Ruslan Rakhmetov, Security Vision
Imagine that you have decided to take care of your health: you have two options.
The first is to get a random blood test once a year and hope everything is fine. The second is to wear a smart fitness tracker that monitors your heart rate, sleep quality, oxygen levels 24/7, and warns of the risk of a heart attack even before you feel a chest pain. Annual IT audits of paper-based procedures are the same "random review once a year" that is hopelessly outdated in the age of rapid cyberattacks. Today, businesses need a digital health approach – continuous, automated information security monitoring of their entire digital infrastructure. This is the topic we'll discuss today.
Let's consider a company's IT infrastructure as a living organism. Servers and databases are vital organs, software vulnerabilities are hidden viruses, and security incidents are symptoms of illness (such as a cough or fever) that require urgent treatment before the system crashes completely.
1) Participation of DRP systems
2) Evolution from classical maturity scales to process management
3) Health Dashboard Architecture: Building Dashboards for CISOs and Top Management
4) Digital Health Dashboard Transition Plan
Imagine you're protecting your country house. Simply locking the door from the inside isn't enough. You need to know: has someone in your household left their keys in the lock outside? Are burglars discussing a plan to break into your windows in hidden chats? Have scammers created an exact replica of your house on the neighboring street to lure guests there and steal their belongings?
1) Participation of DRP systems
A regular, comprehensive digital health audit begins with an analysis of the organization's external digital presence and mitigation of risks emanating from the external environment. This is accomplished using specialized DRP platforms that perform 24/7 automated monitoring of open, deep, and shadow network segments, as well as RM/ORM class systems. allow us to assess these risks and translate possible damage into financial indicators, CM – will ensure audit and compliance with requirements, and SA – operates as a self-assessment portal for holdings and groups of companies.
A company's external perimeter is exposed to constant threats, including confidential information leaks, the appearance of compromising materials, and unauthorized brand exploitation. Modern DRP tools analyze over 2 million domain names and issued SSL certificates daily, detecting and blocking up to 87% of phishing resources in less than 24 hours of detection, with initial response times as short as 12 minutes. The results of external audits provide a dynamic picture of perimeter security, preventing attacks at the preparatory stage.
2) Evolution from classical maturity scales to process management
Doctors used to evaluate health using rigid tables (for example, a system like "at 40, your weight should be X, your height Y"), but this doesn't work for professional athletes or people with unique body types. Modern medicine, however, looks at the dynamics of processes: how your heart copes with the stresses of your life.
The same thing happened with security assessments. Old approaches (for example, the CMMI maturity model) assessed information security using dry standards: "Do you have a policy? Yes/No," but having paperwork doesn't protect against a real hack. Companies quickly realized that such assessments were out of touch with reality and began to switch to customized ones. Information security health model.
Historically established information security maturity assessment models are well suited for the initial systematization of processes, but at more mature stages of business development, they begin to hinder the development of security systems. The main problem with classic scales is their retrospective nature and their disconnect from operational changes in infrastructure. As they evolve, many companies face the need to complicate and customize standard scales to suit their realities, which often leads to information security metrics becoming isolated from business needs.
The information security health model directly links IT and information security performance indicators to key strategic business goals. It allows for a shift from static assessment of abstract processes to continuous monitoring of threshold and target states of operational parameters, as is done, for example, by Governance functions. in Security Vision SGRC. Implementing the Information Security Health Model allows for the digitalization of security's impact on business through cascading metrics: technical parameters of SOC and lower-level security systems are aggregated into comprehensive process health indicators, which are then translated into business risks.
Rusagro Group's experience of transitioning to a new evaluation system in 2023, along with an annual information security audit, is worth mentioning. The developed tool consolidated over 50 operational metrics of information security processes into nine key business indicators, displayed on interactive dashboards. This transforms information security from a classic cost center into a manageable and transparent function that contributes to the company's five-year business strategy.
3) Health Dashboard Architecture: Building Dashboards for CISOs and Top Management
A modern car has a variety of indicators. A backseat passenger needs to know whether the car is warm and whether music is playing, a driver needs to see the speed and navigation, and a mechanic at a service center needs to see engine error codes and fuel rail pressure. Showing a driver a complex oil pressure graph while driving will simply distract them and lead to an accident. The company's digital health dashboard is built on the same principle of role-based division into three levels:
Panel for top management and the Board of Directors
This interface translates the language of information security into the language of business risks, finances, and reputation. Instead of dry technical data, it displays a financial assessment of cyber risks , for example, through the expected annual loss indicator (Annualized Loss Expectancy ALE), and management sees the estimated value of the current IT landscape vulnerability and how investments in information security reduce the potential damage from incidents. Key elements include risk trends over time and compliance with key industry standards and regulatory requirements (ISO 27001, PCI DSS, Federal Law No. 152).
Dashboard for the Chief Information Security Officer
Dashboard focuses on the effectiveness of information security strategy implementation, the performance of security systems, and the dynamics of security changes across the entire IT infrastructure. It displays indicators of information security program coverage (depth and breadth of asset coverage), the effectiveness of the vulnerability remediation backlog , and the percentage of assets fully protected. An important component is an assessment of the level of employee cybersecurity culture, measured through the click-through rate of phishing simulations and the activity of suspicious incident reports.
Operations Dashboard (SOC) and IT Services
The operational-level interface is designed for rapid response and targeted remediation of landscape defects. It accumulates detailed technical performance metrics. This representation is based on the speed and accuracy metrics of the SOC on-duty shift, and for automation in Security products. Vision introduces automatic calculation of SLA and other metrics taking into account work schedules.
Mean Time to Detect (MTTD, average time from the start of an attack or the emergence of a threat until its detection), Mean Time to Respond (MTTR, average time from incident detection to its complete elimination and system restoration), Mean Time to Contain (MTTC, the average time to localize an incident to prevent its further spread throughout the network) and other metrics can be calculated quickly and without human intervention.
Risk calculations also rely on serious mathematics: the Monte Carlo simulation process allows users to run multiple iterations of scenarios, using random variables to account for possible changes and variations in the data. This allows users to estimate the potential loss magnitude and risk exposure, and, using frequency and damage distribution parameters, track minimum/average/maximum values for future reference.
4) Digital Health Dashboard Transition Plan
Transitioning to a digital health concept isn't about purchasing yet another program, but rather about starting a "healthy lifestyle" for your entire business. We recommend following these steps:
1. Start with daily “charging”, set up continuous scanning of your systems both inside and outside;
2. Identify vital organs, clearly define which servers and databases are critical to the company's profitability;
3. Put on a fitness bracelet, switch from rare manual checks to continuous automatic calculation of health indices;
4. Listen to the smart doctor's recommendations, implement predictive analytics with AI and automated vulnerability repair scenarios to nip the disease in the bud.
This approach will allow your business to remain vigorous, protected, and resilient to any digital viruses and epidemics of our time.
.png)
