Part 1: Why Cyber Posture Is Not Cyber Risk Management

Sometimes it seems like the only category growing as quickly as cybersecurity threats are new cybersecurity terms. Even more confusing is that often words are used interchangeably when the subtleties between them are crucial for your business’s bottom line.

Two terms which appear to be synonymous – cyber posture and cyber risk management – are not at all the same, and refer to completely different things. Cyber posture refers to your company’s current resilience to cybersecurity threats (how strong are your current defenses against possible vulnerabilities? Is your data as safe as you need it to be?Is your team up-to-speed with the latest potential threats?) Cyber risk management on the other hand, is all about the measures and procedures your company takes to fortify your posture.

Unpacking the Differences Between Cyber Posture and Cyber Risk Management

Cyber posture involves taking a holistic, deep dive into your company’s defenses and evaluating its resilience to threats right now. You can think of your company’s cybersecurity posture as its overall defense level.

The National Institute of Standards and Technology (NIST) defines cyber posture as “the security status of an enterprise’s networks, information, and systems based on information security resources (e.g., people, hardware, software, policies) and capabilities in place to manage the defense of the enterprise and to react as the situation changes.” In effect, this means that awareness of your company’s cyber posture provides you with insight into how vulnerable you are to cyberattacks and data breaches.

Working with a cybersecurity team which understands the vulnerabilities hackers exploit will enable you to stay multiple steps ahead of them. Determining your cyber posture is a crucial first step in this process, since it serves as a starting point for your overall cyber defense strategy.

And this is exactly where cyber risk management enters the picture. Let’s begin with a definition:  “Cybersecurity Risk Management means technologies, practices, and policies that address threats or vulnerabilities in networks, computers, programs and data, flowing from or enabled by connection to digital infrastructure, information systems, or industrial control systems, including but not limited to, information security, supply chain assurance, information assurance, and hardware and software assurance.”

In other words, cyber risk management comprises the many different actions a company takes to maintain a secure cyber posture. A cybersecurity risk management framework can strengthen the security of your IT infrastructure and enable your C-Suite to make more informed risk management decisions.

The essence of cyber risk management is recognizing the threats to which your business and vertical market are most vulnerable. For example, payment pages are critical for eCommerce players, while email domain configuration is vital for banks. Product catalogs are crucial for commerce B2C players, but not for banks, and so on. It’s critical for your organization to possess the knowhow to identify and manage the risks associated with its business model.

Cyber Posture and Cyber Risk Management – Pretty Much Indispensable

A holistic approach to cyber risk management – putting procedures in place, working with a cybersecurity team that can show you what hackers see, provides companies with a steady foundation and is an effective means of staying ahead of the curve.

What do we mean? For starters, this can be extremely helpful in allocating resources and justifying expenditures. Proactive steps your company may take can include everything from insurance policies to having clear guidelines to follow in case of a breach. Ultimately, all company policies put in place to sustain your cyber posture fall under the rubric of cyber risk management. Given today’s climate, prevention cannot be the only component of cyber risk management; companies must also have procedures in place of how to respond to cyber attacks.

Continuing business, as usual, is not an option.

Next Steps: Evaluating Your Posture

Still, a lot more must be said about how to evaluate your company’s cyber posture. We continue with this very question in our next blog about and answer  what can be done for your company.