Defining the Current Corporate IT Risk Landscape

• Author: Verine Etsebeth
• Position: Senior Lecturer, University of Witwatersrand School of Law. School of Law
• Pages: 62-73

JICLT

Journal of International Commercial Law and Technology

Vol. 6, Issue 2 (2011)

62

Defining the Current Corporate IT Risk Landscape

Verine Etsebeth

Senior Lecturer, University of Witwatersrand School of Law

School of Law, Private Bag 3

Wits 2050, Johannesburg, South Africa

Email: Verine.Etsebeth@wits.ac.za

Phone: +27-11-717-8446

Fax: +27-717-8539

Abstract. Information has a lways been one of the most important assets a company

possesses. Trade secrets, patents and ‘know-how’ are important business assets. In a post-

industrial economy, however, knowledge-based assets have become crucial not onl y for the

survival of any company, but also for its continued existence. Every company decision is based on

reliable and accurate information. Moreover, today companies retain a signi ficant amount of

sensitive, confidential and classified information on their computer systems and net works. It

therefore follows that anything that threatens the information assets of the company will directly

endanger the performance and efficiency of the co mpany. Unfortunately, corporate information

assets are susceptible to various forms/types o f cyber attacks. These attacks ra nge from

unauthorised access, malicious mobile code and inappropriate use to disclosure and information

and/or data theft. The increased use of the Internet by companies highlights these vulnerabilities

and renders the effective protection thereof all the more relevant. It is submitted that ad versaries

no longer launch cyber attacks for fame, but rather for financial gain. Compa nies need to strike a

balance between the pro tection of sensitive a nd confidential corporate information and the

availability of such infor mation to stakeholders. Cor porate information must be available to

stakeholders, and in some instances to the public, not only to encourage investment in the

company, but also to comply with the co mpany’s statutory duty of disclosure and transparency.

The importance of corporate information and the protection of its integrity against ever-increasing

risks and threats necessitate that companies ga in assurance that reasonable steps are taken to

secure the corporate infor mation assets. Failing this, the company and/or its employee(s) may fac e

potential legal liability. This paper will first analyse the most prevalent cyber risks facing

companies today before moving on to identify crucial legal questions that directors and members

of top management must ask themselves in order to determine their potential legal exposure in

instances of security breaches.

1. Introduction

“Security is always excessive until it is not enough” (Sinclair 20 09).

As reiterated throughout this paper, information has always been one of the most important assets a co mpany

possesses. T rade secrets, patents and ‘know-how’ are important business assets. In a pos t-industrial economy,

however, knowledge-based assets have become crucial not only for the survival of any company, but a lso for its

continued existence. Every company decision is ba sed on reliable and accurate information. Moreover, today

companies retain a significant amount of sensitive, confidential and classified information on their computer

systems and networks. It therefore follows that anything that threatens the information assets of the company

will directly endanger the performance and efficiency of the compan y.