Rationale
As organizations increasingly rely on digital technologies, the complexity of managing cybersecurity risks grows. A fragmented approach to security can lead to gaps in coverage, inconsistent policy enforcement, and increased vulnerabilities, compounded by shadow IT, insufficient asset management, and unclear responsibilities. To address these challenges, an integrated cyber risk operating model is essential. This model unifies Governance, Risk, and Compliance (GRC) functions with product teams, security champions, and other key stakeholders to ensure a holistic and strategic approach to cyber risk that aligns with business objectives, regulatory requirements, and risk management priorities.
Effective risk management is crucial for maintaining a strong cyber security posture. It’s not just about identifying risks, but also about prioritizing them to ensure that the most critical threats are addressed first. Overloading teams with an excessive number of alerts or low-priority tasks can lead to alert fatigue, decreased efficiency, and the potential for significant risks to be overlooked.
To prevent this, it is important to have a clear process for assessing and categorizing risks based on their potential impact and likelihood. High-impact vulnerabilities, such as zero-days, should be addressed immediately by incident management teams, while lower-priority issues can be scheduled according to their risk level and business impact.
Additionally, it is vital to maintain open lines of communication between the GRC team, product owners, and security champions. This ensures that everyone is aware of the current risk landscape and understands the rationale behind prioritizing certain risks over others. By focusing on the most significant threats and avoiding unnecessary noise, teams can remain agile and responsive, effectively managing cyber risks without being overwhelmed.
Overall, a well-integrated risk management process not only minimizes vulnerabilities, but also aligns security efforts with organizational goals, ensuring that resources are used efficiently and effectively to protect the organization from cyber threats.
Goal
The goal of this best practice is to establish a cohesive cyber security operating model that:
Aligns security efforts across all teams.
Enhances risk management and compliance.
Improves communication and collaboration.
Mitigates risks from shadow IT and inadequate asset management.
Supports strategic decision-making for a stronger security posture.
Best practice workflows
While this suggested Operating Model provides a general framework based on industry knowledge and experience, its applicability may vary depending on each organization’s structure and needs. Organizations should tailor this model to their unique environments, recognizing that responsibilities for different teams can differ and should remain adaptable to evolving security requirements and organizational changes.
Clarifying roles and responsibilities:
Security champions: Embedded within product teams they promote security best practices, conduct initial assessments, and liaise with both product teams and the GRC team. In scenarios where product owners take on more security responsibilities, the role of security champions may need adjustment.
Product owners (POs): Responsible for the security of their specific products, including vulnerability management, patching, and compliance. They own and manage the cyber risks affecting their products but may lack visibility across the entire IT environment, especially in cases of shadow IT.
GRC team: Clearly defined within the cyber security operating model, with specific roles in governance, risk management, compliance, and policy development.
Cohort leads or heads of departments: Oversee multiple products or tools, providing a broader view and coordinating efforts across multiple teams, especially for vulnerabilities affecting multiple areas.
Challenges and considerations
Lack of visibility: This is a significant issue that product owners alone may not be able to address due to their limited scope of responsibility. Without a clear inventory of all assets and applications, it's challenging to enforce security policies or ensure comprehensive vulnerability management.
Decentralized vs. centralized responsibility: There is a trade-off between having decentralized security responsibilities (handled by POs) versus a more centralized approach (handled by a dedicated team or security champions). A decentralized model can lead to inconsistencies in security practices and difficulty in communication, especially when quick, coordinated responses are needed.
Risk management and the decision-making process
A successful risk assessment and decision-making process requires comprehensive asset coverage within the organization by the Product Owners. With their strong understanding of security standards, thorough coverage of all system components, and minimal overlap in responsibilities, Product Owners are well-positioned to own and manage the cyber risks affecting their products. They should prioritize addressing vulnerabilities as part of their broader tasks to maintain security while balancing other responsibilities. If Product Owners face knowledge gaps, they should seek guidance from Security Champions on effectively remediating different vulnerabilities.
How is it actually done?
Once vulnerability data is ingested into the Vulcan Cyber ExposureOS, critical vulnerabilities, such as zero-days, will be immediately sent to either the security team members or the incident management teams for prompt action, depending on the organization's structure.
Simultaneously, following a thorough risk assessment and triage process , prioritized vulnerability data will be automatically sent to Product Owners (POs) via tickets or alerts using Vulcan Cyber Automated Playbooks.
These automations can be based on predefined conditions such as threat level, risk score, business impact of affected assets, and more. The automation can also include conditions such as ”patch is available“, to make sure that the remediation teams members are getting vulnerabilities that could be fixed.
The goal of sending only a manageable number of vulnerabilities to remediation teams is to ensure they are not overwhelmed with low-priority issues, making sure that only the vulnerabilities that matter are being addressed.
Vulcan Cyber also makes all the data available for additional review and potential risk adjustments by the POs or Security Champions.
Risk identification and assessment:
Once vulnerability data is identified and ingested into Vulcan platform, the platform automatically performs a risk assessment based on predefined criteria, such as severity, exploitability, and potential business impact.
Security Champions review the initial risk assessment to ensure it accurately reflects the context and criticality of the affected assets. It’s important to note that risk calculation can vary across organizations, as it is determined by the organization’s unique risk appetite and strategic priorities.
Risk update by product owners:
Product Owners, who have a deep understanding of the business implications of their managed assets, may edit the risk score if they believe the platform's automated assessment does not fully capture the potential impact.
This update of risk can be performed in Vulcan Cyber, considering the justification for the change based on business needs, asset criticality, or compensating controls. The justification for the risk update can be documented and reviewed within the system.
Risk exception requests:
After the vulnerabilities are assigned to the remediation team, and they decide that a vulnerability cannot or should not be remediated (e.g., due to technical constraints, business requirements, or the presence of compensating controls), they submit a risk exception request in the platform.
The request must include a detailed rationale, including the potential risks of not addressing the vulnerability and any compensating measures that mitigate these risks.
Approval of risk exceptions:
Product owner review: The Product Owner reviews the risk exception request to determine if ignoring the vulnerability is acceptable based on their understanding of the business context and the risk involved.
Security champion consultation: If there are knowledge gaps or uncertainties, Product Owners may consult with Security Champions for additional insights into the security implications of the exception.
Managerial approval for high-impact exceptions: If the exception involves high-impact assets or risks that could significantly affect the organization, it must be escalated to the manager above the PO or a designated approval authority. This ensures that risk decisions align with broader organizational risk appetite and strategy.
Continuous monitoring and review
Vulcan Cyber facilitates continuous monitoring and review of all approved risk updates and exceptions. All decisions are documented in the platform, including the rationale and any compensating controls considered. This documentation helps maintain transparency and accountability, making it easier to conduct audits and reviews.
The platform also allows for ongoing monitoring of approved exceptions and updates, ensuring that risk levels remain acceptable and compensating controls are effective. The GRC team has the ability to regularly review the risk approval process and makes necessary adjustments to adapt to new threats and changes in the organization’s risk environment.
Summary
This integrated cyber security operating model ensures that security efforts are strategically aligned across all teams, fostering a culture of risk awareness and proactive management. By balancing decentralized decision-making with centralized oversight, organizations can effectively manage cybersecurity risks, ensure compliance, and align their security posture with business objectives. Flexibility and adaptability are key, allowing for continuous improvement in response to evolving threats and organizational changes.