Chapter 9 — Security governance, risk and compliance: leadership and assurance | Postgraduate Security governance, risk and compliance

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 09 published. Map, example, EX041.

flowchart TD
  N0["Learning outcomes"]
  N1["9.1 Quantified appetite"]
  N2["9.2 Comparing with appetite"]
  N3["Lab — Loss exceedance estimates against board appeti"]
  N4["9.3 Board assurance"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX041"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["9.1 Quantified appetite"]
  N2["9.2 Comparing with appetite"]
  N3["Lab — Loss exceedance estimates against board appeti"]
  N4["9.3 Board assurance"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX041"]

[Learning outcomes]
    |
    v
[9.1 Quantified appetite]
    |
    v
[9.2 Comparing with appetite]
    |
    v
[Lab — Loss exceedance estimates against board appeti]
    |
    v
[9.3 Board assurance]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX041]

Learning outcomes

You will (1) express risk appetite in quantitative terms; (2) compare risk estimates with appetite; (3) lead assurance conversations with the board.

9.1 Quantified appetite

Halbrook's board has a qualitative appetite statement: low tolerance for cyber risk. Daniel helps translate it into exceedance limits: the probability of annual cyber losses exceeding given amounts should not exceed agreed thresholds, for example no more than a five percent chance of exceeding one million in a year. He learns that quantified appetite makes risk discussions concrete and lets the board compare cyber risk with its tolerances for other financial risks. The five percent limit at one million becomes the benchmark against which the combined curve is tested in the next section.

9.2 Comparing with appetite

Daniel's team estimates a loss exceedance curve for all cyber scenarios combined. The lab compares five points with the appetite. Estimates are within appetite at two hundred and fifty thousand and five hundred thousand, but exceed it at one million, two million and five million: for example, an eight percent chance of exceeding one million against an appetite of five percent. The tail, not the typical year, breaches appetite. He recommends treatments aimed at severe scenarios. Treatments such as backup isolation shrink the tail without changing much in ordinary years.

Lab — Loss exceedance estimates against board appetite

"""Compare loss exceedance points with board appetite (synthetic, thousands)."""
lec = {250: 0.42, 500: 0.21, 1000: 0.08, 2000: 0.02, 5000: 0.004}
appetite = {250: 0.50, 500: 0.25, 1000: 0.05, 2000: 0.01, 5000: 0.002}
for x in lec:
    s = "within" if lec[x] <= appetite[x] else "EXCEEDS"
    print(f"P(loss > {x}k): estimate {lec[x]:.3f} appetite {appetite[x]:.3f} {s}")

Run with python3 lab_appetite.py. Verified output:

P(loss > 250k): estimate 0.420 appetite 0.500 within
P(loss > 500k): estimate 0.210 appetite 0.250 within
P(loss > 1000k): estimate 0.080 appetite 0.050 EXCEEDS
P(loss > 2000k): estimate 0.020 appetite 0.010 EXCEEDS
P(loss > 5000k): estimate 0.004 appetite 0.002 EXCEEDS

9.3 Board assurance

Daniel presents the comparison to the board with the uncertainty behind the curve and the treatments proposed: improved backup isolation and an insurance review. A director asks whether the estimates can be trusted. He explains how the inputs were gathered, that internal audit reviewed the method and that results are ranges. The board approves the treatments and asks for an update in six months. He learns that board assurance depends on transparency about methods as much as on the numbers. Dr. Varga notes that the six-month update gives the board a way to see whether the treatments actually moved the tail.

Worked example

Daniel translates appetite into exceedance limits, finds the tail exceeding appetite at three points and leads a transparent board discussion.

Synthetic case. Curves and appetite are synthetic.

Errors and limits

Combined curves depend on correlation assumptions. Appetite thresholds are judgements.

Exercises

EX041 — Appetite example. Give the example exceedance limit.
Show marking criteria
Rubric: 3 = no more than 5% chance of exceeding 1 million;; 2 = 5% at 1m;; 1 = vague;; 0 = none.
EX042 — Within appetite. At which points is the estimate within appetite?
Show marking criteria
Rubric: 3 = 250k and 500k;; 2 = two;; 1 = vague;; 0 = none.
EX043 — One-million breach. What is the estimate at one million versus appetite?
Show marking criteria
Rubric: 3 = 8% versus 5%;; 2 = exceeds;; 1 = vague;; 0 = none.
EX044 — Breach location. Which part of the curve breaches appetite?
Show marking criteria
Rubric: 3 = the tail;; 2 = tail, hedged with another option;; 1 = typical year;; 0 = none.
EX045 — Trust answer. How did Daniel answer whether estimates could be trusted?
Show marking criteria
Rubric: 3 = explained inputs, audit review and ranges;; 2 = transparency;; 1 = vague;; 0 = none.

Synthesis

Quantified appetite lets boards see where severe risks breach tolerance and govern treatments.

Continue studying — chapter 09 of 12

← Chapter 08 (draft) · Course chapter index · Chapter 10 (draft) →