6 Foundations of cyber risk
This chapter establishes that a strong cybersecurity program starts with knowing what you have, what can go wrong, and how you will keep improving. It frames “identity” broadly to include both organizational assets (devices, software, data, IP) and the individual identities that interact with them, stressing the need to map relationships and criticality so protections match business importance. With clear visibility, organizations can evaluate threats and vulnerabilities, align defenses with regulatory and business objectives, and build an iterative, data-driven approach to reduce risk before incidents disrupt operations.
The text details asset management across the full lifecycle—planning, procurement, deployment, maintenance, and secure disposal—emphasizing least privilege, configuration rigor, patching, and verifiable end-of-life processes. It promotes concrete metrics (counts and ratios of critical vs. total hardware/software, and elimination of unaccounted assets) and illustrates how dashboards and automated inventory can focus effort where it matters. For risk assessments, a structured methodology such as NIST 800-30 is recommended to set scope, avoid sensational “Hollywood” threats, and combine external intelligence (e.g., CVEs, EPSS) with environment-specific testing and compensating controls. Likelihood and impact can be gauged qualitatively or quantitatively, with prioritization guided by effort-versus-risk tradeoffs and financial measures like SLE, ARO, and ALE, alongside operational timing metrics for detection, response, containment, and reporting.
Sustained resilience depends on continuous improvement: learning from incidents, updating policies and controls, and reinforcing culture through training and awareness. The chapter outlines practical metrics to track progress—training completion and phishing simulation outcomes; security control effectiveness (antivirus currency, firewall performance, encryption coverage); compliance outcomes (audit findings resolved, time to compliance); and process improvement velocity and impact. Real-world scenarios show how organizations can reduce critical vulnerabilities, tighten mean-time metrics, and use risk-based prioritization (considering exploitability, business impact, and existing controls) to allocate resources wisely. Together, these practices create a feedback loop that adapts to evolving threats and steadily strengthens overall cybersecurity posture.
Managing cybersecurity risk in all lifecycle phases from conception to destruction.
The left shows TechMed Solutions' asset management dashboard before managing hardware and software assets. The right shows the dashboard after implementing hardware and software asset management.
Guide for conducting risk assessments.
Visualizing threat likelihood and impact for effective risk management.
The vulnerabilities in the darker area are the vulnerabilities that represent the lowest effort/cost vs the highest risk level. These are the vulnerabilities that should be addressed as a priority.
On the left, the TechMed risk assessment dashboard before the risk management program is shown. In this figure, the bottom metrics are displayed as a percentage to indicate the percentage of incidents that were within the predefined target of hours. For example, 40% of the incidents were detected within the 12-hour target detection time. On the right, the risk assessment dashboard after implementing the risk management program is shown.
Acme Trading - Identity cybersecurity dashboard
Summary
- The identity function focuses on managing and securing assets and risks within an organization.
- Conduct comprehensive risk assessments to identify and mitigate potential vulnerabilities and threats to organizational security.
- Adopting guidelines like those from NIST 800-30 provides a structured approach to conducting comprehensive risk assessments.
- Continuous improvement in cybersecurity involves regular evaluation and enhancement of security measures and practices.
- A mature cybersecurity stance requires integrating identity management, asset management, risk assessment, and continuous improvement into a cohesive cybersecurity strategy.
FAQ
What are the main objectives of the Identify function in cybersecurity?
The Identify function ensures you know what assets exist, which are critical, who has access, and how identities interact with assets. By cataloging assets, classifying their criticality, and mapping users/roles to systems and data, you can prioritize protections, align with business context, and target resources where risk is highest.How do organizational assets differ from individual identities, and why map their relationships?
Organizational assets include hardware, software, data, and intellectual property; individual identities are digital representations of users (employees, contractors, customers) with roles and permissions. Mapping relationships shows which identities access which assets, enabling nuanced risk assessments and least-privilege access control.What are the key phases of the asset lifecycle and the security focus in each?
- Plan: define roles, risk, controls, and compliance requirements.- Procure/Build: validate specifications, secure coding, and third-party security posture.
- Deploy/Use: configure securely, enforce least privilege, train users, and monitor.
- Maintain: patch, update, audit, and adjust controls safely.
- Dispose: securely wipe/destroy, remove records, and document for audit.
Which asset management metrics should we track, and how do critical-to-total ratios help?
Track counts of critical and total hardware/software assets and derive ratios (e.g., critical/total). These ratios highlight where the business relies most on technology, guiding investment, control strength, and monitoring intensity for critical systems.Why are unaccounted assets risky, and how can we eliminate them?
Unaccounted assets may be unpatched, misconfigured, or exposed, creating hidden attack paths. Eliminate them with automated discovery and inventory tools, periodic audits, ownership assignment, lifecycle tracking, and escalation to investigate and remediate gaps rapidly.How does NIST 800-30 structure a risk assessment, and why is scope so important?
NIST 800-30 emphasizes preparation (clear scope, assets, boundaries), then identifying realistic threats, finding vulnerabilities (CVE plus internal assessments), estimating likelihood and impact, and reporting results. Tight scoping avoids creep, keeps analysis relevant, and yields actionable, comparable results.Why shouldn’t we rely only on CVSS for prioritization?
CVSS measures severity, not real-world likelihood or business impact. Enhance prioritization with EPSS (exploit probability), active threat intelligence, business impact analysis (criticality and data sensitivity), and consideration of compensating controls and exposure.How do ALE, SLE, ARO, and EF quantify financial risk?
- SLE = AV x EF (asset value times percent loss per incident).- ARO = expected incidents per year (e.g., 0.5 for once every 2 years).
- ALE = SLE x ARO (expected annual loss).
Key pitfalls: misvalued assets, inaccurate EF estimates, poor incident frequency data, and outdated assumptions.
What do MTTD, MTTR (respond), MTTC, and MTTR (report) measure, and why do they matter?
- MTTD: time to detect an incident.- MTTR (respond): time to mitigate/restore.
- MTTC: time to contain and limit spread.
- MTTR (report): time to notify stakeholders/authorities.
Lower times indicate stronger monitoring and response, reducing impact and residual risk.
Data-Driven Cybersecurity ebook for free
