BUSINESS INSIGHTS
Quantifying threat data to achieve the best ROI
Quantifiable threat data is also essential in helping your committee make the right decisions in shaping security policy . Alongside determining which assets could cause the greatest harm if they are compromised in a breach , you need to consider how threat actors will try to reach them .
Attackers look for low-cost ways of realising high value pay outs . They will always take the easy road to reach their goal . Elite , nation-state-backed threat groups with bottomless resources and elaborate plans are very much the exception . Unless you ' re in one of the highest-risk sectors , you should be focusing on more commonplace threats from opportunistic criminals .
Next , assess how likely it is that any existing vulnerabilities will be exploited and how severe the impact will be in that scenario . The best approach is establishing a Cyberrisk Score ( CRS ) that quantifies each potential threat . NIST has an established framework and multiple solutions are available to assist with measurements .
For example , a software vulnerability might potentially lead to a serious incident but requires a very high skill level to discover and exploit . Or an easily exploited issue might pose a minimal risk in isolation .
This exercise will enable you to develop a risk exposure score for each scenario , which in turn will enable the impact of additional security measures to be more accurately tracked . For example , you may choose to implement more network segmentation or multi-factor authentication across core systems to strengthen your defences .
Crucially , it also becomes easier to determine which security investments will deliver the greatest ROI . Solutions that can address multiple issues will provide a bigger bang for their buck , especially if they have a proven track record of delivering results .
An example is Zero Trust Segmentation which can both improve the visibility of threats within the network and help to contain and limit the impact if a breach occurs . The technology has also been found to stop ransomware four times faster than detection and response alone .
With the rising cost of security incidents , cyber-resilience must be a top business priority in the year ahead . Cybersecurity oversight committees have an important role in ensuring your strategies and solutions are making a real difference to your security standing . Arming the committee with accurate and relevant data will help it to identify gaps and vulnerabilities you must address to boost your resilience . x
68 www . intelligentcxo . com