Chapter 40: Security Program Leadership — CISO to Board¶

import numpy as np
from scipy import stats

class FAIRModel:
    """
    Open FAIR risk quantification using Monte Carlo simulation.
    Produces Loss Exceedance Curves and annualized loss estimates.
    """

    def __init__(self, simulations: int = 100_000):
        self.sims = simulations

    def estimate_range(self, low: float, likely: float, high: float) -> np.ndarray:
        """
        Convert PERT (low/likely/high) estimate to log-normal distribution samples.
        FAIR uses PERT distributions for expert estimation.
        """
        mean = (low + 4 * likely + high) / 6
        std_dev = (high - low) / 6
        # Convert to log-normal parameters
        sigma = np.sqrt(np.log(1 + (std_dev / mean) ** 2))
        mu = np.log(mean) - sigma ** 2 / 2
        return np.random.lognormal(mu, sigma, self.sims)

    def calculate_risk(self,
                       # Threat Event Frequency
                       tef_low: float, tef_likely: float, tef_high: float,
                       # Vulnerability (probability threat succeeds)
                       vuln_low: float, vuln_likely: float, vuln_high: float,
                       # Primary Loss Magnitude
                       plm_low: float, plm_likely: float, plm_high: float,
                       # Secondary Loss (regulatory, reputational)
                       slm_low: float = 0, slm_likely: float = 0, slm_high: float = 0
                       ) -> dict:
        """
        Full FAIR analysis.
        Returns annualized loss expectancy (ALE), percentiles, and exceedance curve.
        """
        # Sample distributions
        tef = self.estimate_range(tef_low, tef_likely, tef_high)   # Events/year
        vuln = self.estimate_range(vuln_low, vuln_likely, vuln_high)  # 0–1 probability
        plm = self.estimate_range(plm_low, plm_likely, plm_high)    # $ per event
        slm = self.estimate_range(slm_low or 1, slm_likely or 1, slm_high or 1)

        # Loss Event Frequency = TEF × Vulnerability
        lef = tef * vuln

        # Total Loss Magnitude = Primary + Secondary
        tlm = plm + slm

        # Annualized Loss Expectancy = LEF × TLM
        ale_samples = lef * tlm

        return {
            "ale_mean": float(np.mean(ale_samples)),
            "ale_median": float(np.median(ale_samples)),
            "ale_90th": float(np.percentile(ale_samples, 90)),
            "ale_95th": float(np.percentile(ale_samples, 95)),
            "ale_99th": float(np.percentile(ale_samples, 99)),
            "prob_over_1M": float(np.mean(ale_samples > 1_000_000)),
            "prob_over_10M": float(np.mean(ale_samples > 10_000_000)),
            "samples": ale_samples
        }

# Example: Ransomware via unpatched RDP
fair = FAIRModel()
result = fair.calculate_risk(
    # TEF: RDP brute force attempts per year
    tef_low=2, tef_likely=8, tef_high=24,
    # Vulnerability: probability attacker succeeds given attempt
    vuln_low=0.05, vuln_likely=0.15, vuln_high=0.35,
    # Primary Loss: IR costs + downtime + recovery
    plm_low=500_000, plm_likely=3_000_000, plm_high=15_000_000,
    # Secondary Loss: regulatory + reputational
    slm_low=100_000, slm_likely=500_000, slm_high=2_000_000
)
print(f"Annualized Loss Expectancy:")
print(f"  Mean:    ${result['ale_mean']:>12,.0f}")
print(f"  Median:  ${result['ale_median']:>12,.0f}")
print(f"  90th %:  ${result['ale_90th']:>12,.0f}")
print(f"  99th %:  ${result['ale_99th']:>12,.0f}")
print(f"Probability of >$1M loss:  {result['prob_over_1M']*100:.1f}%")
print(f"Probability of >$10M loss: {result['prob_over_10M']*100:.1f}%")

def security_investment_roi(
    current_ale: float,
    residual_ale_after_control: float,
    control_cost_annual: float,
    implementation_cost: float,
    years: int = 3
) -> dict:
    """
    Calculate NPV and ROI for a security control investment.
    Discounted at 10% hurdle rate.
    """
    DISCOUNT_RATE = 0.10
    risk_reduction = current_ale - residual_ale_after_control

    npv = -implementation_cost
    for year in range(1, years + 1):
        annual_benefit = risk_reduction - control_cost_annual
        npv += annual_benefit / (1 + DISCOUNT_RATE) ** year

    roi_pct = (npv / implementation_cost) * 100
    payback_months = (implementation_cost / max(risk_reduction - control_cost_annual, 1)) * 12

    return {
        "risk_reduction_annual": risk_reduction,
        "npv_3year": npv,
        "roi_3year_pct": roi_pct,
        "payback_months": payback_months,
        "recommendation": "FUND" if npv > 0 else "DEFER"
    }

# Example: $800K EDR investment
roi = security_investment_roi(
    current_ale=4_200_000,          # FAIR ALE without control
    residual_ale_after_control=840_000,  # 80% risk reduction
    control_cost_annual=300_000,    # Licensing + headcount
    implementation_cost=800_000,    # Year 1 deployment cost
    years=3
)
print(f"EDR Investment Analysis:")
print(f"  Annual risk reduction: ${roi['risk_reduction_annual']:,.0f}")
print(f"  3-year NPV: ${roi['npv_3year']:,.0f}")
print(f"  ROI: {roi['roi_3year_pct']:.0f}%")
print(f"  Payback: {roi['payback_months']:.0f} months")
print(f"  Recommendation: {roi['recommendation']}")

class SecurityCultureMetrics:
    """
    Quantitative metrics for security culture program.
    Track monthly; trend over 12+ months for meaningful signal.
    """

    def __init__(self):
        self.metrics = {}

    def calculate_monthly_score(self,
        phishing_click_rate: float,        # % of simulated phishing clicked
        phishing_report_rate: float,       # % of employees who reported phishing
        training_completion_rate: float,   # % completed mandatory training
        password_manager_adoption: float,  # % using enterprise password manager
        mfa_adoption_rate: float,          # % enrolled in MFA
        policy_exception_requests: int,    # Monthly policy exceptions requested
        security_incidents_human: int,     # Incidents caused by human error
        total_incidents: int               # Total security incidents
    ) -> dict:

        # Weighted culture score (0–100)
        score = (
            (1 - phishing_click_rate) * 25 +         # Weight: 25%
            phishing_report_rate * 15 +               # Weight: 15%
            training_completion_rate * 20 +           # Weight: 20%
            password_manager_adoption * 15 +          # Weight: 15%
            mfa_adoption_rate * 15 +                  # Weight: 15%
            (1 - (min(policy_exception_requests, 20) / 20)) * 10  # Weight: 10%
        ) * 100

        human_error_rate = (security_incidents_human / max(total_incidents, 1)) * 100

        return {
            "culture_score": round(score, 1),
            "grade": "A" if score >= 85 else "B" if score >= 70 else "C" if score >= 55 else "D",
            "phishing_click_rate_pct": phishing_click_rate * 100,
            "phishing_report_rate_pct": phishing_report_rate * 100,
            "human_error_incident_rate_pct": human_error_rate,
            "training_completion_pct": training_completion_rate * 100,
            "benchmark": {
                "industry_avg_phishing_click": "14%",
                "top_quartile_phishing_click": "4%",
                "industry_avg_culture_score": "62"
            }
        }

# Industry benchmarks (Proofpoint State of the Phish 2024):
# - Average phishing click rate: 12-18% without training
# - With mature program: 3-5% click rate, 40%+ report rate
# - Each 1% reduction in click rate = reduced breach probability

VENDOR_RISK_FRAMEWORK = {
    "critical": {
        "definition": "Access to PII, financial data, or critical systems",
        "assessment_frequency": "Annual",
        "requirements": [
            "SOC 2 Type II (last 12 months)",
            "Penetration test report (last 12 months)",
            "ISO 27001 or equivalent certification",
            "Right-to-audit clause in contract",
            "Incident notification within 24 hours",
            "Data processing agreement (GDPR)",
            "Cyber insurance: $10M minimum",
        ],
        "onsite_assessment": True
    },
    "high": {
        "definition": "Access to internal systems; no direct customer data",
        "assessment_frequency": "Annual",
        "requirements": [
            "SOC 2 Type II or equivalent",
            "Security questionnaire (SIG Lite)",
            "Incident notification within 72 hours",
        ]
    },
    "medium": {
        "definition": "Limited system access; no sensitive data",
        "assessment_frequency": "Biennial",
        "requirements": [
            "Security questionnaire (CAIQ Lite)",
            "Insurance verification",
        ]
    },
    "low": {
        "definition": "No system access; public data only",
        "assessment_frequency": "On contract renewal",
        "requirements": ["Business registration verification"]
    }
}

def tier_vendor(vendor: dict) -> str:
    """Classify vendor by risk tier based on access and data."""
    if vendor.get("pii_access") or vendor.get("financial_system_access"):
        return "critical"
    if vendor.get("internal_system_access"):
        return "high"
    if vendor.get("limited_access"):
        return "medium"
    return "low"