Defining cyber risk has historically been like trying to describe the weather using only the word ‘bad’. It tells you something is wrong, but it doesn’t explain if you’re facing a drizzle, a thunderstorm, or a hurricane—or how to prepare for it. Just as we need specific terms like ‘wind speed’ or ‘precipitation levels’ to understand and respond to the weather, we need clear, measurable definitions for cyber risk to address it effectively.
Co-Founder & COO @ Pellonium | Unified Security Posture Management | Fmr White House, Washington Post
A few months ago, I connected with Scott Mitchell. Given the work we do here at Pellonium and in particular in how we think about risk, he suggested I check out OCEG's definition of risk: https://lnkd.in/g9wFgcWG Reading this definition made me uncomfortable for weeks. It took me a while to articulate why. After some thought, I realized that, though this definition is directionally correct, it is very difficult to operationalize given its ambiguity. Each of the variables used in this definition are very difficult to estimate in a defensible, repeatable manner. Deriving a defensible estimate of risk using these variables is difficult to impossible for most any organization. And yet, given how threats are increasing, cost of incidents are increasing, all while organizations continue to increase investments in cyber infrastructure, it is becoming critical that organizations employ a risk-based approach to managing their security environment. Even the National Institute of Standards and Technology (NIST) says so. But how? (We believe the answer lies in Unified Security Posture Management, but more on that later...) Organizations can no longer manage without an operational understanding of cyber risk. As cyber risk takes its rightful place as a key enterprise risk, security leaders must directly connect the investments they make in addressing threats, vulnerabilities and assets to the effect these investments have on reducing risk. For more on how we think about risk, check out Homayun's post: https://lnkd.in/gpeEZHvC #pelloniumriskintelligence #cyberrisk #grc
Author of How to Manage Cybersecurity Risk - A Leader’s Roadmap with Open FAIR
2wYes, that is a horrible definition of risk. I prefer: probable frequency and probable magnitude of future loss. That definition was created over a decade ago. The GRC industry would rather sell products.