The Security vs risk management debate. Cyber security is not about nuts, bolts and widgets, its fundamentally about managing risk.

← Back to Blog

The Security vs risk management debate. Cyber security is not about nuts, bolts and widgets, its fundamentally about managing risk. The risk to financial statements, which cyber attacks clearly demonstrate. The reason cyber security fails to land at the board table is that board and security professionals don’t speak the same language; a language of risk management and fiscal control.

Security professionals often get asked, can you show me the ROI of cyber security and it is a very difficult question to answer. I used to get asked a similar question about quality management, as an engineer. Until quality management was able to to demonstrate results improving productivity, efficiency, reducing cost and improving competitive advantage.

We’re in a similar situation with security, big spend and a difficulty in defining tangible outcomes for the board. The asymmetric, enterprise wide nature of security risk makes it hard to quantify and that’s a real problem. But the non-security risks are mounting, regulatory risk, legal risk, operational risk, geopolitical risk and financial risk.

So will security and risk management converge. Yes it will, it has to. The impact of cyber attacks are rising by any measure of fiscal oversight.

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6635451836893581312