The Three Lines of Defense and Cybersecurity

In the wake of the financial crisis, the Institute of Internal Auditors (IIA) came up with a model for risk management and called it the Three Lines of Defense (3LoD) model. 3LoD traces its origins to the managing of operational risk in large organizations, especially financial institutions. However, in the recent past, this has slowly gained traction in the cybersecurity world, too. The main objective of the 3LoD framework is to ensure the effective segregation of duties for all business functions and better accountability for the stakeholders of those functions.

As we saw in earlier chapters, one of the major functions of IT risk management is to have an effective delineation between the risk owners (think the board of directors) and risk practitioners (think senior management).

In the 3LoD framework, the goal is to have business functions segregated based on the duties they perform for effective risk management.

In simple terms...

The 3LoD model

As mentioned in the previous section, the purpose of the 3LoD model is to ensure appropriate segregation and accountability for individual business owners and other functions.

Let’s take a step back for a moment to establish the ownership of the risk – if there is a risk to the business, who will be the owner of the risk? The business owner. Therefore, the business owner will also be the risk owner as per the 3LoD model. Since the business owners are responsible for the day-to-day operational management of the business, they will be considered the first LoD for any risk that might occur to their business.

Now, these business owners might know a lot about the business, the risks, and the control environment, but they might not be the experts in remediating those risks. This is where the second LoD comes in. The second LoD is the risk monitoring and oversight function. They work closely with the first LoD to ensure that these risks are mitigated with...

3LoD and cybersecurity

So far, we have looked at the 3LoD model from an overarching view of enterprise risk management. In this section, we will translate those responsibilities for cybersecurity functions.

Please be aware that an official 3LoD and cybersecurity model is not mainstream, but the following figure should give you a good sense of the responsibilities for each role:

Figure 4.3 – 3LoD and cybersecurity responsibilities

In the preceding figure, we can see that the first LoD is doing the on-ground work and owns the responsibilities of the operational management of technical activities such as conducting penetration tests and vulnerability assessments, restricting user access rights, and more.

The second LoD is focused on performing oversight and monitoring in the form of documenting the policies/standards/procedures as per the business objectives, conducting access reviews, planning and conducting the Business Continuity Planning...

Critical concepts for risk assessment and management

This section is the essence of the critical concepts that will be widely used across this book, your day-to-day job, and any ISACA exam including the CRISC.

The risk profile

The purpose of the risk management function is to optimize the risk decisions for an enterprise. The risk profile is the overall risk exposure of the organization to any type of risk. There are many factors that could impact the risk profile of an organization, such as new regulations, changes in the underlying technology, changes in the business objectives, mergers and acquisitions, direct or indirect competitors, and more. This is all part of the enterprise risk profile and will impact all businesses and functions of the organization.

The IT risk profile of an organization is the overall identified IT risk to which the enterprise is exposed. Similar to the enterprise risk profile, the IT risk profile can be dependent on many external factors such as...

Risk tolerance versus risk capacity

I have seen IT risk practitioners use the phrases risk tolerance and risk capacity interchangeably, but this is not correct.

An organization going a little beyond the risk appetite is still within the risk tolerance, which is manageable as long as there are some compensating controls in place. However, when the risk tolerance crosses a certain threshold, it enters into the territory of risk capacity. As we saw in the earlier definition, anything over risk capacity could impact the existence of the organization, and that is something that has to be avoided at all costs.

That said, an organization can still operate as intended within its risk tolerance and under the risk capacity, but its existence will be in question if it crosses the risk capacity.

In the following section, we will see the relationship between risk appetite and business objectives.

Risk appetite and business objectives

The risk appetite of an organization should be agreed upon with the relevant stakeholders. It is important to align risk appetite with the objectives of the business to ensure that high-risk areas providing more value to the business are getting more resources than low-risk, low-reward processes.

The best way to align risk appetite with the business objectives is to translate it into a number of standards and policies to contain the risk level within the boundaries set by the risk appetite. With changing business conditions, these boundaries need to be regularly adjusted or confirmed.

Risk acceptance

Risk appetite and tolerance need to be defined, approved, and clearly communicated by the senior management with a process in place to review and approve any exceptions. These exceptions are formally documented in the form of risk acceptance.

As important as it might be to keep the risk levels within acceptable thresholds, there might be...

Summary

At the beginning of this chapter, we learned about the 3LoD model and the responsibilities of each LoD. Then, we reviewed how we can translate the 3LoD model for IT risk management and cybersecurity. In the next section, we switched gears to learn about the importance of the risk profile, appetite, tolerance, capacity, the relationship between all of them, and how to distinguish between risk tolerance and risk capacity. Another major area covered in this chapter was how to determine the risk appetite for a business and the process for formal risk acceptance.

In the next chapter, we will learn about the legal, regulatory, and contractual requirements, along with ethical risk management.

Review questions

1. In the 3LoD model, which LoD is responsible for risk monitoring and oversight?
   1. The first LoD
   2. The second LoD
   3. The third LoD
   4. All of the above
2. What is the primary responsibility of the third LoD?
   1. Policy and procedure development
   2. Provide independent assurance of controls
   3. Perform periodic user reviews
   4. Restrict least privileged roles
3. The amount of risk an organization is willing to accept is known as ____::
   1. Risk tolerance
   2. Risk capacity
   3. Risk profile
   4. Risk appetite
4. The information security manager has performed a risk assessment and provided recommendations for enhancing the controls of the Business Process Owner (BPO). After much deliberation, the BPO has decided to accept the risk. The BEST reason for the BPO to accept the risk is ____:
   1. Difficulty to implement the suggested controls
   2. Unavailability of resources to implement the controls
   3. Cost of control implementation outweighs the cost of assets
   4. Budgetary constraints
5. Which of the following statements is correct?
   1. Breaching...

Answers

1. B. The second LoD is responsible for risk monitoring and oversight. Please refer to the Responsibilities of 3LoD section for additional details.
2. B. The third LoD is primarily responsible for an internal and external audit, which is an independent assurance of controls. The keyword here is independent, which is the utmost requirement of a third LoD function.
3. D. An organization should be able to accept the risk within the risk appetite. Any risk above the risk appetite should be reduced to an acceptable level by implementing adequate controls.
4. C. This is the fundamental aspect of risk management to ensure that the cost of control implementation should not outweigh the cost of assets. For example, it does not make sense to put a $1,000 lock on a $500 bicycle.
5. A. This is the only correct statement in this question. Option B is incorrect as that should be risk tolerance. Option C is incorrect as we learned in the Risk appetite, tolerance, and capacity section...