[BreachExchange] Explaining cybersecurity threats in a decision-maker context

[Audrey McNeil]

https://gcn.com/articles/2017/01/26/explaining-cyber-in-context.aspx

As cybersecurity professionals, I’m sure you’ve  had this experience:  you
find a risk to your organization’s systems, data and reputation, and you
want to take action -- recode, deploy a web application firewall or maybe
even disconnect the system.

You don’t want to make it sound like the sky is falling, but you need time
and resources to correct the issue -- now. You discuss the vulnerability
with your team, and everyone agrees that the issue is urgent and must be
remediated.  You take your assessment of the vulnerability to leadership
and say, “We have to take our system down. It has a blind SQL injection
vulnerability that can be used to steal our data, passwords and allow an
adversary to move laterally through our network.” To cybersecurity
professionals the problem is clear, and the decision should be easy to make.

The decision maker listens to you describe the problem and says, “That is
the most important system we have. Build a plan of action and milestone,
and we’ll get the authorizing official to accept the risk and keep the
system up.”

You walk away knowing that nothing has been fixed -- that a piece of paper
won’t keep your system secure and your agency is now vulnerable to a loss
of data and customer trust when the inevitable breach makes the news.

As frustrating as this situation may be, the blame can’t rest solely on
management’s shoulders; perhaps cyber professionals should accept part of
the blame. Cyber professionals have a responsibility to identify and assess
risk, but problems won’t be remediated effectively until they can be
explained in a way that can be understood and acted on by leadership.
Putting cyber risk in context and communicating it effectively makes cyber
professionals the source of real, relevant, reliable threat information.
Effective communication helps senior executives balance the risks of the
vulnerability with the need to sustain system availability.


Because members of an effective team, from management to the mailroom, all
have their own areas of responsibility and their own language, views and
understanding of risks, threats and costs, they may not immediately
understand your perspective. To effectively communicate vulnerabilities,
the risks they pose and the threats to the organization, you must
understand what senior leaders are concerned about: the availability of
critical systems, mission sustainment, the potential loss in dollars (from
system recovery, fines, overtime, etc.) and the probability of exploit.

Once you grasp their language, views and understanding, you must be able to
explain how the vulnerability you’ve unearthed will impact everyone else in
the organization, what data and systems are at risk and the potential cost
of being compromised. While you may have a complete understanding of the
data on your systems and its potential vulnerabilities, others in your
organization may not. It’s up to you to communicate the impact across all
missions and business functions.

In short, you must connect the dots for senior leaders, mission owners,
chief financial officers and other executives. Show them how the compromise
of one application or system can mean much more than that -- the potential
compromise of every bit of data on every system in your entire organization.

Revisiting the same problem from this different direction will better
illustrate the impact of a newfound vulnerability.

Your assessment found a blind SQL injection on a public-facing web
application. You note that the system is hosting personally identifiable
information and that there are PII records  for 512,000 users in the
database across all major business lines (finance, operations, logistics,
etc.) in your organization. Your research shows that the cost of recovery
from loss of one PII record is around $221, making the total cost well over
$113 million. You have your team quickly draft a proof-of-concept exploit
to extract records from the affected database to prove that the
vulnerability is real.

A quick Google search for the site with the vulnerability reveals a
discussion board that says, “It looks like system X has a blind SQL
injection issue; has anyone figured out how to exploit it?”

You now have the data you need to communicate the scope of the problem in
the terms that are important to management.

“We have a critical issue with system X. We know it is hosting PII, with a
potential data breach price tag of $113 million. Additionally, there is
evidence this system is being targeted by hackers. We should act rapidly to
fix this.” From there, you could recommend actions that are far less
expensive than the cost of recovering from a data breach:

Removing external web access and working with the program manager or system
owner to fix the source code (emergency maintenance window).
Deploying a web application firewall to provide virtual patching and
detection/prevention of threats.

By speaking to management’s concerns, you have gained leadership’s
attention and established the potential cost if the vulnerability is
exploited. You have proved you understand their needs and have shown how
your work can support their decision making by providing realistic,
actionable solutions that will keep your organization secure.

As cyber professionals, it’s our job not only to find vulnerabilities, but
also to help decision makers understand the nature, impact and context of
each as well as help them understand the available courses of action and
their relative costs, impacts and benefits. We must learn to place cyber
issues in the language and context of our business or mission leaders. In
doing so, cybersecurity teams will gain increased credibility, decrease
attack surfaces and help decision makers understand critical tradeoffs  --
all toward the goal of improving the organization’s security posture.

Executive leadership drives the business and sometimes accepts operational
risk as part of the normal business process, but it’s up to cyber
professionals to communicate findings effectively, with context and in
terms best understood by senior executives, to ensure timely and effective
action.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.riskbasedsecurity.com/pipermail/breachexchange/attachments/20170126/84567724/attachment.html>