Blogs
Power What’s Next in IT & Cyber Risk with MetricStream Intelligence and Innovations
- IT Risk & Cyber Risk
- 11 November 21
3 min read
Introduction
We recently concluded our flagship event, GRC Summit, held on October 19-20 in a hybrid format comprising of virtual and in-person engagements.
Now in its ninth year, the summit is the largest gathering of risk professionals, C-suite executives, thought leaders, industry experts, and practitioners, who come together and share their experiences and best practices to navigate today’s complex and rapidly evolving risk and threat landscape.
This year, Anil Kumar, Sr. Director, Product Manager – IT and Cyber Security, MetricStream, and I got an opportunity to give a walkthrough on the latest innovations that are being done and planned in our IT & Cyber Risk products. Here are some of the key points that we discussed:
- Current IT and Cyber Security Challenges
The key challenges faced by organizations in the area of IT & cyber today include growing supply chain attacks and data breaches, the proliferation of controls and associated costs, lack of visibility into IT & cyber risk, regulatory compliance, the need to quantify and communicate cyber risk in financial terms, and more. We recommend organizations to implement an integrated and platform-based approach across all programs for facilitating consistency and harmonization among different processes and functions.
- Cyber Risk Quantification
We have been pioneering efforts on cyber risk quantification for a long time. Cyber risk quantification, as the name suggests, is quantifying or expressing cyber risks in financial or monetary terms. This quantitative risk assessment method essentially transforms uncertainty associated with technical aspects of threat, vulnerability, and controls into financial language that business leaders and stakeholders can interpret and act upon. Speaking of the benefits, cyber risk quantification enables
- CISOs to communicate cyber risk exposure to the board and other executives
- To prioritize cyber investments and decision-making (whether to accept or mitigate the risk)
- To meet regulatory requirements associated with disclosing cyber risk factors in financial terms
The session further delves deeper into techniques of quantifying risk – discrete and probabilistic factor values, Risk Quantification Models – factors-based hierarchical models, actuarial/insurance models, AI/ML-based models, and more.
- MetricStream Intelligence
Our products are infused with what we call MetricStream Intelligence – a combination of our AI/ML engine and calculation engine. It sits on top of our federated data model.
If you break down cyber risk management, it is basically about managing your assets, threats, vulnerabilities, issues, and control database. This forms the very first layer of our federated data model. We’ve built a platform on top of this layer that enables simplified ways of capturing the data as well as direct exchange via APIs in real time. Then we have a whole gamut of reporting and workflow around it.
On top of these layers, we have built our machine learning model, which allows you to create simulation techniques and empowers you to do statistical analysis along with machine learning techniques.
In short, the way we approach this is by enabling organizations to not just manage the workflow of risk assessment, but also to do the computation of the risk and take action driven by facts and data.
- AI-Powered Action Plan Recommendations
Our customers have often highlighted a major challenge they face – classifying and creating relevant content for an issue. Our Issue Management System is now capable of assisting the users to tag related issues and create relevant content for an issue. This capability of our AI/ML Model is further enhanced to provide recommendations about the relevant actions that must be implemented in order to mitigate an issue.
- Future Innovations
Going forward, we plan to bring more AI/ML-based use cases to our customers, including in the area of response recommendation, control rationalization, and more. Stay tuned!
If you missed our product innovation session “Power What's Next in IT & Cyber Risk” at the GRC Summit 2021, you can now watch it at your convenience here. To request a personalized demo, click here.
Jump to Topic
Related Resources
Blogs
Simplified Data Import & Export
- GRC
- 09 November 21
3 min read
Introduction
Prior to moving to MetricStream to manage their GRC content, our customers would have been either leveraging competitor applications or managing all their data manually via spreadsheets. This huge volume of data would be in different forms and shapes which now needs to flow into our MetricStream system. So, it becomes important for our customers to have a smooth transition from their legacy applications to the MetricStream solution.
MetricStream’s Answer: Data Import & Export
MetricStream provided the “Data Import & Export” spreadsheet-based import framework to push data to our systems seamlessly. This framework allowed:
- Migration of data from legacy systems into the MetricStream system
- Bulk creation and updating of data into records, bulk creation of library objects like Risks, Controls, Processes, Auditable Entities, etc. and import system entities like Users, Organizations, etc.
However, although the existing framework enabled extensive usage, it still presented a few challenges. Our customers were operating with certain limitations around configurability and upgrade safety. And especially while importing high volumes of data, import wait time was high. Hence, rather than adding new features to the existing framework and tuning it, it was identified that developing a brand-new framework from scratch would reap more benefits strategically in the long run, which led to the birth of the “Simplified Data Import & Export” framework.
How Will the “Simplified Data Import & Export” Framework Help?
The new simplified data import & export framework is an effort to overcome the challenges which were faced in the existing framework.
Note: Adoption of Business Rules & Business APIs is a pre-requisite to enable Forms with the new framework.
Developer Community
- A developer tool that will allow to easily configure and upgrade Safe Data Import & Export templates with minimal development effort
- No additional development effort to have the Data Import & Export validations written separately, since the framework now relies on Business Rules, which will act as a common validation layer across Forms and Data Import
- Relying on the BAPI underneath, will make the framework more performant
- Upgrade safe, thereby reducing the time taken to upgrade to future releases or patches
Jump to Topic
Users of MetricStream
The new framework will co-exist with the existing data import & export framework, i.e., specific Forms can adopt the new framework. Users intending to move to the new framework for a specific Form will require the adoption of Business Rules and Business API’s for that corresponding Form.
The new framework enables:
- Dynamic generation and leveraging of user-friendly templates
- Import of attachments & ability to retain rich text format during import
- Importing data at different workflow stages
- Improved import & export status reports
The early adopters of the brand-new framework from Products include select Forms from GRCF, CMP and LSM.
In short, if your Forms are ready with the adoption of Business Rules and Business APIs, and you plan to leverage the Data Import & Export capability in your application, then, the Simplified Data Import & Export framework should be your choice.
Stay tuned for more information on our product enhancements coming soon.
Request a demo to learn more about how MetricStream can help your organization enable risk-informed decisions that accelerate business performance.
Jump to Topic
Related Resources
Blogs
Our European GRC Summit Roadshows and the Instagram of Risk
- Artificial Intelligence
- 02 November 21
4 min read
Introduction
Talk about roundtrips…. In-the same week of a very successful 2021 GRC virtual summit on the 19 and 20 of October, where MetricStream had over 2500 customers, prospects, and partners registered to learn, participate, and share their experiences around GRC, IRM, and everything in-between, we decided to host three physical summits based in London, Copenhagen, and Zurich to continue the conversations with our community.
All three locations had a boardroom style setting dedicated to a round table discussion. The aim was simple, we would listen to what our community had on their mind. It was an opportunity to find common synergies, lead round table discussions, and network with senior risk professionals that are paving the way in this industry.
With representation from risk, compliance, audit and IT Cyber, the discussions were captivating, and the commentary was electric.
London Calling
The first of the events started off in London, and we had a great mix of customers, partners, and prospects around the table.
Our CEO, Bruce Dahlgren introduced the session, and it was an engaging group that shared their thoughts and concerns around the current themes and trends.
Alongside the presentations, our partners gave a short speech on the success of collaborating with MetricStream to provide business benefits for our risk community. What followed was an insightful roundtable discussion that covered risk quantification, cyber security, and the need for organizations to lead with purpose.
It did not take long for ESG to make an appearance and quite rightly so, with COP26 on the agenda and the link to compliance, organizations that have a purpose and are aligning to social governance, diversity, and climate change are setting a precedent. MetricStream recently launched the ESGRC product, which enables organizations to define and manage ESG standards, frameworks, and disclosure requirements. There was a lot of excitement on this in the room.
Emerging risks and third-party risks were explored in detail. With recent supply chain disruptions, it became even more apparent how peripheral risks had to be managed.
Dinner followed, and the conversations (like the wine) continued flowing. It was delightful to see customers connecting with customers. It was evident that they all thrive in this environment and that it was clearly something they had sorely missed over the last 20 months.
Cycling through Denmark
We settled in for another topical roundtable discussion, where the thoughts and real-life examples of how technology is an enabler in the GRC space were deliberated. In some instances, the dialogue went back and forth. One example of this was that the concern organizations face with risk was not always a technology one, but more of a transformational project that the organization needed to resolve. Accompanying this, was the remark that there are inconsistencies in risk terminologies across the industries, which fuels part of the problem. It was also surprising (to me) to learn that there were still so many organizations using spreadsheets to manage their risk. This was their default way to identify, monitor, and track risks, even though they knew it was not sustainable, efficient, or scalable.
The need for AI and ML to automate risk attributes was the next topical point. The comment was made that AI techniques recognize pattens and trends to help alleviate the pain, time, and missing information that humans cannot always detect, but how do you know that AI is doing the right thing. This conversation continued into the evening, accompanied by food and drinks.
High-End Shopping in Zurich
And finally, concluding the week in Zurich, we had another full house with an engaging group that deliberated on how they can start a community of risk or as was suggested, the “Instagram of risk”. There were discussions around risk culture, accountability, accurate data, and mindset. Some customers admitted that it was quite possible to get lost in the data and what they require is speed, agility, and most of all simplicity. A comment was made that you could spend all your time managing documents and not the risk. Another referenced that as change management sits in all departments including HR and legal it can be a challenge to bring it all together for larger organizations. Crypto also made it in the discussion, with a notable mention that new risks have no historical data to base it on.
Visibility and accountability were front of mind in the discussions, and a common theme that was mentioned was on reporting risks up to the board of directors and the role of the board in risk governance.
MetricStream presented 5 current trends that we are observing in the industry and 5 innovation themes that we are leading the way with (API, AI, Adoption, Agility & Analytics).
By bridging the gap and driving value for the community, MetricStream has a purpose to continue to add value and innovate alongside our community. We want the community to thrive on risk and reap the rewards of being on a GRC journey that like a good bottle of wine gets better with age.
Until the next summit.
Jump to Topic
Related Resources
Blogs
Towards Cyber Resilience: NIST’s Cybersecurity Framework for Ransomware Risk Management
- GRC
- 21 October 21
4 min read
Introduction
The number of ransomware attacks on organizations around the globe is growing at an exponential rate with no signs of slowing down. According to Check Point, ransomware attacks grew by 102% in the first half of 2021 compared to the beginning of 2020.
Cybersecurity Ventures expects ransomware to attack a business, consumer, or device every 2 seconds by 2031, up from every 11 seconds this year, and estimates ransomware damages to cost the world $265 billion by 2031. To operate in this precarious digital landscape, organizations today must go the extra mile to ensure that their cyber defense mechanism is robust and effective.
In the wake of the significant surge in ransomware attacks, the National Institute of Standards and Technology (NIST) has published a new draft on “Cybersecurity Framework Profile for Ransomware Risk Management” that sets out its guidance on how organizations can prevent, respond to, and recover from ransomware attacks.
The document details basic preventive steps to protect against the ransomware threat, including using antivirus at all times, keeping computers fully patched, continuous monitoring, segmenting internal networks, educating employees about social engineering, assigning and managing credential authorization, and many more.
The Five Cybersecurity Framework Functions
NIST has classified Cybersecurity Framework Functions into five categories: Identify, Protect, Detect, Respond, and Recover, and has suggested key measures under each of these functions to protect against ransomware threats.
Identify - This is the first step and the foundation for the rest of the framework. It requires developing an organization-wide understanding of systems, people, assets, data, and capabilities, and the associated cybersecurity risks. Some of the key suggestions made by NIST under this head include:
- Creating, reviewing, and maintaining an inventory of all organizational data, personnel, devices, systems, and facilities
- Prioritizing organizational resources based on their classification, criticality, and business value
- Establishing cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders
- Cataloging and mapping internal and external communications and data flows
- Developing a comprehensive communication strategy that details the action plan in the event of an attack
- Effectively managing legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations
- Establishing and managing risk management processes agreed to by organizational stakeholders
- Conducting response and recovery planning and testing with suppliers and third-party providers
Protect – This function is critical to limit or contain the impact of a potential cybersecurity event and involves implementing appropriate safeguards to ensure the delivery of critical services. Some of the key measures include:
- Documenting and managing identities and credentials for authorized devices, users, and processes
- Managing remote access to maintain the integrity of systems and data files
- Effectively managing access permissions and authorizations, incorporating the principles of least privilege and separation of duties
- Providing cybersecurity awareness education and training to employees
- Managing information and data in a manner consistent with the organization’s risk strategy
Detect – This function requires the implementation of appropriate activities to identify the occurrence of a cybersecurity event and enables timely discovery of cybersecurity events. Some of the key suggestions include:
- Detecting anomalous activity and understanding the potential impact of events
- Continuous monitoring of information systems and assets
- Maintaining and testing detection processes and procedures to ensure awareness of anomalous events
Respond –Once a cybersecurity incident is detected, the Respond Function is important to take appropriate action and measures to contain the impact. NIST recommends:
- Executing and maintaining response processes and procedures to ensure a response to detected cybersecurity incidents
- Coordinating response activities with internal and external stakeholders
- Conducting analysis to ensure effective response and support recovery activities.
- Performing activities to prevent the expansion of an event, mitigate its effects, and resolve the incident
- Continuously improving organizational response activities by incorporating lessons learned from current and previous detection/response activities
Recover – This involves implementing appropriate activities to maintain plans to restore any capabilities or services that were impacted in a cybersecurity incident and helps an organization’s timely recovery to normal operations. Key measures include:
- Executing and maintaining recovery processes and procedures to ensure restoration of systems or assets affected by cybersecurity incidents
- Improving recovery planning and processes by incorporating lessons learned into future activities
- Coordinating restoration activities with internal and external parties
How MetricStream Can Help
MetricStream welcomes the ransomware guidance from NIST. Such practical frameworks can considerably help CISOs and security teams to develop an effective cybersecurity strategy from the ground up and evaluate their existing strategy for any gaps or loopholes.
The MetricStream IT and Cyber Risk and Compliance solution is aligned to the capabilities detailed in the NIST guidance. It helps organizations to proactively anticipate and minimize IT and cyber risks, threats, vulnerabilities, and multiple IT compliance requirements. The solution cuts across enterprise siloes by facilitating harmonization between various functions and aggregating information and providing a 360-degree, real-time view of IT risk, compliance, policy management, and IT vendor posture. It also enables enterprises to execute and manage an effective business continuity and disaster recovery program. To request a personalized demo, click here.
Jump to Topic
Related Resources
Blogs
Frameworks to Consider for Cybersecurity
- IT Risk & Cyber Risk
- 09 September 21
4 min read
What are the Top 3 Takeaways after I’ve Finished this Article?
- What are the controls that should be implemented to have a robust Information/Cybersecurity program?
- How should organizations prioritize Information/Cybersecurity risk?
- Standards that can be used as guidance in creating even better Information/Cybersecurity programs
What is the Difference, if Any?
Information Security includes protecting classified information in all forms that must be protected including, but not limited to: paper documents, photos, media, spoken information, and electronic data. Cybersecurity is a component of Information Security pertaining to the protection of critical systems such as the network and computer systems in order to ultimately protect electronic data from attacks. In creating a robust Information/Cybersecurity program, the standards treat Information/Cybersecurity as a cohesive topic.
Some organizations have put more of their resources into Information/Cybersecurity and hardening the technology because of the increase in ransomware and breaches. They are forgetting about the importance of also managing the data itself through governance and risk assessments, unless required by a regulation or standard that they must be compliant with.
Information/Cybersecurity threats are a key concern and mitigating risks is critical. At the same time, protecting data from internal sources that wish to affect the confidentiality, integrity, and/or availability of data is of prime importance.
In order to manage the risks, policies should be created and approved by top management as part of Governance. An Information Security risk assessment should be conducted in order to assess the potential consequences if vulnerabilities were to be exploited. As part of the process, Information Security risk owners should be identified.
Information Security risk treatment should consider the findings of the risk assessment.
Awareness training is essential in order to mitigate against employees unintentionally affecting the Information Security of the organization.
Guidelines to Consider
There are many guidelines and different industries have their own requirements, but ISO (International Standard Organization) Standards and NIST (National Institute of Standards and Technology span across most industries as additional if not the primary guidelines they wish to implement. The best framework is to include a combination of the different standards into your existing framework as opposed to just choosing one standard to follow.
ISO
International Standards Organization 27000 family pertains to protecting all Information Security assets. These standards include guidance for Cyber Security as well.
ISO/IEC 27001:2013
According to ISO.org, ISO/IEC 27001:2013 specifies the requirements for establishing, implementing, maintaining, and continually improving an information security management system within the context of the organization. It also includes requirements for the assessment and treatment of information security risks tailored to the needs of the organization.
ISO/IEC 27002:2013
According to ISO.org, ISO/IEC 27002:2013 gives guidelines for organizational information security standards and information security management practices including the selection, implementation, and management of controls taking into consideration the organization's information security risk environment(s).
ISO/IEC 27003:2017
According to ISO.org, ISO/IEC 27003:2017 provides explanation and guidance on ISO/IEC 27001:2013.
ISO/IEC 27032:2012
According to ISO.org, ISO/IEC 27032:2012 provides guidance for improving the state of Cybersecurity, drawing out the unique aspects of that activity and its dependencies on other security domains, in particular: information security, network security, internet security, and critical information.
In addition to these three ISO standards, the ISO 27000 family of standards includes many additional standards including:
- ISO/IEC 27004:2016 which pertains to metrics and monitoring and measuring the information security management system.
- ISO/IEC 27005:2008, pertaining to Information security risk management
NIST
The Cybersecurity Framework consists of standards, guidelines, and best practices to manage cybersecurity risk. The Framework integrates industry standards and best practices to help organizations manage their cybersecurity risks.
SP 800-53 Rev. 5
Security and Privacy Controls for Information Systems and Organizations Per NIST, this publication provides security and privacy controls for information systems and organizations to protect organizational operations and assets, individuals, other organizations, and the Nation from a diverse set of threats and risks, including hostile attacks, human errors, natural disasters, structural failures, foreign intelligence entities, and privacy risks.
Conclusion
It’s critical to have Information/Cybersecurity as part of your culture so that all employees are consistently aware and can help protect the organization’s Information / Security assets. Organizations can implement both ISO and NIST controls in perfecting your program, as well as those found in industry regulations, standards, and guidelines.
Jump to Topic
Related Resources
Blogs
Power What’s Next in GRC with MetricStream’s Brazos Software Release
- Compliance Management
- 19 August 21
3 min read
Introduction
The demands and requirements of businesses to thrive in the new normal have changed drastically. Buzz words like agility, digitization, and resilience are no longer just business aspirations but have become necessary and fundamental for the readiness of organizations to address any risk event, including high-impact, low-frequency events such as COVID-19. With the latest Brazos release, we are delivering a myriad of innovations to support organizations in their journey to achieve their business goals and power through the current unsettled operational environment.
Brazos builds upon the previous Arno release and includes key innovations in areas including regulatory compliance, cyber risk quantification, and vendor risk management. The objective is to make the processes simpler, smarter, and more streamlined.
Simplifying Regulatory Complexity
Given the complex web of regulations, along with the escalating number of regulatory change alerts that organizations are bombarded with every day, it has become imperative to simplify the compliance function to make it more efficient and systematic. On these lines, the Brazos release brings new capabilities to our regulatory compliance products, including:
- Fully packaged, real-time curated regulatory intelligence from 1,000 supervisory bodies and 2,500 collections of regulatory/legislative materials facilitating efficient management of regulation overload.
- Certification and sub-certification processes enabling the creation of accountability chains.
- Contextual intelligence on policies allowing compliance teams to easily identify the policy section related to regulations, risks, and controls.
- Artificial Intelligence (AI)-powered action plan recommendations based on semantically similar compliance issues reported in the past for quick and easy resolution.
- Multiple enhancements to the Mobile App that simplify searching policies, tracking regulatory changes, and managing compliance assessments and regulatory engagement activities.
Quantifying the Impact of Cyber Risks
Cyber risk quantification, or quantifying cyber risks in monetary terms, is critical for cybersecurity professionals today to effectively communicate the cyber risk exposure to the top management and board. By understanding the potential impact of cyber risks in dollar values, decision-makers are better positioned to prioritize IT cyber risk spending, resource allocation, and establishment of optimal controls.
Brazos brings advanced cyber risk quantification capabilities to IT and Cyber Risk Management, enabling cybersecurity teams to leverage the industry standard FAIR methodology to quantify their cyber risks in monetary value. In addition, advanced Monte Carlo simulation capabilities help upgrade the assessment teams’ guesstimates into accurate predictive values of the cyber risk exposure.
Powering Next-Gen Vendor Risk Management with AI
Managing risks associated with the extended enterprise quickly and efficiently is crucial for ensuring continued business operations. Supplier networks of organizations today are comprised of hundreds and thousands of third, fourth, and subsequent parties. A manual approach to review third- and fourth-party documentation, including reports, certificates, and evidence, to spot any discrepancies is time-taking and prone to error.
We are addressing this challenge by bringing the benefits of artificial intelligence (AI) and automation to Third-Party Management with the latest release. MetricStream’s AI engine automatically scans through the documents submitted by the third parties, validates the content, highlights any anomalies, and automatically recommends risks scores based on the number and type of anomalies found. This real-time intelligence equips risk teams to accelerate analysis and mitigation of third-party risks.
With Brazos, we are setting a new standard by implementing AI into multiple GRC products, empowering risk, compliance, security, and audit professionals to better perform their roles and responsibilities. The release also provides a simplified user experience and enhances agility for faster time to value with:
- High configurability capabilities across the MetricStream Platform.
- Enhanced frontline capabilities to anonymously report compliance cases.
- Improved mobile capabilities for regulatory compliance, IT compliance, and audit.
- Content Integration Service that leverages REST APIs to import content from external sources.
- Better collaboration and improved cross-referencing in audit workpapers within Microsoft Word.
We are constantly striving to make your GRC journey exciting, enriching, and fun. The latest software release is guided by our key tenet of helping organizations accelerate sustainable growth with risk-aware decisions. The new features and functionalities extend the capabilities of MetricStream Platform and products and will enable you to meet the evolving business needs in this digitized world.
To know more about Brazos Release features, click here.
Jump to Topic
