Securing Intellectual Property is critical to safeguarding and enabling enterprise innovation. The proliferation of enterprise mobility and other endpoint devices is further increasing complexity and vulnerability. How are organizations keeping their brilliance secured as they innovate?

Contributor

• • Tim Callahan, Senior Vice President, Global Security, Chief Information Security Officer, Aflac

Transcript

Sanjog Aul [00:00:00]:
Welcome listeners.

Sanjog Aul [00:00:00]:
This is Sanjog Aul, your host and the topic for conversation is Enabling Secured Innovation and I have with me Tim Callahan. Tim is the Senior Vice President, Global Security and Chief Information Security Officer with Aflac. Hi Tim, how are you?

Tim Callahan [00:00:15]:
I’m doing well, thank you.

Sanjog Aul [00:00:17]:
Thank you for joining us. Now the reason we wanted to discuss this today, the topic is because we see that securing intellectual property is typically very critical to safeguarding and enabling enterprise innovation and we know that the enterprise mobility is mainstream and we have a lot more endpoint devices than we would ever imagine and they are also increasing complexity and vulnerability. So what we wanted to see is to see in this whole process of innovation, since data is moving around and it’s also at rest, how can an organization work towards building the whole process of innovation more secure and also all the brilliance that is being created as part of the innovation also secure. So that said, the first question I have for you, Tim, is for innovation, we know that we need to have our ideas and collaborative communities that are exchanging thoughts throughout the process secured. If you were to pick up the top challenges related to this specific area, what would those be?

Tim Callahan [00:01:13]:
Obviously, in a collaborative environment, we need to be able to set ideas and gain insights into feasibility. Technologists will often use chat rooms and other out of company collaborative environments to vet these ideas and that really creates a challenge to keep that information and one way that we found that we can help meet some of those challenges is one to provide a good network space internally that encourages collaboration and then help the developers, the technologists, see the need to guard our information and we do that through campaigns, through awareness, having conversations with them and helping them understand the ramifications and implications if our precious ideas that they’re working on sleeps out and then by providing that good collaborative environment internally where they can share ideas and text things back and forth and generally we find they’re much more receptive to that.

Sanjog Aul [00:02:17]:
So when we look at anyone who’s in the zone of innovation or they’re doing some creation, if you go and say, you know what, slow down, think about security, they really don’t want to, what’s your message to people like those?

Tim Callahan [00:02:28]:
It is, and part of it is a true partnership, meeting them and understanding that we don’t want to be breaks, we want to be enabling partners, but to guard those secrets and I think part of it is calling on them to say, do you think your ideas are precious? Do you think your ideas are contributing to the benefit of the company and certainly they want them to be that before they wouldn’t be working on them and then we try to encourage them to, if that be true, if they think that their ideas are truly benefiting the company, don’t they want to guard those ideas and we’re here to help them guard those ideas, not to constrain their ideas, but to really guard them and so we find a lot more cooperation through that conversation.

Sanjog Aul [00:03:10]:
Now whenever we have spoken to Chief Information Security Officer, so of course they say that they cannot boil the ocean, they cannot secure literally everything. That would be a crazy idea and in order to really do some sort of scoping for that security, securing the enterprise assets or crown jewels, we are going to identify which ones are those but then when we look at innovation, there may be many other crown jewels in the making. The ideas, the intellectual property which is under development. How do you build a business case for securing those because then it can also be pooh poohed by the people who are giving you the money and resources to say this is again, you’re trying to boil the ocean.

Tim Callahan [00:03:47]:
Yeah, and I think that’s an interesting point. Generally what I found in the companies I’ve worked for or worked with in is it’s not as much making the business case of protection. I think everybody gets that. I think it’s doing it in a way that easy or easy as can be, and then doing it at a low cost model. You don’t want to spend more money protecting an idea than the idea is worth and so trying to find those innovative ways in security to secure the environment, to help people collaborate, to help people be innovative but at the same time, protecting that information is really the key and the key to that is some of the things I’ve already spoke about

Tim Callahan [00:04:28]:
but just setting up these secure sites with access controls that keep it internal but does not become burdensome. I worked at one company where we had an actual innovation hubs, so anyone within the company, or especially in the technology area, could jump on at any time and share an idea and within minutes other people were contributing to the idea or commenting on it and this was just a very good collaborative environment and it was an environment that enables not only the sharing ideas, but the capturing of ideas. So many times if you don’t do it in some kind of format to where you can actually record those off to a safe storage place, you might lose those ideas and when people are brainstorming on one of these chat rooms, if you don’t capture the data, you can lose some very valuable ideas. So I think those are the keys to it.

Sanjog Aul [00:05:24]:
One is to look at them, oh, we are doing some innovations. So anything that we will speak or share or write is going to be some sort of an intellectual property or something worth sharing or securing. Now, when we talk about the sharing and collaboration in general, I’m sure when you talk to any of your peers, there may be so many ideas that may be floating around, they themselves could be source of competitive advantage or then they should be secured. Now, how do you separate, first of all, and if you’re not able to separate, how do you prevent leakage of those unintentional but very valuable ideas that are flowing throughout the organization without calling it boiling the ocean and without getting any additional funds to safeguard them?

Tim Callahan [00:06:09]:
I think the solution to that, you can shut up an innovation site fairly cheaply using just off the shelf type of products, SharePoint for example and so it’s not really about a high investment in the environment itself as much as it is to make sure that you’ve thought through how do we control the access to this environment and when I say that it’s certainly you want to enable all employees to have access, but you don’t want to enable other companies to have access to your information. So that implies setting up a site that’s secure and quite answered, that could be internal, it could be in the cloud, in a file sharing location. As long as you’ve got all the controls around this, make sure that you’re controlling access to that and making sure only authorized people have access to it because you’re right, as you’re boiling ideas, as ideas are brewing and you’re brainstorming, some of those may wind up being nothing, and may wind up just going to a dead end but sometimes those nuggets of information actually spark other ideas and that becomes the true intellectual property and you want to make sure you preserve that.

Tim Callahan [00:07:18]:
One of the analogies that I used to talk to my friends when I was in the military and we would maybe go to a bar and have a few drinks there and be solving the problems of the world and the next morning we wake up and we can’t remember what we solved and we definitely don’t want that in our innovation idea. So we got to make sure that we have a way to capture the information, to classify that information in a way that really takes advantage of that innovation.

Sanjog Aul [00:07:47]:
So with all of that you just mentioned, in terms of that secure side, that’s a brilliant idea. Now let’s look at the other organizations or many organizations today. So each person in the organization has a mobile device, they are texting each other, they are sending other information to each other and that’s the form of sharing and collaboration they are doing and in their mind they are exchanging information but they may be participating in innovation without even realizing. They have not even recognized it. So you do not have a way for you to say now you’re innovating versus now you’re not. So that secured site concept would become a blurry line for many

Sanjog Aul [00:08:22]:
and especially with people having endpoint devices wherever, whenever they want to collaborate and share information, they are doing it. How would that environment and in the way we are structuring and sharing information today is going to jeopardize or undermine the idea that you shared and what do we do to solve that?

Tim Callahan [00:08:42]:
The solution there is much more complicated than an internal site. We know that a lot of people use personal mobile devices. They share through text messages or whatever ideas and they get really excited and they do that. I think that comes back down to though, helping the people understand that those ideas they’re sharing, if they’re really going to be valuable to the company, they have to be protected and they have to come back into the company in a way that we can execute on those ideas. The most powerful message there is one of helping people understand that, helping them to gain buying into. We’re doing this for the benefit of the company. We’re trying to make the company better, more profitable. So therefore we want to make sure the information comes back in and we provide these environments, these environments where you can get into it from your mobile device use that the hub.

Tim Callahan [00:09:37]:
Other than that, it’s very difficult to control. We don’t permit personal devices for business use per se. We don’t permit them officially, we don’t, we acknowledge that they exist, but we don’t allow business to be done on a personal device. We give our employees mobile devices and then we control how that environment looks so that we can gain that information and we’re obligated to do that but there’s no perfect, easy solution to the total personal divide.

Sanjog Aul [00:10:08]:
Let’s take a quick break, listeners. We’ll be right back and let’s talk about the technology solutions that exist today. Do these solution providers understand the complexities of enterprise innovation? Are the solutions that they’re offering really aiding secured innovation and if there are gaps, what are they? Please stay tuned, listeners.

Sanjog Aul [00:10:26]:
We’ll be right back.

Sanjog Aul [00:11:06]:
Welcome back, listeners. So what we are looking at here, Tim, is while we discussed about what the landscape looks like, what people are doing, but let’s look at the technology solution providers. Do they really understand the complexity of enterprise innovation, how the moving parts are because you want people to be able to collaborate and communicate and create ideas, spoke about different ways they want to do it and the solutions that are available and in your case, you’re saying you don’t use or don’t allow personal devices, but there are organizations which is a combination of the two. So as you see the landscape, do you see the solutions really stepping up to the point where we can say, yes, we are doing everything we can from technology standpoint to get secured innovation going and if there are gaps, what do you see the gaps are?

Tim Callahan [00:11:51]:
So I think by and large our technology solution providers generally have a keen appreciation for innovation and they understand the complexities because they’re challenged in the same way. A company that’s not innovative, a company that’s not active, a company that’s not flexible and always taking the pulse of the industry and moving in an innovative way becomes a dinosaur fairly quickly in the technology space. So I think our partners are seen on these things. I think the real challenge comes in is finding that trusted innovation partner and that’s the key. So if we are going to innovate with a partner, then we want to make sure that we have good partner, that we’re doing things in the right way and with mutual benefit, and that the partner has to win, we have to win, and both others have to gain.

Tim Callahan [00:12:45]:
and that implies that we have the right kind of protections in place for that, from a contractual standpoint, et cetera. I think to your questions about our solution providers providing solutions that enable secure collaborations, and I think back to your question on mobile devices, I think there are companies out there that are providing mobile device management solutions that both secure our data. The data exists encrypted. It exists in a way that we can call back to our network and include that information in our network. I think there’s still a gap in the people aspect, though. People don’t understand. If they don’t buy into the idea of securing that data, then I think it’s very difficult.

Sanjog Aul [00:13:33]:
Now, in today’s world, we know we are not chained or we are not confined to our organizational boundary, we are partnering with other entities to sustain with our growth and profitability in the very existence. So with that said, we are going to have situations or on a regular basis as we speak today, all organizations or all organizations who are connecting with outside parties in some form or fashion are exchanging sensitive information which may be somewhere connected to innovation process, but they may not have the commonality in terms of the levels of security or the importance they will give. How do we handle that challenge? How do we make sure it is a consistent securing of sensitive information which is being shared across organizational boundaries as part of innovation?

Tim Callahan [00:14:19]:
I think going down back to some very foundational type of controls, contractual controls is very important when we engage a partner. One, the trusted partner that I mentioned earlier is essential. When we go to partner with someone in an innovative way, we have to be dealing with someone that has an interest in the innovation and interest in the partnership and I generally find the smaller to mid sized technology and security company fit that model better than the larger and they’re generally the best partners to collaborate with because what they’re trying to do is prove out their technology in a way that shows a good practical use and having a partnership where we’ve got solid agreements in place that deal with the things like how are we securing the information, how are we going to develop mutually this solution in a way that benefits both of us and then how are we going to have ownership of this and many times just to get a solution that works for us, we’re willing to give back to that company any intellectual property ownership just to get a consideration on us getting that solution at an economical way, our payment becomes a partnership rather than necessarily owning the property but I think that’s very important that you work in a channel, whether it’s a extranet connection, whether you collaborate into a secured open space and a mutual file sharing arrangement, or however you do it, it’s very important to think through that hint to make sure that both parties are being protected.

Sanjog Aul [00:16:03]:
So if you are looking at the very culture of innovation that we want to develop, because innovation is not, you can do big bang innovation, you can do incremental but we say that the organizations which really want to be successful, they have to develop a culture of innovation. So it’s kind of embedded in the DNA and if we are looking at that, and if that’s an objective an organization has, how could we have security become a forethought and a key ingredient versus something which is an afterthought or something which is a slap on or an overhead.

Tim Callahan [00:16:34]:
I think the key to that is surely becoming a good partner and then involving employees. We had a contest. Our CEO actually promoted a cybersecurity contest sometime last year where he offered rewards to all of our employees to come up with the best ideas on how we can better secure our environment and how we can get move ahead with security and out of that, we had over 100 entry and we selected one of the best and the best one was around how to designate people, get volunteers with heat within each of the business lines, with each of the partners to collaborate and to become kind of the security partner for that particular entity and work with us to create this environment of conversation and collaboration and working together towards that end and through that. We have now cybersecurity ambassadors that are embedded in our technology departments and embedded in our business departments, embedded in our corporate functions and we have visibility and partnership throughout the whole life cycle of coming up with the ideas and implementing the ideas.

Tim Callahan [00:17:48]:
So I think security always has to be at the table as a partner and not as a cop, not as someone trying to catch someone doing something wrong, but partnering with them to say, look, here’s the many ways that we can innovate, here’s how we can do it safely, here’s how we can protect the ideas, and we want you to go and go fast, and here’s a good environment to do it.

Sanjog Aul [00:18:09]:
So the zeal with which executive leadership pursues and sponsors and funds innovation, what would be the secret sauce team that we could use so that they use the same zeal to support secured innovation?

Tim Callahan [00:18:25]:
I think that is part of the culture. It has to become part of the culture and at Aflac, we’re so fortunate because our employees care so much about our client and we do that if you take it. Our very products and our very foundations are meant to help people, our typical client and the typical citizen in the US I guess it’s very difficult if they miss a payday. So our product is there for them when they need it most. That culture of cure for our clients spills over into how we secure that information and because it’s got such attention from the top, all the way down, people want to know, how can I go fast? How can I innovate? We get it, we have to do this. How can I make sure I’m protecting our client? So I think that’s it.

Sanjog Aul [00:19:13]:
Once again, thank you, Tim, for sharing your thoughts and insights about enabling secured innovation.

Tim Callahan [00:19:18]:
Thank you. I appreciate the conversation.

Sanjog Aul [00:19:21]:
And listeners I invite you to find related conversations on our website@ciotalknetwork.com/Enterprise Security.

Download Podcast
Apple Podcast, Google Podcast, Spotify, Pandora, iHeartRadio, SoundCloud, TuneIn, and Stitcher. Find other syndication channels here or search CIO Talk Network podcast on any other app.
Explore More

• How to make IT security everyone’s business?
• How to Build an IT Security Team
• The X5 group Cybersecurity Transformation: A Case Study
• Securing Business Growth with Cybersecurity
• Encourage Board Members to Get Onboard With Cybersecurity
• Cloud security, cost, and culture: Technologies Concern
• Ensuring Digital and Virtual Healthcare Security
• Embedding Security in Technology Capabilities
• Security and Agility – Tips for Getting the Best of Both Worlds
• Steps to Outcome-Driven Security
• Transforming Security Programs to Become Digital Business Enablers
• From Peanut Butter to Surgery for Better Security