Libby Bevin

Technical product managers play a crucial role in an organization, helping with the development and marketing of a company’s products while also serving as the main point of contact between the product development team, the marketing team, and customers. Nick Brown recently joined Reciprocity as a Technical Product Manager for our ROAR platform, and is helping to ensure the continued success of our pioneering new approach to risk management.

It’s Never Boring

Nick has been a Technical Product Manager for the past 4 years, using his engineering background, technical expertise, and natural interest in all things technology-related, to help companies like Reciprocity develop, deliver, and scale their software-based solutions. In addition to working directly with our development team, he also represents the voice of our customers in the R&D process, ensuring we’re always aware of what people want, what they’re asking for, and how they are using our solutions.

“The interesting thing about the role is that it is always changing. Some days, you’ll be deeply involved in day-to-day R&D activities, for example, working with the development team on their daily stand-ups. On other days, you’ll be in front of customers a bit more, spending time speaking at conferences or assisting with sales calls. But whatever you’re doing, it’s never boring,” Nick explains.

A Non-Traditional Path

Nick didn’t follow the ‘traditional’ path to becoming a Technical Product Manager. He didn’t go to school to be a product manager. Instead, he got a Bachelor of Science degree in computer engineering. However, he had always been interested in the software side of things, spending some of his free time researching and working with different operating systems. This helped him get his first role as Tech Support for a software company. As he enjoyed learning about the product – and knew it so well – he also started doing some product training, then made the jump to Sales.

“When I transitioned from Tech Support to Sales Engineer, I went from supporting the product to selling the product – but success in either of these roles is based on the same concept. You have to understand every aspect of the product – front, back, inside and out. It’s only when you truly know how something works, as well as what people should do when it doesn’t work, that you can successfully start selling the product.”

It wasn’t a big step for Nick to then transition to Technical Product Manager, where his subject matter expertise could be applied to influencing the direction of the product.

“I really enjoy the strategic aspect of the role, helping to determine what comes next for the product, as well as for the business. Eventually, I’d like to be more involved in ‘greenfield’ projects, where we can see the direction the market is heading and come up with new approaches – and new products – that have never before been considered.”

Be Flexible

Even though Nick doesn’t have a background in software, he is still having an impact on the software industry. As a subject matter expert on our pioneering new ROAR platform, he’s helping us change the way that businesses approach risk management by enabling them to avoid, control, and mitigate risk in business processes by providing clear, executive-level visibility into risk.

“If you don’t have a background in software (like me), then the best thing you can do is educate yourself. Work on it in your spare time. Computers have always been a hobby of mine, so working with weird, esoteric operating systems was just something I did – and that’s what got my foot in the door. It’s also important to be flexible. If you’re interested in Technical Product Management, you need an engineering mindset but you also need to be creative. While you need to be able to reason through things, you also need to be able to make leaps.”

The Next Challenge

Reciprocity continues to grow at an exponential rate, which is creating new career opportunities for people like Nick, who are always ready for the next challenge. We know there is much more to come from Nick, so definitely keep an eye on him – and his LinkedIn profile – to track his career!

Interested in a career at Reciprocity? Check out our current job openings.

Risk is inseparable from the modern business landscape – and therefore, every company needs an effective risk management program to identify, assess, manage, and mitigate risk.

Robust processes, solid internal controls, and an enterprise risk management framework can help an organization identify best practices, share knowledge, and track metrics to meet these strategic objectives. But another critical element to risk management binds all those other components together: risk culture.

The Institute of Risk Management (IRM) defines risk culture as “the values, beliefs, knowledge, attitudes, and understanding of risk shared by a group of people with a common purpose.” This culture encompasses every aspect of risk, including:

• Which risks are relevant to the organization
• How these risks will be managed
• Risk appetite and risk tolerance
• How decisions about risk are made

A healthy risk culture means everyone understands the organization’s approach to risk, follows risk management policies and practices, and takes responsibility for managing risk.

Why a Strong Risk Culture Matters

A strong risk culture matters because, ultimately, people are what makes effective risk management possible. A risk-aware culture promotes a shared understanding of risk and supports the organization’s strategy, business model, operational practices, and competitive advantage.

When firms don’t foster a risk culture, they struggle to manage risk. As a result, they are vulnerable to potentially crippling consequences. They may make poor decisions that prevent the organization from achieving its operational and strategic goals. In the worst cases, those poor choices damage the company’s financial standing, compliance posture, and reputation.

A strong risk culture allows organizations to design appropriate risk management processes, mechanisms, and policies. It provides organizations with language for articulating acceptable levels of risk. Then accountability for risk management and decision-making is improved, and that ultimately drives the success of the enterprise risk management (ERM) program.

Creating a solid risk culture starts with assessing the current risk culture and evaluating the sustainability of risk management initiatives. Those things, in turn, begin with a look at your organization’s risk appetite.

What Is Risk Appetite?

Risk appetite is the amount of risk a company is prepared to take to achieve its goals before deciding what steps to take to lower that risk. Organizations assess their risk appetite to see how much financial and operational risk they are prepared to accept to innovate and achieve their goals.

The first thing to understand about risk appetite is that you decide (or more precisely, the senior management team decides) the level of risk-taking your company is willing to bear. Why? Because figuring out your risk appetite will help you determine how much risk you can handle, which helps you to distinguish risk tolerance from risk appetite.

Industry, corporate culture, rivals, nature of the goals pursued (such as how aggressive they are), financial strength, and organizational capacities are just a few of the variables that might affect risk appetite. It’s also important to remember that your risk tolerance may fluctuate over time. Therefore, it’s usually a good idea to evaluate your risk profile against risk criteria regularly – say, once or twice yearly, or perhaps even daily in particular risk situations. The frequency depends on the situation, available resources, talents, technologies, or systems.

Why Is Risk Appetite Important?

Understanding risk appetite is crucial because decision-makers must know what their risk exposure is if they want to perform effective risk analysis. For example, an organization implementing new business systems can focus on growth opportunities after determining the cyber risk appetite related to their business objectives.

Additionally, risk appetite helps the company to identify initiatives that limit potential losses and achieve higher returns. That increases the investor’s and the entity’s overall rewards.

What Is a Risk Appetite Statement?

An organization’s risk appetite is documented in a risk appetite statement, which outlines the risk-taking initiatives necessary to meet business objectives as well as the steps to take to reduce bad outcomes.

Every leader can benefit from a meaningful risk appetite statement that aligns with the organization’s goals, as a tool to support risk-aware decision-making. In addition, a public risk appetite statement strengthens your company’s commitment to mindful risk management in a risk-aware culture.

A good risk appetite statement includes plans for tackling any risks that threaten the organization’s capacity to accomplish its objectives. Here are a few fundamental ideas to keep in mind as you prepare to write your organization’s risk appetite statement.

Recruit a Diverse Workforce to Produce the Document

You’ll get a more informed and precise description of the organization’s risks when you include viewpoints from across the enterprise while writing your statement, so solicit input from a varied group of stakeholders and subject matter experts. Share examples of compelling risk appetite statements with the group, and remind them of the organization’s business objectives to get everyone up to speed on the job.

Start With a Plan

The organization’s goals and business objectives directly affect the level of risk it is willing to assume. Using those as the group’s “north star” will help the team stay on task and create a better document for evaluating risk exposure and developing the risk appetite statement.

Include a Brief Executive Summary

Every organization has an extensive collection of company documents, policies, and procedures; you want your risk appetite declaration that will actually be read, distributed, and used. Incorporate an engaging executive summary to outline the purpose of the document. Include images and graphics because those items are frequently a simpler, more powerful way to convey information.

Give Clear, Quantitative Definitions of Measurements

Metrics give teams a way to gauge risk levels. While some organizations develop their own risk scoring scales, others rely on well-known models and methods. Whatever approach you decide on should be easy enough for the reader to understand and use.

Metrics and charts also help visualize volatility and concentrations of risk, which helps for quick decision-making. For example, how many job openings can the company tolerate? How many hours of system downtime are acceptable? Concerns are quickly visible with metrics and graphs.

Remain Current

A risk appetite statement should be a “living document.” Review it at least once a year to assure that it still reflects the organization’s evolving risk appetite and current strategic objectives.

How to Assess Your Workplace Risk Culture

When evaluating your workforce’s risk culture and risk intelligence, it’s essential to assess several factors.

Risk Messaging and Communication

A strong risk culture promotes uniformity in risk messaging and a shared understanding of risk across the enterprise. Clear communication using a shared risk vocabulary improves the organization’s risk understanding, intelligence, and culture.

If this messaging is inconsistent (especially from leadership or senior management), that creates confusion among the broader workforce and weakens overall risk management.

Understanding of the Value of Risk Management

In a risk-intelligent culture, people understand risk and see the value of risk management. Moreover, they take responsibility for risk management and encourage others to do the same. They feel comfortable challenging authority figures (respectfully), and those leaders recognize that such conversations help strengthen the risk culture and respond positively.

Risk Governance Structure

The enterprise risk governance structure influences risk management and risk intelligence. This structure should include risk management policies, procedures, oversight activities, various types of risk assessments, risk indicator reports, and code of conduct and ethics programs.

Alignment of Individual Interests and Organizational Risk Strategy

When individual interests and values align with corporate values, risk appetite, tolerance, and strategic objectives, it usually indicates a risk-intelligent risk organization. A sense of common purpose, ethics, and approach among individuals and the enterprise helps to minimize risk and boost decision-making.

Regulatory Requirements and Other External Attributes

Regulatory requirements and the expectations of customers, investors, and other stakeholders can affect risk culture. If the organization aligns its risk management processes with these expectations, it can strengthen its risk culture and improve its risk resilience.

Critical Elements of a Strong Risk Culture

These key characteristics characterize strong risk culture:

• An enterprise-wide definition of risk and a risk “language”
• A common risk management framework supported by standards and controls
• Clearly-defined roles, responsibilities, and decision-making authority
• A workforce that takes individual and collective responsibility to manage risk
• A robust infrastructure to help business units meet their risk management responsibilities with full accountability
• Full transparency and visibility into risk management practices, particularly for governing bodies such as audit committees and the board of directors
• Shared functions such as IT, legal, HR, and finance help business units manage their risks in alignment with the overall enterprise risk program
• Compliance, internal audits, and risk management teams monitor the risk function and report its effectiveness and performance to the leadership, the Board, and other governing bodies
• Learning is encouraged to manage risks more effectively and avoid repeating mistakes
• Decision-making is guided by both organizational strategy and ethics

5 Strategies to Improve Risk Culture

A healthy risk culture strengthens risk management and improves risk-related decision-making. Building that effort, however, requires time and patience. Fortunately, an organization can create the desired risk culture if it follows these five strategies.

Start From the Top Down

Risk culture depends on the support and involvement of executive leadership. C-suites and corporate boards must be convinced of the value of good risk culture, prioritize it, and communicate its value across the workforce. They must build a consensus about the type of culture they want, why they want it, and how it can be enhanced.

Above all, leadership must lead by example and demonstrate desired risk-related behaviors and business decisions.

Employee Risk Awareness Training

To improve risk awareness, leadership should communicate using a common risk management vocabulary. Risk management roles, responsibilities, and accountability structures should be set up and shared. If possible, employees should receive customized training based on their duties and business unit. Risk management education should be included in new employee training.

Increase Risk Visibility

When employees have better visibility into risks, they can understand individual and collective actions necessary to manage them. Take advantage of having well-informed employees; seek employee feedback. Employee involvement can strengthen the risk culture significantly.

For example, employees can help identify specific risks and participate in establishing robust protocols, policies to guide actions, and communication flows to share risk information.

Align Risk Performance Metrics with Incentive Systems

Rewards, recognition, and incentives are powerful ways to drive and reinforce positive employee behaviors. Embedding risk performance metrics into motivational systems and compensation structures can help drive positive risk-related behaviors and strengthen the risk culture.

At the same time, it’s also important to hold people accountable for their actions and quickly address gaps that harm risk management and weaken risk culture.

Evaluate and Report Progress with Quantitative and Qualitative Metrics

The effectiveness and performance of the organization’s risk culture can be evaluated by looking at:

• Risk management ownership by business units
• Acceptable level of leadership and board support and sponsorship
• Results of critical risk-related decisions
• Use of risk appetite and tolerances in decision-making
• Alignment of risk management policies with strategic planning and risk culture with organizational culture

As risk appetite, risk tolerance, or business strategy change, these metrics should be modified to support ongoing risk culture evaluations.

Manage Risk Appetite Efficiently with Reciprocity ZenRisk

Enhanced risk visibility is invaluable to promoting a solid, risk-intelligent culture. Improve visibility into your risk landscape with the integrated risk software solution offered by Reciprocity ZenRisk. ZenRisk shows where risks exist and where they are changing so you can take the necessary actions to minimize business exposure.

ZenRisk provides multivariable scoring to help you evaluate risks across connections and business objectives. Identify and remediate threats in real-time with its intuitive workflows and automated alerts that support continuous risk monitoring.

Solve your risk management challenges and drive a thriving risk culture with Reciprocity ZenRisk. Schedule a demo today to see how Reciprocity ZenRisk can help your organization.

IN COLLABORATION WITH ELLIOTT DAVIS: EMERGING DEVELOPMENTS & HOT TOPICS, GRC

In a 2021 survey of CIOs, respondents cited limited resources, new or changing regulations, and tracking and maintaining compliance as the top three challenges keeping them up at night. With teams stretched thin trying to keep up with compliance requirements and growing numbers of threats and stakeholder demands, manual processes can no longer keep up with today’s Governance, Risk, and Compliance challenges.

Automating GRC creates a more reliable and comprehensive approach to GRC while optimizing your teams’ talent by freeing them from manual work.

Join us for a discussion on how a risk-first approach can provide strategic insight for better prioritization and decision making and how automation can optimize efficiency and accelerate effective GRC.

You’ll learn:

• How to focus your planning efforts around strategic business priorities
• How to automate evidence collection, risk scoring and monitoring
• Actionable insights to help you communicate better with stakeholders

Duration: 59 minutes

It seems like the next flavor of cyberattack is always making the news, a constant reminder of how vigilant businesses need to be to try and keep themselves, their customers and their suppliers safe. Almost every organization of any size will have some sort of vulnerability assessment and management program, security hardening framework and basic training for employees to recognize malicious emails and phishing attacks.

These are still some of the best front-line defenses businesses can use to keep themselves, their data and their customers safe. However, there are some new and fascinating attacks out there, including some new versions of attacks we’ve seen before in the wild.

Ransomware and the Evolution of Old Favorites

By now, everyone is probably familiar with the concept of ransomware, where a bad actor uses a method like phishing to get someone to run a malicious program, encrypting all the data it can access and holding the decryption keys for ransom. The interesting thing about this type of attack is that it’s in the attacker’s best interest to do exactly as they say and decrypt the data when their demands are met. Otherwise, after a few attacks, word will spread that the data is irreparably lost and no one would consider paying up.

However, there is a ransomware group known as Alphv (aka BlackCat) who threw in a twist! They set up a publicly-available website where they leaked some of the information they stole so anyone could access it. The information exposed was primarily data about employees and customers that could be useful vectors for other phishing attacks to appear legitimate.

And with that, it changed the risk calculus for ransomware. Having good backups that are tested regularly is no longer sufficient to take care of the bulk of ransomware attack damage. Organizations need to revisit how they accept, mitigate or transfer this possible risk to their data.

Speculative Execution Attacks

Back in 2018, a new class of attacks came to the attention of cybersecurity researchers and practitioners: Speculative Execution Attacks. Speculative execution itself is a powerful tool used by modern computer processors to take an educated guess at what it will be asked to execute next and start executing that code before it’s asked to. This can greatly increase performance if done well and is at the heart of much of the improvement seen from the last few generations of processors.

However, it can also be a powerful tool in cyber attacks. At a (very) high level, a speculative execution attack involves inferring private data by watching the results returned when a processor mispredicts what code it will be asked to execute next. The actual mechanisms by which they do this are deeply complicated and leverage the internal architecture of the processor to execute the attack.

Perhaps the scariest and most amazing thing about attacks of this type is that they can be performed with something as simple as Javascript embedded in a web page. And before you know it, your data is publically shared on the internet.

How To Mitigate an Attack on the CPU Design Itself

It’s not all bad news. There are ways to mitigate these types of attacks such as turning off some advanced features of a processor or adding extra steps to execution, such as flushing out buffers. But, as you might imagine, turning off features or purposely adding in more steps slows things down. Which is why organizations must take a risk-first approach to mitigations. What is the risk of implementing these mitigations? And what is the risk if we don’t?

Some mitigations can completely defeat a particular class of attack, such as disabling hyperthreading or simultaneous multithreading (SMT) to prevent Spectre-type attacks. However, the performance penalty is very substantial and not acceptable to many. When you assess this in the context of your organization’s desire to keep its data safe, you can find the right balance between impact and value.

This also allows you to identify a “plan b”. When the risk is too high but the mitigation is unacceptable, you look for a third option. Google developed a technique called “retpoline” (short for return trampoline) that mitigates Spectre-type attacks without disabling SMT and incurring a much smaller performance penalty. Essentially you’re able to lower the risk AND maintain acceptable performance AND protect your data.

A New Challenger Appears

Just a few weeks ago, in mid-July, security researchers revealed a new type of speculative execution attack that completely defeats retpoline as a mitigation method. For this reason, it was termed “retbleed,” a portmanteau of Heartbleed (a previous attack type) and retpoline. Retbleed is capable of leaking private data with high accuracy on processors and as of the time I’m writing this, mitigations aren’t widely available.

Researchers hypothesize a performance penalty of between 12 and 28% when mitigations do become available. If the mitigations will be turned on by default, or if the performance predictions come to pass, remains to be seen.

What This Actually Means For You

For a risk management program, something like retbleed poses a particular challenge. There is no current mitigation strategy. There will presumably be in the future, but:

• Will it be acceptable to implement across the entire organization’s IT infrastructure?
• Do the mitigation strategies need to be enabled for each and every asset, or is there a strategy for protecting the most vulnerable or valuable assets?
• Can we transfer some of this risk with cybersecurity insurance?
• If an employee is browsing the web and comes across a malicious site, what do they have access to?
• How could a bad actor use information like passwords from their PC to get a foothold in the company’s network?

This is where the ZenGRC comes in. We’ve already split out many different types of risk, such as business interruption, risk to reputation, diminished competitiveness, etc. Each of these can be evaluated and scored individually, taking into account the impact on the business and the likelihood of the risk being realized.

With this, you can tailor your treatment plan, determine residual risk and get a holistic view of your risk posture. Why not give it a try? Sign up for our FREE trial of ZenGRC. No credit card required, unlimited time to explore. Or register for a FREE live demo to see ZenGRC in action.

Check out our latest infographic, “Security Threats are Evolving – So Why Isn’t Your Security Program?” to continue your learning journey.