How Is Data Risk Calculated?
The customized data security risk scoring framework draws inspiration from the NIST
Cyber Risk Scoring (CRS) model to create a flexible and transparent approach to
evaluating your organization's data security posture. Customized risk scoring offers
a dynamic and adaptable approach to assessing your data security risk, aligning it
with your organization's unique needs, and provides actionable recommendations for
improving your data security posture.
Identification of Key Risk Factors—Data Risk begins by identifying critical
attributes within three main categories: application, data, and users. These
attributes are carefully chosen by security experts, incorporating their knowledge,
threat intelligence, and industry insights.
Configurable Risk Factors—Administrators have the flexibility to configure the
risk score ranges,
risk factor importance, and
data profile severity settings to align with your
organization's specific business processes and technical requirements. These
importance settings are used to determine the weighting (multiplier) for each risk
attribute.
Assessing the Likelihood of a Breach—The attributes help assess the likelihood
of a data breach. Data Risk considers factors like application configurations, user
behavior, and data exposure. This analysis helps in quantifying the potential
threats an organization faces.
Evaluating the Impact of Data Breaches—Data Risk also factors in the potential
impact of a data breach by examining data sensitivity and data profiles. This
enables a more nuanced evaluation of the consequences of security incidents.
Aggregated Risk Score—Using these attributes and assessments, Data Risk
calculates an aggregated risk score for all discovered assets. This score provides a
comprehensive overview of the risk associated with sensitive data stored in SaaS
applications.
Incorporation of SaaS App Compliance Data—Risk scoring attributes incorporate
data related to SaaS application compliance, ensuring that regulatory and industry
standards are part of the risk assessment.
Continuous Monitoring and Change Tracking—Data Risk is designed for ongoing
monitoring using the
Data Risk Dashboard. It continuously monitors
changes in data asset properties and tracks the effectiveness of implemented
security and privacy controls. This ongoing monitoring provides insights into shifts
in your organization's overall risk posture.
Insights and Recommendations—Data Risk goes beyond just providing a risk score
and offers insights into the specific security and privacy controls that
significantly influence the risk score. It also provides
actionable recommendations for improving the organization's security
posture, allowing for informed decision-making and risk mitigation.
