Category: Cyber Risk

Understanding Security Exceptions and Risk Acceptance

Rules Are Meant to Be Broken

In the field of Cybersecurity, it is imperative that security measures be continuously improved. However, despite the defences and fortifications of procedures and safety measures, circumstances emerge that necessitate brief deviations from established security guidelines. Formally speaking, these variations—which are based on technological constraints or commercial requirements—are known as Cybersecurity Information Security Exceptions (IS Exceptions).

Exceptions provide a variety of uses, but their logical and structured requirements may cause anxiety due to their perceived increased vulnerability. Organizations can strike a balance between security guidelines and business continuity by assessing their effectiveness through a risk-based lens. 

Do not Let Exceptions Swallow the Rules

Cybersecurity IS Exceptions have spread more widely in recent years. The analysis of security SIEM events that produced alerts but were classified as non-incidents in the Verizon Data Breach Investigations Report (DBIR) for 2021, eluded to the fact they were due to approved security exceptions to rules or procedures.

This highlights a crucial realization: exceptions matter when it comes to security risks and weaknesses that a system or organization may encounter. It also suggests that these outliers have a discernible and tangible impact on the threat landscape.

Whether a result of a technological workaround or a new business requirement, their ability to evade security measures calls for ongoing assessment.

Armed with the knowledge of what is the norm (as a security rule) and what is the exception, an ideally optimized solution would be to engineer solutions for the norm (shift-Left)

To Every Rule There Is an Exception

Fundamentally, an information security exception in Cybersecurity allows for the temporary (if not outright) circumvention of established security procedures. These deviations introduce danger on several fronts, even though they may be tactical or required in some situations.

Technically speaking, exceptions get around security measures meant to protect data and infrastructure. The risks covered by resources such as the OWASP Top 10 encompass a range of vulnerabilities, including system access exploitation and data exfiltration.

But the benefits of exceptions also make attestation necessary. Strict adherence to policy might impede adaptation and innovation in dynamic business environments. Frameworks that emphasize organizational resilience through iterative enhancement, such as the Business Continuity Management (BCM) Lifecycle, are prevalent. In a similar vein, the Agile Methodology places a strong emphasis on fail fast, fail forward strategies that are made possible by adaptable systems and quick error correction.

Exceptions facilitate both continuity and innovation by permitting a controlled, limited risk deviation beyond the parameters of policy. The advancement and preservation of systemic integrity balance out the isolated vulnerabilities that are introduced.

Purely from monetary value, it is not a wise use of your organization’s resources to engineer solutions for every single possible exception

Rules Are Rules

Exceptions clearly contradict the principles of Cybersecurity rules and controls, even if they are required in certain situations. Best practices for control implementation are codified in frameworks such as ISO 27002. In a similar vein, CIS Controls assign whole teams to specify organizational and policy requirements. Additional penalties arise from noncompliance with regulations like as GDPR and HIPPA, which penalize control shortcomings.

However, exceptions signify a brief departure from recommended rules, which puts businesses in a difficult situation. This tension results from the fact that, although exceptions could be required to satisfy business requirements, they may also compromise the security framework, which greatly irritates Cybersecurity teams.

See previous Article “what-all-Cybersecurity  -professionals-fear”

It Never Hurts to Ask

An organized approach to exception management can help organizations manage the risks and moral conundrums that arise from making exceptions. Risk analysis is done in the first stages of this process using frameworks such as FAIR or the NIST Risk Management Framework. These methods bring to light the need for exceptions, the actual risks taken, the appetite and tolerance for risk, and the efforts taken to reduce exposure.

The following stage of the process consists of oversight mechanisms for post-exception issues. The COBIT framework’s control and transparency principles are connected to the monitoring of exception duration and compensating control efficacy. Examining alternate technological options in cases when exceptions present an inevitable danger is consistent with the Zero Trust model, which aims to improve security.

Instead of flatly rejecting deviations, the focus is on organizing and managing them at every stage of an exception process. This practical method takes into consideration both business needs and security considerations at the same time.    

Bend The Rules Before They Bend You

The dilemma that businesses confront in maintaining security directives while facilitating operational advancement must be discussed in relation to Cybersecurity IS Exceptions. Policies and restrictions, which are always being improved, are in charge. However, exceptions also allow for flexibility and inventiveness in terms of operations. 

A strategy that is nuanced and smart is needed to resolve this dispute rather than one that is rigid and unyielding. In the end, reaching a solution means accepting complexity, considering a range of risks, and being willing to make concessions and adjustments.

The principles of Human Centered Design should be applied while evaluating validity, whether an exception supports arbitrary demands or user requirements. This will further enable security teams in supporting the advancement of business operations. 

How Can ITM Help You?

IT Minister covers all aspects of Cyber Security including but not limited to Home cyber Security Managed Solutions to automated, Manage Threat Intelligence, Digital Forensic Investigations, Penetration Testing, Mobile Device Management, Cloud Security Best Practice & Secure Architecture by Design and Cyber Security Training. Our objective is to support organisations and consumers at every step of their cyber maturity journey. Contact Us for more information.