The enterprise risk management approach to cybersecurity

With the seemingly endless array of cybersecurity products, tools and related "best practices" available that promise to protect an organization's enterprise and data, it is fascinating to see the continued spate of successful cyberattacks. Whether it is one-off attacks against large companies and government organizations (Target, Sony and the Office of Personnel Management immediately come to mind) or large-scale campaigns based on a software vulnerability (such as the recent WannaCry and Petya ransomware attacks), it appears that the adversaries are winning -- and winning at an increasing rate.

In an era of ever more sophisticated cybersecurity tools, how is it that we are actually backsliding as a community?

Those of us who have served as CIOs or in other senior IT roles at large enterprises understand that three factors, when combined, make it exceptionally difficult to secure an environment and prevent successful cyberattacks.

Factor 1: Complexity

In almost all large organizations, one will find tremendous complexity in the IT environment, which is a combination of legacy (most likely antiquated) systems that are still core to business operations, modern applications that are most likely built in a number of different languages and architectures, and finally a new set of applications that are running in a public cloud. In particular, software-as-a-service applications are increasingly helping organizations quickly and easily leverage new applications.

Although cloud computing and SaaS business models can enable IT organizations to reduce infrastructure costs and enable more agility to support customers, they also increase complexity. To the degree that it uses SaaS-based applications, an IT organization gives up control (and visibility) into some of its IT infrastructure while having third parties store and control sensitive data.

Not so long ago, the IT security team was responsible for protecting the organization's IT perimeter. With today's new computing and service models, a traditional perimeter often no longer exists -- or if it does, it might include protecting a number (perhaps up to dozens) of third-party cloud service and SaaS application providers.

Factor 2: Adversaries

The second factor working against our ability to protect our environments and data are the adversaries themselves. Their ability to share techniques and data makes them ever more sophisticated and persistent. Whether they are nation-states or criminal organizations, adversaries see tremendous potential for gain, and the investment needed is relatively modest.

Although estimates vary greatly, the total loss due to cybersecurity breaches is in the hundreds of billions of dollars per year. A 2016 report by Cybersecurity Ventures states that cybercrime will cost more than $6 trillion worldwide by 2019. The report's authors said they based that estimate "on historical cybercrime figures including recent year-over-year growth, a dramatic increase in hostile nation-state-sponsored and organized crime gang hacking activities, a cyberattack surface which will be an order of magnitude greater than it is today, and the cyber defenses expected to be pitted against hackers and cybercriminals over that time."

Factor 3: Lack of IT professionals

The third factor making cybersecurity defense so difficult is the lack of available talent. Again estimates vary, but Cisco said 1 million cybersecurity jobs are currently unfilled on a worldwide basis. Most large organizations struggle to find, develop and then retain such talent.

In large organizations, the complexity of the IT ecosystem requires proper management of that environment (e.g., rigorous software patching) and proper implementation and monitoring of tools to support the organization’s cybersecurity posture. Such tools include identity management and access control, firewalls and intrusion-detection systems. All those activities must be done effectively in an environment in which it is difficult to find and retain the talent necessary to implement and monitor such systems. No wonder so many organizations are struggling (more than they will admit publicly) to properly manage and secure their IT systems.

Although I believe we, as an industry, are still losing ground to our adversaries, there are some positive developments. The awareness of cybersecurity risk among CEOs, board members and leaders of government organizations has increased significantly in the past five years, and many organizations recognize that cybersecurity breaches are the greatest business risk they face.

Accordingly, organizations are becoming more sophisticated in treating the challenge as an enterprise risk management problem, and they are using tools to help them identify a rational way forward to best address that risk.

Valuable tools for reducing risk

As daunting as the challenge can be, organizations are facing the fact that they must triage the problems and focus on minimizing the risk that can do the most harm to the organization.

To that end, I want to showcase two tools that are being adopted as de facto standards for use in supporting organizations in their cybersecurity enterprise risk management efforts. The first tool is the National Institute of Standards and Technology's Cybersecurity Framework, which was developed under an executive order issued by President Barack Obama to address cybersecurity risks to the critical infrastructure sector.

In describing the framework, NIST states:

The framework helps an organization to better understand, manage and reduce its cybersecurity risk. It will assist in determining which activities are most important to assure critical operations and service delivery. In turn, that will help to prioritize investments and maximize the impact of each dollar spent on cybersecurity.

The framework outlines a rigorous seven-step process that results in an action plan to implement investments that will have the greatest positive impact on an organization's cybersecurity posture. And NIST did not develop the framework in a vacuum. It was crowdsourced with the support of more than 3,000 people from diverse parts of industry, academia and government.

Furthermore, the framework is not just about protecting systems and data. It also covers the cybersecurity life cycle, from identifying threats to implementing protections, and addresses how to detect, respond and recover from intrusions.

According to Gartner, more than 50 percent of U.S.-based organizations will use the NIST Cybersecurity Framework by 2020, up from 30 percent in 2015. Recently, President Donald Trump issued a cybersecurity executive order that directs all agencies to adopt and use the framework to address their enterprise risk management posture.

The second tool that can support organizations in their cybersecurity risk management efforts (and work in concert with the NIST framework) is the Center for Internet Security’s 20 Critical Controls. Those recommended actions provide specific and actionable ways to stop today’s most pervasive and dangerous cyberattacks.

The listings and descriptions are valuable in ensuring that an organization is investigating all appropriate controls and in communicating with non-technical executives.

The first five controls are:

1. Inventory of authorized and unauthorized devices
2. Inventory of authorized and unauthorized software
3. Secure configurations for hardware and software on mobile devices, laptops, workstations and servers
4. Continuous vulnerability assessment and remediation
5. Controlled use of administrative privileges

One can think of the first five controls as constituting basic cybersecurity hygiene. If an organization cannot implement those basic controls, it can never secure its environment. Yet many government agencies struggle to maintain an accurate inventory of what they have on their networks and devices. The complexity factor can be exceedingly difficult for large organizations to manage.

It must be remembered that NIST's Cybersecurity Framework and CIS' 20 Critical Controls are tools, not solutions in and of themselves. They can provide an organization with a roadmap for conducting rigorous and regular cybersecurity enterprise risk management processes that will significantly lower an organization's risk to catastrophic loss. The implementation of a robust cybersecurity enterprise risk management process, however, will always be dependent on leaders' sustained commitment to implementing and overseeing the process.