GRC Journal - (Page 8) OffICER IT: MANAGING YOuR ENTERPRISE’S RISkS and processes that you can layer on top of your infrastructure. It’s a bigger view of the enterprise IT systems and how they integrate and support one another. Automated controls and real-time monitoring results have proven to be very compelling, by reducing the overall costs and complexity of our systems. It has made it easier for our compliance organization to test and verify that our risk mitigation efforts are effective, which in turn reduces the overall cost associated with a very manual intensive risk program. JM: There should be very little argument that automating controls can provide value to organizations through reduced compliance costs and the potential to better identify risks over time. But just as IT’s objectives have moved from cost reduction to business value over the past several years, the opportunity to use holistic GRC approaches to drive value is great. Cisco believes that linking the business context and business controls to the network is really the equivalent of giving the brain a complete nervous system. As the only corporate asset that spans the entirety of the enterprise – not just the formal enterprise, but the extended enterprise and all its devices, systems, and sensors – the network can provide true real-time information, not just about technology events, but information about users, systems, and key business processes well before the information would be in systems of record. Likewise, linking the network to an ERM framework, the millions of events that happen every minute can be normalized, correlated, and presented according to a specific business process model. And critically, once a decision needs to be made, the network can play a critical enforcement role in a more timely and efficient fashion than possible today. Here are a couple of examples: • An integrated and pervasive system could help identify potential service level violations or risks as an adjunct to existing CRM and/or supply chain management systems. • An advanced system could use sensor data to track sensitive inventory and then escalate problems to appropriate individuals using unified communications technologies based strictly on policy. • An integrated system could identify and enforce secure communications across the enterprise to ensure that sensitive data was treated appropriately. Combining these capabilities and both risk aided decisionmaking and control is a breakthrough. Discuss how to prevent, detect, correct, and escalate critical risk issues with integrated systems. BW: We started by establishing an IT compliance group that reports to the CIO. Their charter is to understand critical risks issues with our integrated systems and processes from an IT perspective. This group works in partnership with other compliance groups on the business side, as well as the internal IT groups that manage and maintain our systems, to address risks at an enterprise level. A good example of how these teams work well together to lower risk is how we are able to identify critical risk issues as we implement our integrated ERP systems and provide recommendations to address these risk issues at the architecture/design phases of the project. Furthermore, as we approach the testing phase of our projects, we are able to test the business and IT preventive and detective controls to 42 BTQ assess the effectiveness of our controls from a risk mitigation perspective. This combined view of the project and its place in the enterprise risk management strategy really elevate what the team can accomplish, and greatly lowers the risks associated with an enterprise-wide implementation. By taking advantage of the latest technology, we are able to prevent many of the typical risk issues. For example, our systems utilize self-healing technology – an automated control which reduces our risk of down time; containers – a service that allows us to greatly reduce the risks around patch management and change control; and policy enforcement technology – an automated control which audits our systems and escalates any issues for resolution. AC: Technology allows real-time information to be taken into consideration with risk identification and risk analysis. Leveraging information from various operational systems across the enterprise, certain patterns in data, and certain thresholds that have been preconfigured, can be monitored for exceptions. Some of these “exceptions” that are found will be actual risks; others may just be informational notes. In any case, sophisticated sorting algorithms will ensure that these alerts will be evaluated at some point in their full business context by an experienced manager. Here, too, IT plays an important role in both identifying the correct escalation path for the information, and sending it to the person in the manner that makes most sense – on a cell phone, mobile device, as an alert in a dashboard, as an email, or an entry in a task list. However, the alert information alone is not enough – the context must be reviewed as well – the full value of the customer relationship or the production planning for the next three months, for example. This information can be included if the enterprise systems are integrated. This manager will make the decision of how to respond to the risk – whether mitigation is required or whether to accept the risk as part of normal business. Many enterprise systems offer controls that can be integrated into business processes targeting specific risks. These preventive controls can ensure that the risk situation won’t come up again since they are set up and configured to become a part of the business process. JM: While there are millions of events that happen across an enterprise and on the network every hour, the critical value in such an integrated system is the ability to identify and operate around those most critical business priorities. Once an organization identifies these critical processes and the controls needed to implement them, an integrated system can deploy the controls and enforce their action across the entire extended enterprise. In short, an integrated solution could provide the following: • The ability to detect and assess: This helps balance financial, legal, and operational risks, as well as rationalize controls against multiple frameworks, enabling the organization to correlate frameworks such as Control Objectives for Information and related Technology (CoBIT) against company policies. Built-in event services ensure that the solution detects issues quickly and aggregates them to enable intelligent evaluation of necessary action. • The ability to measure and monitor: The solution would automatically monitor relevant events in multiple enterprise applications, as well as mobile devices, radio frequency Business Trends Quarterly Q1 2007 | www.btquarterly.com http://www.btquarterly.com
For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.