If we are looking at risk reduction, we should be asking ourselves “What is the actual cost of using offshore outsourcing for network and endpoint security?” In my experience, this is a situation where the cost to our business is not always obvious. Seeing the short-term gain of offshore outsourcing by the numbers when you initially evaluate this choice is overwhelmingly positive through the reduction of cost and the use of global talent. Looking at these options, many executives are markedly inclined to select the offshore outsourcing option.
This option allows businesses to achieve higher profitability and allocate resources more effectively, contributing to overall growth.
This sounds great. But is it really?
What about a compatible work model? What about a communication policy that is effective enough so cross-cultural groups can work together efficiently? What would a compatible and efficient work model look like across international boundaries? How is deep technical communication possible when groups working in different countries and across different time zones, speak the same language, but do not understand the underlying meanings which arise within different traditions and lifestyles?
Language barriers create misunderstandings and misunderstandings feed lowered productivity. In some cultures, it is difficult to say “no,” such as the head bobble, which can be difficult to interpret, to the hissed intake of breath followed by the statement, “That might be difficult,” which generally means “no.” Some cultures can lose face by saying “No!” I remember working with another American from Texas who was much older than me, and it always took me by surprise at the end of the phone call when I would say, “I hope you have a good evening, and I look forward to talking tomorrow,” to which he responded with a grunt and an abrupt hang up. I wondered if I said something wrong or annoyed him in some way. But I learned that it was not his intent to be anything but timely and concise. And he was from Texas, not another country. Imagine if I was from another country altogether when experiencing an abrupt hang up like that. It takes more experience and knowledge to bridge these communication gaps and expectation challenges.
As with some cultures, Americans sometimes view people from other countries with a mixture of bewilderment and mistrust. Alternatively, I have seen that American customs are just as often misunderstood by the people of countries utilized for offshore outsourcing. Communication alignment is a two-way street.
Unfortunately, communication challenges will always exist.
I’ve been asked by a few open-minded and curious people with whom I have worked internationally, “What is being American?” From a personal viewpoint, I find the answer to that question to be more complex than I initially thought. Understanding the answer from a professional and technical communication viewpoint is equally, if not more, challenging.
How do we answer the question, “What is being an American?” when asked by offshore personnel so we can begin to set work model expectations? This would include work model expectations of communication (ours versus theirs), of understanding goals and business vision (ours versus theirs), together as we protect an infrastructure from being hacked. And this is only one of the items on the task list that includes confidentiality issues and time zone hurdles. I experienced firsthand the decline of an offshore team performance as the “A team” that initiated the implementation moves on and is replaced by the “B team.” Rotating staff leads to another round of work model implementation and goal review to re-establish expectations from team performance during the time that teams are available. This becomes an iterative process of operational tasks that can significantly increase cost and risk to the organization.
We must also realize that the definition and understanding of confidentiality in one country may be different in another. Therefore, keeping up with expectations and being able to enforce them becomes disjointed. Transparency is also different in varying countries where lives are lived more openly in front of families and in homes with no private workspace in which to conduct their business without prying eyes and unnecessary questions.
Cyber security operations demand a higher level of confidentiality and transparency discipline.
Keeping your team in place and incentivizing them might be a better way to keep your risk reduction per unit cost in balance. Outsourced personnel will not be as loyal to the company as a long-term employee who has deeper relationships with other permanent employees. This lack of loyalty can lead to an attitude of indifference. What do they care if someone gains access to sensitive information? They have no incentive to protect sensitive information which can lead to the loss of intellectual property, which can, in turn, lead to lowered long-term profits and revenue stability.
Other questions that need to be addressed in addition to those above:
- How can we ensure that data resources are being protected by outsourced resources?
- What kind of process can we put in place to check that data is not being exfiltrated from our network? What kind of cyber security tools can I use to review whether my data is being exfiltrated or not?
- How can we ensure that the training is understood in the proper context, even if training is provided? What are the legalities if confidentiality is broken, if access to company systems has been provided to someone other than the employee hired via the outsourcing process?
- Contracts between countries can create legal inconsistencies. Would it be possible to have someone in the company to regularly oversee and monitor the outsourced employees? What would that look like? What are those costs?
As you can see, the decision to outsource your cyber security operations requires a great deal of thought, planning, and understanding of the citizens of the country to which you are outsourcing. If you are at that point in your decision-making process, we can discuss how to create another layer of checks and balances around your operational efficiencies and data exfiltration alerting. A place to start would be to know if you are having any data exfiltration issues before it is too late.
Let’s have a conversation about how these challenges can be addressed.