An Intellyx BrainBlog for Evolven, by Jason English
Most of us have never had to think about enterprise digital risk, in all its forms.
Until recently, only a select council of IT executives needed observability into a broad range of potential software and hardware problems. They would all get together for a quarterly or monthly risk management review board meeting, either in person or on a very long, monotonous conference bridge.
The ‘telemetry’ on this call would consist of a CIO or a Chief Risk Officer, asking each department head, from cybersecurity to development, to IT operations, regional managers, and application suite owners: “What issues are getting reported to you? What are you seeing in your dashboard?”
In some ways, this occasional drudgery was pretty effective at mitigating risk because early change management and compliance procedures were slowing things down to a manageable pace. Then, we started introducing increasing levels of agile software updates and delivery automation atop cloud infrastructures.
Change happens so fast in today’s hybrid cloud environments, it’s much harder for enterprises to truly identify and control the risks that matter from the myriad of potential IT risks. Further, with so many stakeholders making changes that could impact upstream or downstream services, risk mitigation is quickly becoming part of everyone’s job.
Clarifying the opaque silo problem
Talk to a big 4 consultant about risk, and they will likely say that your enterprise “needs to break down informational silos to gain visibility into shared risk mitigation objectives.” Or some sort of win-win management-speak like that.
While cracking open silos always sounds nice in theory, what if they are still holding valuable products inside? It is important to remember that information silos were established for a reason. Different metrics matter to Ops, Dev, and Security teams because they have different objectives.
IT Ops teams will use their ITOM and ITSM platforms to track infrastructure performance indicators and resolve issues, whereas DevOps teams are carefully monitoring their CI/CD pipelines and deployments to manage faster, higher-quality releases. Security teams scan for threats and vulnerabilities in their SIEM and XDR workflows. Partners may have their own ways of measuring their service’s API performance against SLAs and SLOs in relation to your enterprise.
Even if you could gain an “X-Ray Vision” superpower and give everyone transparency into each other’s silos, each of these teams would likely not understand the context of the data they are looking at for their own workflows.
The modern SRE (site reliability engineer) role would be the closest to understanding the meaning of risk indicators within each group’s siloed dashboard, but even then, total transparency would only overwhelm them with unfiltered data when they are trying to identify risks.
Read the entire BrainBlog here.
