Tag: CIO

CIOs keen to drive consequential-innovation

Dr Will VentersLeave a comment

A couple of weeks ago I chaired a Global CIO Institute conference, hosting a dinner, various talks, and round table discussions with CIOs.

What has struck me during all these interactions was the marked contrast between these CIOs at the coalface and the topics obsessed upon by LinkedIn/academic/journalistic style discussions. While CIOs are interested in topics like digital transformation, AI, robotics, data-lakes and lakehouses, the API-economy and the rise of ChatGPT (the usual LinkedIn fare) these were not what drove them. Their interest was much more on safely driving consequential innovation within their company’s line of business.

Of significant interest within this was the need to manage various forms of risk. Risk was not to be “avoided” – or as Robin Smith (CISO) at Aston Martin put it, we need to promote “positive risk taking” for innovation. All intervention generated risk. For some this manifested as needing guard-rails around IT innovation so creative and innovative staff were not constrained by the risk of a catastrophic failure. This was particularly true as low-code and citizen development expands. For CIOs, developing a culture of innovation demanded systems that allowed innovations to fail safely and elegantly.

Risk-taking behaviour within innovation was only one risk they face. Sobering conversations concerned external sources of risk and the need for business resilience in the face of pandemic, war, and cyber-security challenges. Any innovation in digital technology increases the potential surface-area that companies can be attacked through. This demands ever more sophisticated (and expensive) technical countermeasures but also cultural changes. While attention is driven towards the use of AI (like ChatGPT) for good, nefarious actors are thinking about how such tools might be used for ill. For example, attackers can use emails, telephone calls, and deep-fake video calls to sound, and even look, like a company’s CEO or top customer asking for help[1]. How can CIOs ensure their staff do not fall foul of these and various more technical scams? How can trust be established if identity is hard to prove? What happens when AI is applied to exploring possible attacks through Public APIs?

Also of significant concern was keeping-the-lights-on with their ever more demanding and heterogenous estate of products, platforms and systems. One speaker pointed out the following XKCD cartoon which captures this so well. The law of unintended consequences dominated many of their fears, particularly as organisations moved towards exploiting such new-technologies in various forms.  

 Source/: https://xkcd.com/2347/ (cc) XKCD with thanks).

What was clear, and remains clear, is that we need to have a view of the enterprise technology landscape that balances risk and reward. While commentators ignore the complexity of legacy infrastructure, burgeoning bloated cloud computing estates, and the risks involved in adding more complexity to these, those tasked with managing the enterprise IT estate cannot. 

These thoughts are obviously not scientific and are entirely anecdotal. The CIOs I met were often selected to attend, the conversations were steered by agenda etc. But they did remind me why CIOs are not as obsessed with ChatGPT as everyone might think.

[1] An executive from OKTA gave the example of this for Binance exec says scammers made a deep fake hologram of him • The Register

Header Image “Business Idea” by danielfoster437 is licensed under CC BY-NC-SA 2.0.

Netskope’s approach to Shadow IT security.

Dr Will VentersLeave a comment

On Wednesday last week I attended “Cloud Expo Europe” at London’s Excel centre. One of particularly interesting product was Netskope (also a finalists in the UK Cloud Awards) who are addressing the challenge of ShadowIT – employees use of cloud-services which are not sanctioned by the corporate IT departments.

According to Accenture (2013) “78% of cloud procurement comes from Strategic Business Units (SBUs), and only 28% from centralized IT functions”. Without some form of control the data-protection and compliance challenges of this can prove a huge. Users are also poorly skilled in making rational decisions about the safety of company data and products like Netskope address this by examining fire-wall logs or running Proxy servers and providing an easy interface so IT departments can enforce cloud access policies. The product analyses users’ access patterns and sends alerts, encrypts content on upload, blocks cloud transactions and quarantines content for review by Legal or IT. It essentially monitors and stops employees doing anything risky.

For me, the value of this product is the database of different cloud services with detailed information as to their safety and compliance. The product is however also really frustrating. At its heart is the assumption that the job of the IT professional is to monitor, control and police employees. This puts IT in opposition to the other business functions. Why couldn’t this product have instead started from a different assumption – that employees are, mostly, just trying to do their work as efficiently as possible. While a few are bad, most are just ignorant to the risks. Netskope would have been fantastic if it instead helped reduce this ignorance rather than policing users’ failures.  Had it provided an employee-portal to allow employees to evaluate cloud services prior to adoption it would have promoted the effective use of them, and allowed users to make rational decisions on their adoption. The IT department would be in a facilitation role rather than a policing role, and employees would feel in control (rather than in fear). The safety would be just the same (with Netskope policing policy) but with users feeling part of that effort. Productivity gains might also be achieved as users are freed to try using new valuable IT services knowing they were doing it safely and with management approval.

This isn’t to criticise Netskope for what it does do – but to call upon new approaches to thinking about the role of IT and the CIO in this cloud-future.