Healthcare and Technology news
48.0K views | +2 today
Follow
Healthcare and Technology news
Your new post is loading...
Your new post is loading...
Scoop.it!

Information Risk Management Still Needs Improvement

Information Risk Management Still Needs Improvement | Healthcare and Technology news | Scoop.it

Cybersecurity threats and attacks across various business sectors are on the rise pressuring for organizations to continuously assess the risks to any information. While the General Data Protection Regulation (GDPR) has garnered a lot of buzz in 2018, many standards and regulations in the United States also require cybersecurity.

 

But what are the technical details and operational steps needed to meet the high level guidance on cybersecurity risk? A recent Advisen survey revealed some interesting statistics:

 

  • 35% of respondents rated data integrity risks as “high risk” versus only 22% that of rated business continuity risks, or cyber related business interruption
  • Only 60% of the risk professionals surveyed said their executive management team viewed cyber risk as a significant threat to the organization, down 23% from the previous year.
  • Only 53% knew of any updates or changes even after the 2017 high profile attack

 

In short, these statistics paint a grim picture over the state of cybersecurity in the United States. While organizations are aware of the high risk of cyber attacks, management team involvement may be decreasing, and organizations may not be evolving their cybersecurity programs quickly enough.

 

Creating a Security First Risk Mitigation Posture
Many organizations have moved to a risk analysis security first compliance posture to enable stronger risk mitigation strategies and incorporate senior management oversight. However, identifying the potential risks to your environment only acts as the first step to understanding your overall risk. In order to identify all potential risks and engage in a full risk analysis that appropriately assesses the overall risk facing your data, you need to incorporate vendor risk as part of your risk management process.

 

That’s a lot of risk discussion, but you also have a lot of places in your overarching ecosystem that create vulnerabilities. Using a risk management process that establishes a security-first approach to your organization’s data environment and ecosystem means that you’re locking down potential weaknesses first and then backtracking to ensure you’ve aligned controls to standards and regulations. This approach, although it seems backward from a traditional compliance point-of-view, functions as a stronger risk mitigation program by continuously monitoring your data protection to stay ahead of hackers. Standards and regulations mean well, but as malicious attacks increasingly become sophisticated the best practices within these documents may be outdated in a single moment.

 

What is an Information Risk Management (IRM) Program?
An information risk management (IRM) program consists of aligning your information assets to a risk analysis, creating IRM policies that formalize the reasoning and decisions, and communicating these decisions with senior management and the Board of Directors. The National Institute of Standards and Technology (NIST) and the International Standards Organization (ISO) both provide guidance for establishing an IRM.

 

For example, the September 2017 NIST update to NIST 800-37 focuses on promoting information security by recognizing the need for organizational preparation as a key function in the risk mitigation process.

 

In fact, the core standards organization, ISO, updated its ISO 27005 in July 2018 to focus more on the information risk management process.

 

Specific to the United States, the Committee of Sponsoring Organizations of the Treadway Commission (COSO) updated it enterprise risk management framework to minimize data threats while requiring organizations to detail potential risks and manage risks more proactively.

 

As risk analysis increasingly drives information security practices, you need to focus on a risk treatment program that begins with risk identification, establishes an acceptable level of risk, defines your risk treatment protocols, and create risk mitigation processes.

 

Create an Information Risk Management (IRM) Team
In order to appropriately manage risk, you need to create an IRM Team consisting of stakeholders across the organization. Relying solely on your IT department may leave gaps in the process. To determine the stakeholders, you should explore the departments integral to risk identification. For example, you might want to ask yourself:

 

  • What departments hire vendors?
  • What departments can help with the overall risk process?
  • What stakeholders are legally required (in the United States) to be informed of the risk process?
  • Who brings unique insights into the risks that affect my data environment and ecosystem?

 

For example, while your IT department sets the controls that protect your information, your human resources department handles a lot of sensitive data. You need to incorporate stakeholders who understand the data risks unique to their role in your organization so that they can work with your Chief Information Officer and Chief Information Security Officer. Additionally, many United States regulations, such as the Sarbanes-Oxley Act of 2002 (SOX) require senior management and Board of Director oversight so they should also be included as part of your IRM team.

 

Begin with Business Processes and Objective
Many organizations forget that businesses processes and organizational business objectives should be the baseline for their risk analysis. Senior management needs to not only review the current business objectives but think about the future as part of the risk identification process. Some questions to ask might include:

 

  • What businesses processes are most important to our current business objectives?
  • Do we want to scale in the next 3-5 years?
  • What business processes do we need to meet those goals?

 

Understanding the current business objectives and future goals allows organizations to create stronger risk mitigation strategies. Many organizational goals rely on adding new vendors whose software-as-a-service products enable scalability. Therefore, you need to determine where you are as well as where you want to be so that you can protect the data that grows your organization and choose vendors who align with your acceptable level of risk.

 

Catalogue Your IT Assets
The next step in the risk analysis process requires you to look at all the places you transmit, store, or access data. This step often becomes overwhelming as you add more cloud storage locations that streamline employee workflows. Some questions to ask here might include:

 

  • What information is most critical to my business processes?
  • What servers do I store information on?
  • What networks does information travel over?
  • What devices are connected to my servers and networks?
  • What information, servers, networks, and devices are most essential to my targeted business processes?
  • What vendors do I use to management my data?

 

Review Your Potential Risks from User Access
Once you know what information you need to protect and where it resides, you need to review the users accessing it. Using multi-factor authentication and maintaining a “need to know” access protocol protects your information.

 

  • Who accesses critical information?
  • What vendors access your systems and networks?
  • Does each user have a unique ID?
    Can each user be traced to a specific device?
  • Are users granted the least authority necessary to do their jobs?
  • Do you have multi-factor authentication processes in place?
  • Do users have strong passwords?
  • Do you have access termination procedures in place?

 

These questions can help you manage risks to critical information because employees lack password hygiene or decide to use the information maliciously upon employment termination.

 

Establish An Acceptable Level of Risk
Once you’ve completed the risk identification process, You need to review what risks you want to accept, transfer, refuse, or mitigate. To determine the acceptable level of risk, you may want to ask some questions such as:

 

  • What is an acceptable level of external risk to my data environment?
  • What is an acceptable level of risk arising out of vendor access?
  • How do I communicate the acceptable level of risk to senior management?
  • How can I incorporate my acceptable level of risk in service level agreements (SLAs) with my vendors?
  • Can I quantify the acceptable level of risk I have assumed as part of my risk analysis?

 

Your information risk management (IRM) process needs to incorporate the full level of tolerances and strategies that protect your environment. In some cases, you may decide that a risk is unacceptable. For example, you may want to limit consultants from accessing your corporate networks and servers. In other instances, you may need to find ways to mitigate risks with controls such as password management or a Bring-Your-Own-Device policy.

 

Define the Controls That Manage Risk
Once you’ve set the risk tolerance, you need to define controls that manage that risk. This process is also called risk treatment. Your data ecosystem can leave you at risk for a variety of data breach scenarios, so you need to create information risk management (IRM) policies that outline your risk treatment decisions. In doing this, you need to question:

 

  • What firewall settings do I need??
  • What controls protect my networks and servers?
  • What data encryption protects information in transit across my networks and servers?
  • What encryption protects the devices that connect to my systems and networks?
  • What do I need to make sure that all vendor supplied passwords are change?
  • What protects my web applications from attacks?
  • What do I need from my vendors as part of my SLAs to ensure they maintain an acceptable level of security?

 

Defining your controls includes everything from establishing passwords to requiring anti-malware protection on devices that connect to your systems and networks. Creating a clearly defined risk treatment program enables a stronger security-first position since your IRM policies focus on protecting data proactively rather than reactively changing your security controls after a data event occurs.

 

Tracking the Risks With IRM Policies
Creating a holistic security-first approach to risk treatment and management means using IRM policies to help create a risk register. A risk register creates a tracking list that establishes a mechanism for responding to security threats. Your IRM policies, which should outline the entire risk management process, help establish the risk register by providing the list of risks monitored and a threat’s impact.

 

Although this process seems intuitive, the larger your environment and ecosystem, the more information you need to track. As you add vendors and business partners, you increase the risk register’s length making threat monitoring cumbersome.

 

How SecurityScorecard Enables the Information Risk Management Process
SecurityScorecard continuously monitors threats to your environment across ten factors: application security, DNS health, network security, patching cadence, endpoint security, IP reputation, web application security, cubit score, hacker chatter, leaked credentials, and social engineering.

 

Using these ten factors, organizations can streamline the risk management process. A primary hassle for those engaging in the risk management process lies in defining risks and establishing definitions for controls that mitigate overall risk. The ten factors remove the burden of identifying both risks to the environment and ecosystem as well as controls that mitigate risk. Moreover, you can use these same ten factors to quantify your risk monitoring and reaction, as well as the security of your vendors.

 

SecurityScorecard’s continuous monitoring tool can help alleviate bandwidth problems and help facilitate a cybersecurity program more in line with the sophisticated cyberthreat landscape.

Technical Dr. Inc.'s insight:
Contact Details :

inquiry@technicaldr.com or 877-910-0004
www.technicaldr.com

more...
Scoop.it!

Top 3 Third Party Risk Management Challenges

Top 3 Third Party Risk Management Challenges | Healthcare and Technology news | Scoop.it

Since the massive Target data security breach in December 2013, third party cyber security stopped being an afterthought and started becoming one of the top security priorities for CISOs and Risk Departments. As a response, Third Party Risk Management (TPRM) underwent a transformation in early 2014, and continues to reverberate today.

 

With attackers finding new ways to break into third parties in hopes of infecting a larger organization, the third party ecosystem is more susceptible than ever before. Meanwhile third party usage is growing fast in large organizations and enterprises. Many critical business services such as HR functions, data storage, and modes of communication are the responsibility of cloud-based third parties.

 

Without a modern TPRM program, many of these third parties are left behind in security risk management, putting organizations in a vulnerable position.

 

Over 60% of data breaches can be linked either directly or indirectly to a third party (per Soha Systems, 2016) but TPRM programs don’t often take a risk-first perspective when it comes to risk management. Security and Vendor Risk departments are often solely focused on compliance. That’s important, but doesn’t get at the heart of the risk posed by your third parties. To shift the approach of your TPRM program to measure true risk, you’ll need to make some adjustments in how you manage third parties.

 

Here are the three top TPRM challenges and the actions you and your organization can take in order to bolster your TPRM program.

 

1. Automate Your TPRM Process to Reduce Unmanaged Risk
With the rise in SaaS, businesses are now using cloud-based third parties more than ever. Gartner predicted that SaaS sales will nearly double by 2019, and that SaaS applications will make up 20% of the growth rate in all public cloud services, a $204B market. Last year, Forrester had already predicted that enterprise spend on software would reach $620B by the end of 2015.

 

As businesses engage in IT and infrastructure digital transformation, the need to manage vendors is more pronounced. Over 60% of respondents from a Ponemon Institute’s survey on Third Party Risk Management believe that the Internet of Things increases third party risk significantly. 68% believe the same is true for cloud migration.

 

However, as more third parties are brought in, they’re often not managed to match the level of cyber security risk they carry. Worse, they may not be managed at all due to a lack of resources. This creates unmanaged security risk. If these third parties have access to your network, your employees’ PII, or your customers’ sensitive data, shouldn’t they be subject to rigorous risk management assessments?

 

Unfortunately, as the number of third parties swell to the hundreds, it’s often not feasible for every vendor to be assessed in the same critical fashion. That’s why having an automated risk assessment tool for assessing vendors is a way to ensure you’re minimizing unmanaged risk from both new and existing vendors.

 

Automating your TPRM process is one of the major steps towards having a mature TPRM department capable. Its benefits include:

 

  • Improved third party management flexibility
  • Standardized processes and thirdparty management
  • Metrics and reporting consistency
  • Improved data-driven decision making
  • Further structuring the TPRM organization
  • Increased third party responsibility
  • Increased overall risk assessment and mitigation

 

By automating the TPRM process, you’re creating a standardized structure that can be applied to all third parties, whether existing or onboarded.

 

You can automate your TPRM process by finding new technologies or tools that will automate the assessment and information gathering process for your third party vendors. This helps to ensure that you’re optimizing your resources and spending company time on what is most impactful.

 

2. Augment and Validate Self-Reported Questionnaires Through Independent Risk-Based Assessments
Third parties are often assessed through questionnaires, onsite assessments, or via penetration tests. Each has its own advantages and disadvantages. Onsite risk assessments and penetration tests are resource-intensive, requiring time, money, and staff in order to carry out the assessments. Because of the costs, these kinds of assessments cannot be used for all third parties, and should be reserved for the most risk-critical third parties.

 

That leaves questionnaires to fill the void for most of the other third parties. However, questionnaires are self-reported, which makes using a ‘trust, but verify’ approach to risk management difficult to accomplish.

 

In a 2016 Deloitte Study on Third Party Risk Management, 93.5% of respondents expressed moderate to low levels of confidence in their risk management and monitoring mechanisms. With numbers like that, it’s easy to see why TPRM programs need increased attention. Without a way to independently verify the security posture of your third parties, you can only rely on the word of your third parties who are, for obvious reasons, incentivized to report positively.

 

Organizations should find independent third parties that can provide risk-based assessments of their third parties to validate that the findings from questionnaires are a realistic portrait of the state of third party security.

 

There are a number of cyber security solutions that provide risk-first third party assessments. To find the right solution, you should research whether or not those solutions:

 

  • are accurately assessing third parties
  • can facilitate communication between you and third parties
  • are focusing on key cyber security areas that are indicative of a potential breach


3. Utilize Continuous Monitoring to Assess Third Parties Beyond Point-In-Time Assessments
The assessment methods mentioned in the previous section all have one glaring flaw in common – they assess third parties at a single point in time. Many times, the information gathered by security risk assessments is outdated by the time it falls into your hands. The speed at which hackers are developing new attacks and exploiting vulnerabilities is too fast for point-in-time assessments or annual reviews to provide any insight into the real security posture of a vendor.

 

A PWC Third Party Risk Management report on the finance industry noted that 58% of companies using ad hoc monitoring experienced a third party service disruption or data breach, compared to only 37% of those that regularly monitor their providers and partners. Without having a way to know the security posture of your third parties on-demand, you’re managing risk with a blindfold on for most of the year. By only having point-in-time information that is quickly outdated, your ability to react to new vulnerabilities, or worse, a potential third party cyber security incident, is negligible.

 

Through continuous monitoring, you’re bolstering the security of your third party by keeping them consistently accountable, which in turn, minimizes your overall risk to a potential security incident.

 

How to Get Started Revamping Your VRM
We covered how to implement continuous monitoring in your TPRM program in part 2 of our How to Revamp Your VRM Program article series. Start by establishing a central TPRM office if you don’t already have one, prioritize and identify your most risk-critical and business-critical vendors, and then define your third parties’ security controls and processes that you’ll monitor on an ongoing basis. If you have the resources, look for automated risk healthassessment tools and solutions that offer continuous monitoring for your third parties.

 

Conclusion
Updating your TPRM program doesn’t have to be a complete overhaul of your department. Instead, you should use a risk-first perspective to define the aspects that are the most criticalto update. The three we highlighted here will yield the most dramatic changes in a TPRM program, reducing your unmanaged risk, and reducing your reaction time should a security incident occur.

 

By automating aspects of your TPRM program, using independent third party assessments, and adopting continuous monitoring, you’re not far from having a mature TPRM program that can easily assess any new third party as it comes, keeping your organization safe.

Technical Dr. Inc.'s insight:
Contact Details :

inquiry@technicaldr.com or 877-910-0004
www.technicaldr.com

more...
No comment yet.