Based on objective, verifiable information, security ratings are a data-driven and dynamic measurement of your organization’s cybersecurity performance. As ratings are updated on a daily basis, this metric empowers your whole team to have a snapshot of your real-time security posture — and how it’s changing over time. Proven to correlate to the likelihood of a breach, BitSight Security Ratings make it easier than ever for you to quantify risk in terms that make sense to the business. For maximum impact, you can add an industry average or pretext goal to this rating as additional context.
Mean time to detect (MTTD) highlights the average amount of time it takes a security team to become aware of a potential incident. In our current cybersecurity climate, where the security operations center (SOC) is being inundated with alerts, having this visibility is more important than ever. According to a 2018 Imperva survey, 55% of IT professionals receive more than 10,000 threats daily — while 27% receive more than one million. By including MTTD in your cybersecurity dashboard, you can empower your team to align on the current effectiveness of your SOC and how to improve over time in an effort to prevent threat actors from gaining access to your data and systems.
In a similar vein to MTTD, mean time to resolve (MTTR) highlights how long it takes the SOC to remediate a threat after it’s been discovered. By understanding this metric, your executive team can make more informed, data-driven resourcing decisions. If, for example, your MTTR is increasing, that should be an immediate red flag that more budget or headcount needs to be allocated to the SOC to prevent a potential security incident or breach.
In our “new normal” operating environment — where more people are working remotely than ever before — it’s increasingly critical that employees are regularly participating in updated security training initiatives. From a dashboard perspective, it could be useful to include two types of metrics here. Firstly, the security awareness training completion rate can help indicate to the executive team how much human-related error their organization could potentially face on a day-to-day basis. And secondly, the average security awareness training score can highlight whether the investment in these initiatives is actually paying off, in turn helping to make more informed decisions on if and when the training program needs to be revamped to achieve better results.
By equipping stakeholders with a dashboard as a continuous reference tool, you can empower the whole team to make data-driven decisions that more closely consider actual conditions in the cybersecurity department.
Interested in more tips and tricks for optimizing the reporting process across your organization? Check out our ebook, A Practical Guide to Risk-Based Cybersecurity Reporting.
Last year, enterprise IT security got turned on its head. As the world adjusted to working from home, IT teams worked overtime to enable remote access for millions of employees.
This transition went smoothly for most organizations, but...
In light of recent widespread breaches and security incidents, such as the cyber attack targeting SolarWinds, security and risk managers are under more pressure than ever to prove that their cybersecurity investments are actually paying...
Not long ago, corporate executives would give only passing thoughts to their organization’s cybersecurity postures. Leadership and board members would take notice in the wake of a major data breach, for example, or a couple of times a year...