Cybersecurity Governance

An Enterprise Risk Management Strategy for Cyber Risk Control

2025
Buch

Verfasst von: Kok Boon Oh; Giang Hoang; John Sturdy; Sarah Shuaiqi Guo
Verlag: Springer Nature Singapore
Enthalten in: Springer Professional "Wirtschaft+Technik"; Springer Professional "Wirtschaft"

Über dieses Buch

Dieses Buch stellt die Praxis des Schutzes von Systemen, Netzwerken und Programmen vor digitalen Angriffen vor und zielt darauf ab, die Vertraulichkeit, Integrität und Verfügbarkeit der Netzwerke, Geschäftssysteme und Daten eines Unternehmens sicherzustellen. Effektive Cybersicherheit umfasst nicht nur technologische Lösungen, sondern erfordert auch robuste Governance-Maßnahmen. Basierend auf akademischen Forschungsergebnissen und der Berufserfahrung der Autoren in den Bereichen Governance und Cybersicherheitsmanagement konzentriert sich dieses Buch auf die Governance von Cybersicherheit auf der Ebene der strategischen Entscheidungsfindung und deren Umsetzung in der gesamten Organisation. Sie betont, dass die Optimierung aller voneinander abhängigen Funktionen für eine erfolgreiche Unternehmensstrategie entscheidend ist, und übernimmt das Konzept, dass "das Ganze größer ist als die Summe seiner Teile" in der Verwaltung der Cybersicherheit. Das Buch zielt darauf ab, einen ganzheitlichen organisatorischen Rahmen für die Governance von Cybersicherheit (CGF) zu entwickeln, der in die Risikomanagementfunktion des Unternehmens (ERM) eingebettet ist. Es untersucht die Verbindungen, Interdependenzen und Komplementaritäten zwischen umfassenderen Corporate-Governance-Praktiken und Cybersicherheitsmanagement. Das Buch konzentriert sich auf Technologie, Finanzen und menschliche Faktoren als Schlüsselfaktoren und beschreibt, wie technologische Geräte, Technologiemanagement, Finanzdisziplinen und menschliche Interaktionen die organisatorische Cybersicherheit stärken. Es geht um den Einsatz von Technologien zur Planung und Umsetzung von Informationssicherheitslösungen, die Rolle des Finanzmanagements bei der Verbesserung der Cybersicherheit und die Bedeutung menschlicher Faktoren im Cybersicherheitsprozess. Zu den Ausbildungsmerkmalen gehört die Vermittlung von Wissen und Managementfähigkeiten, die für die Konzeption, Verwaltung und Kommunikation eines effektiven CGF unverzichtbar sind. Dieses Buch schließt eine Lücke in der Literatur, indem es einen umfassenden, strategischen und strukturierten Ansatz zur Steuerung von Cybersicherheit bietet, der die Interdependenzen und Komplementaritäten von Organisationsmanagementfunktionen zur optimalen Kontrolle von Informationsrisiken berücksichtigt.

Mit KI übersetzt

Über dieses Buch

This book presents the practice of protecting systems, networks, and programs from digital attacks, aiming to ensure the confidentiality, integrity, and availability of a firm's networks, business systems, and data. Effective cybersecurity is not just about technological solutions but also requires robust governance measures. Drawing from academic research and the authors' professional experience in governance and cybersecurity management, this book centers on cybersecurity governance at the strategic policy-making level and its implementation throughout the organization. It emphasizes that optimizing all interdependent functions is crucial for a successful corporate strategy, adopting the concept that "the whole is greater than the sum of its parts" in cybersecurity governance.

The book aims to develop a holistic organizational cybersecurity governance framework (CGF) embedded within the enterprise risk management (ERM) function of the organization. It explores the connections, interdependencies, and complementarities between broader corporate governance practices and cybersecurity management.

Focusing on technology, finance, and human factors as key enablers, the book details how technological devices, technology management, financial disciplines, and human interactions reinforce organizational cybersecurity. It covers the use of technology for planning and implementing information security solutions, the role of financial management in enhancing cybersecurity, and the importance of human factors in the cybersecurity process. Educational features include imparting knowledge and managerial skills essential for designing, managing, and communicating an effective CGF. This book fills a gap in the literature by providing a comprehensive, strategic, and structured approach to cybersecurity governance, addressing the interdependencies and complementarities of organizational management functions for optimal information risk control.

Inhaltsverzeichnis

Frontmatter

1. Cybersecurity and Governance in the Digital Age

Abstract

Organizations must understand the role governance plays in cybersecurity management and familiarize themselves with the relevant mechanisms for operationalizing governance programs in the digital landscape. Corporate governance describes the methods used to govern businesses and their goals. It indicates who is in charge, who is responsible, and who makes choices. It also serves as an essential toolkit for the Board and management to deal with business difficulties more skillfully. This chapter introduces cybersecurity governance and the essentials for developing a holistic and practical governance framework that optimizes cyber risk control. The essential ingredients for creating a solid cybersecurity governance posture in the firm include leadership, strategic and tactical planning, structure, tools and techniques, policies, and procedures. For instance, leadership is crucial in managing and aligning people within a company by incorporating and interconnecting the corporate vision, strategies, policies, and procedures in all cybersecurity activities. This chapter previews how governance is essential in framing the policies, systems, and procedures for managing cyber threats and maintaining compliance.

Kok Boon Oh, Giang Hoang, John Sturdy, Sarah Shuaiqi Guo

2. Cybersecurity and Governance

Abstract

Many organizations, in both the public and private sectors, have made improving digital information management practices a top priority. They are motivated by several considerations, such as the need to increase business process efficiency, the requirements of compliance rules, and the desire to offer new services. Information security is a critical aspect of information management that ensures the achievement of these objectives. However, information security management is much more than just new technical solutions. It has frequently involved implementing robust governance measures, too. This chapter’s central theme is the relationships between the cybersecurity governance function and its design, manifestation, and embedding in a digital organization. We introduce the role of governance for information security by providing an overview of the relevant governance key factors such as strategies, policies, procedures, oversight, decision-making hierarchies, risk management, due diligence, compliance, accountability frameworks, security concepts, safeguards, standards and guidelines, activities, training, best practices, assurance, economic considerations, and technology in the organization’s digital environment. The scope of this chapter is to enable the reader to explain how governance underpins an organization’s strategic and tactical cybersecurity management and the roles of the Board, senior management, technology management and investment, people and financial management in facilitating cyber risk management for better performance.

Kok Boon Oh, Giang Hoang, John Sturdy, Sarah Shuaiqi Guo

3. Enterprise Risk Management and Cybersecurity Governance

Abstract

This chapter covers the design and implementation of the different forms and processes of cyber risk governance within the Enterprise Risk Management (ERM) framework. We discuss the cruciality of ERM as the foundation for a holistic and integrated risk control mechanism for enterprise cybersecurity governance. We also discuss the need for and implications of governance as a policy tool within the ERM context in strategic cybersecurity planning, risk assessments, security controls, incident response, business continuity, and compliance with legislation and standards. The three basic categories of cybersecurity risks are distinguished, i.e., national security, industrial espionage, and cybercrime. By separating the connotations of cybersecurity and analyzing the various actors and the related governance frameworks, we help create a better understanding of cybersecurity. Another aspect investigated is the difference between strategic and tactical cyber risk management as they pertain to two hierarchical levels of authority, oversight and responsibilities. This dissected approach allows the organization to appreciate the cyber threats it faces and be able to design the appropriate cybersecurity governance measures within the ERM architecture, policies, and procedures to tackle them. A holistic and integrated governance approach is adopted to plan, design, and incorporate cyber risk control measures into the ERM framework for execution from a strategic and tactical perspective.

Kok Boon Oh, Giang Hoang, John Sturdy, Sarah Shuaiqi Guo

Chapter 4. Integrated Cybersecurity Governance and ERM Framework

Abstract

This Chapter discusses technology advances and why we must maintain our efforts to secure it from cyber threats. Information technology (IT) is the practical use of knowledge, resources, and skills to solve problems, boost productivity, and improve everyone’s quality of life. It is essential in guiding and forming society and economic growth. IT applications employed for cyber risk control act as a strategic and tactical instrument in organizational information security management. Information technology (IT) and cybersecurity are inextricably linked; therefore, governance is integral to this relationship for cyber risk control. By leveraging proprietary knowledge and know-how, IT helps develop, maintain, and improve the firm’s competitive advantage.

Kok Boon Oh, Giang Hoang, John Sturdy, Sarah Shuaiqi Guo

Chapter 5. Information Technology, Systems Technology, and Cybersecurity

Abstract

This chapter discusses technology advances and why we must maintain our efforts to secure it from cyber threats. Information technology (IT) is the practical use of knowledge, resources, and skills to solve problems, boost productivity, and improve everyone’s quality of life. It is essential in guiding and forming society and economic growth. IT applications employed for cyber risk control act as a strategic and tactical instrument in organizational information security management. Information technology (IT) and cybersecurity are inextricably linked; therefore, governance is integral to this relationship for cyber risk control. By leveraging proprietary knowledge and know-how, IT helps develop, maintain, and improve the firm’s competitive advantage.

On the other hand, it is also an enabler for cybersecurity to enhance digital risk management. As an enabler, IT can assist the firm in shaping and accomplishing its cybersecurity strategic and operational objectives. IT is a vital weapon in the fight against cyber threats. It enables cybersecurity experts to monitor networks, systems, and servers to look for anomalies that can point to a cyberattack using cutting-edge tools and techniques like artificial intelligence and machine learning. We look at governance issues, challenges, and essentials to help align and design the organization’s cybersecurity program vis-à-vis its IT capabilities.

Kok Boon Oh, Giang Hoang, John Sturdy, Sarah Shuaiqi Guo

6. Cybersecurity Technology Management

Abstract

In this chapter, we define and explain the concept of Cybersecurity Technology Management (CTM) and how it applies to cybersecurity governance. CTM is a multidisciplinary area of study that embraces engineering, science, and management disciplines to design a set of rules and procedures for technology utilization to develop, maintain, and improve a company’s cybersecurity and competitive advantage. Because IT is such a powerful force, CTM emphasizes the governance policies and procedures for efficiently applying risk control processes and technologies to meet organizational objectives, boost revenue, and gain an edge over competitors. The CTM process provides a comprehensive approach and guidelines to connect strategic governance and technical components with the organization's overarching business objectives. It entails various activities, including planning, organizing, and controlling the multiple parts of the CTM governance. It covers the entire value chain of cyber risk control activities under an overarching ERM umbrella.

Kok Boon Oh, Giang Hoang, John Sturdy, Sarah Shuaiqi Guo

7. People and Human Factors

Abstract

Managing cybersecurity solely through technology is always challenging, as dealing with cyberattacks requires a socio-technical strategy. This chapter focuses on this area in the context of governance in human-technology interaction. From a cybersecurity governance perspective, we investigate how firms use people to manage cyber risk effectively. People can assist in identifying and mitigating risks before they have a significant negative impact because they are frequently the first line of defense against cyber threats. The ways that people can support cyber risk management are discussed and include security awareness, training and education, corporate culture, policy compliance, reporting suspicious activity, adhering to established incident response protocols, and aiding in the identification of the issue’s origin and breadth, and assisting in the identification of potential risks and vulnerabilities inside an organization.

Kok Boon Oh, Giang Hoang, John Sturdy, Sarah Shuaiqi Guo

8. Finance

Abstract

This chapter addresses the financial governance of cybersecurity within the broader ERM framework. In the current business environment, corporate activities are becoming more digital. As a result, cyber hazards are more rampant as firms become common targets for cyberattacks, resulting in significant financial losses, reputational harm, and legal liability. The process of allocating economic resources and determining expenditure priorities to support the successful adoption and upkeep of cybersecurity measures within an organization entails figuring out the extent of the risk exposure and how much money is needed to safeguard the organization’s networks, business systems, and data from online threats. Relevant governance factors addressed in cybersecurity financial management include valuation, investment, and budgeting. The presence of a well-designed cybersecurity financial governance as a tool underpinning the evaluation and ranking of cyber threats and prioritizing investments is crucial to taking cyber threats into account.

Kok Boon Oh, Giang Hoang, John Sturdy, Sarah Shuaiqi Guo

Chapter 9. Cybersecurity Governance Value Chain

Abstract

The value chain is essential in cybersecurity management because it enables organizations to comprehend and optimize the various processes involved in controlling cyber threats. Managers can use the value chain as a framework to help them decide on strategic options. By understanding where value is added, companies can focus on strengthening those areas to enhance their cybersecurity posture. Businesses may find cybersecurity flaws, inefficiencies, and possible threat hotspots by analyzing every stage of the supply chain. Therefore, the value chain analysis in this chapter provides a structured process that highlights the critical components of cybersecurity governance that are essential for improving the effectiveness of cybersecurity policies and frameworks. This approach facilitates strategic understanding and operational clarity that enhance cybersecurity governance. The organizational cybersecurity value chain also includes continuous improvement, which entails evaluating the efficiency of the organization’s governance procedures and making adjustments to strengthen the security posture. This value chain component is also essential for the business to keep ahead of emerging cyber risks.

Kok Boon Oh, Giang Hoang, John Sturdy, Sarah Shuaiqi Guo

Chapter 10. Strategic Cybersecurity Governance

Abstract

This chapter consolidates all the relevant literature, guidelines, concepts, standards, best practices, and material we have covered in the preceding nine chapters to propose a comprehensive and practical enterprise cybersecurity governance framework. The purpose is to offer a model, the “Strategic Enterprise Cybersecurity Governance Model” (ECyG-M), that incorporates the significant strategies, policies, systems, procedures, and preventative and corrective measures that firms can take to safeguard the CIA attributes of information system assets. A business’s strategies, policies, procedures, and actions to manage and protect its digital assets and customer data from cyber threats form part of the cybersecurity value chain. We incorporate the critical governance elements and capabilities presented in the preceding chapter into the strategic cybersecurity model. The ECyG-M approach can help reduce cyber risk exposure through a robust and comprehensive governance regime. The ECyG-M and its inherent value chain, created by adopting an ERM approach, offer a thorough and integrated method for cybersecurity risk management across the organization. Organizations can use the ECyG-M structured processes to identify, evaluate, prioritize, and manage cyber risks to accomplish their strategic goals.

Kok Boon Oh, Giang Hoang, John Sturdy, Sarah Shuaiqi Guo

Metadaten
Barrierefreiheit

Titel: Cybersecurity Governance
Verfasst von: Kok Boon Oh
Giang Hoang
John Sturdy
Sarah Shuaiqi Guo
Verlag: Springer Nature Singapore
Electronic ISBN: 978-981-9538-65-2
Print ISBN: 978-981-9538-64-5
DOI: https://doi.org/10.1007/978-981-95-3865-2

Die PDF-Dateien dieses Buches wurden gemäß dem PDF/UA-1-Standard erstellt, um die Barrierefreiheit zu verbessern. Dazu gehören Bildschirmlesegeräte, beschriebene nicht-textuelle Inhalte (Bilder, Grafiken), Lesezeichen für eine einfache Navigation, tastaturfreundliche Links und Formulare sowie durchsuchbarer und auswählbarer Text. Wir sind uns der Bedeutung von Barrierefreiheit bewusst und freuen uns über Anfragen zur Barrierefreiheit unserer Produkte. Bei Fragen oder Bedarf an Barrierefreiheit kontaktieren Sie uns bitte unter accessibilitysupport@springernature.com.

Erweiterte Suche

Suchoperatoren:

Springer Professional

Cybersecurity Governance

An Enterprise Risk Management Strategy for Cyber Risk Control

Über dieses Buch

Über dieses Buch

Inhaltsverzeichnis

Frontmatter

1. Cybersecurity and Governance in the Digital Age

2. Cybersecurity and Governance

3. Enterprise Risk Management and Cybersecurity Governance

Chapter 4. Integrated Cybersecurity Governance and ERM Framework

Chapter 5. Information Technology, Systems Technology, and Cybersecurity

6. Cybersecurity Technology Management

7. People and Human Factors

8. Finance

Chapter 9. Cybersecurity Governance Value Chain

Chapter 10. Strategic Cybersecurity Governance

Premium Partner