Considerations

CRQ is not easy, but it is worth it.

Fundamentally, a CRQ program changes the way an organization works.

Organizations should see this transition as an opportunity for security leaders and stakeholders to learn and speak a common language for quantifying risk using a well-understood methodology. This will result in data-driven decisions that will allow organizations to minimize or mitigate risk to acceptable levels.ⁱⁱ

ⁱⁱBanga

To ensure a data-driven program, Jorge Orchilles, Chief Technology Officer at SCYTHE, states that CRQ programs must leverage a “repeatable approach using algorithms.” But what do you do with all of the data? Stephen Ward recommends that organizations “need automation and ingestion of telemetry data that exists across the environment, speed-to-delivery, and connectivity into the ‘so what.’” Security leaders must make investment recommendations, offer new technology opportunities, and implement new policies to properly communicate the risk reduction impact to enable “a decision support capability, not just a piece of paper (or a risk assessment report) that says, ‘we quantified risk.’”

During implementation, organizations must think critically about how their CRQ program will define and measure cyber risk, rather than just checking boxes to satisfy a compliance assessment. Many CRQ experts recommend leveraging Factor Analysis of Information Risk (FAIR) to enable the translation of security risks to financial terms. This includes using a cost-benefit analysis or return on investment (ROI) calculation to clearly lay out options for decision makers.

Within FAIR, risk assessment is completed in 10 steps across four stages:

Stage 1 - Identify Scenario Components

1. Identify the Asset at Risk
2. Identify the Threat Community

Stage 2 - Evaluate Loss Event Frequency

3. Estimate the Probable Threat Event Frequency
4. Estimate the Threat Capability
5. Estimate the Resistance Strength
6. Derive Vulnerability
7. Derive Loss Event Frequency

Stage 3 – Evaluate Probable Loss Magnitude

8. Estimate Worst-Case Loss
9. Estimate Probable Loss Magnitude

Stage 4 – Derive and Articulate Risk

10. Derive and Articulate Risk

FAIR Ontology (Source: The Open Group)