Integrated IT Governance Framework - Hybrid Work and Knowing what your GRC Security Threats Are.

2020 - The year that changed everything in the world as we know it.
March 2020, a month that will continue to resonate with the majority, if not all, people on the planet. The month in which most countries around the world implemented COVID 19 hard lockdowns within their borders. The month that changed the way we do business in the most dramatic and immediate way ever seen. Some will argue that there was no interruption at all because their company was already well into a "business as usual" cloud adoption strategy. Others struggled to accept that all or a significant portion of their workforce was now working from a "home office." These "offices" include the spare room, a study, and the kitchen counter. Two and a half years later, and I believe we can all agree, this year and all the changes it brought had a significant impact on the escalation of what is now considered the number one risk for most businesses worldwide.
Predictably unpredictable – The Cyber Risk Evolution.
"Tomorrow is going to be predictably unpredictable," to quote Mr. Todd Nightingale, Cisco Executive VP, in a recent Sunday Times article, really sums up the situation as we contemplate the future business landscape, two and a half years after COVID 19 lockdowns hit the world and changed it immeasurably. The changes that occurred in all aspects of life and living are still evolving, and the consequences are still being assessed. However, I believe that the major impacts relating to how we work will be with us indefinitely. Perhaps not in every industry, but in many.
The Work from Home event was the most rapid change in business operations on a global scale in recorded history. This change impacted many things, both personally and professionally, but most notably IT departments and information management, as well as the way we need to think about our Governance, Risk, and Compliance strategies, including Continuity of Business and Business Resilience.
Given the speed with which most businesses implemented Work from Home strategies, many failed to carry out a complete, context-informed, business impact assessment, and consequence analysis in the fine detail that was required. As a result, many organizations that had previously relied primarily on on-premises IT infrastructure or an evolving cloud hybrid quickly migrated to hybrid cloud or total cloud adoption. They then maintained a "management by crisis" business as "unusual" strategy over the last two years, dealing with event after event.
We have seen an explosion of cyber risk in the last two years, resulting in company data compromise, loss, extortion, ransomware attacks, and information leakage on a scale that the world never thought was possible in 2019, certainly not on the scale we see today, but is now, sadly, a daily norm in 2022.
However, over the last two years, there has been no significant evolution in IT GRC and enterprise GRC approaches to match the growth path of cyber risks. Even if a lot of technology has been adopted with the vague comfort level of "I'm pretty sure we're secure," organizations can still be severely compromised. Why?
Many organizations lack the GRC, (governance, risk, and compliance) maturity levels needed to deal with the scope of risk as the world was in 2019. They certainly are not ready for the unknown scope of the unpredictable, rapidly evolving and changing risks of 2022 and beyond.
So, what is the answer?
The Challenge.
Ransomware attacks continue to evolve at a rate that outpaces most businesses' ability to keep up and secure their data. This has grown exponentially in most businesses, to a degree that few want to confront or admit. No business can honestly claim that cybercrime is not a top risk concern right now. Work-from-home strategies are evolving into hybrid work schedules, as are new emerging risks such as high fuel costs, supply chain disruptions and shortages, the emergence of digital currencies and digital exchanges, branchless banking, and others. All of this should have significantly evolved the "Context of the Organizations" evaluation assessments, as they should be in effective Risk Management strategies.
However, given the magnitude or context of the risk universe, this is not occurring, or is not occurring effectively enough. Many Risk and GRC professionals have struggled to make the business understand the critical value of a Context of the Organization Impact assessment. Every time a significant change occurs in the business, this activity should be performed as a routine tool. Nonetheless, maturity benchmark results show that most business executives and management teams have no idea what this tool is, let alone how effective it is in continuous use in the business, as part of strategy and business planning at operational levels.
The Security Focus Africa survey for “State of Ransomware 2022”, indicates that 51% of the South African companies included in the survey, were hit by ransomware. Many succumbed to paying the ransom yet remained compromised in getting their data back.
Our ongoing consultations with clients as part of the process of closing identified security and cyber risk gaps reveal that, despite good backup procedures and quick data restoration, which would avoid paying the ransom, such clients have been subjected to extortion in which data has been encrypted and taken by ransom attackers, who then contact the affected company and threaten to publish sensitive information on the open internet and social media forums. As a result, the ransom attack has evolved into extortion.
Management teams, MDs, CEOs, and business owners frequently tell us that their IT teams have told them that security is under control and well managed. When pressed for specifics, this conversation takes a very different turn, with senior management becoming less confident that they "really" know the state of security and cyber risk resilience levels within their business, transparently and objectively. We consistently see the following risk areas with low maturity scores when conducting cyber risk, information security, and data privacy maturity evaluations.

Common Cybersecurity | Data Privacy | Information Security | IT Governance Maturity Gaps

Maturity Evaluation GRC Verticals Covered by Assessed Respondents.
The most significant area of identified weakness in the 437 maturity evaluations conducted by our business partner Guideline Biztech and their RUBIQ team to date is a structured approach to Information Security Management. Many organizations would benefit greatly from implementing an ISO 27001-compliant ISMS Information Management System. Few, however, have taken the time to properly design and implement an ISMS. There is no doubt that companies that have focused on the implementation of an ISMS, which includes the scope of Data Privacy and Cyber Security, have seen exceptional improvement in the management of IT Governance, Data Privacy Management, and overall maturity across the organization.

Given the hype surrounding POPIA in 2021, many organizations chose to conduct Data Privacy and POPIA / GDPR maturity assessments, which account for the majority of the data set. We included a key focus on information security in the maturity evaluations completed by companies on Data Privacy. We then compared this data to the company's alignment to ISO 27001 clause assessment and the ISO 27002 Annexure A Controls review, and the results were uniformly very poor. Clearly indicating the very low maturity level that exists within organizations in this regard.
When combined with the evaluations we conducted during the maturity assessment, which were related to the organization's approach and general practice to Good IT Housekeeping practice, which included an assessment of Ransomware and Data Breach susceptibility, the results were once again very poor, with most organizations showing a high probability of a ransomware attack, given their cyber risk scores, and demonstrated maturity levels for information protection and data management.
The Maturity Evaluation benchmark data also shows that several other enterprise GRC verticals, such as Ethics, People Risks, Financial Controls, and Enterprise Governance, Risk Management, and Compliance (EGRC) approach overall, to Governance, Risk, and Compliance management, as well as maturity related to Internal Audit, have averagely low maturity levels.
To date, the companies included in the Maturity Evaluations span a broad spectrum of sectors and industries, as well as inclusion in the sampling of small, medium, medium large, and enterprise organizations.

Key findings, we should take note of, relate to the following findings:
Lack of correlation of perception of control at different levels in the organisation - This means that all parties are not on the same page. When control processes and procedures are reviewed and discussed at senior levels versus IT Admins and Technicians at lower levels, the common perception of what is thought to be in practice and consistently applied is discovered to be incorrect. As a result, threat actors have a hidden risk and opportunity to exploit vulnerabilities. Furthermore, in client environments where we have deployed sensors and run attack simulations, we have discovered weaknesses that should have been identified through IT vulnerability testing and ongoing monitoring techniques. However, they were overlooked. We have even made discoveries in some clients where the attackers had been lurking for not just hours, or even days, but months within the client's internal IT environments, planning their attack to their advantage. Standard IT monitoring and assessment tools have failed to detect and identify it.
No insights to, unknown / changing / emerging risks tracking and Control Assurance - This results in inadequate risk evaluation and risk identification practices. Inadequate interpretation of data, trends, and risk indicators. Risk registers are documented, frequently in Excel spreadsheets, and with little or no context of the organisation evaluation assessment process. In general, these "risk assessment" exercises are "old school," tick box, subjective type of exercises that fail to use insight tools and effective information and key indicators, interpretation, due to a lack of skills, time, and expertise to read the data outputs, in terms of risks. We live in an age of information and 4IR that is completely dominated by technology. Criminals understand the world and exploit it to their advantage. However, business and IT teams do not effectively use expertise, skills, know-how, and the appropriate use of insights and detective technologies. Add to this a lack of maturity in the adoption of governance-driven risk and Control Assurance Attestation Frameworks that are embedded and enforced within organizations, with clear lines of accountability and responsibility, and you have a recipe for "Management by Crisis".
Lack of understanding of the real time risk posture - Given the scarcity of time these days, risk and compliance systems tend to be static and one-dimensional. Input data to such GRC or IT GRC information systems becomes a stumbling block to maintain, API integrations are costly and require skill, and risk ownership across the organization landscape is rarely well defined and clearly
understood. The IT Department, it is commonly assumed, should handle everything. This could not be further from the ideal, but it is the situation, company for company. Everyone in the organization deals with information, so protecting it is, to some extent, in everyone's job description. Without a well-established risk-aware culture, the human risk factor will always be the weakest link. Add to that the fact that technical salespeople sell cool technical tools to IT professionals who are constantly on the lookout for the latest and greatest in technology. We shouldn't be surprised that the maturity of IT GRC is so low. Many people will be offended by this statement, but statistics don't lie, and they are what they are.
The process of truly contextualizing the risk, with consultation and insights from both the internal and external risk universes of the organization, is simply not done well, or at all. As a result, there is a lot of cool technology that is frequently misconfigured, leaving gaps for criminals to exploit.
The impact of such attacks can be catastrophic for a company in the worst-case scenario, or significant and often crippling in the best-case scenario. Costs include not only the ransomware itself, but also the direct costs of regulatory fines and penalties, as well as the more concerning hidden costs of customer shrinkage because of reputational damage and other knock-on effects. Because this impact can occur after a serious event, it is frequently overlooked because of the initial incident. However, if the client does not deal with the company again or contracts are not re-signed for the following year, the cost of the knock-on effect can be greater than the original event itself.
Overall, it should come as no surprise that cybercrime is a staggering global issue that many businesses are unable to effectively control.
We have the solution for you.
RUBIQ is a cloud-based platform that uses cutting-edge technology to provide a genuinely unique, comprehensive, and dynamic governance, risk, and compliance ("GRC") management solution for any sized company, wherever in the world. RUBIQ is easy to use, has a lot of, ready to use knowledge repositories and information and features, and is, relatively, inexpensive, regardless of the size of your company, without negating, the sophistication of the insights, that our approach brings to your business. RUBIQ is the culmination of the combined experience of GRC knowledge and expertise and GRC Technology know-how on the part of the Founder, CEO and key subject matter experts, that exceeds 75 years.
The RUBIQ Team has developed a unique and proprietary approach, to addressing the challenges in IT GRC. This approach has been developed in line with the key discoveries made from our GRC and IT GRC maturity assessment initiative, that has been running for the last year and half. The maturity assessment initiative has led to the fine tuning of our Advisory / Solution programmes, which makes unique use of both a select set of technical insights, analysis, and data governance audit tools, as well as the body of Subject Matter Expert developed content, where we have worked with leading advisory specialists in their fields. The RUBIQ Advisory Programmes are broken down into 3 initial phases, with a final 4th embedment and enforcement phase.
Phase 1 - is a discovery insights phase that assists customers in discovering what they don't know they don't know. One cannot address a challenge or problem that they are unaware of. We addressed some of the findings in the bullet points above, but the overarching issue is the biased information that reaches the ears of business owners, C-level executives, and board members. The problem is that information providers tend to have personal or job preservation goals that they can't help but drive; it's human nature. As a result, the true hidden risk, or the true opportunity for risk, is either watered down, as in "the, we have it covered," statements, or the risk is truly unknown, as the context of the environment is not effectively interrogated. This presents an opportunity for threat actors, who may be deep within your organization strategizing attacks for months before the actual attack. As management of holistic GRC strategies, including IT GRC strategies, remains immature, criminals exploit the situation and gain an advantage that IT administrators and management are completely unaware of. This phase assists in determining what management and IT Teams are unaware of.
Phase 2 - addresses a plan to close the identified gaps and establishes priorities based on the criticality of risk exposure.
Phase 3 - addresses a step-by-step approach to implementing new processes, correcting technical control configuration, reinforcing both process and technical tools, and adding or removing tools to streamline overall IT GRC efficiency in dealing with Cyber Risks, Data Privacy, and managing information security in accordance with best practice frameworks and legislation and regulatory requirements.
Phase 4 - provides ongoing support via a month-to-month subscription, in which the control assurance, improved framework developed in Phase 3 is embedded and continuously enforced, providing management with transparent, unbiased information that supports informed decision making.
The results of all 4 phases, fully completed and embedded are:
- Meet compliance requirements.
- Prevent disasters that hurt people and your business.
- Prevent critical events that hurt your stakeholders.
- Maintain and improve brand value.
- Strengthen and grow business.
- Support a customer centric culture.
- Competitive differentiator and gain a competitive advantage.
- Support innovation
- Ultimately, it’s your responsibility.
Why conduct maturity Evaluations?
It is well documented that Companies with a high degree of GRC / IT GRC, integrated maturity, achieved within their organisations are:
- More likely to meet and exceed expectations in achievement of objectives.
- Less likely to be the adverse effect of a serious incident / event.
- Have far higher customer retention levels than their competitors.
- Are perceived by their customers and key stakeholders with a higher level of trust and confidence.
- Demonstrate significant increased capabilities to deal with the “unexpected”.
- Demonstrate far higher levels of resilience to interruptions and crisis.
Realize the value of better decision making, through access to unbiased & transparent information.
Unfortunately, very few organisations take the time to effectively develop a GRC / IT GRC roadmap and supporting strategy, against a proven and workable, GRC Maturity Model.
Address your IT Governance and GRC challenges with MWare Consulting. We offer an advanced advisory and managed GRC platform solution capability that support operations best practices which you need to manage your business more efficiently.
Take the free online quick assessment, as a quick test of your current IT GRC status.






