Risk reduction and cybersecurity

Issue 3 2022 Security Services & Risk Management, Cyber Security

Risk management is critical to a business. We can find examples as far back as recorded history allows with ship and cargo owners routinely taking up insurance to cover risky voyages. Risk grew as companies became more complex, and today’s risk manager must juggle many physical and esoteric risk considerations.

It’s tempting to mitigate risks by nailing everything down, but that isn’t a practical reaction for certain parts of an organisation. Today’s business risks are not just about preventing the negative, but also supporting the positive.

Cyber risks are a perfect example. In an ideal world, a company would make its IT and data systems impenetrable. But employees, partners and customers need continual access to those resources. This tug-of-war between productivity and security is tricky to manage, and many risk managers find themselves outmanoeuvred by operational demands. Yet they are also at the forefront of helping make digital safe and practical for their businesses.

“Risk and IT professionals are converging around cyber risk,” says Lior Arbel, head of pre- and post-sales at cybersecurity audit service, Encore. “The IT guys understand the technical and process challenges of technology while risk managers translate much of that context for the business. For example, if a CFO weighs technology purchase decisions, they often take in the views of risk managers and as new technology regulations prompt more involvement from company leaders and boards, they also rely more on risk managers to add a business context.”

Risk is one of the ways a business strategically understands its technology. Yet grasping those risks is more often about complexity, Arbel explains.

“Companies are becoming very complex in how they operate and the environments they operate in. Risk management naturally rises to handle that complexity. Since digitisation introduces many new complicated relationships in a company, risk managers cannot avoid the topic. They have to be in the thick of it.”

The topic of cyber risk is complex and will occupy business theorists for decades to come. This article aims to answer a more straightforward question: how should risk managers think about cyber risk? What are the main considerations and red herrings? How would you know you’re mitigating cyber risk?

Six areas that help define cyber risk theory and practices

1. The types of risk: Cybercrime is the most visible cyber risk. Hackers attempting to breach company systems and steal sensitive information require serious responses. But there are also other cyber risks, such as employee negligence, abuse of systems, infrastructure failure, and poor legal compliance. Though some of these have straightforward mitigation strategies, it’s important to understand that all cyber risk interrelates. Just taking care of one area, such as regulation, won’t be sufficient.

2. The types of damage: To create an overarching picture of how to rank cyber risks, start with the potential damage – how an organisation could be harmed most. Stolen data is often the biggest problem. It varies based on the type of data, customer, personal, operational, company IP, etc. Business continuity is another big concern: will a cyber incident stop employees, partners and customers from transacting, and for how long? System downtime is often the costliest part of cyber breaches or negligence. Regulations are the third primary consideration: what are the legal implications and fines resulting from non-compliance?

3. Who owns the risk: Many organisations are still uncertain about who owns cyber risk or are unwilling to accept it’s no longer solely IT’s problem. Numerous laws, such as the Protection of Personal Information Act (PoPIA) and governance frameworks, such as King IV, place the responsibility on business leaders, the executives, C-suite and board. It’s not just a question of compliance. Technology is so intrinsic to modern business that leaders must accept technology as a strategic responsibility. It influences their costs, current performance, future investments, and the full gamut of strategic requirements: strengths, weaknesses, opportunities and threats.

4. Identifying risks: There is no single or large act that will sweep across cyber risk. Instead, most risks exist in specific areas of the business. For example, the storage, flow and access of personal identifiable data (PID) creates a number of risks related to compliance, employee behaviour, access rights, infrastructure performance, and operational efficiencies. Yet there will be many overlaps, PID might transact on collaboration systems that also work with company IP data.

5. Mitigating cyber risks: You might be shaking your head: cyber risk is holistic and all-encompassing but also specific. Where do you start? The good news is that you can exploit overlaps in cyber risk. For example, focusing on PID risks will reveal risks in other areas that often benefit from the same mitigation strategies. Stricter access management of user accounts around PID can help reduce risks, as can meeting ISO/IEC 27001 compliance. Improving PID database infrastructure can also improve productivity for other types of data.

6. Create a cyber risk culture: A collaborative culture is essential to mitigate cyber risks. Risk managers and technology managers should work together to understand different dimensions of the problems and opportunities at hand. Employees must receive training to help avoid negligence. Companies should employ senior security managers, and if they can afford it, a chief information security officer (CISO). Crucially, the C-suite and board must have access to someone with security knowledge.

These considerations are broad and demanding, shortcuts are few. But risk managers can still generate a few quick wins. Foremost, support the security teams. Good digital security is a complex and layered discipline, and security professionals can spend a lot of time finding gaps, poor configurations or over-powerful user accounts.

Invest in security and user account monitoring/audit software. Also look at enhancing security monitoring with service partners to provide security orchestration, automation, and response (SOAR), security information and event management (SIEM) and a security operations centre (SOC) as services (often under the banner of managed security services).

Above all, build closer ties to technology and security leaders. Don’t just rely on blunt mitigation strategies such as cyber insurance. Reducing cyber risk is a culture and strategy. Embrace that concept and you'll take control of cyber risk.

Find out more at www.encore.io

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Be aware of privacy and cybercrimes issues
Security Services & Risk Management Cyber Security Retail (Industry)
Artificial intelligence (AI) is being deployed to help shoppers make better choices, but retailers must be aware of their obligations under personal privacy and cybercrimes laws.

Millions in energy savings
Security Services & Risk Management
Massmart partners with Green Wave and Schneider Electric for a BMS system that optimises operations while already saving millions of rand in energy usage.

From Hill Street Blues, to Hillbrow, to managing risk for BMW
Technews Publishing Editor's Choice News Security Services & Risk Management
Jane-Eleanor Morrison’s success story starts from growing up in the stressful pre-democracy times in KZN, moves through a successful career in SAPS. to BMW South Africa where she is now the risk control manager.

Hard times, increased crime
Technews Publishing Security Services & Risk Management Integrated Solutions IT infrastructure
Hi-Tech Security Solutions spoke to Mezuzah Security Services to find out what is happening in the real world, and how security companies are dealing with the added pressure inherent to the South African market.

The cost of safety
iFacts Technews Publishing Security Services & Risk Management
In June 2022, the South African police statistics showed that crime had increased significantly. According to the SAPS, 6083 people were murdered over the quarter (up 22%), the equivalent of 68 people a day.

A guide to employing a new guarding company
Security Services & Risk Management
Outsourcing guarding has become necessary for businesses to mitigate crime, loss and compliance risks, provided you have done your due diligence.

Why LiFePO4 batteries are the future
Regal Distributors SA Security Services & Risk Management
Because the LiFePO4 battery is denser than the sealed lead acid battery, it’s able to store and discharge more energy, giving you more power, for more appliances, for longer.

Business continuity during outages
Security Services & Risk Management
rotecting technical equipment from unplanned outages is important if a company is to maintain business continuity and safeguard critical equipment.

Obscure Technologies adds OneTrust to portfolio
Security Services & Risk Management
Cybersecurity specialist Obscure Technologies has announced the formation of a strategic alliance with OneTrust, a provider of Trust Intelligence.

Cybereason expands presence across sub-Saharan Africa
News Cyber Security
Cybereason has appointed Chantél Hamman as its new channel director focused on growing the company’s presence across sub-Saharan Africa.