The overwhelming demands on security leaders today can have a paralyzing effect. Gartner analysts provide insight to empower these security leaders to take action.<\/p>\n\n\n\n
Gartner analysts provide guidance on how to be empowered to adapt their people, processes, and technologies to address the old and the new; empowered to transform their approach to risk governance to be more continuous and inclusive, and empowered to scale their security capabilities in other ways than by hiring more people.<\/p>\n\n\n\n
Much of this empowerment can come from addressing three simple questions: What\u2019s important? What\u2019s dangerous? What\u2019s real? Gartner analysts took the attendees through a series of scenarios to show how these questions can provide clarity, and in each scenario, the intersection of the questions changed perception and led to action (see Table 1).<\/p>\n\n\n\n
Table 1
What\u2019s Important What\u2019s Dangerous What\u2019s Real
Innovating for Value Start from an Enterprise-Wide Risk perspective Adopt Integrated Risk Management (IRM) Practices Build a strong foundation of communication<\/p>\n\n\n\n
Urgent Crisis and Threat Create visibility into assets and ecosystems Design for resilience at Multiple Levels Use analytics and automation as a force multiplier<\/p>\n\n\n\n
Technology Transformation Empower others to be part of risk management Challenge conventional wisdom on risks and controls Select adaptable and adaptive risk controls
Source: Gartner (June 2018)<\/p>\n\n\n\n
Take an Enterprise-Wide Risk Perspective<\/p>\n\n\n\n
Gartner analysts recommended that security leaders start any initiative from an enterprise-wide risk perspective. Historically, risks have been viewed through a narrow lens, typically that of the risk owner.
\u201cA few key practices will greatly help you overcome this obstacle,\u201d said Katell Thielmann, research vice president at Gartner. \u201cFirst, create and support a culture of accountability with well-established risk ownership and responsibilities. \u201cNext, build an enterprise-wide risk register that accounts for the top risks across all risk domains. Finally, map risk directly, clearly, and defensibly to business goals and objectives.\u201d<\/p>\n\n\n\n
The danger can come from cyber risk, which represents an increasingly critical part of the risk puzzle. This is where integrated risk management (IRM) become so important.<\/p>\n\n\n\n
\u201cIRM allows for easy and simple risk prioritization and linkages to risk treatment plans. We recommend you integrate cybersecurity and technology risks with broader operational risk to ensure that risk oversight is forward-thinking,\u201d Ms. Thielmann said. \u201cDefine and measure risk indicators and identify those that serve as early warnings.\u201d<\/p>\n\n\n\n
Creating Visibility into Assets and Ecosystems
As an enterprise ecosystem grows, it becomes nearly impossible to understand the interconnectedness of it all. When a problem ripples through an ecosystem, unexpected consequences are likely, but Gartner analysts said overreactions can do more harm than good.<\/p>\n\n\n\n
\u201cLast year, more than 15,000 vulnerabilities were disclosed publicly. A small portion of those were rated as a critical severity and posed an urgent threat,\u201d said Craig Lawson, research vice president at Gartner. \u201cOften there is still some time to assess the situation and respond with care. But sometimes these threats are immediately elevated to critical importance because of the hype they receive in the mainstream media.\u201d<\/p>\n\n\n\n
For example, while there are security risks constantly gaining attention, Mr. Lawson said that the data clearly shows now that over the last decade only a small number of vulnerabilities actually go on to be exploited, in fact, he said it\u2019s only about one-eighth.<\/p>\n\n\n\n
When responding to security threats, often the focus is on fixing a trust-related issue. However, in doing so, security leaders must make sure they do not violate their resilience goals. They have to design for resilience at multiple levels, from organizational to technical.<\/p>\n\n\n\n
\u201cTake an enterprise-wide view of resilience, and work with business and IT partners to set resilience goals,\u201d Mr. Lawson said. \u201cSecond, create crisis management and communication plans to reduce the risk of conditioned or habitual responses. Third, design technologies and processes that don\u2019t just plan for high availability, but also for recovery and continuity. Lastly, ensure that these recovery and continuity plans are tested often enough to prove that they work.\u201d<\/p>\n\n\n\n
Empower others to be part of risk management
Security leaders need controls that are appropriate for the environment and risk. They need controls that are applicable to more than just a single vendor or technology and can change as risk and compliance landscapes evolve.<\/p>\n\n\n\n
\u201cAdaptable controls are what turn security into a technology enabler,\u201d said Ramon Krikken, research vice president at Gartner.<\/p>\n\n\n\n
Mr. Krikken said it\u2019s important to empower others in the organization to greatly increase the chances of success.<\/p>\n\n\n\n
\u201cBusiness process owners and IT teams must provide domain knowledge for effective risk management,\u201d Mr. Krikken said. \u201cThis is to ensure that risk professionals understand the changing technology and business realities. In return, we should encourage other roles to take guidance and advice from risk professionals, so that they can incorporate risk-based thinking into their responsibilities. Transforming and scaling security this way is a win-win for everyone involved.\u201d<\/p>\n\n\n\n
More information on security & risk management is available in the Gartner Special Report \u201cThe Resilience Premium of Digital Business: A Gartner Trend Insight Report.\u201d This collection of research focuses on how committing to resilience will equip a digital business with the mindset, resources and planning to recover from inevitable disruptions.<\/p>\n\n\n\n
Gartner analysts will provide additional analysis on IT security trends at the Gartner Security & Risk Management Summits 2018.<\/p>\n","protected":false},"excerpt":{"rendered":"
The overwhelming demands on security leaders today can have a paralyzing effect. Gartner analysts provide insight to empower these security leaders to take action. Gartner analysts provide guidance on how to be empowered to adapt their people, processes, and technologies to address the old and the new; empowered to transform their approach to risk governance […]<\/p>\n","protected":false},"author":2,"featured_media":493,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_meta-robots-noindex":"","_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","_pr_autopilot_social_copy":"","_yoast_wpseo_opengraph_title":"","_yoast_wpseo_opengraph_description":"","_yoast_wpseo_opengraph_image":"","_yoast_wpseo_opengraph_image_id":0,"_yoast_wpseo_twitter_title":"","_yoast_wpseo_twitter_description":"","_yoast_wpseo_twitter_image":"","_yoast_wpseo_twitter_image_id":0,"_yoast_wpseo_primary_category":439,"_extra_hide_author_box":"1","_extra_featured_post":"","_partner_post_id":0,"footnotes":""},"categories":[439],"tags":[],"class_list":["post-8053","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","et-has-post-format-content","et_post_format-et-post-format-standard"],"yoast_head":"\n