(Editor’s note: This is the 46th installment of a monthly column on the growing number of cyberthreats facing businesses of all sizes and what they can do about them.)
In the world of business and customer experience, the seamless, frictionless delivery of value is our north star. We bet on the idea that if we build our services fast, and we build them in the cloud, we will win.
But in May, Canvas – a learning management system used by countless schools and universities – hit a wall. A cybersecurity breach forced Instructure, the company that operates Canvas, and its customers to confront the tradeoff between availability and security.
For those of us in leadership roles and the boardroom, the Canvas incident isn’t just a headline; it’s a mirror held up to every strategy that prioritizes cloud-first without factoring in its dependencies.
We often treat our cloud providers like a utility company. But when we purchase a global software solution, we are inheriting the vendor's risk profile. If that vendor hasn't built a rigid, hardened security system and resiliency for their supposed enterprise-grade infrastructure, your company is living on a fault line. When the vendor’s security fails, your data and reputation are vulnerable.
If we examine the response to the breach, we see a tale of two realities. The "what went right" was the eventual technical containment of the breach. The vendor made the hard call to cut the cord to save the ship. That is expected of any enterprise-grade partner.
However, the "what went wrong" was in the communication with stakeholders. It’s where most organizations fail.
In the modern enterprise, the technical fix is only half the battle. The other half is communication.
When an outage or incident hits, the technical team often retreats into a cave of incident management or forensic analysis. Meanwhile, stakeholders sit in a vacuum. In the absence of an actionable narrative, your stakeholders – including the board, employees, partners and customers – will fill that silence with fear and speculation.
Businesses can’t wait for the vendor’s final forensic report. Some level of context must be provided, defining the risk and outlining a path forward. If you aren't controlling the narrative, the crisis is controlling you.
When responding to third-party vendor cybersecurity incidents, executive teams must have clearly defined roles and responsibilities. We shouldn't shrink into a shell of caution. We must evolve our practices and shift strategy from outsourced convenience to having verified partnerships.
Here is how leaders can adjust this positioning. First, ensure that you operate with a culture of shared accountability. The day of blaming the vendor is over. We are all part of a massive, interconnected digital fabric. We must hold our providers to the same rigorous audit, transparency and communication standards we apply to our own internal services.
Move beyond the black-box thinking and stop treating platform providers as simple vendor contracts. Demand visibility into their security, resilience architecture and data handling. If a provider cannot clearly demonstrate how they secure their environments, you have a material risk.
The bottom line is that the Canvas breach wasn't a tragedy, but it was a learning opportunity. It reminds us that our primary job is to manage the complex risk of the exponentially growing cloud-based, third-party digital vendors.
We need disciplined, ruthless vendor risk management and a leadership style that values honest and open communications.
The next time a core system hits a wall, let’s ensure we’ve already built the strategies to navigate around it. Let’s lead with facts, manage with transparency and keep our eyes firmly on the mission, protecting our clients and our company while the world continues to move forward.
Next month: Manufacturing is ripe for cyberattacks.
Jason Albuquerque is the chief operating officer of Pawtucket-based Envision Technology Advisors LLC. You can reach him at www.envisionsuccess.net.
