It’s not an earth-shattering thing to say that news of hacks, data breaches, and other technology hiccups has grown exponentially in recent years. Between January and September 2019, 7.9 billion records were exposed, marking a 33% increase from the same period in 2018.
A few of last year’s data breaches include:
- An error in pharmacy giant Walgreens’ mobile app messaging feature exposed names, prescription numbers, shipping addresses, and other sensitive information. The number of impacted customers was not disclosed, but the app has over 10 million downloads.
- Personally identifiable information of over 280,000 current and former employees of General Electric was exposed following a data breach of a third-party vendor.
- Credentials of over 500,000 Zoom accounts, including email addresses, meeting room IDs, and passwords were found for sale on the “dark web” and hacker forums. (A good reason to use auto generated meeting room IDs and passwords and their waiting room feature!)
- And in May 2021, a ransomware attack on the Colonial Pipeline led to gas and jet fuel shortages across 17 states and the District of Columbia. Operations were restored a few days later when the pipeline company paid the requested ransom of 75 bitcoin or $4.4 million. This attack was the largest of its kind on oil infrastructure in American history.
Of course, this barely scratches the surface…
There’s no doubt that these and other hacks are serious, but many sensationalist headlines and opportunistic consultants spread alarm about technology risk, cybersecurity and so on, leading many companies to place too much emphasis on this particular issue.
Companies have several frameworks to choose from for helping them address technology risk, with the Risk Management Framework for Information Systems and Organizations from the National Institute of Standards and Technology (NIST) considered the most authoritative. Other examples include the Factor Analysis of Information Risk (FAIR) framework and the ISO 27005 standard.
While these standards do provide guidance on identifying, assessing, and managing technology risk, they each have one big shortcoming.
They fail to address business risks associated with technology…
Truly understanding and managing technology risk effectively requires a holistic approach focused on the business.
IT professionals should have a very good technical understanding of cyber and general technology risk. However, they typically only focus on the immediate impacts of data breaches like the number of records exposed and remediating the cause of the breach.
And as I discuss in a prior article, most organizations also mistakenly believe that since they have insurance for instances like this, they don’t need to do anything else.
This approach to technology risk can do more harm than good and can, in fact, be dangerous.
While having insurance can be helpful, it’s not going to cover all of the costs and impacts of a breach. Some non-insurable impacts that immediately come to mind include:
- The business can’t serve its customers, putting an immediate halt to revenue.
- Employees can’t access the company network and data, stopping work in its tracks.
- Strategic initiatives are forced to a standstill, potentially stopping new products, software implementations, or a pending merger or acquisition.
- Word spreads quickly via social media, whether from employees or customers, negatively impacting the company’s reputation.
But according to a recent book from Norman Marks, Making Business Sense of Technology Risk, it goes even farther.
As Norman and others say, simply “managing risks” is insufficient in today’s world…informed risks have to be taken in order for organizations to add value and remain relevant in a world that’s changing at lightning speed, or as Norman explains:
How should a board assess whether to invest in reducing risks related to technology, address other business risks, or putting that money towards new product development, increases in the sales staff, or a new marketing campaign?
Choices have to be made.
No organization (even Apple) has unlimited resources. Its leaders need to be able to understand technology risks within the context of running the business and achieving objectives.
In days long gone, it would be advisable for a company to wait until a particular technology risk was below a certain threshold. In today’s world, companies have to be willing, on business terms, to accept or take a risk, even it is higher than they would like.
Waiting to implement a new technology could mean lost ground to competitors and eventual displacement like what happened to Blackberry, Motorola, Kodak, Borders, and more.
So how can risk professionals help IT executives and staff better communicate technology risks and opportunities to decision-makers?
Simply saying a particular cyber or other technology risk is high is not helpful for decision-makers. In a 2016 survey published by Osterman Research for example, an astounding 85% of board members believe they are not getting helpful information from IT executives and staff and 59% say these same personnel will be let go from their jobs for not providing actionable information.
With that in mind, risk professionals have an important role to play in ensuring the link between technology risks and goals and objectives is understood by decision-makers. This will mean getting rid of the technical terms and talk the talk of the business.
Again, just saying a particular risk is high, medium, or low without any context doesn’t help executives understand its impact on objectives, much less develop any plans to address it.
By not breaking risks down through root cause analysis, scenario analysis, or quantitative tools like Monte Carlo simulation, it will be impossible to know if mitigations are appropriate or what actions to take, if any. Any information executives do receive will be confusing and overwhelming and therefore continue to feed the perception that ERM is not a helpful tool for building a strategic advantage.
In the end, actions can only be as specific as the risk you have identified.
Technology risks have been a growing concern for many years now and will continue to dominate headlines. Therefore, risk managers need to help their IT colleagues properly understand and communicate these risks (and the appropriate context) to decision-makers to ensure a proper balance is struck between risk mitigation and risk taking.
Does your company link technology risks to corporate goals and objectives or are they viewed strictly through the eyes of the IT experts?
As always, any additional insights from those of you with boots on the ground are very helpful to fellow colleagues. If you have anything you would like to share, please don’t hesitate to leave a comment below or join the conversation on LinkedIn.
And if your organization is struggling to understand how technology risks fit into the bigger picture of what you are trying to achieve, reach out to me to discuss your specific situation and needs today.
Featured image courtesy of Tima Miroshnichenko via Pexels.com