Risk can be tricky to measure. As in so much of life, the devil is in the details. And when it comes to cybersecurity, that tricky devil can be the difference between a number that merely ticks a box on a requirements sheet and a metric that is at the core of a mature risk management plan.
Spoiled for Choice
Boiled down to its most basic form, risk is a simple concept. You take the likelihood that an event will occur, multiply it by the impact of its occurrence, and out pops a risk metric. The trouble is, we all know that life generally isn’t anywhere nearly that simple.
To begin with, there are complications, such as how widespread an event could be — is it a possibility only on a handful of specialty devices or on every endpoint owned by the organization? Then you get into the various sorts of impact an event might have, how readily the impact could be remediated, and so on, and before you know it the equations look more like quantum mechanics than third-grade math.
Then comes the question of how you express the risk quantity; is it a scale of 1 to 100? In dollars? In colors, as in the original DHS Threat Level rankings? In the relative “cool” factor of various amphibians? It can be a difficult choice.
And therein lies a key problem: Not that there’s no way to quantify and express risk, but that there are so many ways to attack the problem. It’s not that any one system is necessarily bad (though the amphibian scale can be a bit slippery) but that it is difficult to map from one scale onto another and compare relative risk postures of organizations across a geography or industry grouping. The difficulty makes it more important than it might otherwise be to take care in choosing a risk quantification method.
Choosing the Right Tool
There are, in a very broad sense, three types of tools used to quantify risk. There are frameworks or methodologies that can be used to build custom processes or as the basis for commercial products. There are tools that quantify risk as their primary function, though they may well provide input to other tools. And there are products or services that quantify risk as part of a larger functionality set.
Some organizations will find that their choice of risk quantification tool is made through their choice of another tool or service. If the larger product or service, whether it be risk management or cyber insurance, includes risk quantification, then it can be very difficult to justify paying for a different system — in many cases, a redundant system — for performing the same analysis.
Other organizations will find that their choice of risk quantification tool is made for them because of business relationships, for example, contracts with a government entity that requires a particular risk analysis as part of the contract qualification process.
For those organizations with the freedom (or chore) of actually choosing a risk quantification tool, the first question to be asked is why quantifying risk is important. It may seem like a question with an obvious answer, but in most cases, there will be a primary need driving the decision. And that primary need should drive the tool choice, as well. Quantifying organizational risk is neither simple nor inexpensive, so it’s important that the tool choice fit the need as fully as possible.
Is there a particular way in which the organization quantifies financial risk? Are there plans for future partnerships or sales efforts that would benefit from a particular way of either measuring or expressing risk? Is a change in insurance provider in the cards? Any — or all — of these could have an impact on the tool that would best fit the organization’s needs. Asking questions of potential partners or providers could open up possibilities for finding a tool that would meet the immediate need while positioning the organization to meet future needs, as well.
Quantifying cyber-risk is a requirement for a growing number of organizations. Taking the right approach to choosing the tool to quantify that risk will go a long way toward making the process as valuable and effective as possible.
