The Importance of Managing Data Risk in the Finance Function CFOs and controllers play a pivotal role in how companies evaluate and manage data risk. Analyst firm Gartner reports that by 2022, more than 30% of businesses will use financial risk assessments of their data assets to prioritize investment choices for IT, analytics, security and privacy. That needs to include managing data risk in the finance function itself. With the prolific ways organizations now have to share information, a persistently difficult issue for the Finance team is how to deal with its own sensitive data like financial statements, customer information and personnel records. The 2021 Financial Services Data Risk Report from Varonis estimates that the financial services industry will suffer the heaviest financial losses from data breaches, estimated at about US$5.85 million per breach. Lax internal practices are also problematic. Varonis found that, on average, employees in financial services organizations have access to almost 11 million files – and it’s closer to 20 million in larger firms. Almost two-thirds in their survey leave more than 1000 sensitive files open for every employee to access – with 20,000 exposed folders per terabyte of data. Additionally, outside organizations like banks, vendors and potential M&A candidates may require sharing sensitive data for legitimate business purposes. While laws and policies exist that provide some protection, you never really have certainty as to where data could end up, and you have no ability to control it once it is sent. The information that resides outside of the company’s security perimeter is accessible with equal permissions, meaning access is not restricted once someone gains it. Finance Faces Increased Risk All of this presents enormous risk. Understanding what the risks and potential costs are is an important component of business planning. How would the company react if information was disseminated to the wrong audience? What could it cost the business? It is human nature to think “it won’t happen to me” or to simply assume that a party erroneously receiving sensitive data will act with integrity and delete the information. But the news cycle is filled with examples of breaches; often there is a strong correlation between the event and the value of the company following the news. The financial risk is typically the cost of lost revenue, cost of litigation, compliance challenges, privacy regulation penalties, and reputational damage. Revenue loss risk and litigation costs risk are tangible impacts that can be measured. What is more difficult to do is to quantify the probability. On that front, having an understanding of your data’s level of vulnerability is important. If you are SOC2 compliant, your risk is going to be mitigated by the controls identified within the internal bounds of your system. However, it is difficult to assess probability for data that leaves your repositories. Internal compliance, including SOC2, cannot address it. Another challenge is that there is a multitude of methods by which to protect assets. Often times, leaders in organizations think that an increase in spend leads to an overall decrease in risk. That’s not necessarily the case. For example, companies could spend millions on digital rights management (DRM), security incident and event management (SIEM), data loss prevention (DLP) and other network controls, and still become breach victims through an application code vulnerability. The Need for Data Centric Security Depending on an organization’s size and industry, cybersecurity can be very complex. New attack methods and new technologies to deal with those attack vectors show up all the time. To maximize efforts at assessing security risk, resources must be allocated so that the most effective tools and strategies like data encryption are being used to protect the most important information assets. There are some best practices that leaders should follow to manage cyber risk. They should understand where there are exposures in either tools or processes. As technology now permeates across the Finance organization, a strong partnership with IT is critical. An important practice is to understand where sensitive data is stored and how access is provided to parties that need it―most importantly outside parties. Company policies and practices often overlook, or have no direct control, with data that goes outside of the organization so this awareness is important. Assessing their organization’s cyber risk starts with clearly understanding the company’s risk tolerance. Are you risk tolerant, or extremely risk averse? The answer may differ depending on what needs to be protected. In other words, what level of risk are you willing to accept and still be able to justify and defend to stakeholders? Identifying what the company views as acceptable risk will move it beyond a culture of fear and into one that can focus on execution.

If enacted, new federal rules would require banks to inform their primary federal regulator as soon as possible following a computer security incident.

A new advisory highlights the risk of PRC government-sponsored data theft.

Eliminating old, out-of-date encryption protocols can protect sensitive and valuable data from being accessed by adversaries, the NSA reiterated this week.

The travel company Sabre has agreed to pay $2.4 million and make changes to its cybersecurity policies following a 2017 data breach that exposed 1.3 million consumer credit cards.

NIST's latest guidance is geared towards preventing healthcare organizations that oversee PACS software from exposing patient data.

Threat analysis tools with updated intelligence feeds have become an essential part of defenders' toolkits. In this blog, we look at 50 threat intelligence tools that can help teams better protect their business.

Learn about data governance and data governance models, the key elements usually covered by policies, benefits, risks, and best practices.

The National Institute of Standards and Technology's Cybersecurity Framework is designed to help organizations manage their security risk; in this blog we'll go over its requirements, penalties for failing to comply with it, and best practices.

Looking to secure your AWS environment? We've gathered 50 security tips to help your organization manage credentials, protect data, mitigate abuse, and more.

Learn more about security orchestration, including how it works, the benefits, and how employing security orchestration tools can increase your organization's efficiency.

In our latest group interview, we asked 21 experts and business leaders what they think the most important thing for companies to keep in mind about managed detection and response costs is.

In a recent FBI note the agency outlined how DoppelPaymer ransomware attacks have impacted critical infrastructure - and the lengths the attackers have gone to get paid.

Learn about data security and the role it plays in many data protection solutions in Data Protection 101, our series on the fundamentals of data security.

With more and more companies making the move to the cloud, security remains an utmost concern. Reviewing a cloud security solution? Ask yourself these 50 questions.

The news, while familiar, is yet another reminder of the importance of securing critical patient data.

The FBI says scammers are increasingly abusing forwarding rules on web-based email clients to hide their activity, opening the door for a Business Email Compromise (BEC) attack.

Learn about how security operations centers work and why many organizations rely on SOCs as a valuable resource for security incident detection.

The FBI is urging the American public to ensure they're getting "reliable and verified FBI information."

Digital Guardian placed the highest among cybersecurity companies, medium-sized business category, in the Boston Globe's Top Places to Work list.