How Does Business-Driven Security Reduce Risk?

TL;DR

Business-driven security reduces cyber risk by using an organization’s unique business context to identify what matters most, prioritize limited resources, and support informed risk-taking. Instead of pursuing an unhackable environment, defenders should make risk visible and manageable, define their mission precisely, and adopt personalized approaches inspired by preventive and precision medicine.

Transcript

Greetings. Good afternoon. Welcome to the APJ edition of RSA Conference 2017. This is our fifth year here, and the conference has grown threefold during that time. This year we anticipate a record registration of sixty-five hundred plus attendees. And at hundred and eight plus sponsors, we are convinced that the cyber market in APJ is healthy. It m... Read More

Key Insights

• Business context is the defender’s central asymmetric advantage because organizations should understand their own operations, priorities, and acceptable risks better than attackers do. That knowledge enables security teams to focus limited time and resources precisely on the systems and outcomes that matter most.
• Business-driven security is a model for ruthlessly prioritizing security activity according to organizational context. It complements technology, innovation, information sharing, collaboration, and education by connecting defensive choices to the business risks and objectives that those choices are intended to address.
• Cybersecurity is a business problem because boards, policymakers, and regulators now participate directly in decisions about security, privacy, compliance, and risk. Security practitioners therefore need to communicate risk clearly enough for business stakeholders to understand it, manage it, and determine which exposures are acceptable.
• The security mission is to create a safer environment, not an unhackable one. A risk-based program makes uncertainty and exposure visible, prioritizes them, manages them, and helps stakeholders take command of risk rather than promising the impossible elimination of every threat.
• The attack surface is expanding from traditional information technology into operational technology, industrial control systems, critical infrastructure, connected devices, and software-enabled products. This changing digital perimeter resembles a complex living organism and makes uniform security controls increasingly inadequate.
• Cyber adversaries are persistent, collaborative, bold, adaptive, and difficult to catch. Their advantages mean defenders cannot rely on hope, luck, fear, or technology alone. A sustainable defensive strategy must also address the psychology of defense by establishing a credible basis for success.
• Precision medicine works by examining individual characteristics such as the genome, biomarkers, family history, environment, and lifestyle instead of relying only on treatments designed for broad populations. The twins Noah and Alexie Berry illustrate how personalized evidence can reveal new treatment pathways.
• Precision cybersecurity applies the logic of personalized medicine to an organization’s distinctive circumstances and risk appetite. Rather than imposing a one-size-fits-all response, it uses business context to choose proportionate actions that protect important outcomes while preserving the convenience and innovation sought through digital transformation.

Questions & Answers

Q: What is business-driven security?

Business-driven security is an approach that connects security priorities and actions to an organization’s specific business context. It treats knowledge of the business as the defender’s asymmetric advantage. By making risk visible, assessing its importance, and prioritizing responses, the approach helps business stakeholders decide what risk is worth taking and directs limited defensive resources toward what matters most.

Q: Why is business context an advantage in cybersecurity?

Business context is an advantage because no attacker should understand an organization’s operations, priorities, critical assets, and risk appetite better than the organization itself. Defenders can use that knowledge to distinguish essential risks from less consequential ones. This supports precise prioritization when adversaries are strong, the attack surface is large, and there is not enough time or capacity to address every issue equally.

Q: How should organizations define the mission of cybersecurity?

Organizations should define cybersecurity as the management of risk and the creation of a safer environment, not as an attempt to eliminate every threat or build an unhackable world. The mission is to make risk visible, examine it, prioritize it, and manage it. Security teams should help business stakeholders understand exposures and decide which risks are worth accepting in pursuit of organizational goals.

Q: Why does cybersecurity need to shift from threat management to risk management?

Cybersecurity needs a risk-management focus because threats cannot be completely eradicated, while organizations must continue operating and pursuing digital opportunities. A threat-centered model can encourage teams to react uniformly to every danger. A risk-centered model evaluates potential effects in business context, concentrates effort on important exposures, and enables stakeholders to balance security, convenience, compliance, and worthwhile risk-taking.

Q: How is precision medicine relevant to cybersecurity?

Precision medicine is relevant because it replaces a one-size-fits-all treatment model with decisions based on the unique individual, including genome, biomarkers, family history, environment, and lifestyle. Cybersecurity can follow the same logic by examining each organization’s distinctive environment, assets, priorities, and risk appetite. That context can produce more appropriate security actions than applying identical controls and responses everywhere.

Q: What does the story of Noah and Alexie Berry demonstrate?

The story demonstrates the value of personalized evidence when a general treatment model fails. After mysterious spasms, years of diagnostic work, and recurring symptoms, genome sequencing of the twins and their family revealed a genetic variant inherited from both parents. That insight opened multiple treatment pathways, allowing the twins to select a less invasive option based on their risk appetite and become nearly symptom-free.

Q: Why are traditional cybersecurity approaches becoming insufficient?

Traditional approaches are becoming insufficient because the protected environment now includes information technology, operational technology, industrial control systems, critical infrastructure, connected devices, and software-enabled products. Meanwhile, adversaries are persistent, collaborative, adaptive, and rarely caught. Technology, innovation, sharing, collaboration, and education remain vital, but they do not by themselves provide the precise prioritization needed across an expanding and changing attack surface.

Q: How can security teams put the precision advantage into practice?

Security teams can begin by defining their mission precisely and shifting attention from eliminating threats to managing business risk. They should identify the organization’s important outcomes, make relevant risks visible, prioritize those risks ruthlessly, and involve business stakeholders in deciding what exposure is acceptable. They can then tailor defensive choices to their own environment and risk appetite instead of depending on uniform, one-size-fits-all responses.

Summary & Key Takeaways

• Cybersecurity faces persistent adversaries, expanding attack surfaces, widespread software adoption, and growing regulatory scrutiny. Connected devices, industrial systems, critical infrastructure, and digital economies have turned security into a business problem. Since technology and collaboration alone are insufficient, defenders need a sustainable advantage grounded in their knowledge of the organization.

• Business-driven security uses organizational context to prioritize risks and concentrate defenses on what matters most. Its mission is not to eliminate every threat or create an unhackable world. It seeks to make risk visible, assess and prioritize it, and enable business stakeholders to decide which risks are worth taking.

• The proposed model draws from modern and precision medicine. Modern medicine shifts attention from treating symptoms toward supporting wellness, while precision medicine uses individual characteristics to select appropriate treatments. Cybersecurity can apply the same principles by defining its mission precisely and tailoring decisions to each organization’s assets, environment, priorities, and risk appetite.