Risk Assessments/Management, Security Strategy, Plan, Budget

Risk management is complicated, but keep the end goal in sight

A U.S. Air Force air traffic controller scans the horizon for landing lights and obstructions on the flight line at Aviano Air Base, Italy, May 7, 2021. (Airman 1st Class Brooke Moeder/Air Force)

At Wednesday's sessions of InfoSec World, eSentire vice president of cyber risk advisory and solutions architecture Tia Hopkins argued that the key to risk-based security models was keeping the end goal in mind.

"It's kind of like when we go to plan a trip, and we want to go to the beach in Miami. But we start to look at flights and rental cars and hotels, and by the time we're done, we're going skiing in Colorado because we got wrapped around the axle of the details," she said.

Risk-based approaches to cybersecurity offer some distinct advantages over compliance models (check-marking minimum standards) or maturity models (improving the security stack on all fronts simultaneously). By focusing on the most important risks, whether they are specific vulnerabilities on the network or specific activities of likely attackers, organizations can better manage their use of resources. It's cheaper, faster and more agile to focus on the most significant problems than to focus on everything.


Click here to register for InfoSec World to watch the full keynote fireside discussion, and access the rest of the Nov. 9-10 conference agenda.

But risk modeling places a lot of emphasis on getting the framing right. It's easy to think your way into a knot, said Hopkins.

"I've seen all too often that teams get wrapped around the axle in terms of process or technology or feature functionality. And they end up somewhere entirely different from where they initially intended," she said.

The solution is to begin with the end in mind, said Hopkins. Your goal should be easily articulable in terms of an easy to communicate metric — for example, the dollar value of the risk reduction over time or cost. Simple framing isn't just good for communicating goals and progress with executives whose eyes glaze over with discussion of technical details. It's a way to prevent hyperfocus on minutia from taking over projects.

"Quantifying cyber risk should not require a degree in mathematics," she said. "It really shouldn't."

Joe Uchill

Joe is a senior reporter at SC Weekly, focused on policy issues. He previously covered cybersecurity for Axios, The Hill and the Christian Science Monitor’s short-lived Passcode website.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.