What is Information Risk Management?

5 min readOct 3, 2019

Information Risk Management (IRM) is a form of risk mitigation through policies, procedures, and technology that reduces the threat of cyber attacks from vulnerabilities and poor data security and from third-party vendors. Data breaches have massive, negative business impact and often arise from insufficiently protected data.

In this article, we outline how you can think about and manage your cyber risk from an internal and external perspective to protect your most sensitive data. External monitoring through third and fourth-party vendor risk assessments is part of any good risk management strategy.

Additionally, we highlight how your organization can improve your cyber security ratingthrough key processes and security services that can be used to properly secure yours and your customers most valuable data.

You need information risk management

Regardless of your risk acceptance, information technology risk management programs are an increasingly important part of enterprise risk management.

In fact, many countries including the United States have introduced government agencies to promote better cybersecurity practices. The National Institute of Standards and Technology’s ( NIST) Cybersecurity Framework”provides a high level taxonomy of cybersecurity outcomes and a methodology to assess and manage those outcomes.”

There are now regulatory requirements, such as the General Data Protection Regulation (GDPR) or APRA’s CPS 234, that mean managing your information systems correctly must be part of your business processes.

Companies are increasingly hiring Chief Information Security Officers (CISO) and turning to cybersecurity software to ensure good decision making and strong security measures for their information assets.

Click here to return to table of contents

Cyber attacks aren’t your only problem

When organizations think about their threat landscape and cyber risk exposure, they often think about attackers with malicious intent from an outside organization or foreign powers attempting to steal critical assets, valuable trade secrets, or to spread propaganda.

However, data breaches are increasingly occurring from residual risks like poorly configured S3 buckets, or poor security practices from third-party service providers who have inferior information risk management processes.

To combat this it’s important to have vendor risk assessments and continuous monitoring of data exposures and leaked credentials as part of your risk treatment decision making process.

Risk avoidance isn’t enough.

Not only do customers expect data protection from the services they use, the reputational damage of a data leak is enormous. Not to mention companies and executives may be liable when a data leak does occur.

Click here to return to table of contents

Cyber risk management must be part of enterprise risk management

Every organization should have comprehensive enterprise risk management in place that addresses four categories:

Strategy: High-level goals aligning and supporting the organization’s mission
Operations: Effective and efficient use of resources
Financial reporting: Reliability of operational and financial reporting
Compliance: Compliance with applicable laws and regulations

Cyber risk transverses all four categorizes and must be managed in the framework of information security risk management, regardless of your organization’s risk appetite and risk sensitivity.

Click here to return to table of contents

How to think about cyber risk

Cyber risk is tied to uncertainty like any form of risk. As such, we should use decision theory to make rational choices about which risks to minimize and which risks to accept under uncertainty.

In general, risk is the product of likelihood times impact giving us a general risk equation of risk = likelihood * impact.

IT risk specifically can be defined as the product of threat, vulnerability and asset value:

Risk = threat * vulnerability * asset value

Click here to return to table of contents

What is a threat?

A threat is the possible danger an exploited vulnerability can cause, such as breaches or other reputational harm. Threats can either be intentional (i.e. hacking) or accidental (e.g. a poorly configured S3 bucket, or possibility of a natural disaster).

Think of the threat as the likelihood that a cyber attack will occur.

Click here to return to table of contents

What is a vulnerability?

A vulnerability is a threat that can be exploited by an attacker to perform unauthorized actions. To exploit a vulnerability, an attacker must have a tool or technique that can connect to a system’s weakness. This is known as the attack surface.

It’s not enough to understand what the vulnerabilities are, and continuously monitor your business for data exposures, leaked credentials and other cyber threats.

The more vulnerabilities your organization has, the higher the risk.

Click here to return to table of contents

What is asset value?

Arguably, the most important element of managing cyber risk is understanding the value of the information you are protecting.

The asset value is the value of the information and it can vary tremendously.

Information like your customer’s personally identifying information (PII) likely has the highest asset value and most extreme consequences.

PII is valuable for attackers and there are legal requirements for protecting this data. Not to mention the reputational damage that comes from leaking personal information.

Click here to return to table of contents

How to manage information security risk

Good news, knowing what information risk management is (as we outlined above) is the first step to improving your organization’s cybersecurity.

The next step is to establish a clear risk management program, typically set by an organization’s leadership. That said, it is important for all levels of an organization to manage information security.

Vulnerabilities can come from any employee and it is fundamental to your organization’s IT security to continually educate employees to avoid poor security practices that lead to data breaches.

This usually means installing intrusion detection, antivirus software, two-factor authentication processes, firewalls, continuous security monitoring of data exposures and leaked credentials, as well as third-party vendor security questionnaires.

Best in class vendor risk management teams who are responsible for working with third and fourth-party vendors and suppliers monitor and rate their vendor’s security performance and automate security questionnaires.

Click here to return to table of contents

Conclusion

Cybersecurity risk management is becoming an increasingly important part of the lifecycle of any project. Organizations need to think through IT risk, perform risk analysis, and have strong security controls to ensure business objectives are being met.

More importantly, your customer’s data must be secure regardless of your organization’s risk tolerance.

You need to control third-party vendor risk and monitor your business for data breaches continuously. Risk avoidance isn’t enough.

Organizations with information security policies but no security programs to protect their IT systems have insufficient security management practices.

Without comprehensive IT security management, your organization faces financial, legal, and reputational risk. Even if you’re non-technical leader, you need to be educated about cyber risk.