Are you guilty of causing an unknown error without even being aware of it? (hence - it being unknown 🙂)
I often meet with small city governments and municipalities to discuss their use of technology. Our conversations usually revolve around how they are leveraging technology, the results they’re seeing, and the potential risks and liabilities. Inevitably, these discussions also touch on budget and costs, which is no surprise given the need for fiscal responsibility.
In a recent discussion with a city government, the discussions morphed into helping them identify what kind of cybersecurity risks were present for them in their existing environment. With just about all organizations, there is always some level of risk and items that you will find in these scenarios. As we got deeper into the cyber analysis of their current situation it became clear that not much was being done on an ongoing basis to properly protect the organization and it came as no surprise to representatives of the city that we were meeting with. That was the intent of the meeting, to help quantify the vulnerabilities and what that might mean to them if threat actors were to take advantage of those.
The discussions ended up going forward to the point that the city decided to get bids from multiple providers to get them out of the scenario they were in. Again, nothing unusual and we know the drill and have participated in this type of process for years. The others that were selected to participate are familiar to us and for the most part, are good organizations. We just have a unique process that is different from all the others and as such our approach to solving the situation is very different.
Where things take a little different turn than normal is in the decision-making process. Long story made short(er), the decision comes down to the city council wanting proposals sent over for review and they will make the best decision with the information they have. The problem with this is that none of the council members or city staff are technical nor should they be. But, they are making decisions based on a printed proposal alone…. in the course of a two-hour meeting… with 15 other agenda items on the docket…. live-streamed for the world to see. Talk about having to make snap decisions under a microscope.
During the meeting and discussions regarding the proposals that were presented to them, the question is raised by one of the council members – “Well what of all of these solutions do we REALLY need”? This is followed by a question – “What have we needed in the past” and then a discussion ensues around just how often they call for support needs and how long it takes for those. Ultimately the discussion circles back to a decision of “Well we really don’t call that much so we don’t need all this” and the decision is made to choose the lowest price option of all the proposals. All the while, the elephant in the room is that the city was presented with information highlighting how vulnerable they were and what things were not being addressed on an ongoing basis up to this point. So the question of what they have needed in the past couldn’t be any less relevant. In fact, ALL of the vendors recommended solutions that would have addressed the vulnerabilities more appropriately whereas the cheapest solution was just trading the existing results to another vendor. An unknown error just occurred and the message won’t pop up for a while.
I understand that these meetings, like many board meetings, are time-constrained and involve volunteer positions. Decisions are made quickly, often without sufficient technical understanding. So, how can you avoid setting yourself up for these unknown errors?
Ensure that your decision-making process includes education and presentation components. Schedule time to talk to others who have gone through similar selection processes, research industry standards, and allow prospective partners to fully present their solutions and answer questions. Utilize technology for virtual meetings and recordings so that decision-makers can review information ahead of time. In this case, the recorded presentations were never viewed, indicating either a lack of interest or a timing issue.
Regardless, the question of – “How much of this do we actually need?” comes back to the top of the discussion. The only way you will know for sure is to invest the time and effort to understand where you are at, why you are there, and what is required to get you where you want to be. If you don’t, then unfortunately you are setting yourself up to see an unknown error pop back into view in the near future.