Security Risk Management - The Driving Force for Operational Resilience: The Firefighting Paradox

The importance of businesses being Operationally Resilient is becoming increasingly more important and a driving force behind whether an organization can ensure that their valuable business operations can 'Bounce Back' from, or manage to evade, impactful occurrences is the Security Risk Management Capabilities.

In this book, we change the perspective on an organization's operational resilience capabilities so that it changes from being a reactive (tick box) approach to being proactive. The perspectives of every chapter in this book are with a focus on risk profiles and how your business can reduce these profiles using effective mitigation measures.

The book is divided into two sections:

1. Security Risk Management.

All the components of Security Risk Management contribute to your organization's Operational Resilience capabilities, to help reduce your risks.

Reduce the Probability/Likelihood.

2. Survive to Operate.

In the event that your SRM capabilities fail your organization, these are the components that are needed to allow you to quickly 'Bounce Back'.

Reduce the Severity/Impact.

Rather than looking at this from an Operational Resilience compliance capabilities aspect, we have written these to be agnostic of any specific Operational Resilience Framework (e.g., CERT RMM, ISO 22316, SP 800-160 Vol. 2 Rev. 1, etc.), with the idea of looking at Operational Resilience through a Risk Management lens instead.

This book is not intended to replace these numerous Operational Resilience standards/frameworks but, rather, has been designed to complement them by getting you to appreciate their value in helping to identify and mitigate your Operational Resilience risks.

Unlike the Cyber Security or Information Security domains, Operational Resilience looks at the risks from a business-orientated view, so that anything that might disrupt your essential business operations are risk assessed and appropriate countermeasures identified and applied.

Consequently, this book is not limited to cyber-attacks or the loss of sensitive data but, instead, looks at things from a business holistic viewpoint.