As a CISO or CIO it is important to measure and effectively communicate cyber security risk to the board of directors.
CISOs can use a combination of quantitative and qualitative methods to measure and provide a comprehensive view of the organisation’s cyber security risk landscape.
“CISOs can use quantitative metrics such as the number of security incidents, cost, and the number of vulnerabilities addressed, as well as industry benchmarks such as ISO 27001 or the Cybersecurity Framework (CSF), to measure cyber risk,” said Rebecca Harper, head of cyber security analysis at ISMS.online
“Using these metrics, CISOs can demonstrate the organisation’s performance compared to others in the industry and track critical data such as detected intrusion attempts, incident rates, and vulnerability response times.”
“Qualitatively, CISOs can use threat intelligence and other sources of information to provide a more complete picture of the organisation’s cyber risk landscape. Additionally, scenario-based risk assessments and tabletop exercises can help test the organisation’s incident response and crisis management capabilities.
“When it comes to reporting cyber risk, CISOs and CIOs need to ensure that the board understands three basic concepts,” Harper continues. “First, cyber-attacks are inevitable – every organisation is vulnerable to a cyber-attack, and the consequences can be severe.
“Second, cybersecurity is a priority and should be considered as seriously as the other investments of a business, such as human resources and legal facilities. Finally, investing in cyber security is a long-term commitment, going beyond just having the right technology in place and also considering personnel and protocols.”
CISOs and CIOs facing rising pressures of regulation compliance and cyber threats are increasingly looking to zero trust network access (ZTNA) solutions to both ensure and demonstrate data and cyber security resilience.
Zero trust network access is a security model that assumes that all network traffic, whether it originates inside or outside of an organisation’s network, is untrusted until it can be verified and authenticated. ZTNA provides secure access to resources, minimises the attack surface and reduces the risk of data breaches.
ZTNA verifies the identity of users and devices and validates the security posture of those users and devices before granting access to resources. Implementing a set of security controls such as identity and access management, multi-factor authentication, device profiling and network segmentation, data encryption and behavioural analytics ensures that only authorised users and devices can access resources.
Device profiling identifies and assesses the security posture of devices, including software and hardware configurations, to ensure that devices are compliant with security policies before granting access. Network segmentation creates secure micro-segments within an organisation’s network to ensure resources are only accessible to authorised users and devices. Data encryption protects data in transit and at rest ensuring that sensitive data is not compromised in the event of a data breach while behavioural analytics detect and respond to abnormal behaviour and potential threats on the network.
“To effectively communicate cyber risk to the board, it’s important to establish a regular cadence of communication and reports,” Harper concludes. “The EU’s Return on Security Investment (ROSI) formula is also a valuable tool for presenting the quantifiable value of an investment in cybersecurity to the board.”
