April 18, 2017 By Rick M Robinson 2 min read

The scope and sophistication of cybercrime continues to grow, with the Dark Web marketplace evolving to provide an ecosystem and even a language designed for the needs of organized crime and other bad actors.

In the face of this challenge, enterprises are still too reactive in their cybersecurity practices. This remains the case even though almost everyone understands that policies shaping governance, risk and compliance (GRC) can and should provide a solid framework for a more proactive approach to security.

Navigating Through Risks and Regulations

According to Infosec Island, enterprises must have a strong “appetite for risk,” because it is the inevitable flip side of opportunity. However, organizational leaders face real frustrations in finding an effective approach to GRC.

Governmental regulations, which set the overall legal and administrative framework, tend to operate within siloed industry verticals, rather than extending in a consistent way across industries. This complicates the challenge for any enterprise that is not itself confined to one vertical.

Organizational leaders also create their own complications by pushing audit demands and other requirements onto IT teams with no regard to workload. They are placing increased responsibility on people who already have very full plates.

The Art of GRC Tool Selection

Fortunately for these overworked teams, there is light at the end of the tunnel. The security community and marketplace are providing a growing range of GRC tools that organizations can use to help keep up with their governance, risk and compliance requirements. The challenge for security professionals is to evaluate the available products and present action-ready options to the C-suite. No one else can perform this crucial role, since most organizational leaders lack the specialized training needed to judge these tools.

The first item on the checklist of GRC tool requirements is affordability, which is not a technical dimension in itself, but is essential for any solution that can be adopted. Many organizations cannot afford a full-blown enterprise suite, but most can benefit from some select tools.

Other features to look for include mitigation, remediation and delegation resources to track progress and responsibilities, risk management tools to evaluate the threat of third-party breaches, and policy libraries, mapping and views that assist those working with the tools.

Selecting effective GRC tools and achieving buy-in from the C-suite is not a simple task. But ultimately, the effort will pay dividends and build mutual confidence between organization leaders and security experts. This confidence is crucial to building effective security in a dynamic, quickly evolving security environment.

Listen to the podcast series: Take Back Control of Your Cybersecurity now

More from Risk Management

How will the Merck settlement affect the insurance industry?

3 min read - A major shift in how cyber insurance works started with an attack on the pharmaceutical giant Merck. Or did it start somewhere else?In June 2017, the NotPetya incident hit some 40,000 Merck computers, destroying data and forcing a months-long recovery process. The attack affected thousands of multinational companies, including Mondelēz and Maersk. In total, the malware caused roughly $10 billion in damage.NotPetya malware exploited two Windows vulnerabilities: EternalBlue, a digital skeleton key leaked from the NSA, and Mimikatz, an exploit…

ICS CERT predictions for 2024: What you need to know

4 min read - As we work through the first quarter of 2024, various sectors are continuously adapting to increasingly complex cybersecurity threats. Sectors like healthcare, finance, energy and transportation are all regularly widening their digital infrastructure, resulting in larger attack surfaces and greater risk exposure.Kaspersky just released their ICS CERT Predictions for this year, outlining the key cybersecurity challenges industrial enterprises will face in the year ahead. The forecasts emphasize the persistent nature of ransomware threats, the increasing prevalence of cosmopolitical hacktivism, insights…

How I got started: Ransomware negotiator

4 min read - Specialized roles in cybersecurity are proliferating, which isn’t surprising given the evolving threat landscape and the devastating impact of ransomware on many businesses.Among these roles, ransomware negotiators are becoming more and more crucial. These negotiators operate on the front lines of cyber defense, engaging directly with cyber criminals to mitigate the impact of ransomware attacks on organizations.Ransomware negotiators possess a unique blend of technical expertise, psychological insight and negotiation skills that allow them to navigate the high-stakes environment of ransomware…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today