Maturity-Based Approach vs. Risk-Based Approach: What’s the Right Answer?

By eSentire

The influx of cyber attacks within the past few years have painted a dire image for the C-suite and the boardroom. As cyber risks grow in number and complexity, business leaders are left wondering just how effective their security programs are. After all, we’ve heard it many times before: cybersecurity is not an IT problem, it’s a business risk to manage.

There are many approaches to developing and managing a cybersecurity program. Currently, the rousing debate within the security industry appears to center on these two options: should organizations adopt a maturity-based approach or a risk-based approach?

The traditional approach to managing cyber risk is maturity-based, wherein organizations aim to achieve a desired level of maturity by implementing certain capabilities and controls. This approach is lauded as the industry favorite and paves the way for an organization to demonstrate the controls and defenses it has built based on standard industry framework, such as the Cybersecurity Maturity Model Certification (CMMC). To demonstrate a specific level of maturity, organizations must fulfill specific requirements outlined by the industry framework, such as:

• Implement phishing training exercises or conduct regular executive awareness briefings for security awareness training
• Enabling multi-factor authentication (MFA) and a strong password etiquette to demonstrate they are adhering to best practices for identity and access management

However, one drawback for some organizations is that maturity models may require a hefty financial investment if the focus is placed on building a multi-layer of defense against everything.

A risk-based approach, on the other hand, allows business leaders to prioritize “building the appropriate controls for the worst vulnerabilities, to defeat the most significant threats”. Risk-based approaches tend to be significantly more cost-effective than maturity models since business leaders have the option to invest heavily in defenses for the vulnerabilities that affect the business’s most critical areas.

A 2019 article by McKinsey & Co. argues that a risk-based approach is an advanced stage in an organization’s cybersecurity journey, whereas a maturity-based approach is still foundational. Rather than chase maturity, business leaders should look inward to identify the set of gaps and critical vulnerabilities identified for their specific business and mitigate those first.

For example, if you identify that the end users in your organization are the weakest link (as is normally the case), you may want to go beyond conducting phishing training or sharing threat advisories to mitigate that risk. Under the risk-based approach, you would implement those practices and more, such as providing simulations and training sessions on good cyber hygiene and how to stay safe online. These additional activities might not be a priority for CISOs who are more concerned with checking off the requirements of a maturity model.

So the question remains, which approach should business leaders rely on to develop their security program? The reality is that while there isn’t a definitive answer that can apply to every type of organization, there is merit in using a risk-based approach since it is geared specifically toward mitigating gaps and vulnerabilities, which can significantly help in reducing cyber risk.

To be successful in using a risk-based approach, here are some questions you can ask yourself:

1. Does my executive team accept that cyber risk is an enterprise risk? 

Many business leaders may consider cyber risks completely separate from other enterprise risks. Given the evolving threat landscape and acceleration towards digital transformation, this is a luxury.

2. What are my business’ “sources of value” and do I understand the specific risks that can impact those sources of value?

Every business has its own set of processes or workflows that are integral to business operations–these are the ‘sources of value’. Retail businesses, as an example, must have a point-of-sale system in their storefronts and an online payment processing portal for e-commerce. Each value source comes with its own enterprise risk. Adversaries can inject malicious code within your website to steal your customers’ credit card information. So, you must understand the specific sources of value for your business and/or industry, and map each to an enterprise risk. Only by doing this will your team be able to gauge the best way to protect your data.

3. Have I identified all potential vulnerabilities that can impact my organization today?

Since your organization’s attack surface is continuously evolving, you must have a deep understanding of any vulnerabilities–especially those tied to a value source–that can impact your organization. Once these vulnerabilities have been identified, you can create a roadmap to establish the protocols and controls needed to fix the vulnerabilities.

4. Do I know the specific TTPs (threats, tactics, and procedures) that threat actors can use to target my business?

Based on the industry in which your business falls, the size of your team, and the type of data you have access to, your organization will face certain TTPs that another organization may not. TTPs also vary based on the software applications and tools used by your organization.

Insurance firms may have access to financial and medical records and government-issued identification for their clients, whereas banks may only hold financial records for their customers. So, it’s critical to identify the specific TTPs that any threat actor can leverage against your organization (i.e., which vulnerabilities are they most likely to target, what are the attack vectors commonly used, etc.) and identify controls to close those gaps.

5. How am I planning to address the vulnerabilities that were discovered?

Once you’ve worked with your security provider to discover all vulnerabilities, you’ll find that either you already have certain measures in place to fix them outright, or that you need to establish a new set of controls altogether. Perhaps it’s a mix of both. Either way, you can now work to set up a roadmap to ensure that you’ve addressed all critical vulnerabilities and work cross-functionally with various teams to determine which controls are working and which controls aren’t working.

As it stands today, it’s inherently more difficult for organizations to get away entirely from maturity models since mapping processes and procedures to an industry framework is a standard practice within cybersecurity. However, it’s also unwise for business leaders to focus so heavily on achieving a certain maturity level that they overlook reducing enterprise risk.

“Business leaders need to make sure that they are cyber risk aware and focused on reducing their cyber risk instead of focusing on a model that pushes towards a certain level of maturity, which can result in a roadmap they are forced to align to amidst a changing threat landscape,” Tia Hopkins, VP, Cyber Risk Advisory and Solutions Architecture, states. “When you end up chasing a maturity model, you might have a scenario where you’re focused entirely on implementing certain tools and technologies, when in reality the largest area of concern might be the users, which means the focus should have been on endpoint prevention and response or security awareness training.”

The attack surface is ever-changing, and the threat landscape is continuously evolving. Ultimately, the goal for any strong cybersecurity program should be to continuously assess and reduce cyber risk.

To learn about the eSentire Cyber Risk Advisory program, please connect with a security specialist today at www.esentire.comTo learn more about how your organization can transition to a risk-based approach, please join us at Tia Hopkins’ session on Quantifying Cyber Risk on August 5, 2021 (11:30am – 12:20pm EST) at Black Hat 2021.

About eSentire

 eSentire Inc., is the Authority in Managed Detection and Response, protecting the critical data and applications of 1000+ organizations in 70+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events. Combining cutting-edge machine learning XDR technology, 24/7 Threat Hunting, and proven security operations leadership, eSentire mitigates business risk, and enables security at scale. The Team eSentire difference means enterprises are protected by the best in the business with a named Cyber Risk Advisor, 24/7 access to SOC Cyber Analysts & Elite Threat Hunters, and industry-leading threat intelligence research from eSentire’s Threat Response Unit (TRU). eSentire provides Managed Risk, Managed Detection and Response and Incident Response services.

For more information, visit www.esentire.com and follow @eSentire.