Explaining cybersecurity threats in a decision-maker context

As cybersecurity professionals, I’m sure you’ve  had this experience:  you find a risk to your organization’s systems, data and reputation, and you want to take action -- recode, deploy a web application firewall or maybe even disconnect the system.

You don’t want to make it sound like the sky is falling, but you need time and resources to correct the issue -- now. You discuss the vulnerability with your team, and everyone agrees that the issue is urgent and must be remediated.  You take your assessment of the vulnerability to leadership and say, “We have to take our system down. It has a blind SQL injection vulnerability that can be used to steal our data, passwords and allow an adversary to move laterally through our network.” To cybersecurity professionals the problem is clear, and the decision should be easy to make.

The decision maker listens to you describe the problem and says, “That is the most important system we have. Build a plan of action and milestone, and we’ll get the authorizing official to accept the risk and keep the system up.” 

You walk away knowing that nothing has been fixed -- that a piece of paper won’t keep your system secure and your agency is now vulnerable to a loss of data and customer trust when the inevitable breach makes the news.

As frustrating as this situation may be, the blame can’t rest solely on management’s shoulders; perhaps cyber professionals should accept part of the blame. Cyber professionals have a responsibility to identify and assess risk, but problems won’t be remediated effectively until they can be explained in a way that can be understood and acted on by leadership. Putting cyber risk in context and communicating it effectively makes cyber professionals the source of real, relevant, reliable threat information.  Effective communication helps senior executives balance the risks of the vulnerability with the need to sustain system availability.

Because members of an effective team, from management to the mailroom, all have their own areas of responsibility and their own language, views and understanding of risks, threats and costs, they may not immediately understand your perspective. To effectively communicate vulnerabilities, the risks they pose and the threats to the organization, you must understand what senior leaders are concerned about: the availability of critical systems, mission sustainment, the potential loss in dollars (from system recovery, fines, overtime, etc.) and the probability of exploit.  

Once you grasp their language, views and understanding, you must be able to explain how the vulnerability you’ve unearthed will impact everyone else in the organization, what data and systems are at risk and the potential cost of being compromised. While you may have a complete understanding of the data on your systems and its potential vulnerabilities, others in your organization may not. It’s up to you to communicate the impact across all missions and business functions.

In short, you must connect the dots for senior leaders, mission owners, chief financial officers and other executives. Show them how the compromise of one application or system can mean much more than that -- the potential compromise of every bit of data on every system in your entire organization.

Revisiting the same problem from this different direction will better illustrate the impact of a newfound vulnerability.

Your assessment found a blind SQL injection on a public-facing web application. You note that the system is hosting personally identifiable information and that there are PII records  for 512,000 users in the database across all major business lines (finance, operations, logistics, etc.) in your organization. Your research shows that the cost of recovery from loss of one PII record is around $221, making the total cost well over $113 million. You have your team quickly draft a proof-of-concept exploit to extract records from the affected database to prove that the vulnerability is real.

A quick Google search for the site with the vulnerability reveals a discussion board that says, “It looks like system X has a blind SQL injection issue; has anyone figured out how to exploit it?”

You now have the data you need to communicate the scope of the problem in the terms that are important to management.

“We have a critical issue with system X. We know it is hosting PII, with a potential data breach price tag of $113 million. Additionally, there is evidence this system is being targeted by hackers. We should act rapidly to fix this.” From there, you could recommend actions that are far less expensive than the cost of recovering from a data breach:

• Removing external web access and working with the program manager or system owner to fix the source code (emergency maintenance window).
• Deploying a web application firewall to provide virtual patching and detection/prevention of threats.

By speaking to management’s concerns, you have gained leadership’s attention and established the potential cost if the vulnerability is exploited. You have proved you understand their needs and have shown how your work can support their decision making by providing realistic, actionable solutions that will keep your organization secure.

As cyber professionals, it’s our job not only to find vulnerabilities, but also to help decision makers understand the nature, impact and context of each as well as help them understand the available courses of action and their relative costs, impacts and benefits. We must learn to place cyber issues in the language and context of our business or mission leaders. In doing so, cybersecurity teams will gain increased credibility, decrease attack surfaces and help decision makers understand critical tradeoffs  -- all toward the goal of improving the organization’s security posture. 

Executive leadership drives the business and sometimes accepts operational risk as part of the normal business process, but it’s up to cyber professionals to communicate findings effectively, with context and in terms best understood by senior executives, to ensure timely and effective action.