Building a Cyber Risk Management Program 9781098147792

Table of contents :
Preface
Brian’s Story
Brandon’s Story
Bringing It Together
Who Should Read This Book
Final Thoughts
Conventions Used in This Book
O’Reilly Online Learning
How to Contact Us
Acknowledgments
1. Cybersecurity in the Age of Digital Transformation
The Fourth Industrial Revolution
Cybersecurity Is Fundamentally a Risk Practice
Cyber Risk Management Oversight and Accountability
Digital Transformation and Maturing the Cyber Risk Management Program
Cybersecurity Isn’t Just a “Security” Concern
Cyber Risk Management Program: An Urgent Enterprise Concern
This Book’s Roadmap
The Bottom Line
2. The Cyber Risk Management Program
The SEC Speaks—and the World Listens
Incident Disclosure (“Current Disclosures”)
Risk Management, Strategy, and Governance Disclosures (“Periodic Disclosures”)
The Cyber Risk Management Program Framework
Cyber Risk Management Program: Key Drivers
Satisfying Obligations and Liability
When Risk Management Fails Completely: The Boeing 737 MAX Disasters
Risk Management Program Applied to the Boeing Disasters
“Essential and Mission Critical”: The Boeing Case
Benefits of a Security Risk Program
Benefit 1: Strategic Recognition of the Security Risk Function
Benefit 2: Ensuring the Cyber Risk Function Has an Effective Budget
Benefit 3: Protections for Risk Decision Makers
CRMP: Systematic but Not Zero-Risk
Board Accountability and Legal Liability
The Boeing Ruling and Cyber Risk Oversight Accountability
CISOs in the Line of Fire for Liability
The Bottom Line
3. Agile Governance
The Uber Hack Cover-Up
What Does Good Governance Look Like?
Aligning with the Enterprise Governance Strategy
Seven Principles of Agile Governance
Principle 1: Establish Policies and Processes
Principle 2: Establish Governance and Roles and Responsibilities Across the “Three Lines Model”
Principle 3: Align Governance Practices with Existing Risk Frameworks
Principle 4: Board of Directors and Senior Executives Define Scope
Principle 5: Board of Directors and Senior Executives Provide Oversight
Principle 6: Audit Governance Processes
Principle 7: Align Resources to the Defined Roles and Responsibilities
The Bottom Line
4. Risk-Informed System
Why Risk Information Matters—at the Highest Levels
Risk and Risk Information Defined
Five Principles of a Risk-Informed System
Principle 1: Define a Risk Assessment Framework and Methodology
Principle 2: Establish a Methodology for Risk Thresholds
Principle 3: Establish Understanding of Risk-Informed Needs
Principle 4: Agree on a Risk Assessment Interval
Principle 5: Enable Reporting Processes
The Bottom Line
5. Risk-Based Strategy and Execution
ChatGPT Shakes the Business World
AI Risks: Two Tech Giants Choose Two Paths
Wall Street: Move Fast—or Be Replaced
The Digital Game Changers Just Keep Coming
Defining Risk-Based Strategy and Execution
Six Principles of Risk-Based Strategy and Execution
Principle 1: Define Acceptable Risk Thresholds
Principle 2: Align Strategy and Budget with Approved Risk Thresholds
Principle 3: Execute to Meet Approved Risk Thresholds
Principle 4: Monitor on an Ongoing Basis
Principle 5: Audit Against Risk Thresholds
Principle 6: Include Third Parties in Risk Treatment Plan
The Bottom Line
6. Risk Escalation and Disclosure
The SEC and Risk Disclosure
Regulatory Bodies Worldwide Require Risk Disclosure
Risk Escalation
Cyber Risk Classification
Escalation and Disclosure: Not Just Security Incidents
Disclosure: A Mandatory Concern for Enterprises
The Equifax Scandal
SEC Materiality Considerations
Cyber Risk Management Program and ERM Alignment
Five Principles of Risk Escalation and Disclosure
Principle 1: Establish Escalation Processes
Principle 2: Establish Disclosure Processes—All Enterprises
Principle 3: Establish Disclosure Processes—Public Companies
Material incident reporting
Risk management and strategy
Governance
Principle 4: Test Escalation and Disclosure Processes
Principle 5: Audit Escalation and Disclosure Processes
The Bottom Line
7. Implementing the Cyber Risk Management Program
The Cyber Risk Management Journey
Beginning the Cyber Risk Management Journey
Implementing the Cyber Risk Management Program
Agile Governance
Common challenges with Agile governance
Establish a starting point
Gain senior-level commitment
Obtain necessary budget and other resource limitations
Adapt to the specific enterprise’s environment
Risk-Informed System
Common challenges with a risk-informed system
Dealing with too much data—or the wrong kind of data
Communicating information in terms specific stakeholders will understand and accept
Getting the right information to the right people at the right time
Additional considerations
Maturity modeling
Metric reporting
Risk assessments (qualitative and quantitative)
Risk-Based Strategy and Execution
Common challenges with risk-based strategy and execution
Inadequate budget and other resources
Compliance-driven strategy
Risk Escalation and Disclosure
Common challenges with risk escalation and disclosure
A view of escalation that’s largely limited to reacting to an incident
The failure to identify and focus on enterprise-specific obligations
Generic, isolated, or excessively broad materiality considerations
Selling the Program
The Bottom Line
8. The CRMP Applied to Operational Risk and Resilience
Enterprise Functions That Interact with and Contribute to Operational Resilience
A Malware Attack Shuts Down Maersk’s Systems Worldwide
Guiding Operational Resilience Using the Four Core Cyber Risk Management Program Components
Agile Governance
Risk-Informed System
Risk-Based Strategy and Execution
Risk Escalation and Disclosure
The Bottom Line
9. AI and Beyond—the Future of Risk Management in a Digitalized World
AI Defined
AI: A Whole New World of Risk
Adversarial Machine Learning: NIST Taxonomy and Terminology
Risk Management Frameworks with AI Implications
NIST AI Risk Management Framework
Model risk management (MRM) and the Federal Reserve Board’s guidance
Key AI Implementation Concepts and Frameworks
Fairness and the risk of bias
Soundness
Robustness
Explainability
Beyond AI: The Digital Frontier Never Stops Moving
The Bottom Line
A. The Cyber Risk Management Program Framework v1.0
Purpose and Context
Structure of the Cyber Risk Management Program Framework
Note: Framework Disclosure
Index

Polecaj historie

Building a Cyber Risk Management Program 9781098147792, 9781098147730

Cyber risk management is one of the most urgent issues facing enterprises today. This book presents a detailed framework

208 91 3MB Read more

Building a Cyber Risk Management Program 9781098147730

Cyber risk management is one of the most urgent issues facing enterprises today. This book presents a detailed framework

196 67 1MB Read more

Building a Cyber Risk Management Program: Evolving Security for the Digital Age 9781098147792, 9781098147730, 1098147790

Cyber risk management is one of the most urgent issues facing enterprises today. This book presents a detailed framework

226 129 2MB Read more

Building a Cyber Risk Management Program: Evolving Security for the Digital Age [1 ed.] 1098144791, 9781098144791

Cyber risk management is one of the most urgent issues facing enterprises today. This book presents a detailed framework

138 96 Read more

Understand, Manage, and Measure Cyber Risk: Practical Solutions for Creating a Sustainable Cyber Program [2 ed.] 1484293185, 9781484293188

When it comes to managing cybersecurity in an organization, most tussle with basic foundational components. This practit

192 66 6MB Read more

Understand, Manage, and Measure Cyber Risk: Practical Solutions for Creating a Sustainable Cyber Program [2 ed.] 1484293185, 9781484293188

175 40 13MB Read more

Understand, Manage, and Measure Cyber Risk: Practical Solutions for Creating a Sustainable Cyber Program [2 ed.] 1484293185, 9781484293188

375 166 7MB Read more

Understand, Manage, and Measure Cyber Risk: Practical Solutions for Creating a Sustainable Cyber Program [2 ed.] 1484293185, 9781484293188

When it comes to managing cybersecurity in an organization, most organizations tussle with basic foundational components

168 56 20MB Read more

Practical Vulnerability Management: A Strategic Approach to Managing Cyber Risk 1593279884, 9781593279882

Practical Vulnerability Management shows you how to weed out system security weaknesses and squash cyber threats in thei

101 95 7MB Read more

Transdisciplinary Perspectives on Risk Management and Cyber Intelligence [1 ed.] 1799854876, 9781799854876

The emergence of artificial intelligence has created a vast amount of advancements within various professional sectors a

731 53 7MB Read more