Understand, Manage, and Measure Cyber Risk: Practical Solutions for Creating a Sustainable Cyber Program

✍ Scribed by Ryan Leirvik

• Publisher: Apress
• Year: 2021
• Tongue: English
• Leaves: 219
• Category: Library

✦ Synopsis

user level

✦ Table of Contents

Table of Contents
About the Author
Acknowledgments
Foreword
Introduction
Part I: The Problem
Chapter 1: What Is the Problem?
Chapter 2: Why Is It Complicated?
Technology Is Everywhere
Technology Is Complex
Technology Was Built on Trust
Technology Is an Opportunity for Misuse
The Fundamental Risk Is Not Always Understood
... and Business Leaders Need to Know What to Do
Lack of a Common Cybersecurity Risk Language
Unclear Answers for Proper Oversight
Oh, and Umm... Distractors
Chapter 3: How to Address This Problem
Understand the Risk
Manage the Risk
Measure the Impact of Risk Management
Choose Risk-Informative Measures
Apply Appropriate Resources
Drive for Value
Be Clear on What to Measure
Avoid Chasing “Perfect” (It’s Not That Valuable)
Part II: The Solution
Chapter 4: Understanding the Problem
Rules to Follow
Be Clear About the Problem (Critical Assets Are at Risk)
Settle on a Definition of Risk
Settle on a Definition of Critical
Inventory and Categorize Critical Assets
Step 1. Acknowledge That Asset Management Is Hard
Step 2. Develop the Business Case
Step 3. Define Your Asset Classes
Step 4. Collect and Inventory in Each New Asset Class
Step 5. Identify the Most Critical Assets
Identify the Risks to These Critical Assets
Step 5a. Perform a Threat Analysis
Step 5b. Discover Vulnerabilities
Step 5c. Anticipate the Business Impact of an Event
Step 5e. Know the Applicable Laws and Regulations
Understanding the Problem: A Recap
Recent Examples
Example 1. Getting Started with a Program
Example 2. From Legacy “Perfection” to “Good Enough”
Example 3. Data Protection Strategy, Please
Example 4. What Risk?
Pitfalls to Avoid
Chapter 5: Manage the Problem
General Observations and Guidelines for Managing the Risk
Observations
Guidelines
Rules to Follow
Focus on One Framework
Structure the Program Approach
Step 1. Set the Structure
Step 2. Align the Risk Mitigating Activities
Step 3. Assign Roles and Responsibilities
Step 4. Identify Gaps and the Appropriate Activities to Fill Them
Step 5. Look Externally (Third-party Risk Management)
Step 5a. Split the Questionnaire into Logical Columns
Step 5b. Build Each Column upon the One Before
Step 5c. Directly Relate the Question to the Risk
Step 6. Pick the Right Tools and Avoid Distraction
Set a Program Review Frequency
Prepare to Respond and Recover
Managing the Problem, a Recap
Recent Examples
Example 1. Addressing Too Many Frameworks
Example 2. Many TPRM Tools
Example 3. From Controls Focus to a Risk Strategy
Example 4. Third-Party Without a Checklist
Pitfalls to Avoid
Chapter 6: Get Ready for Measures
Chapter 7: Measure the Problem
Rules to Follow
Choose Informative Measures That Provide Actionable Values
Step 1. Choose Actionable Measures
Step 2. Define Clear Addressable Activities
Step 3. Provide Actionable Reviews
Research What Others Have Done (Measures That Have Worked)
Metrics That Have Worked
Be Clear About the Math
Straight Math
Less-Than-Straight Math
Gain Buy-In from Stakeholders
Develop a Reporting Structure for Consistency
Allow Measures to Mature Over Time
Recent Examples
Example 1. Simple Measures Anyone?
Example 2. Too Much Data, Not Enough Information
Pitfalls to Avoid
Chapter 8: Report Upward
Rules to Follow
Choose a Consistent Report Structure
Provide Clear and Informative Measures
Use Straightforward Terms
Provide Recommendations for All Problems
Pitfalls to Avoid
Chapter 9: Questions Boards Should Ask
A Tear Sheet for Boards
Chapter 10: Conclusion
First, Understand the Risk
Next, Manage the Risk
Then, Measure the Risk
Go Forth and Prosper
Appendix
Illustration
Step 1. Set the Structure
Step 2. Align the Risk-Mitigating Activities
Step 3. Assign Roles and Responsibilities
Step 4. Identify Gaps (Including Third Parties) and the Appropriate Activities to Fill Them
Step 5. Set the Action Plan
Index