, 15 tweets, 3 min read Read on Twitter
Cybersecurity is not the only technology risk. A thread (hopefully obvious).

In fact, when you total up actual losses it is likely not even the biggest risk. Although I think it is the risk which is increasing the most and has the highest potential existential impact.

1/15
Ignoring wider business risks (process, financial, strategic, legal/regulatory) - just focusing on technology risks:

- Failed projects. Actual and opportunity costs of large-scale failed projects and the organization consequences of failed transformation.

2/15
- Software errors. Not just security vulnerabilities but regular bugs/errors/design flaws that cause outages, processing errors and financial loss.

- Hardware and telecommunications issues. Failures associated with outages of systems and networks.

3/15
- Accumulation of end-of-life systems with consequent lack of preventative maintenance.

- Capacity, failures under load causing losses due to outages or incomplete transactions.

- The list could go on.

There are four main points here:

4/15
1. To focus exclusively & exhaustively on cyber at the expense of the other risks (falling victim to the wrong aside of the Risk = Hazard + Outrage formula) will result in bad outcomes.

5/15
2. More importantly, the best mitigations for cybersecurity risk are also great mitigations for all the other risks - solid IT project management aligned to business objectives delivered incrementally, improved software development and testing, resiliency engineering,......

6/15
...incident learning/continuous improvement, engineering for scale and capacity testing, predictable configurations, system isolation, and so on. The best organizations at cyber are also obsessed with the other risks and treat this as a whole portfolio of risks.

7/15
3. Managing these as a portfolio of risks enables a better selection of control practices, for example in some cases security decisions can increase brittleness and reduce resilience - managing risks together reduces the instances of these negative combinations.

8/15
Controls in each risk category can enhance or degrade the controls in other risk categories. Managing them as a portfolio increases the likelihood of positive selection and also increases efficiency by finding controls that mitigate multiple risks.

9/15
4. Management oversight. Board or other risk metrics can be expressed over a set of risks for which the important by-product is the shared accountability of all the leaders across that range of risks from CIO/CTO, CISO, COO to CFO.

10/15
For example, if the Board holds management accountable for appropriate investment in reliability and elimination of end-of-life systems as opposed to just the CISO for patch levels that can’t be achieved on end-of-life systems then the right outcome is more likely.

11/15
An aside, I remember July 8, 2015 well. The New York Stock Exchange had an outage for most of the day. United Airlines were grounded, globally, for most of the day. The Wall Street Journal web site was down. The news media were hypothesizing a wide scale cyber-attack.

12/15
But this was, respectively, a software error, a network outage and web site capacity issue. There were plenty of other issues that day that didn’t get coverage - all related to software/hardware issues, and I’m sure plenty of failing IT projects were unfolding as well.

13/15
However, this was also about the time of the OPM breach - so there was some cybersecurity issues going on - although when you look at the OPM breach and plenty of others there are many non-cyber root causes to go around as well.

14/15
Bottom line : cybersecurity risk is but one (albeit extremely important) risk in a portfolio of other risks. Portfolios of risk need to be managed taking into account the dependencies [positive and negative] between the mitigations.

15/15
Missing some Tweet in this thread?
You can try to force a refresh.

Like this thread? Get email updates or save it to PDF!

Subscribe to Phil Venables
Profile picture

Get real-time email alerts when new unrolls are available from this author!

This content may be removed anytime!

Twitter may remove this content at anytime, convert it as a PDF, save and print for later use!

Try unrolling a thread yourself!

how to unroll video

1) Follow Thread Reader App on Twitter so you can easily mention us!

2) Go to a Twitter thread (series of Tweets by the same owner) and mention us with a keyword "unroll" @threadreaderapp unroll

You can practice here first or read more on our help page!

Follow Us on Twitter!

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just three indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3.00/month or $30.00/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!