December 13, 2017 By David Strom 2 min read

Organizations manage their risks by making changes to their processes and procedures. The science behind this, called operational risk management, measures the consequences of choices regarding how managers run their business, such as launching new products and hiring or firing staff members. Back in the day, this used to be called cost/benefit analysis, but operational risk management has since grown more sophisticated.

Measuring Operational Risks

The idea is to use more quantitative tools to evaluate how your operate your business. This enables you to measure outcomes and understand the inputs to your business processes, then assess the risks before you make any significant decisions. Measurable benefits include:

  • Better, more effective and more reliable operations;
  • Reduction in losses from damages, threats, illegal activities and exploits;
  • Lower cost of compliance; and
  • Reduction in future potential damages.

So what does this have to do with security professionals? Plenty. We face many of these decisions on a daily or even moment-by-moment basis, but we rarely quantify them or understand how to weigh these risks.

According to Tallyfy, “the more sophisticated the approach to risk management, the more chance the business has to thrive and grow.” The trick is to balance the benefits and costs of this sophistication.

Communicating Risks in ‘the Language of Money’

Many security professionals just dive right in at this point, failing to see the bigger picture and framing these risks in the wrong terms. Part of an operational assessment is being able to communicate the risks your organization has taken to the right stakeholders.

David Froud noted that “if you are a CSO/CISO and have reported to your board how many malware attacks your controls blocked, or how well your firewall is working, I’m surprised you still have a job.” Instead, he advised security leaders to talk in “the language of money.” For example, what is the cost of beefing up your firewall with some other defensive mechanism, and what will be the operational benefit? What is the organization risking by not having the right network protection measures in place?

Tallyfy broke down operational risk into three broad management levels: in-depth, deliberate and time-critical. Usually, security managers are more involved in the last level when responding to the latest breach or fire drill, but each level is important for understanding particular risks.

To classify what you are going to do operationally, identify the risk, figure out what you can do and measure how you mitigated it. The more you do to understand the risks involved and implement various monitors, the more effective you will be as a security professional.

Leading by Example to Improve Operational Risk Management

You’ll notice that up to this point I have spoken in generalities. That’s because if you don’t understand the context, you can’t really start doing any operational risk management. The next steps are easier.

First, you might consider leveraging training resources from the Risk Management Association to help you. Once you feel confident that you have the right framework, you can evaluate various operational risk management service providers.

That sounds like a lot of work, which is why security professionals often take shortcuts, ignore the consequences of their decisions and exhibit other behaviors that could result in a data breach. Operational risk management is crucial to any business, and security professionals must lead by example and resist the temptation to cut corners.

Read the interactive white paper: Making the most of your risk management solutions

More from Risk Management

New Fakext malware targets Latin American banks

6 min read - This article was made possible thanks to contributions from Itzhak Chimino, Michael Gal and Liran Tiebloom. Browser extensions have become integral to our online experience. From productivity tools to entertainment add-ons, these small software modules offer customized features to suit individual preferences. Unfortunately, extensions can prove useful to malicious actors as well. Capitalizing on the favorable characteristics of an add-on, an attacker can leverage attributes like persistence, seamless installation, elevated privileges and unencrypted data exposure to distribute and operate banking…

Why federal agencies need a mission-centered cyber response

4 min read - Cybersecurity continues to be a top focus for government agencies with new cybersecurity requirements. Threats in recent years have crossed from the digital world to the physical and even involved critical infrastructure, such as the cyberattack on SolarWinds and the Colonial Pipeline ransomware attack. According to the IBM Cost of a Data Breach 2023 Report, a breach in the public sector, which includes government agencies, is up to $2.6 million from $2.07 million in 2022. Government agencies need to move…

Back to basics: Better security in the AI era

4 min read - The rise of artificial intelligence (AI), large language models (LLM) and IoT solutions has created a new security landscape. From generative AI tools that can be taught to create malicious code to the exploitation of connected devices as a way for attackers to move laterally across networks, enterprise IT teams find themselves constantly running to catch up. According to the Google Cloud Cybersecurity Forecast 2024 report, companies should anticipate a surge in attacks powered by generative AI tools and LLMs…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today