A Strategic Approach to Cybersecurity Risk Management

 

By  Omodiaogbe Samuel

Last Updated: December 2, 2023

Cybersecurity has traditionally been viewed as an IT issue, but in today’s ever evolving digitized world, such thinking is dangerous. Cybersecurity is not only an IT problem, it is an enterprise-wide problem that requires an interdisciplinary approach, and a comprehensive governance commitment to ensure that all aspects of the business are aligned to support effective cybersecurity practices. Technologically, businesses should not rely on a single security tool or process to secure their operations, but apply multi-layer approach. A layer of defenses including preventative and detective measures should be employed. Therefore, a detailed understanding of networks, hardware,  software and processes is required to create such a comprehensive plan. But it needs to go beyond technology, cybersecurity is majorly about people. It has to take the whole organization to manage cyber risk, and therefore, it is imperative to cast a wide net and include representatives from across business units in the strategy formulation discussions

Strategy is a commitment to a set of coherent, mutually reinforcing policies or behaviors aimed at achieving a competitive advantage. Good strategies promote alignment among diverse groups within an organization, clarify objectives and priorities, and help focus efforts around them. Therefore, crafting a cybersecurity strategy is an exercise that involves aligning cybersecurity requirements to business objectives, and then matching investments against the risk profile of the organization. Good strategy is primarily about deciding what is truly important and focusing resources and action on that objective. The right cybersecurity strategy should therefore be guided by the considerations of how the cybersecurity initiative enable the business operations, as well as how cyber-risk affect the business.  As a result, the organization must consider what assets are most valuable and what threats pose the greatest risk using threat modeling and a risk management analysis. A primary dimension of digital resilience is the identification and prioritization of the organization’s critical assets―data, systems, and software applications that are essential to operations. Without prioritization, organizations may end up allocating scarce resources to what is not important to the cybersecurity posture.

Strategic Leadership:

Thinking of cybersecurity narrowly as an IT issue to be addressed simply with technical solutions is a flawed strategy. It has to start from the board and top management, and then cascade down  to the staff level. The board of directors has risk oversight responsibility. Although the board does not itself manage cybersecurity risks directly, instead, it has the responsibility to ensure that management is doing so effectively. On the other hand, it’s the duty of the management to ensure that a multidisciplinary team effort is put in place to develop a cybersecurity strategy that reflects the scale and complexity of the business challenge. The best way—and the biggest challenge—to bringing your strategy to life is to remember it isn’t policy or technology that matters most, but people. Therefore, the management has to ensure it got the buy-in from its people. Also, the other key stakeholders in in the value chain need to be carried along in the strategy formulation and implementation. However, the leadership has to start from the board and senior executives, as they are the key drivers of culture in an organization.

The business risk associated with cyberattack is enormous, and this include operational downtime, damage to reputation, loss of revenue, loss of customers, loss of business partners/suppliers, regulatory fines, litigation, and diminished shareholders value.  Therefore, cyber risk must be considered not as an addendum to a business process or asset, but as a central feature of the business operations. It’s not the amount of money an organization spent that leads to risk reduction. It’s whether it has approached it from a business perspective and having a risk management program that will not go stale. Managing cybersecurity risk has to expand far beyond the realm of IT; it has to be a business continuity program necessity for ensuring stakeholders value creation, protection of corporate privacy and intellectual property. Regardless of who is appointed to oversee cybersecurity efforts, cybersecurity should be seen as a shared responsibility across the entire enterprise, including senior management, staff, consultants, partners, and clients. But the board and senior executives must provide the leadership and ensure all the stakeholders are carried along

The Right Technological Approach:

Network security refers to any activities designed to protect the confidentiality, integrity, and availability of the network, as well as the information assets that rely upon it. This approach involves network firewall equipment, specialized IPS equipment, network monitoring software, and other appliances. On the other hand, data security involves the implementation of practices and technologies required for protecting data from thefts and unauthorized access. It includes data loss prevention solutions, encryption software, and hardware, hashing, and tokenization. Cloud security involves the protection of cloud-based data, applications, and infrastructure. While infrastructure security includes network implementation services, network operation services, secure email gateway, secure web gateway, threat intelligence tools, as well as deployment of Security Information and Event Management (SIEM) that provides the ability to gather security data from information system components and present that data as actionable information via a single interface. Therefore, the right approach is the deployment of multi-layer security technologies, as no single one is enough, but combination of different technologies can help in mitigating threats

Information security professionals know that eliminating the possibility of a breach is an unrealistic goal in today’s environment. Preventative tools need to be deployed to provide multiple layers of defense as no one piece of technology can provide a complete defense. A defense-in-depth requires layers of security, but the weakest link in each layer may provide access to the next. Applying a stronger defense-in-depth strategy has to ensure that each level is not accessible from the next. Layers of defenses including preventative and detective measures should be employed to adequately secure the systems. The sophistication of modern cyberattacks, the persistent nature of advanced threats, and the importance of managing business risk on a continual basis requires enterprises to reevaluate their entire security ecosystem. A detailed understanding of networks, hardware,  software and processes is required to create a comprehensive plan.

Organization needs to beyond deployment of technologies and learn how to make sense out of the technologies deployed. To achieve that, new capabilities need to be developed. For example, SIEM is able to extract a lot of data from the network, but it requires capabilities in data science, machine learning, deep learning, and artificial intelligence to analyze and make sense out of the data. Also, with 5G networks roll out, the use of connected Internet of Things (IoT) devices will accelerate dramatically, and that will increase networks’ vulnerabilities exponentially. Therefore, organizations need to be strategic in the deployment of IoTs with cybersecurity consciousness. Cloud computing is business enabler especially in terms of cost efficiency and scalability. However, the magnitude of cloud attacks and breaches are high as well. The use of blockchain in cybersecurity is also rapidly gaining momentum and is expected to become mainstream within the next couple of years. But there are also the risks of cybercriminal leveraging cryptocurrencies build on blockchain to perfect their arts, due to the anonymity it provides. Also, organizations can leverage RegTech to meet their regulatory and compliance obligations, as it provides the right insights and scalability

Managing Cybersecurity Risk Through Insurance

Cybersecurity insurance can play a vital role in an organization’s overall strategy to address, mitigate, and maximize protection against the legal and other exposures as a result of data breaches and other serious cybersecurity-related incidents. Cyber-insurance can include identity theft, business interruption, damage to reputation and goodwill, human error, restoration of property costs, litigation costs, investigation and remediation costs, etc. Cyber-insurance can help firm’s smooth financial outcomes by accepting to pay a small cost of an insurance premium in place of future uncertainty of large losses. It’s equally imperative to include third party in the cyber-insurance’s policy. It is virtually impossible to find a business today that does not rely on third-party vendors. Given the cyber risks that third-party vendor relationships pose, it will be a good strategy for firms to impute the security practices of those vendors into their own risk profile.

As part of a comprehensive cybersecurity strategy, the organization determines the type and extent of coverage that best serves it interest, and seek a tailored package of insurance that covers the full range of potential exposure to which a cyber-incident would subject the firm. However, cyber-insurance should be seen as a complementary approach to an overall cybersecurity strategy package.  While cyber insurance can help recoup financial losses that stem from a successful breach, it may not mitigate other impacts including business downtime, reputational damage, and customer attrition. Therefore, any organization that doesn’t have the right technological and other management processes in place, but only rely on cyber-insurance is bound to fail. The reputational damage of cyber-attack is much more severe than whatever compensation such organization could expect from an insurer. As a result, a good cybersecurity strategy should include cyber-insurance, technical readiness, good process, people buy-in, and good governance mechanism

 The People Aspect

The single biggest vulnerability in cyber systems is people. Malicious insiders are those who purposefully seek to benefit themselves at the organization’s expense or to harm the organization directly. They might steal valuable data, commit fraud for financial gain, publicly expose sensitive information to attract attention, or sabotage IT systems in disgruntlement. On the other hand, negligent insiders may not harm an organization intentionally but expose the organization to risk through their mistakes or carelessness. They can do that by sharing too much personal information online, making themselves available for spear-phishing attacks, or mistakenly clicking on links they ought not. The role that insiders play in cybersecurity is far bigger than you may believe. According to McKinsey report, threats from inside the company account for about 43 percent of data breaches. Mistakes such as answering unsolicited emails, connecting to unsecured networks, and setting weak passwords could cause great damage. It is entirely possible that a cybersecurity program, even when created to near perfection, can fail if the concerned persons don’t know how to operate it or take adequate defensive measures during an attack. Many organizations invest heavily in technical controls to protect their computer systems and data. However, most of these technical controls are rendered useless because the employees were not carried along in the program.

People are the most important element, but also the weakest link in the implementation of a cybersecurity strategy. In general, people are not aware of the risk that they face every day. Therefore, we need to focus more on awareness. Employee awareness is not a simple check-the-box exercise. Companies must invest in comprehensive, ongoing programs to minimize the weakest link syndrome. A well-trained staff can serve as the first line of defense against cyber-attacks. Effective training helps to reduce the likelihood of a successful attack by providing well-intentioned staff with the knowledge to avoid becoming inadvertent attack vectors. However, an effective cybersecurity strategy goes beyond training, for a business to be cyber resilient, a holistic cybersecurity strategy should involve the people, information, systems, processes, and culture of the organization. Cybersecurity has to be viewed as a process and not an end point, i.e., the proverbial marathon versus sprint. To be effective, the organization needs a company-wide governance structure, built on a strong cyber-risk culture.

Compliance to Security Standards

Standards are guideposts for the development, maintenance, and measurement of a security program. They set best practices for organizations to meet cybersecurity changing threats, technological innovation, and compliance requirements. Standards enable boards and top executives to understand how comprehensive their organization’s security program is, and provide basis for audits and assessments. Evaluating a cybersecurity program against a leading standard enables an organization to measure progress, assess the effectiveness of controls, identify gaps and deficiencies, and measure program maturity.  Compliance to a security standard helps in management of risk as there is an externally defined framework for security management and controls.  Many compliances require organizations to conduct a risk assessment in order to derive a list of controls that are applicable to their environment. Therefore, compliance to standards is an internal assessment measure, as well as a benchmark for measuring and evaluating how the organization is performing relative to competition

The leading cybersecurity standards and best practices include: ISO/IEC27001 (International Organization for Standardization/International Electrotechnical Commission) for Information Security Management Systems (ISMS). Payment Card Industry Security Standards Council (PCI SSC) that applies to all entities involved in payment card processing. National Institute of Standards and Technology (NIST) in the US. The European Union GDPR (General Data Protection Regulation) for EU members and any organization that does business in the EU. Other notable standards are:  HIPAA, FISMA, GLBA, NERC, SOX, COBIT, CIS etc. Why should organizations care about compliance to standards?

  • Certificate has marketing potential and brand value, and so, it demonstrates that the organization takes information security management seriously.
  • Organizations seeking contracts with governments or large corporate clients are increasingly finding ISO 27001 as a prerequisite for doing business.
  • Certification is seen as a powerful assurance of your commitment to meet your obligations to customers and business partners.
  • The ability to prove that your organization complies with international standards and regulations is likely to open business opportunities across the globe.
  • Compliance to regulations and standard is not only effective for smooth operations, but also as source of competitive advantage for an organization

As a result, organizations need to have a strategic perspective on compliance to standards. In a differentiation strategy, uniqueness is the target. Essentially, organizations that have certification for meeting their industry security standards are able to differentiate themselves, and that is a source of competitive advantages

Deploying the Right Regulation Mechanism

In order to solve the problems of growing cybersecurity risk and increasing attack rates, policy and legislation must coherently allocate responsibilities and liabilities so that the parties in a position to fix problems are made to do so. Looking across the board, there is an incentive to under-report cybersecurity incidences. Banks don’t want to reveal fraud losses, for fear of frightening away customers from online banking; businesses don’t want to cooperate with the security agencies on cyberattacks, because that might have negative effect on their reputation; the operators of critical infrastructures don’t want to reveal information on outages caused by malicious attack, for the fear of public criticism. As a result, information systems are bound to fail when the person or firm responsible for protecting the system is not the one who suffers for their failure. For example, banks encourage consumers and businesses to bank online because the bank experiences massive savings in branch operating costs. Most times, they allow such transactions on an interface that is not adequately secured and regularly exploited by attackers. So, there is misaligned incentives between those responsible for security and those who benefit from weak protection systems.  Such information asymmetry makes security incidences been swept under the rug by affected organizations. They don’t have incentive to invest on secured systems

Given that information asymmetry is a fundamental barrier to improving cybersecurity systems, the regulatory agencies need to adopt policies that improve information disclosure.  Organizations need to improve on their processes and make them more transparent. The traditional approach to compliance—adhering to protocols, ticking boxes on checklists, and filing documentation—is no longer effective, and therefore requires radical improvement.  Communication between organizations and regulatory agencies should be made more effective, and therefore, organizations need to always carry the regulators along on their security posture. On the other hand, the regulatory agencies have to be on top of the game. More stringent punitive measures need to be melted on violators as against the current slap-on-the-wrist approach. They need to deploy RegTech in making businesses to meet and comply more effectively with regulations. Regulators should make organizations to invest adequacy on state-of-the-art technologies on proactive security analytic. Companies need to embrace and adopt automation, big data solutions, and artificial intelligence to cope with the ever-increasing number of cybersecurity threats. Collectively, better intelligence, smarter analytics, and stronger collaboration can help organizations build the active-defense capabilities they need to respond more effectively to pervasive, and advanced cyberthreats. Policy interventions are required that encourage collaboration and accountability on the part of the organization. At present, that is either lacking or inadequate 

Managing Cybersecurity Risks Though Collaboration

Organizations need to have a wider scope of their cybersecurity risk management. Companies may have a state-of-the-art firewall and the latest malware-detection software. And they might have well-tuned security operations and incident-response processes. But what about third-party vendors or suppliers, which might be the weakest link of a company’s value chain? Criminals know that the best targets are well defended, so rather than trying to penetrate a heavily secured front door, they can go around to the back, to the company’s supply chain. Because the internet has made us all interconnected, one person’s compromise could lead to other people getting affected. In the same way, one person’s compromise could help us learn and be more secure. Remember, an organization is as strong as its weakest link. Even if an organization’s own system is not compromised, the organization may suffer significant losses if an incident affects a key vendor, cloud provider, or any key third party in the organization’s product and service supply chain. Therefore, for an organization to be cybersecurity-resilient, there is need to look beyond the internal security measures, and focus on the entire ecosystem. A culture of trust is also important for corporate cybersecurity initiatives to succeed. All stakeholders in the ecosystem— organization, suppliers, and vendors, —must come to a mutual understanding of the risks the company faces and work together to decide on the best approach to addressing them.

Managing Cybersecurity Risk Through Outsourcing

It’s very difficult for an organization to manage or respond to cyberthreat only with in-house team because of huge cost and shortage of cybersecurity skills. Effective management of cybersecurity goes beyond cybersecurity engineering and software development. It takes the adjacent engineering expertise such as machine learning (ML) engineering, artificial intelligence (AI) engineering, big data engineering, and other software related engineering to make a good cybersecurity team. It’s because of shortage of these skills that make incidence preparedness and response in many organizations to be slow. According to IBM 2018 report, it takes organizations an average of 191 days to detect an attack, and 66 days to resolve a situation. Also, IBM 2019 report revealed that there are 2.8 million professionals worldwide currently working in the field of cybersecurity, and an additional 4.07 million more are needed. The reality of skill shortage coupled with the complexity of building an effective cybersecurity team, makes it imperative for organizations to look at the issue more from a strategic perspective

A strategic approach to managing cybersecurity is outsourcing it to a company that has the breadth and depth to effectively do so, as that enables the organization concentrate on its core competence. Such strategic choice allows the organizations’ cybersecurity to be performed by an independent specialist company that focus all its skills and knowledge on just cybersecurity. As a result, an external security consultancy team can help the organization to design the right cybersecurity strategic-fit for the company’s unique environment. Such services could include professional services― integration, support and maintenance, consulting, penetration testing, threat intelligence, incident response, advisory, and incident readiness. On the other hand, managed services could include threat management, vulnerability management, protective monitoring, and advanced threat detection/control. In-house cybersecurity teams are very important, but they are rarely sufficient on their own to defend against constantly evolving and escalating cyberthreats. In an era of critical cybersecurity staff shortages and daily cybersecurity events numbering in the millions, there is need for a proactive approach to managing cybersecurity risk

As cyber threats evolve and become more complex, many businesses recognize they can’t manage the challenge alone. Therefore, they’re turning to managed security services providers (MSSPs) who can provide a cost-effective solution in monitoring, detecting, investigating, alerting and responding to cyber threats. The right MSSP can reduce the cost and complexity of information security while helping the organization to build a stronger security posture. Cybercrime operates around the clock and so you require a partner who will be there 24×7 to watch over your organization. By outsourcing security operations to MSSP, organizations can take advantage of the expert skills, tools and processes that these service providers offer and significantly enhance security without making a large investment in technology and resources. Because MSSPs focus on security, they are usually in a better position to train and retain good security personnel, and they have the advantage of learning from security threats they observe across their client base. As a result, their clients benefit from deep security expertise and improved security safeguards. Allowing an MSSP to handle day-to-day security monitoring and management give organizations an opportunity to allocate in-house IT resources to more strategic initiatives. So, in choosing your MSSP, you need to consider service reliability, breadth of technology coverage, pricing flexibility and even their experience with technology platform interfaces.

Summary

No issue today has created more concern for corporate boardrooms and executives than cybersecurity risk. Cyberattack has the ability to shatter a company’s reputation, hinder customers trust, erode shareholder value, attract lawsuits, draw unholy attention from the media, and cause colossal damage to corporate existence. The fact remains that no region, industry or company is immune, which makes the responsibility to oversee, manage, and mitigate cyberattack a top priority for any organization. Cybersecurity is not solely an IT issue. It is a multifaceted challenge that requires an enterprise-wide approach. Total protection from cyber threats is unattainable. Rather, a best practice is a risk-based approach that implements a comprehensive strategy to deliberately avoid, mitigate, accept, or transfer risks posed by cyber threats. Threat actors are time, years ahead of us in a lot of situations. Therefore, organizations need to have proactive approach to fighting cybercrime. Organizations that prepare for uncertainty and approach their digital transformation with a security-focused mindset will be better positioned to survive this increasingly hostile connected ecosystem.

Omodiaogbe Samuel, MSc. CMC, ChMC, FIMC

Omodiaogbe is a Strategic Management Consultant, and he the Principal Consultant/CEO at Vast Thinking Consults Ltd where he help organizations and business leaders to create superior value. Omodiaogbe holds BSc. and MSc. in Economics. Also, he is a Certified Management Consultant (CMC), a Chartered Management Consultant (ChMC), and a Fellow, Institute of Management Consultants, Nigeria. He is an Instructor on Coursera, where he teaches 25 courses in Strategic Management. Omodiaogbe is one of the world’s leading MOOCs learners on Coursera and Edx with over 500 Certificates from top-ranked Universities and Business Schools. His areas of expertise centers on Strategic Management

Contact him:
Email; somodiaogbe@vastthinking.com.ng
Visit: www.vastthinking.com.ng

Vast Thinking Consults Ltd is a Strategic Management Consulting firm that is into Partnership with a reputable Indian based cybersecurity company to bring top quality cybersecurity solutions to Africa.
Services include:
• Cyber Security Consulting
• Awareness & Training
• Managed Security Services

Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top
×