Posts Tagged ‘risk’

Stifling, Suffocating, Security?

Security risk management requires balancing a number of stakeholders needs. The risk owners, ultimately a board of directors of an institution, set a risk appetite (whether implicitly or explicitly) , the business managers and leaders then seek to operate within that appetite to drive growth or deliver their mission. There is commonly a tension between the hunger for growth versus the desire for safety which tends to be very easily handled at an executive level but becomes increasingly more contentious the further down an organisation a disagreement occurs.
(more…)

Portfolios of Risk

I’ve been thinking, and worrying, about portfolio risk and especially cross-portfolio risk in federated environments. In federated environments or extended enterprises it is not unheard of for strong programme management to have a good clear view of the risks in their scope of activity and in some more effective enterprises the dependencies that different activities within their scope have on each other but it is rare to have a coherent and complete view of external dependencies between portfolios and as the pace and variety of change increases this could be a problem.

(more…)

Managing Insider Risk

A short presentation I gave to the July 2015 NED Forum on using the ‘Critical Pathway to Insider Risk’ to Manage Insider Risk. This was a very conversational event so the slides are even more terse than usual. I’ve removed a slide on my employers proprietary technology in this area. This was a small gathering but a vocal and interactive one.

For more background on the Critical Pathway to Insider Risk I recommend the following paper [PDF].

Cyber’s Dirty Secret?

In 2011 the U.S. Securities and Exchange Commission (SEC) issued guidance on the disclosure of Cyber risks and Cyber incidents where they may significantly affect the risk of investing in the company reporting to the SEC.

This was controversial at the time and has led to an interesting revelation recently; many of the biggest US companies reporting Cyber incidents to the SEC have stated they suffered no major financial losses as a result. The context should be remembered in that on one hand these companies would like to reduce their reporting requirements and would love not to have to show their dirty laundry to the world but on the other hand these financial reports are personally signed off by the C-level executives in these companies and errors, inaccuracies, omissions and lies can all lead to fines and jail time for the individuals involved.

(more…)

Twitter RSS