9.3 Evolving Risk Landscape

Cybersecurity Risks

In today’s digital age, cybersecurity risk has become a critical concern for individuals, organizations, and nations. Cybersecurity risk is the potential for loss or damage due to threats to information systems and data. As our reliance on technology grows, so does our vulnerability to cyber threats, making the understanding and management of these risks essential.

Canadian Centre for Cyber Security (2024) defines Cyber Security as

The protection of digital information, as well as the integrity of the infrastructure housing and transmitting digital information. More specifically, cyber security includes the body of technologies, processes, practices and response and mitigation measures designed to protect networks, computers, programs and data from attack, damage or unauthorized access so as to ensure confidentiality, integrity and availability.

IBM (2024b) defines cyber risk management as “Cyber risk management, also called cybersecurity risk management, is the process of identifying, prioritizing, managing and monitoring risks to information systems”​ (para. 1).

Video: “What Is Cyber Security | How It Works? | Cyber Security In 7 Minutes | Cyber Security | Simplilearn” by Simplilearn [7:07] is licensed under the Standard YouTube License. Transcript and closed captions available on YouTube.

Type of Cybersecurity Risks

Organizations and individuals face various cybersecurity risks in the ever-evolving landscape of digital threats. Understanding these risks is crucial for developing effective defence strategies. Here are the primary types of cybersecurity risks:

  • Malware: Malware, short for malicious software, encompasses a broad range of threats designed to infiltrate, damage, or disrupt computer systems. This category includes (IBM, 2024a)​:
    • Viruses: Self-replicating programs that spread by attaching to files or programs
    • Worms: Self-propagating malware that spreads across networks
    • Trojan horses: Deceptive software that appears legitimate but contains malicious code
    • Spyware: Software that covertly gathers user information
  • Phishing and Social Engineering: These attacks exploit human psychology rather than technical vulnerabilities. Techniques include:​​
    • Email phishing: Sending fraudulent emails to trick recipients into revealing sensitive information
    • Spear phishing: Targeted phishing attacks on specific individuals or organizations
    • Vishing: Voice phishing using phone calls to manipulate victims
    • Pretexting: Creating a fabricated scenario to obtain information
  • Ransomware: A particularly disruptive form of malware that encrypts a victim’s files and demands a ransom for their release. Ransomware attacks have become increasingly sophisticated and prevalent, targeting both individuals and large organizations.​
  • Denial-of-Service (DoS) Attacks: These attacks aim to overwhelm systems, networks, or services to make them inaccessible to intended users. Distributed Denial-of-Service (DDoS) attacks use multiple compromised systems to launch the attack, making them more difficult to mitigate.​
  • Man-in-the-Middle (MitM) Attacks: In these attacks, cybercriminals intercept communication between two parties, potentially eavesdropping or altering the data in transit. This can occur over unsecured Wi-Fi networks or through compromised web browsers.
  • Password Attacks: Cybercriminals use various methods to obtain or crack passwords.
  • Insider Threats: These risks come from within an organization, whether intentional or accidental. They can be current or former employees, contractors, or business partners with inside knowledge and access to systems.​
  • Supply Chain Attacks: Attackers target less secure elements in an organization’s supply network to gain access to the primary target. This has become increasingly common as businesses rely more on third-party vendors and software.​
  • IoT-based Attacks: As the Internet of Things (IoT) expands, so do the potential vulnerabilities. Unsecured IoT devices can be exploited to gain access to networks or be used in large-scale DDoS attacks.​
  • Code Injection Attacks: These attacks involve inserting malicious code into vulnerable software applications. Common types include SQL injection and cross-site scripting (XSS) attacks.
  • DNS Tunneling: This sophisticated technique uses the Domain Name System (DNS) protocol to bypass standard security measures, potentially exfiltrating data or establishing covert command and control channels.​
  • AI-Powered Attacks: As artificial intelligence becomes more advanced, cybercriminals are leveraging AI to enhance their attack capabilities, creating more sophisticated and harder-to-detect threats.​
  • Zero-day Exploits: These attacks target previously unknown vulnerabilities in software or systems. Because they exploit undiscovered weaknesses, zero-day attacks can be particularly dangerous and difficult to defend against​ (IBM, 2024a; Baker, 2024).

Cybersecurity Risk Sources

The cybersecurity landscape is populated by diverse actors with varying motivations and methods. Here’s a breakdown of the key threats according to IBM (2024a):​

  • Cybercriminals: These actors engage in financially motivated cybercrime. Common tactics include ransomware attacks and phishing scams designed to steal sensitive data and extort funds.
  • Malicious Hackers: These individuals possess advanced technical skills and utilize them for nefarious purposes. They may breach systems to exfiltrate critical information or disrupt operations.
  • Hackers: Individuals with the skills to compromise a computer system or a network.
  • Nation-State Actors: Cybersecurity threats can also originate from nation-states seeking to achieve strategic goals. These attacks, often well-funded and meticulously planned, may involve espionage to acquire sensitive information or cyberwarfare targeting critical infrastructure to disrupt essential services.
  • Insider Threats: Employees, either through negligence or malicious intent, can inadvertently or intentionally expose an organization to significant risk. Unintentional actions may involve accidentally installing malware or losing a company device containing sensitive data. In more egregious cases, employees may deliberately compromise systems or steal information for personal gain.

Risk Mitigation Strategies

Effective cybersecurity risk mitigation involves a multi-layered approach combining technical, administrative, and physical controls and robust incident response and disaster recovery planning.

Technical Controls

  • Firewalls: Filter network traffic
  • Encryption: Protect data confidentiality
  • Access Controls: Limit user access based on need

Administrative Controls

  • Policies and Procedures: Establish security guidelines
  • Training: Educate employees on cybersecurity awareness
  • Risk Assessments: Identify and prioritize vulnerabilities

Physical Controls

  • Secure Facilities: Restrict access to critical areas
  • Biometrics: Advanced authentication for high-security zones

Incident Response and Disaster Recovery

  • Incident Response Plan: Approach for handling security incidents
  • Disaster Recovery Plan: Procedures for quick system and data restoration

This comprehensive strategy helps organizations reduce cybersecurity risks and enhance their overall security posture.


Climate Change and Environmental Risks

Climate change and associated environmental risks pose significant challenges to businesses across various sectors. These risks can profoundly impact operations and necessitate adherence to evolving regulatory frameworks.

Video: “Comprehensive Disaster and Climate Risk Management” by United Nations Office for Disaster Risk Reduction [3:56] is licensed under the Standard YouTube License.Transcript and closed captions available on YouTube.

Impact on Business Operations

Climate change and environmental risks increasingly affect businesses across various sectors, presenting challenges and opportunities. Here’s how these risks impact business operations:

  1. Physical Risks: Extreme weather events like floods, hurricanes, and droughts can damage infrastructure, disrupt supply chains, and lead to operational downtime.
  2. Resource Scarcity: Climate change can affect the availability of critical resources, potentially increasing costs and disrupting production.
  3. Market Shifts: Changing consumer preferences towards sustainable products can impact demand and revenue streams.
  4. Employee Health and Productivity: Increased temperatures and air pollution can affect worker health and productivity, particularly in outdoor industries.
  5. Supply Chain Disruptions: Climate-related events can cause delays, shortages, and increased costs throughout the supply chain.
  6. Financial Impacts: Businesses may face higher insurance premiums, increased operational costs, and potential asset devaluation in high-risk areas.

These impacts underscore the need for businesses to integrate climate and environmental considerations into their strategic planning and risk management processes. Companies that proactively address these challenges may find opportunities for innovation, cost savings, and competitive advantage in an increasingly climate-conscious market (Boyles, 2024; Kole, 2023).​

Climate change and sustainability are discussed in detail in Chapter 10 of this book.


Geopolitical Risks

Geopolitical risks have become an increasingly critical factor in the global business landscape. These risks encompass a wide range of threats stemming from political tensions, international conflicts, and shifts in global power dynamics. From trade wars and economic sanctions to regional instabilities and cyber threats, geopolitical risks can significantly impact business operations, financial markets, and economic growth. As the world becomes more interconnected, the ripple effects of geopolitical events can be felt across borders, industries, and supply chains, making it essential for businesses and investors to understand and navigate these complex challenges​ (Kaya, 2024).​

Video: “Measuring geopolitical risk” by Export Development Canada | Exportation et développement Canada – EDC [6:18] is licensed under the Standard YouTube License. Transcript and closed captions available on YouTube.

Geopolitical risks represent a complex and evolving set of challenges that can significantly impact businesses and economies worldwide. These risks stem from various factors, including international conflicts, political tensions, and shifts in global power dynamics. Key geopolitical risks include:

  1. Global Conflicts: Ongoing and emerging international conflicts can disrupt business operations, affect investments, and cause supply chain issues.
  2. Economic Sanctions: The increasing use of sanctions as a political tool can create compliance challenges and market access issues for businesses.
  3. Social Unrest: Political demonstrations and activism can pose risks to assets and security across various sectors and countries.
  4. Misinformation and Disinformation: These pose growing threats to businesses, potentially leading to reputational damage and financial losses.
  5. Cybersecurity Threats: Increased cyber attacks, often linked to geopolitical tensions, target both government and private sector entities.
  6. Regulatory Changes: Shifts in international governance and regulatory frameworks can create compliance challenges for businesses operating globally.
  7. Supply Chain Disruptions: Geopolitical tensions can impact supply chain integrity, forcing companies to reconsider their networks and partnerships.
  8. Economic Instability: Factors like inflation and currency fluctuations can affect international business operations and contracts.

To navigate these risks, businesses must stay informed, conduct regular risk assessments, and develop flexible strategies to adapt to the changing global landscape​ (Mason & Oxnevard, 2024).

License

Icon for the Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License

Risk Management - Supply Chain and Operations Perspective Copyright © 2024 by Azim Abbas and Larry Watson is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License, except where otherwise noted.

Share This Book