Part 1 of 3 in a series on risk management. Click here to read Part 2 and here to read Part 3.
In this three-part blog series, we explore how it’s time to change the way we think about cybersecurity and risk management. Cybersecurity is no longer an IT problem to solve or the “necessary evil” to cost manage. Rather, cybersecurity has rapidly stormed the boardroom as a result of high-profile and costly data breaches.
In part one, we set the stage and explore the ways Covid-19 has changed our focus from protecting perimeters to protecting remote workers. In part two, we look at changes in cybersecurity at the board level. And in part three, we explore beyond Covid-19 to consider the implications of a new normal based on distributed workers, cloud-based data residency and emerging technology, and a nebulous perimeter.
Our company’s founder, Eldon Sprickerhoff, wrote in a recent blog post
that Covid-19 and resulting quarantines and travel restrictions have been a forcing function to drive companies into a distributed model. As Eldon observes, companies have had to quickly move to a remote workforce model to ensure business continuity from home. For companies relying on perimeter security defenses to protect their brick-and-mortar facility, a distributed workforce is a significant risk.
Traditionally, banks are a good analogy here. Tellers manage customer accounts, money and valuables can be protected in a central vault and physical security controls include guards, CCTV cameras and timer locks, etc. that guard against unauthorized access. It’s solid security, until you take away the building, transact digital currencies and provide access from anywhere in the world.
And that’s what happened when we all went home to work. For those companies that already had endpoint and cloud security in place, it was business as usual. But many were caught flat-footed having only invested in network security and it took mere hours to realize the limitations of this mypoic approach. In fact, our SOC and sales teams received inquiries into our endpoint and cloud security services immediately following the stay-at-home orders … and those inquiries continue today.
In 2020, the saying about hindsight being 20/20 rings ironic. In The Field Guide to Understanding Human Error, author Sidney Dekker acknowledges that it is a human tendency to first exaggerate our ability to predict an undesirable outcome (called hindsight bias) then judge those involved when an outcome does not go as planned. As we deal with a new business continuity normal, it might be easy to blame a lack of foresight that someday a legion of remote workers would break many cybersecurity contingency plans. But it’s much harder to really go there considering it’s never happened in our lifetime.
To further support this point of view, in Lewis Carroll’s Through the Looking-Glass, the Red Queen says about her own queendom, “Now, here, you see, it takes all the running you can do, to keep in the same place.” Drawn from biology theory, the Red Queen Effect tells us exactly why we’re in this state at the current time. This is a hypothesis which proposes that like biological organisms in a complex ecosystem, we must constantly adapt in order to survive. In other words, companies that didn’t require a distributed workforce, didn’t invest in facilitating one. Or, as Dekker would see it, you can’t blame firms that didn’t adopt a distributed model when it wasn’t required to do business.
In most cases, these decisions aren’t made consciously. Larger firms, or those operating in specific industries, are more accustomed to measuring risk as the key to decision making, whether it’s an investment strategy or selecting a security service provider. Risk management is a formula based on the cost of an undesirable outcome times the likelihood of its occurrence. To put it in terms of Covid-19, the cost of a breach that results from an unprotected distributed workforce is extremely costly, but the probability of a global pandemic forcing distributed workforce is extremely low (if not close to zero). Any value times zero equals zero.
So, prior to the pandemic, most companies effectively prepared to manage cyber risk. But, when it comes to cybersecurity, there is more to the risk equation. For example, how do you account for security controls that reduce risk? The equation then becomes:
Risk = (Probability of Event - Countermeasures) x Cost of Event
Quickly the formula gets more complicated as we look at costs of countermeasures, likelihood of outcomes, etc. But at its core, it’s relatively simple. In fact, we make these calculations in our everyday lives without even thinking about it.
Risk management in everyday life
Take a simple example: buying a lottery ticket. We will buy a $5 ticket for the chance to win one million dollars. But we wouldn't buy a $10,000 ticket to win $25,000. For both, the chances of winning are extremely low. But, the second case has a high risk ($10,000) with a winning differential that does not warrant the gamble.
Intuitively, we understand risk management in our daily lives. We might drive over the speed limit when we know the likelihood of being stopped by the police is low or the cost of the ticket is marginal. But the majority of us would not try to defraud a company of millions because there’s a high risk of arrest and a high price of a long jail sentence.
Consider our health. We buy health insurance because the cost of medical treatments is expensive. And, while we can’t predict the probability of a serious ailment, we can extrapolate from anecdotal evidence or even crowdsource our decisions (everyone else pays for health insurance, so I should, too). However, for most of us, making daily health-conscious decisions is not always top of mind. We eat a delicious, high-calorie meal because the instant reward outweighs our fear that this activity will cumulatively lead to a negative health outcome down the road.
We make these kinds of micro risk decisions every day that factor in the element of time. An outcome years away somehow obscures the severity of the outcome. Spending habits are another good example here. We gladly spend on travel rather than investing for retirement, because that’s decades away and obscures the risk of limited funds in the future.
The majority of us don’t live high-risk lifestyles. Those who do, take more precautions: think racecar drivers or first responders who put themselves in danger. Race car drivers wear fire protective suits and the cars have built in life-saving structures. First responders have battle-tested procedures to minimize risk of injury in a dangerous environment like a burning building or combat zone.
Hedge funds: the risk management kings
While perhaps not life threatening, there are other industries that play close to the line in a different way. Unlike mutual funds or widely understood investor pools, hedge funds (also called alternative investment funds) are free to use aggressive investment tactics to provide higher returns for their wealthy investors. Hedge funds use detailed calculations that consider macro and investment-specific factors to “hedge” the risk. For example, early hedge funds short sell stocks to offset the risks (losses) associated with longer investments in slower growth vehicles. It’s called a long/short equities model, for which investment managers take a handsome fee. And when you have wealthy investors, you better return a profit.
Early on, these buyers were more astute when it came to identifying and mitigating risks. And they had seen their share of industry attacks and fraud to realize that regulations were designed to prevent insider malfeasance and often took years to come to fruition. By the time rules came into place, they were irrelevant and obsolete.
As they pioneered investing strategies, hedge funds were the first to adopt innovative security strategies that went beyond regulatory requirements. This wasn’t over-engineering; they sought solutions to mitigate real risks. And that’s why many of them have trusted eSentire for well over a decade. They realized our model was about guarding the firm’s assets, regardless of whether they were stored in a bank vault or on a stock trader’s laptop. And it’s why in 2016 Gartner defined a new category called Managed Detection and Response (MDR) that shifted the focus to risk mitigation rather than the traditional view of device management. MDR isn’t about ensuring doors and windows are locked; it’s about assuming the robbers are in the vault.
Hedge fund managers know they live and die by risk management. The risks are high but so, too, are the payoffs. They led the pack when it came to mastering risk management. But as we’ve seen in the last few years, other industries have adopted strong risk management programs.
In part two of this series, we will discuss governing risk and how to ensure that the Chief Security Officer becomes a key executive for the board whether or not a company has experienced a major security incident. We’ll also expose the fact that risk management has always been in the shadows when it comes to cybersecurity.
