Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Tenable 블로그

구독

How to Improve Your Cybersecurity Decision-Making to Reduce Business Risk

Increase your program efficacy by identifying the metrics that offer the right context to aid decision making across the executive, strategic and tactical levels of your organization.

The challenges for security teams continue to increase in the face of ever-changing environments and attackers leveraging the speed and scalability of modern IT environments. The pace and complexity of these changes ushers in a new chapter in the evolution of information security teams; today, security teams must also become risk management experts. Whether you're a team of one or many, you're faced with making decisions across multiple levels of your organization in order to more effectively mitigate risk. 

In our latest whitepaper, 3 Levels of Security Strategy for Business Risk Decisions, we dive into the three levels of decision-making strategies security teams need to perform: 

  • executive;

  • strategic;  and 

  • tactical 


The decision-making process across each of these levels involves much nuance and can be complex. Here, we'll show you some examples of the types of decisions required at each level and how the right metrics and tools can help you improve decision-making across all three levels in order to uplevel your security program efficacy. 

Executive-level decisions

At the executive level, security leaders deal with two different sub-areas of decision-making support: relaying information and metrics about the organization's security and risk posture to their C-suite business counterparts; and for their own executive-level decisions to provide direction and support for their security team. 

In support of their C-suite peers, security executives will typically ask their security teams for a wide variety of information to help guide business, revenue and liability decisions that affect the entire organization. To improve decision making at this level, the metrics provided by the security team must be risk based and framed in a way that aligns with business drivers.

For example, because business leaders need security information to be communicated within the broader context of the organization's goals, they won't find much value looking at the raw number of malware programs blocked by endpoint protection software or the total number of vulnerabilities patched this month. These represent a total volume number without any business context. Instead, security leaders should consider looking at the percentages of discovered critical risk vulnerabilities eliminated within the established Service Level Agreement (SLA) timeframe or the trend of risk reduction broken out by a major business function, such as the organization's primary e-commerce website, or the main data center in New York.

Viewing security performance through a broader lens enables security leaders to provide valuable context to business executives, so they can see how the security program is being effective and decide if there are areas where they must invest more resources to further mitigate and reduce risk within the business.

How to Improve Your Cybersecurity Decision-Making to Reduce Business Risk_1

These same metrics, when viewed through the lens of solely the security team's perspective, represent the amalgam of all the efforts being driven by all members and decision-making levels of the team. In this way, CISOs and other executive-level security leaders can measurably determine if the vision for the security team is being successfully realized by other team members and that the strategic- and tactical-level decisions are effective in reducing risk in a tangible way. Of course, if these metrics are showing a downward trend, this allows for security leaders to course correct and identify areas that need more management support in order to clear obstacles, acquire more resources, hire more staff or bring in additional, outside assistance. 

Strategic-level decisions

As you move down the org chart within the security team, the strategic-level decision makers (commonly directors, team leads or other mid-tier managers, but can also be senior technical experts or analysts) must support the executive-level teams to make better decisions for the overall direction of the business while also helping the tactical-level teams be more efficient and effective in their remediation efforts to reduce risk. 

Prioritization of risk is key to best support the tactical-level teams, where the day-to-day operational decisions are critical to ensure the organization is focusing resources on the most critical areas where remediation will have the biggest impact. As you work to translate the business requirements to operational execution, asset criticality is key to understand not only where to reduce the most critical risks to the business overall, but to help operational teams prioritize their work efforts more efficiently and effectively. 

By understanding the business criticality of assets in your organization, whether by location of the asset, exposure to the internet, the type of device, what business function it supports, or any number of other factors, you can apply a more risk-based approach to your remediation workflows.    

How to Improve Your Cybersecurity Decision-Making to Reduce Business Risk_2

For the overall management of your security program, it's also important to understand whether or not the policies, processes and procedures are working as expected and are helping increase maturity over time. It's important that strategic-level decisions support the other two levels of decision making. By constantly refining and improving the security program through better strategic decisions, one can demonstrate that the program is effective and that it is continuing to improve, which is an important indication of business value for executive-level decision makers. Having executives understand that there is business value in what you're doing to improve the security program is not just critical to the team's success, but can be used to support requests for additional budgetary and staffing allotments. It's here, then, that measuring the effectiveness of your assessment and remediation processes from a maturity standpoint not only allows for the strategic-level decision maker to shuffle resources where needed to improve these workflows, but also supports the overall business requirements to continuously reduce risk and drive more ROI through efficiency and process optimizations.

How to Improve Your Cybersecurity Decision-Making to Reduce Business Risk_3

Tactical-level decisions

Whether or not the security team is directly involved in the operational execution of active remediation efforts, they still play a critical role in helping execute these day-to-day patching and remediation tasks effectively and efficiently. 

By translating security findings into specific recommendation steps, the security team can make it easier for the operations teams to quickly understand what needs to be done and efficiently build the proper workflow to perform the necessary remediation steps. A more seamless integration between the security and operational processes here means improved program efficacy overall, which creates better value and reduces more tangible risk to the organization.

How to Improve Your Cybersecurity Decision-Making to Reduce Business Risk_4

Each level brings its own unique challenges when it comes to decision making. But armed with the right insights and perspectives, you can make — and demonstrate — tangible improvements in program efficacy.

Learn more 

관련 기사

도움이 되는 사이버 보안 뉴스

이메일을 입력하여 Tenable 전문가에게서 적시에 알림을 받고 보안 참고 자료를 놓치지 마십시오.

Tenable Vulnerability Management

비교할 수 없는 정확도로 모든 자산을 확인하고 추적할 수 있는 최신 클라우드 기반 취약성 관리 플랫폼 전체에 액세스하십시오.

Tenable Vulnerability Management 평가판은 Tenable Lumin 및 Tenable Web App Scanning을 포함합니다.

Tenable Vulnerability Management

비교할 수 없는 정확도로 모든 자산을 확인하고 추적할 수 있는 최신 클라우드 기반 취약성 관리 플랫폼 전체에 액세스하십시오. 지금 연간 구독을 구매하십시오.

100 자산

구독 옵션 선택:

지금 구매

Tenable Vulnerability Management

비교할 수 없는 정확도로 모든 자산을 확인하고 추적할 수 있는 최신 클라우드 기반 취약성 관리 플랫폼 전체에 액세스하십시오.

Tenable Vulnerability Management 평가판은 Tenable Lumin 및 Tenable Web App Scanning을 포함합니다.

Tenable Vulnerability Management

비교할 수 없는 정확도로 모든 자산을 확인하고 추적할 수 있는 최신 클라우드 기반 취약성 관리 플랫폼 전체에 액세스하십시오. 지금 연간 구독을 구매하십시오.

100 자산

구독 옵션 선택:

지금 구매

Tenable Vulnerability Management

비교할 수 없는 정확도로 모든 자산을 확인하고 추적할 수 있는 최신 클라우드 기반 취약성 관리 플랫폼 전체에 액세스하십시오.

Tenable Vulnerability Management 평가판은 Tenable Lumin 및 Tenable Web App Scanning을 포함합니다.

Tenable Vulnerability Management

비교할 수 없는 정확도로 모든 자산을 확인하고 추적할 수 있는 최신 클라우드 기반 취약성 관리 플랫폼 전체에 액세스하십시오. 지금 연간 구독을 구매하십시오.

100 자산

구독 옵션 선택:

지금 구매

Tenable Web App Scanning 사용해보기

Tenable One - 위험 노출 관리 플랫폼의 일부분으로 최근의 애플리케이션을 위해 설계한 최신 웹 애플리케이션 제공 전체 기능에 액세스하십시오. 많은 수작업이나 중요한 웹 애플리케이션 중단 없이, 높은 정확도로 전체 온라인 포트폴리오의 취약성을 안전하게 스캔합니다. 지금 등록하십시오.

Tenable Tenable Web App Scanning 평가판은 Tenable Lumin 및 Tenable Web App Scanning을 포함합니다.

Tenable Web App Scanning 구입

비교할 수 없는 정확도로 모든 자산을 확인하고 추적할 수 있는 최신 클라우드 기반 취약성 관리 플랫폼 전체에 액세스하십시오. 지금 연간 구독을 구매하십시오.

5 FQDN

$3,578

지금 구매

Tenable Lumin 사용해 보기

Tenable Lumin으로 위험 노출 관리를 시각화하여 파악하고 시간에 걸쳐 위험 감소를 추적하고 유사한 조직과 대비하여 벤치마킹하십시오.

Tenable Lumin 평가판은 Tenable Lumin 및 Tenable Web App Scanning을 포함합니다.

Tenable Lumin 구매

영업 담당자에게 문의하여 어떻게 Tenable Lumin이 전체 조직에 대한 통찰을 얻고 사이버 위험을 관리하는 도움이 되는지 알아보십시오.

무료로 Tenable Nessus Professional 사용해보기

7일 동안 무료

Tenable Nessus는 현재 구입 가능한 가장 종합적인 취약성 스캐너입니다.

신규 - Tenable Nessus Expert
지금 사용 가능

Nessus Expert는 외부 공격 표면 스캔닝과 같은 더 많은 기능 및 도메인을 추가하고 클라우드 인프라를 스캔하는 기능을 추가합니다. 여기를 클릭하여 Nessus Expert를 사용해보십시오.

아래 양식을 작성하여 Nessus Pro 평가판을 사용해보십시오.

Tenable Nessus Professional 구입

Tenable Nessus는 현재 구입 가능한 가장 종합적인 취약성 스캐너입니다. Tenable Nessus Professional은 취약성 스캔 절차를 자동화하고 컴플라이언스 주기의 시간을 절감하고 IT 팀과 참여할 수 있도록 합니다.

여러 해 라이선스를 구매하여 절감하십시오. 연중무휴 전화, 커뮤니티 및 채팅 지원에 액세스하려면 Advanced 지원을 추가하십시오.

라이선스 선택

여러 해 라이선스를 구매하여 절감하십시오.

지원 및 교육 추가

무료로 Tenable Nessus Expert 사용해보기

7일간 무료

최신 공격 표면을 방어하기 위해 구축된 Nessus Expert를 사용하면 IT부터 클라우드까지, 더 많은 것을 모니터링하고 조직을 취약성으로부터 보호할 수 있습니다.

이미 Tenable Nessus Professional을 보유하고 계십니까?
7일간 Nessus Expert로 무료 업그레이드하십시오.

Tenable Nessus Expert 구입

최신 공격 표면을 방어하기 위해 구축된 Nessus Expert를 사용하면 IT부터 클라우드까지, 더 많은 것을 모니터링하고 조직을 취약성으로부터 보호할 수 있습니다.

라이선스 선택

여러 해 라이선스를 구매하여 비용을 더 절감하십시오.

지원 및 교육 추가