New Global Research Reveals Industry and Geographic Variations in How Corporate Boards Understand and Manage IT Risks

The Carnegie Mellon Governance of Enterprise Security: CyLab 2012 Report is the first survey to examine how corporate boards and executives are managing cyber risks across geographical regions and byvarious industry sectors.  Sponsored by RSA, The Security Division of EMC, this is the third report conducted by CyLab Adjunct Distinguished Fellow, Jody Westby.  The report examines responses to a survey of senior executives and corporate board members from the Forbes Global 2000 list. The report reveals that corporate boards and executives are taking risk management seriously but there is still a gap in understanding the link between information technology (IT) risks and enterprise risk management. This gap indicates that boards have a lack of understanding of how all business operations are supported by computer systems and digital data and how risks in these areas can undermine operations. Less than two-thirds of the respondents’ organizations have full-time personnel in key roles for privacy and security (CISO/CSO, CPO, CRO) in a manner that is consistent with internationally accepted best practices and standards. The degree to which these roles are filled varies by industry and region.

Survey results in the report confirms the belief among security experts that, overall, the financial sector has better security and governance practices than other industry sectors. The financial sector shows the greatest degree of board attention to critical issues related to cyber risk management, while the energy/utilities and industrials sectors reveal a lack of board attention to critical issues such as vendor management, computer and information security and IT operations. The energy/utilities respondents also rank next to last in establishing necessary segregation of duties between board Risk Committees and Audit Committees.

“The increasing criticality of digital resources and the more complex threat landscapes mean senior executives and boards must get better at marrying security functions with corporate operations. Boards are asking questions about risk and IT security, now there needs to be a closed loop system with management for risk policies to assure a trusted IT environment throughout their enterprise. Senior executives and boards can’t get better at this without boosting their essential oversight and involvement in cyber risk management.” Tom Heiser, President, RSA

More than half, 57 percent, of respondents are not analyzing the adequacy of cyber insurance coverage or undertaking key activities related to cyber-risk management to help them manage reputational and financial risks associated with the theft of confidential and proprietary data and security breaches. Although boards across geographical regions are consistent in not reviewing cyber-insurance coverage, a very high percentage of respondents from critical-infrastructure sectors, such as the energy/utilities and IT/telecom sectors, indicate that close to 80 percent of their boards of directors do not review insurance for cyber-related risks.

Although Europe leads globally in privacy regulations and enforcement, only 3 percent of the respondents indicate that their organizations have CPOs.  The U.S. generally believes it is the global leader in security, but the survey results indicate that North American boards lag behind European and Asian boards in undertaking key activities associated with privacy and security governance such as regular reviews involving annual budgets, roles and responsibilities, and top-level policies.

 

Survey Highlights

 

• Respondents across all industry sectors are not assigning key privacy and security responsibilities to defined executive roles, such as CISO/CSO, CPO, or CSO, with reporting lines that avoid segregation of duties issues.
• A much higher percentage of energy/utilities (79%) and IT/telecom (77%) boards are not reviewing cyber-insurance coverage than financial-sector boards (52%) and industrials sector (44%) boards
• Asian boards (76%) are much more likely to have a board Risk Committee responsible for privacy and security than North American (40%) and European (38%) boards
• Although Europe leads globally in privacy regulation and enforcement, the respondents indicate that only 3 percent of European organizations have a CPO.  Asia closely follows with only 5 percent having CPOs while 23 percent of North American organizations have a CPO.

 

Signs of Improvement

 

A positive sign from the survey is the importance that boards are placing on IT and security/risk expertise in board recruitment as respondents ranked it very important or more important.  Risk and security expertise was even more encouraging with 64 percent of the respondents indicating that it was very important or important.  Improvements are also occurring at the organizational level in the increased number of organizations with Board Risk Committees and cross-organizational teams that manage privacy and security risks within the organization.

With the results indicating that governance and enterprise security is still lacking in most organizations, the report outlines 12 recommendations for boards of directors and senior management to help improve their organizations’ security posture and reduce risk.

“Cyber criminals today are sophisticated; they are getting inside corporate systems and stealing confidential and proprietary data. It is imperative that boards and executives take appropriate governance steps to protect their organizations’ computer systems and information. This involves undertaking key-oversight activities, obtaining independent cyber-risk expertise, recruiting board members with cyber risk and governance expertise, and reviewing cyber-insurance coverage. These are the basics; critical infrastructures have a higher duty of care. Boards that fail to step up their cyber risk management are placing their organizations at risk and could be breaching their fiduciary duty to protect the assets of the corporation, which includes digital assets.” Jody Westby, CEO of Global Risk & Adjunct Distinguished Fellow, Carnegie Mellon CyLab

• SAP® Sales and Operations Planning application
• SAP® Cash Forecasting analytic application
• SAP® Planning and Consolidation application
• SAP® Collections Insight analytic application
• SAP® Sales Pipeline Analysis analytic content
• SAP® Bank Analyzer rapid-deployment solution for financial reporting with SAP HANA
• SAP® Deposits Management rapid-deployment solution for transaction history analysis with SAP HANA
• SAP® Supplier InfoNet site

Next Generation Planning Applications powered by SAP HANA

SAP Sales and Operations Planning is a cloud-based application powered by SAP HANA and designed to help companies become more demand-driven by enabling them to rapidly translate demand fluctuations into actionable plans for manufacturing, procurement and logistics. With the new application, companies can engage stakeholders from sales, marketing, finance, supply chain and other functions in a truly integrated and collaborative planning process. SAP Sales and Operations Planning brings together the real-time computing power of SAP HANA and the social collaborative paradigm of the SAP® Streamwork® application to enable:

• Planning, using a unified model of demand, supply chain and financial data, which can be analyzed in real time at any level of granularity or dimension
• Rapid simulations and scenario comparison on a complete, detailed sales and operations planning model against multiple criteria such as demand fluctuations, product mix changes and capacity constraints
• Collaboration, using an embedded, context-aware social platform to accelerate planning and decision-making across the company

More details on SAP Sales & Operations Planning, Powered by SAP HANA can be found in this video.

“In relatively short period of time, we were able to model a significant portion of our business in the pilot environment and perform what-if scenario analysis,” said Richard Komm, director, Advanced Micro Devices. “We could adjust demand volumes and the capacity resource allocations and immediately see their impact on revenue and margins in the solution. This is something that used to take multiple spreadsheets, numerous emails and phone calls and meetings to develop an aligned plan. We feel that this solution has great potential to improve our sales and operations planning process management and accelerate decision-making and the overall responsiveness of our teams.”

“Today, our sales and operations planning process is largely manual, managed over disconnected spreadsheets, spans multiple internal teams and contract manufacturers, and it takes too much time and effort to respond to demand and supply variations,” said James Smith, director, McKesson. “We were able to assess the impact of fluctuations in capacity positions at contract manufacturers on our sales forecasts in real time, model alternative scenarios and cut our planning cycle time in half. We are excited about the solution and look forward to rolling it out at McKesson.”

SAP Cash Forecasting is an on-premise analytic application built on the SAP HANA platform that helps companies better navigate today’s volatile financial environment by providing advanced capabilities for cash forecasting and analysis in a heterogeneous system landscape. The application is available via an early adoption program. With SAP Cash Forecasting, companies can:

• Create accurate cash forecasts based on financial data from SAP and non-SAP systems such as ERP
• Develop an effective foreign exchange hedging strategy based on real-time visibility into exposure across multiple currencies
• Perform ex-post variance analysis on cash forecasts with the ability to explain variance down to the cash flow statement item-level
• Manage the forecast process centrally, tracking subsidiaries’ planning status and consolidating forecasts from across the company

“BSH Bosch und Siemens Hausgerate GmbH co-innovated with SAP on the new SAP Cash Forecasting analytic application, which is built on the SAP HANA platform,” said Marco Dockweiler, enterprise architect, BSH Bosch und Siemens Hausgerate GmbH. “This application has the potential to improve cash forecast accuracy and to optimize our processes in the treasury department. The results we have seen are very compelling, and we look forward to our continued collaboration with SAP.”

SAP Planning and Consolidation helps organizations dramatically accelerate their planning processes, giving financial professionals more analytics power and smarter insights, as well as time savings. Powered by SAP HANA, the application enables companies to accelerate budgeting and forecasting by speeding up the retrieval of queries, pull in large data sets and get a real-time view of what’s happening in the business. As a result, people can plan faster, input data back into systems faster and shrink planning cycles, enabling organizations to more quickly respond to capitalize on opportunities or avoid risks. This also provides simplicity for IT as the application is optimized in real-time with SAP HANA.

Empowering Sales and Marketing Users With Real-Time Solutions

SAP Collections Insight provides sales teams with the real-time customer insights they need to optimize their collections strategy and the collaborative tools to execute that strategy. The application is available via an early adoption program. Powered by SAP HANA and accessible via an easy-to-use Web or mobile app, SAP Collections Insight helps companies:

• Develop rich, dynamic profiles of their customers, including real-time visibility and analysis of payment history and trends
• Equip users to quickly make and act on collection calls — anytime, anywhere
• Empower users to collaborate rapidly and effectively to track and resolve collections issues

The capabilities delivered by SAP Collections Insight can enable companies to increase collections yield, accelerate the conversion of revenue to cash and strengthen their customer relationships.

SAP Sales Pipeline Analysis, powered by SAP HANA, helps sales organizations to get instant insights into massive volumes of pipeline data in the SAP® Customer Relationship Management (SAP CRM) application while performing on-the-fly calculations and in-depth analysis on any business dimension. Sales managers can react more quickly to changing sales conditions with real-time information and accelerate deals through the pipeline with user-driven analytics. As a result, companies can unlock hidden revenue opportunities as well as significantly increase profits and sales effectiveness. To help ensure a quicker time-to-value for customers, the content can be deployed as a rapid-deployment solution with the SAP® rapid-deployment solution for sales pipeline analysis with SAP HANA.

Taking Advantage of “Big Data” in the Banking Industry

SAP Bank Analyzer rapid-deployment solution for financial reporting with SAP HANA is designed to help organizations quickly analyze large volumes of data, enabling them to automate lean banking processes and make decisions in near real time. The solution enables banking organizations to rapidly generate detailed financial reports on assets and accounting performance, offering immediate answers to their business questions.

SAP Deposits Management rapid-deployment solution for transaction history analysis with SAP HANA helps retail banks boost performance through improved transaction history analysis. It makes it easy for employees to access up-to-date account information, while powerful in-memory data platform and business intelligence (BI) software helps organizations process multi-year information for real-time insights.

Drive Greater Visibility and Stronger Performance Across the Business Network

SAP Supplier InfoNet is an information network that brings together SAP HANA and the cloud to help companies gain real-time insights from ‘big data” and rapidly respond to changing conditions across their multi-tier supply networks. With this solution, companies are able to effectively manage their complex supply chains by:

• Proactively monitoring and predicting risks across the multi-tier supply network with real-time alerts and leading-edge machine learning and statistical analysis tools
• Gaining instant insights into the operational health of the supply network by aggregating and analyzing supplier data from enterprise systems and thousands of external data sources
• Benchmarking supplier performance on quality and delivery and identifying significant shifts and trends in their performance

The capabilities delivered by SAP Supplier InfoNet empower companies to minimize supply chain disruptions before they impact the business, drive stronger performance of their suppliers and save time and operational costs of managing the supplier base.

1. Understanding the organization’s needs and the necessity for establishing business continuity management policy and objectives;
   
2. Implementing and operating controls and measures for managing an organization’s overall capability to manage disruptive incidents;
   
3. Monitoring and reviewing the performance and effectiveness of the BCMS; and
   
4. Continual improvement based on objective measurement.
   

“The effects of these incidents extended so deeply into the technology industry and served as a reminder of the fragility of even the soundest supply chain. As tech companies continue to grow and extend their footprint globally, supporting and securing operations is paramount for success.”

The 2012 BDO RiskFactor Report for Technology Businesses, which analyzes the most recent SEC 10-K filings for the 100 largest publicly traded technology companies in the U.S., also found that natural disasters and other geo-political issues pose a serious threat to supply chain management and operations. In fact, 88 percent of companies cited those risks in this year’s study, up from 81 percent in 2011. With business interruption top of mind, more tech companies (73 percent versus 68 percent in 2011) are worried about the maintenance of their infrastructure and information systems. Notably, 71 percent of tech companies cited breaches in security as a major risk, up 25 percent from 2011. The popularity of e-commerce and increased use of mobile devices are contributing to this concern.

“A rise in supply chain and business interruption risks was expected after the fallout from the 2011 Japan earthquake, floods in Southeast Asia and other natural disasters,” said Aftab Jamil, partner and national leader of the Technology & Life Sciences practice at BDO USA, LLP. “The effects of these incidents extended so deeply into the technology industry and served as a reminder of the fragility of even the soundest supply chain. As tech companies continue to grow and extend their footprint globally, supporting and securing operations is paramount for success.”

The following chart highlights the top 20 risk factors cited by the 100 largest U.S. technology companies:

2012Rank								2012				2011				2010
1.				Competition and consolidation in tech sector; pricing pressures				99%				97%				94%
2.				U.S. general economic concerns				98%				96%				93%
2t.				Federal, state or local regulations				98%				96%				88%
4.				Failure to develop or market new products or services				93%				88%				94%
5.				Predicting customer demand and interest, innovation				91%				85%				63%
6.				U.S. and foreign supplier/vendor and distribution concerns				88%				86%				75%
6t.				Failure to property execute corporate strategy				88%				93%				68%
6t.				Management of current and future M&A or divestitures				88%				85%				86%
6t.				Natural disasters, war, conflicts and terrorist attacks				88%				81%				55%
10.				Threats to international operations				85%				85%				83%
11.				Legal proceedings				83%				86%				80%
12.				Ability to attract or retain key personnel				82%				82%				83%
13.				Intellectual property infringement				80%				79%				74%
13t.				Equipment failure and product liability				80%				75%				64%
15.				Cyclical revenue and stock fluctuation				76%				70%				57%
16.				Inability to maintain operational infrastructure and systems				73%				68%				42%
17.				Breaches in technology security or privacy				71%				57%				44%
18.				Inability to acquire capital or financing				69%				68%				55%
18t.				Accounting, international controls and Sarbanes-Oxley compliance				69%				58%				54%
20.				Credit or financial risk of customers, vendors or suppliers				64%				61%				48%

Additional findings from the 2012 BDO RiskFactor Report for Technology Businesses include:

• Matching new product development with customer demand proves challenging. With a constant stream of new products and services being brought to market, many tech companies are concerned with their ability to keep up with the competition. Nearly all (99 percent) companies noted industry competition as a top risk factor for 2012. As competition continues to heat up, innovation and appealing to customer interests are top priorities. This sentiment was evident by the 91 percent of companies who view predicting customer demand as a rising risk (up from 85 percent in 2011), and 93 percent of companies worry they may not be able to continue developing new products and services (an increase from 88 percent in 2011).
• Product delays and raw material costs fuel supply chain concerns. As tech companies work to ensure timely development of products and services, several factors threaten their success. Equipment delays, manufacturing issues and product liability were cited as risks by 80 percent of tech companies, up 7 percent from 2011. Concerns over the price and availability of raw materials rose 21 percent in this year’s analysis (41 percent versus 34 in 2011), another result of Japan’s earthquake and tsunami. Moreover, volatility in the global economy has technology companies increasingly concerned about the credit and financial risk of partners, vendors and suppliers (64 percent versus 61 percent in 2011).
• The battle for more IP leads to greater risks and continued legal concerns. Patent disputes are increasing in the tech industry as competitors fight over intellectual property rights to breakthroughs in areas like mobile technology and cloud computing. Poorly defined rights for inventions are leading even the biggest companies to take desperate measures, including banding together to protect themselves against claims of increasingly broad and vague patents. The study results reflect this threat, with 80 percent of tech companies noting IP protection as a significant risk. Additionally, because of the increasingly complex nature of IP rights, litigation costs are skyrocketing, causing many tech companies (83 percent) great concern.
• M&A concerns remain high amid uncertain liquidity levels. Following an increase in the value of technology M&A deals over the past year, more tech companies (88 percent, up from 85 percent in 2011) cite concerns over their ability to successfully complete and integrate acquisitions. M&A risks are also more in focus as companies like Facebook and Google increasingly look to acquisitions to grow their patent portfolios. Given the heavy amount of deal activity, financing remains a priority. While the BDO 2012 Technology Outlook Survey found that tech CFOs are more confident in their ability to access capital this year, most companies (69 percent) continue to safeguard themselves against a volatile market by noting access to capital and financing as a major risk.
• Ongoing legislation changes and accounting challenges cause anxiety. With the November election looming, concerns over government regulations are at an all-time study high, with 98 percent of tech companies marking it as a risk. Contributing to the concern is the pending cyber-security bill, currently making its way through Congress, and continued issues involving the roll out of the Dodd-Frank Act. Compliance with new revenue recognition rules and other accounting challenges are likely contributing to the 19 percent increase in concerns over accounting standards and maintaining effective internal controls (69 percent versus 58 percent in 2011).

These findings are from the 2012 BDO RiskFactor Report for Technology Businesses, which examines the risk factors listed in the most recent SEC 10-K filings of the 100 largest publicly traded U.S. technology companies. The risk factors were analyzed and ranked in order by how frequently they were cited.

Material discussed is meant to provide general information and should not be acted on without professional advice tailored to your firm’s individual needs.

“We use Amazon CloudFront to deliver over 5 billion requests and 250TB of bandwidth per month to our international user base”

Previously, developers who wanted to improve the performance and reliability of their dynamic content had limited options, as the solutions offered by traditional CDNs are expensive, hard to configure and difficult to manage. This often requires custom code on their websites, and configuration can take days or weeks. Now, developers running web applications with both dynamic and static content can accelerate their entire website in minutes using only the AWS Management Console, without adding undue cost or complexity to their architecture. Amazon CloudFront has implemented several performance optimizations such as maintaining persistent connections with the origin web servers and other network path optimizations to speed up the delivery of dynamic content. When dynamic content delivery is used with origin web servers running in Amazon EC2, customers get an even better experience as AWS monitors and streamlines the network paths from each Amazon CloudFront edge location to the various AWS Regions for improved latency and reliability. All of these features are available at the same low prices that Amazon CloudFront already offers to its customers.

“With this release, we are continuing on the same path we started when we launched CloudFront: iterating based on customer feedback and making premium and innovative content delivery features that other CDNs sell at high prices much less expensive and much easier to use,” said Tal Saraf, AWS’s General Manager for Amazon CloudFront. “In 2008, CloudFront showed customers that they didn’t need to pay premium prices and sign long term contracts to get great performance and reliability for static content. In 2009, we did the same for video on demand, offering RTMP streaming at the same low prices we were already charging for static object delivery. In 2011, we did the same for live events. Now, with this release, customers can use CloudFront to accelerate their dynamic content, and again, customers don’t have to pay any more than our already low rates. No up-front fees, no requirement to make a long term commitment, no monthly platform fees, no need to hire expensive consultants to help with configuration, no more being over-charged by traditional CDNs that used to be the only ones who could provide this important feature for customers.”

Earth Networks gathers and analyzes environmental observations from around the world to help promote a better understanding of the planet and its atmosphere. “We use Amazon CloudFront to deliver static content and are excited to take advantage of the new capabilities that Amazon CloudFront has added to deliver dynamic content generated by our application servers running in the AWS cloud. With these new features, we can be sure that our customers get the accurate and personalized weather updates they need to plan their day and stay safe from severe weather as quickly as possible,” said Andy Rosenbaum, Development Manager at Earth Networks. “With Amazon CloudFront’s strong performance, ease of use and flexibility, our team can use the API or the Management Console to quickly make changes to our CDN configuration and see the updates within minutes. And with the low cost of delivering dynamic content using Amazon CloudFront, we expect to see significant cost savings as well.”

“We use Amazon CloudFront to deliver over 5 billion requests and 250TB of bandwidth per month to our international user base,” said Steve Corona, CTO of Twitpic. “The reliability of Amazon CloudFront allows our small team to focus on our core products instead of scaling servers and network resources. Support for dynamic content is a natural extension of Amazon CloudFront and is something we’re eager to provide our customers to give them a better user experience at Twitpic.”

With this new feature, requests for dynamic, static and streaming content are all routed through Amazon CloudFront’s full worldwide network of edge locations, giving customers improved performance and reliability through network and route optimizations that accelerate the delivery of content from the origin to the end user. There are no additional costs beyond Amazon CloudFront’s existing low prices for data transfer and requests, and no long-term commitments for use. You can get started at http://aws.amazon.com/cloudfront with just a few clicks in the AWS Management Console.