How Technology Reduces Enterprise Cyber Risk

TL;DR

Technology reduces cyber risk by revealing how data flows, who accesses it, and where protective controls are needed. Organizations should combine security technologies with established frameworks, clear metrics, and business communication, shifting attention from isolated technology risk toward enterprise risk while protecting their two most important assets: people and information.

Transcript

Hello, and welcome to this RSA Conference virtual session on the instrumental role of technology in the cyber epoch. I am your host, Brenna Dobbins of RSA Conference. During the session, all participants will be in listen-only mode. At the close of the presentation, we will conduct a question and answer session. At that time, if you have a question... Read More

Key Insights

• Technology is an instrument for protecting and defending people, information, systems, and devices regardless of where data resides. Its contribution comes from providing visibility into data movement, access, behavior, and the security controls needed across increasingly digital, virtual, and connected environments.
• Information is a vital organizational asset that requires assurance against cybersecurity threats. Companies need an approach that combines technical protection with enterprise-level risk management, allowing cybersecurity activity to support the organization’s overall risk appetite rather than remain confined to a technology department.
• The Internet of Things can become an Internet of Threats when pervasive connectivity is not paired with the right questions, controls, processes, and accountability. Connected webcams and other devices can be misused, including in distributed denial-of-service attacks involving large collections of compromised systems.
• The three dimensions of change are velocity, variety, and volume. Organizations must adapt to and adopt change across all three dimensions, while recognizing a fourth dimension, the value created by embracing change as a continuing discipline within the cyber epoch.
• Security technology works through complementary disciplines such as encryption, data leak protection, data loss prevention, endpoint protection, identity and access management, federation, log management, and intelligence. These capabilities help determine who is touching information, who has access, and how data should be defended.
• Frameworks are practical foundations for cybersecurity planning and governance. Organizations can use approaches such as COBIT 5 or ISO 27000, but the essential requirement is to select a framework, develop a plan, and combine processes and best practices with appropriate security technologies.
• Technology is valuable because it can provide evidence-based answers to business, audit, and legal questions. Executives, internal auditors, external auditors, or a court may request explanations, making visibility, reporting, and reliable insight necessary parts of an organization’s protective capabilities.
• Cybersecurity communication is most useful when it expresses metrics and indicators in business terms. Engaging executives through meaningful reporting helps demonstrate value, connect technical controls to enterprise priorities, and protect the two assets identified as most important for a company: people and information.

Questions & Answers

Q: How does technology reduce enterprise cyber risk?

Technology reduces enterprise cyber risk by showing how information flows, who accesses it, and where protective measures are required. Encryption, data loss prevention, endpoint protection, identity and access management, log management, and intelligence support this work. When these capabilities are combined with governance frameworks, planning, metrics, and business reporting, cybersecurity can address the risk appetite of the company as a whole.

Q: Why should cybersecurity move from technology risk to enterprise risk?

Cybersecurity should move toward enterprise risk because information protection affects the entire organization, not only its technology function. Companies need to connect security decisions with their overall risk appetite and business priorities. This broader perspective helps leaders understand the value of controls, establishes communication with the executive suite, and focuses protection on the organization’s two most important assets: people and information.

Q: How can the Internet of Things become an Internet of Threats?

The Internet of Things can become an Internet of Threats when connected devices operate without sufficient visibility, protection, governance, or accountability. The transcript cites attacks that used hundreds or tens of thousands of webcams to conduct distributed denial-of-service activity. Organizations can reduce this danger by asking the right questions of the right people at the right time and applying suitable processes and security controls.

Q: What security technologies help protect organizational data?

Security technologies named in the session include encryption, data leak protection, data loss prevention, endpoint protection, identity and access management, federation, log management, and intelligence. Together, these disciplines help organizations understand where data flows, who touches it, who is authorized to access it, and how sensitive information can be protected or prevented from leaving controlled environments.

Q: What are the three dimensions of change in cybersecurity?

The three dimensions are the velocity, variety, and volume of change. They describe how quickly change occurs, the different forms it takes, and the amount of change organizations must handle. A fourth dimension is the value of changing, which emphasizes the benefit of treating adaptation as a discipline. Organizations must adapt, adopt, and embrace these conditions within a rapidly changing cyber environment.

Q: Why do organizations need a cybersecurity framework?

A cybersecurity framework gives an organization a structured basis for planning, governance, processes, and protective action. The session mentions COBIT 5 and ISO 27000 as available approaches while stressing that organizations should use a framework, do something, and have a plan. The framework can then be combined with technologies such as encryption, access management, data protection, and security intelligence.

Q: How should cybersecurity teams communicate value to executives?

Cybersecurity teams should use metrics and indicators that express tangible value in business terms. Reporting should connect technical protections with enterprise priorities, overall risk appetite, and the protection of people and information. Clear communication channels with the executive suite help move cybersecurity beyond a specialized technology concern and position it as a contributor to business assurance and enterprise risk management.

Q: Why is visibility into data flows important for cybersecurity?

Visibility into data flows helps an organization understand where information moves, where it resides, who touches it, and whether access is appropriate. These insights support protection and defense across cloud services, endpoints, connected devices, and virtual environments. They also prepare the organization to answer questions from executives, internal auditors, external auditors, or a court using information produced by its security capabilities.

Summary & Key Takeaways

• Technology has an instrumental role in protecting organizations during an era when systems, devices, people, and information are pervasively connected. Its central purpose is to help organizations understand data flows, control access, prevent information loss, encrypt sensitive material, protect endpoints, and produce answers when executives, auditors, or courts ask questions.

• The Internet of Things can become an Internet of Threats or Internet of Trouble when organizations fail to ask the right questions of the right people at the right time. Connected technologies therefore require deliberate protection, governance, and insight, supported by security disciplines and frameworks that translate connectivity into controlled business value.

• Cybersecurity should move from a narrow focus on technology risk toward the broader management of enterprise risk. Organizations can support this shift by protecting people and information, embracing the velocity, variety, and volume of change, and reporting meaningful metrics and indicators to executives in clear business terms.