________________________________________________________________________________________________________________________
hand, a lower-rated vulnerability could be more significant if it forms part of an attack path to a production environment or supports a process on which the business depends.
Cyber risk quantification( CRQ) provides a way to make this connection. Instead of starting with a generic severity score, this is a threatinformed approach that considers realistic attack scenarios, the business process or service being targeted, the technology and controls supporting it, and the potential consequences if the scenario occurs. Financial modelling can then help express the potential consequences in financially meaningful terms. While precise figures can be difficult given the availability and quality of underlying data, using realistic loss ranges will provide a practical view of cyber exposure. This allows it to be compared more easily with other business risks and better support the prioritization of investment decisions.
This scenario-based approach changes the way organizations think about controls. The presence of a control does not mean that it will provide the same level of protection against every threat. Control effectiveness must be considered in the context of the specific scenario, including how controls are implemented, evidenced, and expected to perform. This provides a much more useful basis for deciding whether strengthening a control will reduce exposure and by how much.
It is important that this quantification doesn’ t become another periodic reporting exercise. Manufacturing environments are continually changing as production systems are upgraded, new technologies are introduced, suppliers and dependencies evolve, and threat activity changes. A risk assessment that accurately reflected the environment at one point in time may quickly become less relevant as conditions change.
The best approach is to have an ongoing, dynamic view of exposure using evidence from security operations, exposure management, control validation, and changes in business criticality.
And it is here that CRQ moves beyond just putting a financial figure on cyber risk. Its full
32