Understanding Cyber Vulnerability, Threats & Risks
There is often confusion among organisations and third-party partners regarding their cyber risks and the likelihood and impact of a security incident.
Adding to the uncertainty around vulnerabilities is that many leaders aren’t clear on how to benchmark effectively to understand their risks, enhance their security efforts and measure progress.
This is reflected in recent ISACA research, which found that less than half of security leaders are confident in their organisation’s ability to combat anything beyond simple cyber incidents.
Boards of directors and executives often lack confidence in how their organisations’ cyber-security posture actually protects their abilities to achieve their stated organisational goals and deliver business value.
Benchmarking can be an excellent tool for informing and bringing focus to boards of directors and executive management.
Assessing Vulnerabilities
Before benchmarking, organisations should first understand the vulnerabilities and threats against the digital ecosystem that can result in the types of cyber vulnerabilities that have grown since the onslaught of disruptive technologies.
Many executives and technologists are still confused when defining the terms vulnerability, threat and risk, which are often used interchangeably without specificity and attribution.
An established risk management equation to keep in mind is Vulnerability + Threat = Risk, followed by understanding the severity of Impact and Likelihood. A vulnerability is a weakness. A risk does not exist without introduction to a threat. The combination of threat with a vulnerability is a risk.
The vulnerabilities that businesses can experience are vast, and can include:
- Incomplete governance/management
- Shortage of cyber or physical security personnel
- Insufficiently trained staff and partner companies
- Cyber or digital risk management vulnerabilities, such as incomplete risk assessments; static policies, standards, or procedures; or incomplete Governance Risk and Compliance Program
- Operational processes incomplete, incorrect or lacking maturity
- Technology vulnerabilities, such as software or hardware vulnerabilities, internet disruption such as a geopolitical attack on the grid, autonomous cars susceptible to outside hacking, ransomware attack encrypting mission-critical data for a highly dependent organisation such as a government, hospital or financial institution; artificial Intelligence with flaws or back doors; and incomplete audit review processes
Vulnerability awareness and management require forward-thinking strategic plans from governance and management to assure strong value from information technologies.
As the global digital revolution demands advancements for enterprises to remain competitive, risk management decisions will demand the adaption of new tools to provide greater insight into the complexity of cyber or digital risk.
These decisions require a healthy understanding of both vulnerabilities and threats in the business environment and where new capabilities may be needed in response to regulatory changes.
A recent example is the European Union’s Global Data Protection Regulation (GDPR) that creates new boundaries and penalties of fines up to four percent of the company’s global revenue.
Benchmarking Best Practices
Benchmarking cybersecurity vulnerabilities brings clarity to all those responsible for digitally enabling the enterprise while appropriately governing and managing both technical and business risk.
An appropriate maturity model that identifies the cyber capabilities needed for benchmarking within the enterprise helps identify where to appropriately apply resources based on the organisation’s risk tolerance and horizon.
As ISACA CEO Matt Loeb noted, “a more comprehensive, evidenced-based approach is urgently needed.”
The risk-based, cyber-security capability and maturity model has emerged as the desired approach in providing a clear line of sight for the board of directors and management to best understand priorities around resource allocation and long-term digital business strategies, as well as to provide the overall current state of the cyber-security program from which to benchmark an organisation’s current state and the future.
One example is the CMMI Cybermaturity Platform by the CMMI Institute. Developed after hundreds of conversations with board directors, C-Suite executive and other industry leaders, the platform provides a means to assess cybermaturity, understand the likelihood of specific risks and receive insights into cybersecurity gaps and actions needed to improve.
IT leaders should continuously benchmark their organisation’s capabilities against newly evolving threat vectors and against ever-changing regulations specific to the organisation.
Working with a partner network can also be helpful, such as when enhancing security posture in the organisation’s supply chain, for example. Organisations can proactively benchmark their people, processes and technology capabilities against updated cybersecurity frameworks, such as the recently published NIST v1.1.
Teams can also consider creating a security Kaizen team dedicated to continuous improvement and benchmarking across all organisational agencies. Another best practice is to efficiently communicate with the C-Suite to appropriately communicate risks and drive budgets to areas with highest risk.
Business Impact
Through mindful assessment of vulnerabilities and benchmarking, businesses can realise true cyber-security posture and demonstrate improvement, resulting in overall business cost benefits, including potentially lower bond ratings, such as Moody Bond Ratings disclosures.
Dedicating staff resources and funds to this effort and using the right tools will ensure that organisations understand their cyber vulnerabilities, benchmark effectively, and put in place effective measures to enhance risk management capabilities and strengthen cyber-security.
You Might Also Read:
How to Measure Cybersecurity Success:
