Any organization managing cybersecurity risks has a daunting challenge. Security issues are identified and published online daily, mitigations may not arrive for weeks, and threats can originate across international borders. Narrowly focused best practices can become liabilities overnight.
Conscientious and inflexible security practices may mitigate the risk of theft or intrusions but may come at the cost of efficiency and responsiveness. Risks can be invisible right up until they are a problem, and even trusted and seemingly secure supply chains can be disrupted or compromised.
The lines that define safe operations are constantly shifting, as even existing technologies require fresh security assessments. It isn’t enough to make a one-time risk analysis of possible threats when integrating new practices or assets. We recommend organizations routinely determine the scope and business implications of cyber-attacks. In addition, being able to quantify and categorize risk can make the development of a risk management culture a concrete exercise with metrics and clearly defined goals.
Establishing how each process and practice manages risk and increases operational resilience is easier with an integrated risk management approach to security. Leaders in integrated risk management have been expanding their abilities for mitigating risk with new tools that allow for coordinated security processes. See how to protect your organization with robust risk defenses by reading our report, “The State of Integrated Risk Management.”
All Risk is Connected and Your Security Approach Should Be Too
In the physical world, a strong perimeter defense can mitigate losses while still allowing businesses to operate within protected perimeters of a facility. However, cybersecurity perimeter defenses have long been problematic due to the very nature of digital risks and threats. When everything relies on the impregnability of a firewall or the secrecy of a password, everything is at risk if a firewall is breached, or a password is compromised.
When the global COVID-19 pandemic led to workplace shutdowns, the opportunities for cyberattacks skyrocketed. Organizations that did not have an integrated security approach to cyberthreats were more vulnerable to attacks when their workforce was distributed across a spectrum of network security settings. When a flood of remote workers began accessing sensitive assets through home networks, many organizations relied on VPNs to allow personnel to tunnel into protected organization networks.
Unfortunately, this adds as many points of security weaknesses as there are personnel remotely accessing the organization’s network. For example, the Colonial Pipeline ransomware attack used virtual private network login credentials to hold the Colonial Pipeline Company’s operations hostage.[1] A single point of failure led to disruptions in mission critical operations.
Reinforced Defenses against Disruption
The concept of defense in depth has been around for decades and adds layers of protection wherever possible and practical. An integrated risk management approach to security builds on that concept by connecting processes and data from other risk functions since e every part of an operation is a possible security concern or source of risk.
The key to designing and maintaining an integrated risk management approach to security is to make sure the entire process is aligned with operational resilience. The ability to remain in operation despite disruptions should be the primary motivating force behind your security approach. 1 in 5 of respondents in the RSA Digital Risk 2020 survey stated they are prioritizing the alignment of business resiliency and enterprise risk management approaches in the next two years.
With an integrated risk management approach to security, different areas of an organization can manage their risk in a way that strengthens overall operational resilience. The efforts of IT and security weave together with regulatory and corporate compliance, third-party management, and other stakeholders to create a reinforced risk management program.
Granular Risk and Response
We recommend organizations compile a complete picture of technology and digital security related risks and understand their financial impacts. Without knowing how a data breach will disrupt operations, it can be impractical to gauge the appropriate level of effort and capital to invest in precautions and countermeasures. A well-defined process and taxonomy that quantifies the impact of risks can help to align risk management practices with organizational goals.
Without an integrated risk management approach to security in place, a single security risk can propagate through an organization’s assets. With more and more elements being digitized, automated, and controlled with connected technology, a data breach can even result in the disruption of physical operations.
When operational resilience relies on the strength of a single measure, that one defense becomes so critical that it becomes difficult to quantify the results of that defense being compromised. A defense in depth, integrated risk management-based security strategy allows for atomized risk appraisals of any given practice or process.
The growing necessity of defense in depth security practices places a new responsibility on the risk management landscape. While the integrity of a single perimeter defense system can be determined with existing industry practices, the sheer density of security measures calls for new processes to monitor and control an organization’s risk management practices.
The pandemic revealed previously ignored or unaddressed weaknesses in many organizations. Our 2020 Digital Risk survey found that nearly 75% of respondents expect their digital initiatives to accelerate due to the disruptions and shifts over the past year.
While some of this acceleration will include expansion of existing approaches and practices, new processes to meet the expanding risk profile can help an organization match the shifting environment. Operational risk programs should bring risk information together so you can better understand your risk posture, determine more easily how to treat risks, as well as see the interrelationship of these risks to the entire business.
Integrated Risk Management Moving Forward
Comprehensive approaches to operational resilience require detailed audits of weaknesses in every part of a risk management strategy. Most of our customers expect their risk profile to expand significantly in the next two years. We work with organizations to manage their expanding risk profile on our powerful integrated risk management platform. To discover how the organizations that utilize a mesh security approach are outcompeting even in times of disruption, read our whitepaper, “The State of Integrated Risk Management.”
[1] https://www.bloomberg.com/news/articles/2021-06-04/hackers-breached-colonial-pipeline-using-compromised-password