Real metrics for measurable cybersecurity progress
Connecting state and local government leaders
To fully address supply chain risks, we must establish clear incentives to measure risk and share information about attacks.
Every time there’s another massive cybersecurity breach, which like SolarWinds finds its roots in a security issue at a third party, policymakers and security experts ask, “Where do we go from here?”
The private sector and the federal government haven’t figured out how agencies can best address risks posed by their vendors. The problem is especially acute for small- and mid-sized organizations. Individually engaging, evaluating and auditing every vendor, from custodial services to cloud providers, is cost prohibitive and unrealistic for the vast majority.
One thing is clear: What we are doing is not working. Our check-the-box approach to third-party risk neither improves the security of suppliers nor effectively informs the recipients of software and services about its real risk. What’s worse, it’s still practically impossible to determine just how effective our efforts are.
Today, those of us in cybersecurity are just like medieval barbers doing our best not to kill our patients. We struggle to know if an organization was breached due to poor security or if it was doing everything right and was simply overpowered by a nation-state.
We must start creating clear incentives to measure risk and share information about attacks.
It is impossible to know if we are moving forward if we cannot measure outcomes. Without information, we cannot reward good behavior. Developing ways to measure and report risk via trusted, objective security key performance indicators will lead to better approaches to cybersecurity and ultimately lower risk systemically. Government-provided incentives, such as procurement preferences, can drive real improvements, but public- and private-sector organizations need objective measurements to ensure progress and not just activity for the sake of activity.
Of course, objective measurement and effective cybersecurity decision-making requires access to data about risk. Liability concerns about sharing data can hamper this effort. Cybersecurity is one field where catastrophic failure and damage are hidden and protected by non-disclosure agreements, drastically reducing our ability to learn from our mistakes and compile sufficient actuarial data to understand the true nature of the risks we all face.
The Securities and Exchange Commission recognizes that information is key to gaining investor confidence. In 2018, the SEC released guidance calling for more fulsome disclosures of cyber risk. Unfortunately, as identified in a March report released by SecurityScorecard, the Cyber Threat Alliance, IHS Markit and Diligent, companies have yet to embrace full transparency leaving investors unable to properly evaluate the level of cyber risk to which they are exposed in the market.
Solving the metrics and transparency problems will take time. For now, security rating methodologies and services can help improve our understanding of the true scope and scale of the problem. In January, the National Risk Management Center within the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency announced its effort to identify and reduce systemic cyber risk and noted the utility of security ratings in developing cyber risk metrics in the near term.
Measurement and transparency are not new issues, although success has been hard to find. President Barack Obama’s May 2011 cybersecurity regulatory proposal focused on the disclosure of the level of cybersecurity protection implemented by critical infrastructure to allow market forces to hold security failures accountable. Similarly, President Donald Trump’s first Executive Order on cybersecurity proposed using market transparency -- informing investors about the level of cybersecurity implemented by publicly traded companies -- to build national momentum. Over a number of years, states across the country have passed breach disclosure laws. Most recently, the bipartisan Cyberspace Solarium Commission proposed enhancing metrics and establishing a new Bureau of Cyber Statistics to enable success.
That’s a good start; however there is still much work to be done. The Biden administration should take swift action to normalize objective measurement of cybersecurity and corresponding vendor risks. The time is now for an executive order to accelerate the timeline for establishing measurement criteria and build an actionable work program with appropriate incentives.
The attacks aren’t going to stop. We urgently need to establish metrics so we can stop acting as medieval barbers, step into the 21st century and start making progress.
NEXT STORY: DOE 'totally focused' on cyber, Granholm says