It’s not an earth-shattering thing to say that news of hacks, data breaches, and other technology hiccups has grown exponentially in recent years. A few of this year’s data breaches include:
- A ransomware attack on a major fuel provider that carried 45% of the United States' East Coast petroleum supply, resulting in the payment of a $2.3 million ransom.
- The discovery by a prominent lead generation firm that the social security numbers, bank accounts, and drivers license numbers of over 10 million of its customers was being sold on the dark web by a prominent hacking group.
- An attack on a men's clothing retailer by a notorious cybercriminal who posted the PII of over 7 million of its shoppers in a hackers' forum for free.
Of course, this barely scratches the surface…
There’s no doubt that these and other hacks are serious, but many sensationalist headlines and opportunistic consultants spread alarm about technology risks, cybersecurity and so on, leading many companies to place too much emphasis on this particular issue.
Companies have several frameworks to choose from for helping them address technology risks, with the Risk Management Framework for Information Systems and Organizations from the National Institute of Standards and Technology (NIST) considered the most authoritative. Other examples include the Factor Analysis of Information Risk (FAIR) framework and the ISO 27005 standard.
While these standards do provide guidance on identifying, assessing, and managing technology risks, they each have one big shortcoming.
They fail to address business risks associated with technology…
Truly understanding and managing technology risks effectively requires a holistic approach focused on the business.”
IT professionals should have a very good technical understanding of cyber and general technology risks. However, they typically only focus on the immediate impacts of data breaches like the number of records exposed and remediating the cause of the breach.
And as I discuss in a prior article, most organizations also mistakenly believe that since they have insurance for instances like this, they don’t need to do anything else.
This approach to technology risks can do more harm than good and can, in fact, be dangerous.
While having insurance can be helpful, it’s not going to cover all of the costs and impacts of a breach. Some non-insurable impacts that immediately come to mind include:
- The business can’t serve its customers, putting an immediate halt to revenue.
- Employees can’t access the company network and data, stopping work in its tracks.
- Strategic initiatives are forced to a standstill, potentially stopping new products, software implementations, or a pending merger or acquisition.
- Word spreads quickly via social media, whether from employees or customers, negatively impacting the company’s reputation.
But according to a recent book from Norman Marks, Making Business Sense of Technology Risk, it goes even farther.
As Norman and others say, simply “managing risks” is insufficient in today’s world…informed risks have to be taken in order for organizations to add value and remain relevant in a world that’s changing at lightning speed, or as Norman explains:
“How should a board assess whether to invest in reducing risks related to technology, address other business risks, or putting that money towards new product development, increases in the sales staff, or a new marketing campaign?
Choices have to be made.
No organization (even Apple or Amazon) has unlimited resources. Its leaders need to be able to understand technology risks within the context of running the business and achieving objectives.”
In days long gone, it would be advisable for a company to wait until a particular technology risk was below a certain threshold. In today’s world, companies have to be willing, on business terms, to accept or take a risk, even it is higher than they would like.
Waiting to implement a new technology could mean lost ground to competitors and eventual displacement like what happened to Blackberry, Motorola, Kodak, Borders, and more.
So how can risk professionals help IT executives and staff better communicate technology risks and opportunities to decision-makers?”
Simply saying a particular cyber or other technology risk is high is not helpful for decision-makers. In a 2016 survey published by Osterman Research for example, an astounding 85% of board members believe they are not getting helpful information from IT executives and staff and 59% say these same personnel will be let go from their jobs for not providing actionable information.
With that in mind, risk professionals have an important role to play in ensuring the link between technology risks and goals and objectives is understood by decision-makers. This will mean getting rid of the technical terms and talk the talk of the business.
Again, just saying a particular risk is high, medium, or low without any context doesn’t help executives understand its impact on objectives, much less develop any plans to address it.
By not breaking risks down through root cause analysis, scenario analysis, or quantitative tools like Monte Carlo simulation, it will be impossible to know if mitigations are appropriate or what actions to take, if any. Any information executives do receive will be confusing and overwhelming and therefore continue to feed the perception that ERM is not a helpful tool for building a strategic advantage.
In the end, actions can only be as specific as the risk you have identified.
Technology risks have been a growing concern for many years now and will continue to dominate headlines. Therefore, risk managers need to help their IT colleagues properly understand and communicate these risks (and the appropriate context) to decision-makers to ensure a proper balance is struck between risk mitigation and risk taking.
This article was originally written for ERM Insights by Carol.
