Assurance in what connects us

Cyber Assurance

Home /

Innovation /

Continuous assessment and evaluation of connected risk

Holistic approach to managing risk where the management of risks is integrated and coordinated across the organization as a whole.

The threat environment is vast and often hits with a ‘storm’ of incidents designed to either overwhelm defenses or create a false sense of security from a plethora of false positives. It is that turbulence that is the biggest challenge to those tasked as Cyber Operatives and Managers. Given the broad spectrum of threat, intent, likelihood, impact and consequences from the ThreatScape - to especially mission/safety-critical and national security/business essential functions - a new set of CyberSecurity challenges has emerged that is related to determining exactly:

• Where mission/business systems capabilities exist,
• How they are evolving,
• Their changing risk postures and profiles,
• The priority of analyzing the different aspects of this continuum of dimensions
• Actionable risk assessments
• A continued evolving realtime risk identifier that changes with the dynamic nature of the threatscape

Connected Risk

Argo’s Cyber Assurance helps ensure the success of the mission (or value chain) objectives and the protection of the system’s related capabilities regardless of the threatscape throughout the lifecycle. Key activities are executed to ensure that cybersecurity characteristics and elements are incorporated into the planning, design, development, implementation, deployment, sustained operation, and decommissioning of those systems and related components (software, hardware, infrastructure) used to collect, generate, process, store, display, transmit, or receive, mission / business critical data - as part of the operational management of the asset or system.

Argo’s Cyber Assurance activities achieve:

✓ Reduced cost in implementing security
✓ Evidence of readiness and risk probability linked to active threatscape intelligence throughout lifecycle
✓ Rapid Identification of common vulnerabilities, credible threats, critical risks, and security measures in early planning phases
✓ Identification of threats and risk mapped to Confidentiality, Integrity, and Availability (C.I.A)
✓ Secure coding and development in necessary security protections with evidential and probability metrics and common vulnerabilities and exposures.
✓ Identification of associated protection measures to risk and threats
✓ Evidential proof of protections to requirements and design
✓ Modeling of the remaining threats and risks; with impacts, cost if realized, and more
✓ Identification of any residual risk for additional monitoring and risk reduction activities
✓ Indicators and logic for continous monitoring of active security prior to operational status

Argo’s Cyber Assurance activities include an “all source” identification of Threats that are handled differently than what is currently done. These threats are associated to threat Categories (not fully pictured in the above figure). Credible Threat vectors are then associated to capabilities, elements, entities, security elements and characteristics as defined in the Mission/Value Chain (M/VC) and in CIA impacts. Since this is an all source, holistic, and mission design based assurance, these threat categories therefore become more robust than developed during traditional intelligence identification and security impact assessment activities - i.e., identification of degradations of specific capabilities, elements, entities, functions, hardware and software components, and enclaves that have not been - historically speaking - consistently and comprehensively traced to mitigation on the design side of security risk mitigation planning. The resulting protection plan then shifts to more mission/business oriented considerations, with subsequent adjustments in the system’s solution and protection strategies, security architecture/design, System Security Plan, security relevant requirements, testing, etc.

Argo’s Cyber Assurance framework includes a description of essential methods (i.e. techniques). These ‘methods’ are not a description of general best practices - meaning one can not merely take a vulnerability snapshot to continuously understand the security risks that are relevant to protecting the system’s capabilities in achieving mission objectives during the system’s entire life cycle and within the context of an ever evolving ThreatScape.

But a robust implementation of Argo’s Cyber Assurance framework will result in the appropriate and correct implementation of continuously evolving protection strategies for a M/VC, system(s), and solution against a complete set of threats (i.e., current, anticipated, and the emerging threatscape) as per the accepted mission based risk tolerance.