For a long time, the domain of specialised technology teams within organisations resulted in siloed IT operations and risk being kept away from the wider business. Cybersecurity a topic gaining attention around Exec and Board tables in today’s digital world. Terms like cyber activism, ransomware, and cyber terrorism haven’t been around all that long but are set to become permanent fixtures when discussing risk at a strategic level.
Taking a step back from the ‘nitty gritty’ of specific technology risks, a good starting point can often be understanding the organisation’s overall cyber risk posture – because let’s be honest, Exec teams are much more at home discussing risk management, as opposed to jumping straight into why you need $1m worth of network upgrades to address a newly discovered cyber threat!
But understanding the true extent of this cyber risk also means measuring it’s potential impact to your organisation. This is something we’ve seen an increasing number of partners and customers explore and we’ve noted a few of the learnings we’ve picked up along the way, which we summarise as:
- Industry standards are important
- Know all your exposure points – and minimise them
- Report through to decision makers “in their language”
Keep reading to find out more about each of these.
1. Industry Standards are
Important
Industry standards can be an excellent way to accurately and consistently identify cyber risk. A
good example of this would be the Factor Analysis of Information Risk Model developed by
the FAIR Institute. This international standard starts by looking at both the Loss Event
Frequency (LEF), alongside the Loss Magnitude (LM) before drilling down into an individual
threat’s primary and secondary loss potential.
Other, well known standards include ISO 27005 and NIST SP-800-30, both of which are
mentioned in Requirement 12.2 of the PCI standard itself and again stressing the importance of
having a consistent approach to Risk Management. Unsurprisingly for an organisation steeped
in the world of PCI Compliance, we see real value in these types of models, which adds
consistency, rigor and creditability to each risk that is analysed, reported and presented.
2. Know Your Exposure Points – and Minimise Them!
For those starting out on their cyber journey, one activity that really helps is an initial ‘stock take’
of current cyber threats, and overall risk position. An security audit or gap analysis can readily
identify key areas of risk (where loss frequency and magnitude are both considerable), as well
as highlight those ‘quick wins’, that don’t require substantial investment although greatly reduce
vulnerability to any sort of data compromise.
They key thing to here is to ensure that you review your entire organisation, from systems and
processes through to policies, training and culture. We’ve developed a helpful guide to
conducting an initial Risk Assessment in one of our previous articles. Key here is to define
your process, understand the actual cost of a risk being exploited and to keep evolving your
mitigation plan over time – and remember, simply saying your mitigation is “PCI Compliance” is
not enough, always ask the ‘why?’ and ‘how?’ a specific control leads to risk reduction.
3. Report to Decision Makers “In Their Language”
So now that you’ve done the analysis work and identified/measured each cyber risk, what next?
Generally, it’s time to deliver this information to interested parties that are in a position to
approve remediation action – particularly when investment is required.
As touched on at the start of this article these forums are not generally an audience attuned to
the ‘in’s and out’s’ of new technology threats which are often heavily steeped in jargon. This
makes it even more important to report this information to decision makers in a way that is both
consumable and action orientated. Focus on concepts like:
- Quantified risk,
- Business impact,
- ROI for security investments, and
- Recommended next steps and timelines.
A great additional resource to support your work pulling this together is the Institute of Directors
recent cyber risk “Practice Guide” which groups cyber risk management into five core principles.
So as we get started with 2022, let’s continue to flip the Cyber conversation from one of
detailed technical controls, to one of managing & measuring cyber risk. We’ve worked with organisations at along every stage of this journey and if it sounds like something for you – get
in touch today!
