How a 'security by design' mindset can help your business manage cyber risk
Managing cybersecurity risk is a top priority for any organization these days. According to a PwC survey1 of business leaders, the threat of more frequent and broader cyberattacks was identified as the top corporate risk, followed by talent acquisition and retention, then rising production costs.
In this environment, it’s critical that your organization has visibility into its cybersecurity risks and actively makes sustainable, risk-based business decisions that are measurable and quantifiable. To accomplish this, it’s important to incorporate security risk into all business decisions, rather than viewing it solely as a technology issue. With 90% of boards of directors agreeing that cybersecurity is a business risk, not just a technology risk, it’s clear that this message resonates with many organizations.2
Security by design
This is where “security by design” can help.3 Security by design is an architectural design approach and industry best practice that provides testable security patterns. The approach uses common building blocks that allow security components to become repeatable, reusable and controlled across an entire organization.
For example, NIST SP 800-1604 is a security by design framework that contains a number of documented steps an organization can follow when building its security processes.
“As a nation, we have allowed a system where the cybersecurity burden is placed disproportionately on the shoulders of consumers and small organizations and away from the producers of the technology and those developing the products that increasingly run our digital lives,” says the U.S. Cybersecurity & Infrastructure Security Agency (CISA). “Americans need a new model to address the gaps in cybersecurity — a model where consumers can trust the safety and integrity of the technology that they use every day.”
The benefits of a security by design approach
Incorporating key security by design practices into the organizational cybersecurity risk management program creates a holistic, 360-degree view of cybersecurity risks, which can be prioritized alongside other organizational risks. This helps raise the visibility of cybersecurity risk to the enterprise level.
Fundamentally, this approach also allows for proactive planning for and management of security risks rather than having to react and adjust for security issues.
“During the design phase of a product’s development lifecycle, companies should implement Secure by Design principles to significantly decrease the number of exploitable flaws before introducing them to the market for widespread use or consumption,” says the CISA. “[Directly] out-of-the-box, products should be secure with additional security features such as multi-factor authentication (MFA), logging, and single sign-on (SSO) available at no extra cost.”
Automation and control are critical
A key component of security by design is removing manual or human steps in a procedure wherever possible and replacing them with tasks that are automated and repeatable.
Automating key business and technical processes helps reduce the likelihood of risks, protects operational data, and provides the ability to monitor proactively rather than reactively. Once processes are automated, continual oversight and monitoring become second nature.
Creating a more secure environment
Building security into the enterprise environment and managing it as a business capability through an organizational strategic plan leads to an enhanced security environment and improved risk posture.
This proactive, coordinated approach helps organizations focus on their true business risks. It also provides the ability to proactively manage risk rather than having to react to something negative that has already happened because of a system, process or human failure. Understanding your organizational risks and incorporating security by design will allow your business leaders to better manage security risk across the enterprise.
To learn more about the CISA’s “secure by design” movement and find additional resources, click here.
To learn how Old National Bank protects you as a partner and client, click here.
1 https://www.pwc.com/us/en/library/pulse-survey/managing-business-risks.html
2 https://www.gartner.com/en/newsroom/press-releases/2025-11-24-gartner-survey-finds-90-percent-of-non-executive-directors-lack-a-measure-of-confidence-in-cybersecurity-value
3 https://www.techtarget.com/searchsecurity/tip/Top-security-by-design-frameworks
4 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-160v2r1.pdf
