Cyber risk measurement and the holistic cybersecurity approach

Establishing a successful cyber risk dashboard starts with an integrated data architecture and a consolidated data lake to achieve consistent risk reporting and in turn can visualize threat control.

Cyber risk managers in large organizations are often swamped with information on threats that exceeds their capacity to respond appropriately. Fortunately, not all the alerts are warranted. For example, most organizations are little threatened by a so-called advanced persistent attack. The low probability should become visible in risk analysis, freeing organizations from devoting resources to the highly sophisticated defenses needed to protect against such attacks. Instead, they will be able to focus on creating countermeasures for common kinds of attacks—such as, for example, a distributed denial of service induced by malware or malicious overload. The optimal strategy will include controls to prevent collateral damage and investment in state-of-the-art safeguards to ensure business continuity in case of an attack. The goal for cyber risk managers is an efficient, adaptive, and sustainable regime. To attain it, fact-based prioritization is of great importance. Accurate risk sizing is dependent on a few basic inputs:

• a business perspective of the institution’s key assets and the top risks that could affect them
• realistic updated assessments of relevant threats and threat actors, formulated in detail as appropriate
• a consistent and accurate definition of risk appetite for the organization as a whole, prioritized and revised as appropriate

Read on mckinsey.com