Organizations manage their risks by making changes to their processes and procedures. The science behind this, called operational risk management, measures the consequences of choices regarding how managers run their business, such as launching new products and hiring or firing staff members. Back in the day, this used to be called cost/benefit analysis, but operational risk management has since grown more sophisticated.
Measuring Operational Risks
The idea is to use more quantitative tools to evaluate how your operate your business. This enables you to measure outcomes and understand the inputs to your business processes, then assess the risks before you make any significant decisions. Measurable benefits include:
- Better, more effective and more reliable operations;
- Reduction in losses from damages, threats, illegal activities and exploits;
- Lower cost of compliance; and
- Reduction in future potential damages.
So what does this have to do with security professionals? Plenty. We face many of these decisions on a daily or even moment-by-moment basis, but we rarely quantify them or understand how to weigh these risks.
According to Tallyfy, “the more sophisticated the approach to risk management, the more chance the business has to thrive and grow.” The trick is to balance the benefits and costs of this sophistication.
Communicating Risks in ‘the Language of Money’
Many security professionals just dive right in at this point, failing to see the bigger picture and framing these risks in the wrong terms. Part of an operational assessment is being able to communicate the risks your organization has taken to the right stakeholders.
David Froud noted that “if you are a CSO/CISO and have reported to your board how many malware attacks your controls blocked, or how well your firewall is working, I’m surprised you still have a job.” Instead, he advised security leaders to talk in “the language of money.” For example, what is the cost of beefing up your firewall with some other defensive mechanism, and what will be the operational benefit? What is the organization risking by not having the right network protection measures in place?
Tallyfy broke down operational risk into three broad management levels: in-depth, deliberate and time-critical. Usually, security managers are more involved in the last level when responding to the latest breach or fire drill, but each level is important for understanding particular risks.
To classify what you are going to do operationally, identify the risk, figure out what you can do and measure how you mitigated it. The more you do to understand the risks involved and implement various monitors, the more effective you will be as a security professional.
Leading by Example to Improve Operational Risk Management
You’ll notice that up to this point I have spoken in generalities. That’s because if you don’t understand the context, you can’t really start doing any operational risk management. The next steps are easier.
First, you might consider leveraging training resources from the Risk Management Association to help you. Once you feel confident that you have the right framework, you can evaluate various operational risk management service providers.
That sounds like a lot of work, which is why security professionals often take shortcuts, ignore the consequences of their decisions and exhibit other behaviors that could result in a data breach. Operational risk management is crucial to any business, and security professionals must lead by example and resist the temptation to cut corners.
Read the interactive white paper: Making the most of your risk management solutions