Margins of Defeat

You're businesspeople, right? Good. Then let's talk about a business guru, innovation and profit margins for a moment.

By Derek Slater

June 20, 2007 — CSO —

Clayton Christensen is the business guru. He’s a Harvard prof and well-regarded author. His name is one that might hold some influence over your CEO.

The Internet is the innovation. Or at any rate, it’s the fertile ground from which innovations are growing like kudzu. Technology innovations, process innovations, lots of new stuff.

Now one of the things Christensen has said about innovations is this: The disruptive ones initially lower your margins. That’s right. A transformative new idea that changes markets, processes and workflows doesn’t usually pay off instantly for the innovator. It requires some investment in order to grow into what it will become.

Read Senior Editor Scott Berinato’s article on antiforensics starting on Page 24 and you’ll see innovation at work, but you may not like the results. Investigators and researchers alike say hackers are forging new and more easily used technologies at a breakneck pace, effectively covering their digital tracks as they carry out whatever scam they please. As we’ve noted in other recent cover articles, Web application security is in a similar state—the good guys are working hard, but widespread adoption of their work is far, far behind the pace at which bad guys are implementing their own creative ideas. And social networking sites like MySpace are scrambling to catch up to miscreants playing in these new sandboxes.

I’ve never been a fan of the CSO-to-Board whine “We can’t quantify security but you aren’t spending enough money.” That’s why we incessantly write about metrics, return on investment and so forth. And yet when I consider the disruptive nature of the Internet, I have to conclude that CEOs are picking precisely the wrong moment in history to cheap out on cybersecurity in the name of margins. Consciously or not, CEOs have ignored the inherent risks of the platform in favor of what looked like easy money. Now, as Berinato’s story points out, and as news stories every day confirm, those risks are boomeranging back at all of us.

So on April 26 of this year, when a group of cybersecurity experts testified before Congress and said that the United States’ critical infrastructure is vulnerable to a potential “strategically crippling cyberattack,” my knee-jerk response was “Well, duh.” There’s little you do online that’s safe. Everything attached to the Internet is vulnerable. All those enticing profits and efficiencies from Internet commerce are daily being erased by identity theft, phishing, spam and badware in general. And the margins won’t return until we get into a deeper investment mode and stabilize this platform.