With endless headlines decrying the latest enterprise data breach, business leaders are doubling down on their cybersecurity efforts to avoid becoming the next victim. Data breaches are costly; in addition to jeopardizing the business’s, customers’, and any other stakeholders’ sensitive information, data breaches reached the highest average cost in 2021 at $4.24 million. Especially for the many organizations operating on tighter margins in the wake of the pandemic, cybersecurity threats have the potential to be catastrophic.
Effective risk management requires business leaders to have a comprehensive oversight of the business, from its technologies to the people and projects using them—a view they can achieve using an Enterprise Architecture (EA) practice. With a strong understanding of the IT and business landscapes they’re working within and the support of colleagues across the business, IT teams can be proactive in preventing cybersecurity risks, as well as better at managing them should they arise.
Enlist coworkers for their insights
As organizations expand and evolve, the volume of technology and data they own grows with them. Keeping all these assets compliant and up to date can quickly consume the IT department’s bandwidth without the proper support—and that’s time that could be better spent on higher-value strategic work. And if IT professionals can’t maintain constant oversight into operations, risk develops within the organization’s framework because the team won’t be able to conduct regular maintenance on those systems (e.g., bug fixes, system updates, offboarding dated systems). For example, as employees turn their attention to new applications that solve for emerging demands, legacy IT that still holds sensitive company information lingers when it should either be cut from the tech stack or updated.
Even if the organization has an established EA team regularly mapping out its IT and business landscape, architects can still miss cybersecurity risks if there are technologies within the organization that they aren’t aware of. EA teams can’t govern programs if they don’t know they exist, which is why crowdsourcing data is imperative for accurate cybersecurity risk prevention. With an estimated 40% of all IT spending at a company occurring outside the IT department, organizations are otherwise leaving themselves open to major threats if colleagues don’t communicate their technology usage.
Modern EA tools can help EA and IT teams bring people outside their department into their efforts. To start, EAs can grant designated department experts access to the platform where they manage their data, so that these experts can share which applications their teams use and which data they touch. Expecting coworkers—who have their own priorities—to regularly report on their technology usage can be inconvenient though, which is why organizations should consider EA tools with survey functionalities to ease the task. If the system automatically requests employees to enter any pertinent information, it’s more likely they will do so. This ensures the data EA and IT teams are assessing for risk is up to date and therefore accurate, so that they aren’t overlooking any critical considerations that could pose downstream risks.
In addition to helping IT professionals keep up with typical maintenance, establishing a democratic approach to information sourcing can also help organizations avoid risks during planned projects. With an EA oversight—that is, an understanding of how IT and business landscapes interact and intertwine—EA teams can also identify all employees needed for a planned project (e.g., How will a change project impact a given workflow? Who owns a certain application and can help scale it?). Especially given the pace of business today and the continuous pressure to digitally transform, organizations need to be able to align quickly on expectations. Leveraging a system with survey functionality can also be used in this regard to secure approval from any key risk stakeholders who work more closely with the variables involved in the change to shed light on information the EA team might not realize at face value in their data.
Trade language for visuals to aid collaboration
When departments aren’t aligned or transparent with one another, cybersecurity risks have time to develop and exacerbate. Achieving a robust overview of the business is the first step in combating that. Step two is being able to communicate any identified risks back to the business. The challenge is that not everyone speaks IT, meaning any warnings about risk might get lost in translation.
To avoid this, IT teams should prioritize how they present cybersecurity information as much as how they secure it. EA tools that allow for dynamic visuals enable teammates to see connections between resources, like which systems house the same data or which employees use the same applications. Similarly, they help employees outside the IT department understand where the risks are within the organization. With a model to point to, IT professionals don’t have to worry about risk warnings sounding abstract to coworkers; they’ll be able to see points where the organization could be compromised for themselves.
Visualizations are useful for assessing the risk within an organization’s current state—but everyone knows business doesn’t stay the same for long. That’s why IT teams also need a way to assess potential risk. EA, by nature, helps organizations plan for change projects by mapping the actions needed to achieve an outcome based on the business’s current state. EA processes can also help users identify cybersecurity risks by modeling the consequences of defined events—whether that’s offboarding an old system or an outright cybersecurity attack—on the organization so that they can better prepare how to manage the fallout. When business leaders have an action plan for how they will respond in different scenarios, they can be more agile and diligent should they ever occur.
Sometimes cybersecurity threats are beyond an organization’s control, but there are steps the business can take to mitigate the risk and handle it more effectively should it occur. By making cybersecurity an organization-wide effort, enlisting employees across departments for their insights and leveraging modern EA tools and methods to keep colleagues ahead of threats, businesses can remain vigilant.
