Stepping Through Cybersecurity Risk Management

8People

8.1 Three Lines of Defense

Executive management is a stressful job. Pressure to perform comes from internal sources like the board of directors and external forces like shareholders and customers. Balancing work and family is always a time trade‐off. Mid‐level managers have the same pressures and even more because there are more levels of management above them, often with conflicting priorities. It is fully understood that management at all levels is likely to be constantly stressed to deliver products and services, no matter what the culture or industry. Managers also typically earned their management positions by focusing on the positive and making occasionally risky decisions that they were able to turn into opportunities. They will not always want to be faced with information about every way in which their operations could suffer from cyberattacks. They are often tempted to take shortcuts to get products out the door. In a technology environment, this means short cuts in system testing and soaking.

Although system testing is generally a well‐understood process, soak time is less so. To soak a technology system is to start it up and let it run in an environment as close as possible to how it would be used in production. This includes simulating the user input and output over the course of a business process cycle or two. Such input might include staff and customer data entry as well as daily, weekly, and monthly data aggregation and reporting. Of course, the timespan ...