Perimeter

7/18/2012
02:26 PM
50%
50%

Risks Deferred Are Risks Accepted

Decisions to delay compliance and security efforts do not delay the risks

The client did something I’ve seen many times before. The staff considered addressing obvious compliance and security issues, and then decided to postpone that work. While they said they were simply going to push the work back a few months, as typically happens, the postponement became indefinite.

Or perhaps more accurately, the postponement will be indefinite until a costly problem exposes these ignored risks as real, costly and immediate.

Like most clients, they claimed a number of reasons to postpone this work: cash flow, timing, budget restrictions, pending new projects, disruption to other projects, and the time required by management and staff.

Sounding sincere about their need to address these compliance and security issues, clients say, “This is going to be a lot of work, and we need to take care of other matters first so we can better focus on this with less distraction.”

Yet despite claiming to believe compliance and security work is important, clients usually minimize their concerns about risk. After all, they say, as they’ve grown their business, the risks have never materialized, and they really need to put their cash into the growth of the business.

As a business owner, I realize there are times you must make risky decisions. I know there are times where you do have to postpone important work because of something as simple as cash flow or lack of manpower. However, these risky decisions should be made with a sincere evaluation and acceptance of the risks, not by turning a convenient blind-eye and manufacturing emotional justification.

Too many leaders become overwhelmed by the size of the risks they have created -- or allowed to be created -- over time. When these issues become obvious, for whatever the reason, the most common response unfortunately is not to attack these risks full-blast or even to start whittling them down. No, the most common response is to push all these risks into the back of a dark closet where they can be ignored, where they can be put out of sight and out of mind.

Business leaders who decide to defer addressing real security and compliance risks must understand they are essentially self-insuring this risk. They have accepted the risks, even if that acceptance is by default or denial.

If a problem develops from these ignored compliance and security risks, it will be the business that pays the cost, whether it be cash, distraction, reputation, and, perhaps even, sanctions. Perhaps some risks are worth taking, but in most cases I see few leaders acknowledge the true risks and actual consequences. Apparently ignorance is bliss even when the ignorance is by choice.

Glenn S. Phillips, the president of Forte' Incorporated, works with business leaders who want to leverage technology and understand the often hidden risks within. He is the author of the book Nerd-to-English and you can find him on twitter at @NerdToEnglish.

Glenn works with business leaders who want to leverage technology and understand the often hidden risks awaiting them. The Founder and Sr. Consultant of Forte' Incorporated, Glenn and his team work with business leaders to support growth, increase profits, and address ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Valentine's Emails Laced with Gandcrab Ransomware
Kelly Sheridan, Staff Editor, Dark Reading,  2/14/2019
High Stress Levels Impacting CISOs Physically, Mentally
Jai Vijayan, Freelance writer,  2/14/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-8396
PUBLISHED: 2019-02-17
A buffer overflow in H5O__layout_encode in H5Olayout.c in the HDF HDF5 through 1.10.4 library allows attackers to cause a denial of service via a crafted HDF5 file. This issue was triggered while repacking an HDF5 file, aka "Invalid write of size 2."
CVE-2019-8397
PUBLISHED: 2019-02-17
An issue was discovered in the HDF HDF5 1.10.4 library. There is an out of bounds read in the function H5T_close_real in H5T.c.
CVE-2019-8398
PUBLISHED: 2019-02-17
An issue was discovered in the HDF HDF5 1.10.4 library. There is an out of bounds read in the function H5T_get_size in H5T.c.
CVE-2019-8400
PUBLISHED: 2019-02-17
ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error error_hint parameter.
CVE-2019-7399
PUBLISHED: 2019-02-17
Amazon Fire OS before 5.3.6.4 allows a man-in-the-middle attack against HTTP requests for "Terms of Use" and Privacy pages.