GRC Framework - Stable Stakes for Good Management

Why a GRC Framework?
Good governance, risk, and compliance management has become a key-operating imperative for many organizations, both large and small. Boards and executives alike struggle to gain better visibility into their true risk and compliance profile in order to prioritize spending on remediation of risks. Having a coherent, integrated GRC management framework is table stakes for good GRC program management – and can really accelerate an organization’s ability to respond to increased pressures to gain real visibility into its true risk and compliance profile.

A Simple Framework
Here’s a simple diagram (well, maybe not so simple….unless you just look at the headings) that covers the main elements of GRC Framework.


Let’s look at each of these layers and try to get at the essential elements and value:

1. Organizational Framework and Governance model – An active governance structure that drives accountability into the day-to-day operating fabric ensures business owners have the proper degree of granular visibility into risks that really matter.  Armed with options on what to do about them, business owners can make intelligent decisions on what remediation efforts to fund.

2. Risk Profile and Reporting Framework – A set of rationalized processes for the prioritization of key risk and compliance requirements supports GRC reporting across the organization, and to the board. A practical categorization of risk types, threat communities, information, and data classification brings context to risk reporting and decision-making. 

3. GRC Diagnostics – Qualitative and quantitative assessments that follow a common risk and compliance identification and analysis process, supported by consistent controls reviews and testing, provide objective diagnostics required for meaningful decisions on treatment strategies.

4. Risk and Compliance Monitoring Program – Monitoring policies, controls, threats and vulnerabilities against standards and acceptable thresholds provides visibility into risk and compliance profiles on a consistent basis. Key Performance Indicators (KPIs), Key Risk Indicators (KRIs), Key Control Indicators (KCIs) provide early warning alerts that permit organizations to be proactive in their response.

5. GRC Program Optimization – Continuous improvement, communication and awareness programs drive adaption as the external environment presents new and emerging risks and compliance requirements.  Knowledge sharing across stakeholders on the appropriate best practices supports evolution to a target maturity level that is optimal for the organization.


6. Technology Enabling Platform and tools - A technology eco-system that supports a central, secure repository of requirements, policies, control standards, risk analysis, and control test results provides a solid foundation for streamlined workflow, analytics, and reporting.
A well-designed and coherent GRC Framework helps organizations prioritize and respond to risks and compliance requirements with a collaborative and efficient governance process.

Call to Action: An exercise I often use with clients is reviewing the framework, element by element, and marking it up with red, yellow and green to see where your organziation is weak – and then looking at what elements will be key enablers for your GRC Program. Using a GRC Framework model in this way helps prioritize what you need to focus on now in order to deliver real value.
Try this: Review this GRC Framework (or something like it) with some of your key stakeholders and get their assessment of what’s truly important, what they would like to see good progress on, and how they can help. At the very least, you’ll get another perspective on priorities and needs - that will keep you driving your GRC program in the right direction.

Creating a High-Performance GRC System

A high-performing GRC system will always deliver value. Always. The value of a business activity or department directly relates to its contribution to business objectives. For that reason, focusing on measuring GRC activities themselves (risk assessment, policy management, training and communication, or control management, for example) isn't sufficient. Rather, executives must place a special focus on the desired system outcomes that result from those activities.

Each organization is unique, of course, and pursues unique business objectives. In turn, each GRC system will pursue a unique set of outcomes. But surveys of experts and analysis of compliance, internal control, and risk-management charters suggest that most organizations share several desired outcomes across all GRC systems. Among them are the desires to:

• Meet business objectives. Organizations exist to achieve their desired business objectives. Every GRC system must contribute to attaining those business objectives.
  

• Enhance leadership and organizational culture. Inspire and promote an organizational culture of performance, accountability, integrity, trust, and open communication.
  

• Increase stakeholder confidence. Increase stakeholder confidence and trust in the organization as reflected in share price, ratings, and other stakeholder indicators.
  

• Prepare and protect the organization. Prepare the organization to address risks and requirements; and protect the organization from the harm of adverse events, non-compliance, and unethical behavior.
  

• Prevent, detect, and reduce adversity. Discourage, prevent, and provide consequences for misconduct; reduce the tangible and intangible damage caused by adverse events, non-compliance, and unethical behavior and the likelihood of similar events happening in the future.
  

• Motivate and inspire desired conduct. Provide incentives and rewards for desirable conduct, especially in the face of challenging circumstances.
  

• Improve responsiveness and efficiency. Continuously improve the responsiveness (timeliness and agility) and efficiency (speed and quality) of all GRC system activities while improving effectiveness (ability to meet objectives and requirements).
  

• Optimize economic and social value. Optimize the overall value of the system relative to the resources allocated to it.
  

A high-performing GRC capability will deliver those universal system outcomes by balancing three aspects of its systems: effectiveness, efficiency, and responsiveness. Let's study each in turn.
Aspect 1: Effectiveness
This describes the quality of a system along two dimensions:
“Design effectiveness” describes the degree to which a system or process is logically designed to meet legal and other defined requirements. Does the system contain all the necessary elements to evaluate risk? Has it been designed to address those risks? If not, what features must be added to improve the system? Design effectiveness is very much a logical test that considers all requirements, risks, and boundaries and determines if the system is appropriately designed. Some indicators that organizations use to measure this aspect of the system include:

• Risk Coverage (should be 100 percent)
  
• Requirement Coverage (should be 100 percent)
  
• Depth of coverage for priority risks
  

“Operating effectiveness” describes how well a system or process operates as designed. Does it operate the way it was designed to? If not, how must it be managed to elevate its level of operation? Operating effectiveness helps management understand if, given a strong design, the system is operating as intended. Some indicators that measure this aspect of the system include:

• Number of control-test failures
  
• Number of control violations
  
• Number of substantiated allegations of misconduct
  
• Percent of issues detected via proactive activities
  

Some challenges associated with evaluating the effectiveness of a system include the following:
Evaluation compared to what? What generally accepted and vetted standard can be used to judge a program? And not just “in principle” but at a practical, operational level? While frameworks such as the U.S. Federal Sentencing Guidelines provide high-level guidance, they do not provide suitable criteria against which a program can be evaluated for effectiveness. For example, the Guidelines that we should train personnel on how to address the compliance risks that they face. Well, there is training, and then there is training. What are the core training practices and controls that every organization should employ to evidence effectiveness? How much is enough?
Who evaluates? What types of internal and external professionals have the skills to evaluate and judge the effectiveness of a program? Which evaluation activities should be segregated? To what degree should compliance staff leverage internal audit staff to evaluate effectiveness? To what degree should evaluation activities be pushed into the lines of business with some level of centralized monitoring?
How often do evaluations occur? How often can we (and should we) put a stake in the ground so that if we need to go back in time, we can present evidence of effectiveness? Too often, serious issues are detected years after the initial misconduct occurred. Opposing counsel (in particular the government) asks an organization to prove the effectiveness of the program at the time of the misconduct—not at today's time. As such, obtaining annual assurance of your compliance program (not just your internal control over financial reporting program) can be an important thing to do.
One way to overcome the challenges associated with evaluating and documenting the effectiveness of your capability is to use the freely available OCEG Common Assessment Procedures and Criteria, more commonly known as the OCEG “Burgundy Book.” This guide was drafted by a task force of over 100 individuals, and it includes standardized assessment criteria as well as specific testing procedures to assess the adequacy of GRC structures.
Aspect 2: Efficiency
This aspect captures the cost of the process or system—not simply the amount of money spent, but also the cost of human capital expended.
”Financial efficiency” describes the total amount of financial capital required to execute a process. Helpful indicators include:

• Total cost of risk, compliance, and control activities
  
• Average cost to train each employee to address risks and requirements
  
• Average cost to resolve issues (by category)
  

“Human capital efficiency” describes the type and level of individuals required to participate in the process. While human capital costs can be partially captured in purely financial terms, intangible opportunity costs must also be captured. In other words, if the program relies too heavily on senior executive time and focus, it may represent more than just the purely financial costs of salary, benefits, and other overhead. An organization must also recognize the intangible costs of the loss of executive time and focus on other strategic objectives such as growth, profitability, talent retention, and customer loyalty. Helpful indicators include:

• Number of senior executives allocated to the program
  
• Number of senior executives per program staff
  
• Number of hours per month required for business line executives to perform program activities
  

Aspect 3: Responsiveness
This describes the system's ability to operate quickly and flexibly in response to changing circumstances.
“Cycle time” describes the total amount of time it takes to execute a process. Cycle time is extremely important in several processes. For example, it is critical to minimize the lag time from when a problem occurs to the time it is detected. The program should also minimize the time between detection of an issue and response to an issue. For other processes, it is difficult to define clear lag time rules. For example, it is difficult to say how long it should take to investigate a particular issue, because each issue will have its own facts and circumstances. That being said, over time, understanding and improving the cycle time associated with detecting and resolving issues should become more predictable and manageable. Helpful indicators include:

• Cycle time from actual non-compliance to detection
  
• Cycle time from detection to action
  

“Flexibility and adaptability” describe the degree to which the system can integrate changes, including new requirements, such as a new law, rule, or regulation, or new business units due to merger and acquisition activity. Those changes may be internal, as managers study the results of past performance evaluations and make needed alterations, or they may be external. New regulatory environments, changing market conditions, or altered public perceptions and concerns require the organization to make adjustments. A responsive system adapts quickly to changes in the environment and develops a long-range perspective, foresees more distant changes, and prepares for them. Helpful indicators include:

• Cycle time to integrate new acquisitions into program
  
• Cycle time to fully address new risks and legal requirements
  

Balancing Program Aspects
Aspects are interdependent. Sometimes, improving one aspect of the capability hurts the other dimensions. For example, and holding all other conditions equal, improving the risk coverage or the depth of coverage in a system will require additional resources.
It is possible, however, to improve all aspects with breakthrough thinking and innovation. Sensible application of technology, for example, can improve both the effectiveness of the system while decreasing costs over time.

SURLYSPAWN: NSA Exploit of the Day

Today's item from the NSA's Tailored Access Operations (TAO) group implant catalog:

SURLYSPAWN (TS//SI//REL TO USA,FVEY) Data RF retro-reflector. Provides return modulated with target data (keyboard, low data rate digital device) when illuminated with radar.
(U) Capabilities
(TS//SI//REL TO USA,FVEY) SURLYSPAWN has the capability to gather keystrokes without requiring any software running on the targeted system. It also only requires that the targeted system be touched once. The retro-reflector is compatible with both USB and PS/2 keyboards. The simplicity of the design allows the form factor to be tailored for specific operational requirements. Future capabilities will include laptop keyboards.
(U) Concept of Operation
(TS//SI//REL TO USA,FVEY) The board taps into the data line from the keyboard to the processor. The board generates a square wave oscillating at a preset frequency. The data-line signal is used to shift the square wave frequency higher or lower, depending on the level of the data-line signal. The square wave, in essence, becomes frequency shift keyed (FSK). When the unit is illuminated by a CW signal from a nearby radar, the illuminating signal is amplitude-modulated (AM) with this square wave. The signal is re-radiated, where it is received by the radar, demodulated, and the demodulated signal is processed to recover the keystrokes. SURLYSPAWN is part of the ANGRYNEIGHBOR family of radar retro-reflectors.
Unit Cost: $30
Status: End processing still in development.

Page, with graphics, is here. General information about TAO and the catalog is here.

  DRM and the Law

Cory Doctorow gives a good history of the intersection of Digital Rights Management (DRM) software and the law, describes how DRM software is antithetical to end-user security, and speculates how we might convince the law to recognize that.

Every security system relies on reports of newly discovered vulnerabilities as a means of continuously improving. The forces that work against security systems -- scripts that automate attacks, theoretical advances, easy-to-follow guides that can be readily googled -- are always improving so any system that does not benefit from its own continuous improvement becomes less effective over time. That is, the pool of adversaries capable of defeating the system goes up over time, and the energy they must expend to do so goes down over time, unless vulnerabilities are continuously reported and repaired. Here is where DRM and your security work at cross-purposes. The DMCA's injunction against publishing weaknesses in DRM means that its vulnerabilities remain unpatched for longer than in comparable systems that are not covered by the DMCA. That means that any system with DRM will on average be more dangerous for its users than one without DRM.

"The Mask" Espionage Malware

We’ve got a new nation-state espionage malware. "The Mask" was discovered by Kaspersky Labs:

The primary targets are government institutions, diplomatic offices and embassies, energy, oil and gas companies, research organizations and activists. Victims of this targeted attack have been found in 31 countries around the world -- from the Middle East and Europe to Africa and the Americas. The main objective of the attackers is to gather sensitive data from the infected systems. These include office documents, but also various encryption keys, VPN configurations, SSH keys (serving as a means of identifying a user to an SSH server) and RDP files (used by the Remote Desktop Client to automatically open a connection to the reserved computer).
"Several reasons make us believe this could be a nation-state sponsored campaign. First of all, we observed a very high degree of professionalism in the operational procedures of the group behind this attack. From infrastructure management, shutdown of the operation, avoiding curious eyes through access rules and using wiping instead of deletion of log files. These combine to put this APT ahead of Duqu in terms of sophistication, making it one of the most advanced threats at the moment," said Costin Raiu, Director of the Global Research and Analysis Team (GReAT) at Kaspersky Lab. "This level of operational security is not normal for cyber-criminal groups."

It's been in operation, undetected, for at least seven years.
As usual, we infer the creator of the malware from the target list.

We counted over 380 unique victims between 1000+ IPs. Infections have been observed in: Algeria, Argentina, Belgium, Bolivia, Brazil, China, Colombia, Costa Rica, Cuba, Egypt, France, Germany, Gibraltar, Guatemala, Iran, Iraq, Libya, Malaysia, Mexico, Morocco, Norway, Pakistan, Poland, South Africa, Spain, Switzerland, Tunisia, Turkey, United Kingdom, United States and Venezuela.

Based on the prevalence of Spanish-speaking victims, the number of infected victims in Morocco, and the fact that Gibraltar is on the list, that implies Spain is behind this one. My guess is that soon countries will start infecting uninteresting targets in order to deflect blame, but that they still think they’re immune from discovery. So Spain, if it is you, attack a few sites in the Falklands next time -- and use a separate tool for Morocco.

WHAT “GRC” ACTUALLY IS??

GRC is a system of people, processes and technology that enables an organization to:

• understand and prioritize stakeholder expectations;
• set business objectives congruent with values and risks;
• achieve objectives while optimizing risk profile and protecting value;
• operate within legal, contractual, internal, social and ethical boundaries;
• provide relevant, reliable and timely information to appropriate stakeholders; and
• enable the measurement of the performance and effectiveness of the system.

A “GRC activity,” then, is any process or activity that contributes to or is part of the system. Processes and functions that are typically included include:

• Governance
• Strategy and Business Performance Management
• Risk Management
• Compliance
• Internal Control
• Corporate Security
• Legal
• Information Technology
• Business Ethics
• Sustainability and Corporate Social Responsibility
• Quality Management
• Human Capital and Culture
• Audit and Assurance
• Finance

Each contributes to an organization’s ability to drive Principled Performance, and all can benefit from improved communication, shared strategy, common processes, coordinated schedules and integrated technology.
Processes under the areas of governance, risk management and compliance are particularly critical to system success, so a deeper look at their definitions is helpful:

• Governance is the culture, values, mission, structure and layers of policies, processes and measures by which organizations are directed and controlled. Governance, in this context, includes but is not limited to the activities of the Board, for governance bodies at various levels throughout the organization also play a critical role. The tone that is set, followed and communicated at the top is critical to success.
• Risk, in this context, is the measure of the likelihood of something happening that will have an effect on achieving objectives; most importantly, but not exclusively, an adverse effect. Thus, Risk Management is the systematic application of processes and structures that enable an organization to identify, evaluate, analyze, optimize, monitor, improve, or transfer risk while communicating risk and risk decisions to stakeholders. The overriding goal of risk management is to realize potential opportunities while managing adverse effects of risk.
• Compliance is the act of adhering to, and the ability to demonstrate adherence to, mandated requirements defined by laws and regulations, as well as voluntary requirements resulting from contractual obligations and internal policies.

There is some overlap among these functions, but they have distinct areas of focus and each has activities dispersed throughout an organization.

WISTFULTOLL: NSA Exploit of the Day

Today's item from the NSA's Tailored Access Operations (TAO) group implant catalog:

WISTFULTOLL (TS//SI//REL) WISTFULTOLL is a UNITEDRAKE and STRAITBIZZARE plug-in used for harvesting and returning forensic information from a target using Windows Management Instrumentation (WMI) calls and Registry extractions.
(TS//SI//REL) This plug-in supports systems running Microsoft Windows 2000, 2003, and XP.
(TS//SI//REL) Through remote access or interdiction, WISTFULLTOLL is executed as either a UNITEDRAKE or STRAITBAZZARE plug-in or as a stand-alone executable. If used remotely, the extracted information is sent back to NSA through UNITEDRAKE or STRAITBAZZARE. Execution via interdiction may be accomplished by non-technical operator through use of a USB thumb drive, where extracted information will be saved to that thumb drive.
Status: Released / Deployed. Ready for Immediate Delivery
Unit Cost: $0

Note: Inconsistencies in spelling are all [sic].
Page, with graphics, is here. General information about TAO and the catalog is here.