Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

7/18/2013
05:10 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Will IT GRC Become IRM?

Analysts report a shift toward Integrated Risk Management across the enterprise, but IT risk management experts argue on how it'll happen

The differences in risk management information gathering, tools, and processes used by business operations and IT teams is at once introducing redundancies in the way that these two groups operate and gaps in how they communicate. According to a recent analysis by Enterprise Strategy Group (ESG), many enterprises are examining how to better roll up IT governance, risk and compliance (GRC) into a broader framework called integrated risk management (IRM).

"Risk management problems often arise because business operations and IT teams have access to different information and tools. This inevitably leads to redundant data collection, overlapping processes, and higher costs," wrote Jon Oltsik, senior principal analyst for ESG, in a recent paper on the topic. "To alleviate this inefficiency, many organizations are starting to explore the possibilities of more integrated governance and security risk management across the enterprise."

According to a survey of 141 risk management executives conducted by ESG and sponsored by Agiliance, within IT risk management alone, 65 percent use more than software platform to carry out its risk management activities. And that isn't even counting even more business operational focused enterprise risk management platforms frequently in tandem use. The numbers show that organizations are trying to find ways to consolidate. Approximately 27 percent of enterprises are already engaged in a consolidation project and 51 percent are planning such a project within the next two years, hoping to produce better metrics and guidance across their organizations, according to Oltsik.

[Is your organization only paying lip service to its IT risks? See Doing More Than Paying Risk Management Lip Service.]

Oltsik believes that a gap between what he calls security risk management (SRM) tools and processes and governance risk management (GRM) tools are causing an operational disconnect. Whereas most GRM tools were born out of Sarbanes-Oxley requirements that focus on financial and legal controls and processes primarily for compliance purposes, SRM systems are more data-driven based on security operations. The problem, he says is that the data from SRM is primarily "mapped to GRM solutions via spreadsheets."

"CISOs are now required to address risk in a form that business units understand" he wrote. "Most business risk owners don’t understand the language of security, let alone see the causal chain between a critical IT asset disabled by a cyber attack, a failed or missing security control that may have prevented it, and the impact on their business operations."

While other experts in the IT risk management world agree that the language gap and lack of integration between multiple tool-sets can definitely stand in the way of an organization-wide view of an enterprise's risk positioning, the idea of moving to a single risk team working on one platform still remains contentious.

"In many cases, organizations have a best-of-breed set of tools for managing different types of risk that they are happy with," says Chris Goodwin, CTO of LockPath. "Consolidation really doesn't get them where they need to be. Instead, they need to make sure their tools can inter-operate, which allows them to roll-up risks across the enterprise into a true enterprise risk register."

According to Yo Delmar, vice president of MetricStream, enterprise risk management isn't likely to move away from disparate, specialized teams anytime soon.

"GRC is carried out by multiple teams within an organization, and in our view, will likely continue to do so for decades to come," she says. "Rather than one monolithic, integrated program, we see organizations adopting a federated model, where different groups, such are operational risk management, vendor management, audit, IT, and security can maintain their own perspective on risks, that are then rolled up to an enterprise view."

Instead, where Delmar sees the work being done in integration is developing more common taxonomy that covers how risks, controls and scoring are defined so that work can be rationalized across those federated groups.

"The real challenge for security and IT teams is to start expressing vulnerabilities, control failures and exposures in terms the business can understand," she says. "While a common ERM or GRC platform provides the context, the real issue here is one of a common high-level taxonomy. Going beyond that, a common ontology, that extends the taxonomy by adding rules and calculations on how risk is measured."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-20491
PUBLISHED: 2021-04-16
IBM Spectrum Protect Server 7.1 and 8.1 is subject to a stack-based buffer overflow caused by improper bounds checking during the parsing of commands. By issuing such a command with an improper parameter, an authorized administrator could overflow a buffer and cause the server to crash. IBM X-Force ...
CVE-2021-22539
PUBLISHED: 2021-04-16
An attacker can place a crafted JSON config file into the project folder pointing to a custom executable. VScode-bazel allows the workspace path to lint *.bzl files to be set via this config file. As such the attacker is able to execute any executable on the system through vscode-bazel. We recommend...
CVE-2021-31414
PUBLISHED: 2021-04-16
The unofficial vscode-rpm-spec extension before 0.3.2 for Visual Studio Code allows remote code execution via a crafted workspace configuration.
CVE-2021-26073
PUBLISHED: 2021-04-16
Broken Authentication in Atlassian Connect Express (ACE) from version 3.0.2 before version 6.6.0: Atlassian Connect Express is a Node.js package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Express app occurs with a server-to-server JWT or ...
CVE-2021-26074
PUBLISHED: 2021-04-16
Broken Authentication in Atlassian Connect Spring Boot (ACSB) from version 1.1.0 before version 2.1.3: Atlassian Connect Spring Boot is a Java Spring Boot package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Spring Boot app occurs with a se...