When cyber breaches occur, it seems the media hones in mainly on the scope of the incident, i.e. how many people were impacted. While the amount of people impacted by a breach is important information, it is critical to not fall into the trap of thinking that the size of the breach is the stand-alone biggest factor in determining the severity of a cyber attack. An innovative new way of categorizing security breaches known as the Breach Level Index (BLI) was created by Richard Stiennon, a highly regarded security executive. The BLI will allow your organization to determine strategic IT security controls to address.
How does it work?
The BLI blends together key factors such as breach size, contents recovered, source of breach, and any follow-up actions that have been taken into one single metric. Similar to the Richter Scale, the most widely used scale for categorizing earthquakes, the BLI invokes a logarithmic based scaling. With this scaling, the BLI provides a risk assessment score between 0 and 10 based-on the previously mentioned factors and breaks down Breach Level Severity into the following five categories as shown in the graphic to the right.
How can the BLI help you?
Due to growing internal system complexity and wide range of information now stored digitally, security breaches can no longer be viewed as either having occurred, or not. Not all breaches are created equal. Because of this, the BLI Risk Assessment is a great tool for evaluating the risks and potential fallout from any one breach. Any organization can leverage the BLI methodology to better assess the impact of a security breach. The severity can be used as a starting point to help set benchmarks and improved security standards. While breaches of any degree of severity are unfavorable, using the BLI can assure your organization is setting strategies in place that will directly target your immediate gaps.
You can download our breach risk calculator and log to see how your organization stacks up on the breach level index.