April 15, 2015 By Cory Mazzola 2 min read

Many organizations are grappling with a dearth of available options to effectively measure and assess cyber risk within a business context. Current data security solutions do not generally focus on or appropriately address cybersecurity risks in an enterprise environment.

Effectively quantifying and qualifying IT risks within a corporate enterprise environment can prove to be exceptionally difficult. However, it is imperative that business leaders and executives are able to understand and assess risk at a practical level to enable informed decision-making and effective enterprise governance and protection.

Data Security Framework

To help address this fundamental challenge, Aankur Bhatia worked with industry experts such as myself and Charles Carney to devise unique and innovative methods to calculate cybersecurity risks in a quantifiable manner by providing a flexible risk quantification framework. The method provides a systematic risk assessment model for effectively identifying, measuring and calculating cybersecurity risk.

The methods provide a flexible framework in data security for assessing, measuring and calculating risk based on a comprehensive set of base criteria. The scalable and customizable solution helps to address and overcome central challenges that have plagued business leaders and senior managers and provides a defensible means of assessing and mitigating cybersecurity risk.

Considering the prevalence and significance of recent data breaches and increasing regulatory and governance requirements, the risk model has innate advantages over other generic and non-cyber-specific models in data security.

Additionally, the model leverages several leading quantification techniques, such as calculation logic, dynamic simulation methods, a breach probability impact calculator, risk reduction methods and custom weighting models.

Calculating Cybersecurity Risks

In accordance with the method and system, the model leverages a comprehensive set of proprietary base criteria as well as several defined values to optimize the analysis and calculation process. The risk values can be defined and weighted in order to provide finely tuned and targeted assessment results that identify and measure actual cybersecurity risk exposure in an intuitive and defensible manner.

The risks are then weighed against a series of defined and customizable values to compute a relative monetary amount associated with a multitude of specific risk categories. Risk can be represented within the context of several relevant risk-specific categories, including likelihood, impact, efficacy of controls and magnitude of loss. Additionally, the risk calculations can be extrapolated in a representative manner to map risk, purported loss simulations and relative risk ranking.

Many values are predefined and able to calculate a wide range of risk exposure areas, such as network, infrastructure, systems, organizations and people, by weighing active vulnerabilities against purported likelihood and impact.

Based on additional input, the values can be customized and provide the highest level of accuracy and optimization for risk assessment, calculation and reporting. Accordingly, the risk quantification framework includes additional features, such as automated tools, work products, customized risk assessment logic, calculation criteria, industry comparison options, application samples, a breach probability and impact calculator, evaluation tools, simulations, metrics and scorecards.

Security has long served as a critical technical function, protecting the enterprise and its most vital assets from attack or misuse. However, in many cases, security has evolved from a stand-alone IT function and grown into a larger and often more integrated enterprise risk management program.

As security advances and matures as a corporate risk function, it requires broader understanding and reporting from a business perspective. Providing a top-down view of risk using a clearly defined assessment methodology and comprehensive technical context helps drive informed decision-making and effective executive action.

More from Data Protection

Skills shortage directly tied to financial loss in data breaches

2 min read - The cybersecurity skills gap continues to widen, with serious consequences for organizations worldwide. According to IBM's 2024 Cost Of A Data Breach Report, more than half of breached organizations now face severe security staffing shortages, a whopping 26.2% increase from the previous year.And that's expensive. This skills deficit adds an average of $1.76 million in additional breach costs.The shortage spans both technical cybersecurity skills and adjacent competencies. Cloud security, threat intelligence analysis and incident response capabilities are in high demand. Equally…

Why safeguarding sensitive data is so crucial

4 min read - A data breach at virtual medical provider Confidant Health lays bare the vast difference between personally identifiable information (PII) on the one hand and sensitive data on the other.The story began when security researcher Jeremiah Fowler discovered an unsecured database containing 5.3 terabytes of exposed data linked to Confidant Health. The company provides addiction recovery help and mental health treatment in Connecticut, Florida, Texas and other states.The breach, first reported by WIRED, involved PII, such as patient names and addresses,…

Addressing growing concerns about cybersecurity in manufacturing

4 min read - Manufacturing has become increasingly reliant on modern technology, including industrial control systems (ICS), Internet of Things (IoT) devices and operational technology (OT). While these innovations boost productivity and streamline operations, they’ve vastly expanded the cyberattack surface.According to the 2024 IBM Cost of a Data Breach report, the average total cost of a data breach in the industrial sector was $5.56 million. This reflects an 18% increase for the sector compared to 2023.Apparently, the data being stored in industrial control systems is…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today