Understand, Manage, and Measure Cyber Risk: Practical Solutions for Creating a Sustainable Cyber Program

Description

When it comes to managing cybersecurity in an organization, most tussle with basic foundational components. This practitioner’s guide lays down those foundational components, with real client examples and pitfalls to avoid. A plethora of cybersecurity management resources are available―many with sound advice, management approaches, and technical solutions―but few with one common theme that pulls together management and technology, with a focus on executive oversight. Author Ryan Leirvik helps solve these common problems by providing a clear, easy-to-understand, and easy-to-deploy "playbook" for a cyber risk management approach applicable to your entire organization. This second edition provides tools and methods in a straight-forward, practical manner to guide the management of a cybersecurity program. Expanded sections include the critical integration of cyber risk management into enterprise risk management, the important connection between a Software Bill of Materials and Third-party Risk Programs, and additional "how to" tools and material for mapping frameworks to controls. Praise for Understand, Manage, and Measure Cyber Risk What lies ahead of you in the pages of this book? Clean practicality, not something that just looks good on paper―brittle and impractical when exposed to the real world. I prize flexibility and simplicity instead of attempting to have answers for everything and the rigidity that results. This simplicity is what I find valuable within Ryan's book. Tim Collyer, Motorola Solutions It seems that I have found a kindred spirit―a builder who has worked with a wide variety of client CISOs on their programs, gaining a deep understanding of how a successful and sustainable program should be constructed. Ryan's cyber work in the US Department of Defense, his McKinsey & Company consulting, and his advisory and survey work with IANS give him a unique global view of our shared passion. Nicholas J. Mankovich, PhD, MS, CISPP Who This Book Is For CISOs, CROs, CIOs, directors of risk management, and anyone struggling to pull together frameworks or basic metrics to quantify uncertainty and address risk Table of Contents About the Author About the Technical Reviewer Acknowledgments Foreword 1 Foreword 2 Introduction Chapter 1: What Is the Problem? Introduction Chapter 2: Why Is It Complicated? Introduction Technology Is Everywhere Technology Is Complex Technology Was Built on Trust Technology Is an Opportunity for Misuse The Fundamental Risk Is Not Always Understood … and Business Leaders Need to Know What to Do Keep in Mind Lack of a Common Cybersecurity Risk Language Unclear Answers for Proper Oversight Oh, and Umm… Distractors Chapter 3: How to Address This Problem Introduction Understand the Risk Manage the Risk Apply a Framework Structure the Organization Set a Review Frequency Prepare to Respond (and Recover) Measure the Impact of Risk Management Keep in Mind Choose Risk-Informative Measures Apply Appropriate Resources Drive for Value Be Clear on What to Measure Avoid Chasing “Perfect” (It’s Not That Valuable) Chapter 4: Understanding the Problem Introduction Rules to Follow Be Clear About the Problem (Critical Assets Are at Risk) Settle on a Definition of Risk Settle on a Definition of Critical Inventory and Categorize Critical Assets How to Inventory and Categorize Critical Assets Step 1. Acknowledge That Asset Management Is Hard Keep in Mind Step 2. Develop the Business Case Step 3. Define Your Asset Classes Step 4. Collect and Inventory in Each New Asset Class Step 5. Identify the Most Critical Assets Identify the Risks to These Critical Assets How to Identify the Risks to These Critical Assets Step 5a. Perform a Threat Analysis How to Walk Through an Overview of a Threat Model Step 5b. Discover Vulnerabilities Step 5c. Anticipate the Business Impact of an Event Step 5d. Pull It Together in the Risk Register and Keep It Updated Step 5e. Know the Applicable Laws and Regulations Step 5f. Connect Cybersecurity Risk to Enterprise Risk Understanding the Problem: A Recap Recent Examples Example 1. Getting Started with a Program Example 2. From Legacy “Perfection” to “Good Enough” Example 3. Data Protection Strategy, Please Example 4. What Risk? Pitfalls to Avoid Chapter 5: Manage the Problem Introduction General Observations and Guidelines for Managing the Risk Observations Guidelines Rules to Follow Focus on One Framework Structure the Program Approach How to Structure the Approach Step 1. Set the Structure Step 2. Align the Risk-Mitigating Activities Step 3. Assign Roles and Responsibilities Step 4. Identify Gaps and the Appropriate Activities to Fill Them Step 5. Look Externally (Third-Party Risk Management) How to Build Out the TPRM Questionnaire Step 5a. Split the Questionnaire into Logical Columns Step 5b. Build Each Column Upon the One Before Step 5c. Directly Relate the Question to the Risk Keep in Mind How to Verify Your External Look Step 5d. Link a Software Bill of Materials to the TPRM Program Step 5e. Build a Feedback Mechanism for Vendors Step 5f. Align to Procurement and Purchasing Keep in Mind: Third-Party Risk Management Step 6. Pick the Right Tools and Avoid Distraction Set a Program Review Frequency Prepare to Respond and Recover Managing the Problem, a Recap Recent Examples Example 1. Addressing Too Many Frameworks Example 2. Many TPRM Tools Example 3. From Controls Focus to a Risk Strategy Example 4. Third-Party Without a Checklist Pitfalls to Avoid Chapter 6: Get Ready for Measures Introduction Keep in Mind: Consider the Broad View of Risk for Measurement Chapter 7: Measure the Problem Introduction Rules to Follow Choose Informative Measures That Provide Actionable Values How to Choose Informative Measures Step 1. Choose Actionable Measures Step 2. Define Clear Addressable Activities Step 3. Provide Actionable Reviews Research What Others Have Done (Measures That Have Worked) Measures That Have Worked Be Clear About the Math Straight Math Less-Than-Straight Math Gain Buy-In from Stakeholders Develop a Reporting Structure for Consistency Allow Measures to Mature Over Time Keep in Mind: Consider the Insights Recent Examples Example 1. Simple Measures, Anyone? Example 2. Too Much Data, Not Enough Information Pitfalls to Avoid Chapter 8: Report Upward Introduction Rules to Follow Rules to Follow: Report Upward Choose a Consistent Reporting Structure Provide Clear and Informative Measures Keep in Mind: Consider the Value Use Straightforward Terms Provide Recommendations for All Problems Pitfalls to Avoid Chapter 9: Questions Boards Should Ask Introduction A Tear Sheet for Boards Chapter 10: Conclusion Introduction First, Understand the Risk Next, Manage the Risk Then, Measure the Risk Go Forth and Prosper