Wipro collaborates with WEF for quantifying cyber risk for holistic risk management

Wipro (NYSE:WIT), a leading global IT, consulting and business process services company, has been working with the World Economic Forum (WEF) partner companies to evangelise the need for organisations to develop cyber resilience and the importance of quantifying cyber risk.

Cyber threats are distinct from other business risks, given the speed and wide-spread nature of their impact, as well as the sheer variety of objectives and modes of attack. Also, considering the rising profile of cyber attacks, cyber security is no longer perceived as just another technology challenge, but is now acknowledged as one of the top five business threats for most enterprises.

As per the WEF's estimates, if the sophistication of attacks keeps ahead of defensive capabilities, the resultant new cyber regulations and restrictive policies could hurt innovation by approximately USD 3 trillion by 2020. Consequently, business leaders and policy-makers have highlighted the need for a framework that would aid them in making better cyber security decisions.

The Cyber Value-At-Risk (VAR) framework, developed by Wipro and the WEF's Partnership for Cyber Resilience allows organisations to develop a better appreciation of their threat landscape, the nature of assets that need protection and the quality of their defences. Cyber risk quantification allows business leaders to apply standard risk management principles to make decisions around mitigating, transferring and managing residual risk. While this framework can be applied across all industries, this has specific relevance to sectors that involve sensitive personal data such as financial services, healthcare and retail, and those involving critical national infrastructure, including the transportation and energy sectors.

The value-at-risk model (VAR) aims to articulate the aggregate level of risk faced due to cyber threats over a given duration of time and at a particular level of exposure. This framework is modelled on more established risk evaluation models in the financial sector and aims to quantify the complexity of the technology landscape and threats through a standardised risk language. Through this framework, an organisation can reliably determine and predict the VAR threshold of its cyber exposure. This allows it to determine whether it makes more business sense for the company to transfer the risk to an insurance company, take remedial actions to reduce this VAR, or manage the exposure as part of standard business risks.

Elena Kvochko, Manager, Information Technology Industry, Partnering for Cyber Resilience, World Economic Forum, who has worked on the project and the report with Wipro, said: "A shared industry framework for cyber risk quantification and measurement will help boost the confidence in and buy-in for organisations' investments towards cyber risk management. More broadly, the framework can help develop more effective risk transfer markets. The cyber value-at-risk concept that we have worked on with Wipro and other members of the 'Partnering for Cyber Resilience' initiative suggests that organisations actively consider aspects such as value of their assets, profile of attackers, and the existing security posture, as they build their cyber risk models."

Commenting on the framework, R Guha, Head, Corporate Business Development, Wipro said: "Our customers are increasingly concerned about the rising sophistication of cyber attacks and extent of reputational and business risks. Through this framework, we have been able to help our customers quantify their threats, prioritise business assets and assist them in directing their investments towards better risk mitigation."