Making business means taking risks. Risk management deals with exposures to specific threats that can take advantage of existing vulnerabilities and affect organisations. Enterprise risk management (ERM) consists of the processes used to manage risks in the enterprise.
Strategic (not defining and meeting objectives), market (negative interactions with the market), credit (exposure to non-payments) and operational risk (exposure to loss from internal processes, people, systems and external events) constitute ERM.
An ERM umbrella that is aligned with the business strategy helps the organisation achieve its objective.
Information is an essential asset for most organisations: it connects all risk management disciplines and, more broadly, most business processes use it. Information risk management, also called information security, is an element of operational risk.
There is a current tendency towards linking the information security activity (infosec) with the operational risk management (ORM) practice and, more generally, with the enterprise risk management activity.
The link between infosec and ORM disciplines can eventually play a positive role in constructing sustainable and superior benefits for organisations.
An overarching model is proposed to understand and manage the complexity of infosec and ORM in organisations: the ‘risk house’ model.
This model explains how to link the infosec practice with the ORM strategy and practice. It locates ORM within ERM and signals the pervasiveness of information and the need to develop information security and to link it with ORM.
The infosec-ORM link should always happen in accordance to the risk appetite of the organisation. ORM objectives can be significantly facilitated if both risk disciplines are aligned with the strategy of the organisation to achieve its objective.
A survey of 82 experts provides two main conclusions: First, management commitment, the degree of development of information security and the alignment of risk management with the business strategy (i.e. its strategic alignment) are strongly related to superior benefits achieved in organisations.
Second, the three most probable superior benefits achieved are stakeholder value, new business opportunities and better compliance. These three benefits ultimately contribute to the responsible image of the organisation.
Cyber Insurance Due Diligence
Cyber Insurance book by @itsecuriteer
Creating IT security teams
the book
Popular Posts
-
This post compiles my notes on three Papers on vulnerabilities in complex networks: - "Multiscale vulnerability of complex networks ... -
This time the student notes I post are coming from the reading of a scientific paper written by Mark Newman , Professor of Physics in the Un... -
I am convinced that Information Security professionals can benefit from reading, not only Information Security books like this one or that ... -
In the introduction to the Data Science world, one needs to build the right frame surrounding the topic. This is usually done via a set of ... -
Belgium: Waffles... and security The professional activities that we undertake within our company, be it our own shop or our employer, can... -
An elegant way to sell security Every now and then we need to get a chance to slow down our professional tactical everyday pace and think ... -
In the introduction to the Data Science world, one needs to build the right frame surrounding the topic. This is usually done via a set of ... -
Social Psychology Professor Scott Plous mentioned a very enlightening almost 12-minute video on the " Science of Persuasion " by ... -
A valuable security research repository Every single week, somewhere in the world, a security conference or presentation takes place. Att... -
The book by James Surowiecki titled " The wisdom of crowds " fell into my hands and I read it during the summer of 2015. These ar...
Follow me on twitter!
