Enterprise cybersecurity technology research that connects the dots.

Enterprise Choices in Measuring Risk

Organizations have options when it comes to choosing the right tool to quantify risk

Antique rulers and measuring tapes lie horizontally across the image.
Image Source: Ariel via Pixabay

Risk can be tricky to measure. As in so much of life, the devil is in the details. And when it comes to cybersecurity, that tricky devil can be the difference between a number that merely ticks a box on a requirements sheet and a metric that is at the core of a mature risk management plan.

Spoiled for Choice

Boiled down to its most basic form, risk is a simple concept. You take the likelihood that an event will occur, multiply it by the impact of its occurrence, and out pops a risk metric. The trouble is, we all know that life generally isn't anywhere nearly that simple.

To begin with, there are complications, such as how widespread an event could be — is it a possibility only on a handful of specialty devices or on every endpoint owned by the organization? Then you get into the various sorts of impact an event might have, how readily the impact could be remediated, and so on, and before you know it the equations look more like quantum mechanics than third-grade math.

Then comes the question of how you express the risk quantity; is it a scale of 1 to 100? In dollars? In colors, as in the original DHS Threat Level rankings? In the relative "cool" factor of various amphibians? It can be a difficult choice.

And therein lies a key problem: Not that there's no way to quantify and express risk, but that there are so many ways to attack the problem. It's not that any one system is necessarily bad (though the amphibian scale can be a bit slippery) but that it is difficult to map from one scale onto another and compare relative risk postures of organizations across a geography or industry grouping. The difficulty makes it more important than it might otherwise be to take care in choosing a risk quantification method.

Choosing the Right Tool

There are, in a very broad sense, three types of tools used to quantify risk. There are frameworks or methodologies that can be used to build custom processes or as the basis for commercial products. There are tools that quantify risk as their primary function, though they may well provide input to other tools. And there are products or services that quantify risk as part of a larger functionality set.

Some organizations will find that their choice of risk quantification tool is made through their choice of another tool or service. If the larger product or service, whether it be risk management or cyber insurance, includes risk quantification, then it can be very difficult to justify paying for a different system — in many cases, a redundant system — for performing the same analysis.

Other organizations will find that their choice of risk quantification tool is made for them because of business relationships, for example, contracts with a government entity that requires a particular risk analysis as part of the contract qualification process.

For those organizations with the freedom (or chore) of actually choosing a risk quantification tool, the first question to be asked is why quantifying risk is important. It may seem like a question with an obvious answer, but in most cases, there will be a primary need driving the decision. And that primary need should drive the tool choice, as well. Quantifying organizational risk is neither simple nor inexpensive, so it's important that the tool choice fit the need as fully as possible.

Is there a particular way in which the organization quantifies financial risk? Are there plans for future partnerships or sales efforts that would benefit from a particular way of either measuring or expressing risk? Is a change in insurance provider in the cards? Any — or all — of these could have an impact on the tool that would best fit the organization's needs. Asking questions of potential partners or providers could open up possibilities for finding a tool that would meet the immediate need while positioning the organization to meet future needs, as well.

Quantifying cyber-risk is a requirement for a growing number of organizations. Taking the right approach to choosing the tool to quantify that risk will go a long way toward making the process as valuable and effective as possible.

About the Author(s)

Curtis Franklin, Principal Analyst, Omdia

Curtis Franklin Jr. is Principal Analyst at Omdia, focusing on enterprise security management. Previously, he was senior editor of Dark Reading, editor of Light Reading's Security Now, and executive editor, technology, at InformationWeek, where he was also executive producer of InformationWeek's online radio and podcast episodes

Curtis has been writing about technologies and products in computing and networking since the early 1980s. He has been on staff and contributed to technology-industry publications including BYTE, ComputerWorld, CEO, Enterprise Efficiency, ChannelWeb, Network Computing, InfoWorld, PCWorld, Dark Reading, and ITWorld.com on subjects ranging from mobile enterprise computing to enterprise security and wireless networking.

Curtis is the author of thousands of articles, the co-author of five books, and has been a frequent speaker at computer and networking industry conferences across North America and Europe. His most recent books, Cloud Computing: Technologies and Strategies of the Ubiquitous Data Center, and Securing the Cloud: Security Strategies for the Ubiquitous Data Center, with co-author Brian Chee, are published by Taylor and Francis.

When he's not writing, Curtis is a painter, photographer, cook, and multi-instrumentalist musician. He is active in running, amateur radio (KG4GWA), the MakerFX maker space in Orlando, FL, and is a certified Florida Master Naturalist.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like

More Insights