Understanding Cyber Vulnerability, Threats & Risks

There is often confusion among organisations and third-party partners regarding their cyber risks and the likelihood and impact of a security incident.

Adding to the uncertainty around vulnerabilities is that many leaders aren’t clear on how to benchmark effectively to understand their risks, enhance their security efforts and measure progress.

This is reflected in recent ISACA research, which found that less than half of security leaders are confident in their organisation’s ability to combat anything beyond simple cyber incidents.

Boards of directors and executives often lack confidence in how their organisations’ cyber-security posture actually protects their abilities to achieve their stated organisational goals and deliver business value.

Benchmarking can be an excellent tool for informing and bringing focus to boards of directors and executive management.

Assessing Vulnerabilities

Before benchmarking, organisations should first understand the vulnerabilities and threats against the digital ecosystem that can result in the types of cyber vulnerabilities that have grown since the onslaught of disruptive technologies.

Many executives and technologists are still confused when defining the terms vulnerability, threat and risk, which are often used interchangeably without specificity and attribution.

An established risk management equation to keep in mind is Vulnerability + Threat = Risk, followed by understanding the severity of Impact and Likelihood. A vulnerability is a weakness. A risk does not exist without introduction to a threat. The combination of threat with a vulnerability is a risk.

The vulnerabilities that businesses can experience are vast, and can include:

  • Incomplete governance/management
  • Shortage of cyber or physical security personnel
  • Insufficiently trained staff and partner companies
  • Cyber or digital risk management vulnerabilities, such as incomplete risk assessments; static policies, standards, or procedures; or incomplete Governance Risk and Compliance Program
  • Operational processes incomplete, incorrect or lacking maturity
  • Technology vulnerabilities, such as software or hardware vulnerabilities, internet disruption such as a geopolitical attack on the grid, autonomous cars susceptible to outside hacking, ransomware attack encrypting mission-critical data for a highly dependent organisation such as a government, hospital or financial institution; artificial Intelligence with flaws or back doors; and incomplete audit review processes

Vulnerability awareness and management require forward-thinking strategic plans from governance and management to assure strong value from information technologies.

As the global digital revolution demands advancements for enterprises to remain competitive, risk management decisions will demand the adaption of new tools to provide greater insight into the complexity of cyber or digital risk.

These decisions require a healthy understanding of both vulnerabilities and threats in the business environment and where new capabilities may be needed in response to regulatory changes.

A recent example is the European Union’s Global Data Protection Regulation (GDPR) that creates new boundaries and penalties of fines up to four percent of the company’s global revenue.

Benchmarking Best Practices

Benchmarking cybersecurity vulnerabilities brings clarity to all those responsible for digitally enabling the enterprise while appropriately governing and managing both technical and business risk.

An appropriate maturity model that identifies the cyber capabilities needed for benchmarking within the enterprise helps identify where to appropriately apply resources based on the organisation’s risk tolerance and horizon.

As ISACA CEO Matt Loeb noted, “a more comprehensive, evidenced-based approach is urgently needed.”

The risk-based, cyber-security capability and maturity model has emerged as the desired approach in providing a clear line of sight for the board of directors and management to best understand priorities around resource allocation and long-term digital business strategies, as well as to provide the overall current state of the cyber-security program from which to benchmark an organisation’s current state and the future.

One example is the CMMI Cybermaturity Platform by the CMMI Institute. Developed after hundreds of conversations with board directors, C-Suite executive and other industry leaders, the platform provides a means to assess cybermaturity, understand the likelihood of specific risks and receive insights into cybersecurity gaps and actions needed to improve.

IT leaders should continuously benchmark their organisation’s capabilities against newly evolving threat vectors and against ever-changing regulations specific to the organisation.

Working with a partner network can also be helpful, such as when enhancing security posture in the organisation’s supply chain, for example. Organisations can proactively benchmark their people, processes and technology capabilities against updated cybersecurity frameworks, such as the recently published NIST v1.1.

Teams can also consider creating a security Kaizen team dedicated to continuous improvement and benchmarking across all organisational agencies. Another best practice is to efficiently communicate with the C-Suite to appropriately communicate risks and drive budgets to areas with highest risk.

Business Impact

Through mindful assessment of vulnerabilities and benchmarking, businesses can realise true cyber-security posture and demonstrate improvement, resulting in overall business cost benefits, including potentially lower bond ratings, such as Moody Bond Ratings disclosures.

Dedicating staff resources and funds to this effort and using the right tools will ensure that organisations understand their cyber vulnerabilities, benchmark effectively, and put in place effective measures to enhance risk management capabilities and strengthen cyber-security.

Information-Management

You Might Also Read: 

How to Measure Cybersecurity Success:

88% Feel Vulnerable To Data Threats:

Cultural Strategies For Data Security (£):

« GDPR Survey Shows 80% Non-Compliance
Social Media Giants Under Caution In Vietnam »

ManageEngine
CyberSecurity Jobsite
Check Point

Directory of Suppliers

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Evok

Evok

EVOK is an IT Service provider specialized in installing, maintaining and supporting IT infrastructures for SMB's in Switzerland.

Certus Software

Certus Software

Our Secure Data Erasure solutions protect customer data confidentiality by completely erasing it from data storage devices.

CRU Data Security Group (CDSG)

CRU Data Security Group (CDSG)

CRU is a pioneer in devices for data mobility, data security, encryption, and digital investigation.

Rwanda Information Society Authority (RISA)

Rwanda Information Society Authority (RISA)

RISA is at the forefront of all ICT project implementation, research, infrastructure and innovation within the ICT sector in Rwanda.

Eperi

Eperi

Eperi is a leading provider of Cloud Data Protection (CDP) solutions with 15 years of experience in data encryption for databases, (SaaS) applications and files.

Omnipotech

Omnipotech

Omnipotech is a complete managed service provider. From desktop to datacenter, all the technology support you need, under one umbrella.

r00tz Asylum

r00tz Asylum

r00tz Asylum is a nonprofit dedicated to teaching kids around the world how to love being white-hat hackers.

ISSQUARED

ISSQUARED

ISSQUARED is a leading provider of Cyber Security, Cloud, Infrastructure, Consulting and Digital Transformation services.

Ceeyu

Ceeyu

Ceeyu is an all-in-one cybersecurity ratings and third party risk management platform.

SecurityLoophole

SecurityLoophole

SecurityLoophole is an independent cyber security news platform with global coverage. Latest updates, reports, news and events related to cyber security.

Aardwolf Security

Aardwolf Security

Aardwolf Security specialise in penetration testing to the highest standards set out by OWASP. We ensure complete client satisfaction and aftercare.

BuddoBot

BuddoBot

BuddoBot has been a pioneering force in cybersecurity and information technology since 2008.

Baidam Solutions

Baidam Solutions

Baidam Solutions is a 100% Australian owned and operated First Nations information technology business.

Index Engines

Index Engines

Index Engines is the world’s leading AI-powered analytics engine to detect data corruption due to ransomware.

Dispel

Dispel

Dispel makes the fastest secure remote access for industrial networks. Built by operators for operators: a zero trust engine for your entire OT, IoT, and xIoT stack.

Dream

Dream

Dream is developing an AI platform that enables cyber resilience and protects nations from hostile nation-states cyber attacks.