Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

9/24/2019
04:15 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

How to Define & Prioritize Risk Management Goals

As risk management programs differ from business to business, these factors remain constant.

When evaluating the goals for a risk management program, many organizations focus on compliance or filling perceived gaps in their capabilities. The problem is, these priorities fall short of considering the full breadth of risks a business could face, security experts say.

"Those may or may not be the things they should be focusing on or making the center point of their program," says Jack Jones, chairman of the FAIR Institute and executive vice president of R&D at RiskLens. "But they can't know that until they do risk analysis."

At the 2019 FAIR Conference, held this week in Washington, D.C., Jones moderated a panel focused on defining goals of an effective risk management program. Some of these goals are constant across organizations, he says in an interview with Dark Reading ahead of the event.

"From my perspective, one of the objectives of any risk management program is to be cost-effective," he notes, as an example. The cost of a $5 million risk management program is far more when opportunity cost is considered, and it could be doubled when the business considers what it would have to do to implement such a program, he explains. Firms that exclusively focus on best practices and compliance are not going to be cost-effective, he argues.

While there should be "philosophical alignment" in the nature of risk management programs, their paths and considerations will likely differ depending on industry, culture, and resources.

Another core objective should be to bring all risk management groups together: audit, compliance, legal, enterprise risk management "need to have very open and honest conversations," Jones says. In previous roles as a CISO, he adds, clear communication "served me incredibly well," especially when working with external auditors and regulators.

Joey Johnson, CISO of Premise Health and member of the aforementioned panel, takes this a step further and says security leaders should prioritize looking at risk holistically and treat it as a central business function. Risk should be considered outside the spectrum of IT, he explains.

"It feels so often the message security is trying to convey is lost," says Johnson. The business will quickly "gloss over" security risk but are attuned to the conversation around overall risk. It's up to security to deliver tangible metrics and a narrative to corporate stakeholders. "Whatever metrics you deliver have to provide a narrative that the audience can respond to," he adds.

Now Hiring: Risk-Focused Leadership
The first step to implementing a risk management program is finding a leader who can translate risk into terms that inform a dialogue within the business. This leader should understand the company, where it's headed, and its overall risk tolerance. Without one, any organization will have a hard time implementing risk resources in an appropriate say, Johnson explains.

Of course, finding this person is a challenge. There are typically two schools of leadership from a security perspective: those who come from a business background and have no security experience, and those who come from security but don't know how it fits into the business.

"Getting a leader in place, setting up a function to see all different kinds of risk, is paramount," says Johnson. Many security experts are predisposed to view through the lens of risk but often forget security is only one level; there is financial risk and market perception, among others. They need to be able to identify what is critical. If a company starts the process of acquiring a software company, it should recognize it may not have the resources to do software security.

Alignment between the business and security risk management is both "critical and overlooked," Johnson emphasizes. Historically, security programs have involved a lot of "blocking and tackling" to keep people out of trouble, Johnson adds. But with the right strategy, security can be used to deliver valuable outcomes through a risk management program.

As an example, he points to his company's third-party risk management program. In starting a vendor risk assessment, the security team found they were dealing with hundreds of thousands of vendors, many of them duplicative. They could have done a vendor risk assessment for each one — a time-consuming and expensive process — or eliminate some from the start, coach the ones they kept, and shape their product road map with fewer trusted vendors, he explains.

The company went with the latter. "All of that massively reduces our threat landscape, and it's a zero-dollar initiative that reduced risk while fostering the business," Johnson says. As a result, the business wanted to engage with security from the beginning and understood security's position within the organization gave it a perspective that nobody else in the company had.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "'Playing Around' with Code Keeps Security, DevOps Skills Sharp."

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Andrew.houshian
50%
50%
Andrew.houshian,
User Rank: Author
9/25/2019 | 4:48:17 PM
Risk Management Through Risk Assessments
Informative take on risk management across industries! I agree that it's important to set goals for risk management and think that through scheduled risk assessments, this management process can be streamlined and kept in-line with audits and regulations. 
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19317
PUBLISHED: 2019-12-05
lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service or possibly have unspecified other impact.
CVE-2019-19602
PUBLISHED: 2019-12-05
fpregs_state_valid in arch/x86/include/asm/fpu/internal.h in the Linux kernel before 5.4.2, when GCC 9 is used, allows context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact because of incorrect fpu_fpregs_owner_ctx caching, as demonstr...
CVE-2019-19601
PUBLISHED: 2019-12-05
OpenDetex 2.8.5 has a Buffer Overflow in TexOpen in detex.l because of an incorrect sprintf.
CVE-2019-19589
PUBLISHED: 2019-12-05
The Lever PDF Embedder plugin 4.4 for WordPress does not block the distribution of polyglot PDF documents that are valid JAR archives.
CVE-2019-19597
PUBLISHED: 2019-12-05
D-Link DAP-1860 devices before v1.04b03 Beta allow arbitrary remote code execution as root without authentication via shell metacharacters within an HNAP_AUTH HTTP header.