How can security analysts communicate risks to non-technical stakeholders?

由人工智能和领英社区提供技术支持

As a security analyst, you are responsible for identifying and assessing the potential threats and vulnerabilities that could affect your organization's information assets and systems. However, not everyone in your organization may understand the technical aspects of security or the implications of the risks you report. How can you communicate effectively with non-technical stakeholders, such as managers, executives, or clients, and convince them to take action on your recommendations?

此文章中的业界达人

由社区从 14 条内容中精选。了解更多

Sayed Faheem Qadry

Technology Focused | Business Transformation | Cybersecurity Advisory | Project Delivery Consultant
Volker Vo?

Nicht man müsste, man sollte - ?rmel hoch und machen statt quatschen! ?? Intrapreneur bei Cyber Innovation Hub der…

1 Know your audience

The first step to communicate risks to non-technical stakeholders is to know your audience and tailor your message accordingly. Different stakeholders may have different priorities, concerns, and expectations, so you need to understand their perspective and goals. For example, a manager may care more about the impact of a risk on the business objectives and budget, while an executive may care more about the reputation and compliance of the organization. You should also consider the level of technical knowledge and familiarity with security terms and concepts of your audience, and avoid using jargon, acronyms, or technical details that may confuse or overwhelm them.

添加您的观点

Volker Vo?

Nicht man müsste, man sollte - ?rmel hoch und machen statt quatschen! ?? Intrapreneur bei Cyber Innovation Hub der Bundeswehr ?? Softwareentwickler/-architekt Combat Management/Direction Systems ?? Technology Evangelist
举报内容
Man sollte vorallem auch sich selbst kennen. Wo man selbst Schw?chen hat, in welche Themen man sich gerne technisch verliert. Hier hilft es, sich nach solchen Gespr?chen Feedback einzuholen. Entweder von den Stakeholdern oder auch durchs eigene Team. Gegebenenfalls sollte man die Kommunikations ganz jemand anderem im Team überlassen. Die wenigsten sind gleichzeitig in technischen Dingen Exzellenzen und gleichzeitig gute Kommunikateure bzw. Vermittler dieser technischen Dinge.

已翻译

赞
Ravindra Annam

Cybersecurity Professional specializing in AppSec, SAST, DAST, SCA, Threat Modelling, SSDLC, API Security, , DPP,Cloud Security, AI/ML and LLM Security | Container Security, DevSecOps, & Pen testing
举报内容
Security analysts can effectively communicate risks to non-technical stakeholders by employing clear and concise language, avoiding technical jargon, and focusing on the potential impact of the risks in terms of business objectives and outcomes. Utilizing visual aids such as charts or graphs can help illustrate complex concepts, while providing actionable recommendations and solutions tailored to the stakeholders' level of understanding fosters informed decision-making and enhances overall risk awareness across the organization.

已翻译

赞
Ben Woods

Enterprise Security Consultant - Multi-cloud Security Architecture, Audit & Assurance | CISSP, CCSP, CISM, CISA, CRISC, CDPSE, CCSK, ISO LI, ISO LA
举报内容
"Knowing your audience" is essentially part of stakeholder management the key principles of which are the same regardless of subject matter. These 'perennial principles' are: 1. Identify stakeholders accountability, responsibility &, where relevant, interest. 2. Classify those identified & plot relative positions on a stakeholder map in terms of power & influence 3. Group similar stakeholders according to concerns 4. Develop viewpoints and associated views to address the concerns of each identified stakeholder community 5. Use these views and viewpoints to 'tailor' communications in terms that directly address the prioritized concerns of each stakeholder community, as effectively as possible

已翻译

赞
Jorge Alonso

Director de Consultoría en Velorcios Group
举报内容
Sin lugar a dudas este es uno de los grandes retos de un CISO: hacerse entender por el CEO y por otros cargos directivos que no tengan perfil técnico. Es tarea del CISO mantener a la organización informada, formada y concienciada en materia de ciberseguridad para conseguir un sano equilibrio entre negocio y seguridad. Cuando no existe esta concienciación el día que llega un incidente, que siempre acaba llegando, todo es más difícil y complicado. Por eso es importante huir de tecnicismos y siglas que nuestros interlocutores no dominen porque solo generan rechazo y antipatía. Todos los esfuerzos que hagamos para traducir nuestro mundo técnico a la jerga del negocio serán bienvenidos y facilitaran la toma de decisiones.

已翻译

赞
Jeiziel S.

LinkedIn Top Voice | Especialista em Seguran?a da Informa??o e Cybersecurity | Consultor | GRC | CSIRT/CTI | SOC-MSS | EDR/XDR & SOAR/SIEM (SENTINEL/QRADAR/SPLUNK/ELASTIC/CORTEX/STELLAR ) | IA (DARKTRACE/CROWDSTRIKE)
举报内容
Para comunicar riscos de seguran?a às partes interessadas n?o técnicas, os analistas de seguran?a devem adotar uma abordagem acessível e centrada nos impactos para o negócio. Isso envolve evitar jarg?es técnicos, destacar os impactos tangíveis nos objetivos de negócio, apresentar solu??es e recomenda??es para mitigar os riscos, utilizar exemplos concretos e casos práticos, apresentar informa??es de forma visual, encorajar o diálogo e a participa??o, e demonstrar a importancia da seguran?a da informa??o para a organiza??o. Ao seguir essas estratégias, os analistas podem facilitar a compreens?o dos riscos de seguran?a e promover um engajamento mais eficaz na prote??o da organiza??o contra amea?as cibernéticas.

已翻译

赞

加载更多内容

2 Use a common framework

The second step to communicate risks to non-technical stakeholders is to use a common framework or standard that can help you define, measure, and compare the risks you identify. A common framework can provide a consistent and objective way to categorize, prioritize, and quantify the risks, and to align them with the organization's risk appetite and tolerance. For example, you can use the NIST Cybersecurity Framework, which provides a set of guidelines and best practices for managing cybersecurity risks, or the ISO 27005 standard, which provides a process for risk assessment and treatment. By using a common framework, you can also demonstrate your credibility and professionalism, and show that you follow industry standards and best practices.

添加您的观点

Ben Woods

Enterprise Security Consultant - Multi-cloud Security Architecture, Audit & Assurance | CISSP, CCSP, CISM, CISA, CRISC, CDPSE, CCSK, ISO LI, ISO LA
举报内容
Whilst it is essential to use a well-recognised risk management framework (e.g. ISO 27005, ISO 31000, NIST RMF, FAIR) it is equally key to ensure that framework works effectively with whatever control framework(s) the organization uses. This is not to say NIST only works with NIST & ISO only works with ISO....rather it is to say that the processes of identifying, assessing & managing risk through the design & implementation of mitigating controls must be consistent throughout the organization. Where different parts of an organization identify, classify & evaluate risks according to incompatible criteria, much unnecessary friction is generated, which ultimately causes overhead in terms of miscommunication, inefficiency & ultimately cost.

已翻译

赞

3 Visualize and simplify

The third step to communicate risks to non-technical stakeholders is to visualize and simplify the information you present. Visuals, such as charts, graphs, diagrams, or dashboards, can help you illustrate the severity, likelihood, and impact of the risks, and to highlight the trends, patterns, or correlations that may not be obvious from text or numbers. Visuals can also help you capture the attention and interest of your audience, and make your message more memorable and persuasive. However, you should also avoid cluttering or overloading your visuals with too much or irrelevant data, and make sure they are clear, accurate, and easy to understand. You should also simplify your language and use analogies, metaphors, or stories that can help you explain complex or abstract concepts in a relatable and engaging way.

添加您的观点

Sayed Faheem Qadry

Technology Focused | Business Transformation | Cybersecurity Advisory | Project Delivery Consultant
(已编辑)
举报内容
Communicating risks is as logical as communicating profits in the building of a business case. The risks are not all directly quantifiable but some assumptions can be made in such a way that can also quantify things like loss of reputation. Easiest way is to analyze the business functions or sources of revenue affected when the risk takes shape by calculating the loss in monetary terms when the source of function halts or its degraded due to failure of some sort. Simple tools like vision and excel can used, or more complex ones like montecarlo simulators. Convert data into charts showing money lost vs time. Other charts can show human resources lost vs time for HR department to get a clearer picture.

已翻译

赞
Volker Vo?

Nicht man müsste, man sollte - ?rmel hoch und machen statt quatschen! ?? Intrapreneur bei Cyber Innovation Hub der Bundeswehr ?? Softwareentwickler/-architekt Combat Management/Direction Systems ?? Technology Evangelist
(已编辑)
举报内容
Hier kann man sich gerne von Midjourney und Co. inspirieren oder direkt Ergebnisse liefern lassen. Ansonsten gibt es genügend Listen mit Basics für die Erstellung von z.B. Powerpoint Slides, die z.B. auf wissenschaftlichen Erkenntnissen beruhen. Ein Beispiel w?re die Regel, nicht mehr als fünf Zeilen in entsprechender Gr??e auf eine Folie zu packen. Den Vortrag sollte man dann auch mithilfe von Schwarmintelligenz im Team besprechen bzw. sich aus dem Team Feedback holen. Denn auch hier gilt, die wenigstens k?nnen Technik und Visualizierung/visuelle Kommunikation.

已翻译

赞
??Kevin Kloft

Security Solutions Architect bei carmasec GmbH & Co. KG | AWS
举报内容
Auch Heat Maps sind hier eine wirksame Darstellungsform die gut bei nicht-technischen Stakeholder funktioniert. Dadurch l?sst sich die Risikolage auf einen Blick gut erfassen

已翻译

赞

4 Provide context and recommendations

The fourth step to communicate risks to non-technical stakeholders is to provide context and recommendations for each risk you report. Context can help you explain why a risk matters, what are the root causes and consequences, and how it relates to the organization's strategy, goals, and values. Recommendations can help you propose specific and actionable steps that can mitigate, transfer, avoid, or accept the risk, and to justify the costs and benefits of each option. You should also provide evidence and data to support your context and recommendations, such as past incidents, industry benchmarks, best practices, or expert opinions. However, you should also acknowledge the limitations and uncertainties of your analysis, and avoid making unrealistic or exaggerated claims.

添加您的观点

Volker Vo?

Nicht man müsste, man sollte - ?rmel hoch und machen statt quatschen! ?? Intrapreneur bei Cyber Innovation Hub der Bundeswehr ?? Softwareentwickler/-architekt Combat Management/Direction Systems ?? Technology Evangelist
举报内容
Man sollte für Entscheidungsvorlagen immer drei M?glichkeiten des Handelns mit Nachteilen und Vorteilen vorschlagen. Mehr als drei überfordert leicht und differenziert vielleicht zu wenig, weniger als drei schr?nkt oft unn?tig ein.

已翻译

赞
Ben Woods

Enterprise Security Consultant - Multi-cloud Security Architecture, Audit & Assurance | CISSP, CCSP, CISM, CISA, CRISC, CDPSE, CCSK, ISO LI, ISO LA
举报内容
Taking a risk out of context is like kidnapping a brick from a building – you might have a piece, but you won't understand the whole issue/opportunity!

已翻译

赞
Gabriel Carrijo

Mestre em Informática | Diretor Técnico na SETIC | Professor Universitário
举报内容
Deve haver clareza e transparência total no momento de estabelecer as recomenda??es. Muitas vezes um risco é aceito por n?o haver uma comunica??o clara da área de TIC ou quando o gestor n?o enxerga o ROI possível dentro daquela nova implementa??o. Encontrar pontos de retorno do investimento e economia com incidentes eminentes podem justificar uma contrata??o que mitigue um risco.

已翻译

赞

5 Invite feedback and collaboration

The fifth step to communicate risks to non-technical stakeholders is to invite feedback and collaboration from your audience. Feedback can help you understand how your audience perceives and responds to your message, what are their questions, doubts, or objections, and how you can improve your communication and relationship. Collaboration can help you involve your audience in the risk management process, and to leverage their insights, expertise, or resources. You should also encourage your audience to share their own concerns, expectations, or suggestions, and to express their support or commitment for your recommendations. By inviting feedback and collaboration, you can also show respect and empathy for your audience, and build trust and rapport.

添加您的观点

6 Follow up and follow through

The sixth step to communicate risks to non-technical stakeholders is to follow up and follow through on your communication and recommendations. Follow up can help you monitor the progress and outcomes of the risk management actions, and to provide updates, reports, or feedback to your audience. Follow through can help you ensure that the actions are implemented effectively and efficiently, and that the risks are reduced or resolved. You should also be prepared to adjust or revise your communication and recommendations if the situation changes or new information emerges. By following up and following through, you can also demonstrate your accountability and responsibility, and show that you care about the results and impact of your work.

添加您的观点

7 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?

添加您的观点

Information Security

+ 关注

给文章评分

我们借助人工智能创建了此文章。您认为这篇文章怎么样？

很棒不太好

举报此文章

查看全部

How can security analysts communicate risks to non-technical stakeholders?

1

2

3

4

5

6

7

1 Know your audience

2 Use a common framework

3 Visualize and simplify

4 Provide context and recommendations

5 Invite feedback and collaboration

6 Follow up and follow through

7 Here’s what else to consider

Information Security

给文章评分

感谢您的反馈

更多Information Security相关文章

更多相关阅读内容

How can security analysts communicate risks to non-technical stakeholders?

1

2

3

4

5

6

7

1 Know your audience

2 Use a common framework

3 Visualize and simplify

4 Provide context and recommendations

5 Invite feedback and collaboration

6 Follow up and follow through

7 Here’s what else to consider

Information Security

给文章评分

感谢您的反馈

查看其他技能