Nowadays it is very difficult for a Company to evaluate the risk associated with a Cybersecurity attack.
At the management level, it is often not clear why the risk cannot be eradicated, but only reduced to an acceptable minimum. This uncertainty often creates a lack of confidence in placing the right value on security. The steps to increasing security also involve some significant investment.
In order to get a basic understanding of the situation in the field of cybersecurity, below I’ve highlighted the three laws of cybersecurity, which will probably stun all readers.
The Three Laws of Cybersecurity (VEP)
- Every System has a Vulnerability
- A Vulnerability will be Exploited soon or later
- A Continuous Improvement Process helps to Postpone the Exploitation and to Limit the damages
From the three rules highlighted above you can deduce a very simple fact: zero risk does not exist and a vulnerability in any organization will always be present in some form.
The vulnerability can obviously be at the technical level of programming, at the network level, at the system configuration level, in a business process or even at the personnel level. The last is probably the most difficult to control.
Therefore, it is crucial to manage risk by determining a balance between usability and the implementation of security protections. The main objective of risk management is to implement security protections that are commensurate with risk. Applying unnecessary protections may waste resources and make systems more difficult to use and maintain. On the other hand, not applying protections needed to protect the system may leave it and its information vulnerable to breaches in confidentiality, integrity, and availability, all of which could block an entire organization.
More information you find in the Book