ZenGRC

Simply Powerful GRC

Risk Management

Top Risk Management Issues Facing Higher Education

· ·

Institutions of higher education (IHEs) are besieged by risk, especially cybersecurity and information security risk. Risk management for these institutions is critical but also extremely challenging, like trying to juggle balls and lighted torches all at once.

Colleges and universities are worlds in themselves, providing not only classroom learning but health care, living quarters, meals, athletics, entertainment, research opportunities, and more to students, faculty, and staff. To pull it off, higher education institutions must collect a lot of personal data such as health records, financial information, scholastic records, and insurance information. These are the details that enable colleges to meet the needs of so many people every day. But possessing all this data makes every college and state university an enticing target for cyberthieves.

In addition, universities may conduct sensitive research, even working with the federal government on projects. Protecting the proprietary information that goes into and comes out of those projects is another challenge, especially given the rise in nation-state cyberattacks.

Meanwhile, the rise in digital learning, although convenient for students, offers cybercriminals a vast portal through which to access the system.

And then there are ancillary operations to consider. For example, there are development programs, which solicit and accept donations; third-party contractors, whose data must also be protected (and who must comply with the laws that the institution is required to follow); legal matters, and even retail sales. All these generate sensitive data, which must be protected—typically, not by a central enterprise risk management (ERM) team, as is the case with many corporations, but by multiple people working separately in a disparate, decentralized environment.

All the while, college and university risk managers must maintain compliance with a litany of laws and regulations:

  • Family Educational Rights and Privacy Act (FERPA), which prohibits higher education institutions from disclosing education records or student personally identifiable information (PII) without the student’s written consent
  • Federal Information Security Modernization Act of 2014 (FISMA 2014), which mandates the security of federal data
  • Gramm-Leach-Bliley Act (GLBA), a law governing financial institutions, including higher education, to ensure the security and confidentiality of customer PII
  • Health Insurance Portability and Accountability Act (HIPAA), a federal law mandating privacy protections for health records and other personal health information (PHI) and limiting their use and disclosures without authorization
  • Higher Education Act (HEA), which requires colleges and universities with Title IV (financial aid) programs to enact information security policies, safeguards, monitoring, and management practices. In addition, new federal memos link these programs with GLBA and the National Institute for Standards and Technology’s (NIST) special publication 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.
  • Student Aid Internet Gateway (SAIG) Enrollment Agreement, requiring IHEs with Title IV programs to protect Federal Student Aid applicant information
  • NIST 800-171, a federal cybersecurity framework whose compliance is required of institutions that bid on government research projects or accept federal dollars for financial aid

Noncompliance with these laws and regulations could spell disaster for higher education institutions, not just because of reputational risk, but also because penalties can be so severe.

You’re All in This Together: Enterprise Risk Management

The number-one recommendation for Chief Information Security Officers (CISO) and risk managers wishing to improve their institution’s security posture is to integrate the campus into a unified digital whole.

So often at colleges and universities, the left hand doesn’t know what the right hand is doing. Health services keeps students’ health data, for instance, while financial aid holds their financial records. That’s all well and good—to a point. But to effectively manage today’s security risks, someone needs to oversee the entire operation. Walls of separation need to tumble down, and the complete IT infrastructure needs to be managed as a cohesive whole. In the business world, this inclusive approach is known as “enterprise risk management”, or ERM.

ERM covers not just cybersecurity, but all risks, even those posed by natural disasters. It entails risk assessment, risk identification, and decision-making on an institution-wide scale. Steps include:

  1. Assess your starting point. What’s your institution’s security posture today? How secure are your contractors?
  2. Make improvements. Correct deficiencies you might have found in step 1.
  3. Look for new users. Monitor overall IT use to identify any new third parties on the network, and vet their security posture, as well.
  4. Identify gaps. Compare compliance requirements with what you’re doing, and see what must be done to fill them.
  5. Continuously monitor. Use software or other tools to track compliance and alert you when you fall short.
  6. Stay up-to-date. Know when new regulations or updates require changes, and make them as soon as possible.

Fortunately, a number of frameworks are available to help your institution manage risk and compliance.

  • The Federal Financial Institutions Examination Council’s Cybersecurity Assessment Tool helps map security controls to privacy rules for personal data.
  • The Institutions of Higher Education Compliance Framework helps assess and manage security related to federal financial aid.
  • NIST 800-171 is a useful framework for compliance with federal security regulations regarding government contracts.
  • Systems and Organization Controls for Service Organizations 2 (SOC 2) is helpful for ensuring the effectiveness of controls of third-party service providers such as IT service vendors.
  • The University Risk Management and Insurance Association offers many resources to members, including a risk management guide.

Get help if you need it

Keeping an entire higher education institution safe and resilient is an enormous job—too big for just one person, and maybe for an entire team. Those who’ve tried the task using spreadsheets wind up throwing up their hands in despair (or maybe they’re trying to keep their heads above the piles of paperwork).

Digital problems call for a digital solution. Software like ZenGRC simplifies the task of risk management and compliance with fast deployment, a user-friendly interface, system-wide gap analysis and to-do lists, continuous monitoring of risk and compliance posture, real-time compliance framework updates, vendor risk management, and more.

What is Risk Management in Manufacturing?

· ·

Risk management in manufacturing refers to the unique challenges that the manufacturing industry faces in managing risks. Cybersecurity risks can be especially challenging to manage.

Increased digital connectivity via artificial intelligence such as robots, the internet of things (IoT), augmented reality, and other forms of new technology can make factories more efficient. But every connection serves as a possible portal for cybercrime.

And the stakes for manufacturing organizations can be especially high. A breach of one factory or facility could cause shutdowns or damage to its sister factories, resulting not only in lost productivity and revenue, but also, possibly, worker injury and even death.

Special risk management considerations for manufacturing companies include:

Enhanced Risk Assessment

Assessing a manufacturing company’s potential risks doesn’t just entail examining its own IT systems and cybersecurity. Risk identification should extend throughout the supply chain, starting with providers of the raw materials its factories use, and include third-party vendors.

Strategic Risk Identification

What risks are likely to be your greatest concern years into the future? In a Deloitte survey of manufacturing companies, executives said cybersecurity would be their number-one risk management priority. Compliance with critical infrastructure risk management frameworks such as National Institute of Standards and Technology Special Publication 800-53, Security and Privacy Controls for Information Systems and Organizations, is key, especially for companies affected by federal security regulations regarding critical infrastructure.

SCADA Quality Assurance

Keeping Supervisory Control and Data Acquisition (SCADA) systems and Industrial Control Systems (ICS) always on is crucial, so quality assurance testing is imperative. SCADA systems monitor and control a plant or equipment in industries such as manufacturing, telecommunications, water and waste control, energy, oil and gas refining, and transportation. Upgrading and updating systems and software, and monitoring them continuously, are also key. Our 11-step guide to managing manufacturing risk can help.

Automated GRC

Numerous case studies show that software such as the Reciprocity ROAR® Platform can greatly simplify the task of risk management for manufacturing organizations, and ensure compliance with regulations and standards come audit time.

What is Cloud Security Control?

· ·

Cloud security control is a set of security controls that protects cloud environments against vulnerabilities and reduces the effects of malicious attacks.

A wide-ranging term, cloud security control includes all of the best practices, procedures, and guidelines that have to be implemented to secure cloud environments. Cloud security controls help companies address, evaluate, and implement cloud security.

In cloud computing, a cloud service provider hosts a company’s applications on its servers and makes them available over the Internet, while on-premises software is deployed in-house on a company’s own servers.

Since cloud computing differs from an on-premises deployment, it’s reasonable to expect that cloud security will also be different. It’s critical that organizations understand how cloud security differs from data center security before they migrate to the cloud. It’s also important for companies to implement security controls once they’ve finished the migration.

While cloud service providers offer a range of cloud security tools and services to secure customers’ networks and applications, the organizations’ administrators have to implement the necessary security controls. In addition, when companies move their sensitive data and applications to the cloud, user access takes place remotely. Consequently, administrators also have to implement cloud-based user access controls.

To become more agile, companies are distributing their cloud-based applications and sensitive data among a variety of cloud service and deployment models. 

Deployment Models

There are three main types of cloud deployment models: public, private, and hybrid.

Public clouds

In this case, public cloud providers, such as AWS (Amazon Web Services) and Microsoft Azure own the infrastructure, physical network, and hypervisor. The company owns the operating system, applications, virtual network, access to its tenant environment, and the data. Public cloud services may be free or offered through a variety of subscription or on-demand structures, including a pay-per-usage model.

The public cloud providers assume the responsibility for deploying cloud security controls for the cloud infrastructure. The organization has to implement security controls for the operating system, the applications, supporting infrastructure, and other assets running in the cloud.

However, some IT decision-makers are under the impression that public cloud providers are responsible for deploying security controls to protect their sensitive data as well as their applications in the cloud.

Private clouds

A private cloud consists of computing resources used exclusively by one business or organization. The private cloud can be physically located at an organization’s on-site datacenter, or it can be hosted by a third-party service provider. But in a private cloud, the services and infrastructure are always maintained on a private network and the hardware and software are dedicated solely to your organization. In this way, a private cloud can make it easier for an organization to customize its resources to meet specific IT requirements.

Hybrid clouds

Hybrid clouds combine on-premises infrastructure, or private clouds, with public clouds so organizations can reap the advantages of both. In a hybrid cloud, data and applications can move between private and public clouds for greater flexibility and more deployment options. For instance, you can use the public cloud for high-volume, lower-security needs such as web-based email, and the private cloud (or other on-premises infrastructure) for sensitive, business-critical operations, such as financial reporting.

In a hybrid cloud, “cloud bursting” is also an option. This is when an application or resource runs in the private cloud until there is a spike in demand (such as a seasonal event, like online shopping or tax filing), at which point the organization can “burst through” to the public cloud to tap into additional computing resources.

Service Models

Software as a service (SaaS)

SaaS vendors are mainly responsible for implementing cloud security controls for their platforms, including infrastructure and application security. However, SaaS vendors don’t own customer data and they’re not responsible for how customers use their applications. Rather, the organization is responsible for deploying cloud security controls to prevent and reduce the risk of malicious attacks.

Infrastructure as a service (IaaS)

IaaS delivers on-demand compute, network, and storage resources over the Internet on a pay-per-usage model. IaaS enables companies to run any operating system or applications on rented servers without the expense of operating and maintaining those servers. IaaS scales up and down automatically. Additionally, organizations don’t have to manually provision and manage physical servers in data centers.

Platform as a service (PaaS)

With the PaaS model, a cloud vendor provides a platform to customers to allow them to develop, run, and manage applications without having to build and maintain any infrastructure. A PaaS vendor hosts the hardware and software, including storage, network, servers, and data infrastructure on its own infrastructure. The PaaS service provider also supplies the development tools, data management, middleware, as well as the business intelligence software and services developers need to build their apps.

What is Hotel Risk Management?

· ·

Hotel risk management entails identifying, evaluating, prioritizing, and controlling risks to enterprises in the hotel industry. Hotel management faces several types of risk:

  • Operational risk to day-to day operations
  • Project risk, encountered when building or expanding a hotel
  • Strategic risk, to the hotel’s ability to achieve strategic objectives
  • Security risk, including cybersecurity

Hospitality businesses including hoteliers face the same risk management process as those in other industries, starting with a risk assessment and including decisions about whether to avoid, mitigate, or accept the risks that assessment reveals.

But hotel owners do face risks unique to the hospitality industry. Cybersecurity can be especially challenging. Renting hotel rooms to travelers from around the world means collecting personal data and payment card information from many people and businesses every day, and hackers are eager to exploit that data. Marriott International, Hilton, Hyatt, and Holiday Inn have all been victims of cyberattacks, and have revamped their risk management strategies.

Although there is no risk management framework specially developed for the hospitality industry, a number of frameworks are beneficial for secure hotel management. These include:

  • Payment Card Industry Data Security Standard (PCI DSS), compliance with which is required for all who store, process, or transmit payments by credit or debit card
  • General Data Protection Regulation (GDPR) for those processing the personal data of European Union residents
  • California Consumer Privacy Act (CCPA), for hotels processing the personal data of California residents or those with locations in California.

Introducing ZenGRC

· ·

A Connected Information Security Ecosystem 

At ZenGRC, our mission has always been to simplify the way your organization manages risk and compliance and to encourage transparency and trusted relationships with your key stakeholders. 

With ZenGRC, we delivered the industry’s best GRC solution and simplified a traditionally complicated tool to make it easy for CISOs, CROs, and CCOs to manage their organization’s information security. 

Today, we are excited to announce our next massive milestone: Integrations. 

ZenGRC is the first and only integrated GRC solution that fosters a continuous flow of information between the systems, applications, and people that are core to your business. It enables out-of-the-box connections to the tools you have in your tech stack to empower a connected information security experience for your organization.

Vision

Working closely with our ZenGRC customers, we realized how many different tools are used in every organization, from SMBs to enterprises. We knew how much time people spent manually exporting, modifying, and uploading information.  Evidence collection, reporting, and collaboration were exhausting and inefficient. 

With ZenGRC, we are automating that entire, complex process. ZenGRC provides always-on, cross-API integrations with the most widely used business and InfoSec tools.  Now, with just a few clicks, our customers can simplify workflows, automatically gather and distribute data, and continuously monitor their data to identify, assess, and mitigate risk in real-time.

ZenGRC allows for a range of benefits including automated evidence collection, cross-functional collaboration, integrated real-time reporting, and more. 

Our long-term vision is that ZenGRC will be your foundation for a robust and intelligent information security stack. We want to facilitate automatic, continuous — and worry-free — risk and compliance management with the ability to scale with your information security needs.

Integration Categories

These are the high-level functional categories for which we built ZenGRC integrations: Collaboration, Workflow, Business Intelligence, and Information Security.  

We are proud to offer 17 API integrations that are ready to use. We will continue to deepen these interactions overtime  —while also growing our application library to evolve as your tech stack grows.

Collaboration  

Cross-team communication is fundamental to any successful risk and compliance program.  We need to share information so we can make good decisions with our stakeholders about risk posture and audit objectives.  

We designed our first connectors to integrate with Slack. Our customers loved how that integration helped them to easily and efficiently communicate compliance tasks, audit requests and approvals, workflows, and more. We plan to build more integrations with other collaboration platforms soon.

Workflow 

Your teams use a number of tools to manage day-to-day work and requests. To simplify that process, we built strong integrations with Jira and ServiceNow. These connections allow you to automatically sync tickets and workflows with compliance to-dos and audit requests, in-app. Additionally, your teammates in product development can continue to use Jira while your audit team continues to process evidence collection and reports in ZenGRC. Cross-functional collaboration won’t be disrupted and everyone will be up to date via notifications in their preferred app. 

Business Intelligence

We’ve unlocked executive-level reporting with business intelligence tools like Tableau, as well. Through our integration with Tableau, we help you improve reporting while saving you time. Now you can decide exactly which data or object from ZenGRC to sync directly to a report in Tableau. 

Information Security

Our customers use a number of SaaS InfoSec tools to help run their businesses safely and efficiently. Take for example, storage. At the heart of any risk and compliance program is data: the files, documents, and evidence associated with audit controls, risks to be mitigated, and so forth. Where to store this data is a critical decision for your security team. So we built a variety of integrations based on the most widely used cloud storage solutions our customers use, like Box, OneDrive, Google Drive, and Amazon’s S3.

Then we considered the tedious effort that our customers spent on evidence collection and reporting. A series of repetitive tasks that are critical but time-consuming and manual. So we built connectors to enable automated evidence collection and continuous monitoring to applications like AWS, Splunk, and Qualys. These connections give you back hours a day while providing real-time visibility into your risk profile. 

The last area we wanted to address early on for information security was third-party identity and authentication. We know this is an important requirement for every business, stakeholder, and network. So now we have integrations available with providers like Centrify and Okta.

This is just the beginning of ZenGRC and a glance into how we view the world of information security. These integrations brings us a step closer towards our mission of simplifying risk and compliance and fostering transparency throughout the organization and its stakeholders.