What’s your cyber risk exposure? Measure it with exposure management

In this article:

One of the hardest parts of being a security practitioner is convincing your superiors that you're doing a good job. After all, the security team is being paid to prevent bad things from happening, not to make good things happen. It's a negative goal, and it's pretty hard to prove a negative.

If a data breach or other major incident does occur, the security team will likely get the blame. But if nothing happens, the C-suite and other company leaders might forget the team is even there. As security expert Mikko Hyppönen said on Twitter several years ago, "Rarely is anyone thanked for the work they did to prevent the disaster that didn't happen."

How can a security team prove its value to the C-suite? What kind of numbers can justify a budget increase if there were no major breaches or incidents? How can the CISO or CSO show leadership what was prevented?

For more information:

The new concept of exposure management and its associated platforms may provide an answer. Exposure management tools can monitor known performance indicators that quantify risk reduction and demonstrate how well your team is performing.

There are several types of KPIs to show how levels of risk exposure change over time, how different groups and assets perform in terms of risk reduction, and how well remediation efforts are working.

"Exposure management helps translate technical complexity into clear, concise business language," says a recent Tenable blog post. "This translation is vital for winning executive support and for shifting security from a reactive posture to a strategic mindset."

Speaking the C-suite's language

The first step toward pleasing the suits, and getting the budget you need, is to communicate clearly and simply in terms and concepts that non-technical people can understand. This is obviously a big part of a CISO's job, but even some CISOs have trouble reducing technical terms to plain English.

"The challenge isn't the data itself," says Tenable. "On the contrary, it's often how you deliver the message."

Whether you're a CISO, a security or IT manager or even just an entry-level security analyst, explain what's going on — or what you've gone to great lengths to make sure doesn't happen — in terms that any intelligent adult can understand.

For example, you could pretend you're explaining what you've done to other guests at a cocktail party. Feel free to use analogies, especially sports ones.

Some of the people you're reporting to would probably appreciate language like "we're making incremental achievements in improving our security posture," but others might prefer something more direct such as, "we're steadily moving the ball down the field."

Next, frame the security team's accomplishments as they align to business goals. Present your security efforts in terms of financial savings, reduced risk, improved compliance and increased organizational resilience, and how they contribute to the company's overall mission.

Last, remember that executives will want to see measurable numbers and KPIs. If your company has a governance, risk and compliance (GRC) team, it can provide some quantification of risk. That won't help you much as a security practitioner unless the GRC team also reports to the CISO — but an exposure-management platform can.

How exposure management provides security-specific KPIs

Exposure-management platforms scan and inventory an organization's assets and then assess each discovered asset — authorized or otherwise — to determine how much of a risk its compromise and its security posture present to the organization and its business goals.

Because of this, an exposure-management platform can measure each asset's perceived risk and compile numbers signifying a company's overall risk profile. After remediations and upgrades, further scans and assessments will show improvements, or declines, in the risk profile over time.

"When tracked collectively," writes Tenable Product Marketing Manager Hadar Landau, "these metrics empower security teams to assess the speed and consistency of remediation; detect bottlenecks and high-risk delays across severity levels and asset owners; and focus remediation efforts where they are most impactful."

According to Landau, the Tenable One platform quantifies each asset's risk in terms of a Cyber Exposure Score (CES), and these scores can be aggregated, averaged and tracked in a number of different ways.

For example, you could compare CES scores across asset types to "identify whether specific asset types within a category disproportionately contribute to cumulative risk," Landau writes in a blog post, and then focus your remediation efforts there.

Or you could look at CES scores across cybersecurity sectors such as cloud security, identity management or vulnerability management to see which tech stacks need the most immediate attention. You could also break it down by internal department to see whether, for example, your organization's finance or HR software needs urgent care.

To get the biggest picture, you could take the average CES score of the entire organization and track it over time to see how well your remediation efforts are succeeding. If those exposures get better, that's a win for the security team you can show to the C-suite.

The Tenable One platform also keeps track of how many known vulnerabilities, misconfigurations and other weaknesses have been fixed, are still open or have resurfaced, along with how many days have elapsed since the discovery of each issue.

As with CES scores, the age and status of known weaknesses can quickly be broken out by asset type, by severity and by sector to help focus remediation efforts. They can also be averaged into mean time to remediate (MTTR) numbers, which can be tracked over time to demonstrate an improving (or declining) security posture.

Presenting these numbers to executive leadership may help in allocating resources; significant improvements in remediation times for high-priority vulnerabilities will demonstrate the benefits of your team's efforts.

Landau also recommends leveraging internal service-level agreements (SLAs), if your organization uses them to gauge performance among its departments. There may be minimum remediation standards that each department must meet; if so, these can also be tracked and analyzed over time to measure improvements in performance.

With all these numbers, she writes, "Organizations can monitor and fix trends, investigate spikes in resurfaced findings, and benchmark asset groups based on average remediation time to drive process improvements."

And all that generates KPIs that you can take to the leadership team to show how much progress you're making — numbers that may be vital if you're seeking to increase your budget, staff or inventory of tools. You'll finally have a way to show the suits what you've made sure didn't happen.

Please visit our exposure management topic page.