Microsoft's critical success factors in security risk management

Security Risk Management Process - Microsoft Company

Security Risk Management the Microsoft Way

Defining Risk and Risk Management

Value Risk Management

Risk Management Procedures and Processes

Key Success Factors For Security Risk Management

Risk Management Approaches

Risk Management Failure Reduction

An Analytical Review of Security Risk Management The Microsoft Way

Security risk management is a vital tool ensuring the continued success, productivity and stability of organizations across the globe. It is vital in an ever increasingly technology driven and global marketplace that organizations find ways to mitigate the increased risks associated with doing business in their environment. The purpose of this research paper is an analysis of the critical success factors related to security risk management at Microsoft Corporation. Specifically the researcher will attempt to understand what critical success factors Microsoft uses to successfully manage risk, and whether those practices might be useful or practical for other companies to adopt.

In recent years researchers and organizations have given security risk management more attention, in part because the level of risk has increased in recent years (Kimball, 2000). Multiple trends have contributed to an increased risk including globalization of trade and production and corporate investments in "volatile emerging markets" (Kimball, 3).

Risk management unfortunately however fails in many companies. In fact there are reputed and "well publicized failures associated with its implementation" (Kimball, 3). It is important that organizations recognize what factors contribute to failure as much as it is to recognize what factors contribute to success so adequate measures may be taken to improve risk management in the future and reduce errors associated with implementation and maintenance.

Background to Problem

Historically as organizations have grown technologically new security risks have become imminent that must be addressed. Today organizations are connected through IT infrastructures that operate in an environment considered "increasingly hostile" where "attacks are being mounted with increasing frequency" and occurring over shorter periods of time (Microsoft, 2004). There are many factors that contribute to increased risk including higher levels of volatility within financial markets, rapid advances in technology and increasing globalization in the marketplace (Simons, 1996). The rise in transaction volume in markets has also contributed to increased threats and risk, though many risks can be calculated and prepared for (Simons, 1996).

Unfortunately in the past many organizations have been slow to respond to security threats, resulting in increased impact on business processes and procedures. Microsoft has concerned itself among other things with managing the security and safety of its infrastructure to ensure business values to customers both internal and external.

Significance of Study

Microsoft notes that a 'failure to proactively manage security may put executives and whole organizations at risk" because breaches in both fiduciary and legal responsibilities to internal and external customers become apparent when security is lacking (Microsoft, 1).

Corporations must learn to not only identify what risk is acceptable, but also learn to manage the risk. What works for one company may not necessarily work for another, based on the complexity of an organizations infrastructure, an organizations resources and management responsibilities (Microsoft, 2004).

Literature Review: Security Risk Management the Microsoft Way

Defining Risk and Risk Management

Microsoft has developed a security risk management process based on customer experience and the companies own experiences. This guide provides "actionable guidance" which promises to delivery corporations multiple benefits including (1) providing customers a "proactive security base" (2) allowing companies to measure security and place a value on risk management and (3) enabling customers to minimize large risks without deflating all possible resources in the process (Microsoft, 2004).

Barrese & Scordis (2003) suggest that risk management be viewed "as the management of the operations and activities of a corporation and its financing practices" to develop a collection of risks that "yield a corresponding average payoff" (26). Risk according to the researchers has the ability to impact all aspects of business function and personal activity (Barresse & Scordis, 2003). Risk management includes measuring the "variation of actual outcomes around an expected outcome" (Barresse & Scordis, 26).

Kimball (2000) defines risk as "the existence of uncertainty about future outcomes" and suggests it is a key factor in economic transactions because firms make real investments each day without understanding whether their investments will result in debt or improved capital (Kimball, 2000).

Value Risk Management

Risk involves negative consequences whether financial or otherwise. Risk management practices are worthwhile because they may mitigate side effects of a volatile business environment, protect future investments, prevent "erosion of the firm's finance" and ensure the productivity and success value of a corporation (Barrese & Scordis, 26).

While corporations recognize the inherent value in managing risk, many spend too little resources on risk management in part because they lack information regarding "the nature of vulnerabilities, potential loses or options to upgrade security" (Manila, 2005). Simons (1996) points out that risk management can mitigate substantial concerns and potential losses within an organization particularly with respect to an organizations value portfolio.

Risk Management Procedures and Processes

Barrese & Scordis (2003) define risk management as a process. There are many models of risk management including Microsoft's. The number of steps involved will vary from company to company, but there should be core inclusions such as (1) establishing "risk return goals," (2) identifying and valuing root causes of future revenue fluctuations or instabilities, (3) balancing loss control and assessing and implementing financial tools used to mitigate risk and (4) implementation of final processes, maintenance, monitoring and ultimately review (Barresse & Scordis, 2003). A company's exposure to risk varies with time thus it is vital corporations review and consistently update risk management processes to resolve unexpected risks that may arise with time (Miller, 1992).

Simons (1996) supports an approach to risk management called "value at risk" or VAR, which suggests organizations, determine how much money they will lose over a defined period of time if risk is not managed. More precisely the researcher asks, "how much could the value of the portfolio of an organization decline" (Simons, 3). The need to place value on risk management is confirmed by numerous other researchers who note that value helps translate ideas into reality.

Simon's ideas are in line with Microsoft's security risk management approach that suggests organizations must assign value to assets and calculate risks. To do so Microsoft suggest the organization asses the "immediate financial impact" that will be realized if an asset is lost" as well as indirect impacts of a lost asset (Microsoft, 2004). In addition to assessing the total revenue that an organization might lose during a single incident, an organization must also determine how likely a risk is to re-occur during a given year and the amount of money that an organization may lose if no action is taken to mitigate risk (Microsoft, 2004). Likewise the cost of managing a particular risk must be assessed.

Key Success Factors For Security Risk Management

Microsoft (2004) had identified multiple critical success factors that allow implementation of a successful security risk management program. These include: (1) executive and management support of risk management processes, (2) clearly defined roles and responsibilities with respect to security risk management, (3) proper identification of the impact of risk by business owners and (4) identification of risk probability by information security teams. In addition the company uses their information technology team to implement controls to minimize any unacceptable risk within the organization (Microsoft, 2004).

For a risk management program to succeed it also must be well defined with regard to roles and responsibilities; it must be well planned; it must address "critical business threats and vulnerabilities" and it must "articulate" organizational priorities (Microsoft, 2004).

Barresse & Scordis (2003) confirm Microsoft's approach to risk management. The researchers state that multiple elements contribute to the success of a risk management program. The key elements defined by the researchers including (1) management buy in, particularly senior management buy in, (2) an organizational culture that supports risk management, (3) direct communication that moves up and down as well as across hierarchical boundaries in an organization, (4) common language to define risk management and lastly (5) a "company wide responsibility center" accountable for risk management processes and procedures (Barresse & Scordis, 26). Organizations must ensure that risk management ideals, objectives, goals and processes are ingrained in every day affairs and that employees are adequately trained with respect to risk management procedures (Barrese & Scordis, 2003).

Risk Management Failure Reduction

Failure occurs when organizations realize catastrophic losses that exceed worse case expectations, when errors occur in risk management or when firms simply fail to plan for risk management as part of operations (Kimball, 2000).

Microsoft (2004) suggests that failure may occur when an organization leaves out vital portions of the risk management process, which may include engaging in qualitative and quantitative analysis of risk measurement. Quantitative risk assessment includes evaluating and assigning monetary significance to define assets, creating a list of medium to high risk threats, calculating the probability these threats will occur and how long they will last, determining the loss potential for an organization over a 12-month period and recommending appropriate cost reasonable safeguards and controls to mitigate risks (Microsoft, 2004).

While most of these calculations would be subjective at best they nonetheless will provide an organization with valuable information related to risk management. Organizations can't exactly define risks or the potential losses that will result from a threat; they can however take steps to reasonable assume the potential risk or threat of a given situation and calculate the cost to benefit ratio of mitigating this risk.

Qualitative assessment is unlike quantitative assessment in that it involves much more subjectivity and experience related information. It does not involve assignment of monetary values to losses and assets, but rather involves risk evaluations through questionnaire and workshops that share knowledge between different people (Microsoft, 2004).

Researchers have also defined this as 'scenario driven' risk management and planning (Acar & Georgantzas, 1995). Strategic management according to Acar & Georgantzas (1996) involves detecting and planning for threats and converting them into opportunities. They call this process scenario driven planning and can help an organization improve the "content and process or what and how of strategy design" (6). Much like Microsoft's approach scenario driven planning involves identifying variables that may act as threats and identifying a firms objectives with respect to its strategic initiatives.

Firms must evaluate "causal relationships" and determine how changes in relationships may or may not result in looses. Variables that should be considered include the organizations external environment, which offers threats including "competition, emergence of new products and processes, government regulation, fluctuations in currency rates and interest" all of which can determine an organization's success and looses over time (Acar & Georgantzas, 386). The researchers further suggest that organization engage in environmental analysis to not only identify trends and threats but also opportunities for success and profits. An organization must at the same time identify its own resources, strengths and any weaknesses that may prevent it from taking action, implementing a risk management program or dealing with organizational resistance to risk management procedures (Acar & Georgantzas, 1996).

Methods

The aim of this research is to identify what critical success factors have contributed to Microsoft's security risk management approach but also define whether the principles underlying this approach can be applied to other organizations. As part of the research process the researcher will review other approaches companies have taken to manage security risk and compare these practices with Microsoft corporation. The intent of the researcher is to analyze the merits of the Microsoft security risk management program and ascertain whether the guidelines established by the company are applicable to theirs.

This research adopts use of narrative review as a qualitative approach toward examining risk management. Narrative interpretive method allows the researcher to analyze current documents and case studies to prove or disprove the validity of a particular approach (Jones, 2004). Qualitative research such as this is a much about reporting as it is about collecting evidence to support social research (Jones, 2004). This type of methodology is concerned with finding and verifying the meaning and truth or reality and significance of any given phenomena or occurrence (Hiatt, 1986).

Conclusions

Organizations continually face unique challenges when entering the marketplace. Acar & Georgantzas (1996) point out that historically management within organizations has always made mistakes, yet is continually working to minimize mistakes and subsequently reduce risk. Risk management involves identifying common threats including natural disasters or mechanical failures and less common threats, which may include negligence or terrorist activities (Microsoft, 2004). Regardless of the manner in which organizations define risk, organizations can be sure that risk exists regardless of the business they are engaged in. The less attention organizations pay to risk, the more likely they are to suffer from catastrophic experiences when entering the global marketplace.

Microsoft has proposed a security risk management program that involves a proactive approach to risk management. The process also defines steps for reacting to risks when they occur, but points out as other researchers have the proactive approaches to risk management are far more likely to mitigate risk than reactive approaches.

Key elements of the program include management buy in to risk management programs (particularly senior management), identification or organizational assets, identification or analysis of potential risks, planning to reduce risks and continual maintenance and change of programs as risks are dynamic in nature. The program suggests both quantitative approaches to risk management, which involve mathematical calculations of risk management, as well as qualitative approaches, which include surveys, employee and management knowledge sharing, and opinions regarding risk management.

Proper adoption of risk management principles can benefit organizations in many ways, including improving an organization's bottom line and yielding higher profit ratios. In addition risk management can help mitigate catastrophic losses.

The principles applied by Microsoft's risk management system can be applied to other organizations based on the information gathered from the research study. Multiple researchers support the need for adequate risk management measures. Some suggest the best approach involve scenario-based risk management assessment (Acar & Georgantzas, 1996). Others suggest computer or matrix simulated approaches to risk management that again provide management teams with a visual representation of projected risks and the costs of mitigating such risks (Leithhead & McNamee, 2000). By and large the majority of researchers evaluating risk management support the need for management buy in, clearly defined procedures and practices, appointment of individuals responsible for carrying out certain parts of a risk management program and knowledge sharing across an organization with regard to risk management (Kimball, 2000; Jones, 2004; Barrese & Scordis, 2003). Organizations simply can't successfully implement successful risk management programs without adopting these basic principles.

Planning and assessment are an invaluable part of the risk management process. Organizations must work to identify their assets and them determine the costs of protecting those assets (Barrese & Scordis, 2003). Organizations that follow these procedures while keeping in mind their resources, company size and business specifics are most likely to overcome any catastrophic threats the environment presents them during the course of business. Overall the researcher can conclude that the principles adopted by the Microsoft security risk management program are grounded in solid research and based on successful experience. Organizations large and small can adopt the principles outlined in the system successfully, as long as they keep in mind their own industry and resources when doing so. Whether an organization uses a scenario-based approach or graphical representation or prospective threats seems irrelevant. The key is adopting measures that coincide with organization objectives and clearly outline medium to high risks. Organizations must take proactive steps to mitigate risk in a fiscally responsible manner.