Insider threats: the major challenge to security risk management

Security risk management is by definition, a subjective and complex exercise and it takes time to perform properly. Human resources are fundamental assets for any organization, and as any other asset, they have inherent vulnerabilities that need to be handled, i.e. managed and assessed. However, the nature that characterize the human behavior and the organizational environment where they develop their work turn these task extremely difficult, hard to accomplish and prone to errors. Assuming security as a cost, organizations are usually focused on the efficiency of the security mechanisms implemented that enable them to protect against external attacks, disregarding the insider risks, which are much more difficult to assess. All these demands an interdisciplinary approach in order to combine technical solutions with psychology approaches in order to understand the organizational staff and detect any changes in their behaviors and characteristics. This paper intends to discuss some methodological challenges to evaluate the insider threats and its impacts, and integrate them in a security risk framework, that was defined according to the security standard ISO/IEC_JTC1, to support the security risk management process.

The concept of risk management in the renewable sector.

This study explores the perception of risk and the level of risk management implementation in the renewable sector. Risk management is emerging as a key issue due to the loss of confidence amongst banks, causing the attainment of financing to be difficult over the next few years. To attract financing, there is a fundamental requirement to manage risk in a way that minimizes the probability of a negative financial impact on the project. Miller and Lessard (2001) argue that successful projects are not selected but shaped with risk resolution in mind. Rather than evaluating projects at the outset based on projections of the full set of benefits, costs and risks over their lifetime, successful developers start with project ideas that have the potential of becoming viable. Therefore, this study bridges the gap that exists within the renewable sector in relation to risk management literature. This study succeeds through a detailed comparative case study analysis where two developers and two financiers were questioned through qualitative semi-structured interviews on the concept of risk management and its level implementation within the industry. It is believed that the growth in financed renewable energy projects depends on the adequate design and implementation of risk management to mitigate inherent project risks. However, this study revealed that are certain types of developers in existence within the renewable sector, which underestimate the magnitude of risk and view the development of projects as a ‘money racket’. Therefore, it can be concluded that perception of risk will also differ, causing risk and uncertainty to vary from project to project, resulting in investment reluctance to be associated with certain projects. The study originality lies in how it demonstrates to developers the concept of risk management, outlining the simplicity and benefits of implementing it in project development. Finally, this study contributes to the knowledge by enhancing the awareness and understanding of the presence and nature of risk in a RE project environment.

Social perceptions of floods and flood management in a Mediterranean area (Costa Brava, Spain)

Taking as an example three study cases in the Costa Brava area, this paper examines the social perceptionof floods through surveys, interviews and Focus Group sessions. Perception is then related to vulnerability, flood management, and citizen’s preferences regarding alternatives to curb flood losses in the future. The study concludes that flood awareness and the willingness to take actions regarding this hazard are clearly related to the degree of social involvement with the affairs of the local community. Furthermore, participatory settings such as Focus Group sessions appear to enable a better environment for assessing and implementing flood management options that attempt to modify human activities rather than modify natural processes as has been frequently the case in the past

A reflection about the social and technological aspects in flood risk management - the case of the Italian Civil Protection

The right of a person to be protected from natural hazards is a characteristic of the social and economical development of the society. This paper is a contribution to the reflection about the role of Civil Protection organizations in a modern society. The paper is based in the inaugural conference made by the authors on the 9th Plinius Conference on Mediterranean Storms. Two major issues are considered. The first one is sociological; the Civil Protection organizations and the responsible administration of the land use planning should be perceived as reliable as possible, in order to get consensus on the restrictions they pose, temporary or definitely, on the individual free use of the territory as well as in the entire warning system. The second one is technological: in order to be reliable they have to issue timely alert and warning to the population at large, but such alarms should be as "true" as possible. With this aim, the paper summarizes the historical evolution of the risk assessment, starting from the original concept of "hazard", introducing the concepts of "scenario of event" and "scenario of risk" and ending with a discussion about the uncertainties and limits of the most advanced and efficient tools to predict, to forecast and to observe the ground effects affecting people and their properties. The discussion is centred in the case of heavy rains and flood events in the North-West of Mediterranean Region.

Life-course socioeconomic environment and health risk behaviours: a multilevel small-area analysis of young-old persons in an urban neighbourhood in Lausanne, Switzerland

With a life expectancy at the age of 65 of around 20 years, damaging health risk behaviours of young-old adults have become a target for preventive actions. Such risk factors necessitate an accurate understanding of the present and past socioeconomic conditions associated with health risk behaviours. The aim of our study is to assess the impact of certain life events as well as economic and environmental factors on health risk behaviours. We included 1309 participants of the Lausanne Cohort Lc65+ aged 65-70 years and employed logistic regression analyses, with individuals nested within areas. The results illustrate the influences of socioeconomic factors from childhood to young-old age. Life experiences in adulthood and economic resources in young-old age are both associated with unfavourable health behaviours. Neighbourhood is a modest determinant as well, particularly regarding alcohol consumption. Therefore, prevention against health risk behaviours should focus on population subgroups defined on the basis of their socioeconomic and living contexts.

Integrated Risk Management for Improving Internal Traffic Control, Work-Zone Safety, and Mobility during Major Construction, TPF-5(081), 2012

Highway construction is among the most dangerous industries in the US. Internal traffic control design, along with how construction equipment and vehicles interact with the traveling public, have a significant effect on how safe a highway construction work zone can be. An integrated approach was taken to research work-zone safety issues and mobility, including input from many personnel, ranging from roadway designers to construction laborers and equipment operators. The research team analyzed crash data from Iowa work-zone incident reports and Occupational Safety and Health Administration data for the industry in conjunction with the results of personal interviews, a targeted work-zone ingress and egress survey, and a work-zone pilot project.

Quality of Disease Management and Risk of Mortality in English Primary Care Practices

OBJECTIVE: To investigate whether better management of chronic conditions by family practices reduces mortality risk. DATA: Two random samples of 5 million patients registered with over 8,000 English family practices followed up for 4 years (2004/5-2007/8). Measures of the quality of disease management for 10 conditions were constructed for each family practice for each year. The outcome measure was an indicator taking the value 1 if the patient died during a specified year, 0 otherwise. STUDY DESIGN: Cross-section and multilevel panel data multiple logistic regressions were estimated. Covariates included age, gender, morbidity, hospitalizations, attributed socio-economic characteristics, and local health care supply measures. PRINCIPAL FINDINGS: Although a composite measure of the quality of disease management for all 10 conditions was significantly associated with lower mortality, only the quality of stroke care was significant when all 10 quality measures were entered in the regression. CONCLUSIONS: The panel data results suggest that a 1 percent improvement in the quality of stroke care could reduce the annual number of deaths in England by 782 [95 percent CI: 423, 1140]. A longer study period may be necessary to detect any mortality impact of better management of other conditions.

Screening for cardiovascular disease risk and subsequent management in low and middle income countries : challenges and opportunities

Background: Cardiovascular disease (CVD), mainly heart attack and stroke, is the leading cause of premature mortality in low and middle income countries (LMICs). Identifying and managing individuals at high risk of CVD is an important strategy to prevent and control CVD, in addition to multisectoral population-based interventions to reduce CVD risk factors in the entire population. Methods: We describe key public health considerations in identifying and managing individuals at high risk of CVD in LMICs. Results: A main objective of any strategy to identify individuals at high CVD risk is to maximize the number of CVD events averted while minimizing the numbers of individuals needing treatment. Scores estimating the total risk of CVD (e.g. ten-year risk of fatal and non-fatal CVD) are available for LMICs, and are based on the main CVD risk factors (history of CVD, age, sex, tobacco use, blood pressure, blood cholesterol and diabetes status). Opportunistic screening of CVD risk factors enables identification of persons with high CVD risk, but this strategy can be widely applied in low resource settings only if cost effective interventions are used (e.g. the WHO Package of Essential NCD interventions for primary health care in low resource settings package) and if treatment (generally for years) can be sustained, including continued availability of affordable medications and funding mechanisms that allow people to purchase medications without impoverishing them (e.g. universal access to health care). This also emphasises the need to re-orient health systems in LMICs towards chronic diseases management.

Supply Risk Management in Pharmaceutical

Fast development in the operating environment and fierce competition have driven companies to pursue efficiency and success through lean and global supply chains. At the same time overall uncertainty has increased in the business environment and supply chains have become a priority in risk management since their vulnerability may endanger business continuity. Although risk management should start at procurement strategy development phase, proactive contingency planning is also essential because it enables correct reaction and fast changes in process execution in the case of risk realization. This thesis is a case study conducted in the pharmaceutical industry where purchasing and materials management organizations face a number of challenges and limitations that have to be considered in supply risk management. The goal of the study was to discuss the operating environment, and identify and analyze supply risks and potential risk management practices. The study was concluded with suggestions for purchasing strategy development that take risk management considerations into account. This copy is the public version of the thesis.

Stress testing practices in risk management - Empirical evidence from the Finnish banking and insurance sectors

The main purpose of this study was to analyze how stress tests are used in risk management in the Finnish banking and insurance sectors. In order to enhance understanding of the topic, stress testing was explored in the context of corporate governance and regulato-ry implications of Basel II and Solvency II on stress testing were examined. In addition, the effects of the global financial crisis on stress testing were mapped and the differences in stress testing practices between the banking and insurance sector were discussed. The research method was qualitative case study and it was conducted by interviewing risk managers from ten institutions and a representative from FIN-FSA. Findings pointed out that stress testing practices vary significantly between different institutions. Interesting observations were made in terms of stress testing practices in the banking and insurance sectors. The increasing importance and use of stress tests were recognized as a result of the financial crisis. Stress testing was even considered more like art than science given the amount of challenges it involves. In general, improvements in stress tests were suggested, with an emphasis on stress concentration between different types of risks.

Approaches to Supply Chain Risk Management: Identification, Analysis and Control

Supply chain risk management has emerged as an increasingly important issue in logistics as disruptions in the supply chain have become critical issues for many companies. The scientific literature on the subject is developing and in many respects the understanding of it is still in its infancy. Thus, there is a need for more information in order for scholars and practitioners to understand the causalities and interrelations that characterise the phenomenon. The aim of this dissertation is to narrow this gap by exploring key aspects of supply chain risk management through two maritime supply chains in the immediate region of the Gulf of Finland. The study contributes to the field in three different ways. Firstly, it facilitates the identification of risks on different levels of the supply chain through a systematic analysis of the processes and actors, and of the cognitive barriers that limit the actors’ visibility and their understanding of the operations and the risks involved. There is a clear need to increase collaboration and information exchange in order to improve visibility in the chain. Risk management should be a collaborative effort among the individual actors, aimed at obtaining a holistic picture. Secondly, the study contributes to the literature on risk analysis through the use of systemic frameworks that illustrate the causalities and linkages in the system, thereby making it easier to perceive the vulnerabilities. Thirdly, the study enhances current knowledge of risk control in identifying actor roles, risk visibility and risk controllability as being among the key factors determining risk-management effectiveness against supply-chain vulnerability. This dissertation is divided into two parts. The first part gives a general overview of the relevant literature, the research design and the conclusions of the study, and the second part comprises six research publications. Case-study methodology with systematic combining approach is used, where in-depth interviews, questionnaires and expert panel sessions are the main data collection methods. The study illustrates the current state of risk management in multimodal maritime supply chains, and develops frameworks for further analysis. The results imply that there are major differences between organizations in their ability to execute supply chain risk management. Further collaboration should be considered in order to facilitate the development of systematic and effective management processes.

Hazard Risk Management in Large Nordic Companies' Operations in Russia

The objective of this research was to describe how Nordic companies manage hazard risks in their operations in Russia and how the local business environment is considered to affect the hazard risks. Research methods used in this research were literature review and expert interviews. Twelve Nordic industrial companies operating in different fields of industry were interviewed. Large Nordic companies typically guide risk management centralized from the parent company on behalf of the whole company group and the risk management standards and policies are integrated in all subsidiaries. Parent companies typically control hazard risk management in Russia by regular risk management reporting, auditing the Russian sites and by training local managers and employees to risk management work. Many companies have experienced several losses in the first years of operating in Russia before the risk management policies have been implemented in Russian subsidiaries. The companies have learned to take local characteristics better into account by experience and most companies are quite satisfied with their current risk management standards in Russia. The interviews indicate that companies experience especially the poor quality of infrastructure, some features in Russian organizational culture and high level of criminality to increase hazard risks in Russia. However, understanding these features and risks in the business environment makes the management of these risks possible. Risks related to infrastructure can be managed in advance by decreasing dependencies of infrastructure and considering the infrastructure quality already when planning the business operations. Also good local network is often considered critical in order to overcome the complications related to infrastructure. Russian personnel has typically different attitude towards risk management than Nordic personnel and neglecting safety and maintenance and concealing losses is more typical in Russia. By training and guiding the local personnel risk management and safety work and desired ways of actions these risks can be decreased. Criminality risks are often managed to certain extent by investing in security, increasing supervising and paying attention to reliability of the employees and other interest groups of the company.