What Does Good Look Like?
Nine papers ago, I started this series with a simple question:
How much cybersecurity is enough?
It is a question that many cybersecurity professionals - and those supporting them - have been wrestling with for many years.
Boards approve cybersecurity budgets. CFOs fund controls. Organisations purchase cyber insurance. CISOs make recommendations about where more investment is needed.
But underneath all of those decisions sits a surprisingly difficult question:.
Why this much?
Examples of understandable questions:
Why £1 million rather than £500,000? Why £5 million rather than £3 million? Or, even the other way around?
How much financial exposure are we looking at and how much risk are we actually managing?
How much risk are we reducing, transferring and accepting?
And how do we know whether the balance is right?
Over the course of this series, I've tried to work towards an answer. Not by inventing another cybersecurity framework. But by stripping the problem back.
Start With the Decision
One idea has appeared repeatedly throughout these papers:
If it doesn't improve the decision, it doesn't belong.
Those of us who work in the field well know that cybersecurity has no shortage of information. Sometimes it even feels like vendors use this as a sales & marketing mechanism.
The challenge is deciding which information matters.
For an executive considering cyber investment, I believe the objective should be relatively simple:
Understand enough about the financial risk to make a defensible decision about what to do with it.
In many cases, we are not able to work with perfect information. Regardless of the decades of threat intelligence data that various providers carefully curate and present, the nature of cybercrime means that loss event frequency, for any given organisation, remains a largely elusive number though ranges can be useful. So, we do not have perfect prediction. However, on the loss magnitude side of the risk equation, I believe it is possible - without exhaustive analysis, but with some objective effort, to produce sufficient information to make a good decision.
It is this emphasis on utility has profoundly influenced my thinking about cyber risk.
Next. What Makes the Business Work?
The next step is deciding what to assess. Trying to understand the cyber risk of an entire organisation in one exercise quickly becomes overwhelming.
Instead, start with the things business leaders already care deeply about. The business functions and applications that support them. The services. The information. The things that make the money go around.
These are an organisations Core Assets.
They provide a natural meeting point between cybersecurity and the business. A CISO understands the security environment surrounding a critical application. But the business owner understands something equally important. "What happens if we lose it?"
That is expertise we need.
As an illustration, let's start with a day in the life of a business leader. Let's take the Chief Financial Officer (CFO) as just one example.
Any good CFO, will have a deep appreciation of all of the critical functions of their business. The things they and other business leaders already care deeply about.
But, just like business leaders in other roles, the CFO will understand those critical assets that they, and their team, work with each and every day. The accounting system. The payroll system. The procurement platform. Online banking and invoicing. The tax and compliance hub.
It is precisely the intimate knowledge of these systems that can be used to quickly and objectively (with care), determine accurate information about loss exposure. We just need to ask the right questions of the right people.
Don't Ask Business Leaders to Predict Cyberattacks
One of the mistakes we make in cyber risk management is asking people questions they cannot reasonably answer.
What is the probability of this particular threat actor exploiting this particular vulnerability next year? Nobody really knows.
Instead, let's ask business leaders questions about something they understand extremely well. Their business.
What happens if this critical asset becomes unavailable? And what happens if its information is breached?
After responding first-hand to more than 1,000 cyber incidents, I have become increasingly convinced that these two basic scenarios - Outage and Data Breach - capture much of the financially meaningful consequence of modern cyber incidents.
Modern ransomware commonly contains both. Business email compromise involves breach.
Extortion, fraud and many other consequences can sit within or alongside them where material.
The purpose isn't to describe every possible cyberattack but to capture enough of the financial consequence to support the decision and to capture that information from those with business ownership of critical systems we wish to analyse.
Put Financial Bounds Around the Consequences
We still don't know exactly what the next incident will cost. We never will. But we don't need to.
Business leaders can often estimate reasonable ranges in areas such as:
Productivity loss.
Response costs.
Replacement costs.
Losses to fines and judgements.
Costs from loss of competitive advantage.
Reputational loss.
Those six dimensions will be familiar to practitioners of the FAIR methodology, whose development I had the privilege of learning from its early days.
They provide an excellent way of decomposing what initially appears to be an unknowable financial loss into components that knowledgeable people can discuss and estimate. We aren't asking for certainty. We're asking "What are the plausible bounds?"
Once we have those ranges, mathematics can help us understand the uncertainty.
Simulate Rather Than Pretend
If we have ranges rather than single figures, a single deterministic calculation isn't particularly helpful.
So simulate. Run thousands of plausible (not identical) incidents but slightly different versions, drawing from the financial ranges supplied by the people who understand the business.
The result isn't a prediction but a distribution that tells us something much more useful:
the range of financial outcomes we might reasonably experience.
Now we have something a CFO, or other business leader, can engage with. Not "High Risk" or a red square. Not 8.7 out of 10. Money. And uncertainty expressed around it.
Now Make the Decision
Once financial risk is visible, there are only four recognised ways to manage it.
Risk reduction or mitigation.
Risk transfer.
Risk acceptance.
Risk avoidance.
Some of the exposure can be reduced using controls. Some can be transferred through insurance, contracts or other mechanisms. Some can be knowingly accepted where the potential loss is absorbable.
Some activities may simply not be worth undertaking.
Importantly, these are not cybersecurity decisions alone. They are business decisions.
That means Finance, Operations, Legal, Risk, Technology and executive leadership should be involved.
Cybersecurity supplies part of the expertise. The business supplies the rest.
Then Build the Portfolio
One critical asset doesn't tell us enough. However, most businesses do not have an exhausive list of critical assets. Do the same exercise for the other assets that genuinely matter and a portfolio begins to emerge. Now management can see where financial cyber risk is concentrated.
It can also see something else. Shared investment. The same firewall may protect several critical assets.
The same EDR platform may protect dozens. The same cyber insurance policy may transfer financial risk across the portfolio.
This matters because investment shouldn't be counted repeatedly simply because it benefits multiple assets. Instead, the portfolio should reveal economies of scale and eventually it should help us answer an even more interesting question:
Where will the next pound of investment produce the greatest reduction in financial risk?
I don't believe our profession can yet answer that question as well as it should. It is an area I intend to explore further.
And Then Do It Again
There is no final cyber risk assessment. Businesses change. Technology changes. Threats change.
Controls change. As I discussed in article 9., controls also degrade.
That means the assessment itself must be capable of revision. Not necessarily another enormous reassessment programme every few years but planned maintenance.
Review what has changed. Revise the relevant assumptions. Recalculate the financial position and reconsider the treatment decisions because resilience requires maintenance.
This Is What I Wanted CyberCore to Do
Everything I've described so far predates the solution I'm finally going to mention.
Over a number of years, these ideas gradually became a methodology. And that methodology eventually became software.
We called it CyberCore.
The objective was deliberately ambitious but the design philosophy was deliberately simple:
Could we provide executives with a financially meaningful view of cyber risk for a critical asset - or portfolio of assets, without requiring months of analysis?
CyberCore therefore guides users through seven focused steps. It collects only information intended to contribute to the risk determination or subsequent decision.
It considers the business and technology context of the critical asset, including how it is accessed and how vulnerabilities are managed.
It then presents the two incident scenarios: Outage and Data Breach and participants estimate financial exposure which ranges across the six loss dimensions.
Guidance is provided to help make those estimates as objective as possible.
When that assessment is complete, CyberCore runs a 10,000-iteration Monte Carlo simulation for each scenario. Ten thousand plausible incidents with ten thousand slightly different financial outcomes. Two distributions of potential loss.
And then comes the important part. The user doesn't simply receive a risk report.
They can then make decisions as to how they would like to treat the risk. How do they:
Reduce it.
Transfer it.
Accept it.
Avoid it.
The completed profile is then incorporated into the portfolio alongside the organisation's other critical assets. And when things change, the profile can be revised.
Two Sides of A4
There is one feature of CyberCore that perhaps best demonstrates the philosophy behind it.
The individual critical-asset report is deliberately designed to fit onto two sides of a single sheet of A4.
Not because the analysis underneath is trivial. Quite the opposite as there can be considerable complexity underneath it.
But the executive doesn't need all of that complexity. They need the information necessary to make the decision. That is the difference between analytical complexity and executive utility.
Complexity belongs inside the methodology, not inside the decision-maker's experience.
This Isn't the End of the Question
CyberCore doesn't answer everything and nor should it.
There is a question I'm particularly interested in exploring next.
If, for example, an organisation spends £1 million mitigating risk and another £1 million transferring it, what financial value does each investment produce?
In other words, What is the bang for buck?
How much risk reduction is achieved for each pound spent on mitigation?
How much financial exposure is transferred for each pound spent on insurance?
And how long does that benefit persist before controls require further investment?
Those questions take us beyond cyber risk quantification and towards something broader:
The economics of sustained resilience.
I think there is considerable work still to do there and the CyberCore visuals are the start of that journey.
So, How Much Cybersecurity Is Enough?
After ten papers, my answer is perhaps less dramatic than some might expect. There isn't a universal number or a percentage of turnover. There isn't an industry benchmark that can answer the question for every organisation.
"Enough" depends upon:
what matters to the entity;
the plausible financial consequences of losing it;
the uncertainty around those consequences;
the effectiveness of existing controls;
the ability to transfer risk;
the capacity to absorb residual loss;
and the resources available.
The objective isn't to eliminate cyber risk but to make an informed, defensible decision about how much to reduce, transfer, accept and avoid. That was the question behind this series and is is also the reason we built CyberCore.
And Finally...
At the beginning of this series, I recounted a story Jack Jones once told me from the early days of FAIR.
His manager asked:
"If we don't fund this cybersecurity solution, how much risk will we have?"
"A lot." He replied.
"And if we do fund it, how much less risk will we have?"
"A bit less."
FAIR made an enormous contribution by showing that cyber risk could be quantified. The challenge now, I believe, is to make that kind of thinking sufficiently practical that it becomes part of routine executive decision-making.
Because after all the frameworks, technology, mathematics and terminology are stripped away, the question remains remarkably simple:
How much risk do we have, what are we going to do about it, and can we justify the investment?
If we can answer those three questions well, we're probably doing something right.
Final thought for the series:
"Good cyber risk management doesn't eliminate uncertainty. It makes uncertainty sufficiently clear to support a defensible decision."
