Based on objective, verifiable information, security ratings are a data-driven and dynamic measurement of your organization’s cybersecurity performance. As ratings are updated on a daily basis, this metric empowers your whole team to have a snapshot of your real-time security posture — and how it’s changing over time. Proven to correlate to the likelihood of a breach, BitSight Security Ratings make it easier than ever for you to quantify risk in terms that make sense to the business. For maximum impact, you can add an industry average or pretext goal to this rating as additional context.
Mean time to detect (MTTD) highlights the average amount of time it takes a security team to become aware of a potential incident. In our current cybersecurity climate, where the security operations center (SOC) is being inundated with alerts, having this visibility is more important than ever. According to a 2018 Imperva survey, 55% of IT professionals receive more than 10,000 threats daily — while 27% receive more than one million. By including MTTD in your cybersecurity dashboard, you can empower your team to align on the current effectiveness of your SOC and how to improve over time in an effort to prevent threat actors from gaining access to your data and systems.
In a similar vein to MTTD, mean time to resolve (MTTR) highlights how long it takes the SOC to remediate a threat after it’s been discovered. By understanding this metric, your executive team can make more informed, data-driven resourcing decisions. If, for example, your MTTR is increasing, that should be an immediate red flag that more budget or headcount needs to be allocated to the SOC to prevent a potential security incident or breach.
In our “new normal” operating environment — where more people are working remotely than ever before — it’s increasingly critical that employees are regularly participating in updated security training initiatives. From a dashboard perspective, it could be useful to include two types of metrics here. Firstly, the security awareness training completion rate can help indicate to the executive team how much human-related error their organization could potentially face on a day-to-day basis. And secondly, the average security awareness training score can highlight whether the investment in these initiatives is actually paying off, in turn helping to make more informed decisions on if and when the training program needs to be revamped to achieve better results.
By equipping stakeholders with a dashboard as a continuous reference tool, you can empower the whole team to make data-driven decisions that more closely consider actual conditions in the cybersecurity department.
Interested in more tips and tricks for optimizing the reporting process across your organization? Check out our ebook, A Practical Guide to Risk-Based Cybersecurity Reporting.
A single unauthorized device being used on your network. An unsanctioned application someone’s accessing from their non-secure home PC. A small vendor with a seemingly insignificant vulnerability.
All of these are seemingly small...
Imagine you've alerted your IT team to a critical infrastructure error plaguing your network. You ask them to drop their current work and focus on immediate remediation of this detected vulnerability. After further investigation,...
Recent events have made cybersecurity a top concern among C-suite executives. The SolarWinds breach, Capital One incident, and Colonial Pipeline attack are just a few of the noteworthy events that have made CEOs and CFOs take active...