The Risky Business of Risk Illiteracy

The Risky Business of Risk Illiteracy

Speakers: Sean Juroviesky

Conference: BSides SF

YouTube: https://www.youtube.com/watch?v=p4ZEhOMsZOo

Overview

In his compelling BSides SF talk, "The Risky Business of Risk Illiteracy," Sean Juroviesky addresses a fundamental disconnect in how many organizations approach cybersecurity: a failure to understand and communicate risk in terms that resonate with business leadership. Juroviesky argues that security professionals often get lost in the weeds of technical vulnerabilities, high CVSS scores, and sensational headlines, losing sight of the broader business context and the most common attack vectors. This "risk illiteracy" leads to misprioritization, ineffective resource allocation, and a persistent struggle to secure executive buy-in for critical security initiatives.

Juroviesky's presentation serves as a critical guide for security practitioners to shift their perspective from purely technical concerns to a holistic, business-centric view of risk. He meticulously breaks down the components of effective risk management, from robust threat modeling and data flow analysis to translating technical threats into tangible monetary impacts. The talk emphasizes that the ultimate goal of security is not to eliminate all risk—an impossible feat—but to reduce it to an acceptable level as defined by the business itself, typically through the lens of financial implications.

The core message is a call to action for security teams to abandon the "James Bond" mentality of anticipating every improbable attack scenario and instead focus on the most likely and impactful threats. By understanding how the business generates revenue, how its staff operates, and what constitutes real financial loss, security professionals can better articulate the "why" behind their recommendations, secure necessary funding, and ultimately build more resilient organizations. This talk is essential for anyone struggling to bridge the gap between technical security challenges and strategic business objectives.

Background

▶ Watch: Introduction: The problem of risk illiteracy (0:00)

The foundational premise of cybersecurity, as Juroviesky articulates, is to reduce risk to an acceptable level. However, the crucial nuance often missed is that this "acceptable level" is not defined by security teams, but by the business executives who bear ultimate responsibility for the company's financial health and legal standing. These stakeholders primarily perceive risk in monetary terms, making financial impact the lingua franca of executive decision-making.

A significant problem arises from common misprioritizations within security. Many organizations and security professionals find themselves swayed by headlines, new CVEs with 10.0 CVSS scores, or the allure of zero-day exploits. While these certainly represent threats, Juroviesky highlights a stark reality: the vast majority of real-world breaches originate from far more mundane sources. Citing statistics, he reveals that 68% of breach experiences stem from non-malicious human factors. These are not sophisticated, state-sponsored attacks but rather failures in basic security hygiene, such as a lack of Multi-Factor Authentication (MFA) or successful phishing campaigns. Furthermore, a staggering 98% of these human-factor incidents could have been prevented had MFA been enabled on the compromised accounts. Juroviesky points to high-profile incidents like Midnight Blizzard's attack on Microsoft and the ransomware attack on MGM Gaming as prime examples where the absence of enforced MFA played a critical role.

This disparity underscores the talk's central theme: the need to "see the forest through the trees." Security teams must move beyond an individual, reactive focus on the latest vulnerability and adopt a comprehensive view of their organization's overall risk landscape. To achieve this, Juroviesky introduces the essential "ingredients" for effective threat modeling. These include establishing as complete an inventory of assets as possible, developing clear and digestible data flow diagrams (DFDs), and, crucially, gaining a deep understanding of how the business operates—how it generates revenue, and the day-to-day workflows of its staff. Without this foundational understanding of business logic and operational context, security efforts risk being misaligned with genuine business priorities and impacts.

Key Findings

▶ Watch: Core message: See the forest through the trees (4:00)

Sean Juroviesky's talk distills several critical findings for effective risk management in cybersecurity, challenging conventional, often misdirected, approaches.

Firstly, he unequivocally states that risk only exists when there is both a threat and a vulnerability present. Without either component, an event cannot occur. This distinction is crucial for prioritization, as merely having a known threat (e.g., a new exploit) without an existing vulnerability in the organization's environment (e.g., the affected system is not in use or the feature is disabled) does not constitute an active risk requiring immediate mitigation.

Secondly, Juroviesky underscores the overwhelming impact of non-malicious human factors in real-world breaches. He cites compelling statistics: 68% of breach experiences are attributed to human error or oversight, not sophisticated zero-day attacks. Of these, 98% could have been prevented by the simple implementation of Multi-Factor Authentication (MFA). This finding highlights a persistent blind spot in many security strategies, where basic, easily implementable controls are often overlooked or bypassed due to convenience or executive exceptions, leading to significant vulnerabilities.

Thirdly, the talk emphasizes that business impact, translated into monetary terms, is the only language that consistently resonates with executives. Security professionals often struggle to gain buy-in for initiatives when discussing technical jargon or abstract concepts like "ransomware." However, framing a potential incident in terms of "losing a million dollars a day because customers cannot purchase things" immediately elevates the issue to a strategic business concern. Understanding how an outage or breach directly affects revenue generation and operational continuity is paramount for securing funding and prioritizing mitigations.

Finally, Juroviesky warns against the pitfalls of over-reliance on raw CVSS scores for vulnerability prioritization. He argues that fixating solely on high CVSS scores without considering the specific exploitability, likelihood, and impact to one's unique business environment leads to security teams being overwhelmed and misdirecting resources. Instead, a focused approach that considers the context of the organization's tech stack, market segment, and actual operational use of systems is far more effective. He stresses the importance of not "building better locks while your safe is left completely wide open" by focusing on irrelevant threats.

Technical Deep Dive

▶ Watch: Essential ingredients for building a threat model (4:20)

Effective risk management begins with a robust threat modeling process, which Juroviesky outlines as having three core ingredients: a complete inventory of assets (acknowledging the practical challenge of achieving 100% completeness), comprehensive data flow diagrams (DFDs), and an intimate understanding of the business logic – how the organization generates revenue and how its various departments and staff conduct their daily operations.

Data Flow Diagrams are critical for visualizing the movement of data across the tech stack and between departments. Juroviesky advises against overly complex, single-layer DFDs that lead to "eye-glazing" and audience disengagement. Instead, he advocates for layered DFDs, starting with a high-level overview and then drilling down into more complex services as needed. Key elements for DFDs include labeling trust boundaries and directional information, and most importantly, documenting why data flows in a particular manner. This documentation helps identify unnecessary data transfers or outdated configurations that could be refined. As security professionals inherently identify potential vulnerabilities during DFD creation, it's crucial to document all questions and their answers, along with the surrounding context, to prevent knowledge decay over time.

The process of threat modeling, at its surface, can be distilled into Adam Shostack's four fundamental questions: "What did we build?", "What can go wrong with what we built?", "How will we prevent or respond to that?", and "Did we do a good enough job?". Juroviesky specifically addresses the last question, warning against the "James Bonding the scenario" trap. Unless operating in a national security context, security teams should avoid catastrophizing and focusing on highly improbable attack vectors (e.g., "halo diving from a helicopter with a laser"). The emphasis should be on likely attack scenarios relevant to the business's specific context.

A precise understanding of terminology is paramount. Juroviesky clarifies the distinction between threats, vulnerabilities, and risks:

• A threat is the actual event itself – the "verb" of the risk. It can be intentional (e.g., an attacker exploiting a weakness) or unintentional (e.g., accidentally publishing keys to GitHub, deleting a database due to a bad push).
• A vulnerability is a weakness in a system or process that a threat can exploit.
• A risk exists only when both a threat and a vulnerability are present. Without both, an event cannot be exploited. This distinction is vital for accurate prioritization.

When prioritizing mitigations, security teams must consider both the likelihood and exploitability of an event. If a feature is vulnerable but disabled or not in use, the risk is mitigated by its inactive state. The talk acknowledges the complexity of calculating likelihood, deferring to specialized resources like Monte Carlo simulations and books such as "How to Measure Anything in Cybersecurity," due to the depth required.

Finally, the talk emphasizes business impact as the ultimate metric for executives. Security professionals must understand how various outages (e.g., Google Workspace, CRM) affect different teams, revenue streams, and daily operations. Translating potential technical failures into monetary terms is not just beneficial for funding requests but often the only way to convince executives to act. An average CEO, Juroviesky notes, doesn't care about "ransomware" in abstract; they care about "losing a million dollars a day."

Demo / Proof of Concept

▶ Watch: Tips for crafting effective data flow diagrams (6:00)

The talk "The Risky Business of Risk Illiteracy" focuses on strategic and methodological approaches to risk management and communication within an organization. As such, it did not include a live technical demonstration or a proof-of-concept exploit. The speaker's emphasis was on frameworks, documentation, and communication strategies rather than specific tools or attack vectors.

Defensive Implications

▶ Watch: Why documenting threat modeling context is critical (7:30)

The insights shared by Sean Juroviesky offer several critical, actionable defensive implications for security professionals aiming to build more resilient organizations and effectively communicate with leadership.

1. Prioritize Foundational Controls over Fringe Threats: The most impactful defensive strategy is to focus on basic, robust controls. Given that 68% of breaches stem from non-malicious human factors and 98% of those could be stopped by MFA, implementing and strictly enforcing Multi-Factor Authentication across all relevant accounts is paramount. Beyond MFA, foundational practices include using password wallets, ensuring timely patching of known vulnerabilities, and diligent key rotation. These "boring but effective" measures often yield a far greater return on investment than chasing every new zero-day.

1. Cultivate a Holistic Risk View: Defenders must resist the urge to drown in the sheer volume of CVEs (over one per minute) or to prioritize solely based on high CVSS scores. Instead, the focus must be on understanding the exploitability, likelihood, and business impact of a vulnerability within the specific context of their organization's tech stack, market segment, and operational use. This means stepping back to "see the forest through the trees" rather than getting lost in individual "trees."

1. Translate Technical Risk into Business Impact: To gain executive buy-in and secure resources, defenders must become adept at communicating risk in monetary terms. Instead of discussing technical exploits or abstract threats, articulate the potential financial losses—lost revenue, operational downtime costs, regulatory fines—that a security incident could incur. Understanding the business's revenue generation and operational workflows is key to making this translation effective.

1. Embrace Comprehensive Documentation and Ownership: Every identified risk and its mitigation plan requires thorough documentation. This includes clearly defining who owns the vulnerability, what the proposed mitigation is, why it's being mitigated, and when it will be revisited. Juroviesky stresses the importance of having a single source of truth for all risk-related documentation, including tickets, conversations, and especially risk acceptances. This ensures continuity, accountability, and historical context.

1. Formalize the Risk Acceptance Process: When executives decide to accept a risk rather than mitigate it, defenders must ensure this decision is formally documented. This involves presenting an exhaustive threat model detailing potential events and their clear business impact (not just technical terms), along with alternative solutions (e.g., temporary, less costly options). This process not only ensures accountability but also serves to "cover our rears" by demonstrating due diligence.

1. Implement Continuous Mitigation Review: Mitigations rarely eliminate risk entirely; they primarily reduce its likelihood or impact. Therefore, defenders must treat mitigations as ongoing processes. Regularly revisit mitigated risks to assess if they remain effective given changes in infrastructure, new threats, or evolving business needs. A WAF might protect a service today, but architectural changes years later could render that protection less effective.

1. Leverage Strategic Allies: For security analysts struggling to communicate directly with executives, Juroviesky suggests finding a friendly middle manager or strategic ally who has a peer relationship with leadership. This ally can help translate technical risks into business-friendly language, advocate for security initiatives, and even assist in quantifying the monetary cost to the business, making the process significantly easier for the security team.

Key Takeaways

• Risk is a Business Problem: The acceptable level of risk is defined by business executives, primarily in monetary terms, not by security teams. Security's role is to reduce risk to that acceptable level.
• Human Factors Dominate Breaches: The vast majority of breaches (68%) stem from non-malicious human factors, with 98% of those preventable by enforced Multi-Factor Authentication (MFA). Basic controls are often overlooked while chasing sensational threats.
• Effective Threat Modeling is Foundational: Understanding your complete asset inventory, creating layered data flow diagrams, and deeply comprehending your business's revenue generation and operational logic are crucial for identifying relevant threats.
• Risks Require Both Threat and Vulnerability: A risk only exists when both a potential threat (the event) and an exploitable vulnerability (the weakness) are present. Prioritization should focus on likelihood and exploitability within your specific business context, not just raw CVSS scores.
• Communicate in Monetary Business Impact: To secure executive buy-in and funding, translate technical risks into tangible financial losses (e.g., "losing a million dollars a day") rather than abstract security jargon.
• Document Everything, Especially Risk Acceptance: Maintain a single source of truth for all risk documentation, including ownership, mitigation plans, revisit schedules, and formal executive risk acceptance. This is vital for accountability and due diligence.

About the Speaker(s)

Sean Juroviesky is a Senior Security Engineer at SoundCloud, bringing a wealth of experience from various market segments. Beyond his professional role, Sean is deeply involved in the cybersecurity community as an organizer for ChiSec (BBSE), one of the oldest city-sects in the Chicagoland area. ChiSec hosts seven meetups a month, some attracting up to 150 attendees. Juroviesky is a passionate advocate for community involvement, stressing its profound impact on career development within the cybersecurity field.