Uncertainty.
The measurement and monetization of risk and risk reduction gives you your ROC ("return on control")
How do we document acceptable risks?
How do we measure if a risk is worth spending the money on to address?
Measurement does not mean "exact". This isn't even scientific, very few things can be expressed exactly, most things are expressed probablistically.
How do we document acceptable risks?
How do we measure if a risk is worth spending the money on to address? Measurement: A quantitatively expressed reduction of uncertainty based on one or more observations.
Measurement can reduce uncertainty.
Sometimes even small uncertainty reductions can be worth millions of dollars.
Measurements are essentially "uncertainty reducing observations". If we can observe "it" in some amount then it must be measurable.
CISO's need a "return on control" calculation. That is the monetized value of the reduction in expected losses divided by the cost of the control.
Attack surface has increased. In business "exposure" is highly correlated with business success.
Resources are not available in the amount needed to address all cybersecurity problems. Organizations must make tough choices; not everything gets fixed, stopped, recovered, and so forth.
Cybersecurity spending per employee more than quadrupled from 2012 to 2020 to $2,691 - Deloitte, "Reshaping the Cybersecurity Landscape" July 2020.
For systematic approach to Cybersecurity resource allocation 80% of organizations concerned with cybersecurity will resort to some sort of "scoring" method. - Hubbard Decision Research (2016)
- Vulnerability Management
- Security Event Management
- Threat Intelligence
- Threat Management
80% of organizations concerned with cybersecurity will resort to some sort of "scoring" method. - Hubbard Decision Research (2016)
These orgs create a portfolios of organization assets (applications and infrastructure) and assess vulnerabilities which aggregate into a score. Many organizations use the NIST-supported scoring system called the "Common Vulnerability Scoring System" (CVSS). In simple terms this breaks down potential risks into low, medium, and high risk categories combining the liklihood the risk will be exploited and the impact the exploit could have.
This essentially boils down to a "gut" feeling. I don't think this is terrible, but I also don't think its enough given the gravity of the decisions being made. There is overwhelming evidence in published research that quantitative, probablistic methods are an improvement over unaided expert intuition. And when you combine both you get something really special.
How cybersecurity assesses risk, and how it determines how much it reduces risk, are the basis for determining where cybersecurity needs to prioritize the use of resources. And if this method is broken - or even just leaves room for significant improvement - then that is the highest-priority problem for cybersecurity to tackle.