Is Technology Risk Bigger Than “Cyber” Risk?

It’s not an earth-shattering thing to say that news of hacks, data breaches, and other technology hiccups has grown exponentially in recent years. Between January and September 2019, 7.9 billion records were exposed, marking a 33% increase from the same period in 2018.

A few of last year’s data breaches include:

  • An error in pharmacy giant Walgreens’ mobile app messaging feature exposed names, prescription numbers, shipping addresses, and other sensitive information. The number of impacted customers was not disclosed, but the app has over 10 million downloads.
  • Personally identifiable information of over 280,000 current and former employees of General Electric was exposed following a data breach of a third-party vendor.
  • Credentials of over 500,000 Zoom accounts, including email addresses, meeting room IDs, and passwords were found for sale on the “dark web” and hacker forums. (A good reason to use auto generated meeting room IDs and passwords and their waiting room feature!)
  • And in May 2021, a ransomware attack on the Colonial Pipeline led to gas and jet fuel shortages across 17 states and the District of Columbia. Operations were restored a few days later when the pipeline company paid the requested ransom of 75 bitcoin or $4.4 million. This attack was the largest of its kind on oil infrastructure in American history.

Of course, this barely scratches the surface…

There’s no doubt that these and other hacks are serious, but many sensationalist headlines and opportunistic consultants spread alarm about technology risk, cybersecurity and so on, leading many companies to place too much emphasis on this particular issue.

Companies have several frameworks to choose from for helping them address technology risk, with the Risk Management Framework for Information Systems and Organizations from the National Institute of Standards and Technology (NIST) considered the most authoritative. Other examples include the Factor Analysis of Information Risk (FAIR) framework and the ISO 27005 standard.

While these standards do provide guidance on identifying, assessing, and managing technology risk, they each have one big shortcoming.

They fail to address business risks associated with technology…

Truly understanding and managing technology risk effectively requires a holistic approach focused on the business.

IT professionals should have a very good technical understanding of cyber and general technology risk. However, they typically only focus on the immediate impacts of data breaches like the number of records exposed and remediating the cause of the breach.

And as I discuss in a prior article, most organizations also mistakenly believe that since they have insurance for instances like this, they don’t need to do anything else.

This approach to technology risk can do more harm than good and can, in fact, be dangerous.

While having insurance can be helpful, it’s not going to cover all of the costs and impacts of a breach. Some non-insurable impacts that immediately come to mind include:

  • The business can’t serve its customers, putting an immediate halt to revenue.
  • Employees can’t access the company network and data, stopping work in its tracks.
  • Strategic initiatives are forced to a standstill, potentially stopping new products, software implementations, or a pending merger or acquisition.
  • Word spreads quickly via social media, whether from employees or customers, negatively impacting the company’s reputation.

But according to a recent book from Norman Marks, Making Business Sense of Technology Risk, it goes even farther.

As Norman and others say, simply “managing risks” is insufficient in today’s world…informed risks have to be taken in order for organizations to add value and remain relevant in a world that’s changing at lightning speed, or as Norman explains:

How should a board assess whether to invest in reducing risks related to technology, address other business risks, or putting that money towards new product development, increases in the sales staff, or a new marketing campaign?

Choices have to be made.

No organization (even Apple) has unlimited resources. Its leaders need to be able to understand technology risks within the context of running the business and achieving objectives.

In days long gone, it would be advisable for a company to wait until a particular technology risk was below a certain threshold. In today’s world, companies have to be willing, on business terms, to accept or take a risk, even it is higher than they would like.

Waiting to implement a new technology could mean lost ground to competitors and eventual displacement like what happened to Blackberry, Motorola, Kodak, Borders, and more.

So how can risk professionals help IT executives and staff better communicate technology risks and opportunities to decision-makers?

Simply saying a particular cyber or other technology risk is high is not helpful for decision-makers. In a 2016 survey published by Osterman Research for example, an astounding 85% of board members believe they are not getting helpful information from IT executives and staff and 59% say these same personnel will be let go from their jobs for not providing actionable information.

With that in mind, risk professionals have an important role to play in ensuring the link between technology risks and goals and objectives is understood by decision-makers. This will mean getting rid of the technical terms and talk the talk of the business.

Again, just saying a particular risk is high, medium, or low without any context doesn’t help executives understand its impact on objectives, much less develop any plans to address it.

By not breaking risks down through root cause analysis, scenario analysis, or quantitative tools like Monte Carlo simulation, it will be impossible to know if mitigations are appropriate or what actions to take, if any. Any information executives do receive will be confusing and overwhelming and therefore continue to feed the perception that ERM is not a helpful tool for building a strategic advantage.

In the end, actions can only be as specific as the risk you have identified.

Technology risks have been a growing concern for many years now and will continue to dominate headlines. Therefore, risk managers need to help their IT colleagues properly understand and communicate these risks (and the appropriate context) to decision-makers to ensure a proper balance is struck between risk mitigation and risk taking.

Does your company link technology risks to corporate goals and objectives or are they viewed strictly through the eyes of the IT experts?

As always, any additional insights from those of you with boots on the ground are very helpful to fellow colleagues. If you have anything you would like to share, please don’t hesitate to leave a comment below or join the conversation on LinkedIn.

And if your organization is struggling to understand how technology risks fit into the bigger picture of what you are trying to achieve, reach out to me to discuss your specific situation and needs today.

Featured image courtesy of Tima Miroshnichenko via Pexels.com

Posted in

Sign Up For Our Newsletter

Sign Up For Our Newsletter

SDS-Logo
about-sidebar-v2

Meet Carol

Helping companies achieve their vision and strategy, and succeeding in today's turbulent world, is something I'm honored to be a part of. Whether you're an occasional blog visitor or a long-term client, thank you for letting us be a part of your journey.

Most Recent Posts

The 12 Days of ERM Christmas

Without a doubt, one of my family’s favorite holidays is Christmas. Part of the fun, especially for our son, is seeing what “Santa” brought, but most importantly, we treasure the spirit of peace and goodwill the season brings. And after what seemed to be a never-ending warm spell, the weather is expected to be good…

Read More

Don’t Let Goals and Initiatives Be Blindsided by External Events

As the end of the year draws near, I think we’d all agree that while it wasn’t without its challenges, this year also wasn’t quite as turbulent as the previous two. While a lot of people are juggling company parties, shopping for friends and family, and special activities for the kids, most companies are putting…

Read More

Going the Distance: Ensuring Successful Execution of Strategic and Annual Initiatives

Strategic planning is a challenge – of all people, I understand… After all the meetings, risk and data analysis, and brainstorming of the preceding months, it’s tempting to think this is the end of the road and you can relax. Contrary to this common perception though, this is exactly not the time to relax, but…

Read More

Avoid Rookie Mistakes and Protect your Internal Reputation

Be honest – have you ever done something that you soon realized was a real rookie mistake? Me raising my hand… Considering the nature of ERM’s role to ask questions and challenge assumptions (often during conversations with executives), it can be argued that, in at least some cases, the expectations bar for risk professionals is…

Read More

ERM at Thanksgiving – An Illustration of Risk Management in Action

On occasion, I like to take some of the concepts we risk professionals think about in our jobs and apply them to different personal situations…take some of the same concepts we use when working with executives to develop corporate strategy and manage risks or uncertainty around that strategy. It’s Thanksgiving week in the U.S. –…

Read More

Why Quantitative Risk Assessment is Not Just the Best But the Only Option – A Conversation

Periodically, I have the pleasure of speaking one-on-one with Hans Læssøe on a variety of topics around ERM, strategic risk, and other issues and trends. As you know from my previous conversations (here, here) and posts featuring his work, Hans was formerly a practitioner at the iconic LEGO Company, but even more notably, is a…

Read More

The Three Lines Model – 3 Reasons Why I Don’t Like It

Everyone likes a clear-cut template that offers an easy way to create or manage something…I mean what’s not to like about a step-by-step process for accomplishing what you want? Sometimes this can work without any issues, such as the case with the Project Management Book of Knowledge (PMBOK), ISO 9001 standard, or a new cooking…

Read More

5 Avenues for Expanding your ERM Knowledge

One thing I was taught to appreciate from a young age was the value of education and knowledge. It didn’t necessarily matter what the subject was, just that I always maintain a learning or growth mindset regardless of my current status in life. This mindset has served me well over the years, and it’s a…

Read More

Storytelling and Risk Management – Developing Skills that Technology Cannot Replace

It’s amazing how technology has developed and changed our working world over time. Imagine trying to run my risk and strategy consulting firm without tools like Zoom, Box, Slack, and other ERM-specific technology tools. There is no way we would be able to serve our clients the way that we do. Just consider how the…

Read More

3 Phases to Creating and Launching an ERM Program Focused on Organizational Success

If you’ve been handed the task of creating an ERM program for your organization, let me first offer my congratulations quickly followed by my empathy for the task ahead of you. I don’t say that to scare you but to provide a small dose of reality. Building, launching, and refining an ERM program that is…

Read More