Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


05:10 PM
Connect Directly

Will IT GRC Become IRM?

Analysts report a shift toward Integrated Risk Management across the enterprise, but IT risk management experts argue on how it'll happen

The differences in risk management information gathering, tools, and processes used by business operations and IT teams is at once introducing redundancies in the way that these two groups operate and gaps in how they communicate. According to a recent analysis by Enterprise Strategy Group (ESG), many enterprises are examining how to better roll up IT governance, risk and compliance (GRC) into a broader framework called integrated risk management (IRM).

"Risk management problems often arise because business operations and IT teams have access to different information and tools. This inevitably leads to redundant data collection, overlapping processes, and higher costs," wrote Jon Oltsik, senior principal analyst for ESG, in a recent paper on the topic. "To alleviate this inefficiency, many organizations are starting to explore the possibilities of more integrated governance and security risk management across the enterprise."

According to a survey of 141 risk management executives conducted by ESG and sponsored by Agiliance, within IT risk management alone, 65 percent use more than software platform to carry out its risk management activities. And that isn't even counting even more business operational focused enterprise risk management platforms frequently in tandem use. The numbers show that organizations are trying to find ways to consolidate. Approximately 27 percent of enterprises are already engaged in a consolidation project and 51 percent are planning such a project within the next two years, hoping to produce better metrics and guidance across their organizations, according to Oltsik.

[Is your organization only paying lip service to its IT risks? See Doing More Than Paying Risk Management Lip Service.]

Oltsik believes that a gap between what he calls security risk management (SRM) tools and processes and governance risk management (GRM) tools are causing an operational disconnect. Whereas most GRM tools were born out of Sarbanes-Oxley requirements that focus on financial and legal controls and processes primarily for compliance purposes, SRM systems are more data-driven based on security operations. The problem, he says is that the data from SRM is primarily "mapped to GRM solutions via spreadsheets."

"CISOs are now required to address risk in a form that business units understand" he wrote. "Most business risk owners don’t understand the language of security, let alone see the causal chain between a critical IT asset disabled by a cyber attack, a failed or missing security control that may have prevented it, and the impact on their business operations."

While other experts in the IT risk management world agree that the language gap and lack of integration between multiple tool-sets can definitely stand in the way of an organization-wide view of an enterprise's risk positioning, the idea of moving to a single risk team working on one platform still remains contentious.

"In many cases, organizations have a best-of-breed set of tools for managing different types of risk that they are happy with," says Chris Goodwin, CTO of LockPath. "Consolidation really doesn't get them where they need to be. Instead, they need to make sure their tools can inter-operate, which allows them to roll-up risks across the enterprise into a true enterprise risk register."

According to Yo Delmar, vice president of MetricStream, enterprise risk management isn't likely to move away from disparate, specialized teams anytime soon.

"GRC is carried out by multiple teams within an organization, and in our view, will likely continue to do so for decades to come," she says. "Rather than one monolithic, integrated program, we see organizations adopting a federated model, where different groups, such are operational risk management, vendor management, audit, IT, and security can maintain their own perspective on risks, that are then rolled up to an enterprise view."

Instead, where Delmar sees the work being done in integration is developing more common taxonomy that covers how risks, controls and scoring are defined so that work can be rationalized across those federated groups.

"The real challenge for security and IT teams is to start expressing vulnerabilities, control failures and exposures in terms the business can understand," she says. "While a common ERM or GRC platform provides the context, the real issue here is one of a common high-level taxonomy. Going beyond that, a common ontology, that extends the taxonomy by adding rules and calculations on how risk is measured."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Threaded  |  Newest First  |  Oldest First
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-04-15
Wfilter ICF 5.0.117 contains a cross-site scripting (XSS) vulnerability. An attacker in the same LAN can craft a packet with a malicious User-Agent header to inject a payload in its logs, where an attacker can take over the system by through its plugin-running function.
PUBLISHED: 2021-04-15
Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. The Stored XSS exists in the Pi-hole Admin portal, which can be exploited by the malicious actor with the network access to DNS server. See the referenced GitHub security advisory for patch details.
PUBLISHED: 2021-04-15
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
PUBLISHED: 2021-04-15
LightCMS v1.3.5 contains a remote code execution vulnerability in /app/Http/Controllers/Admin/NEditorController.php during the downloading of external images.
PUBLISHED: 2021-04-15
An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associa...