When the entire enterprise is connected and processes are intelligently automated, organizations can innovate and to create lasting, sustainable value and tangible business outcomes.

In Arthur Conan Doyle’s first short story about fictional detective Sherlock Holmes, a mysterious letter is delivered to Baker Street.

Dr Watson asks him what it means – and Holmes replies, “I have no data yet. It is a capital mistake to theorize before one has data. Insensibly one begins to twist facts to suit theories, instead of theories to suit facts.”

He was right, of course. It’s unwise to shape new ideas without any data. But we’d add, it’s not just about the presence or absence of data, but about the quality, specificity, and the insight it reveals.

The more of it you have, and the timelier it is, and the more comprehensive it is in scope, and the more relevant it is to your purpose, the better you’ll be able to innovate and to put momentum behind your ability to create value.

Data + intelligence = information

What’s needed first is an approach to digitizing and integrating business processes. Data drawn from individual areas of the organization is just that: it’s data. It’s partial. It’s like being given directions for ten miles of a 100-mile trip.

What’s also needed is the introduction of smart technologies that help to organize, streamline, and prioritize all that data, so that it starts to make sense and becomes a basis on which judgements can be formed and decisions made. That’s when data stops being data, and becomes information.

At Capgemini, our Intelligent Process Automation (IPA) offer is a case in point. Its aims are to integrate and automate business processes, and reduce and eliminate any sources of friction (see Figure 1).

By introducing robotic process automation (RPA), artificial intelligence (AI), and smart analytics, businesses can make data actionable. The workforce is given the information and the tools to gauge the status of things, and to identify and respond to challenges and opportunities, so a climate of creativity can emerge and evolve.

Figure 1. An approach to end-to-end advisory services for Intelligent Process Automation

Transformational differences

When you can see everything, and when smart tools help you spot key facts and trends, you can think in new ways, and then develop and implement your innovations in ways that radically transform entire processes, rather than merely tinkering around the edges.

Let’s take a look at how an approach such as Intelligent Process Automation can make a difference in foundational areas of the organization.

Human resources

The ultimate aim of HR includes the ability to attract candidates and to support and retain employees.

A smart and frictionless HR operation can, for example, extract information from a CV, pre-create contracts, schedule interviews, validate documents, and source and recommend candidates.

We’ve found that a smart, integrated solution such as IPA can typically deliver a 40% reduction in cost of service and productivity savings of 50%.

Finance and accounting

Similarly, an intelligent and integrated approach to finance and accounting can enable information to flow seamlessly in areas including accounts receivable, cash applications (the matching of information), invoice processing, and employee expense management.

For example, a smart, automated approach to the SAP operations of a Swedish multinational power company rapidly and accurately processes millions of invoices. Benefits include the automatic processing of 550,000 transactions a year, the automatic dispatch of 82% of tickets, and the automation of a full 100% of daily scheduled runs.

Supply chain

Supply chains probably provide the most tangible demonstrations of the case that can be made for integration and intelligence, since they are by their nature physically disparate.

A smart, cohesive, and comprehensive approach can increase accuracy and efficiency in the creation, editing, and transmission of purchase orders; in shipment document creation; in order status tracking; in updates to workers’ timesheets and inventories; in smart transport planning; in supplier risk assessment; and in demand forecasting.

For instance, a European multinational food packaging and processing company integrated and automated functions across its operations. The benefits in supply chain management alone include the use of AI to reduce the time taken to process inbound warehousing documentation from eight hours to just two hours.

Customer operations

A smart and seamless model can be a major factor in a business’s ability to attract and retain customers. Relevant customer operations areas include query classification, creating and updating tickets, generating call transcripts, automating audits, providing near-live translations, sentiment analysis, and contextual pop-ups to assist customer agents.

For example, a multinational healthcare organization uses AI-powered virtual assistants for sensitive personal conversations with patients. The aims include the ability to reduce their pre-and post-surgery burden, provide treatment guidance in a discrete and interactive conversational format, offer a supportive and caring approach facilitating peace of mind, and to answer pre-defined scientific and fact-based FAQs.

As a result, productivity has increased 225%, and there have been over 100 instances of minor continuous improvement of the items implemented.

The Connected Enterprise

The examples above have been drawn from individual business areas within organizations – but as we made plain earlier, benefits accrue to an even greater degree when the entire enterprise is integrated, and when intelligent processes are brought to bear. When everything is connected, and when everything can be seen and examined, organizations find it much easier to innovate and to create lasting value.

It’s what we at Capgemini call the Connected Enterprise – an approach we use to seamlessly orchestrate an integrated, intelligent ecosystem of people, processes, and technology that drives enhanced, sustainable business value and outcomes across your organization.

In short, a Connected Enterprise can innovate based on knowledge and insight. It can twist theories to suit facts, rather than vice versa.

We’d like to think Sherlock Holmes would approve.

This article is published in the new edition of our Innovation Nation magazine. Read more from our special feature on “Automation and the data-powered organization” and download the full magazine.

Brandon Deer, Chief Strategy Officer at UiPath, talks to Capgemini’s Marek Sowa about how UiPath’s automation and AI solutions are driving people to achieve more and how its partnership with Capgemini continues to deliver business value for our clients.

Marek Sowa: Brandon – thanks for joining me today. I’d like to start by asking you about how UiPath’s strategy has changed from being RPA-first to being a market-leading enterprise automation platform?

Brandon Deer: In the last several years, UiPath has transitioned from being a relatively small startup based out of Bucharest with a single product set, to a global organization of over 4,000 people and a platform of over 20 different products that are connected into a seamless and fully integrated service.

All of UiPath’s tools are designed to lower the entry barrier for companies who want to get involved in automation, while our own curiosity helps us find new avenues for improving our clients’ ways of working. However, we noticed one, small problem with our strategy recently – we realized that not everyone is an automation or AI expert.

To use an analogy, we’ve gone from providing a blank canvas, the best paints, and the finest brushes, to understanding that our clients might actually be daunted by an empty canvas and might not know how, or where, to start their automation journey. What they need is some kind of structure to follow – a little nudge in the right direction in terms of the business processes or areas in their organization that could be automated and what their ROI might be.

And in some cases – for example our communications mining tool – we provide a fully painted canvas. You simply point out a specific set of tasks and the tool does the work.

How have automation and AI become the differentiator for human achievement?

That’s a really interesting question. In many ways, there are a lot of parallels to be drawn between the automation and AI revolution and the industrial revolution. The combination of AI and enterprise automation provides a leapfrog capability to humans who have historically just been able to move one foot in front of the other.

UiPath has always been focused on a set of highly manual, repetitive tasks that were largely back-office oriented. This was our bread and butter. But the emergence of AI has helped us remove much of the grunt work in the front office.

For employees, it means having more time to work on higher level, more strategic work. While for enterprises, automation and AI are the most scalable component of their human workforce – which makes it more flexible, productive, and profitable as a result. If you’re freeing people up to do strategic tasks that up leveling is unbelievably critical in producing more productivity and providing more margins.

In practice, automation and AI are uniquely situated between the applications and systems used by many global corporations – putting them in the ideal position for gathering and interpreting data quickly and easily. For example, think of a JIRA ticket. Automation- or AI-based models can interpret what customers are asking for, and instantly provide a recommendation on how to resolve their issue.

Once a decision is made, the technology reaches out to the customer or sends the conversation to a human manager for escalation – without breaking any governance or security protocols. This is what makes UiPath’s technology special, it provides a huge technological advancement to all its users.

What skills do individuals need to excel in today’s increasingly automated world?

Anytime you have a paradigm shift like the one taking place with AI right now, there will inevitably be skill changes in your workforce. For instance, many of us would benefit from being proficient in AI. Knowing how to work with this technology is going to be crucial for us to get the best out of our careers in the very near future.

I also think that understanding bias detection and handling is important. For example, if you’re going to be working with large language models you need to have good judgment skills. Both in terms of translating the transcripts they provide into plain English, and understanding what information will work best if you want to improve their future outputs.

These two skills will be crucial to excelling in today’s increasingly automated world.

How will advancements in automation change enterprise-level decision-making?

If you put openness, flexibility, and infrastructure front-and-center I don’t think you need a new set of security and change management protocols. Additionally, a simple governance layer – something that UiPath provides out of the box – will help you provide data-masking capabilities as well as certain parameters around the data types that can be uploaded into your new AI model. All of which ensures it will run off the best data possible.

Adding layers of auditability, data masking governance, and security to your business through automation- and AI-based models is possible, without making huge changes to your business. This is key for any organization that wants to leverage and democratize automation without causing major disruptions to their business.

How is automation impacting innovation?

Automation enables companies to do more with less, which enables them to invest more time into business-critical tasks. This is the core of what UiPath does.

In fact, just as cloud technology enabled agility, speed, and cost savings in the early 2000s, so automation and AI are the next step function shift for enterprises to continue on that same path forward.

And finally, how is UiPath’s partnership with Capgemini driving a compelling IA value proposition for its clients?

Building on a robust foundation of technical collaboration that started in 2015, Capgemini and UiPath have worked hard to define and deliver an AI and automation platform that meets the needs of today’s enterprises.

Together, we deliver business value that goes beyond simply automating repetitive tasks. Through standardizing and optimizing processes, our integrated, AI-enabled solutions help enterprises boost productivity, customer experience, and employee satisfaction while improving efficiency and reducing operational costs.

But I believe there is much more for us to achieve together as we head into the cognitive era – an era that is not only redefining business, but what businesses need from a joint Capgemini and UiPath intelligent automation platform.

As enterprises worldwide shift gears to drive greater profitability and competitive edge in today’s highly volatile and customer-centric market, our partnership and joint, synergistic solutions will help them effectively navigate the new paradigm.

Brandon, thank you for talking to me today. What you’ve said really highlights the strength of the Capgemini-UiPath partnership and the potential automation has, not only for organizations, but for society as a whole.

Brandon Deer is the Chief Strategy Officer at UiPath. Brandon was an early employee of UiPath and has helped grow the business from $30 million in revenue and a couple hundred employees to over $1 billion in revenue and 4,000 employees. In addition to Brandon’s commitments at UiPath, he is the Founder & General Partner of Crew Capital, a global, early-stage VC fund that focuses on innovative and industry-disrupting software companies.

This article is published in the new edition of our Innovation Nation magazine. Read more from our special feature on “Automation and the data-powered organization” and download the full magazine.

The competitive advantage promised by applied AI is very much here. And it’s delivering competitive advantage for organizations in the transformation business operations.

As my colleague Arul Pradeep writes elsewhere in this edition of Innovation Nation, practical examples are generally better than theory, and show is generally better than tell.

Which is why I thought it would be useful for me to provide examples of applied artificial intelligence (AI). The two implementations I’ve summarized below are very much in the real world.

Language dependency reduction

Whether they are for customer services, supplier assistance, or HR purposes, the support functions of major enterprises have a major hurdle to overcome – and that’s language. Global enterprises must serve the information needs of everyone who gets in touch, no matter where those people are and no matter what language they speak.

Multilingual helpdesk staff can help, but that only gets you so far: they can’t cover every translation permutation. Nor can they give assistance at the scale a multinational organization would need. This is partly because they can only help at a conversational level and can’t translate documents over the phone, for instance.

Capgemini’s language dependency reduction (LDR) solution was developed to meet this challenge. It automates the translation of text in documents while maintaining their format and document structure. This helps reduce dependency on language resources and perform operations globally.

What’s more, it infuses custom translation instructions with enterprise glossaries that extend beyond standard language to improve translation quality. These include generic business terms and acronyms such as “P2P” (procure-to-pay), but also includes context- and abbreviation-aware text enrichment specific to domains and organizations, such as abbreviations of product names and context-based translation.

The solution can handle emails as well as documents in xls, pdf, jpg, doc, html, and ppt formats. It can translate over 150 languages, it holds its data securely, and it easily integrates into applications APIs. It’s this specificity of the solution to the language, terms, and customs of individual enterprises that sets it apart from other online translation offerings.

Predictive analytics

A US-based multinational office supply company was constantly improvising its collection strategy. Before payments had reached a point at which they were deemed to be ageing, it was difficult to go through call logs manually to check whether settlement had been promised or refused. With over 60,000 call logs each month, it was proving to be a challenge to manage the process manually where actions are pending to expedite cash collection.

Capgemini proposed a scalable solution driven by AI and natural language processing (NLP) that can read through the user comments from the call history and automatically derive insights from the call log. It can also classify the call logs into the required groups to derive business insights and provide courses of action for the collection strategy.

Each call is automatically collected from Webcollect and the conversation transcript fed into NLP-based model to provide predictions in real time on the required onward action. The call log is classified and assigned to one of 12 different categories by the solution’s machine learning algorithm. The system also integrates these predictive analytics with an Intelligent Control Center dashboard that provides overall visibility over finance operations.

So far, our client has found the solution’s predictions are 90% accurate. Cash collection has been expedited and efficiency has improved. What’s more, trials have shown not only that the approach is scalable, but that model accuracy can be heightened with the introduction of more data.

Tangible results

At the time of writing, these two projects are close to deployment, and the competitive advantage they promise to deliver explains why I’ve been unable to name the clients involved. It’s safe to say, though, that both organizations are excited by what they’ve seen so far.

Artificial intelligence is very much here, very much now – and it’s very much delivering.

This article is published in the new edition of our Innovation Nation magazine. Read more from our special feature on “Automation and the data-powered organization” and download the full magazine

Creating a transformative people experience that caters to the needs of both the organization and its workforce requires embarking on a journey comprising 12 crucial steps.

In this article, we will outline the People Experience approach, developed by Capgemini, and summarize the 12 necessary steps to make it a reality.

Pillars of an impactful people experience

To ensure success, organizations must build their approach on four foundational pillars:

• People first – establish a mindset that prioritizes employees at the core, just as customers are valued externally. Develop a value promise tailored to individual employees, recognizing their unique needs and aspirations. Utilize real-time profiling to personalize the employee experience and deliver value in the most effective way
• Technology – enable employees with the right technology and ensure a satisfying user experience. This includes personal and office systems, platforms, and enterprise-wide enablement through connected devices. The aim is to leverage technology to support employees’ individual workstyles and enhance their productivity
• Processes and operations – streamline processes to deliver value for both employees and the organization. Simplify operations, establish an HR target operating model focused on service excellence, knowledge management, engagement, and empowerment
• Mindset and culture – foster a culture that embraces inclusivity, wellbeing, and sustainability. Define the organization’s values and goals, aligning them with management practices and corporate responsibility. Clear communication of actual proof-points of the culture to employees is crucial.

12 steps to an impactful people experience

To build an integrated and impactful people experience, organizations should consider and follow these 12 steps, addressing the four pillars mentioned above:

People first:

1. Develop a people promise that connects jobs and roles to outcomes and communicates career growth potential


2. Embrace continuous listening, learning, and feedback mechanisms to understand employee pain points and foster growth


3. Embed autonomy, self-service, and empowerment to provide employees with a sense of freedom in their work.

Technology:

4. Understand employee personas to provide the right technology tools, including productivity and collaboration tools, employee portals, and digital core applications


5. Implement collaboration spaces and immersive experiences, driving adoption and progression through data insights.

Processes and operations:

6. Define an HR operating model and services excellence to support the desired ways of working


7. Design frictionless processes and operations that align with the employee promise


8. Create physical environments that meet employee experience needs and support their work effectively


9. Utilize analytics and insights to continuously improve all aspects of the employee journey.

Mindset and culture:

10. Establish a global/local people strategy for implementing a People Experience across all employee profiles


11. Align managerial practices with the organization’s ambitions and purpose to foster a consistent, inclusive, and wellbeing-driven experience


12. Ensure consistency in all moments that matter to deliver an exceptional employee experience.

In the final article of this series, we will summarize a to-do list for those ready to embark on this journey and highlight real-world success stories.

To discover how Capgemini’s People Experience can help your organization create and sustain an environment where your employees thrive and become a true competitive advantage, contact jan.krogel@capgemini.com or jon.harriman@capgemini.com.

To drive business value, it is important to leverage all the data from within your organization as well as from partners outside of it. Such a collaborative data ecosystem is an alignment of business goals, data, and technology, among one or more participants, to collectively create value that is greater than each can create individually. It is both combining and collaborating on that data.

With a little help from your friends

John Lennon and Paul McCartney met by chance in 1957 when Lennon’s band The Quarrymen was performing in Liverpool. McCartney then joined The Quarrymen and, after the band had already changed its name to The Beatles, they were by chance discovered by Brian Epstein, at that time a local record store manager who became the band’s manager in 1962.

The way we see data ecosystems is similar: it is sometimes about a chance encounter and then bringing various elements together. We could refer to the well-known Beatles song from 1969 Come Together as the unifying theme of this article but instead let’s choose another one, namely With a Little Help from My Friends, which was released in 1967. In the context of this story, a little help comes in the form of a little data. Bringing together data from your friends (customers, suppliers, partners, vendors, whoever) is what we would call “organized serendipity.”

Imagine you’re a retailer operating in a competitive market needing to stay on top of trends, having to make sure your shelves (whether physical or virtual) are filled and are appealing to your customers. As an example, out-of-stocks remain the single largest problem in retail. The challenge with keeping products stocked involves a complex value chain that must anticipate and respond to dynamic market forces. Extreme weather, local events, and even activity from social influencers can quickly alter the demand for a product. In an optimal world, suppliers, distributors, retailers, and other partners would have visibility to changing dynamics and consumption in real-time, enabling them to optimize their operational decisions on-the-fly. And yet supply chains across retail and consumer goods still operate much as they have for decades, making decisions on data that is days or weeks old. It is this delay between changes in demand and our ability to respond that lead to out-of-stocks.

The main sources for retail data are operations by the retailer, data from their ecosystem, competitive data from syndicated sources, and external environmental data from governments and commercial sources.

• Retail operational data comes as a result of business operations, and includes everything from customer-facing retail sales data, advertising, e-commerce, customer support, reviews, and loyalty to back-of-house data from inventory, distribution, planning, and other management systems.

• Retailers operate in a complex value chain, with data coming upstream from suppliers, wholesalers, and distributors, and integrating downstream with advertising and delivery partners.

• Competitive data sources help retailers understand how their key competitors are operating in similar areas. Competitive distribution, assortment, pricing, promotions and advertising, sales, and other sources help retailers index their performance.

• Environmental data helps retailers understand the context in which consumers are making decisions. This includes environmental data such as weather, local economic forces, census information, local events and foot traffic data, legal and regulatory changes, social data, keyword searches, and more.

Finding a cost-effective technology

No two organizations leverage the same data in the same way. The differences in their strategies, operations, competitors, geography, and the systems that support them are designed to help the company succeed. But this means that no two businesses have the same data ecosystem. Companies may exchange data in key areas but increasingly the differences in data between companies is perceived as a competitive advantage. Legacy data-sharing technologies were designed to support the lowest common denominator of collaboration but have struggled to meet the needs of real-time data sharing, quality, and governance and decisioning. Companies want the flexibility to communicate in real-time with a variety of information and across platforms.

The key to achieving this is to select a cost-effective technology that enables the broadest range of sharing options without proprietary technology or vendor lock-in, facilitates real-time data sharing and collaboration, ensures the control of quality and governance of data, and enables companies to focus on immediately leveraging all types of data to drive better decisions.

A retail lakehouse simplifies collaboration

A data lakehouse is a modern data-management architecture that combines the features of both data lakes and data warehouses. It is a unified platform for storing, processing, analyzing, and sharing large volumes of data, both structured and unstructured, in its native format, with support for batch and real-time data processing.

Databricks’ Lakehouse is built on open-standards and open-source, which avoids proprietary lock-in. This importantly extends to data sharing and collaboration. Databricks introduced Delta Sharing, which is an open-source project started by Databricks that allows companies to share large-scale, real-time data between organizations in a secure and efficient manner.

A Lakehouse is the optimal method for data collaboration as it addresses the critical needs in retail.

• Real-time collaboration. Not only can companies share data that is being continuously updated, but Delta Sharing also enables sharing without movement of data.

• Collaborate on all of your data. Unlike legacy systems, Delta Sharing enables companies to share images, video, data-science models, structured data, and all other types of data.

• Centralized data storage. The Lakehouse architecture makes it easier for different users or groups to access and share data from a single source of truth, eliminating data silos and enabling seamless data sharing across various stakeholders.

• It supports quality and compliance. A Lakehouse architecture helps ensure data integrity, traceability, and compliance with regulatory requirements, which are important considerations when sharing data with external users or organizations.

• It simplifies data management and discovery. The Lakehouse architecture includes a robust data catalog and metadata management system that helps in documenting and organizing data assets.

“Collaborative data ecosystems hold immense potential for retail companies looking to thrive in an increasingly competitive and data-driven industry.”

With Delta Sharing, companies can securely share data with other organizations without having to copy or move data across different systems. Delta Sharing uses a federated model, which means that data remains in the original location and is accessed remotely by the recipient organization. This approach allows organizations to maintain control over their data while still sharing it with others.

Collaborative data ecosystems hold immense potential for retail companies looking to thrive in an increasingly competitive and data-driven industry. By leveraging these ecosystems, retailers can optimize their supply chain, gain valuable customer insights, make informed decisions, foster collaboration, and ensure data security and compliance. As more organizations recognize the value of such ecosystems, we can expect the retail industry to become even more connected, efficient, and customer-centric.

INNOVATION TAKEAWAYS

EMPOWERING COLLABORATION

By leveraging data from within and outside their organization, businesses can create collective value that surpasses individual capabilities, fostering collaboration and innovation.

BRIDGING THE GAP

Outdated supply chains hinder retailers from effectively responding to dynamic market forces, making real-time data sharing imperative for optimizing operational decisions and reducing out-of-stock issues.

LAKEHOUSE ARCHITECTURE

A modern data-management approach, the Lakehouse architecture combines data lakes and data warehouses, enabling real-time collaboration, centralized storage, and simplified data management for improved decision-making.

DELTA SHARING

Delta Sharing, an open-source project, empowers companies to securely share large-scale, real-time data without data movement, unlocking the potential for seamless collaboration, compliance, and valuable insights in the retail industry.

Interesting read?

Capgemini’s Innovation publication, Data-powered Innovation Review | Wave 6 features 19 such fascinating articles, crafted by leading experts from Capgemini, and key technology partners like Google,  Starburst,  Microsoft, Snowflake and Databricks. Learn about generative AI, collaborative data ecosystems, and an exploration of how data an AI can enable the biodiversity of urban forests. Find all previous waves here.

Time for some future tech insight… As everyone is stuck in the Gen AI bubble, we are already looking beyond! Good question: What is beyond Gen AI?

“What’s next is #interactiveAI: bots that can carry out tasks you set for them by calling on other software and other people to get stuff done,” said #DeepMind cofounder Mustafa Suleyman in a recent article by MIT Technology Review.

I tend to agree! Does this mean we will have Jarvis in the pocket (for those that don’t know should watch ironman the movie)?

Maybe, let’s look at some of the latest facts. There has been a lot of chatter about these AI companions and some very clear and early implementations. We have seen Microsoft’s move with CoPilot just last week, embedding it almost in all products they have, we have seen Google assistant aided by Bard, we have seen the latest partnership with AWS and Anthropic (which I wrote about this morning) which will probably be used to build the next generation of Alexa, and maybe the most obvious is the recent roll-out of new voice and image capabilities in #ChatGPT by openAI. Coding platforms and enterprise application like Salesforce and SAP are moving in the same direction, with SAP just announcing their own Generative AI assistant named ‘Joule’.

Looking beyond means looking at the current set of step that are being taken by the ecosystem, and the ecosystem has spoken! Interactive AI it is, is this the term we will coin or will it be Bot to Bot as my dear colleague Dr. Cara Antoine calls it, or machine to machine to human, or just as I like to call it, #AICompanions. I hope this brings some clarity to the future thinking we do, and to the new idea of interactive AI.

And for those that think that this is just a hype, I urge them to reconsider, because it is already embedded into the core of your day-to-day applications and all your enterprise applications as well, and the beauty is you don’t need a project manager to activate it and use it, it is already here! For the outsiders it seems sudden, but It has been a long journey, a long time in the making, over the last decades with all the chatbots and smart assistants we had.

Excited to see where this race and wave will take us!

Stay curious!

By 2025, 5G networks are expected to cover a third of the world’s population. As the global footprint of 5G expands, so does the associated security risk. While the underlying security capabilities of 5G are superior to those of previous generations, they are not without limitations.

Retail customers use public networks with limited security liability, but most organizations using 5G (typically for manufacturing and operations) will need to build a private network or use a hybrid public/private model that is built to meet their specific requirements. The complexity of such an ecosystem makes risk assessment an essential part of implementing security for 5G.

In the previous blog, we looked at the challenges associated with 5G deployment architectures and why risk assessment must be holistic in nature, covering both the horizontal and vertical axes of the network. Here, we take a closer look at what it takes to conduct a full risk assessment.

Essential steps for a robust risk assessment

A thorough risk assessment ensures full coverage of the 5G network. It has to be comprehensive and end-to-end, with a full understanding of the people, processes, and technology risks, while adhering to the necessary frameworks, such as NIST, the ISA/IEC 62443 standard, and MITRE FiGHT

At Capgemini, we follow these three essential steps as with any risk assessment :

 1. Discovery

The discovery phase aims to gather all necessary information about the 5G environment, its assets, the number of and types of devices, and the use cases deployed, along with the organization’s risk appetite and existing security policies.

2. Assessment

Once all the necessary information has been collected, the assessment phase evaluates security controls and policies that are pertinent to the 5G network. Every identified gap is assigned a risk score, and reports and visual aids are created to clearly communicate these findings.

 3. Reporting

After the assessment, a complete view of the current maturity level and the risk scores are reported, and supporting recommendations are presented to enhance the security posture.

Our approach to 5G risk assessment is divided into two key parts, one covering the technical controls and the other covering managerial and operational controls:

• Technical controls: This part of the assessment addresses the technical controls implemented in a 5G network spanning its various components that include the endpoints, mobile edge computing (MEC), radio access network (RAN), core, and other functional elements like NFV and network slicing. For each of these components, the assessment is further classified into several sub-categories. For instance, the sub-categories for which an endpoint is assessed include its access control, network security, supplier security, physical security, and asset management. Such an approach to sub-categorization is especially useful when assessing functional elements. For example, network slicing in 5G is a key functional element that enables the delivery of meaningful guarantees for network coverage, performance, capacity, or even security. Slicing essentially divides the underlying physical network infrastructure into multiple virtual networks to cater to a specific quality of service (QoS), such as low latency for real-time applications, high bandwidth for multimedia streaming, and ultra-reliability for critical communications. While this adds significant value to a network and is expected to provide monetization opportunities, each slice requires specific security requirements to protect against attack vectors relevant to itself. Our risk assessment approach covers the following sub-categories for slicing:
  – security for the installation and configuration of a slice
  – security during the slice preparation phase
  – security during the slice run phase, security for the slice decommissioning phase
  – inter- and intra-slice security
  – slice interface security
  
• Management & operational controls: This part of the assessment covers risks primarily related to governance, human resource management, incident management, operation management, monitoring audit and testing, and threat awareness. This means asking those non-technical but critical questions such as:
  – Has a potential dependency on a single supplier of 5G equipment been considered?
  – Have personnel with access to critical or sensitive components of 5G networks been security-vetted?
  – Are there documented plans in place in case of a disaster affecting the ongoing operation of the 5G network?

Some of the key advantages of this risk assessment include ensuring these qualities:

• Standards: It brings together the recommendations and guidance from various organizations, such as ENISA, ETSI, IETF, ITU-T, ISO, ORAN, OWASP, NIST, and GDPR.
• Deployment model: It addresses security risk for various non-public network (NPN) deployment models, including stand-alone deployment and public network integrated deployment.
• End-to-end capabilites: It covers the entire operational technology (OT) and Internet of Things (IoT) ecosystem that sits on top of the 5G network. This includes security concerning manufacturers, suppliers, telco operators, edge, OT, and IoT devices.
• Compliance: It is compliant to industry-accepted standards (e.g., IEC 62443) to facilitate auditing and certification. It incorporates functional and operational requirements for different security levels such as SL1, SL2, and SL3.
• Comprehensive Coverage: It provides full comprehensive coverage for technical and non-technical risks while at the same time covering the entire 5G architecture from edge devices, RAN, core, MEC, cloud, and to the applications.

Ongoing monitoring and compliance

A sound risk assessment is the start of any security journey. After the assessment and the deployment of various security controls, it is crucial to establish an ongoing process for monitoring and responding to security events in the 5G network. Continuous monitoring allows organizations to detect and respond to any security incident promptly, maintaining a robust security posture – the next blog in the series will consider how to deliver such a monitoring program for 5G networks. Stay tuned.

Contact Capgemini today to find out about 5G security.