Quantifying Cyber Risk: A Top-down Approach

Presented by

Ariel Evans, CEO, Innosec

About this talk

Cyber risk must be measures using a top-down approach to understand the business impact of cyber risk in dollars and cents and the effectiveness of cyber controls. Bottom-up approaches stop at the system level and do not tie the business processes to the data assets and the systems, hence they lack the ability to demonstrate the effect a missing control, or a discovered vulnerability has on cyber risk. Bottom-Up methods have proved themselves to be extremely inaccurate as they measure controls on the technology level and only describe the control maturity and not its effectiveness. Control maturity is a term that is commonly used by IT to measure their ability to perform and is derived from IT governance methodologies such as CobIT, ITIL and CMMI models. From a Risk Management perspective, controls maturity has no effect on Risk because it only describes the implementation status of the control. For example, an Anti-Malware solution can be 90% mature because it is installed on 90% of the end-points. But from a Risk perspective, the policy this control is enforcing could be irrelevant to the Risk. So its effectiveness could be 0%. Measuring cyber risk by evaluating controls maturity puts the insurer in a very high exposure for loss. Learn how to quantify cyber risk in dollars and cents.

Related topics:

More from this channel

Upcoming talks (0)
On-demand talks (1127)
Subscribers (13307)
The Information Security Careers Network is the largest group on LinkedIn dedicated to helping people further their careers in IT & Information Security. Due to our partnerships, we are able to offer discounts on some of the most popular security certifications and training courses, including CEH, CISSP, CCISO, and more. www.infosec-careers.com This BrightTALK channel is an extension of the group and the ISCN website (www.infosec-careers.com), featuring webinars, presentations and resources from some of the leading names in Information and IT Security to help you develop your knowledge and get the job you're after. Key areas: InfoSec, Risk, Cyber security, Identity & Access Management (IDM / IDAM), PCI / PA DSS QSA, Governance, Policy, ISO 27001 / ISO27001, CISSP, CCNA, C|CISO, CISM, CEH, CLAS, HMG, JSP440, JSP480, Network Intrusion Detection & Prevention (NIDS / IDS / IPS), Data Privacy & Protection, DLP, Data Loss / Leakage Prevention, Encryption, Cryptography, PKI, Penetration Testing, Ethical Hacking, Firewalls (Cisco, Checkpoint, Juniper, etc.), ITIL, HIPAA, and more