Understanding Cyber Vulnerability, Threats & Risks

There is often confusion among organisations and third-party partners regarding their cyber risks and the likelihood and impact of a security incident.

Adding to the uncertainty around vulnerabilities is that many leaders aren’t clear on how to benchmark effectively to understand their risks, enhance their security efforts and measure progress.

This is reflected in recent ISACA research, which found that less than half of security leaders are confident in their organisation’s ability to combat anything beyond simple cyber incidents.

Boards of directors and executives often lack confidence in how their organisations’ cyber-security posture actually protects their abilities to achieve their stated organisational goals and deliver business value.

Benchmarking can be an excellent tool for informing and bringing focus to boards of directors and executive management.

Assessing Vulnerabilities

Before benchmarking, organisations should first understand the vulnerabilities and threats against the digital ecosystem that can result in the types of cyber vulnerabilities that have grown since the onslaught of disruptive technologies.

Many executives and technologists are still confused when defining the terms vulnerability, threat and risk, which are often used interchangeably without specificity and attribution.

An established risk management equation to keep in mind is Vulnerability + Threat = Risk, followed by understanding the severity of Impact and Likelihood. A vulnerability is a weakness. A risk does not exist without introduction to a threat. The combination of threat with a vulnerability is a risk.

The vulnerabilities that businesses can experience are vast, and can include:

  • Incomplete governance/management
  • Shortage of cyber or physical security personnel
  • Insufficiently trained staff and partner companies
  • Cyber or digital risk management vulnerabilities, such as incomplete risk assessments; static policies, standards, or procedures; or incomplete Governance Risk and Compliance Program
  • Operational processes incomplete, incorrect or lacking maturity
  • Technology vulnerabilities, such as software or hardware vulnerabilities, internet disruption such as a geopolitical attack on the grid, autonomous cars susceptible to outside hacking, ransomware attack encrypting mission-critical data for a highly dependent organisation such as a government, hospital or financial institution; artificial Intelligence with flaws or back doors; and incomplete audit review processes

Vulnerability awareness and management require forward-thinking strategic plans from governance and management to assure strong value from information technologies.

As the global digital revolution demands advancements for enterprises to remain competitive, risk management decisions will demand the adaption of new tools to provide greater insight into the complexity of cyber or digital risk.

These decisions require a healthy understanding of both vulnerabilities and threats in the business environment and where new capabilities may be needed in response to regulatory changes.

A recent example is the European Union’s Global Data Protection Regulation (GDPR) that creates new boundaries and penalties of fines up to four percent of the company’s global revenue.

Benchmarking Best Practices

Benchmarking cybersecurity vulnerabilities brings clarity to all those responsible for digitally enabling the enterprise while appropriately governing and managing both technical and business risk.

An appropriate maturity model that identifies the cyber capabilities needed for benchmarking within the enterprise helps identify where to appropriately apply resources based on the organisation’s risk tolerance and horizon.

As ISACA CEO Matt Loeb noted, “a more comprehensive, evidenced-based approach is urgently needed.”

The risk-based, cyber-security capability and maturity model has emerged as the desired approach in providing a clear line of sight for the board of directors and management to best understand priorities around resource allocation and long-term digital business strategies, as well as to provide the overall current state of the cyber-security program from which to benchmark an organisation’s current state and the future.

One example is the CMMI Cybermaturity Platform by the CMMI Institute. Developed after hundreds of conversations with board directors, C-Suite executive and other industry leaders, the platform provides a means to assess cybermaturity, understand the likelihood of specific risks and receive insights into cybersecurity gaps and actions needed to improve.

IT leaders should continuously benchmark their organisation’s capabilities against newly evolving threat vectors and against ever-changing regulations specific to the organisation.

Working with a partner network can also be helpful, such as when enhancing security posture in the organisation’s supply chain, for example. Organisations can proactively benchmark their people, processes and technology capabilities against updated cybersecurity frameworks, such as the recently published NIST v1.1.

Teams can also consider creating a security Kaizen team dedicated to continuous improvement and benchmarking across all organisational agencies. Another best practice is to efficiently communicate with the C-Suite to appropriately communicate risks and drive budgets to areas with highest risk.

Business Impact

Through mindful assessment of vulnerabilities and benchmarking, businesses can realise true cyber-security posture and demonstrate improvement, resulting in overall business cost benefits, including potentially lower bond ratings, such as Moody Bond Ratings disclosures.

Dedicating staff resources and funds to this effort and using the right tools will ensure that organisations understand their cyber vulnerabilities, benchmark effectively, and put in place effective measures to enhance risk management capabilities and strengthen cyber-security.

Information-Management

You Might Also Read: 

How to Measure Cybersecurity Success:

88% Feel Vulnerable To Data Threats:

Cultural Strategies For Data Security (£):

« GDPR Survey Shows 80% Non-Compliance
Social Media Giants Under Caution In Vietnam »

ManageEngine
CyberSecurity Jobsite
Check Point

Directory of Suppliers

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Quotium

Quotium

Quotium provides automated testing technologies to make business software applications secure and robust.

National Cybersecurity Agency (ANCS) - Tunisia

National Cybersecurity Agency (ANCS) - Tunisia

ANCS (L'Agence Nationale de la Cybersécurité) is the national cybersecurity agency for Tunisia.

IBackup

IBackup

IBackup is a Web Based Online Backup service provider.

Feedzai

Feedzai

Feedzai provide software that uses big data analysis and machine-based learning to prevent fraud in ecommerce.

SERMA Safety & Security (S3)

SERMA Safety & Security (S3)

SERMA Safety & Security provides a comprehensive cybersecurity offering incorporating Expertise, Evaluation, Consultancy and Training, covering hardware, software and information systems.

ThreatSpike Labs

ThreatSpike Labs

ThreatSpike Labs provides the first end-to-end fully managed security service for companies of all sizes.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Digital Arts

Digital Arts

Digital Arts provides internet security software and appliance products for companies and individuals.

Global Lifecycle Solutions EMEA (Global EMEA)

Global Lifecycle Solutions EMEA (Global EMEA)

Global EMEA provides full lifecycle services to corporate Clients covering procurement, configuration, support, maintenance and end-of-life asset management.

SecureThings

SecureThings

SecureThings focus is to provide guidance and technology to secure connected vehicles in order to build end-to-end security for the automotive industry.

Keysight Technologies

Keysight Technologies

Keysight is dedicated to providing tomorrow’s test technologies today, enabling our customers to connect and secure the world with their innovations.

Query.ai

Query.ai

At Query.AI, we are committed to helping companies unlock the power of their security data, so they are empowered to meet security investigation and response goals while simultaneously reducing costs.

Valence Security

Valence Security

Valence manages and secures your Business Application Mesh by delivering visibility, reducing unauthorized access and preventing data loss.

SECUINFRA

SECUINFRA

SECUINFRA has been supporting companies in detecting, analyzing and defending against cyber attacks since 2010.

AgilePQ

AgilePQ

AgilePQ visibly secures IoT devices worldwide to protect the privacy, safety, and well-being of all people.

CYTUR

CYTUR

CYTUR provide trusted and secured maritime cybersecurity solutions to keep ships safe, protecting them, their crews, cargo and all stakeholders from maritime cyber threats.