The Critical Element Companies Are Missing in Digital Transformation Journeys

Digital transformation is no longer the exclusive domain of forward-thinking companies on the leading edge of technological advancement. It has become a cost of entry into competitive business. Digital transformation was already accelerating into the mainstream prior to the pandemic, but the jarring shift to remote and hybrid work put fuel in the proverbial jetpacks. 

In fact, in the Gartner® October 2021 report, Gartner’s 2021 Digital Business Acceleration Survey: The Speed of the Game Has Increased, it states that “over the last year, 65% of executives reported that they accelerated the pace of their digital business initiatives.”* Today, employees and consumers alike expect seamless digital experiences all day, every day.

In the end, Digital transformation helps a company better serve its customers by making its online presence more up-to-date, more actionable, and more adaptable to changing customer demands, internal needs and competitive pressures.  Done well, it’s responsive, flexible, and efficient. It accommodates location-agnostic operations. It can cut down on human error and facilitate automation. 

Moving to the cloud is an inherent, tactical element of digital transformation, and cloud-based operations can revolutionize how quickly, safely, and globally customers and employees can access the information they need, while at the same time saving costs and reducing the risk of data loss.

There’s always a catch, right? 

Digital transformation is a watershed moment for a variety of reasons. Aside from the benefits, it also means rethinking DevOps. With digital transformation, every company is building their own software applications and leveraging the advantages of the cloud. This has incredible potential, but it also invites unprecedented complexity. Even though businesses know security is paramount, it is becoming more difficult to implement.

Thus, the catch: Businesses are so caught up in the frenzy to embrace and accelerate digital transformation that they’re getting overwhelmed by infusing security into these new parameters. They haven’t forgotten about security; they’re just finding out that the old security methods they relied on before don’t work in cloud-native environments. There aren’t enough fine-grained access controls. And that is a major bottleneck to digital transformation.

It’s understandable that businesses are getting snagged here. When it feels like everyone around you is moving further, faster, it’s tempting to sprint to catch up. But without infusing comprehensive security into every element of your digital transformation process—starting right from the beginning—you’ll end up far more likely to go backward, at a painful cost. No one should move to the cloud without comprehensive security controls in place that address privacy.

“Security” is a big word and it’s broad enough to be intimidating, so let’s boil it down to the one security factor that is often overlooked: authorization.

Authorization for who can access what.

Authorization for what can access what.

Authorization for who and what can access what at what times under which circumstances.

Streamlined access is a major pro of digital transformation, but access without fine-grained authorization is asking for trouble. You need to be able to change the coding for the policy without changing the coding for the app. In other words: your developers need to be able to make changes to the application without accidentally changing the authorization logic, which could result in unauthorized access, and you guessed it – opening up your organization (and your customers) to security and compliance risks. 

Moreover, consumers are more wary than ever of how their data is used, and they demand a higher degree of privacy and control in order to do business with your company. Of course, at the same time, they still want that seamless digital experience.

The good news: those two things don’t have to be mutually exclusive.

Authorization and fine-grained access control are fundamental to security. As indicated earlier, the cloud-native stack (e.g., microservices, Kubernetes, etc.) is significantly more complex than before.  The old ways of doing authorization don’t cut it anymore, and it’s critical to rethink security at both the infrastructure and application level when engaging in digital transformation.

Where to start? The simplest (though perhaps not easiest) action is to extend role-based access controls (RBAC) with attribute-based access controls (ABAC) or even policy-based access controls (PBAC). This enhances the granularity and precision of access, maintaining privacy without disrupting the user experience. Implementing fine-grained controls from the start means the right people and applications have access to the right things at the right time. It limits the blast radius of mistakes, and limits security exposure by following the principle of least privilege.

Outdated authorization methods are coarse-grained and inefficient. The old models forced developers to write massive amounts of code, which was not only cumbersome but also difficult to maintain and not standardized.

Does standardizing authorization and producing fine-grained, precise protocols sound even more cumbersome and labor-intensive? It doesn’t have to be. Leveraging a tool like Open Policy Agent (OPA) means development teams don’t have to understand distinct authorization policies for individual applications or build authorization into each service separately. They also don’t have to reinvent the wheel every time something needs to change, such as a customer requesting even finer-grained controls. OPA delivers a unified policy language and, along with an authorization solution like Styra, makes it so that developers don’t even need to build the controls themselves. An authorization solution can do it for them, and be modified with ease.

If you’re going to invest in digital transformation and migration to the cloud, it’s worth investing in fine-grained authorization controls from the get-go. Otherwise, you’re creating more work and more risk—the very opposite of what you want to accomplish with digital transformation.

Want to learn more about authorization and OPA? Explore our in-depth guide, OPA 101: The Starter’s Guide to Open Policy Agent.

*GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved.