Risk management crucial to IT security, say experts

Any effective IT security strategy needs an element of risk management, according to security professionals who spoke at the recent European Information Security Summit in London.

They rationalised the importance of strategy based on the fact that it is clear that hackers also have one in place, and that they are using all of the resources at their disposal.

The Bank of England head security officer Will Brandon said:

“Cyber risk is not about technology alone; it is also about people and processes, and therefore it is about leadership and management.”

He said that is it crucial for all business leaders in the UK to be responsible for the risk, and that means that they would need to be more aware of the risks before they are in a position to manage it.

Brandon added:

“Any cyber risk is combination of threats, vulnerabilities and assets – and all three have to be present for a risk to exist.”

Other than being aware of the threats, businesses need to recognise which systems and data are most crucial, as well as the vulnerabilities.

Businesses can handle vulnerabilities most effectively by emphasising their technologies, processes and people, as well as identifying weaknesses and exercising damage control.

This is why security and IT risk management jobs are so important in today’s organisations. Managers need to know about risk management issues, but they are never going to be as knowledgeable as those who have invested the kind of training that builds a full-time career. Undoubtedly, hiring such professionals is crucial in the current threat-infested environment.