دانلود کتاب مدیریت ریسک امنیتی – نیروی محرکه برای انعطاف پذیری عملیاتی

All too frequently, businesses do not focus enough on the value that security risk management (SRM) can bring to the defense of their organization. Instead, they will all too often regard SRM as an afterthought and as something that should only be conducted after something has happened or something has gone wrong. The authors of this book will argue that the driving force for operational resilience should and must be leveraged, as the result of the proactive application of SRM practices. Would you ever imagine teaching a child the safe way to navigate across a busy road, without them first risk- assessing the conditions? Imagine what the situation would be like if parents and schoolteachers applied the same approach that many business leadership teams appear to have adopted: • Before stepping out into the road, the child does not need to look for hazards (threats) or consider the weather conditions, or even worry about the speed or type of vehicles traveling along the road. In its place, the child only needs to consider conducting a risk assessment after they have been hit by a speeding vehicle. As a result (if they live), they can understand the risks of what mistakes they made and the damage caused, to help them apply the lessons learned. As presented in the analogy above, reactive–rather than proactive–risk assessment can be incredibly costly. The authors of this book will present the concept that SRM should be behind every decision made and every implemented security measure, so that the business leadership teams have a better understanding of why these (often expensive) measures are implemented, which valued business operations/ assets they are helping to mitigate, and what the associated risks are. In today’s modern business operations, it seems common sense that the leadership teams would want to ensure that their valued operations remain robust and able to quickly bounce back from impactful occurrences. However, this does not appear to be the case, meaning that some areas of the globe have seen a need to bring in legislation (e.g., DORA (Regulation of the European Parliament and of the Council on Digital Operational Resilience for the Financial Sector and Amending Regulations (EC) No 1060/ 2009, (EU) No 648/ 2012, (EU) No 600/ 2014 and (EU) No 909/ 20141) so that some regulators (e.g., (Financial Conduct Authority (FCA), “FCA Handbook: SYSC 15A.2 Operational Resilience Requirements”2) have powers to enable them to ‘encourage’ the financial services sector to consider how they can maintain their operational resilience. In addition to the FCA’s guidance, under the topic of operational risk, the Basel Committee (Basel Committee on Banking Supervision3) and the Bank of England4 have created a comprehensive guide on the subject of Operational Resilience. This is stringently enforced within the Saudi Arabian banking rules (Saudi Arabian Monetary Authority5 and this area is starting to gather pace, Internationally, (Price Waterhouse Cooper (PWC)6). The UK FCA’s, “Operational Resilience”7) has defined operational resilience as being: “The capability of firms, financial market infrastructures and the financial sector to prevent, adapt and respond to, recover and learn from operational disruption.”