Protecting Your Data: How to Prevent Spreadsheet Security Breaches

In today’s environment, cybersecurity risk management is facing increased scrutiny not only from internal stakeholders but also from regulators, auditors, and customers. Despite this, many organizations continue to rely on outdated tools such as spreadsheets to track and manage risk. One mid-sized financial institution learned this lesson the hard way during a routine audit, where their reliance on spreadsheets exposed systemic weaknesses that nearly tarnished their reputation.

Challenges of Using Spreadsheets

The institution used a shared Excel file to manage its cybersecurity risk register, which initially seemed practical. However, when auditors requested deeper evidence of due diligence, the limitations of the system became glaringly evident:

• Lack of an audit trail for risk reviews or approvals
• Inconsistent criteria for accepting or remediating risks
• No alignment with business priorities or legal obligations
• Inability to demonstrate decisions reflecting a reasonable duty of care

What was thought to be a comprehensive risk register turned out to be merely a list lacking the necessary context, rigor, and accountability to meet current regulatory standards.

Understanding the Concept of Duty of Care

The audit findings shed light on a fundamental issue—the institution lacked a cohesive framework for determining what constitutes “reasonable” cybersecurity protections. In legal and regulatory contexts, organizations are expected to show duty of care, proving that they have taken responsible steps to prevent foreseeable harm.

Implementing cybersecurity frameworks that embody duty of care principles can assist decision-makers in:

• Assessing the impact of risks on the organization, customers, and the public
• Evaluating safeguards based on their ability to prevent harm, not just cost or technical feasibility
• Making and documenting defensible decisions that can withstand scrutiny

A Shift in Approach

In response to the audit, the institution not only ditched spreadsheets but also reevaluated its entire cyber risk management approach. They adopted a standards-based framework that emphasized accountability, transparency, and alignment with business objectives in risk decisions.

Key changes included:

• Contextual risk scoring: Evaluating risks considering legal duty, stakeholder impact, and operational resilience
• Comprehensive documentation for audits: Logging and justifying every decision with clear rationales and timestamps
• Enhanced cross-functional collaboration: Facilitating communication between security, legal, and compliance teams
• Real-time visibility of risks: Transitioning from static reports to dynamic dashboards for executive insights

Positive Outcomes

Within a short span of 90 days, the institution revamped its risk program to reflect a more mature, collaborative, and defensible stance. It successfully passed the subsequent audit with commendations for transparency and improved governance. Leadership gained deeper insights into cybersecurity exposure, and the security team reported increased clarity and confidence in their roles.

Valuable Lessons

This narrative provides crucial insights for organizations still managing cyber risk using manual methods:

• Spreadsheets are not scalable: In a constantly evolving threat landscape, disconnected tools fail to offer the necessary insights for modern risk management.
• Duty of care transcends legal jargon: It serves as a strategic framework linking cybersecurity to the business.
• Automation is essential for accountability: Traceability and transparency, crucial for defensible decisions, are challenging to achieve with static tools.

Future Outlook

What initially seemed like a compliance setback led to a governance transformation. By embracing a strategic and standardized approach to cyber risk, the institution not only recovered but evolved. Other organizations should reflect on whether their risk register would convey the desired narrative to regulators or customers if scrutinized today.

Rosanna Pellegrino, the Chief Revenue Officer at Reasonable Risk, brings over 30 years of experience in IT security, professional services, and product strategy. At Reasonable Risk, she drives global revenue growth through strategic sales, channel development, and key alliances. Rosanna’s previous roles at Nisos, Qualys, and RedSeal have equipped her with expertise in building and scaling global sales networks and forging partnerships with industry leaders.

Connect with Rosanna online at [email protected], https://www.linkedin.com/in/rosannapellegrino/, and visit the company website https://www.reasonablerisk.com/, https://www.reasonablerisk.com/get-started/contact-us/ for demos