RSA: Organizations Need to Determine Their 'Cyber Risk Appetite'

BEDFORD, Mass., June 8, 2016 /PRNewswire/ --

STORY HIGHLIGHTS

• New paper highlights ability to quantify and manage cyber risk appetite could determine organizations' success or failure in marketplace
• Companies need to identify potential cyber risks, quantify the impacts, prioritize, and constantly re-evaluate
• Group of stakeholders to shape policy should include much wider array of technical and business personnel

RSA, The Security Division of EMC (NYSE: EMC), today announced a new framework designed for companies to inventory and prioritize cyber risks. The framework, issued in a report RSA prepared with support from Deloitte Advisory Cyber Risk Services, gives organizations a new way not only to factor cyber risk into their overall risk appetite but to define the level of cyber risk they are willing to accept in the context of their overall business strategy.

As businesses strive to improve performance, many of the fundamental moves they undertake expose them to new cyber risks. Since organizations can't turn the clock back on globalization, outsourcing, extending their third-party networks and moving to the cloud, they will need to realign their thinking about risk. The report, entitled "Cyber Risk Appetite: Defining and Understanding Risk in the Modern Enterprise," concludes that organizations need a systematic process for defining and comprehensively categorizing sources of cyber risk, a new accounting of key stakeholders and risk owners, and a new way to calculate cyber risk appetite.

First, organizations need to redefine the term "cyber risk." The term extends beyond hacks – planned attacks on information systems. While hacks are an important part of the equation, cyber risk encompasses a wider range of events that lead to potential of loss or harm related to technical infrastructure of the use of technology within an organization.

The paper provides a practical framework for inventorying and categorizing cyber risks across two dimensions of intent.  Cyber risk events could be the result of deliberately malicious attacks, such as a hacker carrying out an attack with the aim of compromising sensitive information. They could also be unintentional, such as user error that makes a system temporarily unavailable. Risk events may come from sources outside the organization, such as cybercriminals or supply chain partners, or sources inside the organization such as employees or contractors.

To effectively assess their cyber risk appetite, the report recommends that organizations take a comprehensive inventory of these cyber risks, quantify their potential impact and prioritize them. Organizations need to ask the right questions, such as what losses would be catastrophic, and what information absolutely cannot fall into the wrong hands or be made public. They need to prioritize the risk according to impact, ranking mission- and business-critical systems ahead of facets like core infrastructure and extended ecosystem (supply chain management applications and partner portals) and external public facing points of interaction. Prioritization needs to be an ongoing process involving constant evaluation and re-evaluation.

The report concludes that an organization's ability to quantify cyber risk and make informed decisions about their cyber risk appetite will put them in a position to succeed. Some costs can be easily quantified: costs that include fines, legal fees, lost productivity and mitigation remediation and incident response. Other costs can be more difficult to determine – like diminished brand equity, reduced goodwill and the loss of intellectual property. Organizations need to develop the ability to demonstrate that the investments they are making align with the risks they face.

EXECUTIVE QUOTES:

Emily Mossburg, partner, Deloitte & Touche LLP and Deloitte Advisory Cyber Risk Services Resilient Practice Leader
"The very fundamental things that organizations undertake in order to drive performance and execute on their business strategies happen to also be the things that actually create cyber risk. Cyber risk is an issue that exists at the intersection of business risk, regulation, and technology. Executive decision-makers should understand the nature and magnitude of those risks, consider them against the benefits a strategic shift would deliver, and then make more informed decisions."

David Walter, RSA GM, Global GRC 
"Cyber risk is a critical issue in today's organizations, touching aspects of business risk, regulation and technology. To effectively deal with these risks, executive decision-makers need to understand their organizations' cyber risk appetites' – balancing the nature and magnitude of those risks against the benefits a strategic shift would deliver. Then they can make more informed decisions."

ADDITIONAL RESOURCES:

• Download Cyber Risk Appetite: Defining and Understanding Risk in the Modern Enterprise paper  
• Find additional assets on the Cyber Risk Appetite landing page 
• Read this blog post on Cyber Risk Appetite
• Connect with RSA via Twitter, Facebook, YouTube, LinkedIn and the RSA Speaking of Security Blog and Podcast

About RSA
RSA provides more than 30,000 customers around the world with the essential security capabilities to protect their most valuable assets from cyber threats.  With RSA's award-winning products, organizations effectively detect, investigate, and respond to advanced attacks; confirm and manage identities; and ultimately, reduce IP theft, fraud, and cybercrime. For more information, go to www.rsa.com.

This release contains "forward-looking statements" as defined under the Federal Securities Laws.  Actual results could differ materially from those projected in the forward-looking statements as a result of certain risk factors, including but not limited to: (i) risks associated with the proposed acquisition of EMC by Denali Holdings, Inc., the parent company of Dell, Inc., including, among others, assumptions related to the ability to close the acquisition, the expected closing date and its anticipated costs and benefits; (ii) adverse changes in general economic or market conditions; (iii) delays or reductions in information technology spending; (iv) the relative and varying rates of product price and component cost declines and the volume and mixture of product and services revenues; (v) competitive factors, including but not limited to pricing pressures and new product introductions; (vi) component and product quality and availability; (vii) fluctuations in VMware, Inc.'s operating results and risks associated with trading of VMware stock; (viii) the transition to new products, the uncertainty of customer acceptance of new product offerings and rapid technological and market change; (ix) risks associated with managing the growth of our business, including risks associated with acquisitions and investments and the challenges and costs of integration, restructuring and achieving anticipated synergies; (x) the ability to attract and retain highly qualified employees; (xi) insufficient, excess or obsolete inventory; (xii) fluctuating currency exchange rates; (xiii) threats and other disruptions to our secure data centers or networks; (xiv) our ability to protect our proprietary technology; (xv) war or acts of terrorism; and (xvi) other one-time events and other important factors disclosed previously and from time to time in the filings of EMC, the parent company of RSA, with the U.S. Securities and Exchange Commission.  EMC and RSA disclaim any obligation to update any such forward-looking statements after the date of this release.

SOURCE RSA

Related Links

http://www.rsa.com