Federated Cybersecurity™

Each methodology federates a different kind of security work. They all do it the same way.

A methodology belongs to the family when it holds to five commitments. The rest of this page takes them in turn.

• Risk is owned where the outcome is controlled. The team that runs a resource owns its risk, and the record says so.
• The work goes to the people who know the resource. They do it inside standards the security office sets.
• Participation is designed for. People outside the security office take part because five principles remove their reasons not to.
• Help follows need. Most teams look after themselves, and expert time goes where it changes the outcome.
• The work leaves its own record. Nobody compiles a report, and each level of the organization can read the record at its own scope.

Why adding staff doesn't close the gap

A central team has to choose between analyzing risk in depth and covering more of the organization, because both draw on the same few people. At the organization where the methodology was first used, a risk-informed security plan took five people about sixteen hours each: three from the security office and two from the team that owned the resource. Across some three hundred resources, that would have cost more each year than the reduction in risk was estimated to be worth.

A program in that position is sized to its budget, not to its risk. Coverage is rationed, and the risk in everything left out is accepted by default instead of by decision. The methodologies change what the work costs, and that is what lets coverage reach the whole organization. The published case study has the figures

Little in these methodologies will surprise a security professional.

They are built from methods the field already trusts: risk assessment against an established control framework, a security plan for each resource, risk handling decisions, compliance measured against baselines, tracked remediation, vendor assessment, and program metrics. An organization that adopts the methodologies keeps its frameworks, its standards, and what its people already know.

The twist is scale

Each of those methods was designed to be carried out by specialists, one system at a time. Each stops working when there are thousands of systems and a small security office. The methodologies keep the methods and change how the work is shared out.

Why that is a strength

Nothing here asks an organization to bet on an untested idea. Every part has a long record behind it, in security and in the fields security has learned from. What the methodologies add is the arrangement: who does each part, how each part is made workable for someone outside the security office, and how the results add up..

Cyber risk ownership is already distributed.

The methodologies build on that fact instead of working against it.

The people who run a system decide how it is built, who uses it and what it holds, and they live with what happens to it. They own its risk, whether or not anyone has said so. The security office owns different things: the method, the standards, the help it offers, and the view of the whole.

When the incentives point the wrong way

Security economists have described this problem for twenty years. In 2006, Ross Anderson and Tyler Moore argued that many security failures come from misaligned incentives more than from missing technology. The people best placed to protect a system often lack the responsibility, the resources or the motivation to do it, and the people who bear the cost of a failure are often not the ones in control of the system.

A centralized program builds that misalignment in. Its stakeholders have learned that good IT is nearly invisible and that cyber risk is a job for technical experts. When the security office carries out every assessment, they conclude that the security office owns the risk, including the risk in systems it does not run and cannot change. Shared responsibility is the reality, but nothing in the traditional process recognizes it or manages it.

The central team, meanwhile, can only work on what it already knows about. Its program narrows to the minimum that satisfies its governing bodies, and it is measured on compliance instead of on reduced risk. The people who could reduce a risk have little reason to, and the people held responsible for it have no means to.

Making ownership explicit

Each methodology puts the decision, and the record of it, with whoever controls the outcome. A resource team decides for its own resource. A gap is recorded against whoever owns it. The security office is accountable for what it does control, and is no longer assumed to own what it cannot.

Two kinds of participant appear in every methodology.

Each methodology may add its own. Federated Cyber Risk brings in the providers of shared services. Federated Practice Monitoring adds auditors, who monitor the outcomes of decentralized activites.

Shared responsibility, not shared access

Taking part does not mean seeing everything. Each team works with its own resources, a unit sees its own teams, and only the security office sees across the whole organization.

A federated model only works if people who are not security professionals take part, and keep taking part. That makes participation something to design for. Each principle removes a reason a busy team would stay away.

1. Agile and lean design

   Iterative, low-friction workflows built around how teams actually work.

2. Automating the tedious

   The work people dread gets done automatically.

3. Knowledge at the point of decision

   Insight delivered when it can be acted on, not buried in reports.

4. Psychological safety

   Gaps are improvement opportunities. Honest reporting is safe and rewarded.

5. Gamification

   Progress is visible. Contribution is recognized. Participation becomes self-sustaining.

The principles are not a menu. Automation without safety produces fast, flattering answers. Safety without knowledge at the point of decision produces honest gaps that nobody acts on. Read “The Five Principles of Participation”

The methodologies borrow their operating model from public health, which protects a whole population without an appointment for every person.

• Self-care. Teams handle routine work themselves, with guidance built into the process, and keep an eye on their own signals.
• Guided care. When something needs attention, a flag or an indicator directs targeted help to that team.
• Specialist care. The security office's expert time goes to the serious cases, where judgment and experience change the outcome.

Underneath all three sit the common protections that every team relies on. Read “From Doctor to Public Health Official”

Doing the work through the methodologies produces a record as a side effect: which teams have plans, how current those plans are, where gaps cluster, and how remediation is moving. Nobody has to compile it.

That record is what lets the security office see an organization it no longer assesses one system at a time, and lets each unit and each team see itself. Reading it, and acting on what it shows, is the subject of Federated Practice Monitoring.

Each methodology takes one part of the work. They meet in the record that the work leaves.

• Federated Cyber Risk covers the resources an organization runs itself. Teams manage their risk, plan, track compliance and remediate.
• Federated Third-Party Risk covers vendors. A vendor's assessment, and the compensating controls it calls for, arrive in the plans of the teams that depend on that vendor.
• Federated Practice Monitoring reads across both. Teams monitor themselves, units monitor their teams, and the security office sees the whole.

An organization can begin with Federated Cyber Risk alone and add the others as its practice grows.

Who is it for

The methodologies are meant for organizations responsible for cybersecurity across a population they can't directly control: universities and university systems, state governments and their agencies, school districts, health systems and distributed enterprises. They fit when three things are true:

• You are responsible for cyber risk across many more systems than you can review.
• Most of those systems are run by people who don't report to you.
• You need a view of the whole population, and haven't got one.

Federated Cybersecurity is for the security team that can't control everything it is accountable for.

The methodologies draw on research in security economics, shared responsibility and safety culture, including these:

• Anderson, R., and Moore, T. (2006). The Economics of Information Security. Science, 314(5799), 610–613.
• Thomas, R. C. (2009). Total Cost of Security. Proceedings of the 5th Annual Workshop on Cyber Security and Information Intelligence Research.
• Zimmermann, V., and Renaud, K. (2019). Moving from a “human-as-problem” to a “human-as-solution” cybersecurity mindset. International Journal of Human-Computer Studies, 131, 169–187.
• El Zein, M., Bahrami, B., and Hertwig, R. (2019). Shared responsibility in collective decisions. Nature Human Behaviour, 3, 554–559.
• Bye, A. (2018). Defining and Developing a Model for an Engaged Information Security Culture. RHUL-ISG-2018-1, Royal Holloway, University of London.
• Stine, K., Quinn, S., Witte, G., and Gardner, R. K. (2020). Integrating Cybersecurity and Enterprise Risk Management (ERM). NISTIR 8286.
• National Institute of Standards and Technology (2011). Managing Information Security Risk. NIST SP 800-39.