Maturing Ethical Risk

The pervasive and accepted thought when dealing with cybersecurity is to evaluate risk from the organization’s perspective: the organization protects itself through assessing risk. There may not be equivalent financial incentive to protect employees and customers. Therefore, regulation is necessary to raise the cost of breaches relating to customers and employees – but companies often have undue influence on governments, preventing substantial cyber-regulation progress. In addition, organizations may make more money by ignoring regulation, not reporting breaches, and paying regulatory fees when exposed. This chapter looks at a series of practices that can mature communication and raise ethical thinking during the risk management process.