Making risk work for you

The government faces a daunting task securing federal networks. From the rise of wiperware—a class of malware that maliciously erases data on an infected device—to the proliferation of cybercrime-as-a-service, federal network defenders are confronting an increasingly dynamic and dangerous threat environment.

Agencies are often focused on mitigating threats and vulnerabilities. While those are crucial aspects of a strong cybers posture, they are only one part of a comprehensive strategy. A more holistic approach to risk management is needed to keep the federal government well protected from an increasing array of malicious activity. 

Effectively managing risks requires agencies to thoroughly understand and mitigate the potential impact and consequences of a cyberattack—not only to their own networks but to the federal government's overall operations.

What is risk and how can you use it to your advantage?

It's always instructive to take a step back and examine the foundations of an effective cyber risk management program. That starts with understanding what risk really means. 

The Institutes Risk and Insurance Knowledge Group defines cyber risk as the "risk of financial loss, disruption, or damage to the reputation of an organization from some sort of failure of its information technology systems."

After understanding what risk means, you can use a simple equation to calculate your own cyber risk. Risk is a combination of the likelihood of a bad thing happening and the consequences that would result if it did. The likelihood of an attack is a factor of threat (what's coming at you) and vulnerability (what weaknesses might allow the threat actor to succeed). That leads to: Cyber Risk = factor of Threat x Vulnerability x Consequence.

The key lesson from this equation is the importance of assessing all three factors—threat, vulnerability and consequence. Without that trifold view, agencies can't truly consider how to mitigate each individual risk scenario. For example, if an agency is only focused on threats and vulnerabilities, they will not be able to assess or mitigate cyber risk effectively because they don't know the consequences of an attack and how to mitigate them.

Focusing on finding ways to reduce the impact of a cyber incident can also help hedge against a rapidly changing threat. For example, if you can find ways to reduce your dependence on a secure and reliable network always being available, you can reduce the impact of disruptions to that network regardless of the cause.

Everyone plays a part in effective cyber risk management

Federal employees, especially those who aren't working to keep technology up and running, may not see or understand their own role in managing cyber risk. While it's easy to assume that the CISO and the security team are primarily responsible for managing cyber operations, the reality is that everyone should be involved in this effort. 

In the same way an electrician can't possibly know the far-reaching impacts a power outage might have on a business, federal cyber managers cannot be expected to know every possible consequence to the organization's mission of a cyber incident. That's where on-the-ground agency workers can help. They might not know the ins and outs of defending against a cyberattack, but they know what will happen if systems go down because they work in those systems day in, day out. 

Agency leaders need to set the appropriate risk tolerance level and then the entire organization—from operations and finance to communications and legal—must work together to assess, prioritize and decide how to mitigate cyber risks. Even the most comprehensive and well-crafted cybersecurity risk management policies and processes are useless if they aren't adequately socialized, implemented, and exercised across an agency or even, in some cases, governmentwide. 

Cyber risk management is a journey, not a destination

Much like the digital transformation and modernization the federal government has been engaging in over the last couple decades, cyber risk management is not a one-and-done activity. It is not a destination where agencies can rest.

With every change that is introduced a potential new risk is also added. As a result, it's essential to regularly reassess those risks, understand the impacts they might have on an agency and then adjust plans and policies accordingly. 

Beyond those organizational challenges, attackers are not using the same old exploits. They are evolving at lightning speed, so agency IT and cyber teams need to keep that mindset about their cyber risk management strategies. 

It's important to communicate these new or updated risk management plans and procedures to all those who are involved since, as stated above, this is a challenge for everyone in the organization to take on together.

Managing cyber risk for the federal government—an organization that holds some of the most sensitive information in the world—can seem insurmountable. But private sector experts have developed ways that make it relatively simple, as long as the process is followed, and everyone buys in. It will take a huge effort, but with the proper planning in place, agencies can take on this new and evolving threat landscape.