While responsibilities of leaders in information security are very extensive as shown in the CISO MindMap, following are seven foundational and “must-have” capabilities that every information security program should have. If any of these capabilities is missing, the first priority should be to build it before considering more advanced level program development.
Governance – Create or update foundational security policies, standards and procedures. This may vary significantly based upon organizational maturity, compliance needs, size of the organization, and risk tolerance. Create success metrics. Perform regular audits to measure effectiveness of security. Align security program with business objectives.
Risk Management Process – At minimum, every organization must have a process for identifying, assessing, documenting, reporting, prioritization, and mitigating risk. This may be as simple as using a spreadsheet or as complex as using a sophisticated GRC tool.
Asset Management – A process for identifying assets including hardware, software, network, applications, Cloud and others. An asset is anything that your organization relies on conducting its business.
Network Security – Employ fundamental network security countermeasures such as network and web application firewalls, network segmentation, remote access VPN, and network threat detection capabilities.
Endpoint Detection and Response – Use tools for endpoint protection, data protection, anti malware, that can provide protection against data theft and ransomware.
Vulnerability Management Program – A program must include network and application scanning, vulnerability identification, penetration testing, patch management, tracking and closing vulnerabilities and linking with the risk management process. Many open source tools are available to overcome budget issues.
Threat Detection and Response – Ability to detect threats using automated tools, logs, and other mechanisms, create an incident response process. Build an internal coalition for recovering from security incidents in a timely manner. Build relationships with local law enforcement. Tabletop exercises are a good mechanism to test capability for incident response, identify gaps and make improvements.
Building these capabilities requires people, effective processes, and relevant tools. A CISO should identify gaps, make a plan, request for budget and set targets/goals to build these capabilities.
Third parties generally refer to external entities with whom you enter into contractual agreements to deliver products or services. These external partners may offer essential services to support your business operations or extend services to your clientele on your behalf. Examples of third parties encompass a diverse range of entities, such as internet service providers, financial institutions, software vendors, building maintenance companies, and others.
Reasons for Managing Third Party Risk
Breach Liability – A security incident with third parties may impact your business operations. If third parties have access to your data or your customers’s data, you may be liable for handling data breaches that occurred on a third party network.
Compliance – Many data privacy regulations require compliance wherever the data is stored, processed and utilized. A third party having access to privacy related data may be part of the scope of work you have to do to meet regulatory compliance.
Resilience of Supply Chain – Disruptions in supply chain may be detrimental to your business. Managing third party risk is essential for a reliable supply chain.
Have a Risk Management Program
If you have a corporate information security risk management program, it can provide you a basis for managing third party risk. Managing the lifecycle for third parties is very similar in many ways to managing other information security risks. Make third party risk as part of the overall risk management program and follow a risk management lifecycle starting from risk identification, categorization, assessment, mitigation and closure.
Define Third Party Risk Management Standard and Processes
Building a third party risk management standard should be one of the first steps for CISOs. A standard provides clarity and consistency for all stakeholders and goes a long way towards achieving maturity. Following are some of the components that should be part of the standard.
Clearly define purpose of the standard
Define categories for third parties
Contractual arrangement with third parties
Onboarding and offboarding of third parties
Perform assessments for a third party
Frequently assessments will be performed
Monitoring and oversight of third party risk
Third party compliance management
Define a list of artifacts needed from third parties and the frequency at which these are required.
Define third party “trust levels” and minimum technical requirements for each level. This will help determine which of the third parties can be given access to network, data, and other assets based upon the trust level.
A RACI matrix for all stakeholders
Categorize Third Parties
Some third parties carry significantly more risk than others, and need more attention for risk management. Categorization of third parties may be based upon factors such as:
Criticality for business operations – Who is critical to your business processes such that without this third party business will cease to function.
Access to data – Who has access to your corporate, employee or your customer data.
Direct connectivity to network or Cloud – Who has direct connectivity into your network or to your Cloud environments with possibility of a breach on the third party environment can directly spill over into your environment.
Type of relationships with the third party – Do you consume services, use source code or software libraries, use a third party for data processing, and so on.
Based upon these and other factors, you can define a list of categories to prioritize assessments.
Automation and Tools
Historically simple tools such as questionnaires and spreadsheets have been used for third party risk assessment. To reduce management overhead, some information for third parties can be collected and assessed with automated tools and publicly available information.
Three use cases of Large Language Models (LLMs) to save time and immediately enhance productivity
While there is tremendous hype around LLMs, many people in Cybersecurity are still struggling to put news tools like ChatGPT and Google Bard to practice. This is a brief article to discuss use cases that will save time and quickly enhance your productivity in carrying out common tasks.
Create Bash Scripts to automate Cyber Security tasks
Super fast SIEM use cases development
Assistance in Security Awareness Program
Use Case 1: Automate Cybersecurity Tasks with bash Scripts
Many Cybersecurity professionals need automating simple tasks using scripts that would otherwise take a large amount of time and work. ChatGPT can create bash shell scripts quickly that you can adapt to your needs. Let us assume your policy requires disabling username/password authentication to SSH and allows only key based authentication. The following example shows how ChatGPT creates a script to accomplish it on a large number of servers. Carefully take a look at the prompt and response
User Prompt
“create a bash shell script that to check if SSH login using username and password is enabled on a large number of Linux servers. Assume key based login is enabled on these servers for a user with username “super_secret_admin”. The list of server IP addresses is stored in a file servers.txt, one IP address per line.”
ChatGPT Response
“To check if SSH login using a username and password is enabled on a list of Linux servers where key-based login is enabled for the user “super_secret_admin,” you can use a Bash script that reads the list of server IP addresses from a file and remotely checks the SSH server configuration for the “super_secret_admin” user. Here’s a sample script for this task:
#!/bin/bash
# Specify the path to the file containing server IP addresses
server_list_file="servers.txt"
# Specify the SSH username (super_secret_admin user)
ssh_user="super_secret_admin"
# Function to check if SSH password authentication is enabled for the super_secret_admin user
check_ssh_password_auth() {
server_ip="$1"
ssh_config_file="/etc/ssh/sshd_config"
# Use SSH to remotely fetch the SSH server configuration
ssh_config=$(ssh -o BatchMode=yes -o ConnectTimeout=5 "$ssh_user@$server_ip" "cat $ssh_config_file")
# Check if PasswordAuthentication is set to yes in the sshd_config
if [[ "$ssh_config" =~ "PasswordAuthentication yes" ]]; then
echo "SSH password authentication is enabled for $ssh_user on $server_ip."
else
echo "SSH password authentication is not enabled for $ssh_user on $server_ip."
fi
}
# Main script
if [ -f "$server_list_file" ]; then
while read -r server_ip; do
echo "Checking SSH configuration on $server_ip..."
check_ssh_password_auth "$server_ip"
done < "$server_list_file"
else
echo "Server list file not found."
fi
Replace “super_secret_admin” with the appropriate SSH username you want to check for password authentication.
Ensure that the SSH key of the machine running this script has access to the servers you are checking. The script reads server IP addresses from the servers.txt file, one per line, and then connects to each server to check the sshd_config file for the presence of “PasswordAuthentication yes” for the “super_secret_admin” user to determine if password authentication is enabled.
You can run this script with the command bash script.sh. It will check each server listed in the servers.txt file.
Make sure you have the necessary permissions and approvals to perform remote checks on these servers.“
Here is a partial screenshot of this prompt and response.
Note that you can fine tune the prompt if the result does not meet your needs. Also note that you still need knowledge of Bash scripting to make sure the generated script meets your needs and that you are able to make manual fine tuning to the script, if needed. ChatGPT is your assistant, not your replacement!
Use Case 2: Super Fast SIEM Use Case Development
LLM tools are also very useful to quickly fine tune SIEM rules and enhance detection capabilities in Security Operations Centers (SOC). The following simple example shows how quickly ChatGPT created Splunk code for detecting directory traversal attacks.
The next screenshot shows Google Bard response to the same prompt with a different answer.
Use of these tools can greatly enhance speed of SIEM tuning and detection capability. The work that usually needs days can be accomplished in hours.
Use Case 3: Assistance in Security Awareness Program
Writing good communication is an art and many of us in the Cybersecurity field are not very skillful in written communication. Fortunately now we have ChatGPT to come to our assistance. Please see the following prompt and response in crafting a communication to your specific audience.
User Prompt
“Craft a brief email for executive management team members highlighting importance of security awareness month and actions that the board should take during this month.”
I trust this message finds you well. As we usher in Security Awareness Month, I want to underscore the critical importance of this initiative and outline the actions that our Board of Directors should consider to reinforce our commitment to cybersecurity.
Security Awareness Month serves as a yearly reminder of the dynamic and ever-evolving nature of security risks within our industry. It is a timely opportunity to focus our efforts on strengthening our organization’s security posture. To this end, I recommend the following actions for our Board’s consideration during this month:
1. **Increased Employee Vigilance**: Encourage all staff to maintain a heightened level of awareness when it comes to security threats. The mantra “See something, say something” should be reinforced throughout our organization.
2. **Education and Training**: Support and participate in security awareness training sessions for our employees. Highlight the importance of robust password management, data protection, and secure online practices.
3. **Policy and Procedure Review**: Conduct a thorough examination of our existing security policies and procedures. Identify areas where revisions or improvements are needed to address emerging threats.
4. **Incident Response Simulation**: Consider organizing a tabletop exercise to test our incident response plan. Ensure that all Board members and key staff are well-prepared in the event of a security incident.
5. **Expert Insights**: Explore the possibility of inviting external security experts to provide insights on emerging threats and best practices in security. Their perspective can be invaluable in fortifying our defenses.
6. **Stakeholder Communication**: Maintain transparent communication with our stakeholders, including customers and partners, regarding our dedication to security and the measures we are implementing to safeguard their data.
7. **Resource Allocation**: Evaluate and approve the allocation of necessary resources for our security initiatives. Invest in technologies and training programs that enhance our ability to mitigate threats effectively.
8. **Regular Updates**: Ensure that our Board members are well-informed about the progress of our security initiatives and receive regular reports on security-related incidents and trends.
By collectively embracing these actions during Security Awareness Month, we will not only strengthen our resilience against potential security threats but also reinforce our unwavering commitment to the security of our organization and the trust of our stakeholders.
Your support and involvement in these efforts are invaluable. Thank you for your commitment to the security and success of our organization.
Best regards,
[Your Name]
[Your Title]
[Your Contact Information]”
Let us say this text is too long for your purpose. A follow-up prompt, as shown below, makes it much shorter.
Using LLM tools as your assistance in a security awareness program is a great help.
Check Your Corporate Policy for LLM Use
Before using LLM tools, check your corporate policy. The tool may store your prompts and use them to enhance capabilities of the model. If you put any sensitive information in the prompt, it may result in unintentional data leakage. Use these tools with caution and in accordance with your corporate policies.
When a CISO joins a new organization, it is important to start with basics. Following is a TODO list for every new CISO.
Understand the business – where revenue comes from, who are major customers, meet internal stakeholders.
Review CISO budget – How much is the budget, where it is spent (people, technology, services).
Know team members – Get to know team members. In case of a large team, get to know key leaders but meet individual contributors to understand their challenges.
Identify compliance and regulatory needs – Before creating strategy, list all compliance needs, their current status, next audit cycle timeline.
Understand technology foundation
Policy, standards and governance structure.
Critical assets and asset management (what to protect).
Identify key technologies used for protection (end point, network, applications, Cloud, Identity and access management).
Benefit from experiences of SOC practitioners, crowdsourcing SOC best practices.
Main Focus Areas
Following are the major areas of focus that should be part of a SOC conference.
SOC in the Cloud, SOC as a Service
SOC – Meaningful Performance Metrics
SOC Staff: Well being and stress management
Use of Artificial Intelligence in SOC
SOC for IoT, OT, Autonomous Vehicles and other emerging industry needs
Implication of Cloud, Containers, Serverless Computing on SOC
Threat visualization, Threat Intelligence
Cooperative SOC for vertical markets
Automation
Open source SOC
Incident Response, Digital Forensics
Business case development, planning and implementation and cost management
Emerging SOC technologies
Global SOC challenges, privacy laws, data sharing across physical boundaries
Integrations, APIs, Ticketing Systems
Knowledge Management
With expanding sources of data and ever-evolving new threats, we, as industry need to continuously work on finding the best path forward. The objective of this conference is to do exactly that by challenging the status quo and bring fresh and original thoughts to meet new challenges.
Who Should Speak?
Speakers at this event should be only those who are SOC practitioners in some form so that they can bring real world experience to the audience.
Delivery Mode
To enable global community, the conference should be virtual so that participants can join/present from anywhere without the need for traveling.
Call to Action
Interested? Connect at LinkedIn and explore this idea further – https://www.linkedin.com/in/rafeeq/
Subscribe to Blog
Email subscription will deliver new posts to your inbox.
This post is an updated version of six fundamental principles that always fill my professional and personal life with joy, pleasure and satisfaction. So here they are!
This is my first model of a joyful life, explained to me by a senior school friend. If you do this, you will never regret anything from the past, career choices, business decisions or personal relationships. It takes a lot of courage, but you will have a contented heart all the time.
“Your value” is directly proportional to the value you create for others. Measure your actions by how much they benefit others, whether it is a business meeting, a family dinner, or social media post. Always serve the people around you.
There is no perfect time to launch a product, start a business, pursue a degree, or change career. You will never have perfect information to make important decisions. Embrace imperfection, “good enough” is much better than “perfect”.
Be generous in your praise of people, in sharing credit, in kindness, in forgiving, in giving favors. Be a giver. Be generous with people who disagree with you. Giving favors is the best investment for your career and your personal life.
Complexity is the biggest enemy at work, home, in relationships, and with friends. Be simple, do simple things, have simple ideas, simplify things for people. Be single threaded to improve productivity. Use images, diagrams, and analogies to explain complex things.
Fear of failure keeps people from achieving great things and miss career opportunities. Fail; if you have not failed in a long time, you have very likely missed many opportunities. Overcome the fear of failure, you don’t have to prove anything to anyone. Abandon your comfort zone. Success and failure are two sides of the same coin, one does not exist without the other.
Most people outside the Cybersecurity profession don’t fully realize and appreciate the complexity of a security professional’s job. Since 2012, CISO MindMap has been an effective educational tool to communicate CISO responsibilities and has enabled security professionals to design and refine their security programs. Here is the latest and updated CISO MindMap for 2023 with a number of updates and new recommendations for 2023-24.
With time, the responsibilities of security professionals are only increasing. Why? Technology is changing fast, bringing new ways of doing business, continuous adoption of Cloud, and many emerging technologies like ChatGPT phenomenon with many vendors working on similar solutions. Not only the Infosec professionals are “expected” to deeply understand these technologies, but also provide policies/guidance on how to secure them. For this reason, every year you find new things on the CISO MindMap. Like every year, few things are added, changed or removed from the CISO MindMap depending upon their relevance. Modified and new items are marked in red color for your convenience.
Other changes include but not limited to:
Automation – A section on “Automation” is added after re-organizing some existing content and adding new. Given efforts of optimization of budget by many CISOs and lack of qualified staff, automation is key to remove routine tasks and find efficiencies in security operations. I believe every security team must create a specific role for automation
Redundancy and Overlaps – Remove some redundancies and overlaps
Expiration Date – A common issue is that many professionals still have older CISO MindMap copies. I added an “expiration date” to let people know when they should stop using a particular version. The expiration date for the 2023 CISO MindMap is the end of June 2024. The next version will be published before the current version expires.
Recommendations for 2023-2024
Every year I make my recommendations as a practitioner and based upon conversations with infosec leaders. I try to be objective, avoid the hype, need for adoption in the next 12-18 months, and solely focus on what data and research shows. While there may be some unintended biases, the objective is to provide actions that can be taken in a short to mid range time period. These are not “predictions” of the future but rather “what is needed now” to strengthen security programs.
For me, the most difficult part while making these recommendations is to pick as few as I can. The following list is longer than what I would like it to be but hopefully it would give you a few things to think about. The followers of MindMap would quickly realize that some of these are the same as previous years and some new ones.
Increase Attention on Resilience – Evaluate ransomware defenses, detection and response capabilities, perform a business impact analysis and identify critical processes, applications and data. Test ability to restore systems and data within an acceptable time frame. Understand that merely having a backup is not enough. Ability to rebuild impacted systems and restore backups in a timely manner is crucial to bring business back to normal operating conditions after security incidents.
Reduce and Consolidate Security Tools – More security tools don’t necessarily reduce risk but do add the need for maintaining expertise on security teams. While deciding which tools to keep or retire, think about functionality overlap, future direction, innovation on the part of vendors
Build a Brand for Security Team – While the message is important, the credibility of the messenger is also crucial. To serve business better, train security team staff on business acumen, value creation, influencing people without authority, and human experience. I included this recommendation last year as well and we need to keep focus on the fact that information security teams don’t live in a vacuum and have to enable business and interact with others.
Untangle Application Web of Components – Modern applications have become a web of interconnected components, APIs, multiple cloud and data centers, open source libraries, third party services like DNS, email, content delivery vendors, and so on. Even when you purchase a commercial off the shelf application/software, it may rely on third party APIs and services. Understand how business applications work, take an inventory of all components that they rely on, and make it part of your vulnerability management program.
Build Expertise in Emerging Technologies – By now everyone has heard about ChatGPT and competing technologies from other vendors. Build team expertise in technology fields including machine learning (ML) models, model training, API security, service mesh, containers, DevSecOps.
Create a Security Automation Role – Managing security program cost and working at “machine speed” requires automation. This is a new section added to CISO MindMap this year. Automate maintaining a risk register, asset (hardware, software, APIs, etc.) inventory, scanning and testing. Many tools used in CI/CD pipelines as part of DevOps are useful for automation. However, simple scripting goes a long way in reducing overhead of routine tasks. I would highly recommend automating security metrics such that you can see the current state of your security program anytime you need to, almost in real time. It is not an easy task but it is doable. I have observed some organizations do it on scale.
I am eager to listen to your viewpoint on these recommendations, why or why not!
How to use CISO MindMap?
It is unbelievable how many posts and messages I see about many different ways people are using the CISO MindMap. Over the years, it has become a great tool for many of you and I appreciate your feedback, suggestions for improvements. Following are some of the ways this MindMap is quite helpful:
Have you been asked what you really do as a security professional? The CISO MindMap is one way for answering the question and explaining it to people. I have heard from many professionals that this MindMap is extremely helpful in explaining the complexity of a CISO job, especially to a business audience.
A means for guiding conversation with other technology professionals.
SANS Institute uses it as part of the Security Leadership Poster.
Designing and refining security programs.
Some security vendors use the MindMap for awareness.
CISO group discussions and/or community meetings.
For aspiring security professionals, understand the landscape and decide their career path.
Many security leaders and professionals have made comments on LinkedIn about CISO MindMap and how they use it. Following is a sample of some of these comments with links to original posts on LinkedIn.
“Interested in understanding the role of a CISO? Today, reflecting on the past weeks of intensity, curiosity and just overall well invested energy, I enjoy looking through the newly updated CISO mindmap thatRafeeq Rehman continues to maintain both from a relevance, recommendations and a reminding perspective.
If you’re in the#cybersecurity field you will have seen the#CISO mindmap for sure, and if you are a senior leader, that haven’t had the pleasure yet or are curious as to what a CISO actually considers in the everyday life, I strongly recommend spending time on this – I guarantee there are topics on there that can inspire a vivid conversation with the board in almost any organization! If nothing else, share the 6 recommendations with your cybersecurity team and see if it’s a match for you too 😉
For me personally, the Mindmap has served as a great source of inspiration from the very first version several years ago – thank youRafeeq Rehman for your continued contributions to the community!!”
“Another year, another update to the CISO MindMap byRafeeq Rehman. Looks like in 2022 we’ve added another dozen or so areas of responsibility for the CISO (unsurprising and yes it is unrelenting), these are shown in red.
Published now for over a decade, I find these CISO MindMaps incredibly useful to explain (maybe to ourselves at the very least) the breadth and complexities of the roles that CISOs and cyber security teams undertake.”
“Landed on a great resource for anyone interested in better understanding the incredibly complex scope of responsibilities under a CISO. The CISO Mind Map (courtesy ofRafeeq Rehman) puts it all into perspective. It’s one thing to say “CISOs have a lot on their plates” – but another thing to see it in black and white. The CISO Mind Map is also useful in terms of thinking about how the many discrete activities and programs may be organized.”
Acknowledgments
In addition to numerous infosec leaders who provide their input, we have a LinkedIn Group to gather suggestions and comments from the community. While many provided feedback, the following is an alphabetically organized list of people and organizations who provided “specific suggestions” for improvements. If I missed anyone, please send me a message to make corrections.
This MindMap is copyrighted material. However it is absolutely free to all (like water and air) with no strings attached (as long as it is not altered and not used to make money). When using this MindMap, please cite the source properly so that recipients can receive future updates.
Subscribe to my blog
To keep updated about new posts, you can subscribe to my blog
In a previous blog post, I discussed qualitative, quantitative, and scoring methods of risk assessment. Irrespective of which method we use, estimating “control strength” is an important part of calculating overall risk (especially in qualitative and quantitative methods). To improve consistency and to decrease subjectivity in estimating control strength, I am providing some examples of how to estimate control strength in this article.
What is a Control and Control Strength?
A “control” is something that reduces the potential of a loss. Controls can be implemented in many forms. It could be a technical control (e.g. a firewall), a process control (e.g. change management process), an administrative control (e.g. a visitor log), or in some cases a person (like a security guard).
Simply put, control strength is the ability of a control to stop/resist cyber attacks from threat actors, resist compromise and protect an asset’s confidentiality, availability and integrity.
Categorizing Control Strength
Control strength can be categorized in different levels. Using five levels for control strength is very common. Following is one way to describe these levels but there could be other ways to do so.
Very High (VH) – The control will protect against top threats
High (H) – The control will protect against majority of threats
Moderate (M) – The control protects against average threats
Low (L) – The control protects only very low .level attacks
Very Low (VL) – The controls is not effective at all and would rarely protect against any threats
Having these categories at hand, a risk analyst can determine control strength during the process of risk analysis in a more consistent manner.
Estimating Control Strength
Risk analysts need to make an estimate about control strength during the risk assessment process. This estimate could be based upon data (which is difficult to acquire in the information security field) or it could be based upon experience and knowledge of the analyst. Following are some examples of how to estimate control strength in different scenarios. These could be used for education purposes.
Scenario 1 – Protecting data in a web application with help of user authentication and making it available to only authorized users.
Following can be one way of estimating control strength levels:
Very High (VH) – A user has to use a combination of username and password along with two factor authentication. The password must be strong with a minimum length of 10 characters and a combination of alphabets, numbers and special characters. Passwords expire after a certain time forcing the user to change it. A user is notified via email when password change occurs.
High (H) – A user has to use a combination of username and password. The password must be strong with a minimum length of 10 characters and a combination of alphabets, numbers and special characters. Passwords expire after a certain time forcing the user to change it. A user is notified via email when password change occurs.
Moderate (M) – A user has to use a combination of username and password. The password must be strong with a minimum length of 10 characters and combination of alphabets, numbers and special characters.
Low (L) – A user has to use a combination of username and password but is able to use a password of any length and no requirement of special characters.
Very Low (VL) – No username and password is required. A user can get to data as long as the user has a specific URL.
Scenario 2 – Protect physical security of a data center
Very High (VH) – Boundary wall with locked gates, presence of 24×7, surveillance cameras, security guard on duty, visitor log register, keycard access to datacenter room with biometric retina scan, camera inside the data center with face recognition technology that can identify unknown people.
High (H) – Boundary wall with locked gates, presence of 24×7, surveillance cameras, security guard on duty, visitor log register, keycard access to datacenter room.
Moderate (M) – Boundary wall with locked gates, security guard on duty, visitor log.
Low (L) – Boundary wall with locked gates. Visitors with a key can enter the building.
Very Low (VL) – Room inside a building with no locks.
Other Considerations
Here are few other considerations while dealing with control strength estimation.
We don’t need all five levels of controls for each scenario. In some cases, we may have three or four levels of controls, e.g. Very High, Moderate, and Low.
The exact definition of each level of controls can vary from one organization to another but should comply with and be consistent with a single standard inside that organization.
The risk management leadership should train risk analysts on a continuous basis. The training should be about how to measure control strength by walking them through new scenarios each time. An example could be a monthly open meeting to pick one scenario and explain rationale for control levels.
Information security community has been performing risk assessment for as long as the profession existed. The risk assessment is typically classified as qualitative (e.g. Critical, High, Medium, Low) or quantitative (a dollar amount). Risk scoring is a relatively new phenomenon where a score (number) is assigned based upon available data and numerical calculations. Scoring system and method could be very different depending upon a particular method. For example, you may see scores between certain ranges in one system and scores without range in others.
Why is methodology important?
Business outcomes may be different depending upon which methodology we pick. Each method has its advantages and drawbacks.
Qualitative methods usually incorporate some level of subjectivity based upon the risk assessor’s experience. However it could be done with relatively ease and at high speed, taking less time for completion.
Quantitative risk assessment methods do involve more complicated math. Since large sets of data are not available, the risk assessors still make some assumptions in the inputs giving an impression of subjectivity. Implementing quantitative risk assessment “at scale” is difficult as it takes more time to perform.
Risk scoring methods differ quite a bit in their implementations. Many vendors are not transparent about their underlying formulas used for scoring. However, methods exist to perform risk scoring based upon available data instead of assumptions. The main advantages are eliminating subjectivity and ability to perform risk scoring at scale.
A decent risk assessment methodology could be a combination of qualitative, quantitative and scoring methods.
What factors to consider?
When considering which risk assessment methodology to adopt, following are a few considerations.
Staff experience in performing risk assessment.
Speed at which risk assessment is needed.
Tools available for risk assessment.
Ability to collect data for risk scoring. The data may include vulnerability scanning, endpoint detection and response systems (EDR) data, penetration testing results, patch management data, asset management, coverage of security agents (or lack of it) and so on. The more data is available, the better the score.
My personal preference is to use risk scoring in combination of qualitative risk assessment performed in assessments like penetration testing.
While there is a huge list of CISO responsibilities as we discussed in CISO Mindmap, keeping oneself focused on value creation and security program improvements is not easy. The following four questions will help improve efficiency of the program by automation and picking right problems to solve.
How can we automate this?
Is this problem worth solving?
Will this enable business or add value?
What incremental improvement can we make today?
While my focus is information security community, these questions are relevant for all knowledge workers and leaders irrespective of their field of work.
