Cyber Defense Magazine - Annual RSA Conference 2019 - Print Edition

Aligning Cybersecurity
Effectiveness with Core
Business Objectives
CYBERSECURITY PROGRAMS ESTABLISH DEFINED GOALS BUT LACK
MEASURABLE INDICATORS TO GAUGE EFFECTIVENESS.
by Brian Contos, CISO, Verodin Inc.
From an objective perspective, it is easy to
become desensitized by the current state
of cybersecurity. Every headline-grabbing
breach plays out like a rerun of a bad sitcom.
Still, recent incidents beg the question: why
are even the most sophisticated and wellfunded
cybersecurity programs struggling?
The margin of error in cybersecurity is
unprecedented. Modern IT environments
are complex and unique, with intricate
combinations of products, configurations, and
architectures. The fact, a lot has to go right
for dozens of disparate tools to work together
in concert and be effective. Known and
unknown changes in tools, infrastructure, and
configurations introduce the risk of unintended
errors and blind spots. To add to the complexity,
environments are constantly shifting, so there
is no guarantee that defenses working today
will remain effective tomorrow.
The harsh reality is that cybersecurity as we
know it is fundamentally flawed. Unlike other
essential business units such as finance and
operations, cybersecurity is not measured with
quantifiable metrics and optics predicated on
evidence-based data. Instead, cybersecurity
success criteria is loosely defined and
principally based on assumptions. Over the
years, cybersecurity infrastructures have
ballooned without the instrumentation
necessary to dynamically measure and manage
their effectiveness. This has resulted in product
redundancies, unnecessary complexity,
overwhelmed analysts, and wasted dollars.
Bottom line: the cybersecurity value perceived
is not the value being realized.
Assumption-based cybersecurity is rampant.
In a recent poll from Verodin Inc., a broad
audience of InfoSec professionals including red
and blue teams, auditors, and executives, were
asked, “How much of your security is based
on assumptions instead of evidence?” Not
surprisingly, a whopping 97% of responders
admitted to managing by assumption to some
degree.
94 Cyber Defense Magazine - Annual Print Edition 2019