Against a background of board-level concern for cybersecurity, organizations are seeking to ensure the protection of their information assets and minimize the risk of a cybersecurity attack. These objectives place two particular demands on organizations: to appoint a suitable official to head up their information security operations, a CISO; and to ensure that the executive and board are appropriately informed of the organization's security status. In exploring the challenges that confront organizations in selecting a CISO, we drew on data from the U.S., Canada, and New Zealand. Two main issues were addressed. First, the organization has to be very clear on what it wants in terms of the job the CISO is expected to perform and the corresponding attributes that such an incumbent would need to possess. The CISO is a senior-level executive and rather than being a specialized technical expert, the CISO should be an excellent communicator. This will help address the second issue, which is how effectively the CISO can communicate with the board. Some suggestions are provided that serve to aid both effectiveness and efficiency. However, organizations need to embrace their concern about cybersecurity and build it into their selection criteria for board members.
Worldwide usage of mobile smart devices has increased dramatically over the past two decades. The popularity of these devices has grown as a result of their increased processing power, storage capacity, and memory; they can now hold enormous amounts of both personal and private business data. In addition to the consideration of mobile devices, the scope of any forensic investigation has also grown to include cloud environments. Previously, we proposed a working model that can improve the effectiveness and efficiency of an investigation in a multidisciplinary environment. The study presented herein, however, evaluates a straw man model derived from current practice models to identify the required improvements. The study also proposes a new improved process model known as a multidisciplinary digital forensic investigation process model.
Business use of cloud computing services is motivated by ease of use and potential financial cost reductions. Service failure may occur when the service provider does not protect information or when the use of the services becomes overly complex and difficult. The benefits of cloud computing also bring optimization challenges for the information owners who must assess service security risks and the degree to which new human behaviors are required. In this research, we look at the risk of identity theft when ease of service access is provided through a single sign-on (SSO) authorization, asking: What are the optimal behavioral expectations for a cloud service information owner? Federated identity management provides well-developed design literature on strategies for optimizing human behaviors in relation to the new technologies. We briefly review the literature and then propose a working solution that optimizes the trade-off between disclosure risk, human user risk, and service security.
Wearable computing devices promise to deliver countless benefits to users. Moreover, they are among the most personal and unique computing devices of all, more so than laptops and tablets and even more so than smartphones. However, this uniqueness also brings with it a risk of security issues not encountered previously in information systems: the potential to not only compromise data, but also to physically harm the wearer. This article considers wearable device security from three perspectives: whether the threat is to the device and/or the individual, the role that the wearable device plays, and how holistic wearable device security strategies can be developed and monitored.
The recent FBI v. Apple case has the potential to turn a 227-year-old statute law in into a tool for government agencies to gain access to personal and corporate information. Recent events such as 'Petraeus-gate,' hacked nude celebrity photos in the cloud, and the use of a search and seizure warrant in the United States seeking customer email contents on an extraterritorial server raise important issues for the supposedly safe storage of data on the World Wide Web. Not only may there be nowhere to hide in cyberspace but nothing in cyberspace may be private. This article explores the legal and technical issues raised by these matters, with emphasis on the court decision In the Matter of a Warrant to Search a Certain E-Mail Account Controlled and Maintained by Microsoft Corporation and the subsequent upholding of that decision.
Through an in-depth case study of Cisco Systems, this Executive Digest finds that companies face two broad challenges when transitioning to the agile product development model. The first is identifying and helping business units and engineering teams adopt this method; the second is developing new management practices that are compatible with and can sustain the agile development practices. Although extant literature has conducted many analyses on these two challenges, there still exist gaps in the research of the agile development method. Herein, we explore how Cisco Systems addressed these two challenges followed by a discussion of the broad implications of adopting the agile development method. This research deepens our understanding of how to adopt and lead the agile development process.
The use of managerial control ratios for benchmarking IT costs is widely accepted. This installment of Accounting Matters informs CIOs about IT managerial control ratios and the assumptions underlying the use of these ratios in IT cost benchmarking. Incorrect use of these ratios and violation of the assumptions can lead to faulty inferences and costly mistakes. This article proposes a technique for benchmarking IT costs to draw the right conclusions from the data.
From the seclusion of monastic life to the noise of Silicon Valley, the ancient practice of mindfulness has 'come out of the cloister.' As an antidote to mindless cognition and behavior, the practice of mindfulness-with its principle of grounding attention in the present moment-has been shown to have powerful and positive effects at both the individual and the collective level and in fields as wide-ranging as medicine, schooling, prison programs, law and negotiation, business, and even the army. This installment of Marketing & Technology introduces mindfulness to managers and explores its potential for enhancing the service encounter. We begin by reviewing the two main conceptualizations of mindfulness: the cognitive and the contemplative. We then explore the service encounter from the perspective of emotional labor and show how mindfulness can change surface acting into deep acting, thereby significantly improving the service encounter for both the consumer and provider. We also explore the other benefits of mindfulness and their application to the service encounter: adaptability, flexibility and creativity. We conclude by sharing resources for managers interested in implementing mindfulness training.
The sharing economy, a rising pattern in consumption behavior that is essentially based on accessing and reusing products to utilize idle capacity, presents both tremendous possibilities and significant threats for emerging as well as incumbent businesses. As of today, it is unclear whether this economy is merely another ephemeral trend in consumption or whether we are experiencing a real shift in how goods are accessed, distributed, and used. Furthermore, little is known about how existing business models are affected by the sharing economy. These two issues represent the central motivation for the development of this article. Consequently, an examination of why the sharing economy has the potential to produce a long-term transformation in consumption behavior is followed by a consideration of how this change might affect companies' business models. Based on a renowned business model framework and a variety of current illustrative examples, we propose central questions managers have to ask themselves in order to be prepared to respond to changes brought about by this new economic trend.
With the explosion of the digital universe, it is becoming increasingly important to understand how organizational decision making (i.e., the business-oriented perspective) is intertwined with an understanding of enterprise data assets (i.e., the data-oriented perspective). This article first compares the business- and data-oriented perspectives to describe how the two views mesh with each other. It then presents three elements in the data-oriented perspective that are collectively referred to as the data triad: (1) use, (2) design and storage, and (3) processes and people. In describing the data triad, this article highlights practices, architectural techniques, and example tools that are used to manage, access, analyze, and deliver data. By presenting different elements of the data-oriented perspective, this article broadly and concretely describes the data triad and how it can play a role in the redefined scope of work for data-driven business managers.
Enterprise risk management (ERM) began to take root in the late 1990s and has since become generally recognized as an expectation of good management and corporate governance. However, as evidenced by surveys and research, many companies still struggle with ERM implementation. This article explores the challenges companies face when implementing ERM and offers solutions for firms struggling with the concepts and execution. We draw upon Hydro One's experience in achieving ERM maturity as a best practice case study. The company's ERM methods have been researched and documented extensively. With over 15 years of ERM success, Hydro One is an excellent organization to benchmark for ERM best practices.
This article presents methods to help companies build processes that emphasize consumer ethnography, customer ethnography, and commercialization planning as components for innovation within mature, well-established consumer or industrial markets. It is written for multifunctional innovation teams and senior management toward increasing the success rates of new product innovations.
In late 2010,the director general of the Industrial Sectors Directorate at Environment Canada, was reviewing a draft work plan for the Air Quality Management System (AQMS), a regulatory project to deal with Canada’s transboundary air pollution problems. Though some of the key elements of AQMS were in place and director general had the support of co-chairs from Alberta and Ontario, she had to develop a series of briefings on her strategy before the end of 2010 so that she could gain approval from her deputy minister and minister.
In 2016, the founder and chief executive officer of West Paw Design (WPD) was faced with a growth dilemma: how could he align WPD’s socially responsible ethos with his desire to expand business activities in the growing pet products market? Based in Bozeman, Montana, WPD developed, manufactured, and distributed pet products. The company was a certified “B Corporation,” meaning its social and environmental credentials had been verified by an external organization, B Lab. The founder had to consider his options very carefully, because some of them could undermine or negate WPD’s growth objectives, as well as its cherished B Corporation principles.
In 2013, the chief executive officer of Porter Airlines, a Toronto-based regional airline, announced an expansion project to expand the airline’s destinations. The project required that Porter Airlines expand its fleet of jets to accommodate longer distances, and that its transport hub, the Billy Bishop Toronto City Airport, be renovated. The airport was governed by a tripartite agreement between the federal government, the City of Toronto, and PortsToronto; any amendments to the agreement required a consensus of the three governing parties. Despite active petitioning, the federal government announced in 2015 it would not support an amendment to the agreement. Should Porter Airlines continue to petition? Or should it consider alternative options to achieve growth?
In late 2010,the director general of the Industrial Sectors Directorate at Environment Canada, was reviewing a draft work plan for the Air Quality Management System (AQMS), a regulatory project to deal with Canada's transboundary air pollution problems. Though some of the key elements of AQMS were in place and director general had the support of co-chairs from Alberta and Ontario, she had to develop a series of briefings on her strategy before the end of 2010 so that she could gain approval from her deputy minister and minister.
After a year at AW Ltd., a family-owned Indian pharmaceutical company, a change management agent was disillusioned about her ability to add value to the organization or gain buy-in for her change initiative. Although she was adept at information collection, data analysis, and using tools for organizational intervention, she had failed to account for softer issues of change management in terms of people management, handling inertia, breaking power centres, and building influence. Management of group inclusion processes were crucial to build buy-in and a sense of urgency to enact change. Why exactly had her change management process gone so badly? Should she continue at the firm and, if so, what should she do differently?
In 2015, the Department of Veterans Affairs (VA) ran the largest healthcare system in the United States, with over 1,700 sites of care that served nearly 9 million veterans. One year earlier, a scandal had erupted over a cover-up of the excessive wait times veterans faced to get medical appointments in some VA facilities. The fallout led to the resignation of the Secretary of Veterans Affairs, a criminal investigation by the Federal Bureau of Investigation, and the eventual replacement of 14 of VA's top 17 leaders. This case documents the efforts of the new leadership team to improve access, regain trust, and transform the organization to address the broadening medical needs of the nation's growing veteran population.