In this long-form interview, I talk with Martin Zorn, the President and COO of the world’s leading provider of risk management solutions, Kamakura Corporation.
I reached out to Kamakura recently because of their unique position in relation to what could have been ground zero for a catastrophic event to the likes that we have not seen this century. I am referring to the event on January 13th 2017, when the emergency broadcast system in Hawaii sent out a message to all cell phones, radio, TV and every other mechanism available. It read “BALLISTIC MISSILE THREAT INBOUND TO HAWAII. SEEK IMMEDIATE SHELTER. THIS IS NOT A DRILL”.
Fortunately this was a false alarm, caused by human error clicking the wrong field in a drop down box.
Kamakura Corporation has regional offices in the US, Canada, Asia, Europe, Middle East, and Africa. However, their headquarters are located in Honolulu, Hawaii. As a company focussed on risk management, they were perfectly positioned to offer their insight into what the immediate and residual effects would be to their organization if the event in Hawaii was not a false alarm.
Here is the audio podcast:
Interview transcript:
Daemon Behr: [00:00:00] This is Technology Emergence podcast, episode one. This week we will be talking with Martin Zorn, the president and chief operating officer of Global Risk Management Firm Kamakura corporation. We will be talking about I.T. and operational risk in the event of a ballistic missile attack and what organizations should be considering when planning their strategy for long term viability.
Daemon Behr: [00:00:36] I’ll give you a bit of an overview of my role and what I hope to get out of this meeting and then perhaps you can give some background on your organization. And I have a number of questions but I’d like to discuss with you in terms of operations and how that relates to risk management. What my role is within the organization is, I’m a Solutions Architect one of the areas I focus with customers is looking at infrastructure risk. And that relates to understanding what areas they are bolstering understand where they have risk from a technological standpoint. And going through this procedure, it inevitably comes to the conclusion that the issues that we have are on the infrastructure side are only one part of the problem. Other areas such as financial risks, market risks, operational risk and so on. But I’m looking in the other areas to see what are the relationships between these areas and how are organizations actually approaching these other areas. From a technological standpoint, it’s fairly straightforward to look at applications and business continuity in providing application redundancy internally and externally to the employees and customers. But that is only one part of the puzzle. If they don’t have the infrastructure set up for management, process, and leadership within the organization then that can cause a real hindrance to the long-term survivability of the organization. If there is a disaster situation that occurs. And the reason that I reached out to yourselves in that regard this specifically is for a number of reasons.
[00:02:24] The first one is that you are a global risk management organization and you have experience in many different regions but your headquarters is also in Hawaii which relates back over to the recent issue that happened with the notification going out with the fake ballistic missile that broadcasted on all alert mechanisms. Since your headquarters is in Hawaii itself I’d like to get your take on what your organization does in this sort of situation how you would respond to a situation where your headquarters would lose communication or there would be infrastructure issues and you wouldn’t be able to communicate with the rest of your organization globally. What would that look like in terms of business continuity from a leadership and communications perspective
Martin Zorn: [00:03:22] Sure. Though let me give you a little bit of information on us, so you as as you noted we’re a global risk management firm. We have two products we have an enterprise financial risk management system which is licensed and installed on site. Currently it is it’s installed in financial institutions both banks insurance companies in 48 different countries. And then we have a default probability or a risk information subscription service that is both accessed online as well as the data is accessed via FTP download from a from a personnel standpoint here in Honolulu we have myself as president as well as our founder and CEO and we have the majority of our development staff here so we have approximately 25 people here in Honolulu now we’ve got the majority of our people are distributed around the globe closest to our clients. So, we have we have our Chief Technology Officer as well as the head of a global client services customer support is the two of them are located in the Los Angeles area. We’ve got sales personnel in North America in Toronto and New York and our North American client services head is in Chicago. Then we have people in Europe and Asia with client services locations in Singapore for Asia and in London four for Europe so pretty much we’ve got our staff is distributed globally in in different locations. From a systems standpoint, today we run two colocations that back each other up so we have a colocation in Honolulu and we have the colocation in a Agoura Hills California. And so, you know if if we lost one and you know the risk is if both of them are down.
[00:05:51] So I guess outside of a real missile that hits hit Hawaii our biggest risk today would be a tsunami in Hawaii occurring at the same time as a major earthquake in California. So, having said that we’re in the process right now of testing a cloud installation in which we’re using Amazon AWS. And you have an instantaneous backup of all of our systems. So, keeping in mind that the only thing that we have that you know would be production is our risk information service which people would you know access online. And that is now really only interactive during the day but our batch process is done at night and could be done either of the two locations and shortly as well in the cloud. So, from a client standpoint but you know if something were to happen in any one location it wouldn’t affect ah, it would not affect any production operations that we have. Now further because our client services is dispersed you know between North America Europe and Asia with you know three different three different areas. You know to the extent that we lost you know one or more locations. All the information is available to all of them and that provides we have the primary support that would provide from a client standpoint if we’d lost one or potentially even two of our locations would be able to continue to provide our clients with support.
[00:07:47] Now you know the question that you asked if let’s say we’ve lost our infrastructure here in Hawaii that the basic risk that we would then then run into and let’s say it was a you know a missile and we not only lost infrastructure but the people as well as the rest would really be on the development side in terms of the impact of future development. But given the business model that you’ve described to you we would we would be able in the short run to continue to provide any production services that clients around the globe have contracted with us. You know probably the trickier part would be would basically be related to communication. So again, if we lost the key management people here in Hawaii we’ve got we’ve got a senior executive that runs all of our product development that’s in in New York. And then what would you know. We have senior members of our senior management team basically in New York, Los Angeles, Chicago Munich, and Singapore, in addition to Hawaii. So, you know what we probably you know as I talked to you probably need to do is in our business continuity plan. We probably have not addressed the situation if you know the Hawaii based management was were wiped out kind of you know what the official succession would be. I think you know obviously then succession would pass on to our senior executive in New York that runs product development.
[00:09:47] And as a member of our board as our next most senior person in the company.
Daemon Behr: [00:09:52]That sort of escalation within the organization to promote people over to the senior level. Is that something that’s done by a lot of organizations, or is that commonly addressed?
Martin Zorn: [00:10:08] With the risk that you’re mentioning probably our history is fortunate for us to be organized the way that we are because the company started with the name Kamakura, we started in Japan we moved our headquarters to Hawaii in 1995 but we always had the goal of being a global company. And such. In part, we moved to Hawaii because of the advantageous tax code that was in place at the time. And as a result, we’ve always had global customers and we’ve worked pretty much in all 24 time zones. So, we’ve had to by virtue of our you know our business and distribution of our client base really be able to work in a virtual environment around 24 time zones around the globe. So, you know, what it’s done just because of the history of the company and our strategy and how we’ve evolved it. It’s actually you know put in place that built-in redundancy because at any point in time we have you know two thirds of our operation you’re working and supporting customers you know with at least one third of that you know being in a in a time zone that is either in it or not it not at work or in sleep or things of that nature. So, you know it’s forced us to you know create a very flexible management structure and to have you know managers around the globe that are enabled to do their operation without necessarily contacting a home office.
Daemon Behr: [00:12:16]Okay. And one thing you mentioned before which I would like to talk a little bit about is the possible scenario that you mentioned where there is a tsunami in Hawaii and possibly another event happening over on the West Coast of the states as well whether it’s an earthquake or otherwise. Have you gone through the probably of those and have you measured what the cost would look like to mitigate those risks?
Martin Zorn: [00:12:48]So in part, the movement to the cloud mitigates that risk. In terms of the probability of both those happening are pretty small in terms of the biggest risk to Hawaii, is there is a tsunami and you have the biggest risk of the tsunami occurring here is primarily earthquakes located either in South America Alaska or Japan. You know just from a physical standpoint an earthquake in said the San Andreas fault or an earthquake that would affect their colocation in Agoura Hills California would not create a tsunami risk for Hawaii just because of geography. You know the probability of major earthquakes happening at one of those other three locations at the same time as a major earthquake in California is also you know pretty remote since it’s never happened before.
Daemon Behr: [00:13:59] What tips would you give to other organizations that are spread out globally and are having similar difficulties and that they want to ensure that they have business continuity strategies in place. What advice would you give to them?
Martin Zorn: [00:14:18]The advice I would give is that the business continuity plans are basically structured around two things either the loss of the loss of a physical compute site and therefore some sort of alternative site that has different risk characteristics. And I think most companies cover that fairly well. Secondarily most business continuity plans you assume either the loss of an individual key team member or communications for some limited period of time. And what I would probably suspect is that most business continuity plans would not encompass a large-scale loss of critical management at the same time. So, in other words what I suspect is similar to us as the CEO and myself. Generally, we would not fly on the same plane. So, we’re both going to a meeting on the mainland. We would take different flights. You know there have been cases for example where your management teams have gone have all been together and have gone down in a corporate plane and most companies have reacted to that and critical management would not fly on the same aircraft together. You know for that risk of losing a management team as opposed to a member of management in the case of what we had if we assume that an incoming missile was real from Korea there really is not much that can be done to prevent that type of destruction of the entire management team at once. So that’s probably not something that is new baked into most people’s business continuity plan.
Daemon Behr: [00:16:17] Okay great. You’ve provided a lot of fabulous information and it has been very valuable. And I really appreciate the time that you have taken to spend with me to discuss this.
Martin Zorn: [00:16:28] Sounds good. Been my pleasure and good luck.
Daemon Behr: [00:16:33] This has been the Technology Emergence podcast. You can find us online at DesigningRisk.com/podcast or Soundcloud.com/Technology-Emergence
Designing Risk in IT Infrastructure 