Calculate cyber risk in financial terms

This major, multinational U.S.-based energy company needed to calculate the cyber risk exposure of their OT assets in terms of the financial impact to the business if they were compromised. They integrated their OT scanning technology with Skybox Cyber Risk Quantification (CRQ) to quantify the risks in terms of dollar value to the business.

Highlight vulnerabilities that represent the greatest risk to the business

This organization is one of the world’s leading integrated energy companies with a presence in over 180 companies and activities that span every aspect of the upstream and downstream oil and natural gas industries.

To manage their cyber exposure, the organization uses OT security scanners to scan for vulnerabilities in devices, firewalls, and networking infrastructure. While these scanners generate a lot of information about potential vulnerabilities, much of it is siloed.

The organization needed a vulnerability management solution to provide a consolidated view of the potential exposure. The solution had to highlight those assets with vulnerabilities that represented the greatest risk to the business if they were compromised. It needed to express this in monetary terms, in line with the overall corporate methodology for quantifying risk.

Use Cyber Risk Quantification (CRQ) to calculate the potential cost of a compromise

The U.S. energy company chose Skybox Vulnerability Control to complement its existing OT security solution. Skybox ingests, normalizes, and aggregates data from the OT security scanners and multiple other sources, creating a dynamic model of the process control networks in the organization.

Using Vulnerability Control’s unique Cyber Risk Quantification (CRQ) capability, the organization can calculate the risk exposure for any asset in the process control network and express the risk exposure in terms of dollar value.

The solution works by making a financial estimate of both the direct and indirect impact of the loss of an asset. It combines this with the CVSS score, exploitability, asset importance, and exposure score for each of the vulnerabilities discovered on the asset. The result is a risk exposure score for each asset, represented in terms of monetary value.

Treat cyber risks the same way as other business risks

Skybox provides a single source of truth on assets and vulnerabilities in the organization’s process control networks. The solution helps the team pinpoint the cyber risks with the highest potential impact, prioritize vulnerabilities and automate mitigation strategies.

Using CRQ, each asset is assigned a risk exposure expressed in terms of dollar value. This enables the organization to understand their risk posture, treating cyber risk in the same way that they evaluate any other business risk.

The solution provides graphical dashboards that display this information for each of the organization’s business units and provide graphs showing how exposure to risk changes over time.