Perspective | Facing cyber risks, where should organisations go from here?

Cyber risk is often a major blind spot for organizations. Today, boards and senior leaders are increasingly focusing on how cyber risk is managed within their organizations, and the impact of proactive and reactive measures around cyber risk on the organization's risk profile is receiving more attention than ever.

Cybersecurity teams carry the heavy burden of supporting daily operations while standing ready to respond to potential adversaries. Among running projects and operational responsibilities, it is hard to balance urgency with responsiveness. Teams often focus only on projects that improve their maturity scores, but may not necessarily be able to tell where the security system's true weaknesses lie. High maturity scores in policy or governance might look good on board reports, but for those working to steer the organization's broad direction, these pretty scores may have lost their original meaning.

First, it is important to understand that cyber risk is no different from other business risks. It is a collection of threats and vulnerabilities that exist across an organization, any of which, if exploited, can lead to financial loss, reputational damage and regulatory issues.

The terms "risk" and "threat" are not the same and should not be used interchangeably. When specifically looking at threats and vulnerabilities, the focus should be more on what technologies or processes the organization has created or used that are potentially vulnerable and create "opportunities" for abuse. We can then overlay threats as potential vectors or methods to illustrate how these vulnerabilities or opportunities could be exploited.

In terms of communicating impact, we recommend being as concise as possible when seeking board buy-in and alignment on how cyber risk is managed, focusing on reporting significant impacts upward. A common issue within organizations is often getting bogged down in how cyber risk is reduced, what controls are relied upon, how the effectiveness of these controls is actually validated, and how to maximize the return on investment in security.

What constitutes the core of the business? This often happens when there is no clear consensus on this within the organization. Without alignment across all teams, we see growing questions around security investments, while critical questions about organizational risk go unanswered. Ultimately, security teams need to consider and fully understand ROI, especially those who cannot defend their investment decisions in front of more business-focused executives.

How to Map Your Organization's Cyber Risk?

Cyber risk is a broad and deep topic, and there is no single process, technology, or solution that can mitigate it. Maturity-based programs are key to the overall direction of a security program, but they should not be its sole driver. Instead, a well-designed program is an orchestration of capabilities that defines and aligns the organization's direction and tolerance, linking it to an evolving threat landscape. Here are some key points to keep in mind when developing your roadmap:

• Understand what matters most: Take the time to understand the critical business assets most likely to adversely affect the organization and prevent business continuity if compromised.

• Define and align cyber risk tolerance across the organization: Develop a top-down view of the organization's cyber risk, articulate executive reporting requirements, and establish and position organizational risk tolerance.

• Identify and model security architecture risks of critical systems: Deconstruct mission-critical systems into their components and connections, identify threats and vulnerabilities, assign risk to each threat, and align with the organization's tolerance for impact.

• Identify cyber risks, key partners and investment portfolios: Identify highly dependent partners and organizations and perform due diligence to assess integration and supply chain risks that, while exposing the organization, also push the risk profile to unacceptable levels of risk.

• Identify operational vulnerabilities and align with organizational risk tolerance: Link vulnerabilities and exploitability to potential harm to mission-critical systems and validate against defined cyber risk tolerances.

• Validate that your security capabilities are moving in the right direction: Benchmark existing security project plans against best practices and validate deviations from standard practices in your industry and region of operation.

Maturity in responding to cyber risks does not happen overnight; rather, it is a continuous process that builds upon itself. To successfully manage cyber risk, organizations need to rethink and better identify threats to the core of the organization, integrating this information from the network to inform the organization's operational risk profile. The goal of proper cyber risk management is to help uncover the threats and vulnerabilities that the organization should focus on most, which can cause significant impact and true risk.