Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

9/23/2019
03:55 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
100%
0%

Rethinking Risk Management

Where most organizations fall short in risk management tools, technologies, and talent, and how they can improve.

It's time for organizations to reevaluate their approach to risk management and consider new, more effective techniques and strategies, Jack Jones, chairman of the FAIR Institute and executive vice president of R&D at RiskLens, told attendees this week at the FAIR Conference.

Modern businesses are increasingly aware of risk management's importance; however, many fail to implement the right approach for their specific needs, Jones explained in an interview with Dark Reading ahead of this year's show, taking place this week in Washington, DC.

"Over the last several years, the conversation around risk quantification and risk analysis has evolved from 'can it be done' to 'should we do it,' and now, 'how do we do it,'" he said. The "how" is a problem for many risk professionals who try to implement change and are challenged by organizational and industry inertia that pushes back against them, Jones said.

Some of the pushback they normally hear: "We already do risk management," "What we've been doing works; why change?" and "What you're proposing is not yet 'best practice.'"

Jones' focus today is on the value proposition of risk management programs. "Part of what we expect to provide to this conference is helping people have those conversations and helping them describe the value proposition for change," he said. There are multiple paths to risk quantification and risk management; Jones wants people to understand which is best for them.

One of the major holes in modern programs is they aren't actually managing risk. "What's they're doing is controls management," said Jones, explaining how this approach is more checklist-based than compliance-based. "That's superficial from a risk perspective because they're not applying any rigor to measuring how those controlled instances matter," he added.

Compounding the problem are tools and technologies the industry relies on. He pointed to the Common Vulnerability Scoring System (CVSS) as an example. "It's great at characterizing certain aspects of technical deficiencies, but it's not a risk measurement," Jones explained.

If an organization has two systems with the same deficiency – for example, a SQL injection flaw – CVSS would call that critical. But if one of those systems is Internet-facing, doesn't hold sensitive data, and doesn't provide a path to other systems, it may not be as critical as it seems.

When something like CVSS labels "a tremendous number of things" critical when they may not be, it can generate a lot of noise for a business. "It's a losing battle," said Jones. "You have to have better metrics than that to be cost-effective in risk management."

Tips for Better Risk Management

There are four components to determine how well an organization can manage the risk landscape: models, the data applied to those models, skills of people doing the work, and the tools they use. Oftentimes, risk analysis is performed by anyone in the business who happens to be assigned to the work, Jones noted, and many companies lack risk measurement tools.

The first step should be training people assigned to risk analysis. "Training accomplishes two things: it normalizes mental models around what risk is and how to measure it, and it also teaches them how to make estimates and use data effectively," he said. Regardless of whether the organization is a Fortune 100 company or smaller, and regardless of the path they want to take or how far they plan to take risk analysis, "having that sort of clarity is huge," Jones added.

How to know if a risk management program is actually working? "I would argue noise reduction," he said. As an example, he describes the "risk register," or one of the biggest sources of noise in most risk management programs. This might be a spreadsheet or governance, risk, and compliance (GRC) tool where a business lists top worries and concerns.

The risk register should not be a "dumping ground" for things you're worried about, Jones said. It should contain risk factors, and if you're going to measure and manage something you must be sure what you're measuring and managing against. "What we're actually trying to manage is the frequency and magnitude of loss events," said Jones. If you stuff things into a risk register that aren't risks but are measured as risk, it messes with the ability to effectively prioritize.

One of the first things organizations are encouraged to do is reconcile the risk register. Businesses often list hundreds of "risks" that aren't risks, said Jones. Reconciling the risk register can help them cut down on noise and prioritize risks that matter most to the company.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "The 20 Worst Metrics in Cybersecurity."

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Stop Defending Everything
Kevin Kurzawa, Senior Information Security Auditor,  2/12/2020
Small Business Security: 5 Tips on How and Where to Start
Mike Puglia, Chief Strategy Officer at Kaseya,  2/13/2020
Architectural Analysis IDs 78 Specific Risks in Machine-Learning Systems
Jai Vijayan, Contributing Writer,  2/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5530
PUBLISHED: 2020-02-18
Cross-site request forgery (CSRF) vulnerability in Easy Property Listings versions prior to 3.4 allows remote attackers to hijack the authentication of administrators via unspecified vectors.
CVE-2020-1842
PUBLISHED: 2020-02-18
Huawei HEGE-560 version 1.0.1.20(SP2); OSCA-550 and OSCA-550A version 1.0.0.71(SP1); and OSCA-550AX and OSCA-550X version 1.0.0.71(SP2) have an insufficient authentication vulnerability. An attacker can access the device physically and perform specific operations to exploit this vulnerability. Succe...
CVE-2020-8010
PUBLISHED: 2020-02-18
CA Unified Infrastructure Management (Nimsoft/UIM) 9.20 and below contains an improper ACL handling vulnerability in the robot (controller) component. A remote attacker can execute commands, read from, or write to the target system.
CVE-2020-8011
PUBLISHED: 2020-02-18
CA Unified Infrastructure Management (Nimsoft/UIM) 9.20 and below contains a null pointer dereference vulnerability in the robot (controller) component. A remote attacker can crash the Controller service.
CVE-2020-8012
PUBLISHED: 2020-02-18
CA Unified Infrastructure Management (Nimsoft/UIM) 9.20 and below contains a buffer overflow vulnerability in the robot (controller) component. A remote attacker can execute arbitrary code.