Wilde is widely known for his masterpiece “The Importance of being Earnest,” written in 1895 … but it’s something else he wrote that relates to utilities in 2012 …
Last week we blogged on a Carnegie Mellon study that cited utilities as being among the least-prepared sectors with respect to risk management and executive knowledge of IT issues. Assuming that conclusion is accurate, it’s hard to argue that there is less Information Security Governance in the utility sector than there should be. The net result of insufficient governance is a lack of accountability for putting the necessary controls in place to reduce information security risk to a level that (should have been deemed) acceptable by executive management. More succinctly, there is still a long way to go before we can call our grid “secure”.
I think there are two logical questions to ask on this issue (the first is far easier to answer than the second):
1. Why are the utilities so far behind regarding risk management and executive knowledge of IT issues?
2. What needs to happen for them to catch up?
Why are the utilities so far behind regarding risk management and executive knowledge of IT issues?
Information Security Risk Management (ISRM) tends to lag behind Enterprise Risk Management (ERM). On the financial side we have seen Information Security Risk Management significantly improve as an extension of an increasingly sophisticated Enterprise Risk Management capability. Utilities have typically trailed in this area. In fact, in a 2011 study by Accenture the utilities industry was cited as having one of the lowest proportions of companies with an enterprise risk management program. Logically this makes sense: banks have been prime targets of physical attacks for hundreds of years and cyber security attacks for years while utilities are only just now realizing the growing threat of these risks.
What needs to happen for them to catch up?
The glass-half-full side of me thinks that the combination of increasing government regulation and growing recognition of the risk at the lower levels of the organization will bubble up to the CXO Suite – and ISRM will get the attention it deserves. The glass-half-empty side of me says that it will take a significant successful cyber-attack causing a massive outage weeks (or more) long to close the current ISRM gap.
Oscar Wilde once said, “The basis of optimism is sheer terror.” I could not have said it better.
MAY
A Best-Practices Guide to Information Security Attestation
Risky Business Blog
Techno Blog
In The News
RSS Feed
About the Author:
John Verry (CISA, 27001 Certified Lead Auditor, CCSE, CRISC) is Pivot Point's resident "Security Sherpa". He is lucky enough to spend most of his day helping clients develop a road map to address security, compliance, and attestation requirements.