cyber resilience framework

Building Cyber Resilience into the NIST CSF

by Davis Hake , Co-Founder & VP of Communications

Executive orders range in impact from mundane to definitional for our society. For example, in 1933, EO 6420B founded the Federal Civil Works Administration, kicking off the New Deal and creating about 4 million new government jobs that served as a bedrock for our country to recover from the Great Depression. Today in cybersecurity, we face a crisis of similar proportions in the security of our critical infrastructure.

During the Depression, GDP fell 29% from 1929 to 1933, about $300 billion in today’s dollars. In comparison, some analysts have pegged global annual cybercrime losses to reach $10.5 trillion by 2025. Even if we fall short of that mind-blowing figure, we are dealing with a problem on the scale of a global depression that is largely written off today as a transaction cost for doing business online. Recognizing the scale and scope of this problem in the early 2010s, the U.S. Department of Commerce released its version of a “Cyber New Deal” with Executive Order 13636, Improving Critical Infrastructure Cybersecurity.

EO 13636 changed how private entities viewed cyber risk by creating a risk-based Cybersecurity Framework that pivoted the thinking behind cyber threats from a technical focus to a risk management lens. The Framework came on the heels of efforts to harmonize regulations and build information-sharing efforts to identify rising cyber threats to our critical infrastructure. This was the first national-level effort to drive a risk-based approach to cybersecurity, and it continues to serve as the de-facto investment guide for organizations from small businesses to Fortune 500 companies.

Evolving Beyond the NIST Cyber Resilience Framework

The Framework’s impacts have been dramatic for the cybersecurity industry. Since the launch of the Cybersecurity Framework, ironically similar to the New Deal, we have seen a dramatic jump in the cybersecurity workforce of around 350%, or 2.5 million people, between its first beginnings in 2013 and 2021. At its fifth-year anniversary, the NIST Cybersecurity Framework had been downloaded more than half a million times, and today it is available in nine different languages. However, as threats have evolved since its launch in 2013, so has thinking on how organizations should manage cyber risk.

Today, due to a continually growing ransomware epidemic, organizations are learning that technical security controls are not enough to avoid costly cyber incidents. There is no part of the NIST Framework that helps quantify how much value-at-risk your IT defenses leave exposed, filters out the noise from non-critical threat alerts, or advises CEOs on dealing with an extortion demand. This is where the Framework must evolve to meet the reality that cyber risk is a team sport beyond the responsibility of the CISO. Cybersecurity is critical, but it is no longer sufficient. We must now begin thinking of how to build Cyber Resilience.

Cyber Resilience is rooted in bridging the organizational silos of finance, risk management, and IT security to enable the business to provide value to customers even during a cyber incident continually. It requires thinking beyond the CISO’s cybersecurity domain and aims for a more holistic approach to managing cyber risk. If this sounds hard, it is. Today, the roles of the CFO and Risk Manager are much more focused on revenue growth and protection from risks IRL (in real life), such as property destruction or loss of goods. According to Gartner, global IT spending is projected to reach $4.5 trillion by 2024, highlighting the growing significance of digital transformation

With the need to rethink how cyber risk is managed, Resilience recently shared this perspective with the Department of Commerce in their request for comment on the next version of the NIST Cybersecurity Framework. Working with our clients, we have learned how to build Cyber Resilience by connecting advanced cybersecurity visibility and actionable cyber hygiene to an organization’s financial risk transfer (insurance). This holistic approach involves multiple key stakeholders in cyber defense efforts and helps enterprises optimize their security control investments.

We broke our recommendations to NIST into three core areas: cyber risk quantification and prioritization, cyber threat visibility, and cyber risk transfer. The synchronization of these three areas drives teams to discuss their most critical risks better and plan more realistic budgets for security and insurance. Uniting these core areas helps companies prepare to take a digital hit and avoid a costly impact to their bottom line. Our guidance to NIST in these areas is as follows:

Cyber Risk Quantification & Prioritization

Version 1.1 of the Framework begins with identifying cybersecurity risks to an organization’s systems, people, assets, data, and capabilities. Resilience has found that this process is significantly enhanced by quantitative modeling around the probability of realistic cyber incident scenarios impacting an organization’s ability to operate.

Instead of jumping straight to a discussion of assets, organizations should start by aligning on key business objectives and identify which cyber incident scenarios may impact operations most. Once all executive stakeholders understand and agree upon these scenarios, an organization can begin identifying the systems, people, assets, data, and capabilities that impact or are impacted by, those scenarios.

As an organization understands its systems, people, assets, data, and capabilities it can begin building out quantitative models to understand how investments in controls affect organizational operations. Quantitative analysis helps forecast not only the value-at-risk but also the cost and effectiveness of controlling losses. This understanding drives the prioritization of the security controls discussed throughout the Framework. The acts of quantification and prioritization should be a key first step in utilizing the Framework, thus deserving of significantly greater exploration by NIST.

Cyber Threat Visibility

Technical visibility into threats is a foundational goal for any cyber defense effort. Understanding an organization’s ability to identify and manage new and existing vulnerabilities is critical to limiting the attack surface for adversaries trying to access critical systems. However, as organizations’ digital footprints have grown and expanded to SaaS vendors, along with digital dependencies of upstream and downstream supply chains, the volume of “doors and locks” that need to be routinely checked has become a Sisyphean task.

As with other aspects of Cyber Resilience, organizations, and the security vendors supporting them, threats and vulnerabilities need to be prioritized based on their actual risk to business operations. This means limiting the scope of what is deemed critical enough to warrant investigation based on its context to overall risk. When Resilience provides threat notifications, we utilize a simple three-level requirement. All notifications to clients must be:

  • Critical: The vulnerability must be of such an essential nature that it could lead to direct access to (or control of) a client’s environment. Example: A remote code exploit (RCE) that provides access to operationally critical systems.

  • Relevant: The threat from the vulnerability must be relevant to the client’s infrastructure or industry. Example: A vulnerability present in deployed IT infrastructure or common across their region, industry, or organization size.

  • Actionable: The outreach must come with remediation guidance that is specific enough to enable independent action. Example: The vulnerability is resident in commonly used infrastructure and can be patched using an update by the vendor through a trusted distribution chain.

Cyber Risk Transfer

A Cyber Resilience approach to managing cyber risk requires holistic management of all four principles. However, security practitioners often overlook risk transfer products, such as insurance, as a tool for addressing cyber risk. NIST has an opportunity to correct this and drive a better understanding of how to transfer cyber risk alongside mitigation strategies.

A critical component of holistic cyber risk management is the collaboration within an organization on their level of risk tolerance and the associated availability of financial risk transfer. To adequately manage cyber risk, it is important to determine what risks are acceptable, as well as, if risk mitigation is required or if transferring the risk through insurance is the appropriate course of action. Emphasizing the role of risk transfer and the collaboration between security, finance, and risk management supports NIST’s approach to analyzing cyber risk holistically.

In many cases, the risk transfer product may also encourage organizations to pursue operational and technological advances to meet insurance requirements. Resilience believes this balance between risk identification, transfer, and mitigation deserves significant attention in future analysis by NIST.

Take Your Cyber Resilience to the Next Level

Resilience endeavors to be a champion in driving organizations to think more holistically about building Cyber Resilience. In the current cyber risk climate, we can’t just sell insurance. We must be a partner that collaborates with our customers to advance their cyber maturity and reduce risk in a mutually beneficial way.

Resilience hopes that its input will be helpful to NIST as it develops version 2.0 of the Framework and aims to partner with all those who continue to support a more Cyber Resilient world. Discover how Resilience can be your strategic partner in advancing cyber maturity and reducing risk. Request a demo of Resilience today and join us in building a more Cyber Resilient world.

You might also like

third-party cyber risk management

New Frontier: Cyber Risk Mitigation with Superforecasting

You’re a CISO, bombarded from all sides. New vulnerabilities emerge daily, vendors tout countless security solutions, and your inbox overflows with security alerts. Your skilled analysts are stretched thin, struggling to keep pace with the ever-evolving threat landscape. How do you make sense of it all? How do you prioritize investments, allocate resources, and make […]

third-party cyber risk management

Cybersecurity Essentials: The Role of Vulnerability Management in Building Cyber Resilient IT Systems

Navigating the complexities of cybersecurity requires a strategic approach to mitigate risks and safeguard IT systems. Central to this approach is vulnerability management, a systematic process that identifies, assesses, and prioritizes vulnerabilities within organizations’ infrastructure. Understanding what vulnerability management entails and how it contributes to preemptive cyber defense is critical.  According to a recent report […]

third-party cyber risk management

Mastering Cybersecurity Risk Metrics: A New Way to Think About Cyber Risk

Digital threats are not just possibilities but inevitabilities; understanding and calculating cyber risk is more than a precaution – it’s a necessity. Understanding cybersecurity metrics is essential to safeguarding and improving business operations. Calculating cyber risks simplifies complex issues and empowers professionals to communicate them clearly to improve their organization’s digital security. This requires a […]

third-party cyber risk management

Evolving Cybersecurity: From Risk Management to Cyber Resilience

With an astonishing 95% of cybersecurity breaches attributed to human error, organizations must educate, train, and implement a security foundation for all employees. This staggering statistic highlights the vulnerability of humans within digital infrastructures and underscores the importance of building a security-forward mindset into the culture of resilient businesses.   As cyber threats continue to lead […]

third-party cyber risk management

Counting the Cost: Understanding the Financial Risk of Cybersecurity Breaches

Cybersecurity breaches stand as a relentless challenge for organizations worldwide, causing substantial financial repercussions. As cyber threats advance in complexity, the economic impact on businesses intensifies, affecting everything from upfront costs to sustained financial health.  A thorough investigation into the financial risks posed by cybersecurity breaches reveals the breadth of direct and indirect expenses that […]

third-party cyber risk management

Rewriting the Rules of Cyber Security Risks: Part II

Building Cyber Resilience requires a new approach to assessing, measuring, and managing risk. Traditional thinking from both the security and insurance sectors views risk management in binary silos that either stop an attack or fail to prevent loss. However, the truth is that cyber security risk is significantly more complex. Being resilient to cyber security […]