IT Risk

出版者:Harvard Business School Press

作者:George Westerman

页数:221

出版时间:August 21, 2007

价格:$35.00

装帧:Hardcover

isbn号码:9781422106662

具体描述

By M. McDonald (Chicago, IL United States) - See all my reviews

IT used to be thought of as separate from the business, a staff function that by itself could enable but not change the business, its value or its brand. Well that view no longer holds water and Westerman and Hunter show how IT risk is really business risk and needs to be treated as such. In their book, the two provide a clear and concise discussion about IT risk from the perspective of the leader/practioner rather than the perspective of the auditor.

Since business and IT have become so closely intertwined and this book offers clear and actionable advice - not fear, uncertainty or doubt - I recommend this as a read for the CIO/IT executive as well as the CEO so they can understand what to expect both in terms of protection but also competitive advantage from the ability to manage IT risks.

I come to this position from the way Westerman and Hunter introduce the concept of risk management and the way they have organized the book. They introduce a framework of four "A's" that looks at risk from a business perspective, rather than an auditing or compliance perspective. The four A's that define IT risk are:

Availability -- keeping business processes and information flowing through the business

Access -- ensuring that the appropriate people, including customers and suppliers, can get the information and functionality they need to be effective

Accuracy -- concentrating on providing timely and complete information to meet operating and oversight needs

Agility -- the ability to change with managed cost and speed.

Westerman and Hunter address this subject in a clean and concise nine chapters that provide actionable advices on how to plan and manage risks. One thing of note is that the book talks about using your risk management capability as a competitive weapon -- what you can do that others cannot because you manage risk better. This gives the topic of risk management a strategic context that is unique to this work.

The book can be thought of as being in three parts.

Part One is about the framework and the overall approach to risk management. It includes the following chapters:

Chapter 1: The 4A Risk Management Framework

Chapter 2: The Three Core Disciplines of IT Risk Management

Part Two concentrates on the actionable management steps business and technology executives can use to manage risk.

Chapter 3: Fixing the Foundation: strengthening the base of the pyramid -- about the importance of infrastructure in risk management.

Chapter 4: Fixing the Foundation: simplifying the base of the pyramid -- about how complexity drives risk, cost and performance levels.

Chapter 5: Developing the Risk Governance Process -- covering how do you manage and make decisions regarding IT and Business risks.

Chapter 6: Building a risk-aware culture-- here the authors make an important connection between risk and culture and a critical distinction between being risk aware (strategically important) and being risk adverse (strategic killer)

Chapter 7: Bringing the three disciplines up to speed -- concentrates on the program and patterns for effective implementation.

Part Three looks at the future and improvements to risk management

Chapter 8: Looking ahead -- talks about how to incorporate risk management as a positive force in planning and strategy setting

Chapter 9: Ten ways executives can improve IT risk Management.

Overall this is a must read for CIOs, IT risk management and IT profesionals. It is also recommended reading for CEOs and others who want to understand how to manage IT and how to gain advantage from having good IT.

By James Taylor "Enterprise Decision Management ... (Palo Alto, CA USA) - See all my reviews

I was lucky enough to get a pre-release copy of IT Risk: Turning Business Threats into Competitive Advantage by George Westerman and Richard Hunter. The book approaches IT risk not as a technical issue but as a business and management one with potentially serious consequences. As businesses increasingly are there information systems, this point of view is both necessary and valuable. The book introduces IT risk and its consequences, discusses the authors' 4A framework and outlines 3 core disciplines for IT risk management. It then drills into actual steps to take to fix the foundation, develop risk governance processes and establishing a risk aware culture. It wraps up with some forward looking thoughts and a list of ways in which executives can improve IT risk management.

Their basic premise is that effective IT governance essential in times of high change and increasing complexity (of systems as well as of business/problems). They discuss 4As - availability of systems, access to systems and data, accuracy or data and results, and agility in terms of ease of change - as being the framework for risk management. These 4As are supported by a foundation, a risk management process and a risk aware culture. The framework and the disciplines mostly work well for the authors, only occasionally becoming confusing to the reader. From my perspective I found the focus on agility very interesting as possible changes to systems should be considered along with general IT effectiveness when managing risk. Also, while the foundation is lower level than I usually consider, I think the objectives for the foundation can all be met more easily by and organization that has adopted enterprise decision management - the approach discussed in Smart Enough Systems: How to Deliver Competitive Advantage by Automating Hidden Decisions. It can make it easier to assess risk, easier to maintain systems, easier to change and fix them. It can also make it easier to apply risk assessments in operational systems by calling out the decisions that must be made, which is where risk assessment matters.

Fixing the foundation is described as a journey and I really liked the focus on incremental improvement. The foundation is a problem as most companies developed their IT infrastructure in stages. However, a poor foundation undermines agility by degrading the business/IT relationship and by making change to existing systems, to meet changing business needs, hard. While I think there are other ways to add agility into existing systems, I do agree with their assertion that you need to change and replace foundation to some extent. They make some fairly good suggestions for broad steps you can take and show the kinds of payoffs that come from the capabilities you enable with a better infrastructure. The authors make a critical point when they show how change in infrastructure is IT change while change in applications is business change but most IT departments don't see the difference - they see it all as "system" change making it harder to manage than necessary. Again, a focus on separate automation and management of decisions can help clarify this difference. There is a fair amount of useful discussion in the book about the need for both local and central management to which I would add one more category - where do decisions live in your organization? Should they be managed locally or centrally? The book outlines both incremental and "big bang" approaches to fixing the foundation and notes that incremental change is slower but surer. The discussion of how legacy application modernization might be business value based or risk based (human resources or technology risk for instance) or both (such as a need to change to support a new business strategy) was well done. I also really liked their idea of a renewal and reinvestment budget to keep legacy modernization ongoing and they had some great stories about human resources risk coming from retirements and the need to get knowledge out of people's heads and into systems.

The section on a risk governance process was thorough, although I think you need to be careful not to implement all of it blindly, and I liked the focus on broad risk awareness - not "risk-averse" or "risk-pro" just "risk-aware". To support this idea, IT needs to build systems in a risk-aware way - they need to drive their use of technologies and languages, consider the consequences of a failure to update documentation or code and so on. It occurred to me while reading these sections that organizations considering a policy manual for this stuff should also consider the value of rules and decision management as a basis for a "policy engine". They had a particularly nice example of a mid-sized company finding its legacy applications, and the lack of agility in them, to be a key risk and investing in replacing and upgrading systems to make maintenance and evolution easier and less risky. This kind of agility improvement is something enhanced by a parallel focus on decision management.

The book was a fairly quick read, had lots of useful suggestions and some good ways to think about the problem. If you think IT risk matters, you should read this.

用户评价

这本书的语言风格非常独特，它没有那种教条式的说教，也没有那种枯燥的理论堆砌。作者仿佛是在和我进行一场深入的对话，他用一种非常个人化、体验式的叙述方式，将复杂的IT风险管理概念娓娓道来。我感觉自己不是在阅读一本技术书籍，而是在听一位智者分享他的经验和感悟。他用大量的比喻和故事来解释抽象的概念，比如将IT风险比作航行中的暗礁，将风险管理比作航海图和罗盘，这些生动的比喻让我在轻松的阅读过程中，就能够深刻地理解IT风险的本质和应对策略。书中关于风险容忍度的讨论让我受益匪浅，我一直很困惑如何在风险和效益之间找到一个平衡点，这本书为我提供了一个清晰的思考框架。它告诉我，并非所有的风险都需要消除，而是要识别出那些可能对企业造成重大影响的风险，并根据企业的风险容忍度来制定相应的应对措施。这种“有所为，有所不为”的智慧，让我对IT风险管理有了全新的认识。

我对于《IT Risk》这本书的评价可以说是非常高的。它不仅仅是一本关于IT风险管理的专业书籍，更是一本能够启发读者思考、提升认知、指导实践的著作。作者以其深厚的学识和丰富的实践经验，为我们构建了一个系统、全面、实用的IT风险管理框架。我从中获得的不仅仅是知识，更重要的是一种解决问题的方法论和一种看待IT风险的全新视角。这本书的价值在于它能够帮助读者将抽象的IT风险管理概念转化为切实可行的行动，并最终为企业带来真正的价值。我强烈推荐所有从事IT工作、对IT风险管理感兴趣的读者，都来阅读这本书，相信你们一定会有所收获。

这本书给我最大的启示是，IT风险管理不应被视为一种负担，而是一种创造价值的工具。作者在书中巧妙地将IT风险管理与企业的业务目标和战略发展相结合，强调了通过有效的风险管理，企业可以提升运营效率、增强客户信任、抓住市场机遇，并最终实现可持续发展。他提出的“风险投资回报率”（ROI）的概念，让我重新思考了IT风险管理在企业中的定位。以前我总觉得IT风险管理是为了“花钱”以避免损失，现在我明白了，它更是为了“投资”以获得更好的业务成果。这种思维的转变，让我能够更有底气地向管理层争取必要的资源，以建立更 robust 的IT风险管理体系。

这本书的书写风格非常严谨，但又充满了智慧和人文关怀。作者在探讨技术性极强的IT风险管理时，并没有回避人性的因素。他详细分析了人为失误、内部威胁以及组织文化对IT风险的影响，并提出了相应的应对策略。我特别喜欢他关于“安全文化”的论述，他强调了建立一种积极的安全文化对于降低IT风险至关重要。书中提供了一些培养安全文化的具体方法，例如加强员工的安全意识培训、建立激励机制以及鼓励报告安全事件等。这些内容让我意识到，技术工具固然重要，但人的因素才是IT风险管理中最关键的环节。在我过去的工作中，我总是过于关注技术层面，而忽略了人的作用。这本书为我打开了一个新的视角，让我明白IT风险管理需要技术、流程和人的协同作用。

这本书的封面设计非常吸引人，深邃的蓝色背景搭配着抽象的金色线条，仿佛勾勒出了一幅错综复杂的网络世界。拿到手里，沉甸甸的纸张质感让我对内容充满了期待。作为一名刚入行不久的IT安全助理，我经常在工作中感到力不从心，面对层出不穷的安全威胁和复杂的合规要求，我迫切需要一本能够系统性地梳理这些概念的书籍。从朋友那里听说了《IT Risk》，据说它能帮助读者建立起一套完整的IT风险管理框架。我希望这本书能为我提供清晰的思路和实用的工具，让我能够更好地理解和应对工作中的挑战。我特别想知道书中是如何讲解风险识别、评估、缓解和监控的，以及如何将这些流程与业务目标相结合，确保IT投资能够真正为企业带来价值，而不是仅仅成为一项成本。我希望作者能够用通俗易懂的语言，避免过于晦涩的技术术语，这样我才能更容易地消化和吸收其中的知识。如果书中能包含一些实际案例分析，那就更好了，这样我就可以对照着学习，将理论知识应用到实际工作中。我对手册式的IT风险管理指南并不感兴趣，我更期待的是一本能够启发思考、培养全局观的书籍，帮助我从战略层面理解IT风险的重要性。

作为一名在金融行业工作的IT风险分析师，我每天都在与复杂的金融系统和严格的监管要求打交道。《IT Risk》这本书为我提供了一个非常宝贵的参考框架。作者在书中对金融行业的IT风险有非常深入的洞察，他详细分析了金融机构面临的特有风险，例如交易风险、信用风险、流动性风险以及合规风险等，并提出了针对性的管理方法。我尤其对书中关于“第三方风险管理”的章节印象深刻，随着金融业务日益依赖第三方服务提供商，如何有效地管理和监控这些风险成为了一个巨大的挑战。这本书为我提供了一些非常实用的策略和工具，帮助我更好地评估和管理第三方供应商的IT风险。这对我来说非常及时，我目前正好在负责评估我们公司几家核心供应商的IT安全状况。

坦白说，我最初被这本书的标题吸引，是因为我在工作中经常被各种“风险”报告弄得头晕脑胀，却又不知道如何着手处理。我期待的是一本能够帮我理清头绪，并且能够提供一些实操性强的建议的书。让我惊喜的是，《IT Risk》不仅仅是关于如何“规避”风险，它更多的是在探讨如何“管理”风险，以及如何将风险管理转化为一种业务优势。作者强调了“风险驱动”的IT策略，他认为，通过主动识别和管理IT风险，企业可以更有效地利用技术，抓住机遇，而不是仅仅被动地应对威胁。书中关于风险度量和报告的章节让我眼前一亮，它提供了一些非常实用的指标和方法，能够帮助我量化IT风险，并将这些数据转化为可供管理层决策的有效信息。我之前总是觉得IT风险很难量化，现在我有了更清晰的思路，知道如何去衡量和追踪。

读完这本书，我最大的感受是，它并非一本简单罗列IT风险和应对措施的技术手册，而更像是一位经验丰富的导师，循循善诱地引导我进入IT风险管理的深邃殿堂。作者的写作风格非常沉稳且具有洞察力，他没有急于给出解决方案，而是先为我们构建了一个理解IT风险的宏观视角。他详细阐述了IT风险与业务风险之间的内在联系，强调了IT风险管理并非孤立的技术问题，而是企业整体战略的重要组成部分。我尤其欣赏的是他对风险的定义和分类，他将风险的来源、影响和发生的可能性进行了细致的剖析，让我明白了为什么我们不能简单地将所有IT问题都视为“风险”。书中对风险评估方法的介绍也非常全面，从定性分析到定量分析，再到各种常用的评估模型，都讲解得非常透彻，让我能够根据不同的情况选择最合适的评估方式。我感觉自己对风险的认知有了质的飞跃，不再是停留在表面，而是能够深入到风险的根源，理解其背后的逻辑。这本书的价值在于它能够培养读者一种“风险思维”，让我能够更主动、更全面地思考IT工作中可能出现的各种问题。

在阅读《IT Risk》的过程中，我深刻体会到作者对IT风险管理领域的深入研究和实践经验。他不仅仅是理论的阐述者，更是一位经验丰富的实践者。书中大量引用的行业最佳实践和标准，如ISO 27001、COBIT等，都经过了他的提炼和解读，使其更易于理解和应用。他能够将这些复杂的标准转化为清晰的指导原则，帮助读者建立起一套符合自身情况的IT风险管理体系。我特别欣赏他对于“风险情景分析”的讲解，通过模拟各种可能的风险发生场景，并分析其潜在影响，可以帮助我们更好地预测和应对未知的风险。这种前瞻性的思考方式，让我能够更主动地为潜在的风险做好准备，而不是被动地应对已经发生的问题。

我是在一次行业交流会上偶然听说了《IT Risk》，当时我负责一个新项目的IT安全规划，对如何有效地识别和管理项目中的IT风险感到十分迷茫。这本书的到来，就像是为我指明了方向。它没有提供一刀切的解决方案，而是引导我思考如何根据项目的具体情况和业务目标来制定个性化的风险管理计划。书中关于风险沟通的章节给我留下了深刻的印象，作者强调了IT风险管理需要所有部门的参与和协作，而不仅仅是IT部门的责任。他详细阐述了如何与业务部门、管理层以及外部利益相关者进行有效的沟通，确保他们能够理解IT风险的潜在影响，并共同承担风险管理的责任。这一点我以前确实忽视了，总觉得IT安全是IT部门自己的事情。通过这本书，我明白了IT风险管理是一个系统工程，需要整个组织的共同努力才能取得成效。我现在正在尝试将书中提到的沟通策略应用到我的工作中，效果出乎意料的好。

就冲着花了158，也得好好翻翻

就冲着花了158，也得好好翻翻

就冲着花了158，也得好好翻翻

就冲着花了158，也得好好翻翻

就冲着花了158，也得好好翻翻