Regulatory Compliance
Organisations are under an ever increasing amount of scrutiny. Today, there are countless government regulations, industry standards and company procedures that have to be met. In fact, industry experts suggest that a global organisation can face up to 15,000 separate regulations that mandate the specific handling of information.
While the high profile failures of companies such as Enron and Lehman Brothers has led to more stringent financial and data protection regulations worldwide, regulatory compliance laws and regulations such as Dodd-Frank Act, HIPAA, ISO and FISMA all impose their own approaches to record keeping and auditing.
Companies are aware that poor information management and non-compliance carry heavy penalties and can lead to lost business and reputation, financial penalties and even prison sentences.
In some industries, failing an auditor’s inspection can lead to an organisation’s operations being suspended until corrective action is taken. Today, an organisation doesn’t just need to comply, it must be seen to comply.
Achieving compliance requires the execution of best practices without error as well as proving that the organisation has done this through accurate information.
Information Governance and Regulatory Compliance
Although different in strategic outcome and content, regulations – whether government, financial or industry – share common elements:
- Governance structure
- Assured and audited delivery
- Ongoing measurement of compliance effectiveness
- Internal audits and corrective measures
- Records keeping
- Process management tools
- Compliance reporting
Given the over-arching nature of many regulations, it is not enough to simply implement policies and procedures. An Information Governance programme is required to overcome organisational, functional and process ‘silos’ in order to reduce risks and facilitate effective tracking, monitoring, reporting and auditing.
While often seen as a cost to the business, Information Governance should really be thought of as providing organisations with the opportunity to utilise regulatory compliance on order to drive their competitive advantage.
The Benefits of ‘Active Compliance’
The concept of Active Compliance has arisen from the understanding that the process of compliance means an organisation is already committing to industry best practices. Committing to continuous improvement, granularity and transparency enables an organisation to quickly identify areas for improvement and determine where investments can yield the best return.
The processes of automation and standardisation inherent in a Information Governance programme do not just drive down costs, they can also identify areas of compliance where small gains in business performance can deliver stronger market performance.
Monitoring Performance
The Right Way to Monitor & Measure Performance Targets
Performance management system is a tool for management not for evaluation of performance
Unfortunately, many organisations neglect this part of the cycle and simply do nothing or very little in the period between the target setting and target evaluation. Excuses vary from not having time to do it, to leaving it to the managers to do it in their own way and time etc. In any case they are just excuses. Not monitoring the evaluation will lose the whole meaning of the performance management since then you are not managing the performance throughout the year but only evaluating the end result.
Reasons for Performance Measurement
Aside of the very obvious reason that it is a part of any performance management system and that without it we cannot evaluate the achievement of the targets, there are also other reasons why we need to measure the performance.
From company side
- The whole performance management system including the monitoring and measurement process is designed to support the company strategy and achievement of corporate goals
- If we don’t monitor the performance of the targets we will not be able to see if we will achieve the company strategy
- Monitoring and measurement gives us valuable inputs for any further development and adjustment of the strategy as well as for the targets of the years to follow
From employees and managers side
- If we don’t measure the performance we won’t be able to show if we are doing a good job
- If we don’t measure the performance we won’t be able to make difference between successful and unsuccessful execution, between outstanding performance and underachievement
- By not making difference between outstanding performance and underachievement we won’t be able to recognize and reward the overachievement, nor to correct and develop the underachievement
- This can lead to rewarding and recognizing the wrong people and not rewarding the ones who really deserve it which will ultimately create dissatisfaction and drop of motivation
- The managers who don’t measure the performance cannot see where they should improve the work of their teams etc.
Setting Targets and Making Monitoring and Measurement Plan
Performance measurement starts with the target setting! Although many may think that the monitoring and measurement phase starts after the targets are set, it actually starts with the setting of the targets because this is the phase when the KPIs are set and when the measurement methods and tools are foreseen.
When setting the goals and the specific targets (KPIs) for each goal it is important to foresee how the achievement of the target will be monitored and measured. If a certain target cannot be measured, or is very difficult to measure, then such target shouldn’t be set.
The next step in the monitoring and measurement process would be to define a monitoring and measurement plan. But let’s go step by step.
What is Monitoring?
Technically performance monitoring is systematical gathering and analysis of information in parallel with the accomplishment of the task or job. In other words it means that as the work is being done, someone has the task to gather information and make the necessary analysis from which we can get a clear picture on the actual performance and make necessary decisions. This means that in order to be able to monitor the performance first we need to know what are the goal and the KPI for that goal. Then we need to establish monitoring and measurement tools and methods. At the end we need to foresee the needed resources as well as the people that will be assigned to monitor the performance.
The goal of the monitoring is to improve the efficiency and effectiveness of the performance through constantly keeping track on the actual performance. It also helps keep performance on the right track.
Planning the Monitoring and Measurement
It is difficult to go back and establish the monitoring and measurement systems, methods and measures once the achievement of a certain target has started. For example, try to measure and evaluate the achievement of a certain task or project without defining a monitoring and evaluation plan prior to the start of that task or project. What will you measure? What will you evaluate? How will you do it? Based on what?
It is difficult to go back and establish the monitoring and measurement systems, methods and measures once the achievement of a certain target has started
Monitoring and measurement should be part of the performance management system and should be well planned at the time of target setting. This plan should comprise the following:
1. Defining Key Performance Indicators (KPIs)
KPIs are measurable, traceable and visible signs / indicators that something has been achieved or not. They are an important part of any performance management system because they are what you actually monitor and measure. In order to be measured the KPIs are set at the beginning of the process, i.e. during the target setting so that assigned employees can immediately start with gathering information.
A simple guidance on how to set KPIs is to see if the ones that we have set justify the term Key Performance Indicator. This means that it should be a key contributor to the success of the goal. The contributors are key only when they make significant impact on the goal. The indicator should be a performance measure that can be measured, quantified, adjusted and controlled. The measure must be controllable in order to be able to adjust and improve the performance if needed. And finally it should be an indicator, a pointer of what we have defined to be successful accomplishment of the specific goal.
Some examples of KPIs are revenue ($), income ($), market share (%), number of new products on market (number), customer churn (%), employee fluctuation (%), employee satisfaction (index) etc.
2. Defining Tools and Methods for Monitoring, Measuring and Evaluation
Next step after the definition of the KPIs is to define the methods, measures and tools for gathering the necessary information for the analysis. These directly depend on the nature of the goal and the KPI.
For example, information can be gathered from activities reports, meeting notes, financial reports, or by surveys, interviews etc.
3. Defining Activities Plan
Now it’s time to define the activities plan and schedule for monitoring. Again it will depend on the nature of the goal and the KPI how often we will need to gather information and make analysis. The achievement of some goals may be measured monthly or quarterly, while other goals may require daily measuring and monitoring.
4. Defining Resources
After the methods and tools have been defined and the activities plan has been set we need to foresee the resources that we’ll need to perform the monitoring and measurement. This includes material, financial resources and people.
5. Assigning People
The last step is to assign people who will perform the measurement and monitoring.
Elements of Monitoring
The whole monitoring and measurement process is consisted of the following elements:
- Setting KPIs
- Setting up monitoring and measurement systems
- Collecting and recording data
- Data analysis
- Use of information for reporting, improvement and adjustment
Monitoring performance
Benchmarking is an excellent way to gain feedback about your business’s performance. Benchmarking compares the measures such as cost, cycle time, productivity, or quality of a specific process or method to what is widely considered to be an industry standard or best practice.
Benchmarking provides a snapshot of the performance of your business and helps you understand where you are in relation to a particular standard. The results should be used to inform actions for improvement.
Financial benchmarks are available for many industries.
Innovation measures
How do you know whether your investment in innovation has been worthwhile? Measuring innovation performance through the use of a handful of carefully chosen measures will help focus and ultimately increase the return on your innovation activities. Some potential innovation measures are shown below. Choose a manageable number that are most relevant for your business and monitor them on a regular (quarterly) basis. Read more about measuring innovation (PDF, 779KB).
Communicating business performance against measures is a powerful way to engage people in the business. Display performance against key measures in highly visible areas. Use graphics to help people quickly interpret results. Start talking about performance and set goals for the next timeframe.
Input measures
- Financial resources committed to innovation
- Human resources committed to innovation
- Operating expenses
- Capital expenditure
Process measures
- Number of ideas generated
- Average time from idea creation to implementation
- Percentage of ideas abandoned at each stage
- Number of suppliers and partners involved
Output measures
- Revenue from products launched in the last three years
- Number of new products or services launched
- Market share growth
- Return on innovation spending
- New product/service success rate
- Number of new customers
- Customer satisfaction
- Cannibalisation of existing product sales by new products
- Brand strength (third party ratings)
- Employee satisfaction
Reference
Financial Management
Financial Management Defined
Financial management involves the creation and installation of financial principles that position a company to achieve its main goal – increasing the value of the business for the owner. Financial management, which includes debt financing and cash flow management, collects and uses information to make sound decisions. Financial management systems enable businesses to leverage financing, management and investment to reach operational and financial goals.
FMIS Defined
A financial management information system helps facilitate financial management in a company by automating financial operations. It is an automated application that uses one or more software programs, internal policies and documented procedures to record, track and summarize company, departmental and functional budgets. In addition, companies use their FMIS systems to prepare financial statements, track decisions that impact profits and track the consequence of financial decisions.
Information Transparency
One key benefit of a financial management information system is transparency of information. Often, the owner and the accounting and finance-related personnel are the only ones who know and understand what is happening financially with the company. Through the use of an FMIS, all individuals with access to the system can check on aspects of a company’s financial performance. This helps managers of other departments and functions better understand how and to what extent what they do impacts the business.
Budget Control
As companies grow larger, the budgeting process becomes more complex. Because different departments can track their spending and make ongoing adjustments through an FMIS, it reduces budgeting complexity. Instead of having to regularly meet to discuss the budget and any changes, department heads can see what they and others are doing and provide insightful commentary on any issues that arose that did impact or could impact their respective budgets. This also facilitates tighter budget control.
Strengthens Financial Controls
For an FMIS to be effective, it requires companies to put systems, procedures, policies and methodologies in place. It may require one or more software systems. For example, an FMIS may require an accounting software package, a database system and an enterprise resource planning software program that pulls financial-related data from the accounting and database systems. All of these working together serve to significantly strengthen a company’s internal financial controls.
What Are the Benefits of a Financial Management Information System?

The World Bank defines a Financial Management Information System as the automation of financial operations. Automation is achieved through the use of financial accounting applications and database management systems. The use of FMIS applications is designed to simplify the recording of events, processing of transactions and reporting of financial information in your business.
Quick Decisions
The FMIS application provides timely, accurate, reliable and verifiable information that hasten your decision-making process. It provides advanced financial reporting and decision-making procedures for evaluating the merits or shortcomings of your operational and strategic approaches to business. This reduces uncertainties that may derail your implementation of important business decisions.
Planning
Implementation of FMIS enhances your scheduling and forecasting capacity. This enables you to allocate your financial resources effectively and set realistic performance targets. Limit the scope of your plans to your financial resource capabilities. The realistic planning capacity also accelerates the achievement of your goals within the desired time frame.
Efficiency
You stand to achieve greater efficiency in financial operations and reporting procedures when using FMIS applications. These systems entrench the controls you need to eliminate misuse of financial resources, but also the mitigation measures you employ to protect your business against the occurrence of expected and unexpected risks. The control measures also provide the historical evidence of performance you need to regulate the current and future activities of the business. Auditors also use this historical evidence to evaluate the progress of your business.
Integration
FMIS provides you with a framework for integrating functional processes and financial resources in your business. This accelerates the processing of transactions and conveyance of financial information, in addition to eliminating duplicate activities and responsibilities along the organization’s chain of command. Systems integration also provides you greater leverage for centralizing shared services so as to reduce operational costs associated with running multiple operational units for the shared services.
Competition
The adoption of FMIS applications elevates the competitive advantage of the business. Indeed, the strategic value of information technology is extremely important in the advancement of customer satisfaction and growth of productivity. It enables the business to respond appropriately to changes in target markets and stay ahead of its competitors.
Reference:
https://yourbusiness.azcentral.com/benefits-financial-management-information-system-27875.html
https://smallbusiness.chron.com/benefits-financial-management-information-system-71943.html
Data Protection
What is Data Protection?
The Data Protection Act (1998) is the protection of any personal data that is in the possession of any organisation, business or government, and how this information is used or shared. There are a set of rules that must be followed called the Data Protection Principles. The Information Commissioners Office (ICO) is in control of the data protection act, they judge whether organisations are using specific data responsibly, or whether they are being reckless with personal files, such as selling information.
Customers have data protection rights, including that all the safekeeping and confidentiality of their personal records. There is even stronger protection for more sensitive personal information, such as ethnic backgrounds, political opinions, religious beliefs, health, sexual health and criminal records.
How Does it Affect Your Company?
Different organisations will have different amounts of personal data; however it is advisable to audit your personal data regularly to get rid of data that you do not need. The ICO can deem it reckless if you keep old data for too long.
Keeping a large amount of personal data without auditing it can also be problematic for organisations for a number of reasons:
- Older data may be out of date, causing errors or increasing the risk of passing on false information.
- It is more difficult to ensure that older documents are correct.
- It is more difficult to locate personal data if there is too much unnecessary data in store.
It is also advisable to put information that you do not need on a regular basis into storage to ensure safekeeping. It is not a criminal offence to keep personal data that does not get used very regularly, however it is a criminal offence to store them unsafely. It is best to outsource your document storage to free up space and also to ensure it is stored in accordance with Data Protection Act legislation. Therefore you should also conduct regular audits to be sure that you are not holding too much data for too long.
If an organisation breaches any of the Data Protection Act’s principles then the Information Commissioner has the right to issue a financial penalty. This is relevant if the company deliberately breaches any of the principles, or if the company knew (should have known) there was a risk of a breach which is likely to cause substantial damage or distress, but failed to take reasonable steps to prevent it.
The maximum penalty that can be issued is £500,000.
Not complying with data protection principles is not a criminal offense; however there are multiple ramifications for being careless with people’s personal data. People may demand compensation for any harm caused, you may need to pay a penalty given by the ICO, but most of all it is bad publicity and negative for your brand name.
Data Protection Case Study
Sony Computer Entertainment Europe was fined £250,000 in January 2013. This is a result of the Sony PlayStation system being hacked in 2011, putting personal data such as payment card and login details at risk. The ICO decided that their security system was not strong enough to withstand the hack and that they should have been stronger.
Sony was responsible for keeping all of this information safe from hackers, and therefore received the fine as the ICO said that it could have been avoided. (SRC: BBC News)
About Secure Data Management
At Secure Data MGT we have over 25 years of document storage experience and we offer an auditing and storage service that minimises the risk of Data Protection breaches. We store in access controlled, weather and fire proof centres with 24-hour security and CCTV. On top of this, we help with the auditing of your documents to improve processes and workflow. Get in touch!
What is the Data Protection Act?
The Data Protection Act (DPA) is a United Kingdom Act of Parliament which was passed in 1988. It was developed to control how personal or customer information is used by organisations or government bodies. It protects people and lays down rules about how data about people can be used.
The DPA also applies to information or data stored on a computer or an organised paper filing system about living people. Organisations that do not adhere to the rules set out by DPA risk prosecution by the Information Commissioner’s Office (ICO) where fines can reach up to £500,000 and even imprisonment.
The Data Protection Act was replaced in May 2018 by the General Data Protection Regulations (GDPR).
Why is the Data Protection Act important?
The Data Protection Act is important because it provides guidance and best practice rules for organisations and the government to follow on how to use personal data including:
- Regulating the processing of personal data
- Protecting the rights of the data subject
- Enabling the Data Protection Authority (The ICO) to enforce rules
- Holding organisations liable to fines in the event of a breach of the rules
The DPA’s rules are very thorough and cover rules around sharing of data, and data security. At the heart of it are eight common sense rules known as the ‘data protection principles’ that all organisations collecting and using personal information are legally required to comply with.
The law provides stronger protection for more sensitive information such as:
- Ethnic background
- Political opinions
- Religious beliefs
- Health
- Sexual life
- Criminal history.
How can you successfully meet data regulation standards?
Ensuring you have the right technology, processes and people in place to handle the quality of the data that you hold was a key part of thriving under the DPA (and now the GDPR). Important activities you should consider include:
- Regular evaluation of the quality of the data that you hold and are continuing to collect. Contact Data Validation and Data Cleansing are good ways of doing this.
- Ensuring you have the right roles and responsibilities set out for your data’s management including the focal point of a Data Protection Officer.
- Analysis and profiling of your data to identify any potential gaps or issues that could cause problems to arise.
Reference:
https://www.edq.com/uk/glossary/data-protection-act/
https://www.securedatamgt.com/blog/data-protection-affect-your-company/
Business Data Backup
Successful Business Data Backup
How to Protect Your Critical Business Data
:brightness(10):contrast(5):no_upscale():format(webp)/always-backup-your-devices-498338507-57acc5313df78cf459e888c6.jpg)
Data backup is crucial for protecting your business’s continuity. If your only backup is on a single desktop/laptop computer or mobile device and it’s lost or stolen, your business data is gone. And having paper copies of business data isn’t adequate data protection; what if your business premises burn to the ground or experience severe flooding? Once again the data you need to carry on your business could be irretrievably lost.
Data Loss
To paraphrase Paul Simon, there are 50 ways to lose your data:
- A desktop/laptop hard drive crash or damage to your mobile device can render your data unrecoverable
- Your computer or phone can be stolen – business break ins are common and according to FBI statistics 97% of stolen laptops/desktops are never recovered
- Data can be accidentally deleted (or deliberately deleted by a disgruntled employee)
- Your computer can be hijacked by malware
- Your online storage accounts can be hacked
- A ransomware attack could render your files inaccessible until a substantial fee is paid
A Data Backup Regime Is a Must
For adequate data protection, you need to establish a data backup system that follows these three steps:
- Backup business data regularly
- Create backups on reliable media or in the cloud
- If using media for backups keep the devices in a secure, off-site location
The basic rule for business data protection is that if losing the data will interfere with doing business, back it up. Desktop software programs can be reinstalled if required, but recovering the details of transactions or business correspondence is impossible if those files are lost or damaged beyond repair.
Data Archive vs Data Backup
Backups are normally periodic, short term images of data for disaster recovery purposes.
Archiving generally refers to long-term storage of data that is no longer in regular use but can be restored if need be (for example, a finished project or data from a former client).
Backup Critical Business Data
There are two steps to successful data backup;
- Identifying the critical data that needs to be backed up
- Implementing backups of the data on a regular schedule
What needs to be in a data backup?
All of the files that you’ve created and/or modified should be regularly backed up. For many businesses, this includes everything from accounting files through email.
More and more business applications are available through the cloud. However, if you are using desktop (non-browser) applications, these can be reinstalled from media or downloaded, so don’t need to be backed up.
Cloud Storage
Using online backup services makes backing up your data easy – which is just one of the reasons cloud computing is ideal for small businesses. But cloud services can still be vulnerable to data loss via hacking or employee sabotage (consider the recent case of the Indianapolis-based American College of Education who, after firing an information technology employee discovered that before leaving he had changed the administrative passwords to the online accounts, preventing the college from accessing their data).
It is not a bad idea to take occasional local backups of cloud data.
Local Data Backups
If you save your data locally (e.g. you are not using cloud storage) you can simplify your backups by keeping all the files that will need to be archived on a single drive on your computer. For instance, suppose you need to back up accounting files, word-processing documents, spreadsheets, photos and email. Putting Simply Accounting, Microsoft Office (including Outlook) and Paintshop Pro all on a separate drive or under a separate folder makes it easier to archive all the files you’ve created or modified using those programs.
All you have to do is back up the drive or folder.
Once you’ve selected the critical data to be archived, it’s a simple matter to install and use a backup software program to archive your business data on a regular schedule.
Backing up your data nightly is recommended. There are many backup software programs available that allow you to set a schedule that will automatically backup your data. Backup software that also zips and encrypts files saves disk space and increases data security.
Only keep your data backups on-site if they are stored in a fire-proof, indestructible safe. Investing in a tape drive or external hard drive and meticulously adhering to a regular data backup schedule won’t help if all your data backup copies are in one place and that place is struck by disaster. To be truly secure your backups should be stored off-site. (Cloud backup does not totally eliminate this concern but is certainly better than many physical locations.)
Some businesses keep their data backups in security boxes at banks. (The fee for a security box is tax-deductible, if you need further incentive.) Other small business owners keep multiple data backup copies of their records at the homes of different friends or family members. It doesn’t really matter where you choose to keep them, as long as the site you choose for off-site data backup is secure and you have regular access to it.
Backup Devices
Online backup services
For ultimate security make sure you use strong passwords, change them regularly, and make sure the backed up files are encrypted (since cloud storage is shared, cloud providers normally encrypt user data).
USB (thumb) drives
USB sticks are constantly increasing in capacity and are ideal for quick data backups. While not having the capacity of external hard drives they have fast data transfer rates and are highly portable. You can easily backup data to a USB drive and take it offsite. As they have no moving parts, USB drives are very reliable.
External hard drives
For small businesses, buying and using an external hard drive for data backups is the recommended method. External hard drives are inexpensive compared to tape drive systems. They’re also easy to use; simply plug the hard drive into your computer’s USB port. Most external hard drives come with backup software.
Local Area Network (LAN) storage
If you have a local area network (LAN) you can also backup files to another computer or server. However, if the backup machine resides in the same location it may be vulnerable to theft or damaged by fire or flood. To prevent theft a server can be installed in a locked cage, cabinet, or closet.
Tape storage
If you have large amounts of data to backup (or wish to make and retain regular complete data archives for long-term storage) tape backups are the best option. They are highly reliable and can store massive amounts of data.
Back It Up or Risk Losing It
Don’t run the risk of losing your business data. The best defensive against such a disaster is proper data protection. By creating a backup system that includes archiving and backing up your business data regularly and properly, you’ll ensure that your business will be able to weather whatever storm it faces and carry on. Remember – you can never have too many data backups!
Reference:
https://www.thebalancesmb.com/data-backup-is-the-best-data-protection-2947129
Hacking
Hacking
For years, “hacker” was a positive term that described computer enthusiasts who had a zeal for computer programming. Those who hacked took pride in their ability to write computer programs that stretched the capabilities of computer systems and find clever solutions to seemingly impossible problems. Although many computer enthusiasts still ascribe to this definition, the everyday usage of the word has changed significantly. Today, “hacking” generally refers to individuals who break into computer systems or use their programming skills or expert knowledge to act maliciously. (Traditional hackers—the good kind—prefer to use the term “cracker” to refer to these individuals.)
Some of the most common types of hacking include:
Report Advertisement
Although portrayed otherwise in Hollywood films and in television shows, hacking is a systematic, tiresome process in which the attacker attempts methodically to locate computer systems, identify their vulnerabilities, and then compromise those vulnerabilities to obtain access. Experts have identified six steps that are generally followed in the hacking process. These include (1) footprinting (reconnaissance); (2) scanning; (3) enumeration; (4) penetration; (5) advance; and (6) covering tracks.
Footprinting.
The first technique often used by hackers is called footprinting. The objective is to gather information essential to an attack and enable an attacker to obtain a complete profile of an organization’s security posture. During this phase, the hacker might gain information about the location of the company, phone numbers, employee names, security policies, and the overall layout of the target network. Often, hackers can perform this work with a simple web browser, a telephone, and a search engine. Unfortunately, humans are often the weakest security link in a corporation. A clever phone call to the technical support department can often compromise critical information: “Hi—this is Bill and I forgot my password. Can you remind me what it is?”
Scanning.
Next, hackers perform scanning to gain a more detailed view of a company’s network and to understand what specific computer systems and services are in use. During this phase, the hacker determines which systems on the target network are live and reachable from the Internet. Commonly used scanning techniques include network ping sweeps and port scans . A ping sweep lets the attacker determine which individual computers on the network are alive and potential targets for attack. Port scanning can be used to determine what ports (a port is like a door or window on a house) are open on a given computer, and whether or not the software managing those ports has any obvious vulnerabilities.
Enumeration.
Report Advertisement
The third phase is the process of identifying user accounts and poorly protected computing resources. During the enumeration stage, the hacker connects to computers in the target network and pokes around these systems to gain more information. While the scanning phase might be compared to a knock on the door or a turn of the doorknob to see if it is locked, enumeration could be compared to entering an office and rifling through a file cabinet or desk drawer for information. It is definitely more intrusive.
Penetration.
During the fourth phase, penetration, the attacker attempts to gain control of one or more systems in the target network. For example, once an attacker has acquired a list of usernames during enumeration, he can usually guess one of the users’ passwords and gain more extensive access to that user’s account. Alternatively, once the attacker has determined that a target computer is running an old or buggy piece of software or one that is configured improperly, the hacker may attempt to exploit known vulnerabilities with this software to gain control of the system.
Advance.
In the advance phase of hacking, the attacker leverages computers or accounts that have been compromised during penetration to launch additional attacks on the target network. For instance, the attacker can break into more sensitive administrator root accounts, install backdoors or Trojan horse programs, and install network sniffers to gather additional information (for example, passwords) from data flowing over the network.
Covering Tracks.
Report Advertisement
In the final phase of hacking, the hacker eliminates any records or logs showing his malicious behavior. By deleting log files, disabling system auditing (which would otherwise alert the administrator to malicious activities), and hiding hacking files that the hacker has introduced, he can cover his tracks and avoid detection. Finally, the hacker can install a root kit—a series of programs that replace the existing system software to both cover his tracks and gather new information.
Recent Attacks, Countermeasures, and Motivations
Since the late 1990s, the number of hacking attacks has grown dramatically. Both private companies such as Microsoft, Yahoo, Amazon.com, Buy.com, and U.S. government entities like the Federal Bureau of Investigation (FBI) and the White House have been targeted by hackers. In the vast majority of incidents, hackers have attempted to either launch denial of service attacks or deface Internet web pages with inappropriate content. However, some of the attacks are far more insidious. In January of 2000, a nineteen-year-old Russian hacker, using the pseudonym Maxim, threatened to publish more than 300,000 customer credit card numbers (obtained by hacking into a popular e-commerce site) if he was not given $100,000 cash. Beyond these highly publicized cases, it is unclear how many corporations have been hacked successfully; however, from all accounts, the number is definitely large and growing.
A number of technologies are available to companies to prevent hacking attacks. The most popular tools are Internet firewalls, anti-virus software, intrusion detection systems, and vulnerability assessment tools. Firewalls are used to set up a virtual wall between the Internet and the company’s internal network to repel attackers. Anti-virus software detects and removes computer viruses, worms, and Trojan horses. Intrusion detection systems watch over critical networks and computers looking for suspicious activities, and can alert administrators in the event of an attack. Finally, corporations use vulnerability assessment tools to inventory their computing infrastructure and better understand the existing vulnerabilities.
Report Advertisement
Contrary to popular belief, most hackers are not international or industrial spies with evil motives and a desire to rule the world; most hackers have a simpler agenda. Among hackers, one of the most frequently cited motivations is that hacking is fun and is like solving a game or a puzzle. Many hackers perceive their activities to be harmless and they do not believe that they are victimizing anyone. In addition, the thrill of doing something illegal or the ability to access data unavailable to the public can be a tempting motivator. The chance to earn recognition from within a hacker group also offers strong incentive for up-and-coming hackers who have yet to gain a reputation. Finally, many hackers justify their actions by explaining that they are doing a service for other computer users by identifying new security holes.
Judicial, Criminal, and Civil Implications of Hacking
The following federal statutes offer computer crime and hacking protection:
Fraud and Related Activity in Connection with Access Devices;
Fraud and Related Activity in Connection with Computers;
Communication Lines, Stations, or Systems;
Interception and Disclosure of Wire, Oral, or Electronic Communications Prohibited;
Unlawful Access to Stored Communications;
Disclosure of Contents;
Requirements for Governmental Access.
As this list suggests, there is a substantial body of statutory law that applies directly to computer crime and hackers. Hacking of government computers, computers that are used by or for the government, and private computers used “in interstate commerce or communications” can be prosecuted under existing statutes. The existing statutory framework also provides for civil liability for unauthorized interception of communications. Finally, federal statutes exist to protect federal records, property, or public money. Consequently, bank, credit records, and electronic fund transfers are all protected by federal laws.
In recent cases, prosecuted hackers have been incarcerated, sentenced to home detention, and/or ordered to pay restitution. Offenders have been incarcerated for up to two years and some have been ordered to pay thousands of dollars in fines.
HACKING
During the late 1990s and into the new millennium, hacking became a popular term for the act of breaking in, tampering with, or maliciously destroying private information contained in computer networks. The FBI’s Computer Emergency Response Team (CERT) reported 17,672 hacking incidents in 2000, a 79 percent increase over 1999 figures.
EARLY HISTORY
During the 1960s, the word “hacker” grew to prominence describing a person with strong computer skills, an extensive understanding of how computer programs worked, and a driving curiosity about computer systems. Hacking, however, soon became nearly synonymous with illegal activity. While the first incidents of hacking dealt with breaking into phone systems, hackers also began diving into computer systems as technology advanced.
Report Advertisement
Hacking became increasingly problematic during the 1980s. As a result, the Computer Fraud and Abuse Act was created, imposing more severe punishments for those caught abusing computer systems. In the early 1980s, the Federal Bureau of Investigation (FBI) made one of its first arrests related to hacking. A Milwaukee-based group known as the 414s were accused of breaking into 60 different computer systems including the Memorial Sloan-Kettering Cancer Center and the Los Alamos National Laboratory. Later that decade, the infamous Kevin Mitnick was arrested and sentenced to one year in jail for damaging computers and stealing software. He was arrested again in 1995 for computer fraud and put in jail for hacking Motorola Inc., Sun Microsystems Inc., NEC Corp., and Novell Inc. to steal software, product plans, and data. Mitnick eventually cost the firms a total of roughly $80 million.
As negative publicity surrounding hackers continued to grow, those who considered themselves true hackers—computer programming enthusiasts who pushed computer systems to their limits without malicious intent and followed a hacker code of ethics—grew weary of the media’s depiction of hackers. As a result, several hacker groups coined the term ‘cracker’ in 1985 to define a person who broke into computer systems and ignored hacker ethics; however, the media continued to use the word hacker despite the fact that although most early hackers believed technical information should be freely available to any person, they abided by a code of ethics that looked down upon destroying, moving, or altering information in a way could cause injury or expense.
AT&T Corp., Griffith Air Force Base, NASA, and the Korean Atomic Research Institute all fell prey to hackers in the early 1990s. Federal World Wide Web sites, including those of the U.S. Department of Justice, the U.S. Air Force, and the CIA, were also attacked by hackers and defaced. During 1995 alone, U.S. Defense Department computers dealt with 250,000 hacker attacks. As technology advanced and business transactions conducted over the Internet increased, malicious hackers became even more destructive. Popular Web sites such as Yahoo!, America Online, eBay, and Amazon.com were hacked, costing millions and leaving online shoppers doubtful about security on these sites; a 16-year-old Canadian boy operating under the name Mafiaboy was arrested for these attacks, as well as for breaking into both Harvard’s and Yale’s university computer systems. Under the terms of his parole, Mafiaboy was not allowed to use the Internet or go into stores that sold computers, and his computer use was limited to that which was supervised by a teacher at school.
DIFFERENT TYPES OF HACKING ACTIVITY
As the cost of hacking attacks continues to rise, businesses have been forced to increase spending on network security. However, hackers have also developed new skills that allow them to break into more complex systems. Hacking typically involves compromising the security of networks, breaking the security of application software, or creating malicious programs such as viruses.
Report Advertisement
The most popular forms of network hacking are denial of service (DoS) attacks and mail bombs. DoS attacks are designed to swamp a computer network, causing it to crash. Mail bombs act in a similar fashion, but attack the network’s mail servers. When eBay was attacked in February 2000, its Web server was bombarded with fake requests for Web pages, which overloaded the site and caused it to crash. Network hackers also try to break into secure areas to find sensitive data. Once a network is hacked, files can be removed, stolen, or erased. A group of teens in Wichita, Kansas, for example, hacked into AOL and stole credit card numbers that they then used to buy video games.
Application hackers break security on application software—software including word processing and graphics programs—in order to get it for free. One way they gain access to software that requires a serial number for installation is by setting up a serial number generator that will try millions of different combinations until a match is found. Application hackers also sometimes attack the program itself in an attempt to remove certain security features.
Hackers that create viruses, logic bombs, worms, and Trojan horses are involved in perhaps the most malicious hacking activities. A virus is a program that has the potential to attack and corrupt computer files by attaching itself to a file to replicate itself. It can also cause a computer to crash by utilising all of the computer’s resources. For example, e-mail systems were inundated with the “ILOVEYOU” and the “Love Bug” viruses in May of 2000, and the damage to individuals, businesses, and institutions was estimated at roughly $10 billion. Similar to viruses, logic bombs are designed to attack when triggered by a certain event like a change in date. Worms attack networks in order to replicate and spread. In July of 2001, a worm entitled “Code Red” began attacking Microsoft Internet Information Server (IIS) systems. The worm infected servers running Windows NT 4, Windows 2000, Windows XP, and IIS 4.0 and defaced Web sites, leaving the phrase “Welcome to http://www.worm.com Hacked by Chinese!” Finally, a Trojan horse is a program that appears to do one thing, but really does something else. While a computer system might recognise a Trojan horse as a safe program, upon execution, it can release a virus, worm, or logic bomb.
PREVENTING HACKING ACTIVITY
While preventing all hacking activity is deemed nearly impossible by many computer experts, businesses spend billions on protecting computer networks. According to research group Data monitor, spending related to network security will increase from $10.6 billion in 2001 to $22.3 billion in 2004.
Report Advertisement
The most popular method of protection against hacking among personal home computer users is anti-virus software. Companies including McAfee.com Corp. provide anti-virus software that scans a computer’s hard drive for infected material, alerting customers when bad files are found. Firewalls, typically used for computer networks, have also become popular with home users, particularly those who use continual online connections such as cable modems and digital subscriber lines. Firewalls act as a deterrent to hacking by protecting private networks from the public, thus keeping most outsiders from tampering with computer systems.
Other software options—mainly used to protect larger computer systems—include Intrusion Detection Systems (IDS), content filtering software, sand-boxing software, and behavior analysis software. IDS is considered one of the best protection methods for large networks. With an IDS in place, system administrators can monitor network requests and detect large-scale malicious attacks. Content filtering software is advanced antivirus software that reads compressed files and allows IT managers to set specific filtering parameters to block threatening email. Sand-boxing software protects against malicious codes. The software creates a protected space within a computer where suspicious code can run, before it has a chance to interact with the main operating system. Still in its infancy in 2001, behavior analysis software protects computer systems by monitoring entire networks and checking every command of all operations.
Unfortunately, many malicious hackers eye security systems not as a deterrent but as a mere obstacle to overcome. However, as long as hacking attacks persist, both individuals and businesses will continue to invest in programs and software designed to protect systems from unwanted visitors.
References:
Problems with in a business
Top Ten Problems Faced by Business
We never like to rely on one source to fuel our analyses of the problems facing business today, so we’ve integrated our own interviews with corporate CEOs along with other inputs, research and thinking to create this list of the top 10 problems for businesses to solve.
1. Uncertainty
All human beings, but it seems business leaders in particular, find great discomfort in uncertainty. Uncertainty in the global economy, uncertainty in the credit markets, uncertainty in how new regulations will affect business, uncertainty about what competitors are doing, and uncertainty about how new technology will affect the business—these are just the start of a never-ending list. The bottom line is that uncertainty leads to a short-term focus. Companies are shying away from long-term planning in favor of short-term results, with uncertainty often the excuse. While this might feel right, we believe that a failure to strategically plan five years into the future can end up destroying value. The problem to be solved, therefore, is to balance the need for a more reactive, short-term focus with the need for informed, long-term strategies.
A failure to strategically plan five years into the future can end up destroying value.
2. Globalization
In interviews conducted by the Lean Methods Group, seven of 10 Fortune 500 CEOs cite the challenges of globalization as their top concern. Understanding foreign cultures is essential to everything from the ability to penetrate new markets with existing products and services, to designing new products and services for new customers, to recognizing emergent, disruptive competitors that only months earlier weren’t even known. The problem to be solved is to better understand international markets and cultures through better information gathering and analysis of what it all means.Similarly, the incredible degree of government intervention in nearly all major economies of the world is leading to much greater uncertainty (see No. 1 above) in the global marketplace, making international operations ever harder to manage.
Big companies are struggling with innovation and a better innovation process is at the top of the agenda for most CEOs.
3. Innovation
Interestingly, we haven’t found that many companies are looking to create more innovative cultures. At least not the big companies (Global 1000) anyway, though that changes some as companies get smaller. This finding was a big surprise when we did our first studies in 2009 and little has changed since. It seems big companies are struggling with innovation and a better innovation process is at the top of the agenda for most CEOs, but the idea of a more innovative culture appears too frightening to many. The problem to be solved is how to become more innovative while still maintaining a sense of control over the organization.
4. Government Policy & Regulation
A changing regulatory environment is always of concern in certain industries, but uncertain energy, environmental and financial policy is complicating the decision making for nearly all companies today. It’s true that things seem to have settled down over the past couple of years, but have they really? We find that they haven’t; it’s simply that dealing with an unknown regulatory environment is fast becoming the new normal and companies are deciding to get on with it—whatever “it” may be—despite the angst. Whether a demand from customers or shareholders to become more “green,” the threat of increased costs due to new carbon taxes, constant talk of changes to corporate tax rates, or the impending healthcare mandate for businesses in the US, much is unsettled. The problems to be solved are to understand the meaning of regulation and government policy in your industry, its implications for your business, and to develop the skills necessary to deal with it.
5. Technology
The pace of technological improvement is running at an exponentially increasing rate. While this has been true for several decades, the pace today makes capital investment in technology as much an asset as a handicap because a competitor may wait for the next-generation technology, which may only be a year away, and then use it to achieve an advantage. Of course waiting to be that competitor can be equally risky. What’s a CEO to do? Similarly, the ability for even the best of technologists to stay informed about emerging technology is in conflict with the need to master a company’s current technology. The problem to be solved is to develop a long-term technology strategy while remaining flexible enough to take advantage of unforeseen technology developments.
There’s no doubt that life and business have gotten more complex, even as certain tasks and activities have become easier due to information technology.
6. Diversity
A particular subset of human capital planning is found so often in our research that it is worth its own mention. Diversity brings many challenges, as it makes it far more likely that people do not agree, and the lack of agreement makes running a business very difficult. At the same time, the lack of diversity within many large company leadership teams leads to a narrow view of an ever-changing and diverse world—contributing to group think, stale culture and a tendency to live with the status quo for too long. The problem to be solved is to first define what diversity (and we’re not talking about satisfying government statisticians) really means in your company, then foster the expansion of differing ideas and viewpoints while ensuring a sufficiently cohesive environment that efficiently gets things done.
7. Complexity
There’s no doubt that life and business have gotten more complex, even as certain tasks and activities have become easier due to information technology. The pace of change is quickening. The global economy is becoming still more connected, creating a much larger and more diverse population of customers and suppliers. Manufacturing and services are increasingly targeted at smaller, specialise markets due to the flexibility that IT provides in these areas. The 3D printing revolution is a perfect example. We know from our knowledge of the patterns of evolution that, in reality, systems tend to become more complex as they evolve, then become simplified again. The problem is how to develop better systems-thinking capability so you can design your business models, processes, products and services in a way that minimises unnecessary complexity.
8. Information Overload
It is said that the only true constant is change, and in today’s world nothing is changing more, or growing faster, than information. A March 2010 estimate put global Internet traffic at 21 exabytes—21 million terabytes. In 2016, global traffic reached 1.1 zettabytes. Every day, 2.5 quintillion bytes of data are created. The ability of companies, much less individuals, to consume and make sense of the information that is available (and necessary) to make good decisions is becoming a nearly insurmountable challenge. The problem to be solved is to deal with this mountain of information with both technology and human know-how, then to convert this information into valuable knowledge.
9. Supply Chains
Because of uncertainty in demand and the need to stay lean, companies are carrying smaller inventories than ever. At the same time, uncertainty in supply, driven by wildly changing commodity prices, an apparent increase in weather-related disruptions, and increasing competition for raw materials makes supply chain planning more challenging than ever. Smaller suppliers that, five years after the global financial crisis, still struggle to get the credit they need to keep up with their larger customers’ demand exacerbates an already unwieldy situation. The problem to be solved is to develop a supply-chain strategy that not only ensures the lowest costs, but also minimises the risk of crippling supply-chain disruptions.
The lack of sophisticated approaches to information acquisition, analysis and the development of unique insight leaves many companies at a disadvantage.
10. Strategic Thinking & Problem Solving
While the first nine biggest problems faced by business are a direct result of research, the 10th is really the Lean Methods Group’s own conclusion based on the prior nine. The lack of sophisticated approaches to information acquisition, analysis and the development of unique insight leaves many companies at a disadvantage; they lack a long-term strategic imperative and instead jump from one strategy to the next on a year-to-year basis. Everyday problem-solving competency among today’s business leaders is also limiting their ability to adequately deal with the first nine problems. This is why corporate managers tend to jump from one fire to another, depending on which one their executives are trying to put out, and in many cases the fast-changing business environment is what ignites these fires in the first place. So what is the problem to be solved? We believe, to navigate the future, companies must resolve that strategic thinking and problem solving are the keys to successful business, then develop a robust capability at all levels.
Big Problems with the Internet of Things
In a few short years, the Internet of Things (IoT) has gone from a technology — or set of technologies — that were cutting edge to the situation today where connected household items, or automobiles, are common. However, growth is only really gathering speed now with San Francisco-based Cisco estimating that the “Internet of Everything cisco article” — its take on the IoT — could have has many as 50 billion connected devices by 2020.
According to Helsinki, Finland-based F-Secure, a cybersecurity company citing research from Gartner, over the next two years, the number of IoT devices entering households will climb steeply from nine devices per household currently to 500 by 2022, with IoT connectivity being bundled into products whether people want it or not.
In fact according to Mikko Hypponen, chief research officer for F-Secure in research on the IoT published last month, in the future, devices without IoT capabilities may be more expensive because they’ll lack data that can be harvested by manufacturers. It’s this very data that makes the IoT such an interesting proposition for enterprises. That data, though, comes with risks, along with a number of other notable risks and problems associated with the IoT that enterprises will have to overcome in the coming years.
Last month, the World Economic Forum published its Global Risks Report for 2018, the 13th year it has published it. Each year, researchers with the Global Risks Report work with experts and decision-makers across the world to identify and analyze the most pressing risks that the world face. As the pace of change accelerates, and as risk interconnections deepen, this year’s report highlights the growing strain we are placing on many of the global systems we rely upon. The IoT and the problems related to cyberattacks take a prominent position in the report.
If the IoT has a problem, or is exposed to weaknesses, then the enterprises that are connected to it are equally threatened. In fact, while security is undoubtedly one of the major issues impacting the development, there are a number of other problems that stem directly from this. Here are 7 major IoT problems for enterprises connecting to the IoT.
Related Story: 12 Emerging Internet of Things (IoT) Trends That Will Become Mainstream In 2018
1. Walled Off Internet
According to the World Economic Forum, the growing number of cross border attacks will start pushing national governments towards breaking up the internet in national, or even regional “walled gardens.” There are other pressures too that will push them to do this, including economic protectionism, regulatory divergence and the loss of government power relative to global online companies.
This will create major problems for the concept — and practice of a global IoT — leading to the erection of barriers to the flow of content and transactions. “Some might welcome a move towards a less hyper-globalized online world, but many would not, resistance would be likely, as would the rapid growth of illegal workarounds. The pace of technological development would slow and its trajectory would change,” the report reads.
2. Cloud Attacks
Given that a large amount of the data that will run the Io T will be stored in the cloud it is likely that cloud providers will be one of the principle targets in this kind of war. While there is growing awareness of this problem, cybersecurity is still under-resourced in comparison to the potential scale of the threat. To get some kind of idea of the problem, the World Economic Forum report cites analysis that suggests that the takedown of a single cloud provider could cause $50 billion to $120 billion of economic damage — a loss somewhere between Hurricane Sandy and Hurricane Katrina.
The annual economic cost of cybercrime is now estimated at north of $1 trillion, a multiple of 2017’s record-year aggregate cost of approximately $300 billion from natural disasters.
3. AI-Built Security Issues
Although the threat magnitude of ransomware has already grown 35 times over the last year with ransomworms and other types of attacks, there is more to come. Derek Manky, global security strategist at Sunnyvale, Calif.-based Fortinet agrees that the problems for cloud vendors are only emerging.
He said that the next big target for ransomware is likely to be cloud service providers and other commercial services with a goal of creating revenue streams. The complex, hyperconnected networks cloud providers have ?developed can produce a single point of failure for hundreds of businesses, government entities, critical infrastructures, and healthcare organizations. If not in the next year, he said soon we will begin to see malware completely created by machines based on automated vulnerability detection and complex data analysis. Polymorphic malware is not new, but it is about to take on a new face by leveraging AI to create sophisticated new code that can learn to evade detection through machine written routines.
4. Botnet Problems
Millions of new connected consumer devices make a wide attack surface for hackers, who will continue to probe the connections between low-power, somewhat dumb devices and critical infrastructure, Shaun Cooley, VP and CTO at San Jose, California based Cisco website said. The biggest security challenge he sees is the creation of Distributed Destruction of Service (DDoS) attacks that employ swarms of poorly-protected consumer devices to attack public infrastructure through massively coordinated misuse of communication channels.
IoT botnets can direct enormous swarms of connected sensors like thermostats or sprinkler controllers to cause damaging and unpredictable spikes in infrastructure use, leading to things like power surges, destructive water hammer attacks, or reduced availability of critical infrastructure on a city or state-wide level. Solutions for these attacks do exist, from smarter control software that can tell the difference between emergency and erroneous sensor data, and standards that put bounds on what data devices are allowed to send, or how often they’re allowed to send it. But the challenge of securing consumer-grade sensors and devices remains, especially as they connect, in droves, to our shared infrastructure.
5. Limited AI
AJ Abdallat is CEO of Beyond Limits website, an organization that was born from the labs of the Caltech deep space program. He points out that most of the current AI offerings on the market have substantial limits. After all, the machine learning and big data based AI that currently pervade are powerful tools for identifying associations in large quantities of data, but don’t have much on humans in terms of working out the complex phenomena of cause and effect, or to identify modifiable factors that can engender desired outcomes.
As big data and machine learning powered AI’s gains processing power, they can incorporate into their algorithms more and more information, more and more variables that may affect data associations. But with little human intervention, inevitably some variables may display strong correlation by pure chance, with little actual predictive effect.
The practical applications of AI to the IoT include, Smart IoT that connects and optimizing devices, data and the IoT; AI-Enabled Cybersecurity that offers data security encryption and enhanced situational awareness to provide document, data, and network locking using smart distributed data secured by an AI key.
6. Lack of Confidence
Amsterdam, Netherlands-based Gemalto is a cybersecurity firm that has researched the impact of security on the development of the IoT. If found that that 90 percent of consumers lack confidence in the security of Internet of Things devices. This comes as more than two-thirds of consumers and almost 80% of organizations support governments getting involved in setting IoT security. In fact its recent State of IoT Security research report, released at the end of October showed the following data.
-
96 percent of businesses and 90 percent of consumers believe there should be IoT security regulations
-
54 percent of consumers own an average of four IoT devices, but only 14 percent believe that they are knowledgeable on IoT device security
-
65 percent of consumers are concerned about a hacker controlling their IoT device, while 60 percent are concerned about data being leaked
“It’s clear that both consumers and businesses have serious concerns around IoT security and little confidence that IoT service providers and device manufacturers will be able to protect IoT devices and more importantly the integrity of the data created, stored and transmitted by these devices,” said Jason Hart, CTO of Data Protection at Gemalto said in a statement about the report. “Until there is confidence in IoT amongst businesses and consumers, it won’t see mainstream adoption,” said Hart.
7. Understanding IoT
In 2018, the real issue is how to increase the ability for people to understand the changes and their implications more clearly, and to take concrete actions to take advantage of the potential upside. “The pace of change has exceeded the rate of human capability to absorb — the cup is already full,” said Jeff Kavanaugh, VP and Senior Partner in High Tech & Manufacturing for Infosys website.
Internet of Things is moving into it’s adolescence as connected devices become smarter and more immersive, and expectations to convert IoT data to insights and financial value increase. Also, algorithms and data visualization templates have evolved so that new use cases can take advantage of earlier ones. The exponential adoption of IoT will drive down sensor and acquisition costs, enabling more and more viable business cases that have previously been too expensive.
Reference:
https://www.leanmethods.com/resources/articles/top-ten-problems-faced-business/
https://www.cmswire.com/cms/internet-of-things/7-big-problems-with-the-internet-of-things-024571.php
What is the Data Protection Act, and how does it affect my business?
The Data Protection Act (DPA) governs the holding and processing of personal data.
‘Personal data’ means information which identifies any living individual or can, with other information held by you, identify any individual.
‘Processing’ of personal data means obtaining, recording or holding the information.
As a business, you will be handling the personal information of your employees, suppliers and/or customers: it is therefore likely that your activities will be caught by the provisions of the DPA. If you are a ‘data controller’ under the Act and fail to notify your organisation to the Information Commissioner, your directors may be criminally liable for failing to do so.
A ‘data controller’ is a person or entity that determines the purposes for which personal data is processed. Under the DPA, personal data must be:
- Fairly and lawfully processed;
- Processed for specified purposes;
- Adequate, relevant and not excessive;
- Accurate and, where necessary, kept up to date;
- Not kept for longer than is necessary;
- Processed in line with the rights of the individual;
- Kept secure; and
- Not transferred to countries outside the EEA unless the information is adequately protected.
Non-compliance can result in an enforcement notice preventing your business from processing data, effectively preventing many businesses from operating, together with significant fines. Furthermore, the officers of your company, the managers and directors, can be held personally criminally liable for non-compliance.
Solutions
You should establish a data protection policy in your business to ensure your legal obligations are met.
The policy should take into account the particular personal data needs of the business as well as the way it processes this information. The policy should also address areas where personal and sensitive data (i.e. data relating to race, religion, sexual orientation etc.) might inadvertently leak in contravention of your obligation under the law.
The law aside, it also makes good business sense to have a policy as:
- Keeping the information you have about your customers secure will help protect your and their information;
- Sending out a mailing from incorrect or out-of-date records could not only annoy your customers but also wastes your time and money;
- Good information handling can improve your business’s reputation by increasing customer and employee confidence in you;
- Good information handling should also reduce the risk of a complaint being made against you.
Every day individuals contact the Information Commissioner to enquire about the way their information is handled. The Information Commissioner can also be asked to assess whether particular processing is likely or unlikely to comply with the DPA.
We live in rapidly changing times, especially for businesses. Consider that, in a single generation, businesses have had to adapt to entirely new marketing channels (web and social), decide how to invest in and utilise new technologies, and compete on a global stage — things that were barely imaginable to our parents’ and grandparents’ generations.
One side effect of these rapid changes and growth is that no single CEO — or any employee, for that matter — can be an expert in everything. This was, perhaps, always true, but it has never been more apparent.
This is why, in my opinion, some of the biggest challenges businesses face today are best met and addressed with qualified consultants. Bringing on a consultant helps CEOs add the expertise and skills they need to address particular problems at particular times, and can provide the best possible outcomes.
Just a few of the challenges I see businesses facing that are best addressed with the help of a consultant include:
Uncertainty about the future
Being able to predict customer trends, market trends, etc. is vital to a changing economic climate, but not every CEO has Warren Buffet-like predictive powers. Bringing in a consultant trained in reading and predicting those all-important trends could be the difference between a bright future and a murky one.
Financial management
Many CEO’s I know are ideas people; that means they’re great at the big picture and disruptive thinking, but less good with things like cash flow, profit margins, reducing costs, financing, etc. Small and medium businesses may not require a full-time CFO, but would do better to employ a financial consultant who can step into the role as needed.
Monitoring performance
Using a meaningful set of rounded performance indicators that provide the business with insights about how well it is performing is key. Most business people I know are not experts in how to develop KPIs, how to avoid the key pitfalls and how to best communicate metrics so that they inform decision-making. In most cases companies rely on overly simple finance indicators that just clog up the corporate reporting channels.
Regulation and compliance
As markets and technologies shift, so do rules and regulations. Depending on your industry, it can make much more sense to bring in a consultant to help with these areas rather than trying to understand the complexities yourself — and risk fines or worse for non-compliance.
Competencies and recruiting the right talent
Again, a small or medium-sized business might not need full-time human resources or recruiting staff, but during peak growth periods, finding the right people and developing the right skills and competencies is the key to a sustainable future. Bringing in a consultant with the expertise to find exactly the workers you need would be a wise investment.
Technology
As technologies change practically at the speed of light, it’s vital for companies to innovate or be left behind — but many CEO’s started their careers and businesses before many of these technologies even existed! Consultants can be vital for integrating new technologies, in particular mobile, app development, and cloud computing.
Exploding data
Grandpa’s generation certainly didn’t have to deal with terabytes of data or worry about what to do with it. 90% of the world’s data was created in the past two years and managing, keeping safe and extracting insights from the ever-increasing amounts of data your company produces needs to be in the hands of a qualified professional who can help you get the most return from that data.
Customer service
In a world of instant gratification, customers expect instant customer service — and can take to the web to share their displeasure at less than satisfactory service just as quickly. Consultants can find ways to improve customer service and bring it into the 21st century.
Maintaining reputation
In a similar vein, because customers can voice any displeasure so much more publicly and loudly than ever before, businesses have to monitor and maintain their online reputations. And while it’s an important task, it’s one best suited to a third party who can monitor and mediate with a certain amount of distance.
Knowing when to embrace change
Early adopter or late to the game? Consultants can help CEO’s determine when to embrace change and when to stay the course. Not everything new is better, yet eschewing every change runs the risk of becoming obsolete. A professional outside opinion can make all the difference in these decisions.
We are living in an era of constant change for the foreseeable future: change is the new normal. Preparing for and embracing that change by investing in the right kind of advice is the best way to meet these challenges head on.
Top Ten Problems Faced by Business
We never like to rely on one source to fuel our analyses of the problems facing business today, so we’ve integrated our own interviews with corporate CEO’s along with other inputs, research and thinking to create this list of the top 10 problems for businesses to solve.
1. Uncertainty
All human beings, but it seems business leaders in particular, find great discomfort in uncertainty. Uncertainty in the global economy, uncertainty in the credit markets, uncertainty in how new regulations will affect business, uncertainty about what competitors are doing, and uncertainty about how new technology will affect the business—these are just the start of a never-ending list. The bottom line is that uncertainty leads to a short-term focus. Companies are shying away from long-term planning in favour of short-term results, with uncertainty often the excuse. While this might feel right, we believe that a failure to strategically plan five years into the future can end up destroying value. The problem to be solved, therefore, is to balance the need for a more reactive, short-term focus with the need for informed, long-term strategies.
2. Globalisation
In interviews conducted by the Lean Methods Group, seven of 10 Fortune 500 CEO’s cite the challenges of globalisation as their top concern. Understanding foreign cultures is essential to everything from the ability to penetrate new markets with existing products and services, to designing new products and services for new customers, to recognising emergent, disruptive competitors that only months earlier weren’t even known. The problem to be solved is to better understand international markets and cultures through better information gathering and analysis of what it all means.Similarly, the incredible degree of government intervention in nearly all major economies of the world is leading to much greater uncertainty (see No. 1 above) in the global marketplace, making international operations ever harder to manage.
3. Innovation
Interestingly, we haven’t found that many companies are looking to create more innovative cultures. At least not the big companies (Global 1000) anyway, though that changes some as companies get smaller. This finding was a big surprise when we did our first studies in 2009 and little has changed since. It seems big companies are struggling with innovation and a better innovation process is at the top of the agenda for most CEO’s, but the idea of a more innovative culture appears too frightening to many. The problem to be solved is how to become more innovative while still maintaining a sense of control over the organisation.
4. Government Policy & Regulation
A changing regulatory environment is always of concern in certain industries, but uncertain energy, environmental and financial policy is complicating the decision making for nearly all companies today. It’s true that things seem to have settled down over the past couple of years, but have they really? We find that they haven’t; it’s simply that dealing with an unknown regulatory environment is fast becoming the new normal and companies are deciding to get on with it—whatever “it” may be—despite the angst. Whether a demand from customers or shareholders to become more “green,” the threat of increased costs due to new carbon taxes, constant talk of changes to corporate tax rates, or the impending healthcare mandate for businesses in the US, much is unsettled. The problems to be solved are to understand the meaning of regulation and government policy in your industry, its implications for your business, and to develop the skills necessary to deal with it.
5. Technology
The pace of technological improvement is running at an exponentially increasing rate. While this has been true for several decades, the pace today makes capital investment in technology as much an asset as a handicap because a competitor may wait for the next-generation technology, which may only be a year away, and then use it to achieve an advantage. Of course waiting to be that competitor can be equally risky. What’s a CEO to do? Similarly, the ability for even the best of technologists to stay informed about emerging technology is in conflict with the need to master a company’s current technology. The problem to be solved is to develop a long-term technology strategy while remaining flexible enough to take advantage of unforeseen technology developments.
6. Diversity
A particular subset of human capital planning is found so often in our research that it is worth its own mention. Diversity brings many challenges, as it makes it far more likely that people do not agree, and the lack of agreement makes running a business very difficult. At the same time, the lack of diversity within many large company leadership teams leads to a narrow view of an ever-changing and diverse world—contributing to group think, stale culture and a tendency to live with the status quo for too long. The problem to be solved is to first define what diversity (and we’re not talking about satisfying government statisticians) really means in your company, then foster the expansion of differing ideas and viewpoints while ensuring a sufficiently cohesive environment that efficiently gets things done.
7. Complexity
There’s no doubt that life and business have gotten more complex, even as certain tasks and activities have become easier due to information technology. The pace of change is quickening. The global economy is becoming still more connected, creating a much larger and more diverse population of customers and suppliers. Manufacturing and services are increasingly targeted at smaller, specialised markets due to the flexibility that IT provides in these areas. The 3D printing revolution is a perfect example. We know from our knowledge of the patterns of evolution that, in reality, systems tend to become more complex as they evolve, then become simplified again. The problem is how to develop better systems-thinking capability so you can design your business models, processes, products and services in a way that minimises unnecessary complexity.
8. Information Overload
It is said that the only true constant is change, and in today’s world nothing is changing more, or growing faster, than information. A March 2010 estimate put global Internet traffic at 21 exabytes—21 million terabytes. In 2016, global traffic reached 1.1 zettabytes. Every day, 2.5 Quintilian bytes of data are created. The ability of companies, much less individuals, to consume and make sense of the information that is available (and necessary) to make good decisions is becoming a nearly insurmountable challenge. The problem to be solved is to deal with this mountain of information with both technology and human know-how, then to convert this information into valuable knowledge.
9. Supply Chains
Because of uncertainty in demand and the need to stay lean, companies are carrying smaller inventories than ever. At the same time, uncertainty in supply, driven by wildly changing commodity prices, an apparent increase in weather-related disruptions, and increasing competition for raw materials makes supply chain planning more challenging than ever. Smaller suppliers that, five years after the global financial crisis, still struggle to get the credit they need to keep up with their larger customers’ demand exacerbates an already unwieldy situation. The problem to be solved is to develop a supply-chain strategy that not only ensures the lowest costs, but also minimises the risk of crippling supply-chain disruptions.
10. Strategic Thinking & Problem Solving
While the first nine biggest problems faced by business are a direct result of research, the 10th is really the Lean Methods Group’s own conclusion based on the prior nine. The lack of sophisticated approaches to information acquisition, analysis and the development of unique insight leaves many companies at a disadvantage; they lack a long-term strategic imperative and instead jump from one strategy to the next on a year-to-year basis. Everyday problem-solving competency among today’s business leaders is also limiting their ability to adequately deal with the first nine problems. This is why corporate managers tend to jump from one fire to another, depending on which one their executives are trying to put out, and in many cases the fast-changing business environment is what ignites these fires in the first place. So what is the problem to be solved? We believe, to navigate the future, companies must resolve that strategic thinking and problem solving are the keys to successful business, then develop a robust capability at all levels.
Business problems are current or long term challenges and issues faced by a business. These may prevent a business from executing strategy and achieving goals. In some cases, business problems also threaten the long term survival of a firm. The following are illustrative examples of business problems.
Financial
Financial issues such as an inability to refinance debt due to tight credit conditions.
Business Model
A business model that has been disrupted by a new way of doing things. For example, an energy company based on products that pollute the environment when cleaner and cheaper alternatives emerge.
Reputation
Reputational issues such as poor customer service that receives media attention.
Values
A firm that doesn’t align to the changing values of a society in which it operates. For example, a business model, product or operational process that harms the environment.
Regulations
Costly or burdensome regulations. This can particularly impact small businesses as it can drain limited resources.
Branding
Brand issues such as a small business that has difficulty establishing brand recognition in a market dominated by widely recognised brands.
Positioning
Product positioning issues such as an organic coffee that looks much the same as the other products on the shelf except that it is more expensive than the competition.
Demand
Changing customer needs, preferences and perceptions that reduce demand for your products and services. For example, a cultural shift towards healthier food may negatively impact brands that produce junk food.
Supply
Increased supply by your competition or a substitute product. For example, a short term property rental service that increases the supply of rooms may negatively impact hotels in an area.
Price Competition
Price competition that lowers your sales and/or reduces your profit margins. This is particularly a problem if you are facing competitors with lower unit costs such that they can keep prices low and remain profitable.
Costs
Rising costs such as your cost of capital, labor, materials, parts, overhead and obligations to partners.
Sales
Sales problems such as an inability to recruit sales people who have many connections amongst your target customers.
Customer Relationships
Customers who are unhappy with your products or services such that they are likely to cancel services and/or generate negative word of mouth.
Promotion
Promotional problems such as an inability to generate demand or interest in a new product launch.
Product
A new product or service that is poorly received by customers or the media. For example, a hotel that undergoes an expensive renovation only to see reviews plummet as customers feel room interiors are visually unattractive and uncomfortable.
Time to Market
A product launch that is slower than you need. For example, issues setting up a production line.
Time to Volume
A product launch that takes longer than expected to reach your sales targets. For example, an innovative new streaming media service that finds that their target audience are uninterested in changing their media viewing habits.
Know-how
A firm that lacks the knowledge to get something done well. For example, a high speed train manufacturer with product reliability issues due to a lack of reliability engineering know-how.
Technology
Technology issues such as a costly service outage due to a failure of IT infrastructure.
Information Security
Information security attacks or vulnerabilities.
Change
An inability to change such as a project failure or business transformation that fails to achieve its objectives.
Employee Performance
Employees who lack motivation, talent, diligence or professional standards. For example, a retail location with poor customer satisfaction due to poor management and employees who aren’t friendly, helpful or reliable.
Organizational Culture
The habits, norms and expectations that have evolved in your organization over its history. For example, a call center where employees openly complain that customers have negative traits such that negativity towards customers is commonplace.
Productivity
Low output in an hour of work. For example, an office where people are spending as much time on personal social media as working.
Efficiency
Low output for a unit of input. For example, a factory that produces 200 units an hour with $1 million in equipment versus a competitor that produces 2500 units an hour with $1 million in equipment.
Measurement
A firm that isn’t able to detect problems because their measurements and benchmarks fail to detect significant under performance. For example, a firm that aggressively reduces unit cost without properly measuring quality or product ratings. This may result in quality failures and a loss of brand reputation and market share.
Quality
A firm that can’t achieve its target level of quality. For example, a firm wants to release a hot chocolate mix that is perceived as higher quality than a major competitor. They have tested dozens of formulations and packaging designs but all score poorly with customers.
Customer Experience
Problems with your end-to-end customer experience. For example, a mobile device brand that customers perceive as visually unappealing, difficult to use and unreliable.
Distribution
Problems reaching customers with your products and services. For example, a restaurant chain that runs out of critical ingredients across an entire region due to a supply chain disruption.
Operations
Business process issues such as a single point of failure on a production line that is causing expensive downtime.
Notes
Business problems should not be confused with business risks. A risk is a problem that hasn’t happened yet that has some probability of occurring in the future.









Who are my competitors?The instant answer is businesses like yours. If you’re planning to set up as a painter and decorator for example, then it would be other people who offer the same service or sell decorating products.It’s not just established businesses that you should include in your research – competition could also come from a new business that is offering a similar service or product to you.






































