Call us now:
I started my career many years ago working in what we now call AI, developing Knowledge Based Systems (KBS/ KBE) for complex manufacturing processes in the Aerospace and Defence sector. It helped me understand the models we created were only ever as good as the knowledge of the system, and automation and control demonstrated through repeatability.
The same is true for risk management. To manage risk you need a very clear understanding of the system you are attempting to risk manage, and systems are people, process and technology. Herein lies the problem for cybersecurity risk management.
Assume you have to implement a cybersecurity risk management program manually. You have to assess external risk factors and threats, internal vulnerabilities, identify risks, create a risk register for governance, apply controls to mitigate risk and report risk. (e.g. NIST SP 800-37R2). Apply controls from over 110 cyber controls to mitigate risks you identify (e.g. NIST SP 800-171), and compensating business controls that are assessed individually and in combination to reduce the residual risk (e.g. Sarbanes Oxley audit). This creates a mathematical problem as risk is a subjective assessment based upon many complex interconnect factors that Quantum may help assess but still relies on a knowledge of the interconnected cause and effect relationships between risks and controls, that for cyber does not yet exist and varies by system (organisation).
Managing risk is understanding and managing the variability of people, process and technology that change, with changes in threats (see Okta hack – script kiddies, of supply chain variability) while demonstrating repeatability. The systemic cyber risk solutions market will be an interesting one to watch.
Ted Dziekanowski
#cybersecurity #cybersecurityriskmanagement #ai #governance #regulation #systemsthinking
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6947443844166635520