Mitigation of Threats and Attacks - Slides 1-14

COSO Enterprise Risk Management (ERM) Framework

-updated in 2017 and titled ‘Enterprise Risk Management - Integrating with Strategy and Performance (“ERM Framework”)

-One foundational drivers behind the update of the ERM framework was the need to address the evolution of risk management in the cyber age, and the need for organizations to improve their approach to managing cyber risk to meet the demands of an evolving business environment.

COSO Internal Control Components

Control Environment, Risk Assessment, Control Activities, Information and Communication, Monitoring Activities

Control Enviornment

Sets the tone of the organization; includes integrity, ethical values, management's operating style, and the assignment of authority and responsibility.

Risk Assessment

Involves identifying and analyzing risks to achieving the organization’s objectives and determining how those risks should be managed.

Control Activities

The policies and procedures that help ensure management directives are carried out: such as approvals, authorizations, verifications, reconciliations, and segregation of duties

Information and Communication

Pertains to the systems and processes that support the capture, processing, and sharing of relevant information internally and externally.

Monitoring Activities

Ongoing evaluations or separate evaluations used to ascertain whether each component of internal control is present and functioning.

Innovations in business and technology have woven a rich and complex fabric of connectivity, enhanced through the proliferation of the internet, and more recently the emergence of readily available could-based solutions.

…

As companies have become more agile and innovative through the emergence of digital reach, new and ever-present vulnerabilities have emerged.

….

Components of ERM for Cybersecurity

Governance and Culture; Strategy and Objective setting; Performance; review and revision; information, communication, and reporting.

Governance and Culture ERM

Governance and culture together form a basis for all other components of ERM. Governance sets the entity’s tone, reinforcing the importance of cyber vigilance and establishing oversight responsibilities for the entity.

Strategy and Objective-Setting ERM

Cyber risk management is integrated into the entity’s strategic plan through the process of setting strategy and business objectives. With an understanding of business context, the organization can gain insight into internal and external factors and their effect on risk. An organization sets its cyber risk appetite in conjunction with strategy-setting. The business objectives allow strategy to be put into practice and shape the entity’s day-to-day operations and priorities.

Performance ERM

An organization identifies and assesses risks that may affect an entity’s ability to achieve its strategy and business objectives. As part of that pursuit, the organization identifies and assesses cyber risks that may affect the achievement of that strategy and business objectives. It prioritizes risks according to their severity and considering the entity’s cyber risk appetite. The organization then selects risk responses and monitors performance for change. In this way, it develops a portfolio view of the amount of risk the entity has assumed in the pursuit of its strategy and entity-level business objectives

Review and Revision ERM

By reviewing cyber risk management capabilities and practices, and the entity’s performance relative to its targets, an organization can consider how well the cyber risk management capabilities and practices have increased value over time and will continue to drive value in light of substantial changes.

Information, Communication, and Reporting ERM

Communication is the continual, iterative process of obtaining information and sharing it throughout the entity. Management uses relevant information from both internal and external sources to support cyber risk management. The organization leverages information systems to capture, process, and manage data and information. By using information that applies to all components, the organization reports on risk, culture, and performance.

An organization’s cyber risk management

program needs to be consistent with the

entity’s core values as established by the

board of directors and senior

management. The program’s policies,

standards, employee expectations,

accountability, and all related

communications should demonstrate

support for the organization’s core values.

For example, management should seek

to build the trust of employees getting

them to buy into the importance of cyber

vigilance rather than trying to coerce the

desired behaviors.

Cyber Risk Management Program Parts

Cross-functional representation; awareness, training, and accountability initiatives; qualified and internal and external cyber professionals; strategy, framework, and execution and monitoring; senior leadership involvement; board engagement and expertise.

Defining risk appetite and the appropriate

balance of cyber risk vs. reward is

something that every organization must

consider. One aspect of risk appetite that

is increasingly important to digital

initiatives is the cost-benefit of not

adopting advanced technology or

expanding technical capabilities.

…

Organizations are finding they have to

move faster, deploy more advanced

technologies, and therefore their risk

appetite may need to be adjusted in

certain circumstances beyond what the

organization has traditionally accepted in

existing business operations.

…

An organization’s cyber risk assessment

should begin first by understanding what

information and systems are valuable to the

organization. The value should be measured

against the potential impact to the entity’s

objectives (including the potential impact of

failed legal or regulatory compliance, which

can have an indirect effect on accomplishing

business objectives).

For example, companies in various

industries (e.g., financial services,

technology, healthcare) may be a prime

target for cyber crime given their assets and

the highly automated nature of business

transactions, processes, and systems.

Cyber Risk Assessment Program Parts

Assumptions; risk appetite; risk profile; business context; strategy; culture

Because the cyber risk assessment informs

management’s decisions about how to

deploy risk responses toward information

systems that support an entity’s objectives, it

is important that senior management and

other critical stakeholders drive the risk

assessment process to identify what must

be protected in alignment with the entity’s

objectives.

…

Many organizations do not spend enough

time gaining an understanding of what

information systems are truly critical to the

organization; they also may have difficulty

understanding where and how the

information is stored.

This can lead to attempts to protect

everything, which may result in

overprotecting certain information systems

and under protecting others

COSO ERM - GOV. and Culture Principles

Exercises board risk oversight (1), establishes operating structures (2), defines desired culture (3), demonstrates commitment to core values (4), attracts, develops and retains capable individuals (5)

Exercises Board Risk and Oversight (1) - Gov and culture

the board of directors provides oversight of the strategy and carries out governance responsibilities to support management in achieving strategy and business objectives.

Establishes Operating Structures (2) - Gove and CUltures

The organization establishes operating structures in the pursuit of strategy and business objectives

Defines Desired Culture (3) Gov and Culture

The organization defines the desired behaviors that characterize the entity’s desired culture

Demonstrates commitment to core values (4) Gov and Culture

The organization demonstrates a commitment to the entity’s core values

Attracts, Develops and Retains Capable Individuals (5) Gov and Culture

The organization is committed to building human capital in alignment with the strategy and business objective.

COSO ERM - Strategy and Objective Setting Principles

Analyzes Business Context (6), defines Risk appetite (7), Evaluates alternative strategies (8), Formulates Business Objective (9)

Analyzes Business Context (6) Strategy and Objective setting

the org. considers potential effects of business context on risk profile

Defines Risk Appetite (7) strategy and objective setting

The organization defines risk appetite in the context of creating, preserving, and realizing value.

Evaluates Alternative Strategies (8) - Strategy and Objective Setting

The organization evaluates alternative strategies and potential impact on risk profile

Formulates Business Objectives (9) strategy and objective setting

the organization considers risk while establishing the business objectives at various levels that align and support strategy

COSO ERM - Performance Principles

Identifies risk (10), assesses severity of risk (11), prioritizes risk (12), implements risk responses (13), develops portfolio view (14)

Identifies Risk (10) performance

the organization identifies risks that impacts the performance of strategy and business objectives

Assesses Severity of Risk (11) Performance

the organization assesses the severity of risk

Prioritizes Risk (12) Performance

The organization prioritizes risks as a basis for selecting responses to risks

Implements Risk Responses (13) performance

the organization identifies and selects risk responses

Develops portfolio view (14) performance

The organization develops and evaluates a portfolio view of risk

COSO ERM Review and Revision Principles

assesses substantial change (15), reviews risk and performance (16), pursues improvement in enterprise risk management (17)

Assesses substantial change (15)

the organization identifies and assesses changes that may substantially affect strategy and business objectives

Reviews risk and performance (16)

the organization reviews entity performance and considers risk

Pursues improvement in enterprise risk management (17)

the organization pursues improvement of enterprise risk management