Digitalization has evolved from a trendy trend to a key element of modern business. Adaptation of new technologies, such as automation and artificial intelligence (AI), provides unique opportunities for increasing efficiency and strengthening competitive positions. RuNews24.ru discussed the topic of benefits and new challenges related to operational risks with Aidan Shakenov, operational risk specialist.
With the introduction of digital solutions, companies are facing several key changes:
- Expansion of the attack surface
Each new digital solution increases the amount of data to be protected and opens up new entry points for possible cyberattacks. Systems integrated with cloud solutions or third-party service providers are particularly vulnerable.
- Complexity of technology chains
Modern automation and AI systems are complex and require continuous interaction between different platforms. Any disruption can set off a chain reaction that can affect key business operations.
- New forms of AI risks
AI is a powerful tool, but it is also prone to data bias, inadequate interpretation, and insufficient control. For example, an improperly trained algorithm can make decisions that violate laws or contravene ethical standards.
- Recent years have seen a significant increase in cybersecurity regulation, both in the U.S. and internationally. In 2024, many new regulations were implemented to improve data protection and increase the responsibility of organizations to report cyber incidents in a timely manner.
In particular, the U.S. introduced important changes regarding cyber incident notification. Under the SEC's (Securities and Exchange Commission) new Cyber Incident Disclosure Rule, public companies are now required to report material cyber incidents within four business days of assessing their significance. However, disclosure may be delayed in cases involving national security or public safety, if authorized by the U.S. Attorney General.
In addition, the FTC (Federal Trade Commission) updated the requirements under the Customer Privacy Rule in May 2024. It requires financial institutions to notify the FTC of hacks affecting the data of at least 500 consumers within 30 days of discovery.
Also worth noting is HUD (U.S. Department of Housing and Urban Development), which in May 2024 issued Mortgagee Letter 2024-10, which requires approved mortgage companies to immediately notify HUD of significant cyber incidents within 12 hours of discovery.
The Federal Aviation Administration's (FAA) August 2024 changes also introduce new standards aimed at identifying and minimizing cyber threats in the aviation industry, including mandatory risk assessments and vulnerability analyses.
In addition, global trends are also playing an important role. For example, the European Commission adopted the NIS2 Directive, which covers critical organizations that provide key services to support critical infrastructure and economic activity.
These new regulations emphasize the importance of taking a holistic approach to data security, implementing advanced security practices such as multi-factor authentication (MFA), data encryption and third-party risk management, and requiring companies to take a more proactive approach to reporting and disclosing incidents.
Thus, cybersecurity continues to be a key area of government and corporate policy, requiring organizations to meet new security standards and strictly comply with regulatory requirements.
Benefits of technology for operational risk management
Despite new risks, technology also plays a key role in managing them:
- Analytics and proactive threat detection
AI and machine learning can process vast amounts of data to help identify weaknesses in systems, assess incident probabilities, and suggest corrective actions.
- Automation of risk management processes
Automating processes can significantly reduce the likelihood of human error. For example, automated systems can monitor and verify compliance and regulations.
- Enhancing cyber defense
AI is already being used successfully to detect cyberattacks, predict new threats and automatically respond to incidents such as phishing attacks or DDoS.
How can you protect your business from digital threats?
- Create a culture of security
Technology is important, but employee awareness plays a major role in protection. Regular training, conducting security drills and mock attacks will help improve overall security awareness.
- Develop layered defenses
To manage cyber threats, companies should build defenses along the lines of “defense in depth” - which includes encryption, network segmentation, real-time monitoring and data backup.
- Third-party assessment and management
Digitalization often involves suppliers or contractors. This requires regular audits and a thorough assessment of their ability to comply with security standards.
- Dynamic AI risk management
It is not just necessary to implement AI, but also to put systems in place to monitor its performance. This includes regular testing of algorithms to ensure decisions are correct and ethical data model validation.
- A flexible incident management plan
Every company should have a well-developed and tested incident response plan in place to quickly restore operations and minimize damage.
Digitalization requires companies not only to be bold in adopting new technologies, but also to be responsible in their use. It is important to have a clear understanding of the risks associated with digitalization and approaches to manage them. This balance between innovation and sustainability is the foundation of successful business development in the digital age.