Independent business risk study shows cybersecurity is seldom fully integrated into business strategy – and it needs to be.
Picture this: a headline-grabbing vulnerability has been disclosed. It’s all over the news and social media. It involves software being used by nearly every business on the planet. The board is demanding answers and your C-level executives are running around with their hair on fire. Your CEO calls an emergency meeting. The first question she asks you is: “How secure are we?”
Are you prepared to answer?
If so, you’re one of the lucky ones. According to a study conducted by Forrester Consulting on behalf of Tenable, only four out of 10 security leaders say they can answer the question, “How secure, or at risk, are we?” with a high level of confidence.
If you’ve spent more than a minute in cybersecurity, you know why answering this question is far more challenging than it might seem.
Sure, you can provide data about how many systems are affected and how quickly your team can remediate. But all this data isn’t going to give your CEO the answers she is looking for. What she really wants to know is: Will our ability to deliver on our core business value be negatively impacted as a result of this vulnerability?
The commissioned Forrester study — which is based on a survey of 416 security and 425 business executives in 10 countries — reveals a disconnect in how businesses understand and manage cyber risk. According to the study, The Rise of the Business-Aligned Security Executive, an alarming 66% of business leaders are – at most – only somewhat confident in their security team's ability to quantify their organization’s level of risk or security. The study also reveals that:
- Fewer than 50% of security leaders are framing the impact of cybersecurity threats within the context of a specific business risk.
- Only half of security leaders (51%) say their security organization works with business stakeholders to align cost, performance and risk reduction objectives with business needs.
- Only 43% of security leaders report they regularly review the security organization’s performance metrics with business stakeholders.
- Less than half of security leaders (47%) consult business executives with a high level of frequency when developing their cybersecurity strategy. On the flip side, four out of 10 business executives (42%) rarely — if ever — consult with security leaders when developing their organizations’ business strategies.
- Just 54% of security leaders and 42% of business executives say their cybersecurity strategies are completely or closely aligned with business goals.
“The biggest challenge when talking to business leaders is trying to keep it non-technical and business focused, or being able to translate tech-speak to business-speak,” said Kevin Kerr, CISO of Oak Ridge National Laboratory in Oak Ridge, TN, in an interview with Tenable. “If you don't understand the business, you can't do that. You need to understand where their fears lie, what they think the threats are and what they think is important. If you understand their business, you know what they're trying to do, what they're trying to protect, what they're trying to monetize; you present them the best way to do that securely to meet the standards you’re supposed to be held accountable to [while also] allowing them to have the freedom to do their business.”
Understanding business context
Getting to the business context of cyber risk isn’t easy, and the answers will differ from one organization to the next.
“Risk is a term that business executives know and fear, and it is also well known in cybersecurity,” said Cesar Garza, CISO of Home Depot Mexico in San Pedro, Mexico. “We cybersecurity professionals deal with risks every minute: vulnerabilities, code flaws, the human factor, broken processes, deprecated technology, misconfigurations, etc. Risk is the common factor between the language of cybersecurity and business executives. It is the common ground. But still, it is a challenge to translate cybersecurity risks into business risks that need to be understood by executives. In some cases, we need to picture the worst-case scenario, talk about concerns such as fines, brand damage and losing customer loyalty to truly send the message. So, I like to say: ‘let’s talk about risks so we can understand our cybersecurity investments.’ “
In order to provide business context, security and risk management leaders must first be able to answer two key questions:
- What is your organization’s core value creation? In manufacturing, the answer may be to make and sell widgets for profit. In healthcare, the answer may be to provide medical care to patients. In government, the answer may be to provide a service to the public, such as issuing driver’s licenses or taking care of trash disposal.
- Which of your IT assets are crucial to delivering on that core value creation? For example, is there an ERP system or medical records app or database which, if taken offline, would cause your business operations to grind to a halt? Are there groups of users whose computers, if compromised, would expose key intellectual property or sensitive data that could prevent the organization from delivering on that core value? Is there a cloud environment which, if taken offline, could derail an important customer-facing web service, such as a banking or ecommerce site?
“It's really having good business partnerships or check-ins with the various business leaders to understand what are the initiatives that are going on with the business,” said Rick Vadgama, VP and CISO for a global travel platform in Needham, MA, in an interview with Tenable. “If they lost a system or a function, how would that impact the revenue stream? Based on that, we’d know from a security perspective where we should be spending effort and time in making sure that we have a good readout of all the assets that make up that [system] and understand what the vulnerabilities are. As infosec leaders, our environments are very vast. By really working with the business leaders, you hear firsthand what they understand are the key systems they can’t live without and [you can] then place the efforts around that.”
While improving your understanding of business context is crucial, it’s also important to recognize that, even with such understanding, existing asset management and configuration databases can only take us so far. For starters, asset inventories and configuration management are fairly static operations. In my experience, most organizations are limited to conducting an annual risk assessment or business impact analysis on critical business functions. Such a static approach is hardly sufficient to capture the realities of the modern attack surface, which comprises a dynamic mix of on-premises and cloud-based IT, internet of things (IoT) and operational technology.
For example, in most large organizations, cloud services are spun up and down every day on an as-needed basis. Computing assets are added and removed constantly as employees join or leave an organization. Applications and software are continuously implemented and upgraded as business needs change. And, in response to the COVID-19 pandemic, vast numbers of employees around the globe have shifted to a work-from-home model that is likely to set a new paradigm for how businesses operate. With today’s business moving at the pace of digital commerce, asset inventories are unable to keep pace. Security leaders are left to use the tools at their disposal to develop as comprehensive an understanding of asset criticality as possible.
“The pace of growth being experienced, which is especially relevant in an industry that normally grows inorganically, together with the portion of ambiguity when performing qualitative risk assessments, are among our biggest challenges as security professionals,” said Jose Maria Labernia Salvador, head of IT security and internal control at LafargeHolcim IT EMEA in Madrid, in an interview with Tenable.
Along with doing the work of identifying your critical business assets, you also have to be able to prioritize which of the tens of thousands of threats and vulnerabilities facing your organization each year actually pose the greatest risk to those core assets. Security leaders need to balance the threat from a vulnerability or attack method with the business impact of remediation or mitigation. Basically, you need to understand how exposed you are to the issue, how quickly you can address it using the robust processes in place and what effect it would have on your core business value to do nothing versus addressing the issue.
When the next headline vulnerability lights up your C-suite, will you be ready?
At the end of the day, your C-level executives are most likely not cybersecurity experts and they are most certainly not vulnerability experts. All they really want to know is: What impact does our cybersecurity practice have on the business of value creation? A business-aligned approach — in which you can confidently evaluate how many vulnerabilities are critical to the assets that have the greatest effect on your core areas of business — enables you to develop a clear answer to the question “how secure, or at risk, are we?”
Earlier this month, we explored findings from the Forrester study that highlight the disconnect between cybersecurity and business leaders. Over the next several weeks, we’ll continue to explore report findings about the technology, process and data challenges facing cybersecurity leaders and provide guidance on how you can become a business-aligned executive. In our next installment, we’ll discuss COVID-19 response strategies as a real-world example of the cyber-business disconnect.
Learn more:
- See additional study highlights here
- Visit our webpage for more information
- Download the full study, The Rise of the Business-Aligned Security Executive
- Read the blog, Aligning Cybersecurity and the Business: Nobody Said It Was Easy
- Download the white paper, What It Takes to Be a Business-Aligned Cybersecurity Leader