Abstract
As organizations accelerate digital transformation with mobile devices, cloud services, social media, and Internet of Things services, cybersecurity has become a key priority in enterprise risk management. While improving cybersecurity leads to higher levels of customer trust and increased revenue opportunities, rapidly evolving data protection and privacy regulations have complicated cybersecurity management. Against the backdrop of rapidly rising cyberbreaches and the emergence of novel cybersecurity technologies such as machine learning and artificial intelligence, this article introduces a cyber risk management framework, discusses a cyber risk assessment process, and illustrates a continuous improvement of cybersecurity performance and cyberinvestment cost analysis with a real-world cybersecurity example.
1. Introduction
According to ISO/IEC 27032:2012, cybersecurity is defined as preservation of the confidentiality, integrity, and availability of information in complex environments resulting from the interaction of people, software, and services on the Internet by means of technology devices and networks connected to it. Along with the advances of IT, the domains of cybersecurity have constantly faced up to new threat methods and techniques aiming to take advantage of IT and human vulnerabilities. Currently, cybersecurity is considered one of the critical components in enterprise risk management, as the ever-growing cyber breaches cause a wide range of critical damages to organizations and people. These damages include penalties, reputational harm, decrease in stock value, compliance breaches, privacy breaches, and disruption of operations, to name a few.
5. Conclusion
With the increased cybersecurity risks posed by cybercriminals and adversaries, it became imperative for organizations to increase their awareness of the change of the cybersecurity landscape and timely response to the change. This paper discussed cybersecurity trends coinciding with technological paradigm shifts. This paper also developed the Cyber Risk Management Framework in which risk management activities are organized and evaluated in four layers. As in many other IT projects, one of the barriers to the investment in cyber risk management is difficulty in measuring the benefits and costs of cybersecurity risk management. The organization is responsible for identifying the need for cyber acquisition and the best technology to meet that need. By prioritizing technologies that improve cybersecurity protection, organizations can reduce the consequences of cybercrime and unlock future economic value as higher levels of trust encourage more business from customers (Accenture, 2019).
