Exploring Enterprise Security Risk Management

Enterprise security risk management (ESRM) is a comprehensive approach organization employ to identify, assess, and mitigate security and compliance risks which could impact their operations, assets, and overall business objectives. ESRM encompasses various activities, such as risk assessment, threat analysis, vulnerability identification, risk treatment planning, and continuous monitoring to ensure ongoing security and protection of critical assets and information within the enterprise. This process helps organizations make informed decisions and allocate resources effectively to reduce the likelihood and impact of security incidents and breaches. 

Even though ESRM follows a structured process, it is important to note the specific steps and terminology used in ESRM can vary depending on the organization and the framework used by the respective organization. Organizations may adopt established frameworks such as International Organization for Standardization – ISO 31000, National Institute for Standards and Technology (NIST) Cybersecurity Framework- CSF-2.0 (draft) or develop their customized ESRM approach. ESRM involves a series of steps:

Risk identification – The organization identifies potential security risks, including internal and external threats, vulnerabilities, and weaknesses in its systems, processes, and infrastructure.

Risk assessment – In this step, the identified risks are evaluated based on their likelihood of occurrence and potential impact on the organization. Thorough risk evaluation helps prioritize risks based on their significance.

Risk mitigation – After assessing the risks, the organization devises strategies and action plans to mitigate or reduce the likelihood and impact of these risks. The organizations implement security measures, internal controls, policies, and procedures to achieve the desired effects. 

Risk monitoring – Continuous monitoring of the security landscape is essential and needs to track any changes in the risk environment and ensure the implemented security measures remain effective and up to date.

Risk communication – Effective communication of security risks and mitigation strategies is essential to ensure all stakeholders know potential threats and their roles in safeguarding the organization.

Risk reporting – Regular reporting on security risk management activities and the effectiveness of implemented measures are essential for management and relevant stakeholders to make informed decisions.

It is clear ESRM aims to create a proactive and adaptive security posture, enabling organizations to respond quickly and effectively to emerging threats and challenges. By incorporating ESRM best practices into their operations, enterprises can enhance their resilience and protect critical assets, sensitive information, overall business interests, and reputation.

It is pertinent to examine the ESRM model beyond the traditional model to further achieve organizational strategic objectives in a challenging environment under a different context. In this context, the military risk management model could be a valuable foundation for achieving the above outcome. The military risk management model and ESRM share similar approaches to managing risks and achieving their objectives. Here are some key comparisons:

Hierarchical structure – The military and corporate ESRM have hierarchical structures to ensure efficient decision-making and clear command lines. In the military, there are ranks and chains of command, while in corporations, there are levels of management and reporting structures.

Risk assessment – Both the military and ESRM involve rigorous risk assessment processes. In the military, this entails evaluating potential threats, vulnerabilities, and the impact of various actions. Similarly, corporate ESRM assesses security risks to identify potential threats, assess their likelihood, and determine their potential impact on the organization’s objectives and business continuity. 

Resource allocation – Both models involve resource allocation based on identified risks. In the military, resources are allocated based on mission requirements in order to preserve combat efficiency and achieve the end state. In corporate ESRM, financial resources, and security measures are allocated based on the identified security risks and the organization’s risk appetite.

Incident response – Both the military and ESRM have well-defined incident response protocols and contingency plans. In the military, response plan activation occurs when a threat is imminent or attacks occur. In corporate ESRM, incident response plans outline the actions to take in case of security breaches or other incidents.

Training and preparedness – Both models emphasize the importance of training and preparedness. Military personnel undergo rigorous training to be ready for various scenarios. In corporate ESRM, employees are trained to recognize security risks and follow best practices to minimize potential threats.

Continuous improvement – Both the military and ESRM strive for continuous improvement. Lessons learned from past experiences are used to refine strategies, policies, and procedures for future operations.

Collaboration and communication – Effective collaboration and communication are vital in the military and corporate ESRM. In the military, teamwork and coordination are essential for mission success. In ESRM, cross-functional collaboration and communication ensure security risks are addressed holistically across the organization.

Despite these similarities, it is important to note the military model focuses on achieving strategic objectives through force and defense. At the same time, corporate ESRM is centered on protecting assets and information to support business continuity and safeguard organizational interests. While they share common principles, the application differs from end states and goals.

Integrating elements of the military model into corporate ESRM can enhance the organization’s security posture and preparedness. Here are some ways to do so:

Risk assessment and threat intelligence – Adopt military-style risk assessment methodologies, which involve analyzing potential threats, vulnerabilities, and consequences in a structured manner. Incorporate threat intelligence gathering and analysis to stay informed about emerging security risks and make timely changes within the organization to preserve organizational resilience.

Incident response planning – Develop an incident response plan inspired by military strategies. Define clear roles and responsibilities, establish incident escalation procedures to meet the requirements of rapidly changing threat landscapes, and conduct realistic drills regularly to ensure the organization is well-prepared to handle security incidents effectively.

Command structure – Implement a clear command structure within the ESRM team, analogous to military chains of command to ensure quick decision-making and efficient communication during crises.

Training and drills – Conduct regular training sessions and exercises to prepare employees for various security scenarios to build a culture of security awareness and readiness throughout the organization.

Defensive tactics – Learn from military defensive tactics to protect physical assets, information systems, and data. Implement layered security measures, access controls, and encryption to strengthen the organization’s defenses against threats.

Contingency planning – Develop contingency plans for critical operations and assets, just as the military plans for alternative courses of action to ensure the organization can adapt and respond effectively to unexpected security challenges.

Threat mitigation – Utilize military principles of proactive threat mitigation. Consider conducting red teaming exercises to simulate potential attacks and identify vulnerabilities, enabling the organization to address weaknesses before adversaries exploit them.

Adaptability and resilience – Learn from the military’s ability to adapt and be resilient in challenging environments. Build a flexible ESRM strategy which can respond to evolving security threats and changing business requirements.

Collaborative approach – Encourage cross-functional collaboration, as seen in military joint operations, to foster a unified and coordinated approach to security risk management across the organization.

Learn from military case studies – Study historical military case studies and operations to extract relevant lessons and insights on leadership, adaptability, and resilience under challenging circumstances. Apply these lessons to corporate ESRM, tailoring them to the company’s specific organizational context and security challenges.

By integrating elements of the military model into corporate ESRM, organizations can enhance their security readiness, improve incident response capabilities, and create a culture of security awareness and preparedness throughout the organization. Risk management is an ongoing process which requires continuous improvement. The military regularly reviews and updates risk management strategies and best practices based on evolving threats, technological changes, and lessons learned from incidents or reviews. In the corporate world, it mainly depends on directives of regulatory authorities such as NIST, ISO, etc. In this context, in the corporate world, individual organizations have little leverage or latitude for accelerated actions for timely changes for betterment. Finally, it is crucial to adopt best practices thoughtfully to suit the corporate context, as the military and corporate environments differ significantly in their objectives and operational requirements. Nevertheless, it is vital to develop robust ESRM to optimize business continuity while maintaining critical operations in the face of security incidents or disruptions and bolstering their security efforts better to protect assets, data, and reputation.

ABOUT THE AUTHOR

Suminda Jayasundera

Suminda Jayasundera is a retired military officer in the rank of lieutenant colonel. During his illustrious military career, have held many important appointments including a tour of duty in the United Nations. After his retirement, he entered the corporate sector, where he excelled in crisis management, global security management, and business continuity management. He holds a master’s degree in defense management and a graduate of Army Command & General Staff College, Ft. Leavenworth, Kan. He acquired further education from New Jersey Institute of Technology in emergency management, business continuity, and Federal Emergency Management Agency. Jayasundera holds certifications in business continuity management, cybersecurity, and risk, and compliance management.