Many organizations start their cyber risk quantification (CRQ) program by identifying their top 10-20 cyber and technology risks based on loss exposure in dollars. It’s a quick way to prove the analysis power of the RiskLens CRQ platform and gives direction for cyber risk analysis work going forward. Here are some use cases for cybersecurity top risks analysis to support tactical and strategic decisions.
Organizations typically have a long list of perceived risks centered on concerns (data breach, business interruption), assets to be protected (a crown jewel database, an order fulfillment system) and threats (insider or external). Bringing FAIR™ (Factor Analysis of Information Risk) to bear, analysts can boil these down to loss event scenarios that can be quantified for probable frequency and magnitude of impact, then ranked for loss exposure leveraging product features that drive rapid risk analyses. Top risk analysis is often performed for a business unit or line of business but could cover the entire enterprise.
RiskLens Top Risk Reporting
2. Identify top risks for deeper analysis to drive cybersecurity investment decisions.
The most severe risks are candidates for deeper analysis on the RiskLens platform to understand the drivers of risk and what would be the most effective mitigations to reduce loss exposure in dollar terms. With RiskLens Risk Treatment Analysis, analysts can compare the effect of various controls – factor in the cost of the controls and you have a comparative cost/benefit analysis.
3. Identify lines of business (or assets or attack vectors or more) with greatest loss exposure.
Top risk assessments can show enterprise or business-unit risk managers where risk may be lurking in unsuspected places. With RiskLens, they can track risk across the organization using Portfolios, highly flexible, automated reporting with customizable dashboards that aggregate risk scenarios by business unit, revenue stream, strategic initiative, assets, attack vectors or any other category the organization might demand.
RiskLens Portfolio Reporting by Business Unit
4. Report to the board and senior management on cyber risk in a handy, business-friendly (and regulator-friendly) way.
Risk and security organizations can show their boards and regulators that they are proactively looking out for risk exposure in financial terms, particularly at material levels. The RiskLens platform generates top risk reporting in non-technical terms ready for presentation, and exports reporting via API to popular dashboards such as Microsoft Power BI, Oracle, SAP or Tableau to incorporate in the ongoing reporting in the organization.
5. Respond to policy exception requests, audit findings or compliance gaps.
How does an infosec team prioritize among five different “high risk” audit findings – particularly when they suspect none of them are truly high risk? A quick top risk analysis, drawing on RiskLens Data Helpers, the prepackaged frequency and magnitude data pulled from the organization’s records or standard industry data, sorts it out. Similarly, prioritize among compliance actions for NIST CSF or other standards and frameworks by mapping risk scenarios to the recommendations, then ranking the risks for loss exposure.
