Factor analysis of information risk (FAIR) Assessment

What is the best option for risk mitigation? Probabilistic analysis. The question shouldn’t be what’s possible, but rather what is most probable. In this educational article, we will unpack risk management, how to evaluate your assets, prioritize your threats, and how to use the fair risk methodology to limit quantified risks.
 

American automobile executive Lee Iacocca, perhaps best known for conceptualizing the Ford Pinto and Mustang vehicles, once said that every business and every product has its own set of risks that they cannot get around or away from. It is what it is. However, smart organizations understand that they can minimize risks and the gravity of their impact on the company’s operations and reputation if they do it in a systematic manner.

The age of interconnected industrialization – otherwise known as the Industry of Things (IoT) – is truly upon us, and has disrupted traditional ways of working. Unlike before, when industries operated within clearly demarcated niches and segments and relied heavily on human input and involvement, the economy now operates and leverages its potential for growth on its capacity to create, connect, and collaborate.

This burgeoning culture of interconnectivity that has emerged over the last decade, however, has also given birth to another emerging revolution — that of IT safety and security, data privacy, cybersecurity, and risk management. Companies are hard-pressed to protect their tangible and intangible assets, in order to mitigate and manage a variety of risks that may adversely impact their customers and stakeholders.

Indeed, in this age of digitalization, IT safety and security matters — a lot.

 

The dawn of the Fractional Security Officer a.k.a. the Cybersecurity Advisor

Industry 4.0 revolves around the concept of shared services, which has greatly benefited both service providers and consumers. However, being subjected to the security risks that go along with being part of an interconnected web can be costly, and may impact an organization’s brand perception and credibility.

Case in point: a few months ago, news spread about how some 500,000 user details of communications technology company Zoom were being sold on the dark web. With nearly everyone working from home due to the COVID-19 pandemic, tens of thousands of employees have turned to the use of the videoconferencing platform as part of their business continuity plans or simply to reach out to family and friends from across the globe. As a result of this massive breach, Zoom has now advised its users to update their passwords and to employ the use of such for all subsequent meetings to discourage possible interruptions.

If something of this scale could happen to an established ten-year-old technology conglomerate, it can happen to just about anyone. Sadly, not everyone can get away with or from it. Hence the growing need and demand for Cybersecurity Advisor.

They go by many other titles – Cybersecurity Advisor, IT Security Advisor, Fractional Security Officer. But what exactly are they, and what are they required to do?

In a nutshell, they are IT safety and security professionals, tasked to develop efficient measures to manage crucial information assets and reduce potential security threats to a bare minimum.

The Fractional Security Advisor is your go-to person when it comes to IT safety and security, working with all relevant data security stakeholders to ensure the creation and implementation of a fool-proof cybersecurity strategy that will safeguard critical information assets and databases.

 

Assess your cybersecurity

 

What qualifications should a good Cybersecurity Advisor have?

Let’s begin with the specific skills you need to look for in a potential Cybersecurity Advisor, in case your company has decided you need their services.

 

The passion for getting to the root of things

Your potential Cybersecurity Advisor must have strong analytical and diagnostic capabilities, since s/he will be looking both at the big picture, and the nitty-gritty details of an organization’s digital framework to safeguard IT safety and security. Just like a forensic investigator goes down to the most minute of evidence, the Cybersecurity Advisor must have a firm grasp of the administration, architecture, and management of the organization’s operating systems, as well as their virtualization software and networking frameworks.

An understanding of the Web’s weak spots

Since your Cybersecurity Advisor will be protecting your organization from threats pervading the Web, s/he must be aware of both existing and emerging risks. Is your system prone to a malware attack? Are the files on your cloud storage protected by authentication and registration processes that can protect them from cloud abuse? Is the company taking steps to monitor employees’ online activities to ensure that leaks of confidential and proprietary company information are prevented? These are just some of the things that your Cybersecurity Advisor must identify, flag, and rectify.

 

The exceptional ability to explain otherwise complicated concepts

IT safety and security is a very broad and elaborate topic that may sound foreign and unintelligible when communicating with senior managers that may not have the corresponding technical background. As such, your potential Cybersecurity Advisor must possess exceptional communication and presentation skills so that s/he can explain the company’s IT safety and security landscape and the capital expenditure required to protect it, to decision-makers as simply and clearly as possible.

 

Certified is best

Given the complexity of the field of IT safety and security, determining the exact set of skills your potential Cybersecurity Advisor must possess is a bit delicate.

Aside from being well-versed in the fundamental concepts of software development and programming and its variety of languages (Kotlin, Python, or Java, among others), it would be best to work with someone certified in the field of cybersecurity. Some key certifications to look for in a Cybersecurity Advisor’s resume would be:

• OSCP (Offensive Security Certified Professional): The OSCP tests a Cybersecurity Advisor in his ability to conduct penetration training or the access of live systems within a controlled environment, using methodologies such as Kali Linux.
• CEH (Certified Ethical Hacker): A Cybersecurity Advisor must be able to think and act like a hacker — although in a legitimate manner — to test target systems for vulnerabilities. Strong two-year work background in IT safety and security is one of the prerequisites for taking the CIEH exam.
• CISA (Certified Information Security Auditor): With this certification, given by ISACA, an internal organization of professionals specializing in IT governance,  your company can be assured of the expertise of your IT Security Advisor in IT safety and security processes, governance and management of IT safety and security systems, and the sound protection of various information assets.
• CISSP (Certified Information Systems Security Professional):  In addition to expertise in the identification and mitigation of IT safety and security threats, the CISSP-certified IT Security Advisor has the ability to develop and implement an unassailable framework of proper controls that can further enhance the efficiency your company’s risk management protocols.

Why is getting an IT Security Advisor a good investment?

With the growing number of interconnected systems and networks, as well as the steady increase of people accessing electronic data, proper IT safety and security management require skill and intuitiveness that can only come from education and experience. It cannot be handled by just a cloud architect or a software developer because that would be like, say, putting together an automobile without the inputs of a safety officer.

Simply put, the role of an IT Security Advisor is a crucial and multi-faceted one and requires as much expertise as possible. Moreover, a good IT Security Advisor must have strategic connections with other equally credentialed experts such as privacy practitioners, cybersecurity engineers, data forensic analysts, and the like.

Of course, the choice of having a full-time Cybersecurity Advisor highly depends on the specific needs of your organization, as well as your budget.  Because of their technical skills and credentials, IT Security Advisors will not come cheap, and may not be ideal for start-up companies with a limited overhead budget.

Making the choice between a specialized agency vs a full-time Cybersecurity Advisor

Having a sound and actionable IT safety and security plan is a must for every organization, especially as criminal activities on the World Wide Web pervade 24/7. However, ask yourself – will hiring a full-time Cybersecurity Advisor serve me better, or would it be more prudent to start off with an agency that specializes in IT safety and security?

Of course, having a full-time IT security expert means that your advisor will focus solely on your company’s needs and requirements. As a result, s/he will be able to build a deeper familiarity and understanding of your networks, including their configuration, intricacies, and vulnerabilities, and be able to anticipate and mitigate potential security attacks quickly and more adequately.

Cybersecurity Advisors normally hold an honorary seat at the management table, which means he can become more involved and invested with the achievement of the organization’s goals and objectives.

S/he will proactively suggest measures that will look out for and nurture the health of the organization, especially concerning data security and privacy.

Of course, be ready to pay a hefty price tag for your IT Security Advisor’s services. Aside from the salary, which ranges between $109,000 to $204,000, there will be other additional costs, such as medical and dental coverage and allowances for transportation and communication.

Because technology on IT safety and security is constantly evolving, Cybersecurity Advisors will need to attend training seminars to keep abreast of the latest security threats that may negatively impact the company. It will be expected for the company to foot the bill on these workshops, seminars, and re-certifications since it will be the one to benefit from these.

Nowadays, IT safety and security services, similar to administrative tasks like Human Resources and Finance, can now be outsourced via specialized managed security service providers (MSSP) whose expertise lies in identifying and preventing both common and advanced threats to your company’s IT infrastructure.

However, make sure that your potential cybersecurity can present a customized plan of approach that effectively addresses your company’s varying needs, to allow you to study their recommended measures and vet their credentials.

These specialized agencies can assign to your organization a team of highly-specialized IT safety and security experts to work either on-site or remotely with your in-house IT personnel to conduct daily monitoring and management of your company’s security systems.

Once this team becomes familiar with the ins and outs of your IT system and gets a better grasp of its workings, the agency may recommend either increasing or reducing the number of team members working on your account, with your permission, to allow them to optimize and adjust their services according to the agreed-upon goals.

When it comes to budgetary concerns, an MSSP will only charge you for the hours that the team or a specific team member has worked on your company’s account, which you may find more manageable. Compared to a full-time Cybersecurity Advisor, rates of MSSPs are significantly lower and can be relatively easy to adjust as needed.

In addition, MSSPs can provide weekly or monthly reports and recommendations on how an organization can ensure that their assets and infrastructure complies with industry standards on IT safety and security, having worked with companies across various industries. While IT safety and security is definitely not a one size fits all type of situation, their wide breadth of experiences can help your outsourced team in navigating different security-related scenarios with efficiency and ease.

Nonetheless, there are also potential downsides when working with an IT safety and security agency. There may be a number of gaps in relation to communication and turnaround time, especially as the team works remotely. However, these are relatively minor and may be addressed by providing clauses on the service agreement that you will sign with the agency.

Whether you decide to go with a full-time Cybersecurity Advisor or decide to outsource your requirements to an IT safety and security agency, make sure to do your due diligence so that you can make a decision that will serve your organization’s interests.

Bear in mind, however, that prevention is better than cure. A sound investment towards improving your company’s data security measures may end up being cheaper than having to contend with the aftermath of a brutal security breach.

 

 

There are daily risks to your business. Technology has improved how business is conducted, but it has also opened the door for cybersecurity risks. There are standards and regulations designed to prevent hackers that organizations must be in compliance with. However, it’s not easy identifying all potential vulnerabilities in a system or network.

Performing a factor analysis of information risk (FAIR) is an important proactive security measure. The assessment looks at the security controls and potential vulnerabilities in the network’s cybersecurity framework. Identifying these threats before a breach occurs will save businesses money and time in fines and penalties.