From Scapegoat to Savior: The Risk Manager Story

Even in the toughest times, winners will invariably emerge. With the way expectations are changing regarding corporate controls and disclosure, risk management professionals (whose lack of influence was seen as a substantial cause of our current state of affairs to begin with) will likely be among the first beneficiaries of our new outlook on business.

Forrester customer inquiries seem to have taken a step back when it comes to risk management. While there are still plenty of incoming technology and vendor selection questions, there has been a noticeable spike in calls about fundamental issues, such as how to build and organize risk management programs. Knowledge and experience in risk management basics is in high demand.

Last week, the New York Times emphasized this demand by highlighting the current value of graduate degrees or certification related to risk management. The article explains:

“Among the hot areas now are positions related to minimizing risk, as firms try to mitigate the chances of another financial crisis. Risk in general is a relatively new focus, and the openings range from business, credit and operational risk to product and technology risk.”

Bank Technology News printed a more in-depth article about the rise of the risk management profession earlier this month, stating:

“...strategic soul-searching is going on in bank boardrooms and executive suites, but it's the chief risk officers that must carry out the emerging marching orders to accurately assess all forms of risk, and ensure that risk posture is in line with the institution's appetite.”

The article goes on to say that this added responsibility will also tear open some of the covers risk managers could previously use to avoid blame that might come their way. With increased budget and influence, it’s much harder to claim ignorance or innocence when things go wrong.

 In any case, much will be expected of risk managers in the immediate future, and I’m eager to see the professional step up and take on more of the spotlight.

In security, weird shift happens

I just created a slide with a giant squid on it . . .

 

. . . so I think maybe it’s time to ask for your help.

 

It occurred to that I haven’t yet started blogging since I joined the Security & Risk team here at Forrester. My new job has me looking after our global research agenda for all things related to information security and risk management. So as I attempt to put pen to paper I was thinking, “where do I start?” Well, luckily that’s easy: Talk about our upcoming Security Forum.

 

One of the cool things about being a Research Director at Forrester is that you get to champion events. Last year I had the pleasure of championing our first ever IT Infrastructure & Operations Forum. Well, no good deed goes unpunished, so when I took over the security team I was immediately thrust back into planning for this September’s Security Forum (coincidentally, the event is being held in the exact same hotel as the Infrastructure & Ops event — so at least this time I’ll be in a better position to direct attendees to the facilities). And I kid about the punishment part. Putting on a good forum is a ton of work, but it’s extremely rewarding all said and done!

 

So what does an event champion do? Glad you asked. In short, I work with our events team to pick the theme, plan the content, write all the marketing collateral, recruit the Forrester and industry speakers, vet everybody’s presentations, practice the keynote, and, eventually, act as MC for the event.

 

Back to the squid.

 

That’s where I’m stuck. As part of my MC responsibilities I have to do the opening remarks. This kicks off the whole event. A good opening has to be informative, yet humorous. Short, but memorable. Deliver some value, but not take away from the keynotes. Basically, I have to set the tone for the event. Now, don’t get me wrong, I enjoy the spotlight. It’s just hard work to come up with a high impact opening for eight keynotes and 15 breakout sessions.

 

That’s where you come in. I’m looking for advice, thoughts, jokes, anecdotes, pretty much anything that will help me kick off the forum in style. But for that you’ll probably need some background first . . .

 

The theme of this year’s Forum is all about the shift in the security and risk management landscape. In fact, in a rather glib moment of weakness, I chose to make the tagline for the event “shift happens.” Where’d that gem come from? We've been discussing “change” for years. In fact, impending change has been the underlying theme for the first three Security Forums dating to 2006. We’ve always talked about how the future of IT will bring dramatic changes to workplace dynamics, sourcing models, and application portfolios. But change is no longer hypothetical — it's real. We need to move beyond discussions of the economy plunging into free fall and the resulting decrease in budgets, jobs, and discretionary security projects. This year we’re focusing on helping CISOs and other info sec pros understand how to navigate the new security reality in today’s topsy-turvy business climate. Each keynote and track sessions will focus on helping attendees master three major shifts: 1) a shift in business expectations; 2) a shift in ownership; and 3) a shift in security architecture.

 

So how about it? Does anyone have an interesting story about security teams facing change? Maybe something to do with Web 2.0 like Twitter or Facebook. I’ll give full credit for any and all ideas. Please leave any comments on the blog or send me a tweet.

 

Ok, so back to writing my opening remarks. What comes after a giant squid . . .

Denial Of Service Attacks Have The Internets All A Twitter

My BlackBerry battery died more quickly than usual yesterday as I received a wave of calls from reporters wondering about the denial of service (DoS) attacks against Facebook, Twitter, and other social networking sites.  It seems many people are not aware of the long and storied history of denial of service attacks and this is their first personal experience with DoS. These types of DoS attacks have been around since the creation of the public Internet. A 15 year old named Mafiaboy famously brought down many of the top Websites of the day at the beginning of this millennium using similar techniques.

It appears that yesterday's attack was a distributed denial of service (DDoS) attack where a large number of hosts controlled by the same attackers were used to launch a coordinated attack against social networks. Over the course of the next few days and weeks we should see some more detailed information about the anatomy of this attack, but for now blame has been spread all across the usual suspects. Will we ever know who was behind this? Probably not. Mafiaboy was caught because he bragged about his exploits in Internet chat rooms. If the Twitter attackers stay quiet, they will be hard to find.

The good news is that this really didn't disrupt business or cause damage to sensitive data. It was merely an inconvenience. In fact it would have gone unnoticed like the thousands of DoS attacks before it if Twitter and Facebook weren't the flavors of the month. Things could've been worse. Banks, eCommerce sites or credit card networks could have been targeted. Real money could've been lost. Hopefully this is a wakeup call to organizations that they need to take proactive measures to protect their networks from all types of attacks.

[Posted by John Kindervag]

Hathaway resigns … another one bites the dust

Hathaway joins a distinguished group of highly respected and accomplished people who have quit the position of Cybersecurity Czar. She wasn’t even the actual Cybersecurity Czar, she was just the acting one, but it appears even that was too much to take for her. She cited personal reasons for resigning, but media reports suggest a more plausible reason for resigning – frustration at “spinning her wheels” and not being able to accomplish anything. Sounds familiar, doesn’t it. Whether you are a Cybersecurity Czar or a CISO, the challenges for this position are very similar. 

• CISO role is a thankless one – with a lot of responsibility and no authority.  This job has already been rumored to be rejected by as many as 30 potential candidates. Forbes notes that among those who have said "no" to the position are former Virginia Sen. Tom Davis, Microsoft security executive Scott Charney, and Good Harbor Consulting Executive Paul Kurtz. The reason many are tempted to consider this position is that it looks great on paper. The role is accountable for protecting the nation’s cyber infrastructure had dual reporting relationship to NSC and National Economic Council (NEC) but as many candidates found out, it actually has very little authority to do anything substantial.
• CEO (and the President) diligently pays lip service to security. Many security professionals  were excited to hear the USPresident laying out the high level objectives of his administration in the area of cybersecurity and claiming cybersecurity as a national security priority during his speech on May 29^th. Even after Hathaway’s resignation the rhetoric from the white house is impressive. The wall street journal article reports:

Cybersecurity is "a major priority for the president," White House spokesman Nicholas Shapiro said, adding that the administration is "pursuing a new comprehensive approach to securing America's digital infrastructure." In the search to fill the top cyber post, "the president is personally committed to finding the right person for this job, and a rigorous selection process is well under way," he said.

• Without political clout, you are bound to fail. As Ms. Hathaway found out – access to the President was not as easy as she was made to believe, and getting out of favor with some of his advisers (President’s economic team) meant that she was not able get the support she needed to progress her agenda. Also, similar to many corporate environments, not everybody wants you to succeed. This  role could potentially encroach on other turfs, or at least make them do additional work – so it was not in their best interest to see this role succeed. Without getting buy-in from these stakeholders – you are guaranteed to fail.
• Other business priorities take precedence. It was widely expected that President Obama would name the new Security Chief during his speech on May 29^th, but to our disappointment he did not. It has been two months and there is no appointment in sight. Obviously other priorities such as our nation’s financial crisis and healthcare take precedence over this issue – and security comes way down in the list of priorities.
• Companies will not take security seriously unless they get hit. This is an unfortunate but true. Many companies (and in this case the government) does not recognize the gravity of the situation unless they are affected by it first hand. The recent attacks on the electric grid system and sensitive government information assets should serve as a warning sign to the administration. Many organizations have found an attentive management and a lot more willingness to spend money on security only after an unfortunate disaster.

Let's hope the Obama administration moves from rhetoric to action before something drastic happens.