Tag: Advisory

The Rise Of Digital Transformation And Its Impact On The Economy

Posted on by info

Digital Transformation in the Pandemic and Post-Pandemic Era

If there were any lingering doubts about the necessity of digital transformation to business longevity, the coronavirus has silenced them. In a contactless world, the vast majority of interactions with customers and employees must take place virtually. With rare exception, operating digitally is the only way to stay in business through mandated shutdowns and restricted activity. It’s go digital, or go dark.
 
This digital mandate isn’t new; it’s simply been brought into sharp focus. Prior to the pandemic, a paradigm shift towards digitization and servitization of the economy was already underway. Current events have accelerated the paradigm, as evidenced by the marked shift in spending towards digital businesses.

And this is just the beginning.
 
The pandemic is a reality check for businesses that have been reluctant to embrace digital transformation and now find themselves woefully unprepared. On top of the stress of potentially health-compromised employees, a sudden and dramatic drop-off in demand and total economic uncertainty, these digital laggards are now scrambling to migrate their operations and workforce to a virtual environment. While fast and furious is the name of the game when it comes to digital innovation, fast and frantic can lead to mistakes.  
 
On the other hand, businesses that had not only developed digital strategies but executed on them prior to the pandemic are now in a position to leapfrog their less nimble competitors. That isn’t to understate the COVID-19-related challenges they now face, irrespective of their current level of digital maturity.  Going digital in and of itself isn’t a panacea to all that ails businesses in the current economic environment. They do, however, have significantly more tools at their disposal to not only weather the storm, but to come out the other side stronger for it.
 
Don’t write off the digital laggards just yet, however. Crisis breeds ingenuity, and good ideas put into practice can propel any business to breakout performance. Organizations that rest on their existing digital laurels can be surpassed by those that invest in adapting their digital capabilities for the post-coronavirus future—a future that looks very different from the world pre-pandemic.

Spotlight: The Digital Advantage

Organizations that embrace digital solutions have greater resiliency in the face of adversity—and a leg up on the competition that will enable them to recover faster and pivot from playing defense to chasing growth.
 

 Efficiency advantage:They harness digital technologies to streamline operations and automate manual processes—resulting in greater speed, less waste and more focus on revenue-generating activities.
   
 Productivity advantage:Their employees were already set up to work remotely, so their focus is on leveraging collaboration technology and tools to maximize workforce productivity and sustain company culture.
   
 Security advantage: They are better prepared for and more resilient to the proliferation of cyber threats in the current environment.
   
 Customer advantage:They mine customer data to monitor for shifts in demand and uncover emerging customer needs.
   
 Agility advantage: They leverage data-driven insight to make decisions faster and act on them faster. They have built-in cultural flexibility to adapt or change course at any point.

New Reliance on Digital Solutions During COVID-19

Under COVID-19, the world has, by necessity, gone into isolation. Social distancing is currently the most effective way to slow the spread of the virus until a vaccine can be found to protect the population. As a result, anything that relies on human-to-human contact–which is to say, most aspects of our lives–must be amended to account for the dangers of the virus.
 
Digitization has stepped in to bridge the gaps left by mandated shutdowns and social distancing measures. Without digital tools and technologies, we would have no way to work, shop, go to school, and more.
 
Let’s take a closer look at how digitization is keeping society–and businesses–afloat during the pandemic:
 

  • Remote Work: Before the pandemic, only 30% of U.S. employees worked remotely 100% of the time, according to Owl Labs. For the other 70%–including the 38% of the total U.S. workforce that only worked on-site—the transition to working remote full-time has been a shock to the system—figuratively, and in some cases, quite literally, when user demand has exceeded system bandwidth. But the silver lining is that with such a high percentage of the working population now remote, digital collaboration is improving in leaps and bounds, both in terms of the sophistication of the tools to facilitate it and workers’ level of comfort with it.
  • Omnichannel Commerce: As many physical business locations are shut down, consumers are turning to online shopping to meet their needs, even those who had historically been reluctant to do so. In particular, grocery delivery services, such as Instacart, have been in high demand. Consumers can choose their groceries, pay online, and leave feedback all on one convenient app. Businesses are blending the physical and the digital to provide for their customers through delivery methods such as curbside pickup and contactless delivery. Physical-digital integration is more important now than ever before.
  • Digital Content Consumption: Homebound consumers are turning to digital content providers to meet their entertainment needs. 51% of internet users worldwide are watching more shows on streaming services due to the coronavirus, according to data from Statista. Netflix alone saw 16 million new signups for its service in the first three months of 2020.  Meanwhile, many film studios have been pushing new releases to streaming services early to captive audiences.
  • Platformification: Institutions and organizations of all types are trying out digital platforms to stay above water during the pandemic. The fitness industry has shifted to holding virtual classes on streaming services, both live and pre-recorded. Almost every school, from elementary schools through graduate programs, have shifted to online courses. Large-scale conferences and events are being held virtually. The NYSE has moved entirely to online trading. While some businesses will revert to their traditional models when the crisis abates, others may opt for a hybrid approach as they recognize the benefits of recurring revenues.
  • Digital Health Solutions: Much of America’s healthcare system has gone digital to alleviate some of the strain imposed by the coronavirus. Telemedicine and remote diagnostics are helping patients get medical advice and diagnoses at home so they don’t need to come in to the doctor’s office or hospital, and 3D printing is being used to expedite the production of critical medical supplies, such as PPE. In the absence of a vaccine or proven treatment, the best preventative medicine is information-sharing. Digital contact tracing has already been used to effectively slow the spread of COVID-19 in East Asia. The technology itself is at least a decade old but has struggled to gain traction in the Western world where views on privacy have been prohibitive. Whether American citizens (and those that govern them) will be willing to trade individual privacy rights for the greater public good remains to be seen, but there may be more leniency around data collection going forward.

 
The pandemic serves as a widespread test case for the effectiveness of these digital solutions, many of which will be permanent fixtures and lead to long-term changes for many businesses.
 

The Case for Digital Transformation in Crisis

The economy is now mired in a downturn, which may outlast the current (and hopefully sole) wave of the pandemic. Some organizations may be inclined to retrench on their digital transformation plans, as part of a broader belt-tightening agenda. A good cost reduction program focuses on trimming the fat without cutting away the essential parts of the business that are necessary to sustaining current levels of business performance. If we view an organization as a living organism, digital transformation powers the backbone, muscle, brain and heart of the organization. Halting digital innovation efforts in crisis will significantly compromise overall business health.
 
Though it may seem counterintuitive, crisis is the ideal time to double down on digital transformation. Rather than putting digital transformation plans on hold, organizations need to go all in.
 
It shouldn’t be prohibitively expensive. Many businesses are understandably reluctant to loosen the purse strings in the current environment of uncertainty. While digital transformation is often viewed as a massive upfront investment in long-term results, it doesn’t need to be. Some of the most successful transformation projects start with low-cost pilots and limited resources that are scaled up once the kinks are worked out and the results are proven. Done in the right way, digital transformation can be self-sustaining, with each incremental improvement paying for the next leg of the journey.
 
You can actually save money. Past recessions show that controlling costs by improving operational efficiency—a task for which digital solutions are perfectly suited—is more effective in sustaining businesses through financial turbulence than traditional cost-cutting measures alone. For example, companies that rely primarily on workforce cuts to manage costs only have an 11% chance of “breakaway performance” coming out of a downturn, whereas companies that focus on operational efficiencies over layoffs are more likely to experience breakaway performance, according to research from Harvard Business Review.
 
The biggest efficiency play is automation. With automation projects, ROI is realized near-instantaneously, offsetting the upfront investment. Robotic process automation allows organizations to automate certain types of work processes to reduce the time spent on costly manual tasks and reallocate resources elsewhere. The economics of automation are simple: the same work is performed faster and with fewer mistakes, while human capital resources can be redeployed to higher-value tasks or to fill critical gaps. More sophisticated machine learning tools can be used to identify and address unforeseen areas of waste.
 
Business reinvention isn’t always a choice. Many businesses are experiencing devastating financial consequences from the pandemic, whether because of supply chain impacts, forced shutdowns, a significant pullback in consumer spending, or all of the above. Consumer discretionary manufacturers and retailers, oil and gas companies, and the service industry are among the sectors that have been struck the most grievous blows. To avoid catastrophic revenue losses, these companies have no choice but to shift focus to their business’s existing digital channels or make a bigger pivot to a digital business model. But again, there is a silver lining: The innovations that are made out of necessity could become lasting pillars of the business that help it to thrive well beyond the pandemic.  

There will be no “return to normal”. The coronavirus is permanently reshaping the way we live and work. Some of the behaviors developed in crisis—including wide-scale digital adoption—will outlast the pandemic, well after restrictions on activity are lifted. To stay competitive, organizations must respond to these behavioral changes and meet emerging customer demands. Savvy organizations will focus now on leveraging advanced analytics to extract insights from their customer data and continue internal and external data integration efforts to develop a more holistic view. Detecting those signals of change early will be crucial to optimizing the customer experience and redefining customer value propositions in line with evolving preferences and needs.
 

COVID-19 Trends Here to Stay

  • Remote Work Arrangements
  • Digitization of Customer Service
  • Shift to e-Commerce
  • Greater Use of Self-Service
  • Contactless Delivery Options
  • Outsourced IT
  • Customers Focusing on Spending Less and Saving More
  • Increased Focus on Safety, Cleanliness and Health
  • Bulk-Buying and Stockpiling
  • Use of Online and On-Demand Platforms

Summary Digital transformation is more necessary during this crisis, not less. But that doesn’t mean it will look the same as it did before the pandemic. Resources—both in terms of talent and money—will likely be constrained. Digital initiatives may need to be reprioritized based on relevance in the current environment. New problems and opportunities may come to light with greater urgency. For some businesses, the forces of disruption may be so great that the long-term strategic vision will need to be overhauled. And any digital transformation roadmap that does not deliver value at every increment will need to be reimagined. The key is continuing to experiment and innovate with digital solutions front and center. With the right approach, businesses can come out of the fray stronger, more agile, and more customer-centric than before.

7 Actionable Steps to Reducing Cyber Vulnerabilities

Posted on by info

Cybersecurity breaches are in the news daily, and as forensic investigation and incident response practitioners, we have seen several common themes among victim companies. Attackers often pass over larger companies with robust cybersecurity measures and instead prey upon small to mid-sized businesses that are softer targets with weaker security postures. These seven steps to reducing your cyberattack surfaces will help to strengthen your defenses.

  1. Raise Cybersecurity Awareness and Hold Employees Accountable

    The weakest link in any cybersecurity program is the human workforce operating within it. Phishing attacks–in which users are tricked or deceived into opening an unsafe email attachment or visiting a fraudulent website–are among the strongest weapons in an attacker’s arsenal because they work against people, not software. Institute a regular cybersecurity awareness program that includes not only instruction but also random testing throughout the year. Repeated failures of such random testing should be considered a notable area for improvement for employee progression. If your company lacks the resources or abilities to perform such training, several outsourced providers have these training and awareness platforms at the ready.
  2. Use Strong Passwords and Password Managers

    An attack known as “credential stuffing” is extremely effective at helping attackers gain access to multiple systems at once by taking valid username and password combinations (called “credentials”) stolen from one computer system or website and trying them against others such as corporate logins, online banking, and more. As people often reuse passwords across platforms to make remembering passwords easier, this also leaves systems—including the computers and accounts they use for work—vulnerable to compromise.

    To combat credential stuffing, an organization’s best defense today is the combination of strong passwords (long passwords with a mix of capital letters, lower case letters, numbers, and symbols) and password managers—secure programs designed to generate strong passwords and store them for easy recall, to make using unique strong passwords on every account and website easy. This also assists with “corporate memory” of shared or administrative passwords, as particular entries can be made accessible to a certain group of users. Password managers such as 1Password, LastPass, and Dashlane also have web browser extensions that make it extremely easy to have a different strong password for each website visited. They often also have the capability to provide for personal and professional password vaults to ensure that users have a common experience to improve the likelihood that they will adhere to using a password manager and not using only “password123.”
  3. Patch and Update Regularly

    Software developers—including those who write operating systems, office platforms, and even security software—are human, and bugs or vulnerabilities can exist in even the most secure computing platforms. As these issues are discovered, software manufacturers will fix and release new versions of these products. It’s critical that you have a regular cadence for updating the operating systems, applications, and security tools that your company depends upon. When responding to incidents, it’s not uncommon for responders to find several “critical” systems to an organization that are running on long outdated and unsupported versions of Windows or Linux servers. Outdated and unsupported operating systems often have several vulnerabilities and wide-open attack surfaces which serve as open doors for attackers.

    Needless to say, always make sure your organization’s antivirus (you do have an organization-wide antivirus in place already, yes?) is regularly updated to receive the freshest definitions and algorithms, but remember, antivirus only helps with malware-based attacks.
  4. Tighten Existing Controls

    In nearly every operating system, network, file system, and application, user accounts have varying degrees of permissions to accomplish tasks or access data. Administrators tend to have the most and standard users tend to have the least. Ensure that each user account, including system accounts used for handling automated tasks, has the amount of authority and permissions necessary to complete the job at hand—but no more. For example, while a company’s CEO might drive the policy and agenda for the entire organization, he or she doesn’t necessarily need access to detailed engineering plans or code repositories; they won’t use that data as a course of normal business, but it expands their attack surface tremendously and increases the potential for a catastrophic breach should their credentials be compromised by clicking on a nefarious link in an email message.
  5. Use Two-Factor Authentication Whenever Possible

    Operating systems, application platforms (such as Microsoft’s Office 365), and many websites provide enhanced security and authentication through “two-factor authentication.” Two-factor authentication often combines something you know (such as a password) with something you have (such as a one-time randomized key) to authorize credentials. At a minimum, two-factor authentication should be a requirement for any Office 365 Administrator account, and it’s no less recommended for standard user accounts as well.

    Two-factor authentication is often accomplished through a program that runs on one’s mobile phone, providing “one time passcodes” that rotate every thirty seconds with a unique number that will provide an additional verification your user credentials. Common two-factor authentication programs include Google Authenticator, Authy, and Microsoft Authenticator, and many password manager programs also can generate authentication passcodes as well.
  6. Have an Incident Response Plan, Even Minimally

    Due to the growth in cyberattacks and cybercrime, organizations are beginning to understand that it isn’t about if they’ll face a data breach, but when. As a result, the difference between catastrophic organizational damage and cyber resiliency can be the manner and speed in which an organization responds to a breach when it happens, along with the programs, procedures, and processes in place beforehand to best position the organization for recovery.

    While a full incident response plan with trained, dedicated staff at the ready is great, this is definitely an area where perfect shouldn’t be the enemy of good. Critical days or even weeks can be lost after a breach while a company looks for an incident response contractor, negotiates contracts (at panic pricing), and waits for the contractor to begin their response in an unfamiliar network belonging to an unfamiliar company. When you don’t have an active incident is the time to contract with an incident response and/or managed security services firm, because you can set fair pricing, reasonable retainers, and the contractor will have time to learn what’s “normal” in your company and network before a crisis happens. Even if your plan is to “call our account rep at our incident response contractor,” that can be enough to stop a security incident from becoming a security breach.
  7. Encrypt Data at Rest and In Transit

    Most desktop and server operating systems can encrypt the contents of their hard drives right out of the box. From a single user’s laptop to the information stored in your corporate-wide databases, encryption should be the standard, not the exception. Before a computing device is provided to an employee, activate the on-board disk encryption to reduce exposure to loss or theft, and ensure that your cloud computing platforms, corporate databases, and email servers are also covered by their encryption capabilities. Emergency decryption keys can be stored within the safety of your password manager for cases when an employee leaves suddenly, but not providing encryption on that employee’s laptop can be a disaster if it’s lost or stolen in an airport café.

    Speaking of travel, when employees are on the road, they should connect to the Internet through a Virtual Private Network (VPN), preferably one provided by and running through the corporate network to maintain control and assure data security. Open Wi-Fi access points may be a boon to travelers, but they’re also a goldmine for data thieves who may listen-in on unencrypted connections. In a pinch, commercial VPN services are also available on an individual basis, and computing enthusiasts can set-up their own using open-source platforms such as AlgoVPN for the price of a cup of coffee.

In summary, while there is no one end-all, be-all to cybersecurity, there are a number of simple, practical steps that organizations can take to dramatically improve their cybersecurity posture. Many of these options are free or come with the software you’ve already purchased. Others, while they do charge a fee, cost significantly less than the amounts associated with a data breach in loss of customer confidence, loss of intellectual property, incident response costs, fines, penalties, legal fees, and more. Cybersecurity should be another risk that needs to be quantified, monitored, and managed by your C-suite and Board, and policies must be drafted and enforced accordingly.

Returning To Work In Society’s New ‘Normal’

Posted on by info

How companies should plan to return to work and emerge from COVID-19 stronger and smarter.

As the response to the COVID-19 pandemic progresses, many companies have established operational crisis management teams and adjusted to global restrictions on work and movement. Executives are now beginning to ask the question: How are we going to return to work?

As of April 2020, some countries are starting to ease restrictions, allowing for more freedom of movement and the reopening of specific industries. In the United States, The White House has announced guidelines for re-opening the nation in a three phased approach. These guidelines include thresholds for states to satisfy in the following areas: trajectory of reported symptoms; trajectory of reported cases; and ability for hospitals to care for patients and provide ongoing testing.

Additionally, multiple groups of governors have formed regional coalitions to coordinate reopening their states in a unified way. While it is challenging to predict when each country and U.S. state will begin to return to the workplace, many predictions point toward restrictions being lifted gradually over the next few months, depending on your location.

Regardless of precisely how governments decide to ease their restrictions, companies need to plan for an orderly and thoughtful approach to returning to work. There are three crucial steps to accomplishing this:

  1. Build a return-to-work plan.
  2. Work through the stages of partial and full operations.
  3. Increase resilience through monitoring for possible virus resurgence, completion of after-action reports, and program enhancements.

By doing this carefully and methodically, businesses can begin the process of restoring operations while also ensuring that they do not take one step forward and two steps backward in returning to work.


Build a return-to-work plan

Companies first need to consider the structure in which a return-to-work plan will be created. That structure will need to include identifying stakeholders; outlining authorities and decision trees; defining critical information requirements; identifying assumptions and variables; and, of course, creating detailed execution checklists for individual business units.

It’s essential to examine each part of the return-to-work program in detail:

  • Identifying stakeholders: Most of the critical stakeholders may already be members of the Crisis Management Team. Members should include representatives from major business units and support functions.  
  • Outlining authorities and decision trees: As your company prepares to make return-to-work decisions, it is important that a decision tree is outlined in advance and that the company agrees on who has the authorities to make those decisions. At a minimum, a company will need to answer three basic questions before returning to work. Those questions are:​
    • Can we do it? Is physical access possible through government easing of restrictions or landlord policies?
    • Should we do it? Is it safe for staff to commute to and occupy a given work site? Additionally, are there supplemental government restrictions like the required use of personal protective equipment (PPE) that the company must provide for occupants?
    • How will we do it? Who within the company makes the final decision to open a work site, and what are the steps (checklist items) the business units will need to follow? 
  • Defining indicators: Sometimes referred to as triggers or critical information requirements, these indicators will likely come in the form of the lifting of government orders or easement of agency (e.g., Centers for Disease Control and Prevention, World Health Organization) guidance. This type of information will indicate a country, state, city, or region is ready to begin the process for considering reopening non-essential work sites.
  • Identifying variables: Any lifting of work and movement restrictions will likely occur in a phased approach. Governments and agencies will closely monitor infection cases and use that information to determine next steps to further ease restrictions or revert to prior levels. Some of the variables companies will need to consider are:
    • Countries will only begin to ease work and movement restrictions when they see consistent reductions in new infections and are comfortable that they have available medical capabilities and hospital beds to handle any potential resurgence.
    • In the U.S., individual states will start to return to work in segments (coastal states first with interior states to follow). Additionally, state governors are likely to extend restrictions beyond federal government deadlines due to the differences in when peak infection cases are reached.
    • Restrictions are likely to remain in the workplace, and it is possible to see government orders that could require a reduction of in-person workforce by half, staggered work schedules, or some other measures to keep occupancy low while the effects of returning to work are measured in any potential new infection cases.
    • Guidance or government orders may include parameters around which segments of the population can work first (e.g., low-risk and immune persons may be allowed to return first, while higher-risk populations will be required to remain at home).
    • Some governments are requiring PPE for employees (e.g., China, France, and, in the U.S., New Jersey, New York, and some counties in California and Florida). In these cases, companies will need to prepare for and provide the required equipment before staff are allowed back into the work site. Lead times for this equipment can be very long, so advanced planning is required.
    • Manufacturing and pharmaceutical equipment may require re-calibration and, in some cases, re-certification by the Food and Drug Administration (or local equivalent). Lead times for these processes could extend many weeks or months.
    • Finally, companies will need to determine what other government regulations are required of them prior to opening a work site. For example, in Alameda County, California, there is currently a regulation requiring employers to post notifications to the buildings informing staff of the potential dangers that may still exist.
  • Creating detailed execution checklists: For individual business units, both business unit and support function checklists will need to be created to help ensure proper steps are completed prior to staff returning to a work site. Additionally, critical third parties must be accounted for when preparing to return to work.

Working through the four stages

A return-to-work plan should account for four main stages and allow for a clear roadmap in moving from a (1) current state, to a (2) partial or limited opening, to a (3) full resumption of operations at capacity. The fourth stage accounts for the need to continue to monitor for virus resurgence. This allows for a diagnosis of how the company performed during the crisis and how it will improve going forward.

The situation, objectives, indicators, and actions should be clearly defined for each of the four stages that a company expects to move through during the return-to-work process. Those elements are detailed as follows:

  • Situation – Parameters are established to help define the given stage. This is especially helpful in determining when a company can begin to move from the partial opening to the full opening stage.

According to World Health Organization director-general Tedros Adhanom Ghebreyesus: “The last thing any country needs is to open schools and businesses only to be forced to close them again because of a resurgence.”
Source: https://www.reuters.com/article/us-health-coronavirus-wuhan-secondwave/beware-second-waves-of-covid-19-if-lockdowns-eased-early-study-idUSKBN21D1M9

  • Objectives – A company articulates what is most important in each stage. It could be maintaining cash flow, re-establishing connections with clients and customers, re-evaluating supply chains, or completing a look back at the event with an eye toward future maturity.
  • Indicators – This information is gathered from both government orders and agency guidance. It informs the company what is or is not allowed from a movement, work, or health and safety perspective.
  • Actions – Finally, companies should outline how they will act within each stage. This may take the form of specific actions related to People, Process, and Technology.

The final stage of the return-to-work plan is to monitor and prepare. Here it is incumbent on companies to continue to monitor for any resurgence in the virus, identify changes to government restrictions and agency guidance, and better prepare the company to be more resilient toward future disruptions. This is also the stage where companies should do a “look back” to evaluate if any controls were relaxed during the work-from-home period.

There is growing concern among academics that a second wave of virus infection cases may occur later this year. Given that possibility, companies should take full advantage of the expected break over the summer and early fall months to begin to perform after-action reports and outline a plan for improvements. Those in highly regulated industries (e.g., Financial Services, Pharmaceutical) should further prepare for regulatory inquiries on how they are planning to address gaps. Regardless of industry, it is always better to show the Board and regulators (if any) that gaps have been self-identified, remediation programs outlined, and resources allocated.

This will also be the time for companies to build a consolidated operational resiliency function. In this environment, resiliency components are no longer siloed but are integrated and provide end-to-end recoverability regardless of the next business interruption.

Conclusion

As companies continue to navigate these uncharted waters, it is essential to understand that business may fundamentally change when we come out of this. A return to “business as usual” may also be a return to a new normal where we re-evaluate how we work, where we work, how we interact with customers, and where our products are made. Supply chains and concentration risks will be reassessed, and executives will begin to evaluate outsourcing and the use of low-cost locations with more of a risk lens and not merely a cost-cutting lens.

Like every systemic shock to the economy, winners and losers will emerge. One need only look to the long list of defunct internet companies from the late 1990s or the more recent list of white-heeled boutique banks that didn’t make it out of the 2008 financial crisis. In most cases, the firms that emerged had strong risk management programs and decisive leaders who executed on clearly defined recovery plans.

That is why now is the time for companies to begin working on the following three return-to-work steps:

  • Build a return-to-work plan.
  • Work through the stages of partial and full operations.
  • Increase resilience through monitoring for possible virus resurgence, completion of after-action reports, and program enhancements.