One of the most challenging aspects of working in cybersecurity is demonstrating value. Despite the breaches that dominate the news and the headlines surrounding ransomware wreaking havoc on organizations each day, the fact remains that for the vast majority, the cybersecurity department is a cost center. Business leaders do not need to understand the deeply technical aspects of the technology they use, simply the cost benefit of it. For this reason, in the industry we talk in terms of risk. Risk is the shared language between cybersecurity and the business. Risk is something that businesses understand well and is a guiding principle in decision making. We know that cybersecurity programs reduce the risk of breaches, but the question is by how much and what is the cost associated. Which leads me to the question: Is there such a thing as too much security? Well, quite frankly yes there is... The security guy inside of me is screaming “Wait no… we keep you safe, what about the data we’re charged to protect? What about the company’s reputation?”
We need to understand that most businesses do not exist to provide cyber security, but rather goods or services and more to the point, to make money. In order to make informed business decisions around an appropriate level of security we need data. That data is derived from cybersecurity metrics.
Where do you turn when you need to generate metrics surrounding cyber security? You will want to look both outward (industry-wide statistics) and inward (internal statistics).
Industry-wide statistics come from a lot of different sources for example the Ponemon Institute does an annual study related to the cost of data breaches (https://www.ibm.com/security/data-breach), which has a lot of great information in it. Verizon also releases an annual study of trends in data breaches known as the Verizon Data Breach Investigations Report (DBIR) (https://enterprise.verizon.com/resources/reports/dbir/), which breaks down data breaches by industry, attack vectors, and vulnerabilities. There are also industry-specific publications that can be referenced such as the summaries of healthcare data breaches published on the Department of Health and Human Services Office for Civil Rights website (https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf). These can be great tools to understand potential impact, threats, likelihood, and overall cost associated with real-world incidents.
Internal statistics are arguably even more important than industry-wide because they are specially focused on the risks to your organization in particular. There are many ways to generate internal cybersecurity metrics, one such way is to measure incident response. Your incident response plan and procedures should include the steps to document the incident. Some organizations use IT ticketing systems as a means to record efforts and track cybersecurity incidents throughout their life cycle. You will want to record data such as:
This will allow you to provide the data necessary to create the statistics such as:
You can also collect metrics on the effectiveness of your security awareness programs:
Your vulnerability management program is another excellent source of metrics:
Gathering this data at first will be challenging, however most of this data is simple to automate within your ticketing system, vulnerability scanner, phishing and user awareness platform, etc. Once the hard work is done upfront, we can determine:
Analyzing the data from these security metrics creates actionable intelligence that is specific to your organization. Armed with this data we can then better define the risks and the efforts of the cybersecurity department to reduce those risks. Collecting and analyzing this data will allow you to focus your resources on the projects, the technology, and people that provide the most value to the organization.
When going to the business to ask for resources, time, money, or people we ideally want to communicate to them in dollars. Security metrics can drive security leadership to spend the available resources on the things that provide the most bang for the buck. When you go to ask for the newest email security gateway complete with sandboxing, threat feeds, and all the bells and whistles, provide evidence showing email phishing as the number one attack vector faced by your organization. What about staffing? If you can show the mean time to response is not aligned with the industry average, it could be a technology, process, or a staffing problem. These can all be demonstrated with the appropriate metrics informing resource-spending decisions. Perhaps you have legacy technology in place, and it has become a liability to your organization. Showing vulnerability statistics may very well help the business understand the risk (and hidden costs) associated with keeping it around.
As cybersecurity matures (we are still a relatively new discipline) we must try to tighten the integration with our business counterparts. Security metrics help merge the business goals with security needs ultimately providing a more effective and efficient cybersecurity program.