8 minutes to change the way the world banks

minutes to change the way the world banks

David Gee was a judge at the recent Citi Mobile Challenge in Sydney where innovators were given 8 minutes to pitch their mobile apps. He discusses his top picks.

Last week, Citi held the Sydney leg of its Mobile Challenge, which gives FinTech developers worldwide a chance to compete against each other to create innovations that work with existing Citi technology.

The Citi Mobile Challenge in Asia-Pacific is a next-generation accelerator that combines a virtual hackathon with a developer program, and worldwide network of FinTech experts, to help create solutions across more than 100 markets.

There were 17 finalists in the Sydney Citi Mobile Challenge, primarily from Australia but also the US, Spain, and New Zealand. It is interesting to note that there were more finalists at the same events in Bengaluru, Hong Kong, and Singapore. The perplexing question is, does this reflect on the quality of FinTech startups in Australia?

It is always tricky as a judge to work out and calibrate what looks like a slick presentation versus a demo that has real potential with a significant value proposition.
To make this assessment, I was there with 45 other judges to rate pitches (innovators were given a maximum of 8 minutes) using the 5 star evaluation criteria on a mobile app.

This included the following criteria:

• Benefit for the user
• Business potential
• Customer experience
• Technical functionality

What was trending?


Wealth investment was clearly over represented with Macrovue, Quant Stats, Simply Wall Street, Gold Bean, SAGE and Wealth Projector with variations of investment portfolios.

A few of the presenters added that they had ‘robo-fund’ functionality, which appeared to be the latest buzzword that everybody wants to quote. All of these startups had some differences but it is undeniable that it was a crowded space in this single pitch event.

Wealth Projector used a gamification approach and had a very nice UX. It noted that the average time spent on the app was 18 minutes, which is quite a reasonable active engagement for such a tool. To me it was the pick of this genre of demos.

There was also a strong trend towards no or low cost platforms such as Mclowd, a self managed superannuation fund, and First Step, which operates as a sweep function for putting small change into an investment vehicle. There were clearly a few judges who like the niche market that this was targeted at.

What was unique?

A startup named Capital Preferences was an interesting risk management approach that used game theory to understand investor preferences. This sounds complex but it was executed simply and made into a task of choosing between two different axis constraints that have different paybacks.

Another demo named Citi Rewards was an entertaining approach that used geo zones to make relevant dining offers. We all thought that this sounded good, until you get overloaded with too many offers, and this would become SPAM.

A startup that I mentor, KnowledgeFlux, was also unique (and while I am biased) it clearly had a very rich proposition that was unlike any other. KnowledgeFlux demonstrated the concept of collective intelligence and how this can be applied to integrate loan processes with information and collaboration.

Wearables and FinTech?


Another startup named Strap presented its app, which interfaces to any wearable that you may use using a standard Citi API. In the demo it was all about Citi providing reward points for the more steps that you take. Perhaps not the most realistic use case.

For me, I can that imagine that a life or health company would consider this as an active risk monitoring approach.


Blockchain for smart tenancy contracts
 

One of my favourite innovators was Michael Smolenski from Lend2Fund, which uses private Blockchain technology and has applied this to standard paper contracts to be digitised into smart contracts with real-time settlement.

His use case outlined was around how landlords not receive their monies for a month lag time. (This was previously deposited into a trust account, with a delay on getting your hands on the funds)

With the future advent of “smart contracts” which have additional information about the contract, terms and deposits, payments could be made into a Citi app and the monies are available instantly. Citi is then rewarded with a transaction fee.

But of course, the bank also the opportunity to cross sell for loan products or perhaps reward payments for on time payment.
Smolenski also made reference to the concept of a virtual credit bureau, and he made a startling comment that if this happens, then the current enterprises that do credit services will be challenged:

 “Veda and Experian could be obsolete,” he said.

In the startup world, it is clear that there are major differences in the capability of the different teams and Citi, like any other corporation, is trying to connect with its customers in new ways.

This is clearly a great approach for this international bank to ensure it is exposed to some great talent and innovative ideas.

There were no winners announced at the Sydney event but for most of the startups, the reward was in connections and the network that was at the meeting.

Are ERP ‘dinosaurs’ on the road to extinction?

David Gee asks if the ‘big two’ ERP giants have seen their day and are making way for more nimble enterprise software players.

In a past life I was an IT consultant. During this time, I always found it rather interesting that the vast majority of organisations would invest millions of dollars into enterprise software marketed by the big three – Peoplesoft, SAP, and Oracle (before it bought PeopleSoft).

At the time, there was a constant stream of companies building business cases to make large investments in IT transformations.

Now, these projects were not easy; they were often delayed or not delivered at all. This is not surprising given that enterprise software is a complex beast.

But things have moved on since those days of client/server computing. Everyone’s moving to the cloud and delivering services to their highly mobile user bases.

For the most part, the likes of SAP and Oracle have struggled to keep pace with this change. This begs the question: Are these ERP dinosaurs on the road to extinction?


Will the force awaken?

The release of the latest Star Wars film, The Force Awakens, reminds me that there’s a new force that has woken up and we are now seeing a fresh class of apps that are attacking what was impregnable territory.

Vinnie Mirchandani discusses this in his 2014 book, SAP Nation 2.0: an empire in disarray. We are seeing pure cloud players such as Salesforce, NetSuite, Workday, and Ramco, taking on the ERP behemoths.

We’ve reached a tipping point as these new cloud and mobile-enabled solutions – which operate ‘capital free’ at third-party cloud service providers – gain in popularity.

Most enterprises started using cloud (to cut costs) and mobile (forced by BYOD). There also was a shift within these organisations towards customer experience and digitalisation.

This shift has been kick-started by many organisations that use cloud services for storage (through AWS and Microsoft Azure, etc) and CRMs such as Salesforce.

These are key core enterprise systems, not subsystems. Such change is not going to happen overnight as enterprises have made significant investments and are slowly depreciating old assets.
But there are compelling reasons to stop and look at an alternative world.

Clearly if you were starting a new business, you would have to think long and hard about using a dinosaur and instead start with one of the new breed of cloud apps.

Enterprise apps build for cloud and mobility

Recently, I came across a company named Ramco – which is a subscription offering just like Salesforce. The surprising thing was that it is a fully featured ERP and payroll system that operates in the cloud and with ‘mobility by design.’

It is not a point solution but a fully integrated ‘platform-as-a-service’ that provides rich functionality just like SAP and Oracle.

Where it starts to separate itself from the big boys is that it is also quicker to implement and cheaper – we are talking months not years of effort.

But for me the biggest factor was the design, which has mobility built in and it’s not an add-on. One simple example is a concept called Mail it by mailing “AL” to an email address, your annual leave balanced is returned.

Similarly, if I want to request annual leave or a salary slip, it’s all done over email. Or if I want to get a new hire approved, it’s a mobile task on your browser or even SMS.


The concept of Zero UI


By definition, Zero UI is the concept of removing the barrier between user and device, and having a more seamless interaction with technology. It is all about making the experience very intuitive and natural.

A great example is the concept of a timesheet and we all hate to fill these in at the best of times.
Ramco’s mobile app has a location-aware timesheet. It knows where you are and will automatically provide a SIRI-like response to help you through a task that you don’t enjoy.

These are not extra add-ons but ‘out of the box’ functions that you can use or ignore as it comes with a standard subscription product.


Add some machine learning

These products also observe your behaviour and once a pattern is established, they suggest a workflow action using a ‘Prompt it’ button.

An example is a routine approval that a manager makes every week, and you are prompted with options to make a decision. No, it’s not big brother but the system observing what is normal and suggesting a few logical options.

But if you don’t like that you can also control your own screens and processes. This is actually at a
‘user’ level and not a ‘group’ basis. The feature, called “Hub it”, allows you to create your own view of the world.

Does the empire strike back?

Obviously, I don’t know how the next Star Wars movie will unfold because it’s being released near Christmas, but in the case of enterprise apps, the more nimble cloud and mobile players will give the legacy vendors a real run for their money.

In fact SAP, Oracle and others are all trying to play catch-up and create cloud solutions. SAP has just announced its SAP Fiori technology to port applications to mobile devices.

Either way, it is clear that the dinosaurs are trying to survive and the question is, ‘will they be able to thrive over the longer-term?’

Perhaps we will know the answer by the time Star Wars VIII is released.

Are ERP ‘dinosaurs’ on the road to extinction?

Digital is the Glue for Business – Cyber Security can make this unstuck

Every business is addressing Digital as the approach to drive a better customer experience and to reduce costs through the introduction of self-serve channels.


In the Digital world, everything is open 24 hours per day and that is the basic expectation. Recently SKYPE had an unexpected outage and all customers received an apology with an offer for a week’s free calls.

We expect systems to work 24x7 and that there be no downtime. I’ve seen myself access closed on weekends for basic maintenance and have to do a double take. Oh yeah that’s correct.

Digital is clearly the Glue for Business, even in Australian Government we are seeing the focus on ‘e’ across all portfolios and there are a series of Digital Disruption Government Conferences that have emerged.

Moving into the Digital era, means often that you require capabilities that are not in-house and therefore have to be acquired. This starts to open the Enterprise Fortress and while, openness is not a bad thing this has significant implications for security.

These partners also become the targets for cyber security hackers, which is sobering and we all have existing vendors that may or may not meet the security requirements that we enforce in the Enterprise. If they don’t then it is clear then that you are accepting that risk whether you realise it or not.

 

Accenture have noted in a recent Strategy document that: “Downtime is not just costly but untenable. Failures and hostile cyber actions have profound impacts on enterprise performance—even enterprise viability”.


CXO Oversight


In every organisation there are usually two CXO parties that are responsible for Cyber Security. This might be the CISO and CIO \ CMO\ CRO or in many organisations this also includes the CEO.

Cyber Security is all about protecting one’s reputation and in a Digital world this is not a domain that can be delegated. It is becoming too important and every breach that has occurred and is going to occur is going to reinforce this position.

The CEO has to take this onto his personal agenda, if he or she doesn’t then it will result in scenarios like we saw in Target USA and many other organisations.

It is reality that cyber security is no longer a backoffice concern and the expectation of Digital Resilence. Our thought leaders at McKinsey have noted that this shift from cyber security as a control function is in the past.

There is a greater integration of Digital IT with Business Processes (the Glue), and with these raised stakes Cyber Security becomes critical.


Extending the Perimeter

This means that our staff, their families and partners that we work with all become part of the security ecosystem. With this scope it is not really possible to simply extend the security perimeter but we have to find mechanisms to educate and provide safeguards for these players.

It won’t be acceptable for staff or partners not to take cyber security policies as serious and it becomes a dismissible offence.

The CEO will also have to provide the input around risk – resource tradeoffs. To actually assume more risk has a real cost and that’s not just Cyber Security Insurance Premiums but largely reputational risk.

For any Digital business ‘trust’ is a critical element of the transaction. It is assumed that you can trust this organisation with your sensitive and valuable data. Any breach of that trust has a cost that is impossible to fully recover from. Just ask any of the Executive teams from organisations that have had major cyber security incidences.


A growing challenge for CMO

Enterprises will progressively embrace greater sources of data and even in the absence of Big Data, this will be sources of data from objects, such as sensors, drones and devices.

Some cool data, but of this information will be sensitive and private. It will require the CXO – perhaps the CMO to be working with the CISO on understanding cyber security which becomes part of the brand.

​What would you do if you received this message?

This was shared with me, earlier this week. It is a fascinating read……

Let me stop here and let you enjoy this.

So what do you do?

You already have been bombarded with 4 million packets per second and you know that it is only time until your system vulnerabilities will start to be exposed. Actually you don’t really know what will happen, as this is the first time you have witnessed this event happening before your eyes.
Once you have got over the poor English language that has been used in the message, it dawns on you that ‘Houston we have a problem’
So what are your options:

• Call your Telecom provider and ask for their assistance?
• Get out that business card and buy a DDOS service?
• Go online and buy 100 bitcoins?
• Pray like hell or go straight to the pub?

Option 1 your Telco Provider

 

This is when you try to call in the favour and get your partner to help.
Of course this all depends on your business scale etc and how long you have been working together. However it is unlikely that they would support you, as the attack will start to effect their own service.

Option 2 Buy DDOS

 

There is no time to negotiate the rate, so it will be at the top of the range of the price book. It is likely that you will need to escalate the approval as it is outside of normal delegated authority.
You will expect that while this measure will work, that there will be questions asked from Risk Committees, Procurement and others about why this transpired. While you may get the organisation out of trouble, you may have landed in it along the way.

Option 3 Buy Bitcoins

There is never a fast way to acquire Bitcoins, unless you have already traded in the past and have already completed the normal KYC process.
If you do have Bitcoins, then you will also be suspicious that this is not going to be the end of the demands.

 

Arrhg……


Option 4 - Pray like hell or Go to the Pub

Sorry, this will only serve to soothe you and numb your feelings. But actually not have any added benefit to the situation.
It may be cheaper than 100 bitcoins, but your career may be over and there’s not much that you can do.


The Real Case Study 

In this real life example, that occurred option 2 was chosen by the client.
They actually had a DDOS service that was in-place and they had tested this on a periodic basis. The SLA was 15 minutes and this was nearly met, however there was human judgment involved and that delayed this by a few additional minutes.

As the business was an online mobile based company, any outage would have dire consequences and the hackers chose the perfect time to strike – which happened to be at an expected peak time.

Once the network traffic was diverted via the DDOS provider, the danger was averted and in effect the attack was abandoned………Life reverted to normal.

Read more ​10 Cyber Security Startups to note

Some Learnings

At the time of the crisis – a 3^rd party organization was engaged to provide the Network and Cyber Security monitoring and they took the necessary and express actions to address the issue. They told me this story and to protect the innocent they have declined to be named or to share their client’s name.

This is even when things actually worked out well.

The other learning was that it was expected that this organization could withstand up to 500MB before the firewalls would start to drop packets and become useless.
However the learning was that the packets that were sent to flood the firewall were designed to maximize damage and the issue kicked in much earlier than expected at 300MB of bandwidth.

It is not impossible but actually very hard to practice such a scenario.

Have you been Pwned?

Ummm, yes I have and I didn’t know that I had.

From Wikipedia – “Pwn is a slang term derived from the verb own, as meaning to appropriate or to conquer to gain ownership. The term implies domination or humiliation of a rival, used primarily in the Internet-based video game culture to taunt an opponent who has just been soundly defeated.
"You just got pwned!" well I did anyway and here’s the proof:

A Quick Check 


Thankfully it is easy to check, just go to the URL below.


https://haveibeenpwned.com/






Passwords are dead

Now I have your attention, let me talk about Passwords.

 

“Open sesame”, was the famous passcode that Ali Baba used to gain access to the legendary treasure.
In Hebrew, the word “Sesame” has connotations for being the name of heaven.

For hackers, this is indeed “heaven” and gaining access to a password provides more than a simple way to feed the family. Passwords are the bane of our everyday existence and for most of us we struggle with the different requirements of expiration and format.

It might surprise you that the average person has 17-19 different passwords and uses around 8-12 per day. In our working day, we cope with around 6-7 just at our place of employment. Then when we want to relax, and use the internet we have to use a further 4-5. So much for chilling out!

It is not the daily websites that are an issue, but the more infrequent ones, where we just have little hope of remembering these passwords.

Data Breaches

With so many passwords and these having different rules and expiry dates. This just exacerbates the current situation.

Not surprisingly with so many passwords it is often the case that users, or should I say the average person will therefore tend to use not as “strong” passwords and also likely that they have duplicates.

Recent evidence is that more than 60% of all data breaches came from weak credentials and user authentication. We have a problem and the current approaches don’t work.



Authentication Sucks


The fact is that around 70% of users forget their passwords every month. It was embarrassing as a CIO to be calling the helpdesk to reset my password, but like many others we fall victim of multi tasking.

Authentication as it stands – does suck. We need a more intuitive approach and the hypothesis is that we need a pattern to remember our passwords. The usual good advice is to use a poem or rhyme to help you make this mental recall eg.

Mary Had a Little Lamb = MHALL



Biometric sensors

We are all now using smartphones with gestures or biometric sensors. It is a great improvement over typing in on that little virtual keyboard. I recall reviewing the patent of the biometric touch for the iPhone, which was a number of years ahead of this being launched.

It is however fascinating to look at what more recent Apple’s patents. They have patented full finger (multiple fingers) patents. Of course let’s remember that the importance of using one’s finger is that it provides that third factor authentication. This is critical for payments and Apple Pay will be using a biometric approach to approve the transaction.

They are taking this one step further with the concept of User ID using Plethysmography, which my understanding is a combination of motion, gestures and light movement. Thus in the future we can use a gesture, not unlike the movements used at the gambling table to make a bet etc

Apple is doing some R&D on using biometrics on a TV remote, just imagine your remote knowing David’s preferences and what alternatives you like. Just an exciting development, but based on Apple’s normal innovation process this is going to be a few years away.

But back to security…..


Continuous Monitoring is the answer?

Where I would place my bet is where you can use a number of sensors to validate myself. The theory here is that using Machine Learning it will monitor a combination of sensors.
 
How fast and how you type and such key-stroke patterns would understand your normal tempo etc.

But what happens that day that you are not feeling 100% or perhaps jetlagged.

Your device is therefore your monitor and will also be listening to how you speak and what you say?

Thus this is not binary – Yes or No Password, but continuous monitoring that develops an ongoing trust score that is authenticating you in real time on your device. Our friends at Google are working on this approach.

Will this mean the end of being Pwned? I’m not sure, but clearly I could be using “Open Sesame” as my password and with continuous monitoring this may be enough to validate who I am.

​Interview: Colin Weir, CEO, Moroku

Moroku's gamification technology is getting some attention from the largest banks in the world.

David Gee (CIO) 23 October, 2015 12:08

Fancy a game with that banking transaction? Most people don’t expect banking to be fun and pretty much want to get ‘in and out.’ But Sydney-based startup, Moroku, is changing that with gamification technology that is getting some attention from the largest banks in the world.

CIO sat down with Moroku’s CEO, Colin Weir to discuss what motivated him to start the company and its core objectives.

CIO: Gamification provides a distinctly different customer experience. Can you outline the strategic drivers behind Moroku?

Weir: The unfortunate truth is that after spending billions of dollars creating banking systems, banks are well off but the customers are less so. In the developed world, we are hooked on debt, spending billions of dollars on interest and fees at exorbitant rates.

In Australia, the average savings at retirement is $130,000, in America it’s the same and in Europe, 20 per cent of the population risk spending their lives in poverty once they retire. In my opinion, that just isn’t good enough for some of the wealthiest countries in the world.

CIO: So with that in mind, what are your core objectives?

Weir: We want ordinary people to save more than they spend and retire well – not in poverty. We want people to be able to look at the holistic journey of 30 years work, with house paid off and no debt. In essence, shifting from share of wallet, to making the wallet bigger for each customer.

CIO: How do you make banking fun but still business-like?

Weir: Like with many things, it just starts with awareness: Awareness that a focus on product, interest and fees is perhaps not the most sustainable of models.

There are an increasing number of banks and regulators around the world who are turning their attention to a new model, one based on liquidity and growing the overall size of the revenue pool based on customer success.

As we do this, we find turning to game design a very useful approach. Game play in all sorts of its variations is very good at thinking about the core set of skills and capabilities the customer needs to acquire in order to get to the next level and win.

This serves us very well when we think about the skills and capabilities customers need to win, and how banks support their customers’ financial journey through a digital experience.

From all the research we have done, our dopamine-based reward system actually hard wires us for fun. We firmly believe that for banks to win, their customers need to win. If customers are going to win we must find a way to lead with fun.

CIO: Can you explain how and why customer engagement is improved by this novel approach?

Weir: Engagement is improved by applying ‘fun to use’ as a design paradigm and coupling it with social connection to drive engagement and care factor. When we do things that are fun dopamine is released in the brain and triggers our reward centre.

The return on investment is very measurable; Bain research shows that customers who engage with companies over social media spend 30 per cent more than those who don’t and demonstrate a deeper emotional commitment. Engaged customers buy more. Our pilots will prove this out and get data to support this.

CIO: What’s the user experience philosophy behind Moroku?

Weir: The first thing we do is think about customers as players and their journeys. Whilst user journeys are employed in ‘human-centered design’, these are often conceived as a journey within an app.

Rather than thinking about what the bank to winning, we first ask what does winning look like for a customer. We ask questions around the skills and challenges for people get good at managing cash and progress to being great.

From there, we employ a combination of design principles and mechanics from gaming, coupled with behavioural economics and insights from Maslow and Pavlov.

 

Games are very good at on-boarding new players, we then look at a range of feedback loops that can be implemented to corral the user and nudge them along. Our belief is that ‘ease of use’ has run its course as a design principle. If we don’t move to ‘fun to use’, we will be left behind.

The Moroku GameSystem interface

CIO: What’s the basic architecture behind your technology?

Weir: The Moroku GameSystem has 4 components. We build customers apps from a baseline set of mobile libraries. The platform’s designed with a rules engine at its centre. This allows us to tweak
some of the experience on the fly without releasing new versions.

Non-banking interactions are all delivered through cloud based GameServer. As no personally identifiable information is held within the GameSystem, enabling us to support most banking regulations with regards to the use of cloud infrastructure.

An anonymisation service connected at the bank side manages the relationship between the GameSystem player and actual accounts at the bank.
Customisable standard reports are provided to measure performance and behaviours such as payments made, click through rates and customer acquisition.

Plus the API is provided to integrate GameSystem with the bank’s payment and internet systems. This enables the registration process to be presented via the bank’s internet banking platforms.

We’ve built everything from scratch. One rarely gets to start with a white canvas but this has really helped us build and own something which gives us flexibility and agility around our core challenge.

CIO: Who’s using your technology right now?

 

Weir: We have a customer already live in Europe. Their target market is young savers, as they search to appeal to millennials and the next generation of banking customer. We have a number of prototype and pilot engagements on the boil too.

Our target market for this year is Asia and we are seeing a broad range of interest from unbanked, under served, retail banking, wealth management, high net worth, and insurance-based customers.

CIO: Any talks with Australia’s big 4 banks or other global banking organisations?

Weir: Our participation in the Accenture FinTech Lab has given us great engagement with a dozen global and regional banks, including CBA. The 12 week program finishes up on November 4. I’m confident that we will come away with 3 to 4 new customers from the Asia Pacific region.

CIO: How hard was it to integrate your ‘games’ front end onto existing mobile or online banking functionality?

Weir: This integration is relatively easy and we plug into existing online and mobile channels.
It’s not a silver bullet. If we’re planning on getting customers to save more, or pay off their debt earlier, we need everyone in. This message then needs to be supported through a broad range of customer communications to ensure it has integrity.

Lastly we need to drive the analytics hard. It’s a science and as with the best science it involves a series of experiments that get us moving closer and closer to the truth with each iteration.”

CIO: How quickly can a new bank deploy Moroku?

Weir: Our typical project commences with a 2 week scoping engagement to understand the strategic customer objectives and how that may play out as a digital experience. Then we identify opportunities for integration, cloud, security etc.

We then run 8 – 12 week build and learn cycle that see these concepts become real and deployed into the hands of customers to validate and test assumptions.

CIO: What are the key attributes of your team?

Weir: We have 3 values that we look for – courage, curiosity and creativity. These are our tickets to the game and you don’t get to a skills interview without them.
 

The first is a combination of confidence, awareness and openness; to know who you are. Our engineering teams possess a blend of mobile and cloud skills coupled with solid software engineering principles.

Digital is the Glue for Business – Cyber Security can make this unstuck

Every business is addressing Digital as the approach to drive a better customer experience and to reduce costs through the introduction of self-serve channels.


In the Digital world, everything is open 24 hours per day and that is the basic expectation. Recently SKYPE had an unexpected outage and all customers received an apology with an offer for a week’s free calls.


We expect systems to work 24x7 and that there be no downtime. I’ve seen myself access closed on weekends for basic maintenance and have to do a double take. Oh yeah that’s correct.


Digital is clearly the Glue for Business, even in Australian Government we are seeing the focus on ‘e’ across all portfolios and there are a series of Digital Disruption Government Conferences that have emerged.



Moving into the Digital era, means often that you require capabilities that are not in-house and therefore have to be acquired. This starts to open the Enterprise Fortress and while, openness is not a bad thing this has significant implications for security.

These partners also become the targets for cyber security hackers, which is sobering and we all have existing vendors that may or may not meet the security requirements that we enforce in the Enterprise. If they don’t then it is clear then that you are accepting that risk whether you realise it or not.



Accenture have noted in a recent Strategy document that: “Downtime is not just costly but untenable. Failures and hostile cyber actions have profound impacts on enterprise performance—even enterprise viability”.

In every organisation there are usually two CXO parties that are responsible for Cyber Security. This might be the CISO and CIO \ CMO\ CRO or in many organisations this also includes the CEO.

Cyber Security is all about protecting one’s reputation and in a Digital world this is not a domain that can be delegated. It is becoming too important and every breach that has occurred and is going to occur is going to reinforce this position.

The CEO has to take this onto his personal agenda, if he or she doesn’t then it will result in scenarios like we saw in Target USA and many other organisations.

It is reality that cyber security is no longer a backoffice concern and the expectation of Digital Resilence. Our thought leaders at McKinsey have noted that this shift from cyber security as a control function is in the past.

There is a greater integration of Digital IT with Business Processes (the Glue), and with these raised stakes Cyber Security becomes critical.

 

 

Extending the Perimeter
This means that our staff, their families and partners that we work with all become part of the security ecosystem. With this scope it is not really possible to simply extend the security perimeter but we have to find mechanisms to educate and provide safeguards for these players.

It won’t be acceptable for staff or partners not to take cyber security policies as serious and it becomes a dismissible offence.

The CEO will also have to provide the input around risk – resource tradeoffs. To actually assume more risk has a real cost and that’s not just Cyber Security Insurance Premiums but largely reputational risk.
 
For any Digital business ‘trust’ is a critical element of the transaction. It is assumed that you can trust this organisation with your sensitive and valuable data. Any breach of that trust has a cost that is impossible to fully recover from. Just ask any of the Executive teams from organisations that have had major cyber security incidences.

A growing challenge for CMO
Enterprises will progressively embrace greater sources of data and even in the absence of Big Data, this will be sources of data from objects, such as sensors, drones and devices.

Some cool data, but of this information will be sensitive and private. It will require the CXO – perhaps the CMO to be working with the CISO on understanding cyber security which becomes part of the brand.