Leading a security programme: risk in numbers and major incidents
Lesson 4 of 5
4✈️ Leading a security programme: risk in numbers and major incidents
The big pictureA new security head gave management thirty slides on flaws and attacks and asked for a budget. The finance director asked one question: "if we do not pay, how much do we lose?". There was no answer, so the budget was not approved. A senior brings the answer: "ransomware risk costs us about 2.4 million riyals a year in expectation, and this 600 thousand project cuts it to 0.7 million". That is the language decisions are made in.
What the picture shows: Every risk goes through the same loop: a clear name, then a price, then options with their cost and effect, then a decision owned by the business, then a metric proving it worked.
Map of this part
The concepts in order, click any one to jump to it:
Two ways into the same idea
Think of car insurance. The insurer does not say "accidents are dangerous"; it computes how often a driver like you crashes each year and what one crash costs, so it knows the average yearly loss and sets the premium. If you fit a camera and smart brakes the premium drops, because the expected loss dropped. A security leader thinks the same way about every risk.
The classic sum: SLE (single loss) = asset value × exposure factor, ARO = expected times per year, and ALE = SLE × ARO. FAIR (a standard from The Open Group) sharpens it: event frequency (threat frequency × the chance it succeeds) with loss size (primary and secondary), using a minimum, most likely and maximum with Monte Carlo simulation instead of one number. ROSI = (cut in ALE − cost of the fix) ÷ cost of the fix. Metrics: mean time to detect (MTTD) and to contain (MTTR), the share of critical flaws patched within the agreed time, the share of accounts on phishing-resistant MFA, and ATT&CK coverage. A major incident: one incident commander, a technical lead, a communications lead, a scribe, legal counsel, one room and updates at fixed times. NIST SP 800-61 Rev. 3 (April 2025) ties response to the six CSF 2.0 functions: govern, identify, protect, detect, respond and recover. In Saudi Arabia: incidents are reported to the National Cybersecurity Authority under its controls, and a personal data breach is reported to SDAIA within 72 hours of becoming aware under the PDPL regulations.
Before You Start
📋Governance, risk and compliance
You know the risk register and CSF 2.0.
🚨The SOC and incident response
The phases of incident response.
The Core Idea
1Risk in money
The risk register in the first stage was "high, medium, low". That is enough to rank, but it does not answer the finance director. The next step: a number in money, even a rough one, with a range showing the uncertainty. What matters is not perfect precision but comparing options in the same unit.
The first half is the classic textbook sum. The second approximates the FAIR way: a range instead of one number, and a simulation that gives you a "bad year" (the 90th percentile), not only the average.
import random
random.seed(7)
def ale(sle, aro):
return sle * aro
def rosi(ale_before, ale_after, cost):
return (ale_before - ale_after - cost) / cost
# Ransomware on the ERP system, in SAR. SLE = asset value x exposure factor
sle = 8_000_000 * 0.6 # 4.8 M: downtime, recovery, fines, lost trust
before, after = ale(sle, 0.5), ale(sle, 0.15) # one in two years -> about one in seven
cost = 600_000 # immutable backups + EDR + MFA for admins, per year
print(f"SLE {sle:,.0f} ALE before {before:,.0f} after {after:,.0f}")
print(f"ROSI = ({before:,.0f} - {after:,.0f} - {cost:,.0f}) / {cost:,.0f} = {rosi(before, after, cost):.0%}")
# FAIR style: ranges instead of one number, simulated many times
def tri(low, likely, high):
return random.triangular(low, high, likely)
def one_year(aro):
hits = sum(random.random() < aro / 12 for _ in range(12)) # each month may bring an attack
return sum(tri(1.5e6, 3.5e6, 9.4e6) for _ in range(hits)) # each loss somewhere in a range
years = sorted(one_year(0.5) for _ in range(10_000))
print(f"simulated: average {sum(years) / len(years):,.0f}, median {years[5_000]:,.0f}, "
f"bad year (90th percentile) {years[9_000]:,.0f}")2Metrics that drive decisions
A good metric answers a question and drives an action. "Attacks blocked" is a big satisfying number that says nothing. These metrics do say something:
| Metric | Answers | Example target |
|---|---|---|
| MTTD: mean time to detect | How long does an attacker stay unseen? | Under 24 hours |
| MTTR: mean time to contain | How long do we need to stop them? | Under 4 hours for critical |
| Critical patches on time | Do we close known doors? | 95% within 14 days, KEV within 7 |
| Phishing-resistant MFA | Are identities protected? | 100% for admins and executives |
| ATT&CK coverage of relevant adversaries | Would we see the expected attack? | 75% alerted or blocked |
| Restore tests | Can we recover after ransomware? | A full tested restore every quarter |
3Leading a major incident
In a major incident the most dangerous thing is not the attacker but chaos: twenty people on a call, everyone suggesting, nobody deciding, and the CEO calling every ten minutes. The cure is roles written before the incident, known by all and rehearsed. Walk the first hours of a ransomware incident:
The first hours of a major ransomware incident
Two in the morning, Thursday. EDR flags mass encryption on the file servers, and a ransom note appears on screens.
The idea: the big decisions (isolating the network, reporting, dealing with the attacker) are made fast because their owners are known in advance, and communication runs on a schedule so nobody interrupts the technical team.
1 · Declare
The on-call analyst classes the event as a "major incident" against written criteria and calls in the incident commander. From here a timeline begins, with the scribe writing every decision and its time.
2 · Roles
The commander assigns: a technical lead for containment, a communications lead for management and staff, legal counsel, and a scribe. Management gets an update every hour at a fixed time, no random calls.
3 · Contain
A hard decision owned by the commander: cut the server network off from the internet and disable the suspected admin accounts, accepting the service outage. Evidence is preserved before any reboot.
4 · Scope
The technical team establishes: was data stolen before encryption? The logs show 40 GB uploaded to an outside storage service. It is now a personal data breach as well.
5 · Report
Counsel and the communications lead prepare the reports: to the National Cybersecurity Authority under its controls, to SDAIA within 72 hours of learning of the breach, and to affected customers as needed. The clock started at hour 3.
6 · Recover and learn
Restore from immutable backups once sure the attacker is out, then a blameless review within two weeks: what worked, what failed, and the tasks with owners and dates.
Worked example
The task: you have a budget of 900 thousand riyals and three projects: (a) immutable backups at 300k cutting ransomware ALE from 2.4M to 1.2M; (b) a DLP tool at 600k cutting data leak ALE from 900k to 600k; (c) FIDO2 keys for everyone at 250k cutting account takeover ALE from 1.5M to 0.4M. What do you choose?
The answer: compute ROSI for each: (a) (1.2M − 300k) ÷ 300k = 300%; (b) (300k − 600k) ÷ 600k = −50%, so it costs more than it saves; (c) (1.1M − 250k) ÷ 250k = 340%. Choose (c) and (a) for 550k in total, and leave (b) for now. The remaining 350k? Do not spend it because it is there: propose the next highest risk in the register, or return it. In the presentation to management: three lines with the numbers, a note that the figures are estimates with ranges, and that you will measure the effect after a year (account takeovers and restore test results).
Myth vs Reality
| Myth | Reality |
|---|---|
| Security cannot be measured in money. | Estimating with a range is possible and useful; insurers have done it for a century. Perfect precision is not needed for a better decision. |
| In a major incident, the more people join the better. | Without a commander and roles, numbers become chaos. A small organised team with regular updates is faster. |
| The security head must be the most skilled technician on the team. | They need deep technical understanding, but their main job is translating risk for management, building the team and deciding under pressure. |
Where you meet it at work
💼Budget requests
Projects ranked by return get approved faster.
🏛️The board
A quarterly report of the biggest risks, their cost and progress.
🚒The response plan
Written roles and tabletop drills before they are needed.
Test your understanding
An asset worth 1M, exposure factor 40%, an incident expected once every four years. What is the ALE?
SLE = 1M × 0.4 = 400k, ARO = 0.25, so ALE = 100k.
A project costs 200k and cuts ALE by 150k. What is the ROSI?
(150k − 200k) ÷ 200k = −25%: it costs more than it saves.
What does FAIR add to the classic sum?
FAIR admits uncertainty and gives a normal year and a bad year.
Who decides to isolate the network in a major incident?
One commander owns the big decisions, and the roles are known in advance.
When must SDAIA be told of a personal data breach?
The PDPL regulations set 72 hours, so do not wait for the investigation to finish.
Quick review cards
Check Your Understanding
Why present risk as a range and not one number?
Because the estimate is uncertain, and a range shows the normal and bad year so management decides knowing the limits of the number.
What makes a metric good?
That it answers an important question and drives an action, such as time to detect or critical patching on time.
What are the core roles in a major incident?
Incident commander, technical lead, communications lead, scribe and legal counsel.
Resources for this lesson
Grouped by type. Start with the official docs for precision, or an article or video for the explanation.
Articles1
reference3
Done with this lesson?
Sign in to save your progress.