Implementing Converged Security Risk Management: Drivers, Barriers, and Facilitators

Abstract

Converged security risk management is an approach that addresses interdependencies between security-related business functions that have traditionally been managed by separate departments within organizations. It is a more effective means of addressing organizational security risks and threats than tackling physical and information security challenges separately, given that the boundaries between the two are frequently blurred. However, fully converged security remains the exception rather than the rule, leaving organizations increasingly vulnerable as their adoption and reliance on digital technologies accelerates. Through interviews with eight senior security professionals, this research identified key factors critical to effective converged security risk management, expressed as ‘drivers,’ ‘barriers,’ and ‘facilitators.’ The practitioners’ accounts illuminated how the modern threat landscape continues to drive further the need for such an approach, while the traditional separation of corporate security departments from the information security function in organizations remains a barrier. A greater focus on training and education, as well as soft skills, were identified as key priorities in the drive for an effective converged approach.