Just a few weeks into an engagement with a client, their office closed due to a pipe explosion in the building. We had been practicing the brand new Business Continuity Plan, and I had gotten a late night phone call just the previous week as part of the phone tree test. Now I was receiving the actual call. We were shifting to remote for two weeks. Laptops ✅, make sure the VPN was working ✅, environments accessible ✅, video conferencing for stand ups ✅. It was a little bumpy, but generally the things that needed to get done, got done. Now, all around the world people are experiencing this due to coronavirus, and it's testing our remote capabilities.
When remote work is tested, cybersecurity will be tested. Often the stresses on the cybersecurity of a company's information systems come from the gap between how the company imagines it operates and how it actually operates. Why would a company's collective belief about its structure matter? Conway's law states that the organizational design will be reflected in the system it designs.
Any organization that designs a system (defined broadly) will produce a design whose structure is a copy of the organization's communication structure.
— M. Conway[2], http://www.melconway.com/Home/Conways_Law.html
Companies design systems for their customers, but also their internal systems that require being secured. This is demonstrated by Manu Coronet's (a google engineer) famous comic to the right. While there are as many different structures as there are companies, to simplify things we'll discuss three broad categories for organizational design: hierarchical, matrixed and boundaryless.
King Stay the King
Traditional organizations filter information up, with the higher levels having greater access to information aggregated by the lower levels. This is seen in structures like the military, traditional corporations and wherever command and control is exercised. The cybersecurity properties of these systems reflect this and often rely on classifications systems like the Bell-Lapadula model, which can be summarized as "read down, write up."
Enter the Matrix
There is a lot of confusion about what a matrixed organization is. Simply put, it is a cross functional model where every employee has responsibilities to both their function (engineering, marketing, IT, finance, etc.) and a project or product.
After being the dominant trend in corporate America for the 1990's and 2000's, it became hard to tell the organizations that truly operated this way versus the ones that aspired to operate in a cross functional manner. The greatest challenge turned out to be in changing the mindset of managers trained on hierarchy to get used to the ambiguity of multiple responsibilities. The information model that aligns with this structure is the Brewer and Nash model, known for its flexibility and dynamism. It is well suited to consulting firms, which may explain why consulting firms often recommended it to their clients.
Sleeper Cell
This networked version of organizational design came of age with internet 2.0 businesses like Google, but historically they were the domain of clandestine operations like intelligence or terrorist organizations. These organizational choices have also created a new information security paradigm, zero trust. With the success of Google and the increasing pressure for organizations to share information and adapt quickly, the new business gurus are advocating a move from castle and moat to zero-trust.
Test Results
While popular trends, management gurus and political pressures will always be pushing your organization to adopt a structure that they prefer, leadership must decide what is best for the business. This may take some deep introspection, and acknowledgement that the systems and security models in place are mismatched to the task. I predict that when the shadow of coronavirus has passed over our doors and we can return to normal, many people will have had an unsatisfactory experience with remote work and the cybersecurity barriers/failures that it created. While people will be quick to blame cybersecurity or remote work, the failure is really in the mismatch between what people think of their organization and how it actually functions.