CFOtech Asia logo
Technology news for Asia's CFOs and financial decision-makers
Story image

Hard numbers: Why ambiguity in cybersecurity no longer adds up

By Contributor
Tue 17 May 2022

Article by MetricStream APAC managing director, Michel Feijen.

There are places where ambiguity and subjectivity work well – but measuring your cyber risk exposure isn’t one. 

One place where clarity is required is in the C-suite. As both cybersecurity costs and risks continue to escalate, CEOs continue to struggle with what their investment in cyber protection buys. 

When trying to gauge the effectiveness of their company’s cybersecurity, one survey found that 72% of CEOs receive metrics that “lack meaning or context,” and 87% “need a better way to measure the effectiveness of their cybersecurity investments.”

As MIT Sloan Management Review notes, “Often, executives as well as directors spend too much time studying technical reports on such things as the numbers of intrusion detection system alerts, antivirus signatures identified, and software patches implemented.” These things often get delegated and limited to the IT department but ideally, dealing with and addressing cyber security risks should be strategically managed by the top management so that risk management is not just incidence-based. 

Cybersecurity increasingly needs to learn to speak a different language. Current reforms in multiple countries - notably, Australia and the United States - would expose individual directors and executives to personal liability for cybersecurity risks. The proposals also seek to record the “substance of how a company manages its cybersecurity risk.”

That’s a profoundly different position on risk - and not one that is conducive to qualitative or ambiguous ‘traffic light system’ type representations.

The traditional approach has been to rank risks as high, medium, and low, or assess them in terms such as “probably likely to occur” or “somewhat likely to impact the business.” 

These categorisations are too vague in the modern world. Security teams might think a medium risk needs to be mitigated, but the management team might argue that it can be accepted. Defending your point of view can be tough because the term ‘medium risk’ sounds quite ambiguous.

It gets more challenging when teams have multiple risks that are all ranked medium. Which one do you focus on first? Do you spend the same amount of time and resources managing all three risks? It’s difficult to know for sure with non-quantitative metrics.

Organisations face thousands of IT and cyber risks a year. The challenge is to determine which risks should be dealt with first. Likewise, there may be hundreds of possible security controls; which one will yield the greatest benefits for the least cost? 

These are questions that CISOs must have an answer to. And to do that, they need quantitative data. Ambiguous terms must be converted into hard numbers.

Do the math

Enter cyber risk quantification - a process for measuring IT and cyber risk exposure in monetary terms. 

It’s intended to help practitioners and their employers determine which risks to prioritise and where to allocate cybersecurity resources for maximum impact.

Typically, cyber risk quantification uses sophisticated modelling techniques like Monte Carlo simulations to estimate the value at risk (VaR) or expected loss from risk exposure.

By quantifying the monetary impact of a risk event, questions like “How much should we invest in cybersecurity?”, “What will be the return on investment?” and “Do we have enough cyber insurance coverage?” can be more confidently answered.

Uncertainty is minimised when cyber risk exposure is expressed in clear and precise terms. It becomes easier to direct security investments when it’s known how much the risk will cost and how much a particular control can help lower that cost. There’s much less debate and confusion about the top three cyber risks, why they’ve been ranked that way, or which controls are most relevant to mitigate those risks. The data is already there for everyone to see.

Multiple stakeholders benefit from such clarity. CISOs gain a deeper understanding of risk impact, which helps them make data-driven decisions. Boards have more visibility into what’s at stake for the business in terms of dollar value. And executives can effectively prioritise cybersecurity investments, driving alignment between cyber programs and business goals.

Six things to keep in mind 

To quantify cybersecurity risk, organisations should consider six important points.

First, establish a common risk language. If everyone in the organisation has a different definition for each IT asset, threat, or vulnerability, it will be difficult to communicate and defend risk decisions. Standardise the risk nomenclature as much as possible.

Second, cyber risk quantification is a collaborative exercise that goes beyond the IT security department. Engage other divisions in identifying critical risk scenarios. The more perspectives that are brought to the table, the more comprehensive your risk data will be.

Third, cyber risks and threats are constantly evolving. A risk that was critical a year ago may not be as important or relevant anymore. The only way to know is to re-quantify risks at regular intervals – maybe once or twice annually.

Fourth, it’s neither efficient nor effective to cover all possible threats and risk scenarios at once. Pick one important use case and work on that before moving forward.

Fifth, automate wherever possible. Manual cyber risk quantification processes can be both complex and time-consuming. Automating those workflows can help measure a large number of risk exposures faster.

And finally, quantification isn’t a cure-all: Cyber risk quantification should enhance, not replace, other IT and cyber risk management processes. Its value is best realised when complemented with risk monitoring, qualitative assessments, internal audits, and issue management processes.

While no organisation can ever be fully immune to threats and risk, smart and calculable risk quantification, management, and measurement can help organisations get better at mitigating risks. 

Related stories
Top stories
Story image
Robotic Process Automation / RPA
Western Union implements intelligent automation programme from SS&C Blue Prism and ISG
Western Union has successfully implemented a strategic intelligent automation programme from SS&C Blue Prism and its certified partner, ISG.
Story image
Telecommunications
WiFi as a Service market to reach $26 billion through 2032
As a result of the easy management of wireless infrastructure over cloud services, WaaS is experiencing rapid growth.
Story image
Ransomware
Examining the future of ransomware threats with Vectra’s CTO
As customers' valuable data move to the cloud, so will ransomware. What is the current landscape and what do we need to know?
Story image
Infrastructure
Symbio, Cisco partner to launch Webex Calling in Singapore
Symbio has partnered with Cisco to launch a unified communications offering for Cisco's Cloud Connect for Webex Calling.
Story image
Infrastructure
Global investment in data centers more than doubled in 2021
DLA Piper's latest global survey finds the total investment in data center infrastructure worldwide rose from USD $24.4 billion in 2020 to USD $53.8 billion in 2021.
Story image
Cybersecurity
Vulnerable APIs costing businesses billions every year
Large companies are particularly vulnerable to the security risks associated with exposed or unprotected APIs as they accelerate digital transformation.  
Story image
Data ownership
Brands must reclaim trust by empowering data ownership
According to Twilio's new State of Personalisation Report 2022, 62% of consumers expect personalisation from brands, and yet only 40% trust brands to use their data responsibly and keep it safe.
Story image
Remote Working
RDP attacks on the rise, Kaspersky experts offer advice
"Given that remote work is here to stay, we urge companies to seriously look into securing their remote and hybrid workforce to protect their data."
Story image
Music
Mastercard reveals first-ever album titled Priceless
Mastercard's music album Priceless has been unveiled at the Cannes Lions Festival of Creativity and features 10 songs by 10 artists worldwide.
Story image
Infrastructure
New VMware offerings improve cloud infrastructure management
VMware has unveiled VMware vSphere+ and VMware vSAN+ to help organisations bring benefits of the cloud to existing on-prem infrastructure.
Story image
Artificial Intelligence
Accenture shares the benefits of supply chain visibility
It's clear that gaining better visibility into the supply chain will help organisations avoid excess costs, inefficiencies, and complexity to ultimately improve their bottom line.
Story image
BitTitan
How to achieve your monthly recurring revenue goals
Monthly recurring revenue (MRR) is the ultimate goal, the most important issue on which anyone in the IT channel should focus.
Story image
Open source
DataStax secures US$115 million to fund database expansion
DataStax has secured US$115 million in funding, which it will use to develop and expand its Astra DB multi-cloud database and Astra Streaming service globally.
Story image
Cloud
Cloudflare outage in 19 data centers worldwide due to own error
Cloudflare says its outage for 19 of its data centers yesterday was because of a change in a long-running project to increase resilience in its busiest locations.
Story image
Multi Cloud
Cloud is a tool, not a destination
For many years, “cloud” has been thought of as a destination which has led to a misguided strategy that sees an enterprise trying to shift all its applications to a single cloud provider – regardless of the specific needs and nuances of each individual workload.
Story image
Talend
Forrester names Talend Leader in enterprise data fabric
Forrester has named Talend a leader among enterprise data fabric providers in the Forrester Wave: Enterprise Data Fabric, Q2 2022 report.
Story image
Gartner
Gartner's top recommendations for security leaders
"Leaders now recognise that major disruption is only one crisis away. We can’t control it, but we can evolve our thinking, philosophy, program and architecture.”
Story image
Tech job moves
Tech job moves - ActiveCampaign, Arcserve, LogRhythm & Qlik
We round up all job appointments from June 17-22, 2022, in one place to keep you updated with the latest from across the tech industries.
Story image
Cybersecurity
Tech and data’s role in the changing face of compliance
Accenture's study found that 93% of respondents agree or strongly agree new technologies such as AI and cloud make compliance easier.
Story image
Artificial Intelligence
Juniper study reveals top AI trends in APAC region
Juniper's research shows an increase in enterprise artificial intelligence adoption over the last 12 months is yielding tangible benefits to organisations.
Story image
DNS
DigiCert acquires DNS Made Easy and affiliated brands
Greg Clark comments, says, "This combination enhances the security of certificate validation and enables the automation of future validations."
Story image
CSG
To win at 5G, telcos must tame their quoting chaos
The catalogs of CSP (communication service providers) market offerings are set to explode as new digital services emerge, powered by B2B2X business models.
Story image
Cryptocurrency
NOWPayments launches new service to analyse cryptocurrency fees
NOWPayments has launched a new network fee optimisation solution that analyses current network fees and picks the most profitable option out of the client's payout wallets.
Story image
Education
Microsoft Hong Kong partners with CUHK Business School
The collaboration sees CUHK Business School become the first business school as the authorised exam centre for Microsoft Certifications in Hong Kong.
Story image
Collaboration
IT and security team collaboration crucial to data security
Many IT and security decision makers are not collaborating as effectively as possible to address growing cyber threats.
Story image
Airwallex
How Airwallex helps businesses achieve globalisation success
As markets continue to shift, businesses need to be able to provide the same quality of service for customers regardless of where they are located around the world.
Story image
Tech job moves
Tech job moves - Bitdefender, Cohesity, Fortinet & MODIFI
We round up all job appointments from June 27-30, 2022, in one place to keep you updated with the latest from across the tech industries.
Story image
Sustainability
Honeywell launches new carbon energy management software for buildings
The new Carbon & Energy Management service allows building owners to track and optimise energy performance against carbon reduction goals, down to a device or asset level.
Story image
Fintech
Corpay announces new collaboration with Triterras
Corpay and fintech firm Triterras have announced a new collaboration between Corpay’s Cross-Border business and Triterras Inc.    
Story image
Public Cloud
Public cloud services revenues top $400 billion in 2021
"For the next several years, leading cloud providers will play a critical role in helping enterprises navigate the current storms of disruption."
Story image
Infosys
Preparing for the digital decade with the right workforce strategies
For a decade that started under the pall of the pandemic, the 2020s is poised to end with a bang with the digital economy swelling to a high across the world.
Story image
Recruitment
Thales on recruitment hunt for next disruptive innovations
"Recruiting new talent is part of Thales's belief in the power of innovation and technological progress to build a safer, greener and more inclusive world."
Story image
State Library of Victoria
State Library of Victoria entrusts Oracle support and security to Rimini Street
“Our finance team are very happy with the support and security that Rimini Street provides, which keeps our assets and our customers secure."
Story image
Storage
EXCLUSIVE: Finding the best data center for your business needs with datacenterHawk
Companies using cloud are consistently looking for the best storage solutions to suit their enterprise needs and often have to go through rather complex processes in order to find the right fit.
Story image
Market growth
Salesforce unveils new offerings for consumer goods companies
Salesforce has announced new products for consumer goods companies to help brands navigate increasing market complexity more easily.
Story image
Digital Transformation
What CISOs think about cyber security, visibility and cloud
Seeking to uncover the minds of CISOs and CIOs across Asia Pacific, my company recently asked Frost & Sullivan to take a snapshot of cloud adoption behaviour in the region.
Story image
Contact Centre
Customer service agents don't want to return to contact centres
A new report has revealed that 85% of customer service agents want to work full-time at home and not return to contact centre offices.
Story image
Cloud
BT builds on Equinix partnership with new cloud offering
BT has launched a next-generation cloud connectivity offering extending its global network into strategic carrier-neutral facilities (CNFs) and building on its existing partnership with Equinix.
Story image
Robotic Process Automation / RPA
Salesforce announces latest generation of MuleSoft
Salesforce has introduced the next generation of MuleSoft, a unified solution for automation, integration and APIs to automate any workflow.
Story image
Data
Kacific and Teleglobal support expansion of telecom networks in Indonesia
Kacific has partnered with Teleglobal in Indonesia to provide a large-scale deployment of mobile backhaul services to major telecommunications operators.
Story image
Supply chain
Supply chains continue to be disrupted, enterprises embrace circular economy
“Businesses urgently need to find a solution that can help them to manage this disruption, and transition to a circular economy."
Story image
Amazon Web Services / AWS
Qualtrics goes live on AWS Cloud Infrastructure in Japan
Organisations across Japan will now be able to access the Qualtrics XM/OS platform locally via data centre in the AWS Asia Pacific (Tokyo) region.
Story image
Motorola Solutions
Motorola Solutions deploys communication system to 5th Japanese airport
Motorola Solutions with its partner, Nippon Airport Radio Services deployed the mission critical communication system to Kansai.
Story image
MarTech
Martech experts reveal the “buzz” on personalisation
In the digital age, innovative technology must be leveraged to power an efficient and effective relationship marketing strategy.