April 15, 2015 By Cory Mazzola 2 min read

Many organizations are grappling with a dearth of available options to effectively measure and assess cyber risk within a business context. Current data security solutions do not generally focus on or appropriately address cybersecurity risks in an enterprise environment.

Effectively quantifying and qualifying IT risks within a corporate enterprise environment can prove to be exceptionally difficult. However, it is imperative that business leaders and executives are able to understand and assess risk at a practical level to enable informed decision-making and effective enterprise governance and protection.

Data Security Framework

To help address this fundamental challenge, Aankur Bhatia worked with industry experts such as myself and Charles Carney to devise unique and innovative methods to calculate cybersecurity risks in a quantifiable manner by providing a flexible risk quantification framework. The method provides a systematic risk assessment model for effectively identifying, measuring and calculating cybersecurity risk.

The methods provide a flexible framework in data security for assessing, measuring and calculating risk based on a comprehensive set of base criteria. The scalable and customizable solution helps to address and overcome central challenges that have plagued business leaders and senior managers and provides a defensible means of assessing and mitigating cybersecurity risk.

Considering the prevalence and significance of recent data breaches and increasing regulatory and governance requirements, the risk model has innate advantages over other generic and non-cyber-specific models in data security.

Additionally, the model leverages several leading quantification techniques, such as calculation logic, dynamic simulation methods, a breach probability impact calculator, risk reduction methods and custom weighting models.

Calculating Cybersecurity Risks

In accordance with the method and system, the model leverages a comprehensive set of proprietary base criteria as well as several defined values to optimize the analysis and calculation process. The risk values can be defined and weighted in order to provide finely tuned and targeted assessment results that identify and measure actual cybersecurity risk exposure in an intuitive and defensible manner.

The risks are then weighed against a series of defined and customizable values to compute a relative monetary amount associated with a multitude of specific risk categories. Risk can be represented within the context of several relevant risk-specific categories, including likelihood, impact, efficacy of controls and magnitude of loss. Additionally, the risk calculations can be extrapolated in a representative manner to map risk, purported loss simulations and relative risk ranking.

Many values are predefined and able to calculate a wide range of risk exposure areas, such as network, infrastructure, systems, organizations and people, by weighing active vulnerabilities against purported likelihood and impact.

Based on additional input, the values can be customized and provide the highest level of accuracy and optimization for risk assessment, calculation and reporting. Accordingly, the risk quantification framework includes additional features, such as automated tools, work products, customized risk assessment logic, calculation criteria, industry comparison options, application samples, a breach probability and impact calculator, evaluation tools, simulations, metrics and scorecards.

Security has long served as a critical technical function, protecting the enterprise and its most vital assets from attack or misuse. However, in many cases, security has evolved from a stand-alone IT function and grown into a larger and often more integrated enterprise risk management program.

As security advances and matures as a corporate risk function, it requires broader understanding and reporting from a business perspective. Providing a top-down view of risk using a clearly defined assessment methodology and comprehensive technical context helps drive informed decision-making and effective executive action.

More from Data Protection

Communication platforms play a major role in data breach risks

4 min read - Every online activity or task brings at least some level of cybersecurity risk, but some have more risk than others. Kiteworks Sensitive Content Communications Report found that this is especially true when it comes to using communication tools.When it comes to cybersecurity, communicating means more than just talking to another person; it includes any activity where you are transferring data from one point online to another. Companies use a wide range of different types of tools to communicate, including email,…

SpyAgent malware targets crypto wallets by stealing screenshots

4 min read - A new Android malware strain known as SpyAgent is making the rounds — and stealing screenshots as it goes. Using optical character recognition (OCR) technology, the malware is after cryptocurrency recovery phrases often stored in screenshots on user devices.Here's how to dodge the bullet.Attackers shooting their (screen) shotAttacks start — as always — with phishing efforts. Users receive text messages prompting them to download seemingly legitimate apps. If they take the bait and install the app, the SpyAgent malware gets…

Exploring DORA: How to manage ICT incidents and minimize cyber threat risks

3 min read - As cybersecurity breaches continue to rise globally, institutions handling sensitive information are particularly vulnerable. In 2024, the average cost of a data breach in the financial sector reached $6.08 million, making it the second hardest hit after healthcare, according to IBM's 2024 Cost of a Data Breach report. This underscores the need for robust IT security regulations in critical sectors.More than just a defensive measure, compliance with security regulations helps organizations reduce risk, strengthen operational resilience and enhance customer trust.…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today