Tigger team -- a novel methodology to manage business risk

Abstract

Security is hard. Security is expensive. Security negatively impacts business function. All of these are bad, but far worse is the difficulty of measuring the effectiveness of security. IT security over the last decade has become increasingly visible and important to a broad range of businesses. At the beginning of this period the response to IT risk was predominantly focused on technical prevention. Gradually this has evolved into a more business-oriented approach to risk management. This change has come about largely because of the perception that the technical approach to security provided too narrow a view of risk, failed to engage effectively with business and was failing to deliver benefit. This paper explores a number of the fundamental difficulties that hamper the delivery of effective IT security. It also examines some of the difficulties created because of the conflict between the goals of security and those of business. This paper describes a methodology that attempts to minimise the impact of a number of these difficulties. The primary goal of this methodology is to provide business with clear justification to support IT security activities and to demonstrate an adequate return on investment. The methodology proposes the development of offensive and defensive capabilities within an organisation, in order to identify and manage both contextualised business risk and generic technical risk. The defensive capabilities act as both a control and a deterrent, but most importantly they provide concrete evidence of loss, which can be used to justify future activities. The offensive capabilities allow the business to refine an understanding of their specific risk, rather than generic risk. In addition they also allow realistic testing of the defensive capabilities through simulated attacks. The methodology is cyclic and as it progresses the understanding and management of risks specific to the business should evolve. This will allow security to address increasingly remote and esoteric risks, until it is no longer possible to economically justify deploying mitigation. When this stage is reached the risks will be sufficiently small to fall within the business's risk appetite. The monitoring process should identify exploitation of these risks but no controls would be deployed because they would be uneconomic.