Cybersecurity Risk Management: An ERM Approach

266 Pages·2022·6.181 MB·English

by  Kok-Boon Oh

CYBERCRIME AND CYBERSECURITY RESEARCH

C R
YBERSECURITY ISK
M
ANAGEMENT

A E R
N NTERPRISE ISK
M A
ANAGEMENT PPROACH

No part of this digital document may be reproduced, stored in a retrieval system or transmitted in any form or
by any means. The publisher has taken reasonable care in the preparation of this digital document, but makes no
expressed or implied warranty of any kind and assumes no responsibility for any errors or omissions. No
liability is assumed for incidental or consequential damages in connection with or arising out of information
contained herein. This digital document is sold with the clear understanding that the publisher is not engaged in
rendering legal, medical or any other professional services.
C
YBERCRIME AND
C R
YBERSECURITY ESEARCH

Additional books and e-books in this series can be found
on Nova’s website under the Series tab.
CYBERCRIME AND CYBERSECURITY RESEARCH

C R
YBERSECURITY ISK
M
ANAGEMENT

A E R
N NTERPRISE ISK
M A
ANAGEMENT PPROACH

KOK-BOON OH
BRUCE HO
AND
BRET SLADE
Copyright © 2022 by Nova Science Publishers, Inc.
DOI: https://doi.org/10.52305/TNSD3712

All rights reserved. No part of this book may be reproduced, stored in a retrieval system or transmitted
in any form or by any means: electronic, electrostatic, magnetic, tape, mechanical photocopying,
recording or otherwise without the written permission of the Publisher.

We have partnered with Copyright Clearance Center to make it easy for you to obtain permissions to
reuse content from this publication. Simply navigate to this publication’s page on Nova’s website and
locate the “Get Permission” button below the title description. This button is linked directly to the
title’s permission page on copyright.com. Alternatively, you can visit copyright.com and search by
title, ISBN, or ISSN.

For further questions about using the service on copyright.com, please contact:
Copyright Clearance Center
Phone: [phone] Fax: [phone] E-mail: [email protected].

NOTICE TO THE READER
The Publisher has taken reasonable care in the preparation of this book, but makes no expressed or
implied warranty of any kind and assumes no responsibility for any errors or omissions. No liability is
assumed for incidental or consequential damages in connection with or arising out of information
contained in this book. The Publisher shall not be liable for any special, consequential, or exemplary
damages resulting, in whole or in part, from the readers’ use of, or reliance upon, this material. Any
parts of this book based on government reports are so indicated and copyright is claimed for those parts
to the extent applicable to compilations of such works.

Independent verification should be sought for any data, advice or recommendations contained in this
book. In addition, no responsibility is assumed by the Publisher for any injury and/or damage to persons
or property arising from any methods, products, instructions, ideas or otherwise contained in this
publication.

This publication is designed to provide accurate and authoritative information with regard to the subject
matter covered herein. It is sold with the clear understanding that the Publisher is not engaged in
rendering legal or any other professional services. If legal or any other expert assistance is required,
the services of a competent person should be sought. FROM A DECLARATION OF PARTICIPANTS
JOINTLY ADOPTED BY A COMMITTEE OF THE AMERICAN BAR ASSOCIATION AND A
COMMITTEE OF PUBLISHERS.

Additional color graphics may be available in the e-book version of this book.

Library of Congress Cataloging-in-Publication Data

ISBN: (cid:28)(cid:26)(cid:27)(cid:16)(cid:20)(cid:16)(cid:25)(cid:27)(cid:24)(cid:19)(cid:26)(cid:16)(cid:24)(cid:19)(cid:24)(cid:16)(cid:26)(cid:11)(cid:72)(cid:37)(cid:82)(cid:82)(cid:78)(cid:12)

Published by Nova Science Publishers, Inc. † New York
Contents

List of Figures ....................................................................................... vii
List of Tables ........................................................................................ ix
Preface ........................................................................................ xi
Acknowledgments ................................................................................ xiii
List of Acronyms and Glossary ............................................................ xv
Chapter 1 Cyber Threats and Enterprise Risk ............................ 1
Chapter 2 Corporate Risk Environment and Cyber Risk ........ 23
Chapter 3 Cybersecurity Enterprise Risk Management .......... 43
Chapter 4 Standards and Regulations ........................................ 69
Chapter 5 Cyber Risk Identification ........................................... 93
Chapter 6 Cyber Risk Assessment ............................................. 115
Chapter 7 Cyber Risk Mitigation .............................................. 139
Chapter 8 Cyber Risk Monitoring, Detection and Reporting . 165
Chapter 9 Cyber Attack Response and Recovery .................... 179
Chapter 10 Strategic Cybersecurity Risk Management ........... 197
References ..................................................................................... 219
About the Authors ............................................................................... 239
Index ..................................................................................... 241

LIST OF FIGURES

Figure 1.1. Business strategy and risk management alignment. 5
Figure 1.2. Cybersecurity uncertainty and risk. 11
Figure 1.3. Risk types. 14
Figure 1.4. Chinese characters for “risk.” 15
Figure 1.5. Cyber risk and opportunity nexus. 16
Figure 2.1. Corporate risk environment. 26
Figure 3.1. Value creation from portfolio risk management. 46
Figure 3.2. ERM, SRM & ORM processes. 47
Figure 3.3. Five attributes of cybersecurity risk management. 48
Figure 3.4. Cyber risk control and ERM convergence. 51
Figure 3.5. ERM framework. 53
Figure 3.6. Strategic risk management. 54
Figure 3.7. Operational risk and crisis management processes. 55
Figure 3.8. Cyber risk exposure relationships. 59
Figure 3.9. SRM process for cybersecurity ERM. 64
Figure 3.10. Operational risk management/
crisis management cycle. 67
Figure 4.1. Standards categories. 74
Figure 4.2. ERM/SRM related standards. 75
Figure 4.3. ISO 31000 - framework, principles, and process. 76
viii List of Figures
Figure 4.4. ERM/ORM related standards. 79
Figure 4.5. NIST/CSF Framework core & ERM/ORM alignment. 81
Figure 4.6. NIST/CSF Framework Core. 82
Figure 4.7. ISO 27000 series standards (selected). 85
Figure 5.1. Risk identification phase in the ERM/ORM cycle. 95
Figure 5.2. ERM/ORM & NIST/CSF alignment. 102
Figure 5.3. Bow tie risk analysis. 109
Figure 6.1. Risk assessment phase in the ERM/ORM cycle. 118
Figure 6.2. Risk assessment –
ERM/ORM & NIST/CSF alignment. 120
Figure 6.3. Risk likelihood and impact matrix. 123
Figure 6.4. Heat maps showing severity levels of risks. 124
Figure 6.5. EMV based on potential impact and probability
of events. 129
Figure 6.6. Economic risk paradigm. 132
Figure 7.1. Risk mitigation phase in the ERM/ORM cycle. 141
Figure 7.2. Risk mitigation –
ERM/ORM & NIST/CSF alignment. 146
Figure 8.1. Monitor, detect & report risk
in the ERM/ORM cycle. 168
Figure 8.2. Monitoring, detecting, and reporting cyber risks. 168
Figure 8.3. Risk monitoring & reporting - ERM & NIST
CSF alignment. 174
Figure 9.1. Cyber crisis management cycle. 181
Figure 9.2. Incident response process. 187
Figure 10.1. Integrated cybersecurity ERM. 202
Figure 10.2. Cybersecurity strategic plan, vision, goals,
and objectives. 203