Digital platform technology choices: Cybersecurity and privacy

Is our platform’s commitment to building trust in the ecosystem adequately supported by its technological choices regarding privacy and cybersecurity?

This article is part of the Digital Platforms hub

Data privacy and cybersecurity choices provision the technical backbone for creating a trusted environment for the ecosystem.

A platform organization needs to clearly articulate and enforce its data privacy policy. To build trust with users and partners, the platform organization must have clearly structured data sharing arrangements and policies governing downstream secondary use of data, particularly around access to third parties, but also including data enrichment and transformation that the platform firm may undertake internally. To ensure that downstream processing is clearly defined and avoids unnecessary limitations, the platform organization should articulate its internal privacy policy as well as external privacy notice to ecosystem stakeholders. Where data moves across ecosystem players, every ecosystem stakeholder’s roles, access rights, ownership rights, and transformation rights with respect to data resources should be clearly specified. Managing data privacy also involves managing the trade-off between achieving the platform’s business goals driven by data and delivering agency to the user regarding control of data acquisition points including cookies, pixels, web beacons etc. To enable appropriate downstream usage, the platform firm should also manage data retention and transformation through effective aggregation and anonymization, to ensure it adequately uses data towards its business goals while also complying with regulation and addressing privacy concerns.

Platform organizations also need to set up the appropriate cybersecurity capabilities and defense to ensure data security and regulatory compliance. However, cybersecurity becomes increasingly challenging in an open ecosystem, where the platform firm is dependent on the security guarantees and policies of its ecosystem partners. As firms increasingly participate in open ecosystems, cybersecurity breaches are likely to increase. The speed with which malware and hacking evolve often outpaces the speed with which adequate responses can be developed and deployed. Moreover, the regulatory landscape to prosecute cybersecurity incidents is increasingly fragmented as every regulatory regime involves different requirements.

A platform firm should include cybersecurity as a core part of the partner due diligence review for potential partners. The risk associated with every ecosystem partner/provider/ consumer connected with the firm should be assessed, scored, and periodically reviewed.

Beyond partner review, the rise of machine-to-machine communication in ecosystems requires that access interfaces and credentials are appropriately architected with a view to securing all communication points. Verification of machine communication, for example, through cryptography, is essential to securely scaling ecosystem interactions.

The platform firm should ensure that its infrastructure and governance avoid attack points and single points of failure. Improvements in artificial intelligence and machine learning also, help analyze security threats and better identify malevolent access patterns.

Feel Free to Share

Finally, platform organizations – and more broadly, any firm participating in an open ecosystem – should develop an adequate post-attack response. This involves a plan to ensure business continuity, regain user trust, and manage forensics towards providing legally compliant evidence of the attack.

Beyond technological risk, platform firms should also consider the impact of reputational risk. On boarding third-party partners requires careful curation as these partners shape co-developed offerings in partnership with the platform. A platform business should set up adequate governance mechanisms to communicate the division of rights and responsibilities between the platform and its partners. Terms of services as well as dispute resolution mechanisms should accurately reflect this division of responsibility to avoid scenarios where the platform business takes on undue risk for partner participation.

For all the doom and gloom surrounding technology and reputational risks associated with a platform strategy, the risk of not participating in ecosystems at all is much higher Connected digital ecosystems are the new competitive landscape. Firms need to ensure their playbook adequately covers reputational and technological risk considerations as they participate in this new competitive landscape.

 Previous article related Digital Platforms       Next article related to Digital Platforms

Frequently Asked Questions

What strategies do platform organizations use to effectively balance data utilization for business goals while respecting user agency and privacy?

Platform organizations must carefully balance the imperative to utilize data for business purposes with the imperative to respect user privacy and control over their personal data. This balance necessitates clear articulation and enforcement of data privacy policies. Strategies may include implementing structured data sharing arrangements, defining policies for downstream data use, and managing user control over data acquisition points. However, specific approaches may vary depending on the platform’s business goals and regulatory environment.

How do platform firms in open ecosystems ensure cybersecurity is adequate, given reliance on partners’ security policies? How do they adapt to evolving risks and regulations?

In open ecosystems, platform firms face the challenge of ensuring cybersecurity amidst dependencies on the security measures of ecosystem partners. To address this, they may integrate cybersecurity into partner due diligence processes, assess and score risks associated with each partner, and regularly review these assessments. Additionally, they need to secure machine-to-machine communication interfaces, employ cryptography for verification, and adopt AI and machine learning to identify security threats. Furthermore, they should develop robust post-attack response plans to ensure business continuity, rebuild user trust, and comply with legal requirements.

How do platform organizations manage reputational risks in third-party partnerships and communicate division of rights and responsibilities to mitigate risks?

Platform organizations mitigate reputational risks associated with third-party partnerships through effective governance mechanisms. This involves clearly communicating the division of rights and responsibilities between the platform and its partners, reflected in terms of service and dispute resolution mechanisms. By setting up such governance structures, platform firms aim to avoid scenarios where they assume undue risk for partner actions, thus safeguarding their reputation in the ecosystem.