Based on objective, verifiable information, security ratings are a data-driven and dynamic measurement of your organization’s cybersecurity performance. As ratings are updated on a daily basis, this metric empowers your whole team to have a snapshot of your real-time security posture — and how it’s changing over time. Proven to correlate to the likelihood of a breach, BitSight Security Ratings make it easier than ever for you to quantify risk in terms that make sense to the business. For maximum impact, you can add an industry average or pretext goal to this rating as additional context.
Mean time to detect (MTTD) highlights the average amount of time it takes a security team to become aware of a potential incident. In our current cybersecurity climate, where the security operations center (SOC) is being inundated with alerts, having this visibility is more important than ever. According to a 2018 Imperva survey, 55% of IT professionals receive more than 10,000 threats daily — while 27% receive more than one million. By including MTTD in your cybersecurity dashboard, you can empower your team to align on the current effectiveness of your SOC and how to improve over time in an effort to prevent threat actors from gaining access to your data and systems.
In a similar vein to MTTD, mean time to resolve (MTTR) highlights how long it takes the SOC to remediate a threat after it’s been discovered. By understanding this metric, your executive team can make more informed, data-driven resourcing decisions. If, for example, your MTTR is increasing, that should be an immediate red flag that more budget or headcount needs to be allocated to the SOC to prevent a potential security incident or breach.
In our “new normal” operating environment — where more people are working remotely than ever before — it’s increasingly critical that employees are regularly participating in updated security training initiatives. From a dashboard perspective, it could be useful to include two types of metrics here. Firstly, the security awareness training completion rate can help indicate to the executive team how much human-related error their organization could potentially face on a day-to-day basis. And secondly, the average security awareness training score can highlight whether the investment in these initiatives is actually paying off, in turn helping to make more informed decisions on if and when the training program needs to be revamped to achieve better results.
By equipping stakeholders with a dashboard as a continuous reference tool, you can empower the whole team to make data-driven decisions that more closely consider actual conditions in the cybersecurity department.
Interested in more tips and tricks for optimizing the reporting process across your organization? Check out our ebook, A Practical Guide to Risk-Based Cybersecurity Reporting.
Despite the best efforts from security and risk leaders, it can be extremely difficult to establish an efficient and effective enterprise risk management plan. As with anything that requires buy-in from the executive level, there has to be...
Cyber risk is everywhere. As organizations become increasingly interconnected — across business units, geographies, subsidiaries, remote offices, and third-party networks — the digital ecosystem is expanding rapidly. And this increased ...