Information Security, Business Continuity & Resilience
Resources:
Read Chapter 15 in Book and review all slides titled, “Information Security & ERM/Business Continuity & Resilience”. Google “cyber security events” or other IT failures for additional examples to understand the root cause in order to propose a response to the adverse event. You may also identify opportunities created by proactively using ERM practice (optional)
(examples of IT security weakness):
https://digitalguardian.com/blog/data-security-experts-reveal-biggest-mistakes-companies-make-data-information-security
Case study source:
https://www.csoonline.com/article/2130877/data-breach/the-16-biggest-data-breaches-of-the-21st-century.html
Description of Adverse Event:
Information Security has become one of the most critical internal controls in ERM due in part to the rise of Cyber risk in all industries. However, the S.E.C. has always mandated that strong business continuity plans are in place to ensure that customer access to their funds and the financial markets are resilient to a host of disruptive factors that could lead to broader impacts.
(Draft scenario is a cyber security breach as a result of an employee who clicked on an infected email link)
Template outline:
This workshop is designed to provide a more immersive experience than lecture to understand how each of the traditional risk functions contribute to a robust ERM program. The purpose of each workshop is to provide a self-study guide to learn more about each risk discipline. The first of these workshops deals with Information Security. The book and the lecture slides are only the beginning of your research. You are required to explore the topic further to determine how to apply the separate risk disciplines in ways that lead to appropriate responses to adverse events. Each workshop will be scenario based and you must apply your reading and research to develop an appropriate response to the adverse event.
