How to Define & Prioritize Risk Management Goals

When evaluating the goals for a risk management program, many organizations focus on compliance or filling perceived gaps in their capabilities. The problem is, these priorities fall short of considering the full breadth of risks a business could face, security experts say.

"Those may or may not be the things they should be focusing on or making the center point of their program," says Jack Jones, chairman of the FAIR Institute and executive vice president of R&D at RiskLens. "But they can't know that until they do risk analysis."

At the 2019 FAIR Conference, held this week in Washington, D.C., Jones moderated a panel focused on defining goals of an effective risk management program. Some of these goals are constant across organizations, he says in an interview with Dark Reading ahead of the event.

"From my perspective, one of the objectives of any risk management program is to be cost-effective," he notes, as an example. The cost of a $5 million risk management program is far more when opportunity cost is considered, and it could be doubled when the business considers what it would have to do to implement such a program, he explains. Firms that exclusively focus on best practices and compliance are not going to be cost-effective, he argues.

While there should be "philosophical alignment" in the nature of risk management programs, their paths and considerations will likely differ depending on industry, culture, and resources.

Another core objective should be to bring all risk management groups together: audit, compliance, legal, enterprise risk management "need to have very open and honest conversations," Jones says. In previous roles as a CISO, he adds, clear communication "served me incredibly well," especially when working with external auditors and regulators.

Joey Johnson, CISO of Premise Health and member of the aforementioned panel, takes this a step further and says security leaders should prioritize looking at risk holistically and treat it as a central business function. Risk should be considered outside the spectrum of IT, he explains.

"It feels so often the message security is trying to convey is lost," says Johnson. The business will quickly "gloss over" security risk but are attuned to the conversation around overall risk. It's up to security to deliver tangible metrics and a narrative to corporate stakeholders. "Whatever metrics you deliver have to provide a narrative that the audience can respond to," he adds.

Now Hiring: Risk-Focused Leadership
The first step to implementing a risk management program is finding a leader who can translate risk into terms that inform a dialogue within the business. This leader should understand the company, where it's headed, and its overall risk tolerance. Without one, any organization will have a hard time implementing risk resources in an appropriate say, Johnson explains.

Of course, finding this person is a challenge. There are typically two schools of leadership from a security perspective: those who come from a business background and have no security experience, and those who come from security but don't know how it fits into the business.

"Getting a leader in place, setting up a function to see all different kinds of risk, is paramount," says Johnson. Many security experts are predisposed to view through the lens of risk but often forget security is only one level; there is financial risk and market perception, among others. They need to be able to identify what is critical. If a company starts the process of acquiring a software company, it should recognize it may not have the resources to do software security.

Alignment between the business and security risk management is both "critical and overlooked," Johnson emphasizes. Historically, security programs have involved a lot of "blocking and tackling" to keep people out of trouble, Johnson adds. But with the right strategy, security can be used to deliver valuable outcomes through a risk management program.

As an example, he points to his company's third-party risk management program. In starting a vendor risk assessment, the security team found they were dealing with hundreds of thousands of vendors, many of them duplicative. They could have done a vendor risk assessment for each one — a time-consuming and expensive process — or eliminate some from the start, coach the ones they kept, and shape their product road map with fewer trusted vendors, he explains.

The company went with the latter. "All of that massively reduces our threat landscape, and it's a zero-dollar initiative that reduced risk while fostering the business," Johnson says. As a result, the business wanted to engage with security from the beginning and understood security's position within the organization gave it a perspective that nobody else in the company had.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "'Playing Around' with Code Keeps Security, DevOps Skills Sharp."