Did you weigh those to be able to show the difference from one control to another, that one control was more important or weightier than another? Did you weigh them, or did you order them in a priority to say, “we focused on these things first,” based on a risk appetite or something like that?
That's really what we did is take the controls that we felt were really critical to that. In going back to looking at the different business operations, that's where I think organizations really mess up because you try to take, let's say for patient portal access, well you've got a certain set of controls that are going to be really important on that particular operation. It doesn't mean that those same controls are going to be top priority on another set of operations, because you've got a whole different set of risks over here. So you really got to look at those risks based on that operation and what controls you have in place, then you get the residual risk. That's a really hard concept for people to really understand. But to me that was key and to explaining to the executives.
CIS measures if you have an inventory of all your things, and then it measures how you're doing against even things like patching. Do you have certain security gaps open or closed? It's very specific even down into the technology. Then understanding if that control is fully effective or partially effective. With partial, obviously you have residual risk.
After the team got that base model in place, now you have a database full of exceptions. We've accepted these risks, but we have just instituted that you cannot file an exception without a mitigation associated with it—something that says, “I'm going to make this risk less because I'm going to do these three things, whatever it is.” The value of that exception is not just a minus one. It might be now a minus one-half, because you have it half covered by some other mitigation. But you've got to figure out the effectiveness of each mitigation, because it may completely cancel out the exception.
You may be granting an exception on a very specific thing where a mitigation completely cancels out the risk for you, because you've basically done an entire work around so that somebody can't get through, because there's no attack vector anymore. You put MFA in front of something, and put it behind a firewall—it's incredibly hard for someone to get in and exploit that. So that's what I've challenged the team with next. Now that you've got the, “I see it in this many places, and I see it missing in this many places,” now go challenge where you have exceptions. Understand your mitigations, to see if those are really minus ones or they're minus less-than-ones to bring that into the mathematical model. So that you really can either say, “we have the right amount of risk,” or, “we have less risks than we expected, which means that maybe we can spend more time on something with higher risk or an area that needs more attention.”
Content you might like
Completely confident – they’re as solid as possible13%
Sort of confident – policies seem adequate59%
Slightly confident – better than nothing20%
Not at all confident – we need to redo these4%
Unsure3%
Control required by law.67%
Business recommendations.32%