Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

9/24/2019
04:15 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

How to Define & Prioritize Risk Management Goals

As risk management programs differ from business to business, these factors remain constant.

When evaluating the goals for a risk management program, many organizations focus on compliance or filling perceived gaps in their capabilities. The problem is, these priorities fall short of considering the full breadth of risks a business could face, security experts say.

"Those may or may not be the things they should be focusing on or making the center point of their program," says Jack Jones, chairman of the FAIR Institute and executive vice president of R&D at RiskLens. "But they can't know that until they do risk analysis."

At the 2019 FAIR Conference, held this week in Washington, D.C., Jones moderated a panel focused on defining goals of an effective risk management program. Some of these goals are constant across organizations, he says in an interview with Dark Reading ahead of the event.

"From my perspective, one of the objectives of any risk management program is to be cost-effective," he notes, as an example. The cost of a $5 million risk management program is far more when opportunity cost is considered, and it could be doubled when the business considers what it would have to do to implement such a program, he explains. Firms that exclusively focus on best practices and compliance are not going to be cost-effective, he argues.

While there should be "philosophical alignment" in the nature of risk management programs, their paths and considerations will likely differ depending on industry, culture, and resources.

Another core objective should be to bring all risk management groups together: audit, compliance, legal, enterprise risk management "need to have very open and honest conversations," Jones says. In previous roles as a CISO, he adds, clear communication "served me incredibly well," especially when working with external auditors and regulators.

Joey Johnson, CISO of Premise Health and member of the aforementioned panel, takes this a step further and says security leaders should prioritize looking at risk holistically and treat it as a central business function. Risk should be considered outside the spectrum of IT, he explains.

"It feels so often the message security is trying to convey is lost," says Johnson. The business will quickly "gloss over" security risk but are attuned to the conversation around overall risk. It's up to security to deliver tangible metrics and a narrative to corporate stakeholders. "Whatever metrics you deliver have to provide a narrative that the audience can respond to," he adds.

Now Hiring: Risk-Focused Leadership
The first step to implementing a risk management program is finding a leader who can translate risk into terms that inform a dialogue within the business. This leader should understand the company, where it's headed, and its overall risk tolerance. Without one, any organization will have a hard time implementing risk resources in an appropriate say, Johnson explains.

Of course, finding this person is a challenge. There are typically two schools of leadership from a security perspective: those who come from a business background and have no security experience, and those who come from security but don't know how it fits into the business.

"Getting a leader in place, setting up a function to see all different kinds of risk, is paramount," says Johnson. Many security experts are predisposed to view through the lens of risk but often forget security is only one level; there is financial risk and market perception, among others. They need to be able to identify what is critical. If a company starts the process of acquiring a software company, it should recognize it may not have the resources to do software security.

Alignment between the business and security risk management is both "critical and overlooked," Johnson emphasizes. Historically, security programs have involved a lot of "blocking and tackling" to keep people out of trouble, Johnson adds. But with the right strategy, security can be used to deliver valuable outcomes through a risk management program.

As an example, he points to his company's third-party risk management program. In starting a vendor risk assessment, the security team found they were dealing with hundreds of thousands of vendors, many of them duplicative. They could have done a vendor risk assessment for each one — a time-consuming and expensive process — or eliminate some from the start, coach the ones they kept, and shape their product road map with fewer trusted vendors, he explains.

The company went with the latter. "All of that massively reduces our threat landscape, and it's a zero-dollar initiative that reduced risk while fostering the business," Johnson says. As a result, the business wanted to engage with security from the beginning and understood security's position within the organization gave it a perspective that nobody else in the company had.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "'Playing Around' with Code Keeps Security, DevOps Skills Sharp."

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Andrew.houshian
50%
50%
Andrew.houshian,
User Rank: Author
9/25/2019 | 4:48:17 PM
Risk Management Through Risk Assessments
Informative take on risk management across industries! I agree that it's important to set goals for risk management and think that through scheduled risk assessments, this management process can be streamlined and kept in-line with audits and regulations. 
Cloud Security Startup Lightspin Emerges From Stealth
Kelly Sheridan, Staff Editor, Dark Reading,  11/24/2020
Look Beyond the 'Big 5' in Cyberattacks
Robert Lemos, Contributing Writer,  11/25/2020
Why Vulnerable Code Is Shipped Knowingly
Chris Eng, Chief Research Officer, Veracode,  11/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: We are really excited about our new two tone authentication system!
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-4126
PUBLISHED: 2020-12-01
HCL iNotes is susceptible to a sensitive cookie exposure vulnerability. This can allow an unauthenticated remote attacker to capture the cookie by intercepting its transmission within an http session. Fixes are available in HCL Domino and iNotes versions 10.0.1 FP6 and 11.0.1 FP2 and later.
CVE-2020-4129
PUBLISHED: 2020-12-01
HCL Domino is susceptible to a lockout policy bypass vulnerability in the LDAP service. An unauthenticated attacker could use this vulnerability to mount a brute force attack against the LDAP service. Fixes are available in HCL Domino versions 9.0.1 FP10 IF6, 10.0.1 FP6 and 11.0.1 FP1 and later.
CVE-2020-9115
PUBLISHED: 2020-12-01
ManageOne versions 6.5.1.1.B010, 6.5.1.1.B020, 6.5.1.1.B030, 6.5.1.1.B040, ,6.5.1.1.B050, 8.0.0 and 8.0.1 have a command injection vulnerability. An attacker with high privileges may exploit this vulnerability through some operations on the plug-in component. Due to insufficient input validation of ...
CVE-2020-9116
PUBLISHED: 2020-12-01
Huawei FusionCompute versions 6.5.1 and 8.0.0 have a command injection vulnerability. An authenticated, remote attacker can craft specific request to exploit this vulnerability. Due to insufficient verification, this could be exploited to cause the attackers to obtain higher privilege.
CVE-2020-14193
PUBLISHED: 2020-11-30
Affected versions of Automation for Jira - Server allowed remote attackers to read and render files as mustache templates in files inside the WEB-INF/classes & <jira-installation>/jira/bin directories via a template injection vulnerability in Jira smart values using mustache partials. The ...