By Jonathan Trull, Chief Security Officer at Qualys
The CISO role is now as much about your ability to effectively communicate with your CEO and board of directors as it is about your technical acumen. It is arguably more important to effectively convey current organizational risk because it will dictate budget, time, and personnel allocation. This continues to be one of the most demanding jobs of the CISO and security team. Distilling the risks associated with disparate, profoundly technical, and constantly evolving environments is akin to explaining to your grandparents that you make a living as a social media influencer on TikTok.
Despite the challenge, this is what CISOs are expected to do, with nearly 50% now reporting directly to the CEO and nearly 100% regularly briefing their board of Directors, according to a recent survey from Splunk. Of course, various tools score risk in one way or another, but these are disjointed and don’t give the whole picture. To this point, CISOs haven’t had a reliable means of aggregating, correlating, and translating cyber signals from an ever-expanding cybersecurity stack and then distilling that information into meaningful cyber risk mitigation and remediation strategies.
To effectively convey cyber risk, CISOs have been moving away from merely enumerating it in the form of Key Risk Indicators (KRIs) and instead moving towards Key Performance Indicators (KPIs) that provide the business impact of vulnerabilities, threats and risk posture in real time. Moving towards KPIs requires CISOs to have a view across the entire enterprise from asset management to attack surface management, vulnerability management, remediation, policy compliance, and advanced threat protection – and then distill that information into an easy-to-understand risk metric. This was the problem Qualys set out to solve with its Qualys Enterprise TruRisk Platform.
Multiple Parts of a Comprehensive Solution
The Qualys Enterprise TruRisk Platform allows security leaders to effectively measure, communicate and eliminate risk by guiding remediation actions based on financial metrics. Some of the new platform updates include:
- TruRisk Eliminate. TruRisk Eliminate builds on the successful Qualys Patch Management and adds in risk-based, intelligent mitigation actions that include compensating controls, patchless patching, configuration changes, and more. Additionally, because it is guided by the TruRisk quantification engine, customers can leverage automation to intelligently defend the highest value and highest risk assets, ensuring that the right mitigation or remediation actions are taken every time.
- TotalCloud with TruRisk Insight. TruRisk Insights is designed to consolidate critical security data from diverse sources into a cohesive and actionable dashboard. Critically, it shows how cloud risks are multiplicative rather than additive. A vulnerability paired with a misconfiguration and internet exposure escalates that vulnerability to a much higher threat that organizations should prioritize immediately. The focus of this is not on compiling an ever-expanding list of issues that need to be addressed, but understanding the interplay between various factors that allow a single fix to mitigate multiple risk factors.
- TruRisk Artificial Intelligence (AI). As we all know, AI is only as good as the data you feed it. That’s why TruRisk AI is purpose built on a petabyte-scale security data lake with trillions of high-fidelity security data events and signals across asset inventories, vulnerabilities, misconfigurations, cloud and OT/IOT. This wealth of knowledge allows TruRisk AI to learn from customer behavior, third-party apps and Qualys apps to identify assets and users and then propose the best and potentially overlooked remediation actions.
- Cybersecurity Asset Management (CAM) and Software Bill of Materials (SBOM). CAM allows security teams to extend the power of TruRisk with detections including EoL/EoS software, unauthorized software, unsanctioned ports and missing required software such as an uninstalled anti-virus. CISOs can now get a snapshot of the organization’s risk by adding all these new vectors to an asset’s TruRisk score. This allows security teams to effectively prioritize mitigation efforts and extend them across their entire software ecosystem. Qualys will also be adding a new CAM capability that will track all SBOMs in a single location, allowing security teams to quickly identify applications running a vulnerable component.
The integration of these various capabilities, all with the focus on quantifying cyber risk, allows CISOs to not only better prioritize the actions that the organization needs to take to better protect itself, but it also gives CISOs a way to convey the current cyber risk exposure to their organization in business terms. Having the ability to say that specific vulnerabilities, if left un-remediated, leave the organization at risk of $XX millions of dollars in losses, helps CISOs make the necessary evolution from cyber risk enumeration to cyber risk quantification for executive stakeholders, board members, and other business risk stakeholders. The better CISOs communicate the true financial risk an organization is facing, the better that organization can manage and mitigate the implications of cyber risk on the over all business.
##
ABOUT THE AUTHOR
Jonathan Trull is Chief Information Security Officer and Head of Solutions Architecture at Qualys, an American technology firm based in Foster City, California, specializing in cloud security, compliance and related services.
