Risk management needs young blood as threats evolve

Can you tell us a little about how you came to be in your current position? I studied informatics at university and received the bulk of my 18 years of training and experience from all four of the Big Four consulting firms across Africa, in the US and in the Caribbean. I have also been involved for the past eight years on the board of directors of the leading global association for Information Risk Management and IT Governance (ISACA). The need for controls assurance in IT environments grew exponentially with the digital business transformation. The continued evolution of business and technology and the explosion of information resources has meant that my foundation training and experience in information risk management has remained a relevant skillset.hideWhat do you see as the major challenges facing your part of the organisation? In an era where rapid technological advancement is as much of a preventative measure as it is a causative agent in the growth of information risk, human beings remain the weakest link. According to the Verizon 2016 Data Breach Investigations Report, “the majority of the attackers behind this year’s incidents were external actors motivated by financial gain”. The report goes on to point out that while they also used sophisticated techniques, social engineering is increasing in importance as a technique to breach an organisation. In other news, data is the new currency. We have more information on almost everything under the sun than ever before. Storage and transmission of data introduce their own confidentiality, integrity and availability risks. While those of us in risk management are increasingly grateful for data analytics techniques used to probe this data, this is a capability that cybercriminals have had access to for much longer. Cybercrime is organised crime, plain and simple. As cybercriminals become more sophisticated and collaborative, there is an increasing threat not only to global economies but also to national and international security. This is compounded by the fact that cybercriminals and hacktivists like the infamous Anonymous group, are economically and politically incentivised now more than ever before. Government-sponsored ‘hacktivity’ has resulted in access to even more resources. Of 850 global data breaches investigated in 2015, 63% involved a third party. More than two thirds of cyber attacks are being perpetrated through third parties that organisations, or individuals for that matter, are contracting with (also known as supply chain data security risk). We are also witnessing an unprecedented level of innovation as the criminal elements cultivate newer techniques to disrupt and destabilise. To the extent that information security risk management has become an exercise in damage limitation as opposed to an absolute preventative measure. For most organisations, the unfortunate reality is that it is no longer a matter of if they will be breached but simply a matter of when and how badly they will be impacted. Do you have any tips on how best to deal with those? As much as we are up against organised criminals with access to the most sophisticated toolkits, I maintain that organisations and individuals alike should continue to pay attention to the basics. User education and training, the routine monitoring of system activity, disciplined change and system patch management to keep technology secure and up to date; all of these remain non-negotiable. In addition, greater diligence and attention to key risk indicators is required in scoping contracts and dealing with third parties that handle information assets on an entity’s behalf. Do you think companies generally pay enough attention to IT risks? If you had asked this question as recently as five years ago, I probably would have responded in the negative. But with recent world events, it has become apparent that organisations have no choice but to pay the requisite attention to IT risk management. The biggest indicator of this to date is that IT risks are now receiving commensurate airtime at board level. Whereas previously IT security functions had to scrounge for budget and attention, it has become commonplace now that IT security is one of the first-line items on the enterprise budget. Chief information (security) officer roles are also being elevated to board level in some organisations. With the South African economy in a fragile condition, is there increasing risk of fraud and corruption? Typically, where economic pressures exist, control measures are the first to be circumvented. The weaker the controls, the greater the likelihood of fraudulent activity.As the competition for economic resources escalates, people will resort to unscrupulous means of ensuring survival. Basically put, if the incentive of the perpetrator is greater than of the organisation or economy being attacked, breaches are likely to happen. Is this likely to manifest itself in more cyber threats? Absolutely. As information assets take on increasing organisational and strategic significance, they will increasingly become the target of cyber attacks. Whereas in the past it was adequate to physically launch an attack on strategic assets, in this age cyber attacks are now perpetrated remotely – with even more devastating consequences. Ransomware is an increasingly common, economically motivated technique that is growing in popularity even here in South Africa. With ransomware, proprietary information is forcibly encrypted (locked) by the attacker and is only decrypted (unlocked) after the owner has paid the requested consideration. You are heavily involved in education – how important is it to bring ‘fresh blood’ into risk management across Africa? Studies done by ISACA are showing that the newer generation have a different view of – and relationship with – technology than previous generations. Increased mobility (mobile devices), the explosion of the phenomenon that is social media, hyperconnectivity between humans and technology (better known as the Internet of Things) and countless other developments, have meant that it has become imperative for risk management to adapt to the end users and to the assets being protected. What more could be done to encourage those younger people to become risk managers? Cultural changes that see the integration of alternative thinking into risk management techniques are certainly required. The premise for our traditional risk management frameworks (such as COSO) is required to evolve in line with the assets being protected. Traditional IT risk management skills have to be re-evaluated in order to understand and effectively address the cyber challenges of today. As the Iranian government learnt from the Stuxnet virus attack circa 2010, an army of trained guards, on its own, is no longer enough to protect a strategic nuclear power plant. Greater investment in advanced data and technology protection mechanisms is required.

Risk management needs young blood as threats evolve

Want to read this article?

Read Next

Ferma members told AI will bring risk and reward for corporate insurance buyers

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

The Netherlands sued over PFAS contamination

Marsh launches global alternative risk solutions practice

Ferma members told AI will bring risk and reward for corporate insurance buyers

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

The Netherlands sued over PFAS contamination

Marsh launches global alternative risk solutions practice

Want to read this article?

Read Next

Ferma members told AI will bring risk and reward for corporate insurance buyers

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

The Netherlands sued over PFAS contamination

Marsh launches global alternative risk solutions practice

Related Articles