Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

7/18/2013
05:10 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Will IT GRC Become IRM?

Analysts report a shift toward Integrated Risk Management across the enterprise, but IT risk management experts argue on how it'll happen

The differences in risk management information gathering, tools, and processes used by business operations and IT teams is at once introducing redundancies in the way that these two groups operate and gaps in how they communicate. According to a recent analysis by Enterprise Strategy Group (ESG), many enterprises are examining how to better roll up IT governance, risk and compliance (GRC) into a broader framework called integrated risk management (IRM).

"Risk management problems often arise because business operations and IT teams have access to different information and tools. This inevitably leads to redundant data collection, overlapping processes, and higher costs," wrote Jon Oltsik, senior principal analyst for ESG, in a recent paper on the topic. "To alleviate this inefficiency, many organizations are starting to explore the possibilities of more integrated governance and security risk management across the enterprise."

According to a survey of 141 risk management executives conducted by ESG and sponsored by Agiliance, within IT risk management alone, 65 percent use more than software platform to carry out its risk management activities. And that isn't even counting even more business operational focused enterprise risk management platforms frequently in tandem use. The numbers show that organizations are trying to find ways to consolidate. Approximately 27 percent of enterprises are already engaged in a consolidation project and 51 percent are planning such a project within the next two years, hoping to produce better metrics and guidance across their organizations, according to Oltsik.

[Is your organization only paying lip service to its IT risks? See Doing More Than Paying Risk Management Lip Service.]

Oltsik believes that a gap between what he calls security risk management (SRM) tools and processes and governance risk management (GRM) tools are causing an operational disconnect. Whereas most GRM tools were born out of Sarbanes-Oxley requirements that focus on financial and legal controls and processes primarily for compliance purposes, SRM systems are more data-driven based on security operations. The problem, he says is that the data from SRM is primarily "mapped to GRM solutions via spreadsheets."

"CISOs are now required to address risk in a form that business units understand" he wrote. "Most business risk owners don’t understand the language of security, let alone see the causal chain between a critical IT asset disabled by a cyber attack, a failed or missing security control that may have prevented it, and the impact on their business operations."

While other experts in the IT risk management world agree that the language gap and lack of integration between multiple tool-sets can definitely stand in the way of an organization-wide view of an enterprise's risk positioning, the idea of moving to a single risk team working on one platform still remains contentious.

"In many cases, organizations have a best-of-breed set of tools for managing different types of risk that they are happy with," says Chris Goodwin, CTO of LockPath. "Consolidation really doesn't get them where they need to be. Instead, they need to make sure their tools can inter-operate, which allows them to roll-up risks across the enterprise into a true enterprise risk register."

According to Yo Delmar, vice president of MetricStream, enterprise risk management isn't likely to move away from disparate, specialized teams anytime soon.

"GRC is carried out by multiple teams within an organization, and in our view, will likely continue to do so for decades to come," she says. "Rather than one monolithic, integrated program, we see organizations adopting a federated model, where different groups, such are operational risk management, vendor management, audit, IT, and security can maintain their own perspective on risks, that are then rolled up to an enterprise view."

Instead, where Delmar sees the work being done in integration is developing more common taxonomy that covers how risks, controls and scoring are defined so that work can be rationalized across those federated groups.

"The real challenge for security and IT teams is to start expressing vulnerabilities, control failures and exposures in terms the business can understand," she says. "While a common ERM or GRC platform provides the context, the real issue here is one of a common high-level taxonomy. Going beyond that, a common ontology, that extends the taxonomy by adding rules and calculations on how risk is measured."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
US Formally Attributes SolarWinds Attack to Russian Intelligence Agency
Jai Vijayan, Contributing Writer,  4/15/2021
News
Dependency Problems Increase for Open Source Components
Robert Lemos, Contributing Writer,  4/14/2021
News
FBI Operation Remotely Removes Web Shells From Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/14/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-20527
PUBLISHED: 2021-04-19
IBM Resilient SOAR V38.0 could allow a privileged user to create create malicious scripts that could be executed as another user. IBM X-Force ID: 198759.
CVE-2021-27028
PUBLISHED: 2021-04-19
A Memory Corruption Vulnerability in Autodesk FBX Review version 1.4.0 may lead to remote code execution through maliciously crafted DLL files.
CVE-2021-27029
PUBLISHED: 2021-04-19
The user may be tricked into opening a malicious FBX file which may exploit a Null Pointer Dereference vulnerability in FBX's Review causing the application to crash leading to a denial of service.
CVE-2021-27030
PUBLISHED: 2021-04-19
A user may be tricked into opening a malicious FBX file which may exploit a Directory Traversal Remote Code Execution vulnerability in FBX’s Review causing it to run arbitrary code on the system.
CVE-2021-27031
PUBLISHED: 2021-04-19
A user may be tricked into opening a malicious FBX file which may exploit a use-after-free vulnerability in FBX's Review causing the application to reference a memory location controlled by an unauthorized third party, thereby running arbitrary code on the system.