3 ms·

Yep, this. OMG THIS! There are three things that most security types don’t understand: 1. Security is a small component of risk. Impact (in dollars) x Likelih

Yep, this. OMG THIS! There are three things that most security types don’t understand: 1. Security is a small component of risk. Impact (in dollars) x Likelihood = Risk 2. Cybersecurity insurance can change the risk equation dramatically 3. It is possible for a security remediation to kill/harm more people than the underlying insecure system that the fix is being applied to Once you realize that security is a risk problem then you’re able to quantify that problem in dollars. Lives affected can be used as a metric too but dollars are the magical language that everyone can understand.

kenniskrag 5y ago
> Cybersecurity insurance can change the risk equation dramatically Do they check if you implement best practices in security? I could imagine, that this will have an impact on the premium.
- windowsworkstoo 5y ago
  Yes and the audits around this change arbitrarily each year and you will be denied coverage if you are doing something otherwise competent but miss their particular flavour of the year
austinjp 5y ago
Fully agree that impact x likelihood = risk, although I'd extend it beyond dollars. Impact can include reputation, health, etc. Certainly these could be measured using cash-value as a proxy, but this risks chasing the wrong metric. I also recognise that "when a measure becomes a target it ceases to be a good measure", and cash as the bottom line risks increasing this tendency. Too idealistic, probably :)
- faeyanpiraat 5y ago
  Corps don’t care about your health, they care about you being healthy enough to bring in the dough. And when you accept this fact, you can skip lamenting about all sorts of ethical questions and just know that everything will be a monetary decision in the end.
- aahortwwy 5y ago
  Using cash-value as a proxy for impact gives you many benefits. Here are two particularly good ones that are relevant to planning security work: 1. It clarifies your thinking around impact. The simple exercise of sitting down and trying to put a dollar amount on the reputation damage your organization would suffer if Bad Thing were to happen will help you better understand the likelihood and potential consequences of Bad Thing. 2. It allows for more easy comparison to the costs that will be incurred while mitigating the risk. If you think the impact of Bad Thing will be "significant reputation damage", that's bad, but it doesn't help you decide how much time, effort, and money you ought to dedicate to preventing Bad Thing. Blindly chasing metrics can lead to pathological behaviour, for sure, so you need to balance that with strong cultural values, but overall I would say the security industry is terribly heavy on cultural values right now and pays little to no attention to measuring what actually matters to organizations.
rjzzleep 5y ago
I just went through a "risk triage" they called it for a client and while the client is more focused on being able to work AT ALL the risk triage is solely focussed on the monetary damage of losing IP and data. Two things: 1. Security to some extent doesn't always need to impede engineering. Enterprise IT security is very much focused on removing risky behaviour, without providing any alternatives. 2. The cost to the business losing IP it cannot generate due to excessive security practices should be taken into account when doing these exercises. I'd argue that the security part of this organization has gone "rogue" and is solely focused on justifying its own existence. It's as if the security part is more focused on reducing liability for itself than it is on actually securing systems. That said, I still think that most organizations put too little emphasis on security, not too much. And oftentimes, too late. EDIT: an analogy I like to use is that oftentimes these people try to build a castle surrounded by massive walls without doors or gates, but since people inside still have to get things from the outside they just dig a tunnel circumventing the whole thing. But since it wasn't approved there is no liability problem for the security part of the org.
Kalium 5y ago
I've found that using a risk-based approach to security requires a mature organizational framework for handling risk. A mature risk management process keeps good records of how risks are handled, what the estimated impact and likelihood are, will promote accountability, and will learn when risks are realized. An immature one, of the sort many companies have, may have difficulty with some or all of these steps. Often the immaturity is invisible until it's too late - an impact or likelihood is far higher than estimated (and thus your quantification was wildly off and you took your estimate too seriously), there's no organizational accountability (so nobody who makes serious mistakes has to learn from it), and so on. I don't know how many SaaS startups have mature risk management processes, but I know I've seen companies well beyond the startup stage that suffer from immature ones.

kenniskrag 5y ago

> Cybersecurity insurance can change the risk equation dramatically Do they check if you implement best practices in security? I could imagine, that this will have an impact on the premium.

windowsworkstoo 5y ago
Yes and the audits around this change arbitrarily each year and you will be denied coverage if you are doing something otherwise competent but miss their particular flavour of the year

austinjp 5y ago

Fully agree that impact x likelihood = risk, although I'd extend it beyond dollars. Impact can include reputation, health, etc. Certainly these could be measured using cash-value as a proxy, but this risks chasing the wrong metric. I also recognise that "when a measure becomes a target it ceases to be a good measure", and cash as the bottom line risks increasing this tendency. Too idealistic, probably :)

faeyanpiraat 5y ago
Corps don’t care about your health, they care about you being healthy enough to bring in the dough. And when you accept this fact, you can skip lamenting about all sorts of ethical questions and just know that everything will be a monetary decision in the end.
aahortwwy 5y ago
Using cash-value as a proxy for impact gives you many benefits. Here are two particularly good ones that are relevant to planning security work: 1. It clarifies your thinking around impact. The simple exercise of sitting down and trying to put a dollar amount on the reputation damage your organization would suffer if Bad Thing were to happen will help you better understand the likelihood and potential consequences of Bad Thing. 2. It allows for more easy comparison to the costs that will be incurred while mitigating the risk. If you think the impact of Bad Thing will be "significant reputation damage", that's bad, but it doesn't help you decide how much time, effort, and money you ought to dedicate to preventing Bad Thing. Blindly chasing metrics can lead to pathological behaviour, for sure, so you need to balance that with strong cultural values, but overall I would say the security industry is terribly heavy on cultural values right now and pays little to no attention to measuring what actually matters to organizations.

rjzzleep 5y ago

I just went through a "risk triage" they called it for a client and while the client is more focused on being able to work AT ALL the risk triage is solely focussed on the monetary damage of losing IP and data. Two things: 1. Security to some extent doesn't always need to impede engineering. Enterprise IT security is very much focused on removing risky behaviour, without providing any alternatives. 2. The cost to the business losing IP it cannot generate due to excessive security practices should be taken into account when doing these exercises. I'd argue that the security part of this organization has gone "rogue" and is solely focused on justifying its own existence. It's as if the security part is more focused on reducing liability for itself than it is on actually securing systems. That said, I still think that most organizations put too little emphasis on security, not too much. And oftentimes, too late. EDIT: an analogy I like to use is that oftentimes these people try to build a castle surrounded by massive walls without doors or gates, but since people inside still have to get things from the outside they just dig a tunnel circumventing the whole thing. But since it wasn't approved there is no liability problem for the security part of the org.

Kalium 5y ago

I've found that using a risk-based approach to security requires a mature organizational framework for handling risk. A mature risk management process keeps good records of how risks are handled, what the estimated impact and likelihood are, will promote accountability, and will learn when risks are realized. An immature one, of the sort many companies have, may have difficulty with some or all of these steps. Often the immaturity is invisible until it's too late - an impact or likelihood is far higher than estimated (and thus your quantification was wildly off and you took your estimate too seriously), there's no organizational accountability (so nobody who makes serious mistakes has to learn from it), and so on. I don't know how many SaaS startups have mature risk management processes, but I know I've seen companies well beyond the startup stage that suffer from immature ones.