It was a pleasure to moderate a workshop to assess cyber security risks hosted by Strategy Insights. We discussed options and practices to quantify confidentiality, integrity, and availability risks with delegates of the big players in the pharma, banking, retailing, and service sectors in the Nordics. Thanks to Anna Rose Poyntz, Finlay Wilson, and Edgar Baier for the event coordination. Round tables https://lnkd.in/e_m5eTW5 #cybersecurity #compliance #strategy #banking #ciso #riskmanagement

1. Practices and tools to
Quantify IT Risks
Prof. Hernan Huwyler, MBA CPA

2. Participants
Chatham House Rule > you can use the information
from this forum, but you are allowed to reveal who
made any comment
Name, position, company
Why is this topic important for you?
What are your technical and business challenges?

3. How much are you
saving on cyber
insurance costs from
solving vulnerabilities?

4. If you cannot answer this
question, your IT risk
management is not
working

5. Is this helpful?

6. Where is your IT risk assessment?
Technique Risks (mostly used)
Quali Heatmaps compliance, safety, fraud,
reputation
Questionnaires reporting, infrastructure,
auditing
Desegregated
scoring and bowties
supply chain, third-party
Quanti Decision trees strategy, engineering
At-risk models and
scenario analysis
treasure budgeting, market,
project

7. Introduction
Popular use of data cocktails
based on scores, vulnerability
assessments or questionnaires with
standard IT controls have the
same flaws than a qualitative
approach
Too many risks and issues to
manage
Ambiguities and ordinary values
cannot prioritize actions

8. IT Risk Assessments
Confidentiality, integrity and availability
risks on the IT assets’ lifecycle
1
Identify and measure objectives for the assessment
scope
Set the ownership for asset, service and process-
based identification
Promote your approach to your third-parties

9. Need of risk data
Data on previous losses by incidents,
breaches and disputes
2
Disaggregate the elements of your model
Use ranges when exact values are not known
Calibrate when no previous data is known
Apply different distributions of IT risks
Learn from differences between actual vs. targets
Consider external industry-specific statistics

10. Timing
Assessments would be done before decisions
are made, otherwise it is paper compliance
3
Focus on the most important investment decisions
Start from quick wins with a phased approach
Address the domains of the cyber security program
Cover potential IT assets > planning stage
Limit to complex decisions > you don't need to
perform a risk analysis to know if a vulnerability
fix or procedure are missing

11. Disaggregating IT risks
without data cocktails

12. Introduction
Disaggregate components for
each particular IT asset to
produce meaningful risk scenarios
Understand the specific cause
and effect relationship of
components
Use risk data measured in
monetary units, time, and number
of records

13. Introduction
CIA
objective
Threat
Vulner
ability
Secondary
loss
Secondary
loss
Primary
loss
Secondary
loss
Causes Probability Consequences Impact
Asset

14. Model
Loss
Min Max
#
cases
Confidence
Ln (Max) + Ln (Min)
2 Standard Error
P(A), μ = , σ =
Single
Loss =
Ln
Ln (Max) - Ln (Min)
Confidence Interval
Standard
Error
80% 2.56
90% 3.29
95% 3.92
99% 5.15
+LOGNORM.INV(RAND(),(LN(Min)+LN(Max))/2,(LN(Max)-
LN(Min))/Standard Error)

15. Model
Loss Exceedance Curve
0 100%
Acum
Loss
Reserves for IT incidents
Cost of IT controls
Cyber insurance policies
Outsourcing
Extra assurance costs
No-go decision

16. Methodology
What are the IT security objectives with the
highest risks?
4
Use objectives to disaggregate risks
Assess the uncertainty on assumptions
Understand the value of IT assets to the business
Run simulations on the portfolio
Assess emerging risks with case studies

18. Members

19. Let´s connect
Prof. Hernan Huwyler, MBA CPA
/in/hernanwyler/
hewyler