Evidence-Based Security

Conclusion: Moving Toward Measurably Better Security

Organizations nowadays understand the fact that cyberattacks target all types of organizations of every size and geography and that they need to protect themselves effectively. Organizations that have gone through a risk assessment program and drafted a business impact analysis likely already know the potential impact of cyber-related disruptions to their businesses; what they don’t always know is how well they keep those risks at bay. What remains a challenge for CISOs and C-suite peers is measuring how effective security programs are in reducing risk and what their return is on investment.

In many cases, organizations that want to show proof of reducing risk may take a checkbox approach to assessing their resiliency. They rely on complying with regulatory requirements or compliance schemes that lay the baseline for being “secure enough” and do very little more if they don’t “have to.” But this approach can only work for so long, and it is only when those organizations are ultimately breached that investments in a proper security program receive support and funding. But compliance is not a practical guide to building a security strategy, and as such, it can never be adequate. Moreover, threats vary between industries and keep evolving over time, requiring organizations to also evolve the way they treat risk. The better way forward is to move from compliance-driven risk management to data-driven risk management.

Moving to data-driven ...