Trinidad Cyber Breaches: A Lack of Effective Risk Management

When will “lessons learned” form part of the decision-making process?

Risks eventuated because of these breaches are as follows but not limited to: Communication risks, people risk, risk culture, enterprise risks, Operational risks, IT risks, Cyber risks, and financial risks = Reputational risk

Many (definitely not all) of the leaders of institutions either don’t seem to know the full range of the impact/probabilities of the risks they are exposed to, or if they do know, it appears they are ambivalent or worse, don’t care. One reason might be that they don’t have any “skin in the game.” There are no consequences to their inactions, no accountability. Some may even believe they are all-knowing when they should endeavor to be all-learning. (no Intellectual humility)

Perhaps we should focus more on the philosophy that “an amateur practices until they get it right; a professional practice until they can’t get it wrong,” as the great Julie Andrews quotes. Unfortunately, the current poly-crises environment we are working/living in does not allow for a deep learning curve or more practice sessions. Having said that, I was told by some colleagues that some leaders need time to understand cybersecurity and other business risks that they are exposed to and that it is a “marathon and not a sprint.” Folks, in my respectful view, this is the wrong approach; institutions do not have the luxury of time on their side, risks are not static or will wait on a “marathon”: the velocity of risks is such that it is, in fact, a sprint. Furthermore, risks are too interconnected, volatile, uncertain, and hyper-connected to have a “marathon” mindset.

My Apologies: I have taken a point of privilege to vent, but I believe we will see many more of these massive negative disruptions unless and until the “behaviour” of leaders and decision-makers changes.

#cobra effect, #dunningkruger, Schrödinger’s cat paradox, #upksilling, #unlearning, #newthinking, #normaliation of deviance, #leadership, #riskmanagement