Understand, Manage, and Measure Cyber Risk: Practical Solutions for Creating a Sustainable Cyber Program

Table of Contents
About the Author
Acknowledgments
Foreword
Introduction
Part I: The Problem
	Chapter 1: What Is the Problem?
	Chapter 2: Why Is It Complicated?
		Technology Is Everywhere
		Technology Is Complex
		Technology Was Built on Trust
		Technology Is an Opportunity for Misuse
		The Fundamental Risk Is Not Always Understood
		... and Business Leaders Need to Know What to Do
			Lack of a Common Cybersecurity Risk Language
			Unclear Answers for Proper Oversight
			Oh, and Umm... Distractors
	Chapter 3: How to Address This Problem
		Understand the Risk
		Manage the Risk
		Measure the Impact of Risk Management
			Choose Risk-Informative Measures
			Apply Appropriate Resources
			Drive for Value
			Be Clear on What to Measure
			Avoid Chasing “Perfect” (It’s Not That Valuable)
Part II: The Solution
	Chapter 4: Understanding the Problem
		Rules to Follow
		Be Clear About the Problem (Critical Assets Are at Risk)
		Settle on a Definition of Risk
		Settle on a Definition of Critical
		Inventory and Categorize Critical Assets
			Step 1. Acknowledge That Asset Management Is Hard
			Step 2. Develop the Business Case
			Step 3. Define Your Asset Classes
			Step 4. Collect and Inventory in Each New Asset Class
			Step 5. Identify the Most Critical Assets
		Identify the Risks to These Critical Assets
			Step 5a. Perform a Threat Analysis
			Step 5b. Discover Vulnerabilities
			Step 5c. Anticipate the Business Impact of an Event
			Step 5e. Know the Applicable Laws and Regulations
		Understanding the Problem: A Recap
		Recent Examples
			Example 1. Getting Started with a Program
			Example 2. From Legacy “Perfection” to “Good Enough”
			Example 3. Data Protection Strategy, Please
			Example 4. What Risk?
		Pitfalls to Avoid
	Chapter 5: Manage the Problem
		General Observations and Guidelines for Managing the Risk
			Observations
			Guidelines
		Rules to Follow
		Focus on One Framework
		Structure the Program Approach
			Step 1. Set the Structure
			Step 2. Align the Risk Mitigating Activities
			Step 3. Assign Roles and Responsibilities
			Step 4. Identify Gaps and the Appropriate Activities to Fill Them
			Step 5. Look Externally (Third-party Risk Management)
			Step 5a. Split the Questionnaire into Logical Columns
			Step 5b. Build Each Column upon the One Before
			Step 5c. Directly Relate the Question to the Risk
			Step 6. Pick the Right Tools and Avoid Distraction
		Set a Program Review Frequency
		Prepare to Respond and Recover
		Managing the Problem, a Recap
		Recent Examples
			Example 1. Addressing Too Many Frameworks
			Example 2. Many TPRM Tools
			Example 3. From Controls Focus to a Risk Strategy
			Example 4. Third-Party Without a Checklist
		Pitfalls to Avoid
	Chapter 6: Get Ready for Measures
	Chapter 7: Measure the Problem
		Rules to Follow
		Choose Informative Measures That Provide Actionable Values
			Step 1. Choose Actionable Measures
			Step 2. Define Clear Addressable Activities
			Step 3. Provide Actionable Reviews
		Research What Others Have Done (Measures That Have Worked)
			Metrics That Have Worked
		Be Clear About the Math
			Straight Math
			Less-Than-Straight Math
		Gain Buy-In from Stakeholders
		Develop a Reporting Structure for Consistency
		Allow Measures to Mature Over Time
		Recent Examples
			Example 1. Simple Measures Anyone?
			Example 2. Too Much Data, Not Enough Information
		Pitfalls to Avoid
	Chapter 8: Report Upward
		Rules to Follow
		Choose a Consistent Report Structure
		Provide Clear and Informative Measures
		Use Straightforward Terms
		Provide Recommendations for All Problems
		Pitfalls to Avoid
	Chapter 9: Questions Boards Should Ask
		A Tear Sheet for Boards
	Chapter 10: Conclusion
		First, Understand the Risk
		Next, Manage the Risk
		Then, Measure the Risk
		Go Forth and Prosper
Appendix
	Illustration
	Step 1. Set the Structure
	Step 2. Align the Risk-Mitigating Activities
	Step 3. Assign Roles and Responsibilities
	Step 4. Identify Gaps (Including Third Parties) and the Appropriate Activities to Fill Them
	Step 5. Set the Action Plan
Index