Understand, Manage, and Measure Cyber Risk
Practical Solutions for Creating a Sustainable Cyber Program
(Sprache: Englisch)
user level
Leider schon ausverkauft
versandkostenfrei
Buch (Kartoniert)
48.14 €
Produktdetails
Produktinformationen zu „Understand, Manage, and Measure Cyber Risk “
user level
Klappentext zu „Understand, Manage, and Measure Cyber Risk “
When it comes to managing cybersecurity in an organization, most organizations tussle with basic foundational components. This practitioner's guide lays down those foundational components, with real client examples and pitfalls to avoid.A plethora of cybersecurity management resources are available-many with sound advice, management approaches, and technical solutions-but few with one common theme that pulls together management and technology, with a focus on executive oversight. Author Ryan Leirvik helps solve these common problems by providing a clear, easy-to-understand, and easy-to-deploy foundational cyber risk management approach applicable to your entire organization.The book provides tools and methods in a straight-forward practical manner to guide the management of your cybersecurity program and helps practitioners pull cyber from a "technical" problem to a "business risk management" problem, equipping you with a simple approach to understand, manage, and measure cyber risk for your enterprise.
What You Will Learn
- Educate the executives/board on what you are doing to reduce risk
- Communicate the value of cybersecurity programs and investments through insightful risk-informative metrics
- Know your key performance indicators (KPIs), key risk indicators (KRIs), and/or objectives and key results
- Prioritize appropriate resources through identifying program-related gaps
- Lay down the foundational components of a program based on real examples, including pitfalls to avoid
Who This Book Is For
CISOs, CROs, CIOs, directors of risk management, and anyone struggling to pull together frameworks or basic metrics to quantify uncertainty and address risk
Inhaltsverzeichnis zu „Understand, Manage, and Measure Cyber Risk “
Introduction Part 1: The Problem
Chapter 1: The situation
Chapter 2: The complication
Information Technology or "IT" became pervasive near 1995, and after a quarter-century of IT in organizations, managers, engineers, and board-level oversight still speak different languages. The language divide creates a disconnect in the strategy-to-management-to-tactical thread that is critical for overall organizational risk management, not to mention overall business management. This complicates the ability for these functions to align on one language for managing cyber risk.
Chapter 3: The resolution One unified approach to cybersecurity:
· Be clear on identifying the risk
· Understand the risk
· Categorize the critical data at risk
· Determine the causes, consequences, and accountability of a data breach
· Identify the business impact of a breach
· Simplify how you manage the risk
· Apply a framework
· Structure the organization (i.e., staff and management)
· Prepare to respond (... and recover)
· Build feedback mechanisms to measure the risk
· Choose risk-informative metrics, Key Performance Indicators (KPI's), and Key Risk Indicators (KPI's
· Apply appropriate resources (e.g., measuring projects, overseeing initiatives)
... mehr
Part 2: The Solution
Chapter 4: Understand the problem Knowing what "problem" you are solving is the most critical part of problem solving. It is important to spend time exploring the main issue. This typically means asking others what they see as the problem, gathering facts and opinions (and knowing the difference between them), and then establishing a recommended problem to solve that categorically encompasses all the facts you have gathered. For example, the audit team will likely talk about the problem of fines and resources to remain in compliance. The contracts team will likely talk about the risks brought about by outside companies (aka Third Parties), and the tech teams will likely talk about the immediate risks to the network, applications, or endpoints. Each team is looking at their part of the enterprise risk, but are they all looking to one specific problem that aligns them all? Typically not. So, the solution becomes the one problem everyone is solving for and helps them focus on that. In this case, that might be: critical data and systems at risk. Communicating as one problem everyone is solving for has the benefit of pulling everyone together, instead of trying to manage everyone from within their view of the problem -- risk to critical data or systems. The solution here is to get them all focused on one problem so that managing the problem is much easier -- with everyone understanding that the problem is (i.e., keeping critical data and systems secure), the management of that becomes an easier tactical activity.
Chapter 5: Manage the problem
· Guidelines up front: Settle on one approach (i.e., Framework) that best fits the business
· Complication is that no one framework fits any one organization's risk profile perfectly
· Key is to pick a framework as a starting point and modify it to the organization (and as cyber risk management matures)
· Key to resolving this is to assign roles (e.g., an adversary, a manager, a third party); remember, there is a person at the center of the problem you are trying to manage
Chapter 6: Measure the problem
· Guidelines up front: Board-level metrics are strategic, supported by tactical measures. · Objective is to communicate three things: (1) Understand what is at risk; (2) Manage that risk; and (3) Measure your management through feedback metrics
· Educate the Board on what you are doing to reduce the risk
· Communicate the value of your programs: provide insightful measures
· Mature measures: measure what you can measure now, with a focus on what you want to measure
Chapter 7: Conclusion
· Understand the risk· Categorize the critical data at risk
· Determine the causes, consequences, and accountability of a data breach· Identify the business impact of a breach
· Apply a framework
· Structure the organization (i.e., staff and management)
· Prepare to respond (... and recover)
· Choose risk-informative metrics, Key Performance Indicators (KPI's), and Key Risk Indicators (KPI's· Apply appropriate resources (e.g., measuring projects, overseeing initiatives)
Appendix: Common questions (TBD)
Appendix: Illustrations (TBD)
Chapter 4: Understand the problem Knowing what "problem" you are solving is the most critical part of problem solving. It is important to spend time exploring the main issue. This typically means asking others what they see as the problem, gathering facts and opinions (and knowing the difference between them), and then establishing a recommended problem to solve that categorically encompasses all the facts you have gathered. For example, the audit team will likely talk about the problem of fines and resources to remain in compliance. The contracts team will likely talk about the risks brought about by outside companies (aka Third Parties), and the tech teams will likely talk about the immediate risks to the network, applications, or endpoints. Each team is looking at their part of the enterprise risk, but are they all looking to one specific problem that aligns them all? Typically not. So, the solution becomes the one problem everyone is solving for and helps them focus on that. In this case, that might be: critical data and systems at risk. Communicating as one problem everyone is solving for has the benefit of pulling everyone together, instead of trying to manage everyone from within their view of the problem -- risk to critical data or systems. The solution here is to get them all focused on one problem so that managing the problem is much easier -- with everyone understanding that the problem is (i.e., keeping critical data and systems secure), the management of that becomes an easier tactical activity.
Chapter 5: Manage the problem
· Guidelines up front: Settle on one approach (i.e., Framework) that best fits the business
· Complication is that no one framework fits any one organization's risk profile perfectly
· Key is to pick a framework as a starting point and modify it to the organization (and as cyber risk management matures)
· Key to resolving this is to assign roles (e.g., an adversary, a manager, a third party); remember, there is a person at the center of the problem you are trying to manage
Chapter 6: Measure the problem
· Guidelines up front: Board-level metrics are strategic, supported by tactical measures. · Objective is to communicate three things: (1) Understand what is at risk; (2) Manage that risk; and (3) Measure your management through feedback metrics
· Educate the Board on what you are doing to reduce the risk
· Communicate the value of your programs: provide insightful measures
· Mature measures: measure what you can measure now, with a focus on what you want to measure
Chapter 7: Conclusion
- Be clear on identifying the risk
· Understand the risk· Categorize the critical data at risk
· Determine the causes, consequences, and accountability of a data breach· Identify the business impact of a breach
- Simplify how you manage the risk
· Apply a framework
· Structure the organization (i.e., staff and management)
· Prepare to respond (... and recover)
- Build feedback mechanisms to measure the risk
· Choose risk-informative metrics, Key Performance Indicators (KPI's), and Key Risk Indicators (KPI's· Apply appropriate resources (e.g., measuring projects, overseeing initiatives)
Appendix: Common questions (TBD)
Appendix: Illustrations (TBD)
... weniger
Autoren-Porträt von Ryan Leirvik
Ryan Leirvik is a cybersecurity professional who has spent the better part of two decades enhancing information security programs at the World's largest institutions. With considerable US Government and Commercial Sector experience, Ryan has employed his professional passion for cybersecurity at almost every level within an organization. A frequent speaker on the topic of information security, Ryan fields several questions on "How do I make sure I have a sustainable cyber program?" This book was written to help answer that question.
Ryan has been the CEO of a cybersecurity Research and Development company, Chief of Staff and Associate Director of Cyber for the US Department of Defense, and a cybersecurity strategy consultant with McKinsey&Company. Ryan's technology career started at IBM, and he has a Masters of IT from Virginia Tech, an MBA from Case Western Reserve University, as well as a Bachelor of Science from Purdue University. Ryan is also on the faculty at IANS.
Bibliographische Angaben
- Autor: Ryan Leirvik
- 2021, 1st ed., XVIII, 211 Seiten, Maße: 15,5 x 23,5 cm, Kartoniert (TB), Englisch
- Verlag: Springer, Berlin
- ISBN-10: 1484278208
- ISBN-13: 9781484278208
Sprache:
Englisch
Kommentar zu "Understand, Manage, and Measure Cyber Risk"
0 Gebrauchte Artikel zu „Understand, Manage, and Measure Cyber Risk“
Zustand | Preis | Porto | Zahlung | Verkäufer | Rating |
---|
Schreiben Sie einen Kommentar zu "Understand, Manage, and Measure Cyber Risk".
Kommentar verfassen