WORLD ECONOMY - Stanton Chase

More documents

Recommendations

Info

OCTOBER 2010 p6 CFOrole Middle East Globalization has caused a paradigm shift in the thinking of business owners in the Gulf which in turn has put new pressures on the C-Suite of the Gulf’s biggest organizations. The hinge pin to these changes can be found in the finance division of these companies, as they are now commonly interacting with International Fortune 100 companies and dealing with increasingly complicated projects. This requires a more sophisticated approach and in particular a seasoned and experience Chief Financial Officer. Times are changing, previously multi-million dollar companies could operate with a finance team led by a strong Controller or Finance Manager; today many organizations recognize the strategic advantage in having a seasoned Chief Financial Officer in the board room. As businesses grow and become more complex they now require their finance teams to manage M&A’s, divestments, global expansions, complex tax strategies, Sukuks, IPOs, and the internal complexities of highly diversified family businesses. While this growing need is great news for the hand full of seasoned CFO’s in the region, it is increasingly creating a talent gap which could potentially knee cap the regions ability to compete globally. Historically the GCC has not developed a talent pool of strategic CFO’s as most family offices and owners prefer to handle the financial strategic decision making themselves; thus stripping the CFO of his autonomy on critical business decisions. With a lack of exposure to some of the most difficult decisions in the business the Controller, Finance Manager or CFO is never developed to international standards. For example, as it relates to acquisitions the tip of the spear is generally the head of the family or one of the family members supported by the CEO and a team of Consultants. These efforts may be underpinned by the diligent work of the finance team in house but rarely will the in house CFO get the opportunity to lead the vanguard. To further dilute the CFO’s influence in the gulf is the role of the expatriate in the region. To a large extent the CFO is bound by an employment agreement which gives the employer a tremendous amount of power. Specifically the right to S T A N T O N C H A S E I N T E R N A T I O N A L ban the employee from the right to work for six months should the employee and employer leave on bad terms. Under western employment conditions the CFO is often in a position in which he would be comfortable aggressively challenging the board and other C-Suite executives, however in the MENA region this type of behavior can prove fatal. With out the safety net of being able to walk across the street and find a seat at a competitor the CFO can be held hostage. This often reduces the amount of candor the leadership of a company can bring to its owners and makes employees think twice before raising a red flag. The only solution under this premise lies in the development of strong local talent which is not bound by the limiting employment visa of the expat. As more local CFO’s emerge the CFO will have a more aggressive voice within the organization. The development of strong local talent requires an effective knowledge transfer, which is happening, however at a snails pace. There are many reasons for the slow pace of change in the CFO role in the Gulf. To start with the region is already starved for CFO’s, making it difficult for an emerging star to identify a suitable mentor. The issue of CFO succession planning is compounded by global trends which find the jump from Controller or Finance Manager to CFO very difficult even in mature markets. In fact at Stanton Chase International our research shows that less than 40% of the CFO’s promoted from within come from the Controller position. This is be- Executive Newswire By Shane Phillips While local businesses were once content maintaining front rank in the domestic markets which they operated, their thirst for success is no longer satiated by national leadership; they are now driven to emerge on the global stage and take a seat on the podium. The views, comments and opinion highlighted in this article are solely the personal views of Mr Shane Phillips. Consultant with Stanton Chase UAE for Financial Services & Member of the Board of Directors of the Canadian Business Council, Dubai & Northern Emirates cause there is a significant gap in the skills required by a Controller versus a CFO, and few companies have a training and development or mentorship program in place to bridge it. Given this gap and the immediate pressures the emerging markets place on an organization, most clients prefer to hire a CFO from outside who can hit the ground running rather than take the time to grow their Controller or Finance Manager into the role. That said there are new local CFO’s emerging across the region who represent the seeds of change and a new generation of leaders who are beginning to sprout up across the landscape. Mr. Mohammed Al Qatari, Chief Financial Officer at Dr. Sulaiman Al Habib Medical Group represents this new generation of local talent.… “The role of finance within organizations is evolving, where as previously they required a Finance Manager, they now require a true CFO who can be second to the CEO, helping set the strategic direction of the company, reaching out to capital markets, creating sukuks, creating new areas of financing. The type of manager required is becoming more sophisticated.” In a market where the only constant is change, the Middle East has made huge strides forward in the last decade and organizations and executives have struggled to keep pace. The rate of change within an organization must be greater than the rate of change within the market; otherwise they will find themselves in an uncompetitive position. Change is managed by the senior leadership team of an organization, this means the rate of change at which the executive team is developing must also be greater than the rate of change in the market. This requires a commitment by locals to develop themselves and to operate outside of their comfort zones. A trend we can see on a macro-level with programs like the Sheikh Mohammed Bin Rashid program for young leaders and Saudi Arabia’s recent colossal investments in education, which is currently the highest in the world. While the commitment from local leadership is mirrored by the dedication from GCC nationals, the effects of these efforts is still to be felt and I am sure in the long run the Middle East will reap the benefits.
OCTOBER 2010 p7 *To Build or NotTo Build This topic is too long for one article – however the goal is to give a high level overview of why organizations are / should be moving transitioning to Managed Security Services. Information Security can be defined in many ways but in its simplest form it spans People, Process, Procedure, Products and is concerned with Confidentiality, Integrity, Availability, Privacy, and Compliance of an organization digital or electronic asset. The past two decades have brought about a lot of innovation in software, hardware, intellectual property, digital rights, etc but it has also introduced an increase in malware, hacker and organized cybercrime where our businesses are online all the time 24x7. Thus emphasis on information security has gone from nice to have to a must have in most organizations including some being regulated (PCI-DSS, EU Data Protection) which has made CxO level executives responsible and sometimes financially liable. Until regulators and organizations hold executives accountable and liable in the Middle East much of the same problems will continue based on each individual executives capabilities and beliefs. The topic of discussion is how we transition in this E-Era to manage our governance, risk and compliance (GRC) through security monitoring and management of our critical assets including our security devices (firewalls, IDS, IPS, Anti-Virus, etc), Servers, Network Equipment and Applications. The concepts of Defense in Depth, Layered Security and Holistic Security have lead to a lot of security devices working as silos with very little correlation if any. Over the past decade I have focused my attention on the dilemma of managing such large number of disperse heterogeneous systems from various vendors and trying to generate meaningful and actionable security incidents that can be managed by a security department or Computer Incident Response Team (CIRT) as well as reports to support compliance and information dissemination. An organization typically has three options when dealing with the need to manage their security and risk through a 24x7x365 monitoring and management function. The first is the most recognized form which is to build an internal Security Operation Center (SOC), the latest and most robust is to outsource to a Managed Security Services Provider (MSSP) and the last is to simply Pray which is what I see a lot of in the Middle East and North Africa. I will start with the last one as it is the one that gets most organization in trouble and is not a sustainable or credible model in the mid to long term. S T A N T O N C H A S E I N T E R N A T I O N A L Prayer is not a strategy for achieving information security; it doesn’t hurt but doesn’t replace the need to either build or outsource this critical function. To Build or Not to Build that is the question or in most cases the dilemma. There is no clear cut answer that applies to everyone – it really depends on the situation. Globally most mature organizations have already launched a Security Operations Center (regionally this is limited) and have been benefited from the pros and suffered from the cons which will be discussed later. While more organizations in the last half of the previous decade benefited from the maturing and more accepted MSSP market by avoiding the investments and headache of building, operating and managing a SOC (this is still in its infancy age in the region). Then there are those who decided to build and then transitioned to MSS. In most cases organizations put this requirement off as long as possible until the problem of managing the security becomes too obvious or regulation forces them to. In other cases, organizations adopted best practices and standards like ISO 27001 which require monitoring of critical assets. Whatever the reason and no matter what the size of the organization if you are connected to the Internet you are a potential target for a cyber attack. Hackers or Cyber Criminals typically exploit victims who are easy targets which unfortunately most of the region is. Organizations that have ignored best practices including regular vulnerability scanning, penetration tests, patch management and maintenance / configuration controls on security appliances are the most likely to experience a successful attack ranging from being a nuisance to brand impacting to financial losses. I equate the cyber security challenge as an on-going war. When a nation goes to war it typically has a modernized, equipped and qualified military that is ready to defend the entire nation – in this scenario a MSSP. We don’t typically see individual towns, cities, states nor companies have their own military or militia or in this case Security Operation Centers. The costs of trying to achieve this would be much higher than any one organization could justify in most cases because the cost for Personnel, Equipment and Operations would be too high. This is one of the key reasons SOC’s fail; the high OPEX and CAPEX required to truly meet the functions that will improve an organizations security. For a SOC to match a MSSP in functionality it would need to provide at minimum the following functions: Security Event Management, 24x7x365 monitoring by a qualified team of security analysts, incident ticketing / workflow, reporting / dashboards, service level agreements, change management, health monitor- By Samer Omar Executive Newswire To say we live in an E-Era is probably an understatement. Everywhere, Everything and Everyone is implementing an E-initiative including E-Government, E-Banking, E-Commerce, E-Health, etc. It is clearthat InformationTechnology has, is and will always have an impact on our lives. This is what makes the topic of Information Security pivotal to our E-Future where we will be living in a connected world and are always connected. The views, comments and opinion highlighted in this article are solely the personal views of Mr Samer Omar. Co-Founder / Executive Board Member of I(TS) 2 ing, log monitoring & retention, threat intelligence, vulnerability management, device management, disaster recovery and more. The problem is that most enterprises embark on building a SOC and only have the first four in mind which doesn’t provide the appropriate level of security monitoring and operations. The neglect to really analyze the TCO of the SOC because they are technology focused. Combine this with the fact that 80%+ of threats come from insiders – this means without the appropriate internal controls an organization is handing over the keys to the kingdom to those same people who are prime suspects in any potential security breach. Add to this that organizations have very little recourse other than termination of an employee even if a breach is due to their gross negligence (in some cases there may be legal implications but the laws and courts in the region are not yet mature enough to prosecute). Finally, the door to most SOC’s should probably be replaced with a revolving one due to the low retention rate of these resources who are in high demand. This is why I favor a qualified MSSP; because not only do you get the other functions listed above but they are typically backed by professional SLA’s which include service credits, penalties and insurance for gross negligence or errors and omissions. Also you buy security for your size organization based on the number of devices you have; buy a ticket not the plane. There are many other advantages of going with the MSSP option but you should be careful in selecting the right one because not all of them are qualified or focused. My top five recommendations are to: Select a trusted and recognized market leader (Gartner or Forrester) with proven experience and references. Select a MSSP vendor that has local and regional support including an incident response capability to include on-site response in case of emergencies. Select a MSSP who understands your local laws, regulations, customs and language. Select a MSSP who has a firm commitment in the region in the form of actual infrastructure (SOC, DC, Resources). Select a MSSP that has global affiliations or associations (first.org) that provide better threat intelligence.
Page 1 and 2: OCTOBER 2010 Executive News for Cor
Page 3 and 4: OCTOBER 2010 p3 S T A N T O N C H A
Page 5: OCTOBER 2010 p5 F R O M S T A N T O
Page 9: OCTOBER 2010 p9 S T A N T O N C H A

WORLD ECONOMY - Stanton Chase

Create successful ePaper yourself

Delete template?

Save as template?