Abstract:

The fast-paced information age has been instrumental in accelerating many digital developments that have been happening for a while now. The past decade has seen enormous digital knowledge gaining significance. The advancements in computing power and miniaturization have contributed enormously the growth of human knowledge due to which, just in the last decade the consumption of digital datasets have risen exponentially. But like Spiderman would say, “With great power comes great responsibility.” And the responsibility here is Cybersecurity.

Reports have suggested that in the US at every 39 seconds a computer is getting attacked by hackers. And while the impact of cyber breaches is critical, shocking, growing and evolving on a day-to-day basis, the gist of it is that it can bring down organizations and even nation states. The only possible way to prevent this is cybersecurity. So, now the question arises – How can cybersecurity manage risk in the information age? The straightforward answer to this would be cybersecurity risk management. The current complexity of the cyber world makes it imperative to address the multiple components of cybersecurity and how it impacts the risk strategies for an organization. The article investigates the cyber universe risk mandates and the processes and functions involved in risks, threats, role of leadership, mandates of law and their inter-connected relationship with cybersecurity.

Introduction:

Given that globalization has transformed economic markets into a strongly interconnected system at the international level, the risks for companies are no longer isolated depending on the branches of activity or location. Entrepreneurial education discusses the need for continuous information about the dynamics of the business environment, entrepreneurs being advised to be up to date with legislation, economic news, capital market trends, competition, dynamics of inflation, naming all of them essential elements that any investor must know.

All the elements of the market described above are in fact information, data of different structure with different degree of sensitivity that become the source of establishing strategies and future prospects in business. Nowadays data is the most vulnerable link and the biggest investment in the entrepreneurial image, because treated without the aspect of information security it may fall at the risk of losing confidentiality, integrity or availability. For example, according to a report published

by the Identity Theft Resource Centre in 20201, the United States saw approximately 1,100 reported data breaches affecting more than 300 million individuals and average ransomware payout topped $233,000 (USD) per instance.2

We were and are educated in the business environment to look at internal and external risks,
but under what spectrum? Usually only under the economic-financial one, but in the era of computerization this is not enough, our visions must be as open as our perspectives on globalization and limitless development.

Information has been and is essential in business. At the stage of evaluating and planning the context of the organization, an exhaustive estimation of risks and opportunities is needed, many companies going into insolvency because they overestimated their capabilities, had far too optimistic expectations about the potential. Even for risk-averse managers, it is increasingly difficult to anticipate and respond effectively to increasingly serious threats to the businesses they manage.

Nowadays as businesses, governments, financial institutions, and public sector organizations collect, store, and process vast amounts of sensitive and valuable data. As a result, cyber risk management has become a fundamental component of business operations and understanding and mitigating risk has become an essential skill for business leaders, thought leaders, analysts, as well as security and technology specialists.

This is also the reason why more and more companies use integrated risk management solutions, designed to ensure that their business can cope with the dangers of service quality and information security, that they are effectively implemented to give them time to recover.

Managing and mitigating risks of any kind is necessary for the survival of a company, regardless of its size, but not all hazards can be prevented with maximum efficiency, so it is better to develop proactive visions and plans to mitigate or treat identified risks.

Cybersecurity risk is business risk

Keywords: authorization, common control, information security, privacy, risk assessment, security risk.

The efficient synergy between IT and business tools has favored the development of a complex organizational infrastructure, which depends in its processes on a wide set of factors. At the moment it is impossible to draw a clear boundary between the security management system and the quality management system, so it is difficult to identify the boundaries between general risk management and information security management.

Technological evolution of transmission, processing and storage financial-accounting data gave rise to new concepts such as: cloud computing, real-time accounting or mobile reporting but at the same time brought with it and new threats underlying these new concepts. To hide malicious intentions and deeds, criminals continue to hone their techniques and methods of computer attacks. Users are caught at middle, now becoming not only targets for attackers but and possible facilitators or even accomplices. Users have has now become the most vulnerable link of security system. The literature reveals that development technology has brought with it extremely rapid progress of information security threats.

Unfortunately, for easy to understand reasons, cyber-attacks are not popular enough. But when the effects they can no longer be hidden, they shock through their magnitude. Examples of this are the big one’s enterprises forced to interrupt their activities because their information system has become dysfunctional, or when ATMs in a banking network become inoperable long enough to create dissatisfaction or even induce panic. It is imposed with need to assess the impact of cyber- attacks on multiple plans: legislative, technological, economic, social.

Identification, mitigation or elimination these are mandatory requirements without which an efficient management in the information age cannot be performed.3 Therefore, when elaborating a risk management strategy or a continuity plan, we must set from the beginning the context of the organization, objectives and principles of work to ensure the fullness gathered information. Basically, the aim of the management process is to understand that risks must be identified, classified, treated or mitigated by possibility.4

Data security experts suggest that the time is now to change the approach to cybersecurity to
get real network security and cybersecurity must be implemented in simplicity and with core
focus on an organisations key control systems, critical hardware and software and valuable data. Preventive and proactive cybersecurity measures such as employee sensitization and customer data understanding are more effective than high-end cyber management risk solutions, especially in the context of small to medium scale digital enterprises. Cybersecurity must be understood and implemented at all control and network levels and real time preventive protection, but also during and after an occurrence of an attack. The risks induced by cyber-attacks on business activity involves management risks to the security of information systems.

In every risk management processes there are three major elements to think about: the risk management principles, policy, framework and process documentation; the risk culture in the organization; the risk recording and sharing system. Organizations of different sizes and types face both internal and outside influences that can make it uncertain whether or not they will be able to accomplish their objectives. The impact of this uncertainty over a company’s goals is called “risk”.

In order to achieve the best results in implementing a cybersecurity risk management there
could be used some internationally known documents from the United States National Institute
of Standards and Technology’s (NIST)5 Cyber Security Framework or ISO Standards. ISO standards stand out in the risk management space, both of which provide crucial information for performing activities. The fundamentals of the NIST Cybersecurity Framework are showcased in figure1. The first of these is ISO 31000, because of its general context, it provides overall guidelines to any area of risk management (i.e., finance, engineering, security, among others)6. It suggests that companies should continually develop, implement, and improve a framework whose goal is to integrate
the process for managing risks associated with governance, strategy, and planning, as well as management, the reporting of data and results, policies, values and culture throughout the entire organization.

2023-03-16