New Report: Enterprises Lack Effective Risk Management

A recent article, provides an overview of the findings of a new report (accessible as a free download, here) by “The Alliance for Enterprise Security Risk Management (AESRM)”:

“The currently popular silo approach to managing enterprise risk is inadequate because it leaves too many gaps and provides no reliable way to evaluate an enterprise’s risk position, according to a new research report issued by The Alliance for Enterprise Security Risk Management (AESRM), a partnership of leading international security associations ISACA and ASIS International.
The Convergence of Physical and Information Security in the Context of Enterprise Risk Management shows that while risk management is fundamental to most enterprise managers, many risk reduction initiatives are not coordinated or integrated across all risk areas. Only 19 percent of executives surveyed said their company has a robust process in place for identifying when risk tolerance approached or exceeded defined limits. To address these risk challenges, organizations are investigating more inclusive enterprise risk management (ERM) programs and converging traditional and information security functions. Although this convergence is intuitive and logical, it is still in its early stages, according to the research conducted by Deloitte.

When asked to identify the major drivers of their companies’ security integration efforts, 73 percent of the executives cited “reducing risk of combined information and physical security threats,” 58 percent said “increased information sharing,” and 50 percent noted “better protection of the organization’s people, intellectual property and corporate assets.” The survey shows that security integration and ERM, when aligned, add value throughout an organization.”

As you might expect, the management of identity information has itself its “risks”. In particular, in terms of identity and identity management this report mentions that:

• Identity thefts and account frauds are listed among one of the main (internal and external) threats that enterprises have to face
• Each stolen customer identity is the cause of a financial lost of $100 (rule of thumb)
• Identity and Access Management is the third more important initiative in terms of “current focus on security initiatives”

--- NOTE: my original HP blog can be found here ---