![]()
Part 1
What Is Enterprise Security Risk Management (ESRM)
and How Can It Help You?
This part will help you to:
- Understand what is meant by Enterprise Security Risk Management.
- Explain the difference between traditional, task-based management and strategic, risk-based management.
- Understand and overcome some of the blocks to effective relationships with enterprise leaders.
- See how adopting ESRM can lead to a more successful security program overall and enhance your own career.
![]()
1
What is Enterprise Security Risk Management (ESRM)?
As a security practitioner, you know the world is a risky place, and you know itâs becoming more risk filled all the time. Hardly a day goes by without headlines about a workplace shooting, a data breach, a cyber-attack, or some other security failure that has exposed an enterprise and its assets -human, physical, and intangible - to some kind of serious risk. Whatever your security role, and no matter how far along you are in your security career, itâs your responsibility to protect your enterprise, and its assets, against these high-profile threats, and many others that are only beginning to emerge and be recognized. These changes in the security risk environment, and the urgent changes they require in your work as a security practitioner, are the reason we wrote this book.
This book is about an approach to security thatâs new and yet familiar, radical and yet practical: enterprise security risk management (ESRM).
1.1 ESRM Defined
Weâll be discussing the meaning and implications of ESRM in depth throughout this book, but letâs begin at the beginning, with a simple, straightforward definition of the term:
Enterprise security risk management is the application of fundamental risk principles to manage all security risks - whether information, cyber, physical security, asset management, or business continuity - in a comprehensive, holistic, all-encompassing approach.
To break that down further, we can look at the individual parts of the definition.
1.1.1 Enterprise
An enterprise is a business or company.
This can be a:
- Public, state or government run organization.
- A privately held, family company.
- A not-for-profit organization providing goods, services, or other non-profit activities.
- A stockholder controlled corporation.
- Any other organization that exists to fulfill a purpose defined by that organization.
When we reference business, organization, company, or any similar term in this book, we are referring to any or all of the above - an enterprise.
1.1.2 Security Risk
Security risk is anything that threatens harm to the enterprise, its mission, its employees, customers, or partners, its operations, its reputation.
That can mean:
- A troubled employee with a gun.
- An approaching hurricane.
- A computer hacker in another country.
- A dissatisfied customer with a social media account and too much time on his or her hands.
- And, of course, many more.
Security risks take many different forms, and new ones are being introduced all the time. Recognizing those risks, making them known to the enterprise, and helping your internal functional business partners mitigate them is central to the ESRM philosophy.
1.1.3 Risk Principles
The definition of ESRM states that risks are managed through fundamental risk principles. Here, weâll reference an already existing body of knowledge on how to manage all types of risk, and apply it specifically to the security function. There are well-established, fundamental risk principles -principles that have been tested and found effective over many years, in many different enterprises, and in many different industries - that can be used to manage risks of all types.
The International Organization for Standardization, in standard ISO 31000:2009 - Risk management - Principles and guidelines, and the American National Standards Institute, in their standard document ANSI/ASIS/RIMS RA.1-2015 - Risk Assessment, both outline similar, highly effective, standards for risk management. A few examples of key principles from the ISO standard 31000 (2009) are that risk management should:
- Be part of the decision-making process.
- Be transparent and inclusive.
- Be dynamic, iterative, and responsive to change.
- Be capable of continual improvement and enhancement.
Again, these are just a few snippets from the standard. The entire standard is voluminous and comprehensive and weâll describe more from this risk standard and others in the course of this book to give you a road map showing how to use these fundamental principles of risk management and apply them to the security risks you are responsible for managing.
1.2 How is ESRM Different from Traditional Security?
The description of ESRM above may sound somewhat like what you and your security organization are already doing - and the fact is, you probably are already doing some parts of it.
So letâs take a look at what makes ESRM such a radical departure from traditional, âconventionalâ security. To do that, we need a baseline understanding of what traditional security is - and what it is not.
These days, security practitioners are often too busy dealing with threats and vulnerabilities and other urgent operational problems to ask themselves basic questions about what they do and why they do it.
Questions like:
- What is my role in the business environment, beyond the specific security tasks Iâve been assigned?
- Why are the tasks I do every day necessary for the enterprise?
- How is what I do perceived in the organization?
- What is the mission my department is chartered to accomplish?
Thatâs a serious problem, because in security, as in every other business discipline, if you arenât sure what youâre trying to accomplish - why youâre doing what youâre doing - you canât be sure youâre doing it right. And, just as important, you canât be sure that youâre being recognized by the management in your organization as doing it right.
1.2.1 Traditional Corporate Security Scenarios: Something is Missing
One thing weâve learned in our years as security professionals is that there are a lot of different ways to âdo security.â Some are good, some are bad, most are a bit of both - and all can teach us something about how to do things better. Weâve talked to a lot of security managers and practitioners in our time, at conferences, seminars, and other industry events, and weâve learned about a lot of different approaches to security. Here are just a few things weâve heard about:
- Security programs that seem to work successfully in their business environments, even though theyâre run largely on instinct or experience rather than as formalized processes that could be extended into new areas.
- Security practitioners who feel like outsiders in the enterprise, because theyâre only called in when theyâre âneededâ - when somethingâs gone wrong - not before.
- Security managers who spend all their time performing tactical functions - responding to incidents, implementing password controls, installing and monitoring video or access systems - instead of developing strategies.
- Security programs that fail because they donât have the participation and support that they need from the rest of the enterprise.
- Security managers who are âblindsidedâ by security problems they werenât even aware existed - but are still expected to take the blame for.
Thereâs a lot wrong here, and weâll be talking throughout this book about exactly what makes these things wrong and what you, as the security practitioner, can do about it. But for now, weâd like to talk about one key component thatâs missing from all these scenarios: consistency. In ESRM terms, consistency has two fundamental meanings:
- Consistency in applying a security risk management philosophy to every part of the security function and to the thought processes applied to all security decision-making.
- Consistency in how security roles and responsibilities are communicated to, and understood by, the internal strategic partners who are so critical to the success of an ESRM program.
Bringing consistency to your security program is essential to ensuring that all your stakeholders across the enterprise understand exactly what to expect from you as a security professional and from your security program, recognize and appreciate securityâs roles in the enterprise and its business value, and rely on you and your team to perform your roles as trusted business partners.
Consistency is driven by:
- Following known, documented, well communicated, practices.
- Remembering the proper steps of all security activities and processes.
- Always understanding the true role of the security professional as manager of security risk.
- Incorporating that understanding and philosophy into your everyday thought processes as the security manager.
Consistency in your security program offers many benefits, but none is more important than earning the trust of the business. When your strategic partners in the enterprise can see that you perform all your security work in a consistent manner and treat al...
