Managing Risk to Reduce the Impact of a Breach
Managing Risk to Reduce the Impact of a Breach
In today’s information security environment, organizations are moving beyond simply lowering the probability of a breach to limiting the impact if a breach occurs.
Rapid detection and effective response are now clearly in focus, and organizations are spending time and money to manage growing security responsibilities which now include: operating a monitoring infrastructure, investigating alerts, and responding to incidents. Without this investment, organizations risk missing requirements necessary for regulatory compliance and the warning signs of incidents while they are in progress.
In this paper, we review the targets that organizations should set to achieve adequate detection and response.
Introduction
Today’s CISO must participate in risk management conversations with the C- Suite and the Board of Directors. Organizations now plan for cyber threats as foreseeable events that lead to expensive data breaches, disruption to operations, and outright theft. Additionally, regulators are compelling CIOs, CISOs, and CTOs to develop and manage KPIs that demonstrate management of this information security risk. As a result, leaders are managing information security risk analysis as they would any other business risk. As part of this strategic shift, organizations must also determine how to allocate budget to best address the growing information security risk and the regulatory requirements that come with it.
