Enhancing communication between security and business leaders
Author: Marco Bresciani, Cyber Risk Enthusiast – CBN Board Member
Security leaders experience a continual trade-off between what they want to achieve and the resources that the organisation is willing to give them, be it funding, tools, suppliers, or people. At the same time, their executives need to quantify the financial loss that the organisation will incur if that specific risk happens.
This is not trivial: Gartner at the London 2024 event pointed out the need to “mind the gap” when reporting cybersecurity to management, providing different stakeholders with information they can act upon.
As someone who has worked in the cybersecurity industry since 1996, I have worked with banks and other regulated industries across EMEA, and realised many leaders avoid risk quantification due to misconceptions about data needs and complexity.
In this article I will highlight why cyber risk quantification (CRQ) serves as a vital purpose for security leaders, fostering better discussions with executives. Also, I will explain how organisations can achieve significant improvements in decision-making and risk prioritisation by debunking the myths on data complexity.
It’s not quantify vs qualify
CRQ has been the trusted method for actively communicating cyber exposure in an objective, well-grounded, and defensible manner for several years. It can be delivered in different ways. Most CRQ frameworks are based on the Value-at-Risk approach, developed in the Finance industry to measure the potential loss of investment portfolios.
A popular choice is the Open FAIR framework, an international, non-proprietary standard whose open nature and wealth of supporting documents helped increase its adoption by practitioners and consultants.
It’s important to remark that CRQ is not a replacement for a company’s risk management framework. The identification, analysis, evaluation, and treatment of risks are conducted as usual.
CRQ complements the qualitative output of common frameworks like COBIT or risk controls like ISO27000, by providing the “so what”, a means to compare losses deriving from risk scenarios, and the costs/benefits of mitigating actions.
The lessons learned from early adopters
Many organisations have tested CRQ in the past 5-8 years, often obtaining mixed results that made them question if introducing it in their risk management process was worth the effort. However, executives agree that when done right CRQ can foster confidence in security programs, by enabling informed decisions on cyber risk investments.
The initial stage of CRQ adoption highlighted some practical and some inherent problems:
- Too complex: CRQ may generate an analysis overload that doesn’t address business questions. It takes robust experience to avoid falling into a rabbit hole.
- Too manual: Stakeholders and subject matter experts are necessary to collect data and to interpret the results. Repeating the analysis implies re-engaging again with this cohort.
- Too static: Changes to risk exposure should be measured in near real-time, based upon live data. Integrating CRQ tools with monitoring feeds and asset data can be a big task itself.
Operationalising CRQ, even with a rigorous, well-structured, well-documented framework like FAIR, can be a real challenge.
How could we keep a CRQ initiative on the right path? The experience of early adopters suggest the following:
- Identify the use case that brings more value: for example, prioritising security initiatives and allocating budget, or choosing the correct cyber insurance coverage for your risk acceptance.
- Connect CRQ with business questions: does the extra effort solve a business problem? Else it’s just an intellectual pastime that doesn’t help risk owners in taking the right action.
- Use available data: inform risk scenarios with data from system telemetry and monitoring of third parties risk profiles.
- Automate CRQ where possible: to be a repeatable step that hits the window CRQ needs to be automated with a tool. The CRQ market, like the whole of cybersecurity, is experiencing disruption through automation and AI.
Conclusion
After the initial enthusiasm about a fresh new method and the sobering experience of delivering it, CRQ is maturing into a solid foundation to inform executive decisions about cyber risk.
More in general, CRQ is becoming an element of a broader data-driven approach to cyber risk management, where risk exposure is measured in quasi real-time, from within the organisation, across the third parties, and from the external threats.
Does it look too difficult? Remember that Lloyds made the first aviation insurance in 1911, when the “flying machine” industry was just 8 years old. Not much historical data was available to inform the decision, and possibly not many success stories too… Where there’s a will, there’s a way!