Security Risk Management - The Driving Force for Operational Resilience: The Firefighting Paradox (Internal Audit and IT Audit)

The importance of businesses being ‘operationally resilient’ is becoming increasingly important, and a driving force behind whether an organization can ensure that its valuable business operations can ‘bounce back’ from or manage to evade impactful occurrences is its security risk management capabilities.

In this book, we change the perspective on an organization’s operational resilience capabilities so that it shifts from being a reactive (tick box) approach to being proactive. The perspectives of every chapter in this book focus on risk profiles and how your business can reduce these profiles using effective mitigation measures.

The book is divided into two sections:

1. Security Risk Management (SRM).

All the components of security risk management contribute to your organization’s operational resilience capabilities, to help reduce your risks.

• Reduce the probability/ likelihood.

2. Survive to Operate.

If your SRM capabilities fail your organization, these are the components that are needed to allow you to quickly ‘bounce back.’

• Reduce the severity/ impact.

Rather than looking at this from an operational resilience compliance capabilities aspect, we have written these to be agnostic of any specific operational resilience framework (e.g., CERT RMM, ISO 22316, SP 800- 160 Vol. 2 Rev. 1, etc.), with the idea of looking at operational resilience through a risk management lens instead.

This book is not intended to replace these numerous operational resilience standards/ frameworks but, rather, has been designed to complement them by getting you to appreciate their value in helping to identify and mitigate your operational resilience risks.

Unlike the cybersecurity or information security domains, operational resilience looks at risks from a business-oriented view, so that anything that might disrupt your essential business operations are risk-assessed and appropriate countermeasures identified and applied. Consequently, this book is not limited to cyberattacks or the loss of sensitive data but, instead, looks at things from a holistic business-based perspective.

Jim Seaman honed his skills and craft during a 22-year career in the Royal Air Force Police, with the final decade being employed on Counter Intelligence, Computer Security, Counter Terrorism and Risk Management duties. On completion of his 22-years of military service, he sought the new challenge of transferring his specialist skills and knowledge across to the corporate sector. In the decade since transitioning across to the corporate environment, he has fulfilled roles within Payment Card Industry Data Security Standard (PCI D)SS compliance, data protection, information security, industrial systems security and risk management. In the past few years, he has sought to further develop his knowledge and to rise to the challenge of authoring two books, one on the subject of PCI DSS (published May 2020) and the other on Protective Security (published Apr 2021).

Michael Gioia is an information security leader with over 18 years of experience delivering security solutions across several industries. He has served as an officer in the United States Air Force and worked in higher education, the Department of Defense, retail food services, and security consulting. He has performed most of his information security work within higher education, currently, as the Chief Information Security Officer (CISO) for Babson College and formerly as the Information Security Officer (ISO) at Eastern Illinois University, Rose-Hulman Institute of Technology, and Bentley University. He retains various professional certifications that include a Certified Information Security Manager (CISM) and Certified Data Privacy Solutions Engineer (CDPSE) from ISACA, Certified Information System Security Professional (CISSP) from ISC2, GIAC Security Leadership Certification (GSLC) from SANS, and Payment Card Industry Professional (PCIP) from the PCI Security Standards Council.