Unreasonable Security Best Practices vs. Good Risk Management

Years ago, I spoke with the risk management leader at a bank where I was consulting. This person was new in the role and was outlining plans for implementing an IT risk management program. The company's program was to be based on the NIST 800 series, which predates the creation of NIST Cybersecurity Framework, and they had worked out their own proprietary risk rating system based on the control catalog in SP 800-53. It was well thought out and the leader had some success in a previous role working with the same solution.

Ultimately, the risk ratings assigned as a result of this process came down to the personal opinion of the assessors. But the real trouble with this approach was that the security leader held the viewpoint that, eventually, the process would result in all of the controls in NIST SP 800-53 being implemented. As a result, the model they developed was designed to give good risk ratings when more controls were implemented and bad ratings when those controls were missing.

This person is not alone in the belief that more controls equal less risk. Far too many risk registers are truly just lists of broken or missing things. So sure are we in the belief that we need more security that we tend to believe that only perfection will do. Security conferences are rife with these axioms, such as "we need to get it right every time; hackers only need to get it right once." Such views are pessimistic and dissuade business leaders from taking the actions they need to properly secure themselves. Why should they bother if they can't get it perfect?

I often say that we need cybersecurity professionals doing blocking and tackling who believe they can stop 100% of the things trying to break in. I think that mindset is important for high-quality threat management and security operations. However, I know they will eventually fail. This doesn't mean that their efforts are pointless. Indeed, what we must celebrate are the small wins and consistent behaviors, not perfection.

Control frameworks aren't to blame; they are simply cataloging the world of possibilities. The blame falls to broken risk models that leverage a "gotta catch 'em all" approach to security controls. This approach pretends there is a linear relationship between security controls and loss exposure. This ignores critical variables such as frequency of attack, attacker capability, and an organization's tolerance for loss.

Such "collector" approaches to risk management find their way into auditing frameworks that so often purport to be risk-based but instead treat every missing or deficient thing as the risk itself. This approach has allowed risk statements expressing zero appetite to make their way to senior executives and corporate boards. Well-meaning risk appetite statements such as "we don't accept any cyber-related risk" are virtually impossible to put into action in organizations with limited budgets (and all are limited). Accepting zero risk means that you would spend every dollar an organization has to avoid a loss, and even then, no one can guarantee a future with zero incidents.

A mature way to talk about cyber-risk appetite is using some non-zero loss amount as a guide. Statements about risk and loss should focus on the range of the amounts that could be lost and the timelines over which such a loss could occur. These ranges are necessary because we're discussing future events that may or may not come to pass, and, as such, any specific measures that may be made about appetite are going to be wrong.

The Goal of Effective Risk Management
Effective risk management enables an organization to attain an acceptable amount of loss over time with the least amount of capital expenditure. In other words, we're trying to balance money spent today to reduce risk against the probability of some amount of loss at a future time. Nowhere in good risk management is the notion of perfect risk avoidance. Such a focus on risk would choke off innovation and good business management.

First, every dollar spent on risk reduction cannot be spent on the mission of the organization. As a result, risk reduction investments necessarily mean mission curtailment. Second, without the right amount of freedom to operate without safeguards in place, business innovation is also curtailed.

Navigating Risk
Having a good model that represents the nature of risk accurately is important if you intend to navigate risk and approach risk elimination through a security controls process. Further, such a model should support the modern needs of organizations, such as the purchase of cyber insurance and/or setting aside money for risk allocation (risk-based capital). The FAIR Institute was established to promote the open source FAIR standard for cyber-risk quantification. The FAIR model lets you scope and model risk scenarios in a way that is meaningful to the leaders of that organization. It ties things like missing controls and audit findings to statements of loss that allow decision-makers to make well-informed and risk-aware decisions.

Further, it gives companies the opportunity to express those cyber loss scenarios to which they are exposed in terms that are meaningful and actionable: economic impact. For example, FAIR lets an organization express why a control from that voluminous catalog is meaningful by linking it to the company's potential for loss, impact to customers, and/or its implications to insurance and risk-based capital. In other words, this links technology failures to business impacts. FAIR also enables practitioners to demonstrate how implementing a solution will reduce risk by expressing it in terms of a risk efficacy ratio: a dollar invested in this solution reduces future loss potential by "x" amount.

Beware the allure of "best practice" models when assessing your organization's risk posture. If that model encourages you to get an A+ on a controls implementation test, you're signing your company up for an overcontrolled environment that is choking off innovation and leaching off its business plan. Instead, focus on risk navigation: Provide decision-makers with the information they need to make truly risk-informed decisions and accept that the perfect solution to an organization's cybersecurity problems may be imperfectly implemented security.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Account Fraud Harder to Detect as Criminals Move from Bots to 'Sweat Shops'."