Sensible About Cybersecurity

"Remarkably difficult, as is usual in other fields. We have a traditional approach, and we face the same common issue: prioritization. Which risk is redder than the other reds? We still rely on probabilities and impact. Broadly speaking, the current approach to risks in cybersecurity has three commonalities: we are not good translating hazards to money; we are not good creating business cases for cybersecurity —that’s why it’s often perceived as costly—; finally, we are not good at achieving approvals for what we want to do. As a whole, cybersecurity is poorly understood, and we are responsible for that. I’m not saying that we still speak in terms of IT assets to top management. Nevertheless, in Corona, we have started to build a new language to speak directly to the business, referring to risks. We have managed to speak in financial terms to senior executives by leveraging on the expected loss paradigm, something we came across by, among others, exchanging ideas with Fluid Attacks. Though, it’s still an enormous challenge. The expected loss indicator is not perfect, and it’s complicated to understand. Nevertheless, it’s the best approximation we have to speak in business terms. (Interested in Expected Loss? Take a look at Risk Indicator Roundup.)

In organizations where security breaches translate quickly into money, it’s easier to connect the dots. For instance, the risk of a successful hack targeting an online banking user with USD 5,000 in his account is easy to quantify. However, a scenario where a hack reveals personal information or industrial secrets is not straightforward to numbers. In the latter, you have to analyze more. How much does it cost that someone steals you a food recipe or an industrial design? You just try to take what seems more readily available, for example, sales forecasts."

In this discipline, you don’t have to do everything. You can leave to randomness some things. Take, for example, theft. Every day, people are a victim of some theft. Yet, local institutions don’t place a policeman in every corner of the city. That’s the value of the expected loss approach because it allows you to better weight your actions. To do nothing is also a managerial decision. Sometimes it’s better to accept that some incidents happen, and when they arrive, you deal with them. Not every time you get a fever, you go to the doctor. In cybersecurity is the same. We need to be sensible about cybersecurity.

Fluid Attacks, for instance, I’m certain will always manage to breach some of my protections in the projects we work together. How much do I have to invest to be immune to them? There is no point on that. I just accept that fact, and I protect from more likely scenarios. The lie is to go until the end. You have to know when to stop. Many professionals should discard the go-until-the-end idea".