Cyber Risk Trends in 2020

Acuity Blog

Business leaders are investing in digital transformation to increase competitiveness, drive operational efficiencies, and grow market share. It has never been a better time to capitalize on the advantages of digitalization but with increased reward, comes increased risk.

As we embark on a new year and new decade, it is important that we reflect on the lessons of 2019 to drive our future strategies. Acuity has put together some trends and tips for managing cyber risks to help you prepare for the coming year.

The Board of Directors and cyber reporting

Trend 1: Increased Board interest in cyber security risk

Boards are paying more attention to cybersecurity with more CISOs joining management conversations and cybersecurity spend rising year on year. While this reflects increasing awareness of cyber security risks, there are still continuing challenges in translating technical matters into Board-level discussions.

A PWC survey of 3000 respondents (The journey to Digital Trust, 2018) found that 80% of companies have provided the board with strategies for cybersecurity, however only 27% of them feel comfortable that the board is receiving adequate reporting on metrics for cyber and privacy risk. Evidently, there is still a lack of understanding around how to measure cyber risk and determine the best course of action.

By putting financial measurements on risk, an objective calculation can be used to provide reporting that is widely understood and comparable with management’s tolerance for risk. These insights will be used to shape strategies by enabling security and risk professionals to speak the language of business leaders, aid decision-making and optimize security investments. Cost/benefit analysis will help organizations determine how to gain the best ROI.

Tip: Consider quantitative risk assessment methods, such as FAIR
Last year, we highlighted how the introduction of quantitative methods for cyber security assessments can allow organizations to understand their financial exposure from cyber risks.

The Open FAIRTM method is an international standard quantitative model for cybersecurity and operational risk licensed by the Open Group. Open FAIR is already being used by 30% of Fortune 1,000 organizations and we expect that more firms will adopt this method as quantitative approaches become more prevalent.

Acuity is one of the very few vendors licensed for Open FAIR and has integrated this risk assessment method into its STREAM Integrated Risk Manager platform. With STREAM, organizations can use Open FAIR for quantitative assessment of risks and then use STREAM’s powerful aggregation, reporting and dashboarding to view financial exposure from cyber and operational risks across the enterprise. STREAM can then use the quantitative data to perform risk-based prioritization of security improvement and model the ROI from potential security investments.

Supplier Risk Management

Trend 2: Increased demand for Vendor Risk Management
While managing internal risks is highly important, it is imperative not to forget that risks can also be inherited from vendors and the wider the supply chain. This is a rising challenge as organizations increasingly share sensitive and business-critical information with the wider ecosystem.

Due to the dynamic nature of risk, it is important to understand suppliers’ risk profiles and security capabilities before entering a relationship and for the duration of the relationship. With some firms having thousands of suppliers this can be a daunting challenge.

Tip: Increase consistency

The most common approach to vendor risk management has involved asking vendors to complete and return questionnaires with supporting evidence. Apart from the shear volume of administration effort involved, these approaches suffer from some serious problems:

Vendors can be less than honest in their questionnaire responses
Assessments are ‘point in time’ and can be out of date shortly after completion
Questions tend to focus on controls and compliance rather than primary indicators of risk, such as threats, vulnerabilities and incidents.

Organizations should take a risk-based approach to Vendor Risk Management at two levels:

Prioritizing vendors based on level of dependency, e.g. because they handle highly sensitive data or provide time-critical services
Understanding actual risks posed by vendors and across the supply chain by reducing check-box compliance activity and monitoring (for high dependency vendors) security ratings / threat intelligence services, security performance metrics and incident history.

By monitoring what happens in practice, organizations can gain greater insights into vendor risk and use these to manage business exposure down to acceptable levels.

All of this requires a platform which is capable of efficiently handling the information capture, analytics and reporting in close to real time.

Trend 3: Ever-increasing data protection and privacy regulations

As we enter 2020, data protection and personal privacy rights continue to grow in importance. In 2019, the General Data Protection Regulation (GDPR) was joined by similar laws in regions such as Australia, Brazil and Canada. It is undeniable that data breaches will continue to be one of the biggest concerns for businesses worldwide; in fact, a 2019 survey by KPMG found that 91% of technology leaders believe that data privacy and trust will be as important as their product/service offering in customer attraction. With this in mind, it is not surprising that businesses of all sizes are devoting more time and effort into data privacy and cyber security.

Tip: Growing effort to demonstrate a risk-based approach to privacy management

Not only will regulators be demanding security and privacy assurance but also customers and investors. It will be more important than ever for firms to get their arms around security efforts and demonstrate transparency in order to win business.

New privacy regulations are risk-based and it will be essential for organizations to record, assess, manage and review both privacy and security risks to the processing of personal data. As part of this, accountability must be established and evidence of activities and decisions must be chronologically logged. This will give confidence on a day-to-day basis but also, be used as mitigating evidence in the event of a data breach.

Trend 4: Increasing adoption of flexible integrated risk management platforms

Cyber, privacy and vendor risks have all escalated in recent years with potential to cause material damage to organizations, alongside more traditional enterprise risks. As mentioned above, these new risks require some quite specific attention with specialist tools but the Board wants an overall consolidated view of risk status across all material enterprise risks so that it can prioritize and allocate resources accordingly.

Spreadsheets or parochial enterprise risk management tools that simply imitate spreadsheet functionality do not have the capability to address these new risks to business for the 2020s so we will see the increasing adoption of flexible integrated risk management platforms that can adapt to the changing risk environment.

Tip: Consolidate multiple risk management systems into a fully integrated system

Organizations should aim to bring these traditional and new risk management disciplines together as value can be derived by centralizing these activities onto one, platform. Breaking silos and connecting the dots will enhance:

Efficiency: sharing data across teams, minimizing duplication of effort
Accuracy: reducing guess work and errors
Consistency: forcing the adoption of a common language to avoid misalignment
Reliability: scheduling, reminders and workflow for critical tasks and processes
Visibility: holistic risk view, with consolidated, close to real-time and on-demand reporting.

Consolidation of risk management has been one of Acuity’s core beliefs and a key value proposition of STREAM. This fundamental approach is still crucial to gain a true insight into an organization’s risk status. Ultimately this will also enable better decision-making for prioritization, investment and resource allocation.

Conclusion

There are undeniable benefits to risk management but huge challenges that need to be overcome.

As we embrace digitalization, the most serious risks to business are changing to include cyber security, privacy, vendors and the wider supply chain.

To survive this dynamic environment, organizations must modernize their approaches and equip themselves with the suitable tools to stay competitive. By moving away from siloed activities to having multiple risk functions under one umbrella, organizations can get a better grasp on their risk, compliance and security. Luckily there are sophisticated tools available which make it possible to make risk manageable.

Acuity has an award-winning platform and extensive knowledge to fast-track your journey to quantifiable, automated, integrated risk management. With over 15 years of experience, Acuity has been helping organizations around the world across various industries. Let our innovation guide you to stay ahead of the game in 2020. For more information or to arrange an introductory call, please contact us.

Cyber Risk Trends that will dominate in 2020

Onsite or web training needed?

Newsletter