No matter what the size of your business you should have a cybersecurity strategy. Yes that means if you run a part time business out of your home you need a cybersecurity strategy. And of course that also goes for every other business of every other size small to big.

There are plenty of lessons learned and resources that can start you on your way to creating a great cybersecurity strategy. Smaller businesses should see the new cybersecurity toolkit curated by the Global Cyber Alliance. Larger businesses probably already have a strategy and it could include multiple sub-sections covering topics like incident response, vendor/supply chain management, employee onboarding etc.

But one thing every security strategy has in common is that it is, at best, only good for a brief period of time. Your business is changing in ways that will require the strategy to change. Your technology infrastructure is changing in ways that will impact your cybersecurity strategy. And, perhaps most importantly, the threat actors are changing.

Agility is key!

To aid in your agility OODA produces a daily curated product capturing the latest in cyber threats, changes to the tech landscape and recommendations for you action to optimize opportunity in this dynamic environment. Sign Up Here.

And if you could use some external assistance in reviewing your cybersecurity strategy or incident response plans please get in touch. I’d love to help you out with that.

Perhaps the greatest model for fast decision in adversarial environments was articulated by Air Force Colonel John Boyd, a fighter pilot who saw service in World War II, Korea and during the Vietnam War. During his time at the Air Force Fighter Weapons School he became so highly regarded he was nicknamed “40 second Boyd” because that’s all it took for him to gain winning advantage over any other pilot.

He was asked to articulate his methods and described his decision-making as a dynamic process called the OODA Loop, where OODA stands for Observe, Orient, Decide and Act.

The OODA decision-making process has been shown to apply very well to just about any situation where dynamic competition is underway, and is now very influential in business and strategy. OODA is a model so critical to operational success in the modern world we named our consultancy, OODA LLC, after it.

OODA LLC is comprised of a unique team of international experts (see About OODA LLC). Our team is capable of providing advanced intelligence and analysis, strategy and planning support, investment and due diligence, risk and threat management, training, decision support, crisis response, and security services to global corporations and governments.

OODA helps our clients identify, manage, and respond to global risks and uncertainties while exploring emerging opportunities and developing robust and adaptive strategies for the future. OODA provides services in the domains of Security, Technology and Opportunity. For more visit OODA.

OODA LLC has contributed to cybersecurity assessments on both side of M&A transactions. We have helped acquiring firms better understand the digital risks and security posture faced by the firm they are going to acquire, and we have helped firms that want to be in a better position to be acquired ensure they have taken prudent steps to reduce their digital risks.

If you are on the buy side of an M&A deal, you will want to make sure your cybersecurity due diligence delivers the information you need. This includes:

• Information that may point to not yet revealed cybersecurity problems
• Estimates of the cost to remediate cybersecurity issues
• Information on the risk due to cybersecurity issues, including quantification if possible, since it could impact decisions on whether to consummate the deal or negotiate down the purchase price
• Indications of compliance problems
• Understanding of security frameworks/approaches
• Understanding of the security architecture
• Awareness of breaches and how they have been responded to

If you are on the sell side of an M&A the information above should motivate you to focus on your security posture. Other considerations include:

• Does your entire executive team understand their role in cybersecurity?
• Do you have strong governance (policy, process, leadership) that supports your security compliance requirements (which may well include, for example, the Gramm-Leach-Bliley Act (GLBA), FFIEC, FINRA, FISMA, HIPAA, HITECH, Fair Credit Reporting Act (FCRA), and others
• Do you have an up to date, actionable cybersecurity policy? Do you have an incident response plan? Do you have a privacy policy that is actionable and applied?
• What is the status of your technical defenses?
• Have you had appropriate independent verification and validation of your approach to cybersecurity?

Whether you are on the buy side or the sell side of an acquisition, we recommend you start with a cybersecurity assessment to cover all aspects of cybersecurity people, process and technology.

For more information see OODA LLC Technology Due Diligence Services

Part of what was different was the implications of privacy that many of us saw coming. Few were as prescient as Kord Davis, who ran a series at CTOvision on the Ethics of Big Data (which was the topic of a book he published in 2012 by the same title). Lots of us are thinking about Kord’s words of wisdom these days. Techies everywhere, especially data scientists, have also long been tracking the ideas of DJ Patil, the first US Chief Data Scientist, who has advocated that data scientists and executives and leaders of all types understand the ethical dimension of what we are doing. DJ captured many elegant thoughts on this topic in a widely read post on medium at “A Code of Ethics For Data Scientists.”

DJ and Kord are not alone. Many technologists, business leaders, politicians, academics informed citizens have been tracking these issues for years.

Then all of a sudden, surprise surprise surprise. On 17 March 2018, TheGuardian reported that a political research and data science firm called Cambridge Analytica had inappropriately harvested data from the Facebook profiles of over 50 million of us who had not provided consent for their data to be used for political and psychological profiling.

In discussion with techies, as well as with my surveillance of the social media of many I admire, it seems few were really surprised that this sort of thing happened. Similar things seem to happen all the time, including data from Facebook being used for multiple political research efforts and campaigns over many years. In fact, it seems Facebook is mostly mad because they were not paid for the data use that they normally like to monetize directly through the sale of targeted ads.

It is time I pointed out a very good thing about the present situation with Facebook and Cambridge Analytica. It has woken up many others to the issue. That growing awareness may help us address the challenges.

Some opinions:

Just like we should not trust either Apple or the FBI to make the right decisions regarding encryption and data privacy, we should not trust either Facebook or Cambridge Analytica to make the right decisions regarding information privacy.

Policy makers need informed inputs on this an many other ethical debates, and technologists are well poised to help educate and inform the debate based on our insights.

So, all of us who are students of technology or developers or leaders of tech teams should take it as a duty to help others understand.

We should also consider not just our own ethics, but how to inform others on the potential damage that can be done by data. This includes, unfortunately, the potential for damage when the data is being used in exactly the way it was designed to be used.

Another point: Humanity can fix this stuff. It will take collective action, which can and probably should include government regulation. But we can fix it.

As you dwell on your role in fixing this challenge, please keep it in context. I know we can fix this issue and it needs to be a priority. But frankly I believe there are even more significant problems for us techies to help address. An example follows:

The Information Warfare Threat To The United States

Privacy threats are one important component that can feed adversaries of democracy. But there are other challenges. We have produced a draft study on the threats to democracy of information warfare. It has been briefed to 100’s of senior leaders in government and in the national security space around government. Based on feedback we will spend much more time on this topic in the coming months including launching a new series on at CTOvision. If you are interested in contributing ideas to this effort please get in touch. We are especially interested in guest posts from technologists who have ideas on how to mitigate information warfare threats.

The Information Warfare Threat To Your Business

These serious topics should result in actions being taken to reduce the risk to your business of cyber attacks and information warfare. The good news here is that best practices in cyber defense are widely known. And now that we see a rising storm we should all be motivated to move out on those, right?

For more please see: OODA LLC