Cybersecurity Value and Metrics with Gavin Grounds

Welcome to Cybersecurity Vault. I'm your host, Matthew Rosenquist, cybersecurity strategist and CISO at Eclipse. Today we are going to talk about how CISOs can showcase cybersecurity value through metrics. I'm going to be talking with Gavin Grounds, who is an executive director of cybersecurity strategy and information risk management at Verizon and formerly He was the global delivery CISO of Enterprise Services at HP. And it just so happens he also has a patent in this subject. And this is going to be a long breath here. The patent is for systems and methods for automated quantitative risk and threat calculation and remediation. We're going to find out what that means because it plays all into what we're going to be talking about today, which is really about cybersecurity metrics. And well, simply put, they're very tough. It's not easy. And the industry has been struggling for, well, almost a decade and a half now trying to come to terms with how to do it. So we're going to talk about it. We're going to talk about why it's important, and we're going to give some best practices and some recommendations out there. So when we think about cybersecurity metrics, one of the challenges and issues which differentiates it from other industries is, well, it's about measuring things that don't happen. Now think about that. Cybersecurity is about preventing loss. And if you do a good job, you prevent bad things from happening. How do you measure something that doesn't happen? And it all comes circle, you know, full circle when we think about managing that. And, you know, Edwards Deming is famous for saying you can't manage what you can't measure. And obviously there's some challenges here in measuring it. So, We're going to dive into it, and today's podcast is created in part by Eclipse, which secures data in transit through any cloud, network, or device. So welcome, Gavin. Thank you for coming and talking to us today.

It's great to be here, Matthew. Appreciate you inviting me, and yeah, looking forward to an animated discussion around metrics and why they matter and how to make them matter and how to make them relevant. So yeah. We'll see how we get on with time. We can get it all in, but yeah, big area, looking forward to it.

Yes, yes. So before we get kind of into the first question, security metrics can be frustrating. It can be dry. It can be painful. Given the fact of what you've done and the patent that you have, what attracted you? What craziness happened in your brain to say, yes, I want to dive into this headfirst and I want to help the industry make progress? What was it for you that got you into this topic?

I think in many ways, Matthew, it's because it is difficult, first of all, and it's so easy to do it poorly, even accidentally, you know, doing it poorly. But it's just becoming so increasingly critical to every aspect of not just business, but even, you know, our day-to-day lives. We think just in our kind of human interactions or anything we're doing as humans during the day, just the relevance now of cybersecurity and information risk in our day-to-day lives and in business. And so for all those reasons, you've got this kind of heightened criticality of being able to really truly measure how well we're performing in terms of cybersecurity and risk management. So we have the heightened need and it's just so challenging to do. So for me, it became more of a business problem and a business issue to solve more than a kind of technical and mathematical problem. Although, of course, clearly with the pattern and the algorithms, there's a lot of mathematics behind it. But yeah, it was just that need to solve it for where we are in business, in the economy, as humans and the way we live our lives in the modern world. Yeah, and just the dire need to solve the problem.

Well, let's dive into that a little bit more, and I'm going to play devil's advocate here. You know, we can all agree that cybersecurity is important. Yes, yes, it's important, but are the metrics really that important? I mean, if you just do the right things and you turn on that magic switch that says turn security on, you know, why are cybersecurity metrics important to this industry?

Yeah, I think the way I look at that, Matthew, is, is, um, Ironically, a lot of the verbiage that we use in cybersecurity kind of starts to answer the question for us. You know, one for me that strikes me is, for example, is, you know, we talk about cyber health. And so we talk about cyber health and our overall, you know, posture and so on. And, you know, we think about that in the physical world, literally the biological world, and we think, well, what do we mean by health and how do we manage our health? You know, in your opening comments there, you talked about how, you know, how do we measure what didn't happen? And yet interestingly, when we're proactively taking care of our physical health, that's exactly what we are doing. We're measuring what didn't happen. We're measuring how healthy we remain because we took proactive steps to remain healthy. And so when you think about how would that tie then, for example, to some of the things I said a few minutes ago about the fact that we've got the modern world that we all live in and it affects us literally at the personal level, but also at the business level. And I think about that again in human life, and I'm speaking obviously predominantly in countries that have got access to technology and access to good healthcare, because clearly there are countries that are so, you know, under-provisioned in those areas. But in the countries where we have access to, you know, good healthcare and good insights, just look at the expected or the life expectancy now of the average human. Compared to, let's say, 1,000 years ago. You know, the average Roman soldier lived until the age of about 24 years of age, you know. And yet now we still feel like children when we're 24 years of age. And depending on if you're like me, you probably still are a child at 24 years of age. But, you know, but when you think about it, you know, so why are we living so much longer? And it's really because of, of all of the preemptive care fundamentally that is available to us. Because when you think about it, there is an irony to that. Again, just using that analogy of the human body and life, again, in the more perhaps affluent and well-provisioned countries, we tend to be a lot more sedentary as human beings than we otherwise would have been 100 years ago or 200 years ago. And yet, despite that being sedentary, because of the insights that we have into health and healthcare and things that we can do that are going to improve our health, we live longer, generally speaking, and generally we live a healthier life. And so again, we just use that simple phrase, cyber health. And so we said, well, are we taking the same approach to cyber health as we take as a species to human health, all that proactive ways that we Nutrition, well, what would be the equivalent of nutrition in cyber health? Exercise, what would be the equivalent of exercise in cyber health? And so for me, ironically, we've been using all of the analogies that would make sense. The challenge we have is we have, I think, better insights in managing the metrics around our human health compared to the way we manage the metrics around our cyber health in general.

Yeah, I would agree. And I love the analogy for cyber health because we all want our organizations to remain healthy, right? You know, there are other aspects, though, that I'm thinking as well, right? Peter Drucker said, "If you can't measure it, you can't improve it." And with cybersecurity, it's not only, you know, that risk level, but you also have aspects of how much it costs, right? And people don't have infinite budgets, although cybersecurity wants an infinite budget, right? We all do. So you have to manage budgets, you have to manage impacts to users and for management and oversight. So, you know, how do you see cybermetrics overall playing into all of that? Is it crucial and is it a fundamental foundation really to good business decisions? I mean, is this the fuel that we should be using to make good business decisions or are there other other indicators out there that we really should be looking towards?

Yeah, I think it is, Matthew, and not least of which because when we look at any other aspects of business, we always depend on, essentially, on analytics and measurement to be successful. You know, you think in our marketing division, you know, we have a marketing campaign and we have specific analytics, first of all, to try to decide what will be the most effective campaign to drive the outcome that we're looking for. It's all based on facts and figures, and clearly there's some theory and subjectivity that goes with it, but nonetheless there's a very analytical approach that says, how can we make sure that every dollar we spend on a marketing campaign is going to give us the biggest return in terms of the business outcome that we're looking for? And then equally, how do we know that that particular marketing campaign was successful? So we need to see the trend of what sales look like for a particular product line or whatever it is that the marketing campaign is looking to drive. Improvement in. We need to be able to measure that to say, did that marketing campaign really work? So in cybersecurity, if we view it as another element or another aspect of our business, then it's essentially the same rules apply. So you mentioned, Matthew, about, you know, we don't have infinite budgets, but we wish we did. And, you know, I was thinking about that in the context of, let's say, for example, a typical cybersecurity control framework. You know, so we have our policies, we have our standards, we have the control framework. And it's interesting, the question that, you know, I'd encourage our audience to even think about is this, is, you know, in your— just a corporate policy, don't worry too much about regulations and contractual obligations to customers, just think about your corporate policy framework and structure for cybersecurity. And answer, how many policies and standards do you have? How many controls ultimately? How many cybersecurity controls make up your whole pyramid framework. And let's say you land on, you say, okay, well, we have 315. I'm not saying we Verizon do, that's just an arbitrary number. But let's say you land and say, well, we have 315. Then the next question needs to be, how much does each control cost? Because controls don't happen for free. You know, we can—

there's always some cost associated. Yeah, there's always is.

Exactly right. So if we've got 315 controls, okay, control number 1, How much does that cost? How much does it cost us to design it in the first place? How much does it cost us to implement processes, maybe tooling, to effect that control? What does it cost us to monitor it? What does it cost us to react to it? And now we have to calculate that 315 times. And if we can do that, I would guarantee that the dollar figure that we come out with at the end of cost per control is not going to be the same. And then imagine taking that to the next level and say, and and what is that control, what do I get for my money for each of these controls? Because when you think about it, Matthew, as I've looked at that, the controls really serve one of two purposes. They're either binary, in other words, you have to have them. Maybe there is a regulatory requirement, or maybe there's a legal requirement, that control just has to be there to be in business. So that's almost like a binary, it's got to be there.

But if it's— It's boilerplate, it's foundational, got to have it, right.

Exactly, yeah, it's table stakes. You don't have it, you're not in business. But then the rest of those 315, they're essentially there to buy down risk. You know, those controls are there because they're trying to prevent— to your point in your opening comments— they're trying to prevent something bad from happening, fundamentally. So then that's where we can start to ask the question, well, you know, clearly every control doesn't cost the same amount of money. The business outcome from each control— what are we getting for each control?

Because that can be different too, right?

Exactly, exactly. And so, you know, it's also almost back to the analogy of the marketing campaign. You know, we almost do experimentation. We kind of, we have a theory of what we think is going to be effective in the campaign. We try it, we need to tweak it a little bit because we're measuring the actual results. And in cybersecurity, I think we do a really good job of not doing that. You know? Yes. And it's not even—

We need a new model. Almost everybody tries to avoid that. And when we look at those metrics, right, you know, one aspect those metrics can come back and say in managing and prioritizing that, we can look how to dial that risk, you know, up or down, because every organization has a different risk appetite and that's fine. Finding that, defining what that is, and then dialing into it is part of the challenge of any CISO. But while I was at Intel, I actually, I was running a project and, and I had one of the absolute ugliest situations come up. I was asked to figure out, okay, what is the value, right, of a particular security program and showed it in terms of risk. And when I went to present to some very, very smart executives, they said, okay, we get it. We get how this reduces risks. However, we have another program not related to security that can actually increase productivity. So we can show a value proposition in dollars, in revenue. Can you compare to that? Why would we spend money on security for a certain percent of less downtime compared to, you know, efficiency gains over here? And it completely threw everything out of whack because, you know, I approached it as a problem of how I'm going to reduce risk. Not necessarily as a comparative analysis, the opportunity cost that executives and even board members want to look at as well. So again, a good metrics program potentially can show value in many different ways, not just risk reduction, right? Not just cost, but also as part of comparison to opportunity costs.

Absolutely, Matthew. I think you've really struck at the heart of the challenge with that that example you just gave. And, you know, I know we're going to spend a little bit of time talking a lot more about risk and quantification of risk. But, you know, what you just highlighted there really underscores two things. One is the absolute necessity to be able to quantify risk. And then secondly, to be able to put that in business context. You know, because I've always used the analogy oftentimes, you know, you talked about, you know, your focus there was like essentially, you know, an annualized loss expectancy play. It's like, how do we drive this particular risk down? But, you know, if that's our only objective to drive risk down, then the rest of our business doesn't operate that way. The rest of our business is actually deciding how much risk are we willing to take, which is a very different question. You know, as I've often said, you know, imagine if a business leader comes and she says, you know, hey, I've got a $100 million business opportunity here. So we, you know, we can put our cybersecurity geeky hats on and we take a look and say, you know, you've got, you know, 5 critical risks, 4 highs, and 3 mediums. And so what's likely going to happen is that business leader might say, okay, well, can we take those criticals and maybe at least, you know, contain them or drive them down to make them less impactful, right?

Change it from the ugly red to the yellow. Yellow seems okay, right?

Exactly right. So can you get me to yellow and then we'll go? But 2 things have happened as a result of that. One, we now spend the money on whatever controls we need to put in place to take those criticals and bring them down. And the second thing we're doing from a business point of view is we're losing the time value of money. Because if that business executive could have gone ahead straight away, now they're going to be late. Let's make it up, you know, 4 months. So now you've got 4 months' cost of cash, basically, or your time value of money of cash flows that we're not going to realize for 4 more months because we're in the middle of trying to get these high criticals and so on addressed before we go. But here's how that conversation equally could have gone. Equally, hey, I've got $100 million worth of opportunity here. And then we've still got our cybersecurity geek hats on, but now we do a risk quantification approach and we say, you're going to be sitting on $1 million worth of risk. Now, depending on what industry we're in, that business leader, she might just say, I'll take it, thanks. I'll have the $99 million. Accepted. And it's like, boom, gone. We go and we don't lose that 4 months of cash flow and we don't spend money on those controls. Or it might be, yeah, put those controls in place, but I'm going to go anyway. Because the business risk makes sense. And that approach, as you know, Matthew, that is the way we handle pretty much any other business risk scenario. And that's exactly what you experienced, right, with your case study.

Yeah, you know, it's so important to be able to provide the right information to the decision makers. And if you don't have a good quantification of risk, it's difficult for them to make those trade-offs. Or they can make them but ill-informed, which typically doesn't have very good outcomes, right? So being able to quantify that in terms that are accurate, timely, right, and relevant to the decisions they need to make, I mean, are key to all the metrics. So let's back up a little bit because, you know, we talked about how metrics are important, very important to cybersecurity, and cybersecurity is more important to all of our digital ecosystems. So it all ties in. It has value to the business. So, you know, my question is, is why hasn't this been figured out? Right. I mean, we've been working on this for 15 years. Originally, the industry said, well, hey, insurance has got this figured out, right? They use ALE and ARO and SLE, right? Single loss expectancy, annual rate of occurrence, you know, annual loss expectancy. And they figure all these things out. Let's just adopt that model. And I saw where some organizations tried to just map that over and it didn't work out so well, right? You know, I mean, what are your thoughts there? I mean, I've got some thoughts in the back of my head, but I mean, why didn't it get solved 15 years ago just by adopting another industry's model?

Yeah, so I think perhaps even in more recent years, you know, there have been a couple of initiatives around that kind of modeling or that approach Matthew used to describe is, you know, how do we take, you know, the cybersecurity risk and kind of build like an ALE type play around it so we can at least say, hey, look, we spent $1 million and we avoided losing $35 million, and here's the math to kind of prove it. But I think part of the challenge is, and it just ties right back to the foundational metrics themselves, because for a calculation to work like that, we have to look at, you know, all of the usual things, you know, that you talked about a little bit earlier in the probability. And first of all, you know, one approach for that, even if we have some metrics, we might be tempted to almost like do a rearview mirror approach. It's like your credit score. You know, your credit score is kind of an indication of how well you used to pay your bills. And we kind of use it even in the financial industry, you know, we kind of use it as an indicative of what your future behavior might be. But it's not really predictive, it's just kind of indicative. And so even if we have, you know, a reasonably good history, the problem thing that we have with that model today still is the way we measure things in cybersecurity is still inconsistent. So, you know, you can look at some— think about vulnerabilities, you know, depending on the type of vulnerability we're talking about, it will be rated either low, medium, high, critical. So we've got 3 colors, 4 colors to choose from. Or 4 levels rather to choose from, or maybe 3 colors, red, amber, green, you know. And then every other part of business, we actually come up with the numbers first, and the numbers produce the heat map. And in cybersecurity, we come up with the heat map first, then we say, how do we turn this into, into numbers, you know, right? So, so there's that. And then even with this low, medium, high, critical, or, you know, red, amber, green, or maybe we look at some of the vulnerability reports, you know, MITRE's scale and all that, and it's like 1 through 10. But now we already can see the problem. So we were looking at some scales, we're rating that 1 through 10. Over here, we're rating these, you know, low, medium, high, critical, red, amber, green. And then with all of that, then we try to merge all that together and say, well, so what's our cyber risk posture? And invariably, it's in the absence of the context of business. So let's say, for example, if I've got something that is rated top 10, number 10, it's like 10 of 10. Vulnerability. Most of our— most of the listeners' organizations probably will have the approach of all hands on deck, find out what the systems— they've got that vulnerability, off we go, boom, boom, boom, knock it out, knock it out, knock it out. And that would basically mean that, you know, the systems that are managing treasury processes are getting the same level of attention as the system that's managing the cafeteria menu, uh, you know. So then, which becomes— right, exactly. I know that people can listen to, yeah, well, you've got east-west movement, so let's just assume that, you know, we factor that into it. So the cafeteria menu, you know, it's segregated sufficiently from our treasury management systems. And so, you know, so there are, of course, those nuances, but the point is, even in our approach, typically we don't even factor those nuances in. It's just go, go, go, go. It's a 10, it's a 10, just get it done, get it done. And yet how many, say, level 6s been scored a 6 are sitting somewhere where it can absolutely facilitate east-west movement in the organization, and they're being ignored. Yeah, exactly. And I think part of that, Matthew, is, is also because a lot of cybersecurity metrics that are there kind of grew up out of compliance. So what I mean by that, so we might have a policy standard— I'm going to stay on vulnerabilities just as an example. So we might have a policy standard that basically says, you know, depending on low, medium, high, critical, or red, amber, green, or whatever, we might say, okay, the, the, uh, the mitigation or remediation standard is if it's this bad, you've got to get it done within 15 days. If it's this bad, 30, 60, 90, right? And so here's the irony of that. So you still could have that, you know, rated number 10. Let's say you've got to give yourself a target, 15 days. So on your cybersecurity metrics, on day 13, what color in our lovely red, amber, green scale is that going to show up at? It's going to show up as green because we've got 2 more days to go. Well, so our policy says you've got 15 days, we're at day 13, oh, green, well done everybody. From a risk perspective, that risk is there the minute it's there. So what it really— exactly, exactly. So the minute we can measure it, it's already red, uh, in that example, right? So, and it doesn't get any less red over time. It doesn't say, well, it would be red, but we've got 13 days to go, don't worry about it. It's like, no, it's screaming red. And that's why, by the way, you know, we could have, um, a vulnerability management dashboard that is showing green all over the place, but from a risk perspective, our risk profile could be showing completely red. But for that reason, because the risk is there until it's resolved. So I know it's a complex answer to the question, Matthew, but I think that's, you know, that's kind of the foundational challenge that we have, that we have these different disparate ways of trying to measure cybersecurity performance, you know, and cybersecurity posture and overall risk. The disparate measures invariably in the absence of business context. And then if we then try to push it into an ALE, so we're trying to do an annualized loss expectancy, We then try to rely on the right-hand side of that tree, if you like, that says how do we calculate the direct impact, financial losses and secondary losses.

Consequences and impacts.

Exactly. But we're trying to make an apple pie with oranges. The two are just not fundamentally harmonious.

Yeah, I agree with you. There can be huge disconnects. And again, as you mentioned it, it's much easier to do metrics wrong than right. And if your dashboard is all green because you still have a window of opportunity according to your policy, your SLA, and yet your risk is in the red and you're going to feel that, it's, it's a disconnect, right? And we see, you know, a lot of organizations putting terrible metrics in place. And once you have terrible metrics, you're going to use whatever you have. So now you're using terrible metrics to make business decisions. And again, the end of that story never turns out very well. And back in the day when, when, you know, all of us were thinking, hey, we're just going to adopt that insurance model. One of the things that insurance models have is they have massive actuary tables which show, right, a history. And even though it's not predictive. So, for example, you know, fires in the state of California, right? How many house fires occur? You can't use that data to predict whether a house on your block is gonna catch fire. You can look at trends and say, it's within kind of this range that we expect every year, right? Plus or minus 5%. But when we look at the total chaos and unpredictability around cybersecurity, those ranges get so big, it just doesn't even make sense. And, you know, trying to even capture data that's relevant— in the beginning, nobody was even capturing the data or aggregating it, right? So we didn't have the data. And then once we did have the data, we realized it's so varying that that actuary model that the insurance industry relies upon doesn't work so well. And the one other aspect that, that, you know, I try and impress upon people is Security metrics are different than IT metrics. And the example I always give is, if you're in IT, right, and you're supporting the IT environment, and a power supply goes out in one of your servers, right, you know what you have to do. You got to go down to the data center, you got to pull out the server, rip out the power supply, slap in a new one, reboot, and you're good to go, right? And it's scriptable. It's absolutely scriptable. In fact, when you start looking at mean time to repair and mean time to failure metrics, You can start to predict that. You can start having assets in place ready to go and even swap it out ahead of time. So you can start managing those risks proactively. And the big difference is you don't have an intelligent actor that is adapting to what you're doing, whereas you do have that in cybersecurity. So trying to measure risk becomes an exponentially more difficult challenge than trying to measure the risk of a power failure on your server. It's completely different because as you move one direction, your opponent's going to move a different direction and adapt to you. So trying to get risk metrics, incredibly tough, especially down to the point of when are we going to get hacked? How much is it going to cost us? We can take some swags at it. Even the best metrics can give some ideas, But quantifying it, incredibly difficult. Whereas in other disciplines within the business, as you said, you quantify a situation first and then you qualify it to make it more palatable and understandable. We're the reverse in cybersecurity. We tend to start with qualitative metrics and then try and translate that to some type of quantitative. And the accuracy there, it doesn't translate very well, but it's what we have. And there are best practices out there. So given your experience and the challenges, right, what do you see when we talk about the quantification of risk, qual to quant, right? What's necessary in an organization to start thinking about how do we do this? How do we start gaining the value of security metrics by generating ones that we can feel fairly confident in? What are some of those first steps in your mind?

Yeah, so I think there's a couple of things, Matthew. I want to actually just go back and underscore something that you said, because to my mind it is one of the first steps. You know, you gave an example, you gave two examples. You talked about, you know, trying to apply the insurance type mindset and methodologies, you know, and the fact that, you know, there is that depth of kind of, you know, data and historical information for like actuaries, for example. And then you talked about, you know, the IT kind of metrics and standards and processes. And what those two have in common, that cybersecurity is different, is if you think like an actuary— well, let's take something physical like a fire hazard. You know, fire doesn't change its nature. You know, there's a finite number of variations. You know, you've got a fire because, I don't know, your building is close to an electrical power plant, and so you've got the likelihood of an accident.

Fuel, ignition source.

Exactly. Exactly. It really becomes a finite— or flooding, if you're living on a floodplain, if you're living close to the ocean, if you're not living close to the ocean. You know, there are a finite number of scenarios that the actuary model can be based on. Whereas when it comes to cyber security, and that's why, you know, you've made a point really well, Matthew, there, is that when we think about even just with a cyber attack, the methods or the TTPs, you know, the techniques and the tools and so on, they just constantly vary. So there is no finite number of scenarios of the way in which, you know, an attack can be executed. And I think that is almost like a fundamental way of thinking. So rather than trying to say, well, we've got these way we've been measuring metrics and, you know, this disparate way that we've been doing it and then trying to stuff that into a model, I think it's really about starting off first of all, you know, with taking a hard look at what we already do know. I think we've used, or I've used this analogy before, I think I've shared it with you, Matthew, when we were chatting one time. And that's, you know, people will sometimes say, well, you've got to start from somewhere. And when you really think about that, that's kind of a really strange statement to say. I remember when I was a kid, I'd be walking around with my nan, you know, my family are Irish, and I don't know if she was saying it just to tease people or whatever, but somebody would come in and ask her for directions and she'd be like, well, I wouldn't start from here if I were you. The person would go like this.

How does that help me?

And then she'd laugh. And I wasn't sure if she was just doing it to get a laugh out of it, but it's actually— it is an interesting statement because when you say, well, you've got to start somewhere, that's like saying I wouldn't start from here if I were you. In other words, the only place we can start is where we are. Right. So when you think about where are we starting? Well, where we're starting is most of our listeners are probably in a situation where we've got more data than we have information already. You know, if we're using, you know, I don't want to drop a name, but a platform like Splunk, for example, or any kind of similar platform, you know, oftentimes that just becomes a giant syslog server. It just becomes like a giant, giant— right, but everything that might be happening. Yes, exactly. And then we just try and build dashboards. Well, here's our dashboard for our vulnerability, and here's our dashboard for our endpoint protection. And here's our dashboard for this. I don't know about you, but my car has one dashboard, you know? So I think, you know, to really boil it down and just start off with what we do know. So don't be thinking about the next shiny tool. Don't be thinking about, I need a widget to do this or the other. It's like, take a look at what we do know. What are we collecting? Whether it's system logs, whether it's, you know, user activity, whether it's, you know, security tooling logs. I mean, the whole plethora. We've got, just tons and tons of data, but we don't have tons of information. And then taking a look at that and then literally doing an analytics plan, saying, okay, so what does this data now tell me about the environment? You know, so, so then we can start to put it in business context. So, all right, so if it's a particular application, or a particular application that's supposed to support a particular business process, what kind of data is it? And let's not go straight down the way as we do as cybersecurity people and start thinking about is it public, is it private, is it confidential, is it highly confidential? But really start thinking out what's the value of that data?

Right.

Or what's the value of that process? Because we could have data, just using data as an example, we could have data that's confidential that financially is worth far more to the business than something that's tagged as highly confidential. So it's really kind of taking, literally running analytics of what is all of this noise telling me about the operating environment? And then taking that and putting it in the context of about these specific applications or platforms or business processes. And then we say, and how valuable are those business processes? And then we can start to build a picture on what we do know. We literally start from where we are. And that's in any other kind of business area, that is how we would approach metrics.

Absolutely. And I love that instead of going tabula rasa, okay, let's, let's, You got to start with what you have. Oh, absolutely. And I love that instead of going tabula rasa, okay, let's— you got to start with what you have. Now, I'm going to challenge you here and I'm going to say, because the last company and, you know, when I was with Intel, the last division that I built there, the first thing I started with, right, is saying what business decisions need to be made. Let's not worry about the data or see how many attacks, right? No, tell me what business decisions the CEO needs to make from a security perspective. Great. When we have those, now take it to that next step and go, okay, well, what data do we have? What are they gonna need to be able to make that decision? Because even if you've got some really cool data, and I've seen awesome charts, Awesome chart. Pointless because it didn't contribute to an actual decision being made. Looked great. One of my favorite ones is the world map where you see attacks coming from different places. It looks awesome. Completely worthless. Add zero value to the business decisions that have to get made. Looks cool. Cool factor high. Practicality worthless. So, you know, I've always approached it saying, What business decisions need to be made? Then jumping to, okay, what data do we have and how does that fill that? Are there any gaps? Do we need something else? And from then kind of planning a good system. Would you agree? Am I nuts here?

No, you're spot on, Matthew. And that's what I was going to say is it's not an either or. What I described is one approach and it should not be the only approach to your point, but it's one approach of what I just described as like a bottoms-up approach. It's like, you know, figure out what we've got and why we care about what we've got and why and make it minimal. And to your point, if we're collecting a whole lot of information that drives no business value, then that's costing us storage dollars. So why are we collecting it?

You know, so time and resources and opportunity cost and everything else.

Yeah, exactly. But whereas what you described is then the top-down, it's like, okay, so what's the business? You know, what is the strategy of each business unit? What are they looking to do? And then You know, what does cybersecurity need to do to enable that and really to optimize the profitability of whatever that venture is? That's why I say it's not either/or, because oftentimes what we see from the bottom going up is we actually can identify scenarios that we say that's going to impact the business. And it's a scenario that's developing that we didn't see coming. And to me, that's not— Again, this is similar to like taking care of our personal health. You know, if we— again, if we live in a country where we're well serviced by healthcare, you know, we will have the opportunity to get an annual health screening. And that annual health screening, you know, you can have a full blood panel done. You know, if there's something we're a little bit concerned about, we can have scopes done, we can have MRIs done, and we actually get to see whatever we need to see that will lead us to a conclusion, say, hey, there's some proactive action we need to take. What do we take here to prevent a terrible outcome to our, in this case, our body, the business of our body? And so I think those two, the Jude Stratton method, they actually need to, we need both, you know, because what they then do is that they actually kind of come together. The bottoms up will flush out either opportunity or risks to business operations. The top down is like, hey, cybersecurity, here's what we're going to do in the business. We need you to make sure that it stays as profitable as we possibly can be. And so that's why I think the two actually go, you know, harmonized, you know, really well together when we deliberately do them in the fashion that we do.

You have to connect those two because the data supports the decisions and everything. Okay, so let's kind of close out here. I want your ideas around the best usage of security metrics, right? So if, you know, one of our listeners is a CISO out there and they're working, you know, they're all focused on vulnerability. I just got to close though that, 10 vulnerability, and that's my entire job firefight every day. You know, and they're listening to us going, hey, yes, metrics, I really need them. I've been putting it off. Sounds ugly. What is your selling point here? What is, you know, your recommendations for the top usage and benefits for that CISO to allocate a little time and get a good metrics program established? What's in it for them?

Yeah, so you touched on it a little bit earlier actually, Matthew, and you— it was when you— it was a real kind of short, quick passing comment that you made, and you talked about risk appetite. And, you know, I, I really believe that a lot of CISOs, either CISOs themselves or the CISO organization, and, and information risk management, cyber risk management— I think a lot of professionals struggle to understand what we mean by risk appetite, as though it's like one thing. They say, well, that's for the board to decide. I don't know about you, but I don't think there's many board directors on the board, you know, that are just going to say, well, my cybersecurity risk appetite is this, so go measure that, and if it goes above that, then you're red, you know. So, so we think again, any other aspects of the business, the risk appetite is, is actually built around, around financials. So, you know, so for example, uh, any initiative that we're embarking on the business What we're looking at, for example, is the return on capital. And so we're talking about the return on capital, and for a complex business of multiple business units, we might have, you know, varying targets for the return on capital depending, you know, on the nature of the business. Or if it's a simple business, then we'll have a singular, you know, cost of capital and therefore a return on capital as a target, whether we're using, you know, weighted average cost of capital, whatever the methodology is. But that's how we measure the business. And so when we talk about risk appetite, what we're really talking about in the business terms is how much are we willing to potentially lose and still see the return on the capital that we're looking for. So that's like return on capital play. You can have the same view with return on equity and, you know, return on investment or whatever. And I think in cybersecurity, we definitely don't talk in those terms. So we're not actually representing the business value of what we're doing in those terms. My advice, if you like, is like to a CISO, where do we start? It's actually— and you touched on it, Matthew, before— it's like, what are the business objectives for our various business units or for the company itself? What is the return on capital, the return on equity that essentially our business is looking for? Then we can walk down from there and say, so what metrics do we need to measure to demonstrate that we're actually protecting those investments and realizing those returns? It's not easy, but that's the, that's the, uh, that's the danger.

But that's a huge benefit, right, for a CISO to be able to use metrics so that they can communicate the value of their program to the C-suite, to the boards, to say in business terms, this is how— what we're doing now, this is what our target is. Because with metrics, now you can set that risk appetite target. Right. And so everybody's kind of on the same page because no CISO, right, wants an uninformed board or C-suite to be shocked when something bad happens. Right. Because it's just your neck in a noose. Whereas if you have those metrics and you said, hey, you know, we're making decisions and you've decided to accept these risks. Right. And they're going to happen. Right. If we can quantify it eventually. And this is what we're going to protect against. When that bad thing does happen, it's not a surprise. It's you accepted the risk. We talked about this. You have the numbers. You know, you made that business decision. You know, it's not that cyber failed, right? We did exactly what we were supposed to do by hitting that risk target. So it provides some incredible power to that CISO who has a program like that.

Exactly. And you hit the number again, you hit it on the head, Matthew, when you said about we gave you the numbers because again, in any other domain of risk, you know, that will show up on the balance sheet. You know, there'll be a line item specifically on the balance sheet to accommodate for, you know, unplanned spend basically as risks get realized. That's where we need to drive to with, you know, with a good cybersecurity metrics program.

Okay, so this has been a great discussion, great discussion. And we're gonna have another one. We're gonna do another session. We're gonna talk about how to build a program like that, some of the best practices, some of the pitfalls to avoid. But as I understand it, that you're chairing a special interest group that's initiated by Gartner. Can you give us a little insights to what that is?

Yeah, sure. So basically, you know, the approach that I've taken at Verizon is, is essentially starting with creating cybersecurity risk as a currency in its own right. So in other words, you know, so as the IT operations or the delivery organizations, you know, they get an OpEx budget, they get a CapEx budget, and now they get a risk budget. And that risk budget is a thing like a points system. They have to manage within their budget of risk. So basically, I've shared that on a number of different forums, including Gartner, and Gartner set up a special interest group now to focus specifically on quantification of risk, where we treat and manage cyber risk as a currency in its own right. So we literally manage the budget of cybersecurity risk. So yeah, anyone who's a Gartner member, you know, that's something that you should definitely look into. So yeah, that's awesome. So we actually have the first session that we're kicking off on that next week. We've got a number of CISOs participating in workshops to see kind of how to get there, basically.

Outstanding. Is some of that discussion and output going to be made public as well? Are you going to be sharing that with the world?

Yeah, absolutely. You mentioned the patent earlier, Matthew, so we got that filed, so we're kind of protected with that. But the methodology and the outcome, you know, the way we're looking at this, Matthew, is, and the way I'm looking at it, is in many ways we're all in this together as a cybersecurity community across every industry. You know, we're in this together, and I think that the more we can do to share and build common practices that do align cybersecurity with business outcomes, I think just the better off we'll be as a whole community.

I agree with you wholeheartedly. I mean, it's us against the bad guys. It's not you against me, one company against another. We're all in the same boat. We're all potential targets. So we have to collaborate, you know, and communicate because the bad guys do and they're coming after us. So this has been great. So I'm going to close this out, but I do want to invite everybody back. Our next session, I'm going to again be grilling Gavin here. We're going to be talking about risk taxonomy. We're going to be talking about the economics of it, you know, viewing it from that perspective, best practices, how to set things up and some pitfalls that you want to avoid if you do want to establish a good cyber risk metrics program. So thank you very much, Gavin.

Been a pleasure, Matthew. Thank you so much. Look forward to catching up again.