‘Business Continuity Manager’ software enters the market

LockPath, a provider of governance, risk and compliance (GRC) applications, has announced the launch of ‘Business Continuity Manager’.

The tool, part of Keylight 2.4, the latest version of the company’s GRC platform, enables organizations to manage business continuity in a simple and effective way, empowering them to create unified business continuity strategies.

Leveraging the flexibility of the Keylight platform, Business Continuity Manager lets businesses create custom business continuity plans, manage the associated risks and minimize potential losses.

Unlike traditional GRC tools, Business Continuity Manager provides common forms for business continuity right out of the box and lets customers use any standard web browser to quickly match Keylight to the company’s distinct business continuity processes and needs.

Key features of Business Continuity Manager include:

• Business impact analysis: Through detailed analysis, users can easily organize complex information, determine the impacts of a loss, and prioritize the recovery function of multiple business components.
• Business continuity plans: Users can leverage pre-built forms, workflows and notifications to quickly build a business continuity plan or create a fully customized plan down to individual fields, field types, field visibility and forms.
• Teams and contacts: The tool enables the appointment of a team leader, identification of a team of essential personnel, and definition of critical vendors so if a disaster occurs, users can immediately locate them and make contact.
• Tabletop exercises: To ensure a plan will be effective, Business Continuity Manager supports exercises to test a plan against a simulated situation and collect valuable information about its application.
• Assessments: Users can launch business continuity plan assessments or tabletop exercises and create reports to gather valuable insight about the plan and its execution.
• Workflow: Custom workflows allow a simplified review of plans and exercises by appropriate experts across the organization. Users can create a custom set of stages that the document will be routed through based on certain criteria.
• Document management: Users can easily export business continuity plan content with all supporting documents (Adobe PDF, Microsoft Word, Excel, PowerPoint or Visio files) into one comprehensive Adobe PDF document.
• Extensibility: Users can add lookup references to policies, controls and resources in other Keylight application records to enhance their organization’s ability to proactively prepare for and react to events.

Risk and Business Continuity - Managing for the unknown

Do you have the right team in place to face a future filled with Unknown Risks?

While the perilous unknown may be the stuff of sci-fi and doomsday movies, the potential for more mundane or fiscal danger is always around us.

This should not provoke paranoia but rather a healthy sense of vigilance as well as skepticism. Executives need to be vigilant about what could happen next. By all means consider pandemics, earthquakes and wars, but also be skeptical about their effects on their organisations.

For example, if financial executives had been more vigilant and skeptical prior to the fiscal meltdown of 2008 some businesses may not have found their institutions so over-leveraged.

Clearly, we say this from the moral high ground of Hindsight, which is always 20/20.

So what is a savvy executive to do? Three questions come to mind.

What is the worst that could happen to us?
This question prompts many scenarios from a natural disaster to a market crash, or even the entry of a significant new competitor who changes the balance in the market place. What happens then? Executives need to keep their antennae up and do their Risk Assessments and sound Business Continuity Planning.

How would we react?
Very often companies do have BC or disaster plans but are they robust and up to date? Do they stipulate what happens when resources are not available or executives and employees are separated from each other?

Do we have the right people in place to recover?
This is perhaps the most important question. Very often members of a leadership team are equipped to manage when the going is good, but what happens when the bad gets into fear and panic?

The senior leader must ask if these people have the right mindset to adapt to evolving and changing circumstances.

Flexibility becomes an imperative, but so too does resilience. You need leaders who can cope with setback and maintain the discipline to persevere.

Big questions provoke big picture thinking. Very often such questions will cause real unease, or at least a sense of disruption and that is healthy.

If a catastrophe strikes disruption will be significant. So what will you do to survive?

Project management lessons you can take from the Titanic disaster

One hundred years ago this month, RMS Titanic sank after striking an iceberg. More than fifteen hundred people died in that disaster.

The event has been the subject of books and movies, but it also provides a few stark illustrations regarding project management mistakes and oversights.

Here are seven lessons that relate to the sinking itself and three that involve the recovery of the victims.

1: You need to know what you’re measuring

The lack of lifeboats is a well-known matter, and it certainly played a role in the number of deaths. However, according to the regulations that applied at the time, the Titanic DID have “enough” lifeboats?

According to the standards in effect at the time, the WEIGHT of a ship, not the number of passengers, determined the number of required lifeboats. Needless to say, these standards changed as a result of the inquiries into the disaster.

This principle applies to your own projects. In his classic work The Mythical Man-Month, Frederick Brooks points out how far too often a project reaches the point of “coding 90% complete,” only to remain that way forever.

Brooks says, milestones should be objectively measurable. If you do not have valid measurements for your project, you will run into problems.

2: Assumptions will kill you

A few hours before the collision, wireless operator Jack Phillips received a message from a nearby ship, telling him of icebergs in the area.

However, Phillips at the time was taking care of messages to and from Titanic passengers and in doing so, was communicating with a lighthouse at Cape Race, Newfoundland.

Unhappy with what he considered a bothersome message, and assuming it was unimportant, Phillips replied brusquely, “Shut up, I am working Cape Race!”

As a result, Phillips never received the iceberg warning the ship was trying to send.

How often have you seen things blow up in your face because of assumptions? Maybe you assumed that a particular system was using a newer software release than it actually was.

Maybe you assumed that another department or someone else, would take care of ordering cable. Maybe you assumed that the vendor received our critical email message and didn't need you to call to check.

Assumptions are important in your work, but if you proceed on the basis of them, make sure everyone is clear about what assumptions you are making.

3: Distractions are dangerous

Of course, when we look back, we can always find fault with the actions of Titanic officers and crew.

Clearly, they must have known about the risks of traveling through “Iceberg Alley” so, they should have focused the wireless operators less on passenger messages and more on communication with other ships.

The Phillips incident, therefore, illustrates another hazard to project management: that of being distracted.

How often do you start your work with the best intentions of completing your to-do list, only to become sidetracked by chatting with co-workers or surfing the Web?

And you are not alone in facing distractions. If enough members of your team encounter enough distractions, your project will gradually wander of course and fall behind.

4: Little things add up

A number of small factors played a role in the Titanic disaster. Allegedly, the lookouts had no binoculars, because those binoculars had been left behind at Southampton, where she began her voyage.

Jack Phillips interrupted a ship trying to send him an iceberg warning and neglected to deliver an earlier warning.

While no one factor can be said to have “caused” the disaster, the effect of all of them made the disaster all the more likely.

Brooks asked rhetorically, “How does a software project get to be a year late? One day at a time.”

He explained that if a major event or problem occurs, a project team rallies and steps up its effort.

However, such a team can fail to appreciate the issues of small delays and how those small delays add up.

In other words, the small delays are just as critical as the large ones, meaning that adherence to milestones is critical to the success of a project.

5: Stakeholders should be kept informed

Following the iceberg collision, the nurse for the Allison family, in first class, took one-year-old Trevor Allison from the family stateroom without saying where she was going.

She and Trevor boarded a lifeboat and were rescued. However, because Trevor’s parents didn’t know about it, they spent the rest of the time looking for Trevor, turning down chances to escape in a lifeboat.

As a result, the parents and their other child, three-year-old Loraine, died when the ship sank.

Your own project might not be as critical as a sinking ship but your stakeholders need to know about the status and progress of your project. Keeping them informed will keep them happier.

6: Other people’s perspectives matter

One of the victims of Titanic was 23-year-old John Law Hume, a member of the band. A few weeks after the sinking, the company that managed the band sent a letter to his father, asking for payment for his son’s band uniform.

Even although such a request made financial sense from the company’s perspective, it almost certainly sounded insensitive to Mr. Hume.

In the same way, when explaining aspects of a project, especially by technical members of your project team, try to see things from the other person’s perspective.

If a client asks a question, try to see beyond the question itself to the motivation behind the question.

If a technical person is explaining a function of a system or program, make sure the explanation avoids jargon. Clear communication will lead to happier clients.

7: Moving targets can hurt you

The Titanic was one of three new ships the White Star Line had built, around that time. The company’s strategy was to emphasize luxury, not speed, as a selling point.

Yet during that maiden Titanic voyage, White Star chairman J. Bruce Ismay reportedly pressured Captain Edward Smith to increase speed.

This higher speed quite likely contributed to the collision, in preventing the ship and crew from reacting quickly enough.

In your projects, beware of “scope creep.” A typical customer, if there is such a thing, will say, “Can you make just this one small change please?”

The fact is, any change is rarely “small.” It typically involves making other changes to other parts of a system, results in greater complexity, and requires more testing.

Make sure that your customer knows that in a project world governed by quality, time, and budget, at least one will have to yield.

Be sure your customer understands the implications of a requested change, the need for change control and ensure that the customer’s expectations are appropriately set.

8: Traceability is essential

A few days after the sinking, rescue ships based in Halifax, Nova Scotia, set out to recover victims and to return them to Halifax.

As each victim was recovered, he or she was numbered accordingly. The recovery crew recorded information and a description of the victim in a ledger book and then bagged personal effects with that same victim number.

If that victim was later buried in Halifax, and 150 victims were buried in three cemeteries there, then that victim number was engraved on the grave marker.

The victim number allowed researchers and others to link victim and property descriptions, to the cemetery location.

The same kind of traceability is important in your projects. How familiar are you with the strategic objectives of your company?

Can you find a logical connection between the requirements of your project and those strategic objectives?

Of course, the connection might be a distant one, but there should be a connection nonetheless but if you can find no such connection, you start asking yourself whether that requirement really is part of your system.

9: Methodology is more important than technology

When the recovery crews were recording victim information, they used regular ledger notebooks and pens, obviously, no one had iPads, computers, or barcode scanners in those times.

Nonetheless, the methodology they used had solid reasoning behind it, so it proved highly effective.

In the same way, you might want to use sophisticated planning and tracking software and tools.

More important, though, is that your plan be resilient. The best software in the world will not save a poorly designed plan.

10: Documentation may have lasting benefits

The documentation of the recovery records are still kept in Halifax, at the Public Archives. Researchers in Halifax and from around the world still visit and review this documentation, one hundred years after the fact.

A few years ago researchers made use of these records, and DNA analysis to identify the “Unknown Child of the Titanic.”

No one enjoys documenting a project or system but it is a necessary part of it. Documentation is often the 'most' important part of the project because it will exist long after the project team has been disbanded.

Documentation probably won't need to exist for a hundred years, but it should still serve the purpose of helping your customers understand their system and allow them to build on what you have already accomplished.

Data Security not a Priority - The Information Risk Maturity Index

Data breaches will continue to expose European businesses to unnecessary risk and damage business reputations unless action is taken now to improve the management and protection of sensitive business information, says a new report by Iron Mountain and PwC.

The study highlights an urgent need for a change in employee behaviour and a cultural shift among senior executives if organizations are to overcome the complacency, negligence and lack of shared responsibility uncovered by the study.

PwC surveyed senior managers at 600 leading European businesses to compile the Information Risk Maturity Index.

The scores, assessed for France, Germany, Hungary, the Netherlands, Spain and the UK, suggest that many businesses are woefully unprepared to address and manage information risks such as data breaches, data loss and non-compliance.

The average score for European companies was 40.6 against an ideal score of 100.

The report, launched at Iron Mountain’s first European Information Risk Summit, reveals that:

• Only around half of mid-sized businesses consider the loss of sensitive information as one of their top three business risks.
• Less than a quarter (24 percent) of the companies surveyed were aware as to whether or not they had experienced a data breach in the last three years.
• A mere 1 percent of respondents consider information risk to be the responsibility of every employee, while nearly two thirds (60 percent) concede that they do not know whether their employees have the right tools to protect information.
• Only 13 percent consider information risk to be a boardroom issue, while around a third (35 percent) view all information risk – whether related to paper or digital information – as the responsibility of the IT department. This tendency to view information risk as an IT issue was found to be widespread, with 59 percent responding to a data breach by installing additional technology.
• Just a third (36 percent) of companies have assigned responsibility for information risk to a specific individual or team whose effectiveness is monitored.

Marc Duale, President of International at Iron Mountain, said the report was a wake-up call for European businesses: “It is time for businesses to move from a culture of information apathy and neglect to a culture of information responsibility. Fail to act and you expose your customers to serious information risk while potentially leaving your company open to the risk of irreparable reputational damage.”

Read the report (PDF)

PwC report identifies a ‘fundamental shift in risk management’

Economic turmoil, political upheavals and natural disasters, all combined with advancing globalization and rapid technology progress, are creating a new era of risk for businesses and causing a fundamental shift in risk management practices, according to a new PwC US 2012 annual report.

Entitled ‘Risk in Review’ the report is based on a survey of more than 1,000 executives and risk management leaders.

"2011 marked a year of reckoning, and many companies are still struggling to create an effective approach to managing the ever-widening risk landscape. Businesses are scrambling to fix weak links in their systems stemming from non-traditional risks such as social media and digital technology, to dealing with the realities of operating in today's global marketplace," said Dean Simone, leader of PwC's US Risk Assurance practice.

"In this new risk era, corporate boards and senior management have a crucial role to play to ensure they set the right culture and align their strategy to risk imperatives."

According to the report, forward-looking companies are responding by shifting their risk management focus in several fundamental ways: from internal to external, from operational to strategic and from bottom-up to top-down.

To better prepare themselves to deal with unexpected events for the upcoming year and beyond, companies installed new risk management organizational structures, have put in place a new breed of risk management leadership and have adopted innovative techniques such as scenario analysis and predictive indicators.

To address changing risk landscape, PwC recommends the following risk management approaches for 2012:

Increasing cross-communication: Place greater emphasis on communications and data sharing in 2012 and take steps to improve cross-functional and departmental communication.

Improving data quality and reporting: Enhance global economic teams to help improve data quality and put in place improved processes for reporting data. Different business units should meet periodically with different business units to review and exchange information and data as a form of early alert to possible upcoming risks to the business.

Better forecasting and scenario analysis: Leverage more sophisticated tools such as early-warning systems and contingency plans to reconfigure approaches to manage risk (i.e. set up scenario models or Monte Carlo analysis geared to the nuances of the business, run models as events unfold, etc.)

Elevating the chief risk officer (CRO): Put risk management role on the proactive offensive instead of reactive defense by giving CROs more cross-functional access and ability to effect decision-making.

Integrating risk management: Manage risk holistically by continuing to integrate risk management into decision-making processes relating to ‘traditional’ functions (i.e. strategic planning). Don't exclude new areas of risk (i.e. talent management and outsourcing), but address and integrate them into decision-making processes.

Bolstering IT: Address data privacy and security concerns and take stock of where to build better processes, practices, procedures and technical defenses. Shifting technology and heightened competition for new customers in new markets are also exposed to more risks, so it's imperative to study the setbacks and successes of peers who pioneered the use of these new technologies.

Greater board involvement: Understand the risks facing a company and have in-depth discussions with management to make sure those risks are being handled properly. The discussion should also cover potential risks that are not yet on management's radar and what the implications of those emerging risks might be.

To download a full copy of the report visit: http://www.pwc.com/riskinreview

Institute of Risk Management issues new guidance on risk appetite

The Institute of Risk Management (IRM) has published new guidance on the subject of risk appetite and tolerance aimed at helping organizations better understand the risks they take when pursuing their strategic objectives.

IRM's guidance document has been endorsed by the Chartered Institute of Internal Auditors, the Chartered Institute of Management Accountants, the Institute of Chartered Secretaries and Administrators, The Chartered Institute of Public Finance and Accountancy and Alarm, the public risk management association.

IRM Deputy Chairman Richard Anderson, the main author of the report, explained: "Risk appetite today is a core consideration in any enterprise risk management approach for organizations of all types, yet there is little widespread understanding about what it means and how it can be applied. In the light of the explicit requirement in the UK Corporate Governance Code for boards to understand the nature and the extent of the risks that they face, IRM decided to take the lead on drawing together some practical guidance on the subject, aimed at board members as well as risk professionals.

We are particularly pleased that other respected professional bodies are supporting our work - risk is everyone’s business and a common understanding and approach helps us work together to address this challenging area."

Anderson continued, "Our underpinning precept is that organizations can only progress by taking those risks that they need to embrace and managing down those that they wish to avoid.

Our recommended approach to risk appetite, based on the wide experience of our members and also benefitting from an extensive consultation exercise earlier this year, is intellectually rigorous as well as highly practical.

We think we have managed to outline a process which should be proportionate to an organization's risk management maturity, capability and culture and, most importantly, supported by appropriate data.

Nevertheless, we do not think that this is the last word on the subject in such a fast-moving environment and we are extremely interested in receiving feedback on this work."

The IRM paper Risk Appetite and Tolerance is available for free download at http://www.theirm.org/publications/risk_appetite.html

Managing cloud risks

Adopting cloud computing may save money, but how does it change risk? The cloud allows the procurement of IT services from both internal and external suppliers to be optimized because the services are delivered through the Internet in a standard way.

The cloud is not a single model, but covers a wide spectrum from applications shared between multiple tenants to virtual servers used by one customer and hosted internally.

The key benefit of a cloud approach is one of scale; the cloud provider can potentially offer a better service at a lower cost because the scale of their operation means they can afford the skilled people and state-of-the-art technology necessary to deliver a secure service.

In general, a large cloud provider is likely to provide a better and more secure IT service at a lower cost than a small to medium sized enterprise could provide itself.

While the public cloud offers applications shared by multiple customers, the private cloud provides applications and infrastructure that are dedicated to a particular organization.

It allows organizations to outsource the management of their IT infrastructure while retaining tighter control over the location and management of the resources.

The price to pay for this is that the costs are likely to be higher than for a public cloud because there is less potential for economy of scale, and resilience may be lower because of the limit on service resources available.

The information security risks associated with cloud computing depend on both the service model and the delivery model adopted. The specific risks depend on the organization and their individual requirements.

The common security concerns across this spectrum are ensuring the confidentiality, integrity and availability of the services and data delivered through the cloud environment.

The approach to managing risks from the perspective of the cloud service user is one of due diligence - ensuring that the requirements are clearly understood, the risks are assessed, the right questions are asked and the appropriate controls are included in the service level agreements.

The principal information security related issues that organizations adopting cloud computing need to address are summarized below. Because of the wide spectrum covered by the cloud, their priority will depend on the cloud model adopted and the individual circumstances:

- Ease of purchase: anyone can buy access using a credit card. Your organization may already be using a cloud service without a proper assessment of the risk.

- Service contracts: those offered by cloud providers are often ‘take it or leave it’ and may contain less onerous obligations on the provider than a normal SLA. Key issues include: who owns the data, and how difficult would it be for you to get it back?

- Compliance: identify the business requirements for compliance with laws and regulations and ensure that the cloud provider is able to answer how they will meet these needs.

- Service location: identify the legal issues that relate to the jurisdiction of the geographic location of the cloud provider, the service and the data, and ensure that service contracts address these issues.

- Data security: identify and classify the business data that is involved and specify the security requirements for this data in terms of confidentiality, integrity and availability.

- Availability: identify the service availability requirements and assure that the provider is capable of meeting these.

- Identity and access management: specify the business needs for identity management and access control and assure that it will be delivered securely.

- Insider abuse of privilege: confirm that the cloud service provider has processes and technology to properly control privileged access.

- Internet threats: determine the level of protection needed against Internet-based threats and ensure they the steps to be taken both by the cloud provider and internally are adequate.

- Monitor: Within the cloud service, meet the business and legal requirements of the client while separating the data relating to different clients.

Taking a good governance approach, such as COBIT, is the key to safely embracing the cloud and the benefits that it provides. COBIT provides guidance to:

- Identify the business requirements for the cloud-based solution. This seems obvious but many organizations are using the cloud without knowing it.

- Determine if the functionality is currently provided by an existing internal service. If so what are the options?

- Determine the governance needs based on the business requirements. Some applications will be more business critical than others.

- Develop scenarios to understand the security threats and weaknesses. Use these to determine the risk response in terms of requirements for controls and questions to be answered. Risk IT: Based on COBIT provides an ideal framework for this.

- Understand what the accreditations and audit reports offered by the cloud provider mean and actually cover.

Cloud computing can reduce costs by providing alternative models for the procurement and delivery of IT services.

Many organizations have already adopted an outsourcing approach to internal functions that are not core and this approach naturally extends to IT.

However, they need to consider the risks involved in a move to the cloud and good governance provides a way for this.

For more information, visit www.isaca.org/cloud for a free ISACA white paper.

What makes a great risk manager?

Active Risk, conducted a major survey of risk professionals in mid-2011.

Phase One analysis, based on over 250 completed responses from around the globe, has shown some surprising results and provides important advice for organizations implementing enterprise risk management programmes.

As demands placed on risk professionals increase and evolve, this new research has given an insight into the types of individuals organizations need in their risk team to produce the best chance of meeting corporate and project risk objectives.

The research also provided an understanding to the training and development required to grow and retain risk professionals; strategies to improve the effectiveness of communications between risk managers and other departments such as sales, finance, contracts and projects and the actions necessary to reduce stresses on the risk team.

Risk professionals completed an online psychometric survey based on the well-established DISC profiling methodology and received a confidential personalized profile report in return.

The cumulative results were used to identify the main personality types active in the profession. Three groups emerged.

The largest percentage (60 percent) represented ‘Technicians’ with the characteristics for accuracy and logical action traditionally associated with risk managers.

More surprisingly over 30 percent of those who responded to the survey emerged as ‘Evangelists’ who are optimistic and inspiring leaders.

This new breed of risk manager could prove instrumental when imbedding a corporate risk culture.

Finally, just under 10 percent of risk professionals who took part in the survey were ‘Drivers’ with determined personalities more usually associated with sales professionals.

To participate in the confidential survey and to download the Phase One summary report, go to www.activerisk.com/risksurvey

NIST: New Guidlines for Conducting Risk Assessments

Risk assessment is the topic of the newest special publication from the National Institute of Standards and Technology (NIST).

Guide for Conducting Risk Assessments (NIST Special Publication 800-30, Revision 1), an extensive update to its original 2002 publication, is the authoritative source of comprehensive risk assessment guidance for federal information systems, and is open for public comments through November 4.

Overall guidance on risk management for information systems is now covered in Managing Information Security Risk: Organization, Mission, and Information System View (NIST SP 800-39), issued last March.

The updated SP 800-30 now focuses exclusively on risk assessments, one of the four steps in information risk management.

Information risk assessments help organizations:

• Determine the most appropriate risk responses to ongoing cyber attacks or threats stemming from man-made or natural disasters;
• Guide investment strategies and decisions for the most effective cyber defenses to help protect organizational operations (including missions, functions, image and reputation), organizational assets, individuals, other organizations and the US nation; and
• Maintain ongoing situational awareness of the security state of an organization's information systems and the environments in which those systems operate.

The guidance in the revised publication has been significantly expanded to include more information on a variety of risk factors essential to determining information security risk, such as threat sources and events, vulnerabilities and predisposing conditions, impact, and likelihood of threat occurrence.

The publication describes a three-step process to help organizations prepare for risk assessments, successfully conduct risk assessments and keep assessment results up to date.

Guide for Conducting Risk Assessments also describes how to apply the risk assessment process at the three tiers of the risk management hierarchy outlined in Special Publication 800-39.

Sample templates, tables and assessment scales for common risk factors are provided for users to adapt to their own organizational risk assessments based on the purpose, scope, assumptions, and constraints of the assessments.

Guide for Conducting Risk Assessments (Special Publication 800-30, Revision 1) may be downloaded from here. Please send comments to sec-cert@nist.gov by Nov. 4.

Social engineering risks explored

Check Point has published the results of a new survey revealing that 42 percent of UK enterprises, and 48 percent internationally, have been victims of social engineering attacks, experiencing 25 or more such attacks in the past two years at a average cost of over £15,000 per incident.

The survey report, ‘The Risk of Social Engineering on Information Security’, shows the most common sources of social-engineering threats are phishing emails (47 percent) and social networking sites (39 percent).

The survey found that new employees (52 percent) and contractors (44 percent) were cited as the most susceptible to social engineering techniques, emphasising that hackers target staff that they suspect are the weakest security links in organisations, using social networking applications to gather personal and professional information on employees to mount spear phishing attacks.

According to the global survey of over 850 IT and security professionals, 86 percent of businesses recognise social engineering as a growing security concern.

A majority of respondents (51 percent) cited financial gain as the primary motivation of attacks, followed by competitive advantage and revenge.

The highest rate of attacks was reported by energy and utility organizations (61 percent) with non-profit organisations reported the lowest rate (24 percent), reinforcing gain as the key reason for attacks.

“Although the survey shows that nearly half of enterprises know they have experienced social engineering attacks, 41 percent said they were unsure whether they had been targeted or not.

Because these types of attacks are intended to stay below an organization’s security radar, the actual number of organisations that have been attacked could be much higher. Yet 44 percent of UK companies surveyed are not currently doing anything to educate their employees about the risks, which is higher than the global average,” said Terry Greer-King, UK managing director for Check Point.

Further findings from the survey report are:

• The threat of social engineering is real – 86 percent of IT and security professionals (80 percent in the UK) are aware or highly aware of the risks associated with social engineering. Approximately 48 percent of enterprises globally (42 percent in the UK) surveyed admitted they have been victims of social engineering more than 25 times in the last two years.
• Social engineering attacks are costly – Survey participants estimated each security incident costing anywhere between $25,000 and over $100,000, including costs associated with business disruptions, customer outlays, revenue loss and brand damage. 36 percent of UK respondents cited an average incident cost of over $25,000 (£15,000).
• Lack of proactive training to prevent social engineering attacks – 34 percent of businesses do not have any employee training or security policies in place to prevent social engineering techniques (4 percent in the UK).
• Financial Gains are the primary motivation of social engineering - Financial gain was cited as the most frequent reason for social engineered attacks, followed by access to proprietary information (46 percent), competitive advantage (40 percent) and revenge (14 percent).

While social engineering techniques rely on taking advantage of a person’s vulnerability, the prevalence of Web 2.0 and mobile computing has also made it easier to obtain information about individuals and has created new entry points to execute social engineering attacks.

Greer-King added: “An organization’s employees are a critical part of the security process as they can be misled by criminals, or make errors that lead to malware infections or unintentional data loss. Many organizations do not pay enough attention to the involvement of users, when, in fact, employees should be the first line of defence. A good way to raise security awareness among users is to involve them in the security process and empower them to prevent and remediate security incidents in real time.”

Read the report (PDF).

Our security paradigm is out of date

At a recent Cloud Security event, the president of the UK & Ireland chapter of the Cloud Security Alliance (CSA UK & Ireland) said that the perception of security as a concept is out-dated.

According to Des Ward, the current focus on complying with the myriad of assurance frameworks is taking focus away from the obligations placed on organizations to identify and manage the risks to their information assets; which, in turn, places an inordinate and inappropriate burden on external service providers to satisfy the concerns of organizations with no common terms of reference.

“The discussion following my presentation was very interesting as it highlighted that, whilst security in the cloud services environment is clearly a concern for many IT security professionals, there is still a lack of assurance within the external supply chain as whole,” said Des Ward, President, CSA UK & Ireland.

“What this tells me is that, whilst the message on security is getting through to businesses, there is no consistent language to determine whether the service provider will operate the controls to a level that assures the client that their risks are managed appropriately.

This proves to me that the current security mindset is little more than managing risks to achieving compliance rather than empowering organizations to understand the controls required to manage the risks to their information.”

“It is important”, says Ward, “to understand that all organizations in the UK and Ireland, on both sides of the public/private sector divide, have an explicit obligation under law to ensure that personal and corporate information is managed in a safe manner.

“The current compliance overload over the past four or five years has led to an inordinate focus on managing risks to compliance rather than understanding the risks to information – and this focus has meant that we look to overuse of technical controls to show due diligence to ensure that when a breach occurs, that penalties will not be levied; it is not designed to reduce the likelihood of breaches themselves,” he adds.

“This approach is, in my humble opinion, unsustainable, as it does not look to the implementation of the controls and fails to address the business risk management issue that exists in most organizations.

This is turn has no more benefit to the business than placing money in the shredder.” he explained.

“A classic case of these issues”, he says, “was the ICO's recent engagement with Lush after the cosmetics retailer suffered a payment card breach; although the outcome was favourable for all concerned, the key lesson to be learnt is that the current compliance boundaries can now be crossed by another interested party.

What stops the ICO from looking beyond the compliance scope of PCI and entering its own jurisdiction which is the entire business?

“The current lack of corporate information governance in today's businesses will soon result in increased penalties and I feel that this case will be a tipping point; despite the clamour for more prescription from assurance frameworks, my own experience is that many implementations of the PCI DSS are tightly scoped and shows there is little appetite for additional level of prescription that comes with little more benefit than a licence to undertake business on the internet.

This proves to me that the current focus on compliance risk management as we know it is nearing an end, and something else is required to assist organizations to understand and manage the risks to their information going forward.”

The Financial Turmoil and Business Continuity

‘Eurozone at tipping point’, ‘Greece may be forced to default’, ‘Is the euro doomed?’ The headlines alone make you want to pull the covers over your head.

The Governor of the Bank of England, Mervyn King, tells the BBC: “This is the most serious financial crisis at least since the 1930s, if not ever.”

He then went on to call for a calm reaction to the crisis; which led to a few wry smiles!

If the financial crisis does get appreciably worse or, heaven forbid, the euro were to fail, what does this mean for business continuity professionals? Because, call the eurozone meltdown what you like, it’s certainly a crisis: and crisis is what we do isn’t it?

Contingency planning makes us all gaze into a crystal ball from time to time in an attempt to predict what might happen so we can plan accordingly and provide contingencies. But inevitably: ‘All plans imply an attempt to impose the values of the past...on the future.’

So it doesn’t mean we always get it right. But if the world’s economy or ‘just’ the eurozone does take a serious dive then at some point organizations are going to look to us to help get them out of this mess.

So what can we, as business continuity professionals, do to help: and how can our specialist knowledge be leveraged to help those trying to overcome the financial crisis?

We have a responsibility to understand as much as we can about the financial situation, but clearly it’s not our job to solve it.

For that there are leaders and governments; though some might argue it is just such people and institutions that got us into the crisis and of course within companies, particularly banks, there are experts assigned to investments, governance, auditing and PR who are trying to mitigate risk.

We stray into those fields at our peril. But what about the aftermath of a crisis? Many predict that inflation will go through the roof and this could spark further looting or civil unrest on the streets.

There could also be lengthy utility failures, fuel shortages, disruption to public transport and pressure on supply chains.

Perhaps staff won’t be able to travel to work or prefer to stay at home to look after their families. The fallout from these kinds of problems has our name written all over them.

The job of the business continuity professional is to identify risks and impacts to critical processes.

For each critical process we have to identify ways of providing a structure that enables these processes to be performed during or in the wake of a crisis.

Once the resources needed to perform these actions are identified this can form the basis of a plan, which can then be tested to see whether core critical processes really can continue to operate in extreme circumstances; and it doesn’t get more extreme than the uncharted territory that we would enter should the European banking system or the euro fail.

Unravelling a financial crisis may be way outside our skill set, but our business as usual is business as unusual and crisis our stock in trade.

Perhaps it’s a good time to review business continuity plans in the light of the societal impacts that could occur.

The Human Brain has difficulty calculating RISK!

The human brain struggles with comprehending risk. We find it difficult to translate the mathematical fact of probability into an accurate assessment of danger. This can be especially true in medicine, where emotion frequently clouds rational thinking.

In one study, Gigerenzer and his colleagues asked doctors in Germany and the United States to estimate the probability that a woman with a positive mammogram actually has breast cancer, even though she’s in a low-risk group: 40 to 50 years old, with no symptoms or family history of breast cancer. To make the question specific, the doctors were told to assume the following statistics couched in terms of percentages and probabilities about the prevalence of breast cancer among women in this cohort, and also about the mammogram’s sensitivity and rate of false positives:

The probability that one of these women has breast cancer is 0.8 percent. If a woman has breast cancer, the probability is 90 percent that she will have a positive mammogram. If a woman does not have breast cancer, the probability is 7 percent that she will still have a positive mammogram. Imagine a woman who has a positive mammogram. What is the probability that she actually has breast cancer?

The trick is to think in terms of “natural frequencies” — simple counts of events — rather than the more abstract notions of percentages, odds, or probabilities. As soon as you make this mental shift, the fog lifts.

This is the central lesson of “Calculated Risks,” a fascinating book by Gerd Gigerenzer, a cognitive psychologist at the Max Planck Institute for Human Development in Berlin.

In a series of studies about medical and legal issues ranging from AIDS counseling to the interpretation of DNA fingerprinting, Gigerenzer explores how people miscalculate risk and uncertainty. But rather than scold or bemoan human frailty, he tells us how to do better — how to avoid “clouded thinking” by recasting conditional probability problems in terms of natural frequencies.

The correct answer is roughly 9 percent.

How can it be so low? Gigerenzer’s point is that the analysis becomes almost transparent if we translate the original information from percentages and probabilities into natural frequencies:

Eight out of every 1,000 women have breast cancer. Of these 8 women with breast cancer, 7 will have a positive mammogram. Of the remaining 992 women who don’t have breast cancer, some 70 will still have a positive mammogram.

Imagine a sample of women who have positive mammograms in screening. How many of these women actually have breast cancer?

Since a total of 7 + 70 = 77 women have positive mammograms, and only 7 of them truly have breast cancer, the probability of having breast cancer given a positive mammogram is 7 out of 77, which is 1 in 11, or about 9 percent.

Notice two simplifications in the calculation above. First, we rounded off decimals to whole numbers.

That happened in a few places, like when we said, “Of these 8 women with breast cancer, 7 will have a positive mammogram.”

Really we should have said 90 percent of 8 women, or 7.2 women, will have a positive mammogram. So we sacrificed a little precision for a lot of clarity.

Second, we assumed that everything happens exactly as frequently as its probability suggests. For instance, since the probability of breast cancer is 0.8 percent, exactly 8 women out of 1,000 in our hypothetical sample were assumed to have it. In reality, this wouldn’t necessarily be true.

Things don’t have to follow their probabilities; a coin flipped 1,000 times doesn’t always come up heads 500 times. But pretending that it does gives the right answer in problems like this.

Although reformulating the data in terms of natural frequencies is a huge help, conditional probability problems can still be perplexing for other reasons. It’s easy to ask the wrong question, or to calculate a probability that’s correct but misleading.

Enterprise Risk Management gaining ground

The seventh edition of Deloitte’s ‘Navigating in a changed world,’ surveyed chief risk officers from 131 financial institutions around the world, with aggregate assets of more than $17 trillion and representing a range of financial services sectors including banks, insurers and asset managers.

Major findings from the survey included:

* While the majority considered their institution to be either extremely or very effective in Risk Management overall, one-third (33%) of survey participants graded themselves below that level.

* Not only is the Chief Risk Officer (CRO) role more prevalent at financial institutions, but he or she is reporting to higher levels in the organisation. According to the survey, 86% of institutions had a CRO in place, up from 73% in 2008, and reports to the board level or to the CEO (or both) at 85% of institutions. In addition, they are playing a more strategic role.

* More institutions have adopted Enterprise Risk Management (ERM) programs: 79% of institutions reported having a program or equivalent in place or in progress, an increase from 59% in 2008.

* While the value of ERM has increased, so have the challenges of implementing the information and technology infrastructures to support a comprehensive program; the importance of information and technology management in effective risk management has only been emphasised by the events of the global financial crisis.

* The top-rated Risk Management technology challenge among those surveyed was integrating risk data across the organisation, which was rated as an extremely or very significant issue by 74% of executives.

Deloitte’s study also indicates that financial institutions may need their Risk Management programs to have greater flexibility to adapt to new business models and changing regulatory requirements.

“During the last few years, Risk Management assumptions and methods have been challenged as never before, and will be facing even more rigorous requirements in the future,” said Hida. “Regulators have numerous risk-focused efforts on the horizon including Basel III, systemic risk initiatives and various implementation efforts related to Dodd-Frank Act.

As a result, many institutions have been strengthening their Risk Management governance models, and there is likely to be a continued focus on enhancing Risk Management data and analytics capabilities. This is a very busy time for Risk Managers at financial institutions.”

The report can be found online at www.deloitte.com/fsiglobalrisksurvey

NIST Publication on Information Security - March 2011

The US National Institute of Standards and Technology (NIST) has published the final version of a special publication that can help organisations to more effectively integrate information security risk planning into their mission-critical functions and overall goals.

‘Managing Information Security Risk: Organization, Mission, and Information System View’ (NIST Special Publication 800-39) provides the groundwork for a three-tiered, risk-management approach that "fundamentally changes how we manage information security risk," according to Ron Ross, NIST Fellow and one of the principal authors of the publication.

For decades, organisations have managed risk at the information system level that resulted in a very narrow perspective that constrained risk-based decisions by senior management, Ross explains.

SP 800-39 calls for a holistic approach in which senior leaders determine what needs to be protected based on the organization's core missions and business functions. 

For example, managers of a power plant tied to the distribution grid need to ensure that its computer security keeps hackers from interfering with the plant's power generation or getting into the power grid to wreak greater havoc.

The publication is the fourth in the series of risk management and information security guidelines being developed by the Joint Task Force Transformation Initiative, a joint partnership among the Department of Defense, Intelligence Community, NIST and the Committee on National Security Systems.

SP 800-39 can be downloaded from here (PDF) or by clicking on the picture.

Risk Management in Tough Times

Risk management and governance policies and structures are being provided increasing authority, visibility and independence. However, this is within a planned increases in investment and spending that is more than modest and may even experience shrinkage.

The reality is that the natural tension and conflict between the risk functions and the business’ aspirations for higher profit growth still exists. The real conflict is in how some balance and compromise can be achieved?

Key findings in the current environments, are:

* Strategic risk management is currently in an embryonic stage of maturity. Executives view the identification of new and emerging risks as a key objective of risk management, but roughly two-thirds of them believe their organisation is weak at anticipating and measuring future risks.
* Few organisations truly involve risk functions in key business decisions. Few companies expect risk functions to participate in strategic decision making in the near future. It tends to be a garnish on the side.
* Risk management needs to shift its role and emphasis from preventative activities towards a more proactive and supportive one. Risk managers need to expand far beyond providing supervisory, policing controls and monitoring to also include identifying opportunities to achieve and enable business objectives.

Window of Opportunity

Will increasing interest in including the risk function in strategy formulation simply a passing trend or temporary phase?

Hopefully, the interest will be permanent, but not without difficulties, and there are real obstacles.
1) Business line managers may continue to view the risk function as inertia and a brake on their 'innovative' activities, slowing sales and profit growth.

2) Technical knowledge and experience by boards of directors and executives is simply not adequate to fully understand how to integrate risk and performance management into strategic growth.

On a positive note, risk management is gaining influence and using more structured modeling and analytics software. Some better informed managers are creating a richer organisational culture for metrics and risk awareness that considers opportunities, not just threats.

Invulnerable Today, Rudderless Tomorrow

Half of the 25 companies that passed the rigorous tests listed in the once-famous book by Tom Peters and Robert Waterman, “In Search of Excellence,” today either no longer exist, or are in bankruptcy.

What happened? Well, when an organisation and it's executives start to achieve results or becomes successful, they become more stability orientated and adverse to risk taking. Forgetting that maintaining their risk appetite /profile and taking calculated risks, is essential for organisations to change and continue be innovative.

Cloud-based Risk Management

Business Stream, the business division of Scottish Water, is to implement a Cloud-based risk management platform which aims to streamline and unify its Risk and Controls activities.

It’s claimed the software, Risk Manager from Xactium, will encourage a “collaborative approach to risk management through its organisation-wide visibility and remote accessibility”.

There are hopes the implementation at Business Stream, which provides water and waste services to over 96,000 businesses and the public sector in Scotland, will also promote better risk culture across the organisation, together with improvements to business efficiency, and “demonstrate Business Stream’s risk management commitment to customers and industry regulators”.

Risk Manager is built on Force.com, the Cloud application platform from Cloud Computing vendor, Salesforce.com.

Paula Louchart, IT solutions manager at Business Stream, said “Xactium’s Risk Manager stood out for us because of the speed and ease of implementation.

We were already familiar with Salesforce, so we know that the platform offers impressive business advantages, such as better visibility and effortless reporting”.

“We are delighted that we have been able to provide Business Stream with a risk solution that matches their forward-thinking ethos,” added Andy Evans, managing director of Xactium.

“It is a very positive sign for us that businesses are now recognising the value of cloud-based risk management. The flexibility and customizability it offers hasn’t been available with traditional systems.”

Wharton Professor Jeremy Siegel: Stocks, the US Economy and the Mid-Term Elections

The political landscape in Washington and around the country shifted considerably as a result of the midterm elections, with Republicans taking control of the House, gaining ground in the Senate and claiming several high-profile state offices against incumbent Democrats.

What are the elections' implications for the economy and the stock market, health care reform, the Obama administration's leadership strategy and the future of both parties going forward?

Knowledge@Wharton spoke with Wharton finance professor Jeremy Siegel, insurance and risk management professor Kent Smetters about these and other issues.

Enterprise Reinvention: How to Improve Corporate Performance through Enterprise Risk Management

Where companies have historically been able to improve results through specialization, successful reinvention requires a much greater emphasis on unification and facilitation—moving from managing the parts to leading the whole. This requires a different approach:

• Start with Your Customer
Every company's enterprise view and strategy needs to start with customers. Most executives agree with this tenet philosophically, but few enterprise reinvention and enterprise risk management programs follow this in practice. This requires that executives clearly establish, articulate, and integrate: where your company intends to go and why.

• Be holistic and systematic
Another principle to incorporate is to be both holistic and systematic. Without a shared enterprise view to guide companies in continually changing environments, companies often get stuck by focusing on the parts instead of the whole.

When competitive and organisational situations change, executives get caught working on the wrong things—on areas that used to be important but are no longer the bottlenecks.

• Don't Forget Your Community
A third insight—important for sustainable enterprise reinvention and effective risk management—is to systematically manage social roles. Companies are the only true economic engines for society, and strong communities are the only source of sustainable profits. When companies don't formally integrate into their communities and—instead—view themselves as separate entities, enterprise risk profiles will inevitably increase.

Integrating Enterprise Reinvention and Enterprise Risk Management
Enterprise risk management is an important tool for sustainable competitive advantage. Similar to the market and the enterprise itself, a successful enterprise risk management program requires holistic and systematic processes to support the following:

• Envision: An Enterprise strategy linked to customer needs, with defined operational implications, and well-articulated enterprise guidelines for managing risks and opportunities.
  
• Design: Formal risk mitigation and opportunity sensitivity analysis/monitoring/reporting.
  
• Build: Enterprise-wide controls, processes and infrastructure.
  
• Operate: Well-established personal roles and motivations for people to act in the best interests of their companies—at the enterprise level—through proper incentive structures.

For companies to successfully reinvent themselves, the enterprises can't be viewed as the sum of their parts. The enterprise overall is the goose that lays the golden eggs. Similar to a brand, it needs to be holistic, integrated and relevant—and continuously adapt through successful and accelerated enterprise projects.

Improvements

To improve your company, try taking your enterprise reinvention and enterprise risk management program to the next level. Integrate "Envision-Design-Build-Operate," to achieve your objectives through a shared enterprise framework, integrated roles and responsibilities, and adaptive monitoring/sensitivity analyses.

Holistic approach

Then, holistically address risks through independent program assessments to diagnose and correct identified weaknesses and take full advantage of new opportunities.

Given our rapidly changing and hyper-competitive business environment, there has never been a better time to reinvent your enterprise and your enterprise risk management program.

Clearly, this will require a different approach than the scientific management methods that worked so well in the old Industrial Age.

The new knowledge-based approach is at the heart of systematic and sustainable enterprise reinvention. The best time to start your reinvention is today.

Thinking Cautiously about Risk Appetite

How does the current trend for Caution in Risk Management affect business potential?

Because well-considered risk taking is critical to business growth and success, not just for individual companies but also to enable or entitle the expansion of a properly functioning economy.

Food for Thought

Business-to-business lending and borrowing always involves a high degree of risk. Therefore, curtailing that appetite for risk can directly hobble entrepreneurship, deprive deserving businesses of capital, and reinforce deflation.

Take a Positive Stance

Moreover, for any business, the assessment of risk should not dwell on the potentially damaging prospects but also on the opportunities; potential rewards and gains. If you take an overly cautious stance this is more difficult to do or can create a restrictive position.

Although the need for risk taking is recognised by both businesspeople and economists, a lot of this is based on theoretical lip service and rhetoric, rather than real positive and optimistic determinations and outlooks.

Complexity

The complexity of risks in the global economy severely tests many companies, both in their judgment about how much risk to take and in their controls for tracking and managing it. What doesn’t help the situation in any way are sponsors and senior management teams who are not comfortable or practiced at discussing risk in the context of strategic decision making or in articulating those expectations to the organisation.

Positive Solution
To overcome the problem of over cautious risk taking, sponsors, senior managers and companies needs a fresh, more rigorous definition of the appropriate level of risk the organisation can accept or endure. The organisation needs to stress its structure, confirm its strengths and articulate its risk appetite.

Set the Appetite

In addition to asking how much risk to avoid and how much to accept, we need to prepare for the possible downside. Leaders should be setting a better example, by defining how much risk they want and establishing how much capital they are willing to stake against it.

Result Focus

Clearly this is only part of the algorithm, because the result of all this effort is to achieve as much potential and capital gain. The whole organisation should be involved and open to this discussion on risk appetite.

Trading on the edge

Traders and deal makers are at the sharp end of it. They, of all people need to fully understand the risk appetite of the company and the part that their individual deals might have in the corporate-wide performance, because they are the ones that have to implement it effectively.

Unshackle and empower your people, by giving them a clear framework, an appetite for risk and a plan for success.