September 27, 2022 By Ray Stanton 2 min read

The average cost of a data breach hit a record high of $4.35 million, a 13% increase in the last two years, according to the 2022 Cost of a Data Breach report. In addition, laws are holding board members personally liable for IT security breaches and ineffective security controls, so it’s easy to see why cybersecurity risk and compliance have become priorities in the boardroom.

CIOs and CISOs are spending heavily on cybersecurity services and technologies. Research firm Statista forecasts revenue in the cybersecurity market will reach nearly $160 billion in 2022 with a compounded annual growth rate (CAGR) of 13%. The result? By 2027 the market size will reach just shy of $300 billion.

An effective cybersecurity strategy becomes even more critical because the nature of cyber risk is continually changing. So what do we do?

Working with our clients around the world, we have learned three keys to an effective enterprise IT risk management (ITRM) strategy.

Power of automation

It can be incredibly difficult to clearly demonstrate your enterprise’s cybersecurity health and hygiene in a way that aligns with strategic and operational goals when you lack automation and the necessary staff. IT organizations cannot find, hire or afford the people they need to run their cybersecurity operations and systems.

They need tools that automate cybersecurity workflows, monitoring, data collection and analysis, testing, auditing, documentation and reporting. Effective automation reduces system compliance time, the time to generate regulatory documentation and the time to research new vulnerabilities — while alleviating audit fatigue.

Built for enterprise scale

The number of devices in an enterprise IT platform continues to grow with the interconnections between devices increasing exponentially. Software-as-a-Service (SaaS) applications in your portfolio make your IT supply chain dependent on things you cannot see or control. ITRM software platforms need to support millions of interconnected IT assets, connections and SaaS controls.

Leveraging hybrid cloud

Businesses and governments are being transformed by the cloud, making security challenges increasingly complex. The good news is that the leading cloud platforms are investing heavily in cybersecurity. The challenge is leveraging those investments as part of enterprise cybersecurity controls.

Technologies are available that allow risk managers and cybersecurity professionals to inherit security controls from the major cloud providers and integrate them with enterprise systems. In addition, application programming interfaces can be used to support specialized cloud services and legacy applications.

Bringing it all together

IBM Security recently launched a new integrated software and services solution called Active Governance Services (AGS), based on the industry-leading ITRM software platform from Telos called Xacta.

Xacta created the category of ITRM software 20 years ago and has been continually enhancing the platform to support complex enterprise IT environments with hybrid cloud, automated workflows, global best practices and compliance frameworks, and continuous monitoring and reporting.

AGS provides the strategy, people, processes and technology to identify, manage and mitigate the rapidly growing and ever-changing cyber risks faced by business and government organizations.

Learn more about this partnership in the joint webinar,  “The True Cost of Compliance and Why You Can’t Avoid It.”

More from Risk Management

Working in the security clearance world: How security clearances impact jobs

2 min read - We recently published an article about the importance of security clearances for roles across various sectors, particularly those associated with national security and defense.But obtaining a clearance is only part of the journey. Maintaining and potentially expanding your clearance over time requires continued diligence and adherence to stringent guidelines.This brief explainer discusses the duration of security clearances, the recurring processes involved in maintaining them and possibilities for expansion, as well as the economic benefits of these credentialed positions.Duration of security…

Remote access risks on the rise with CVE-2024-1708 and CVE-2024-1709

4 min read - On February 19, ConnectWise reported two vulnerabilities in its ScreenConnect product, CVE-2024-1708 and 1709. The first is an authentication bypass vulnerability, and the second is a path traversal vulnerability. Both made it possible for attackers to bypass authentication processes and execute remote code.While ConnectWise initially reported that the vulnerabilities had proof-of-concept but hadn’t been spotted in the wild, reports from customers quickly made it clear that hackers were actively exploring both flaws. As a result, the company created patches for…

Researchers develop malicious AI ‘worm’ targeting generative AI systems

2 min read - Researchers have created a new, never-seen-before kind of malware they call the "Morris II" worm, which uses popular AI services to spread itself, infect new systems and steal data. The name references the original Morris computer worm that wreaked havoc on the internet in 1988.The worm demonstrates the potential dangers of AI security threats and creates a new urgency around securing AI models.New worm utilizes adversarial self-replicating promptThe researchers from Cornell Tech, the Israel Institute of Technology and Intuit, used what’s…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today