It doesn't start when your VP, Research & Development suddenly leaves the company for no apparent reason. Intelligence-led operations will continue to be the aspiration of many, yet only possessed by a few.

OSINT 2: When is it Time?

Wonder why some companies don't have a more proactive OSINT (Open Source Intelligence) operation inside their own institution, looking at and analyzing potential “Threat Intel” across their global domains?

While there are very expensive services that can package up exactly what you are looking for, sometimes it just takes a little more time and the right “Sources."

You could get a service at x-iDefense or even a more wide range of collection capabilities from the likes of x-Cyveillance to assist the in-house OSINT operation.

Throw in some Stratfor, OSAC and one or more variations of Symantec or Qualys or Seerist and you have it mostly covered. Except for one thing.

Plenty of "Gray Matter.”  How many qualified analysts do you have on your team?

We might agree that there is more information out there than anyone could possibly imagine accessible with a few clicks and keystrokes.

Yet the easy part is the collection and the filtering or storage. Making any sense of it all with the relevance you seek is the "Holy Grail" for you, today.

Yet that might change tomorrow.

It's the consistent development of a new hypothesis and testing it that determines who will get the next new piece of information ready for OSINT.

And still the question remains. Will this be better kept a secret, or out in the “Wild"?

The argument usually isn't whether the results of the test should be published, it's more about when to publish.

Open Source Intelligence is going to be around for some time to come. The tools are getting even better to find and process massive volumes of information.

Think AI.  Think GPU.

The only real impediment will continue to be those who want to wait and hold on to it, a little longer…

Trusted Horizon: "Augmented Intelligence"...

When you read that critical powerpoint report last week at work, did you trust what the author had written?

How did you make the decision to trust the numbers that the author placed in the columns and rows chart on page 3?

Did you trust the author and source because of their previous track record of accuracy?

Did the numbers come from a sensor that has been tested in an independent lab to a 99% level of truth?

You trusted that report at work for a reason. It was a “Trust Decision”.

Why?

Have you personally tested the math? What is the source of the data?

So why do you trust Apple vs. Samsung? Verizon vs. AT&T?

Would you pay $100 for a machine that was 99% accurate or could you live with a machine that was 50% accurate and only cost $50?

Think about your mobile navigation mapping app. Where are you going?

These kind of discussions are fundamental yet necessary for us at this point in our digital innovation journey. Just as humans have since the inventions of the Personal Computer, Internet and Quantum Computing.

Trust Decisions are mathematical.

mathematical

adjective

1: of, relating to, or according with mathematics

2 a: rigorously exact : PRECISE

b: CERTAIN

3: possible but highly improbable

We have been trusting computers, data and all kinds of sensors as a result of established testing standards. You name it. ATM’s. Stock Markets. Airplanes. Rockets.  Satellites.

Today, would you trust the answer of any question asked to your favorite Large Language Model (LLM)?

LLM’s will challenge your future digital “Trust Decisions” because you might decide whether you believe Chat-Brand A vs. Bard-Brand B vs. Claude-Brand C.

No different than your preference today on using Google search or Bing.

Are human lives at stake? How will we ensure the trust of our digital machines? 

Into the future, our ability to produce high accuracy “Trust Decisions” will depend on your own “Augmented Intelligence” (Ai)...

Mosaic: Launching New Solution Navigators…

There are countless people and organizations who are articulating the problems that exist in your agency, your business or your non-profit.

Some international entrepreneurs are assisting those who have not developed their own concept selection and development team with solving the identified and validated problems.

The challenge in most entities has been enough resources and the correct people dedicated to defining the problem-sets and then applying a proven methodology for creating a solution space with a mission to deliver potential prototypes for testing.

How fast does your organization move from “Problem Definitions” to “Deliverable Solutions” ?

Well that is going to depend on what business or industry you are competing in across your geographic area. Are you in a small business? A regional enterprise. The national leader in ordering stuff online made by someone else and then delivering it to your customers household doorsteps?

Or are you in a services institution that invents and delivers new process designs. New intellectual capital. New creative ideas. New real-time OSINT information.

Moving from a past historical era where “Problem-space to “Solution-space” may take years, now our 2022 world is witnessing this time line whittled down to days, hours or even seconds.

In our current digital environment, utilizing Quantum capabilities, the problem may be solved in a minute or a second or two.

If you are trying to launch the next space craft to the Moon or Mars or beyond, it could take longer.

Yet what does all of this focus on true innovation really mean to “John Q. Citizen”?

So what?

Do you remember the first time you used Mosaic? What about the Netscape Navigator?

If you do remember, then you have a substantial set of real context on the topic of and history of creative innovation. Solving real-problems.

You actually understand and witnessed the speed at which people are capable of creating “New”.

Defining problem-sets to creating new solution-sets was a daily process for all of those "Digital Navigators" with electronic keyboards and modems in the early 1990’s.

Utilizing our Earths new World Wide Web technologies and capabilities, provided so many with the ability to explore, experiment and test, then to deliver new product solutions for those who did not even know they had a problem yet.

For those so interested in the future of our world and so eager to be innovators in 2022, sometimes you just have to study the past for a lesson. Maybe even read up on Mosaic on Wikipedia.

This journey has been epic. Now get out there and “Do” what you have a passion for and that will make a difference on this rock!

R3: Team Leaders On The Front Lines…

Now that you and your team have finished the mission strategy planning for 2022, how might you simplify this for those on the front line who work outside the building?

When you really understand what the product/solution does and you truly believe the benefit of someone using it, now what?

Your team may know the strategy and the “Why now”, yet will you still be wondering where all of the budget allocations have gone, after the first six months of your budget cycle?

What if you focused on a small part of your team, who you might name your company “Operators”. 

You know, the people who are eager to get out the door everyday to go see and solve problems for themselves. The people that will be responsible for the implementation of the product, the tool, and the solution on the customers premises in their environment.

"The team of “Operators” in your organization who are actually accountable for the final results."

Hopefully your organization has at least a 3:1 ratio of “Operators” to “Bean Counters”.

3-Operators to 1-Bean Counter, just might give you a chance of making your mission strategy work.

In our global world of business these days, the relationships are your Ground Zero.

Without effective relationships that exist and are continuously building rapidly across your intended target zones, you will have a much longer wait for your positive and smiley face of EBITDA.

Developing and growing “Relationships” is perhaps one of your greatest Operational Risks ahead of you, as the Leader of your particular team.

Having learned a simple yet “Never Forget” acronym from a few very wise business instructors (Randy & Wendy) many years ago, consider this:

R3 = Relationships >>> Results >>> Revenue.

Guess what? It is something the “Operators” will actually understand and since you have 3 times more of these people on your front line team, they must have their own business strategy acronym that they will be able to remember and execute on:

1. Operators that are developing meaningful and effective Relationships are your way to mission accomplishment.
   
2. Operators who realize how to produce tangible Results that can be measured are your way to mission accomplishment with end users, customers and clients.
3. Operators will see Revenue if #1 and #2 are successful.

R3 is your execution layer on top of the “Bean Counters” PEST, STEER, SWOT or any other planning acronym they might use in the “God Pod” upstairs or down a long corridor of the outside view offices in the E-ring.

In order for you as the field Team Leader, to truly better understand how to improve the “Revenue” and mitigate the Operational Risks in your business entity, you have got to get out on the front lines with your Operators.

To see and experience the real “Relationships” and the actual “Results”.

Where will your next “Senior Leader” tour of duty take you in the field of your Area of Responsibility (AOR)…

Analytical Decisions: Navigating to a Trusted Future...

"For those of us who are decision makers, these are huge problems. With growing velocity, we are losing our ability to trust digital information to be factual, accurate, reliable, and authentic. But we also are losing something far more important—trust in the quality of our own decisions and our confidence in those we trust to make good decisions"  Jeffrey Ritter-Achieving Digital Trust

Think about all the Trust Decisions that you made this morning.  This week.  This month.

Countless decisions to act upon your experience, your current information or the live scenario unfolding almost instantly in front of you.  "Trust Decisions".

Is this a discipline or process that you can truly learn and improve upon?  The question is, do you think it is important enough to learn more and to devote precious time to making this a priority in your life?

Where are you in your particular "Life Cycle" right now?  At the beginning, near the end or somewhere in between?  Yet it is never to early, to study and learn more about the science of Trust.

SpaceX is looking to raise around $250 million in new funding according to a new report from CNBC’s Michael Sheetz. The additional cash would bring SpaceX’s total valuation to around $36 billion, according to CNBC’s sources — an increase of more than $2.5 billion versus its most recently reported valuation.

The rocket launch company founded and run by Elon Musk is no stranger to raising large sums of money — it added $1.33 billion during 2019 (from three separate rounds). In total, the company has raised more than $3 billion in funding to date — but the scale of its ambitions provides a clear explanation of why the company has sought so much capital.

Building trust with a new person, new organization, new project, new government or new ecosystem requires a sound and thoughtful strategy.  A strategic approach to reaching your vision, completing the transaction and achieving your outcome.

Trust is the affirmative output of a disciplined, analytical decision process that measures and scores the suitability of the next actions taken by you, your team, your business, or your community. Page 49 - Achieving Digital Trust - Jeffrey Ritter

Godspeed on your particular TrustDecisions ahead.  Onward!

Trust Decisions: Never Stop Questioning...

"Learn from yesterday, live for today, hope for tomorrow.  The important thing is not to stop questioning."  --Albert Einstein

What sources are influencing your "Trust Decisions" today?

The front page of the "Washington Post."  The e-mail from a parent.  The text message from a loved one.  A phone call from your commander or a work supervisor.

What does your future look like next week?  Next month.  Or next year.  You might think you have it all planned out and on your calendar.  Or maybe you have not even thought about it yet.

Which person are you?

One certainty is, that you will experience the unexpected and you will simultaneously be required to adapt, to adjust and to be agile, in order to respond to the changes in your day, your plan and in your life.

As a true leader in your business, in your agency, in your tribe or in your family, is there anyone you know, that asks questions all the time?  Here is a question.  Why does this bother you?

How will you achieve your latest objectives?  Most likely because you have a continuous passion for asking questions.  Then you truly listen.  You take the time to think.  You now make your "Trust Decisions" to act.

Albert Einstein was correct...

Transparency: "Square One" in ORM...

Operational Risk Management (ORM) has been evolving for over a decade. There are new insights into why effective business process management coupled with Operational Risk architecture makes sense, through the lens of the Board of Directors. Transparency.

Still to this day, the questions remain:

• What can my organization do about the risk of loss resulting from inadequate processes, people, or systems?
• To what extent should my organization link employee compensation or job performance with operational risk management?
• How is operational risk taken into consideration when new products or technology solutions are designed or acquired, deployed, and executed?
• Does my organization have an inventory of its key business processes with documented controls and designated senior managers responsible?

Can these questions be answered in a book of 308 pages from 2008? It was a good start, to say the least. The authors understood, that to really embed a culture of (ORM) into the enterprise, you have to begin at the architecture level, the business process level.

This is far in advance of the governance of information and the business rules coded into software systems, even for such mundane corporate tasks as expense report or travel request review and sign-off.

You see, some companies still think that they are just doing fine with their Safety and Security Team, Continuity of Operations and Crisis Team, Chief Information Officer (CIO), General Counsel (GC), Chief Financial Officer (CFO) and in limited cases the Travel Risk Management department all working autonomously. They think that having a few dedicated investigators to look into corporate malfeasance, is all they require in a corporate population of tens of thousands.

What do we mean by autonomous? Not what you may think. There is no doubt that the leaders of these organizational departments are cooperating and coordinating functionally. They have each other on speed dial. They share high level red alert Intel with each other.

The question is, what is being done at the metadata level of the Operational Risk Enterprise Architecture (OREA)?

How are they designing Operational Risk Management systems to answer key questions at the speed of business? To continuously adapt to an organization’s changing global environment, executives must know about, keep in balance, and communicate several vital components:

• What are the organizational strategies (Strategic Intent) and how these should be implemented (Strategy Development and Organizational Change)
• What organizational processes are executed and why, how they are integrated, and how they contribute to the strategy of the organization (Business Process Management)
• How human resource utilization is working and whether there is optimum use of skills and resources available across processes and functions (Human Resource Management)
• To what extent the enterprise organizational chart is cognizant of appropriate roles and responsibilities, in order to effectively and efficiently carry out all work (Organization Management)
• What IT applications exist and how they interface with what processes and functions they support (IT Portfolio Management)
• How the performance of each process, each function and each individual adds up to the organization’s performance (Performance Management)
• What projects are currently underway, how they effect and impact change, what processes and IT applications they change and how this contributes to the strategy of the organization (Project & Program Management) 

Is Operational Risk Management (ORM) about "Big Data Analytics"?

Only if your organization values better transparency, governance and regulatory compliance. Ask the Board of Directors their answer on this question to determine whether ORM is a "Big Data Analytics" issue. How big is big?

The momentum for transparency is now at the U.S. government level of commitment.   It is the law. Big Data Analytics will mean nothing, without increased transparency. Now we can ask the questions that we all want answers to.

The Operational Risk Management (ORM) architecture of your enterprise will now begin with transparency, as the fundamental "Square One".

Future Risk: Resilience and Competitiveness...

The U.S. Department of Defense (DoD) is in the middle of substantial Operational Risk Management discussions behind closed doors, in light of new threats and new priorities. The majority of the Intelligence Community budgets are under the DoD umbrella and in a new world order, subjected to the mobile ICT revolution that is erupting before us. Does Twitter and other social media tools present the need for a new paradigm shift in the future evolution of the Intelligence Community (IC)? Consider this flashback analysis:

Abstract
"This paper analyzes the role of situational information as an antecedent of terrorists’ opportunistic decision making in the volatile and extreme environment of the Mumbai terrorist attack. We especially focus on how Mumbai terrorists monitored and utilized situational information to mount attacks against civilians. Situational information which was broadcast through live media and Twitter contributed to the terrorists’ decision making process and, as a result, increased the effectiveness of hand-held weapons to accomplish their terrorist goal. By utilizing a framework drawn from Situation Awareness (SA) theory, this paper aims to (1) analyze the content of Twitter postings of the Mumbai terror incident, (2) expose the vulnerabilities of Twitter as a participatory emergency reporting system in the terrorism context, and (3), based on the content analysis of Twitter postings, we suggest a conceptual framework for analyzing information control in the context of terrorism."

The Mumbai attackers could have used open source social media even more to their advantage and this is what the Intelligence Community (IC) continues to leverage as the Arab Spring(s) continue, civil war escalates in Syria and other ICT-enabled regions of conflict emerge. The tools are becoming more optimized to the kinds of applications necessary to deal with these new Operational Risks. What may continue to be the greatest vulnerability, is the economics. The ability to invest in and provide training for the new generation of cyber warriors and HUMINT collectors. Are the Trusted Systems and Networks in place integrated with the latest Commercial-Off-The-Shelf (COTS) software riding on encrypted networks?

The convergence of mobile, cloud and big data is the single IT transformation issue in governments and the private sector. The IC and DoD realize that the only way to survive and to be more resilient, is to close or converge data centers with legacy hardware and software. Simultaneously accelerating the onboarding to private sector assets, that have also been certified and accredited. The next vulnerability being discussed, is how to acquire enough of the existing energy grid to support the requirements for cooling the vast data centers under construction and getting access to dark fibre. Bluffdale has been just one example:

"Inside, the facility will consist of four 25,000-square-foot halls filled with servers, complete with raised floor space for cables and storage. In addition, there will be more than 900,000 square feet for technical support and administration. The entire site will be self-sustaining, with fuel tanks large enough to power the backup generators for three days in an emergency, water storage with the capability of pumping 1.7 million gallons of liquid per day, as well as a sewage system and massive air-conditioning system to keep all those servers cool. Electricity will come from the center’s own substation built by Rocky Mountain Power to satisfy the 65-megawatt power demand. Such a mammoth amount of energy comes with a mammoth price tag—about $40 million a year, according to one estimate."

This is the kind of capability that will remain exempt from the threat of limited funding or future austerity in the new world order of mobile, cloud and big data. The introduction of tools or services such as Silent Circle, Wickr, Signal and others will only add to the Operational Risk challenges of the next decade. Privacy will become a sought after luxury, only available to those with the means or the latest set of consumer-based communications tools. Either way, the senior executives of private sector critical infrastructure companies are under the spot light. They own the majority of the ICT assets and therefore have the most to win. Unfortunately, they also have the most to lose.

The future of the DoD and the IC will be determined by the success or failure of the cooperation, coordination and collaboration of men and women with a unity of purpose. Patriots who will continue to do the right things for the right reasons. The future is now about resilience and competitiveness. Lets get to work!

Intelligence-led Enterprise: CIU Success Factors...

Intelligence-led processes applied within the corporate global enterprise, continues its relevance for reasons being published in the popular press. "Operational Risk Management (ORM) Specialists" utilize these processes, to mitigate a growing spectrum of domestic and transnational threats:

•  How Hackers Make Money from DDOS Attacks
• China’s plan to organize its society relies on ‘big data’ to rate everyone 
• Government alleges former NSA contractor stole ‘astonishing quantity’ of classified data over 20 years
• Banks preparing to leave UK over Brexit, says banking body chief executive

Developing relevant intelligence to run daily business decisions in your institution may seem like an important task day to day. The question is, how embedded is the "Corporate Intelligence Unit" in developing the relevant intelligence your decision makers need every few minutes or hours to steer the organization away from significant losses? Is your internal web-enabled "Corporate Daily News" or "ABC Company Post" being updated in real-time by the employees in each department or business unit?

Do you have an organized, synchronized media and communications function working within your Corporate Intelligence Unit (CIU), to continuously post the correct content and manage the RSS feeds from each global business unit? Why not?

The "Information Operations" (IO) of your company are the lifeblood of how your employees will make relevant decisions on where to steer clear of significant risk.  Based upon what other business units are doing or what is going on in the external environment of your state, sector or geography, consider these scenarios:

If the internal RSS Feed for the IT department reported that there was a Distributed Denial of Service  (DDos) Attack going on at the moment, how might that impact the decision by the marketing department to delay the posting of the new product release information to the Twitter site? The synchronization of intelligence-led processes is lead by the head of the Corporate Intelligence Unit. The CIU is staffed with people who have a tremendous understanding of the corporate enterprise architecture and have the skills and talents to operate as effective operational risk management professionals.

If the internal RSS Feed for the Facilities Security department reported the presence of a "White Truck Van" with blacked-out windows trolling the perimeter of the corporate parking lot, how might this change the decision for the CEO to leave that minute for her scheduled trip to the airport? Skilled CIU staff within would quickly notify the CEO via the "Corporate 9-1-1 Alert" App embedded in every employees iPhone. Under cover corporate security personnel would then be immediately approaching the vehicle for a recon drive by.

If the internal RSS Feed reported the recent change in industry legislation that would change the way the Federal Trade Commission defined the elements regarding consumer privacy, how might this affect the latest strategy on how the institution was going to encrypt it's data in servers and on laptops? The CIU staff would advise the Chief Information Officer and other Information Security Risk staff to step up the roll-out for the latest version of PGP for the enterprise.

And the list goes on. The modern day intelligence-led Corporate Intelligence Unit (CIU), in concert with other highly specialized Operational Risk Management professionals in the enterprise can keep you safe, secure and keenly aware of new threats to your corporate assets. The degree to which you provide the right resources, funding and continuous testing/exercising of your capabilities will determine your likelihood for loss outcomes.

If your organization has been impacted by loss outcomes that continuously put your employees, stakeholders or assets at risk, then look hard and deep at your "Operational Risk" quotient, to determine if you are the best you can be...

Know Your Customer: ISP Future Horizon...

The American public is changing their behavior as a result of the privacy and security failures across the private sector business policy landscape.  As the latest NTIA survey data reveals again, online commerce is being impacted and government agencies are now trying to further communicate there is a growing problem:

Lack of Trust in Internet Privacy and Security May Deter Economic and Other Online Activities
May 13, 2016 by Rafi Goldberg, Policy Analyst, Office of Policy Analysis and Development

Every day, billions of people around the world use the Internet to share ideas, conduct financial transactions, and keep in touch with family, friends, and colleagues. Users send and store personal medical data, business communications, and even intimate conversations over this global network. But for the Internet to grow and thrive, users must continue to trust that their personal information will be secure and their privacy protected.

NTIA’s analysis of recent data shows that Americans are increasingly concerned about online security and privacy at a time when data breaches, cybersecurity incidents, and controversies over the privacy of online services have become more prominent. These concerns are prompting some Americans to limit their online activity, according to data collected for NTIA [1] in July 2015 by the U.S. Census Bureau. This survey included several privacy and security questions, which were asked of more than 41,000 households that reported having at least one Internet user.

Perhaps the most direct threat to maintaining consumer trust is negative personal experience. Nineteen percent of Internet-using households—representing nearly 19 million households—reported that they had been affected by an online security breach, identity theft, or similar malicious activity during the 12 months prior to the July 2015 survey. Security breaches appear to be more common among the most intensive Internet-using households.

This survey is indeed only one facet of a much larger topic and pervasive problem.  Digital Trust is the output of making affirmative "Trust Decisions" with computing devices. Whether they are machine-to-machine, person-to-machine, or machine-to-person requires several technology engineering elements and business rules, that are understood and agreed upon.  The question is by whom?

Consumers who are using the Internet for communications and commerce and are the victims of Identity theft, stolen funds or other fraudulent schemes, are just the first wave of targets for transnational organized crime (TOC).  We have known this since the invention of virus scanners and bug bounty programs, in the early days of the 21st century.

Yet fifteen plus years later, the government is doing a study on the consumers feelings about privacy and security.  As a business or a consumer, we understand that the speed of commerce and technology is always far ahead of the regulations and the laws.  When enough people or businesses seem to be harmed, then the momentum begins for policy shifts and new laws are sometimes enacted after thousands of pages of semantic negotiation.

The answers and the outcomes we seek will come.  However, they will not first be solved by politicians and lawyers.  They will be mostly solved by our brilliant mathematicians, software engineers and data scientists.  At this point in time, we are getting so much closer to achieving digital trust through new innovations and inventions.  Just look at IBM Watson.

It is now time for business and commerce to begin the process of finding the truth.  Why do we continue to allow the levels of known bad actors to operate inside and within our networks?  It's a numbers game and it is because the criminals also employ the smartest social engineers and data scientists.

Digital Trust in the next fifteen years will mean something different than it does today.  We will have found the formula along the journey, the new equations and the rules agreed upon by all to make online and digital commerce more safe and secure.  So what will we do today and tomorrow, until the engineers and scientists save the day?

At this point in time, it is simply called "Know-Your-Customer"(KYC).  If this was utilized more effectively across critical infrastructure sectors beyond finance in our digital economy, then we would be making some progress.  Where are we talking about next? 

The FTC and FCC are well on their path to defining those critical elements of improving the trust that consumers have using their digital tools with ICT and on service providers web sites.  Yet even to this day, you still can find the criminals using and leveraging our own Internet Service Providers (ISP) to launch their attacks and perpetuate their fraudulent schemes.  How will this ever be deterred?  Could a version of KYC work with the ISP's?

Even with a global banking system in place you have pockets of greed and deceit.  Rogue nations or territories that have become the go-to-locations for the transnational organized crime syndicates to flourish.  Yet we can do much better, than we are today.

Just ask any "BlackHat" hacker from Eastern Europe who they prefer to do business with.  Query the experts that exist on the dark side and you will find the ISPs they prefer to do business with.  One day the regulators will realize this is where the business of e-crime has an opportunity for change and additional reform.  It will be more than just opening an account to gain access to the Internet.  It will be about scaling up our systems to a future horizon with new rules and robust real-time behavioral predictive analytics.  In the mean time:

May 11, 2016 

In testimony before Congress today, the Federal Trade Commission outlined its work over the past 40 years to protect consumers’ privacy at a hearing convened to examine privacy rules proposed by the Federal Communications Commission.

Chairwoman Edith Ramirez and Commissioner Maureen Ohlhausen testified on behalf of the Commission. The testimony before the Senate Judiciary Committee’s Subcommittee on Privacy, Technology and the Law provided background on FTC law enforcement efforts, policy work and consumer and business education programs related to protecting consumers’ privacy.

The testimony highlighted the FTC’s extensive history of privacy-related work. The testimony noted that the agency has brought more than 500 privacy-related enforcement cases in its history against online and offline companies of varying sizes, including companies across the internet ecosystem. In addition, the testimony highlighted a number of recent cases of note.

The testimony also provided information on the FTC’s policy work in the privacy area, going back to its first internet privacy workshop in 1996. The testimony noted that recent policy work has been based on principles featured in the FTC’s 2012 privacy report, and also highlighted workshops and reports related to the Internet of Things, big data, and other issues, including cross-device tracking.

The testimony also described the FTC’s extensive consumer and business education efforts related to privacy, including the FTC’s Start With Security campaign for businesses, and the newly-updated IdentityTheft.gov.

Predictive Intelligence: Data or Precogs...

The use of the term "Predictive Intelligence" has been around for a few years in the Operational Risk Management (ORM) community.  Born from the marketing collateral of the Business Intel (BI) vendors, it essentially requires hundreds of gigabytes or even terabytes of historical data and then is analyzed or data mined for so called insight.  The question is, why is this "Predictive Intelligence" and not just more "Information" in a different context?

Now introduce the nexus of our own "Trust Decisions" and the "Human Factors" associated with the science of cognitive decision making.  How do we as humans make our decisions to trust vs. how computers make their decisions to trust?  Are they not executing rules written by humans?  When is it information in a different format as opposed to true intelligence?

Christian Bonilla may be on to something here:

"Professionals in the foreign intelligence community take pains to distinguish between information and bona fide intelligence. Any piece of knowledge, no matter how trivial or irrelevant, is information. Intelligence, by contrast, is the subset of information valued for its relevance rather than simply its level of detail. That distinction is often lost in sector of the enterprise technology industry that is somewhat loosely referred to as Business Intelligence, or BI. This has become a bit of a catchall term for many different software applications and platforms that have widely different intended uses. I would argue that many BI tools that aggregate and organize a company’s information, such as transaction history or customer lists, more often provide information than intelligence. The lexicon is what it is, but calling something “intelligence” does not give it any more value. In order to sustainably outperform the competition, a company needs more than a meticulously organized and well-structured view of its history. Decision makers at all levels need a boost when making decisions amidst uncertainty and where many variables are exerting influence. They need what I would call predictive intelligence, or PI – the ability to narrow down the relevant variables for analysis and accurately measure their impact on the probability of a range of outcomes."

What does the fusion of human factors have to do with predictive intelligence?  That depends on how much you value the kind of innuendo and messages in the Tom Cruise movie, Minority Report.  Many aspects of the original Philip K. Dick story were adapted in its transition to film that was filmed in Washington, DC and Northern Virginia.  Is it possible to predict someone's future behavior even before they commit a crime or even become violent?

Set in the year 2054, where "Precrime", a specialized police department, apprehends criminals based on foreknowledge provided by three psychics called "precogs".

Cruise plays the role of John Anderton who is part of the experimental police force known as "Precrime."  These aspects of clairvoyance and precognition has many skeptics and their use for predicting future events or a related term, presentiment, refers to information about future events which is said to be perceived as emotions.

Regardless of terms, beliefs or whether the software analytics are using historical data, the science of "Predictive Intelligence" is about forecasting the future.  Based upon the recent global events that missed the forecast of economic implosion based upon historical data, maybe it's time to start introducing more human factors to the equation.

The interviews with people who have gone on record to predict a future historical event will probably be right at some point in time. How long will you be around to wait?  The demise of the banking sector and the extinction of Lehman Brothers, Bear Stearns and maybe even AIG were most likely predicted by someone, somewhere in 2007/2008 time frame.  The point is that you have to have context and relevance to the problem being solved or the question being asked.

The real story of the crash began in bizarre feeder markets where the sun doesn't shine and the SEC doesn't dare, or bother, to tread: the bond and real estate derivative markets where geeks invent impenetrable securities to profit from the misery of lower--and middle--class Americans who can't pay their debts. The smart people who understood what was or might be happening were paralyzed by hope and fear; in any case, they weren't talking.

Predictive analytics extracts relevant information from data and attempts to forecast the future. It relies on capturing relationships between explanatory variables and the predicted variables from past occurrences, and exploiting it to predict future outcomes.  Is it possible that there was and is too much reliance on the numbers and not enough on people's cognitive intuition?

This blog has documented the "11 Elements of Prediction" in the past.  Now it's time to utilize the combination of these human factors in close collaboration with the data analytics and raw numbers. Effective execution of both will provide corporate management the situational awareness they seek within the time line they wish.

The future state of Predictive Intelligence will combine the science of "Trust Decisions" with the art of "Data Analytics" to achieve our desired outcomes.

ID Analytics: Risk of the Unknown...

Operational Risk Management (ORM) has been at the top of the news in the past few weeks.  Digital media and the metadata of "Big Data" is the topic of choice.  It is a revealing look behind the curtain of what is possible these days, with the tools and capabilities that exist for exploitation and analysis.  Is too much privacy an operational risk to your personal and professional well being?  What "Trust Decisions" did you make to arrive on this page in the universe of the Internet?

In the spirit of full disclosure, if you are reading this now, we tracked how you found this blog and perhaps what search terms you used to be referred here.  Some of you, revealed their company identity. So why do we do this?  The main reason is that we want to make sure that we understand what is on your mind these days, when it comes to the global Operational Risk Management (ORM) universe. Here are a few examples in the past day or so that caught our eye:

• management of operational risk - Latvia
• operational risk management - Nigeria, Illinois, South Dakota, The Vanguard Group
• common board of directors mistakes - Turkey
• lessons learning from fail in operational risk - Malaysia
• predictive intelligence - North America
• rogue trader operational risk - United Kingdom
• fund industry operation management discussion topic - Luxembourg
• operational risk management game - Unknown
• reputation risk management process - Unknown
• operational risks in bank call center - Qatar
• coso definition of operational risk - Unknown
• black swan incident that occurs once in a lifetime - Unknown
• ubs operational risk case analysis - Unknown
• business resiliency definition - JP Morgan Chase
• "operational risk" outliers - France
• a risk effect on a daily operation - DeVry
• examples of smart objectives risk - United Kingdom
• black swan incident\ - South Carolina
• black swan incident - Computer Sciences Corporation
• what is a black swan incident - South Carolina
• duty of care board of directors - United Kingdom

Collection of data is one thing.  Relevance and sense-making is another.  Can you imagine some of the search terms that are tracked just by Google or Bing?

What about the companies that know us the best?  Those marketing and personal data sites that keep track of where you live, how much you spend on your credit cards and where, or even the name of your pets.  How often do you give them your phone number or e-mail address at the point-of-sale (POS) to get a discount at the local retailer, gas station or pharmacy?  Believe us when we say that there are hundreds of organizations that know more about you in the private sector than some government across the world.

The trail of "digital finger prints" you leave behind everyday are vast.  A snap shot of your face at the local ATM or a snap shot of your desktop when you login to the online banking web site.  In either case, these examples are just a few of the ways that your habits, locations, preferences and lifestyle are profiled each and every day.  Where did all of this begin?  Fraud Management.  Not Homeland Security.

As a citizen traveling across the country or a consumer, you willingly give up these digital bread crumbs of your journey through life.  Your goal now, is to make sure that you are not mistaken for someone else.  After all, you or your organization have developed a profile and a reputation that is being recorded and therefore, it could be a prudent strategy to make sure that you are not mixed up with another person or organization with the same name or brand identity.

How can you do this?  Operational Risk Management (ORM) is about monitoring yourself and your organization to make sure you understand your competition (good or bad) for the same personal or business identity space.  Do you have Biometric and DNA samples of all of your key executives?  If you don't, then the question is why not?  You may have considered this in light of some of the places that your executives are traveling.  Cities and countries across the globe with the risk of kidnapping, improvised explosive devices (IED) and other risks to their lives.

As we look into the crystal ball of our digital futures, we see the scenes from movies past that have already captured our own human imagination.  A world where everyone is known and you may even choose to "opt-in" to be tracked.  After all, you are unique.  You make your own choices in life.  The risks that you face may very well be greater, for those who choose a life to remain private, anonymous and even unknown.

Algo Bots: The Risk of Human Error...

What "Trust Decisions" did you make this past week?  How fast did you make them?  The ability to manage an entire portfolio of operational risks in a daily routine is daunting.  How do you prioritize? What Operational Risk Management (ORM) process will you engage in, with so many uncertain outcomes?  Why will you sit up in bed at 3AM, to read the latest alert on your smartphone?

In October of 2012, this ORM blog discussed the topic of "Algo Bots" and "Dark Pools".  Machine language talking to other machines, to make optical network speed decisions and more precise, "Trust Decisions."  What is the risk of a low probability and high consequence incident when humans are taken out of the equation?  Dave Michaels of Bloomberg explains the current focus:

Mary Jo White’s blueprint for imposing tighter controls on high-frequency traders and some of the murky venues they inhabit stops short of a crackdown. 

The U.S. Securities & Exchange Commission’s plan, unveiled by White in a speech this week, advanced some new ideas while borrowing heavily from existing proposals and measures that already have support on Wall Street. While stock exchanges, rapid-fire traders and private trading venues known as dark pools all would come under new scrutiny, White didn’t embrace the kind of tighter restraints that have been enacted in countries such as Australia and Canada. 

White isn’t acting in a vacuum. She is responding to political pressures raised by an investigation by the New York attorney general into whether speed traders prey on slower-moving investors as well as a book by Michael Lewis, “Flash Boys,” that condemned the role of exchanges and brokers in enabling unfairness. She announced the initiatives even as she said U.S. markets aren’t rigged and serve the goals of retail and institutional investors.

As an Operational Risk Management (ORM) professional, you have to stay on the edge.  You must imagine the future and dive into the current R&D of innovation.  Being a futurist is staying on the bleeding edge of technology and this is just one facet of the risk mosaic.  The other and more human factor oriented component are the TTP's.  Tactics, Techniques and Procedures (TTP) are what you need your own "Opposition Research" team to be studying.  This is your opportunity to gather the intelligence on your competition and simultaneously look at your own vulnerabilities.  Sam Mamudi and Keri Geiger explain:

The U.S. Securities and Exchange Commission cited Wedbush Securities Inc. and Liquidnet Holdings Inc. for violations of stock market rules, taking tangible steps a day after Chairman Mary Jo White outlined her plan to improve Wall Street trading. 

Wedbush, which the SEC said is among the five biggest Nasdaq Stock Market traders, failed to vet clients who broke the law as they placed billions of dollars of transactions in the stock market, the regulator said. Two current and former Wedbush executives, Jeffrey Bell and Christina Fillhart, were also targeted in the complaint. 

Liquidnet, one of the biggest independent dark pool operators, agreed to pay a $2 million fine for not living up to client secrecy standards on its private trading platform.

So what?  The Rise of the Machine Traders:

In the beginning was Josh Levine, an idealistic programming genius who dreamed of wresting control of the market from the big exchanges that, again and again, gave the giant institutions an advantage over the little guy. Levine created a computerized trading hub named Island where small traders swapped stocks, and over time his invention morphed into a global electronic stock market that sent trillions in capital through a vast jungle of fiber-optic cables. 

By then, the market that Levine had sought to fix had turned upside down, birthing secretive exchanges called dark pools and a new species of trading machines that could think, and that seemed, ominously, to be slipping the control of their human masters. Dark Pools is the fascinating story of how global markets have been hijacked by trading robots--many so self-directed that humans can't predict what they'll do next.

So how do you mitigate the potential risk of a rogue algorithm? Some have devised a mechanism called a circuit-breaker. In other words, an alarm that something is not normal. Let's slow down until we can understand what is going on here. What are some other ways that we could potentially address the threat or the vulnerability? Was the "Flash Crash" a weak signal of a pending melt down of the complete system?

Or is this just the next natural phase of the future growth curve.  Who will you put your faith in for your next "Trust Decisions"...

Top Secret America: Analysis of Competing Hypotheses...

Operational Risk Management Executives are still digesting the latest Washington Post investigative reporting from Dana Priest and William M. Arkin, "Top Secret America". The U.S. Intelligence Community (IC) and the Defense Industrial Base (DIB) employees in the suburbs of Virginia, Maryland and DC will be debating the impact over whispered dialogue around the weekend BBQ or over a candle light dinner in their favorite Georgetown restaurant.

The aftermath of the disclosure, increased transparency and ongoing investigation will continue for months and most likely years. New questions, new facts and new ideas will be put on the table for consideration inside the board rooms of private sector companies, law firm lobby shops and the government program management offices. Risk Management and the topics of risk exposure and the likelihood of incident categories will be the center of the conversation.

Since the Safety and Security of the United States is the foundation for the article, it makes the nexus of all the newspaper writing, blogposts, TV interviews and Internet "Tweets" relevant to Operational Risk Management.

As professionals in the IC and DIB continue to evolve their solutions on the ever changing threat to US citizens, you only have to look to the requirements placed in front of them. What risk are we trying to mitigate? What exposure do we have now? What is the likelihood that this will happen to us and how soon?

The requirements dictate the solution. The understanding of the threat dictates the requirements. The solution is not going to be implemented one time, one place and then it's over. It's going to be adaptive and it's going to evolve at the speed of the threat. The question that is always being asked by everyone is, how fast can we adapt?

Dana Priest and Bill Arkin may have done our country a great service at this point in time. The "Analysis of Competing Hypotheses" (ACH) may be utilized to ultimately prove the correct course and to make even more sound analytical judgments about our national security evolution. By actually using the data facts uncovered by their current research the process of eliminating errors in the data can begin. And once the data has been normalized and cleansed so that all agree that it is the true baseline, then the ACH can begin.

As the DNI provides the leadership and works through the governance cycles with all of the IC Director's and Secretary's, then the use of a vetted methodology such as ACH combined with the entire risk management exercise, may indeed reveal some operational risk vulnerabilities. It would be through the analytic process, risk matrix and the future enterprise architecture work that a more robust, resilient and economic model is developed and implemented.

Now about the question on whether our national security has been compromised or the risk to our private sector assets has increased as a result of the Washington Post article. Only time will tell as the possibility of future VBIED incidents, take out the facades of previously unknown or unnoticed IC or DoD facilities identified and validated in the newspaper's research.

Even now however, the vulnerability of our vital national security assets are most likely to be copied, stolen, corrupted or deleted by the logic bombs lying in wait, before major kinetic disruptions. It will no doubt be a 4GW blended attack on our homeland that combines the effects of both that experts predict is our greatest threat.

This brings us back to the quote at the top of this blog:

"The Only Thing Necessary For Evil To Triumph Is For Good Men To Do Nothing." --E. Burke

God's Speed to the United States of America...