Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


05:10 PM
Connect Directly

Will IT GRC Become IRM?

Analysts report a shift toward Integrated Risk Management across the enterprise, but IT risk management experts argue on how it'll happen

The differences in risk management information gathering, tools, and processes used by business operations and IT teams is at once introducing redundancies in the way that these two groups operate and gaps in how they communicate. According to a recent analysis by Enterprise Strategy Group (ESG), many enterprises are examining how to better roll up IT governance, risk and compliance (GRC) into a broader framework called integrated risk management (IRM).

"Risk management problems often arise because business operations and IT teams have access to different information and tools. This inevitably leads to redundant data collection, overlapping processes, and higher costs," wrote Jon Oltsik, senior principal analyst for ESG, in a recent paper on the topic. "To alleviate this inefficiency, many organizations are starting to explore the possibilities of more integrated governance and security risk management across the enterprise."

According to a survey of 141 risk management executives conducted by ESG and sponsored by Agiliance, within IT risk management alone, 65 percent use more than software platform to carry out its risk management activities. And that isn't even counting even more business operational focused enterprise risk management platforms frequently in tandem use. The numbers show that organizations are trying to find ways to consolidate. Approximately 27 percent of enterprises are already engaged in a consolidation project and 51 percent are planning such a project within the next two years, hoping to produce better metrics and guidance across their organizations, according to Oltsik.

[Is your organization only paying lip service to its IT risks? See Doing More Than Paying Risk Management Lip Service.]

Oltsik believes that a gap between what he calls security risk management (SRM) tools and processes and governance risk management (GRM) tools are causing an operational disconnect. Whereas most GRM tools were born out of Sarbanes-Oxley requirements that focus on financial and legal controls and processes primarily for compliance purposes, SRM systems are more data-driven based on security operations. The problem, he says is that the data from SRM is primarily "mapped to GRM solutions via spreadsheets."

"CISOs are now required to address risk in a form that business units understand" he wrote. "Most business risk owners don’t understand the language of security, let alone see the causal chain between a critical IT asset disabled by a cyber attack, a failed or missing security control that may have prevented it, and the impact on their business operations."

While other experts in the IT risk management world agree that the language gap and lack of integration between multiple tool-sets can definitely stand in the way of an organization-wide view of an enterprise's risk positioning, the idea of moving to a single risk team working on one platform still remains contentious.

"In many cases, organizations have a best-of-breed set of tools for managing different types of risk that they are happy with," says Chris Goodwin, CTO of LockPath. "Consolidation really doesn't get them where they need to be. Instead, they need to make sure their tools can inter-operate, which allows them to roll-up risks across the enterprise into a true enterprise risk register."

According to Yo Delmar, vice president of MetricStream, enterprise risk management isn't likely to move away from disparate, specialized teams anytime soon.

"GRC is carried out by multiple teams within an organization, and in our view, will likely continue to do so for decades to come," she says. "Rather than one monolithic, integrated program, we see organizations adopting a federated model, where different groups, such are operational risk management, vendor management, audit, IT, and security can maintain their own perspective on risks, that are then rolled up to an enterprise view."

Instead, where Delmar sees the work being done in integration is developing more common taxonomy that covers how risks, controls and scoring are defined so that work can be rationalized across those federated groups.

"The real challenge for security and IT teams is to start expressing vulnerabilities, control failures and exposures in terms the business can understand," she says. "While a common ERM or GRC platform provides the context, the real issue here is one of a common high-level taxonomy. Going beyond that, a common ontology, that extends the taxonomy by adding rules and calculations on how risk is measured."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Microsoft Patches Wormable RCE Vulns in Remote Desktop Services
Kelly Sheridan, Staff Editor, Dark Reading,  8/13/2019
The Mainframe Is Seeing a Resurgence. Is Security Keeping Pace?
Ray Overby, Co-Founder & President at Key Resources, Inc.,  8/15/2019
GitHub Named in Capital One Breach Lawsuit
Dark Reading Staff 8/14/2019
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2019-08-18
The Recruitment module in Humanica Humatrix 7 and allows an unauthenticated attacker to access all candidates' files in the photo folder on the website by specifying a "user id" parameter and file name, such as in a recruitment_online/upload/user/[user_id]/photo/[file_n...
PUBLISHED: 2019-08-18
The Recruitment module in Humanica Humatrix 7 and allows an unauthenticated attacker to upload any file type to a candidate's profile picture folder via a crafted recruitment_online/personalData/act_personaltab.cfm multiple-part POST request with a predictable WRC01_USERID parame...
PUBLISHED: 2019-08-18
The handshake protocol in Object Management Group (OMG) DDS Security 1.1 sends cleartext information about all of the capabilities of a participant (including capabilities inapplicable to the current session), which makes it easier for attackers to discover potentially sensitive reachability informa...
PUBLISHED: 2019-08-18
The Access Control plugin in eProsima Fast RTPS through 1.9.0 does not check partition permissions from remote participant connections, which can lead to policy bypass for a secure Data Distribution Service (DDS) partition.
PUBLISHED: 2019-08-18
The Access Control plugin in eProsima Fast RTPS through 1.9.0 allows fnmatch pattern matches with topic name strings (instead of the permission expressions themselves), which can lead to unintended connections between participants in a Data Distribution Service (DDS) network.