Risk Assessment




Risk Assessment Overview

There are several risks that are inherent in tracking and storing user information. High profile security leaks have been documented in the press in recent years, like Heartbleed, the Vault7 scandal, and Facebook’s involvement with Cambridge Analytica.  Privacy breaches are unlikely to happen, but the impact of their occurrence could be catastrophic for NZG. Because of the potential to wreck the company’s reputation for data safety, privacy concerns are likely the biggest risk faced by the company.

Other risks involved with the purchase of the subscription (rather than working within the confines of the free plan) are financial in nature.  As with any purchased plan, there is the risk of product failure, where no benefit is gained from the subscription. Luckily, since the product is web-based, NZG will not have to face the same infrastructure issues as seen at IVK (Austin, 2016). Still, there is a continuum of effectiveness along which the financial risk will be mitigated; the use of the appropriately sized tools will gain the most benefit from purchase.  This aspect of risk is addressed in more detail in the Cost Analysis and Value Assessment sections.


Privacy Risks

With the issue of privacy, the concerns surround questions of what is being tracked, how the data is being used, and by whom. Protecting our customer data are our primary concern here. Activity of users who visit our website will be tracked by our Google Analytics system. We want to make that clear by providing an easy to access privacy guidelines document written in clear language with no ambiguous wording or fine print that outlines for our customers what kind of data we track through our website, and how users can protect their information. But we know that the data tracking does not stop with NZG. Google plays a key role here. The data collected through our website goes through Google’s system and returned to us so we can make decisions based on the insights we glean from our website activity and traffic. We know there will be some customers who worry about whether NZG or Google will be storing their information, and we will make clear that this is not happening. The action we will take to mitigate this risk is to ensure that the data we collect is anonymized. Furthermore, nothing NZG provides to any third-party will contain any personal identifiers. Data analytics will be a major part of our “insights value chain,” i.e. the processes that turn raw data into business action (Mohr, N. & Hürtgen, H., 2018). As such it is in our best business interest to be as concerned if not more concerned about eliminating the liability that comes with storing personal data with personal identifiers by building our system architecture in such a way that this does not occur. The diagram below effectively shows how vital privacy and its associated legal considerations are to the overall strategy and vision of NZG website insights value chain fueled by Google Analytics.


Security Issues
One of the risks that come with subscribing to a service that stores a lot of information from many companies in a database is the threat of a heartbleed. Gallaugher describes this as a risk that comes with using open source software because not everything is bug free. When there is a coding error with the software and it is downloaded many times a hole, or heartbleed, begins to form. This can open the database up to hackers who then have the opportunity to steal information that was encrypted (Gallaugher, 2016).

Some of the potential risks that are involved are associated with the data and where it is stored. The data that is being collected and reported on is owned by the company. Since it is not stored by us but rather by Google Analytics and their team if there were to be a breach of security our information, along with others could be at risk. We might not even be the target but have that risk since we are not the company controlling security. On their website, Google explains that they safeguard the information collected by encoding it and then distributing the information amongst “ a shared infrastructure.” The information is stored at Google’s data centers in homogenous machines where they are able to watch over it and secure it further.

Discussion of Benefits
Ultimately we decided that the benefits outweighed the risks and we purchased the annual subscription for Google Analytics. The threat of Heartbleeds is arguably the biggest risk that is associated with the use of Google Analytics because while we do own our data, we do not have control over the protection that is placed over them. It is interesting to see that part of the reason we chose to purchase Google Analytics is part of the risks that we are faced. Because NZG isn’t a marketing firm and our goal is to move people from Earth to Mars, we wanted to spend as much time on R&D as possible. The risks and benefits that will be experienced during this coming year might be different than we could have imagined. It is important that we take the time to audit the work that Google is doing and reevaluate what we deem as important and if they continue to align with the direction that NZG is headed toward.


References

Austin, Robert D. (2016). The Adventures of an IT Leader, Updated Edition with a New Preface by the Authors. Harvard Business Review Press. Kindle Edition.

John Gallaugher. (2016). Information Systems: A Manager’s Guide to Harnessing Technology. Boston, MA: FlatWorld

No comments:

Post a Comment

Subscribe to: Posts (Atom)