5 Ways to Address IT Risk for Competitive Advantage

Jon Murphy outlines five steps any organization can take to proactively address risk and achieve competitive advantage.

By Jon Murphy

September 01, 2009 —

How is your environmental dynamism?

'Environmental dynamism' is the perceived rate of change brought on an organization by external forces. "The forecast for most companies is continued chaos with a chance of disaster," according to Geoffrey Colvin, noted Fortune Magazine columnist. Yet, if organizations do not adapt, change, and embrace the positive possibilities hiding in chaos, they begin to die. Conversely, organizations that allow unbridled growth and that do not proactively manage change invite a kind of chaos that could lead to an organizational form of cancer. That malignancy can consume all resources until almost nothing productive is left.

The headlines are full of former leading companies struggling for their very survival with this balancing act. In the realm of IT risk, some companies are faced with both extremes mentioned above simultaneously. The good news is the remedy is fairly straightforward, though not necessarily inexpensive. Here are five tips for remediation:

Tip # 1: Shore up the foundation first: Invest in infrastructure improvement
Asa Hutchinson, former Under Secretary for Border and Transportation Security, Department of Homeland Security, whose duties also included cyber security, recently stated that if private or public organizations are not "doing the basics of risk management hygiene," then the organization is "a headline waiting to happen." These basics include meeting some information security standard with requirements to log sensitive systems access, addressing Business Continuity/Disaster Recovery, employing intrusion checking systems, regularly scanning for vulnerabilities, and more.

The most obvious sign of a company failing to address the basics is a badly neglected IT infrastructure, which is the cornerstone and foundation for the rest of the effectiveness of IT overall. This vulnerability most often manifests itself in inadequate environment management systems/tools, old and unreliable hardware, and a status of neglect until something breaks. Remember, even the very best developed software and applications code is ineffective and inefficient if it rides atop poor infrastructure environments. Other necessary steps in this area include utilizing formal project management disciplines enterprise-wide, actively managing vendors, enforcing budget discipline, and reducing unwarranted complexity where possible.

• Print

• Jeff Spivey on Enterprise Risk Management
• Information Security Management: The Basics
• State of the CSO: Security's Influence Grows; Will It Last?