The Security Interviews: Alex Yampolskiy, SecurityScorecard

Unquantified dependencies

In the summer of 2013, Yampolskiy and his business partner began to think in more depth about the myriad dependencies on third parties that exist within the average enterprise, and how widely documents and data are shared – legal paperwork goes to a law firm, taxes to an accountant, your own files to a cloud storage service, and so on.

Any one of these dependencies, says Yampolskiy, could be the one that results in a cyber security incident that gets your organisation on the front page of a national newspaper, and yet there have historically been no key performance indicators (KPIs) in the security world that could be used to effectively judge what third-party risk looks like.

“You go to a doctor, they measure your blood pressure. You drive a car, you have a speedometer. For security, you get nothing. Why can’t there be a KPI to measure and quantify risk? That was the insight that led to us beginning to incubate SecurityScorecard,” he says.

How it works

At its core, the SecurityScorecard platform is a database of companies scored by various cyber risk factors, giving users insights into the security postures and risk profiles of any organisation they do business with, or care to run a search on.

How are these scores calculated? First, SecurityScorecard looks at the attack surface of an organisation from without, using non-intrusive scanning methods to collect signals about organisations.

“Just like you can walk in the neighbourhood and see a broken window or graffiti on the wall, you can deduce without walking into a house that maybe it’s not been well maintained on the inside. Similarly, for companies, there are hundreds of signals you can pick up non-intrusively,” says Yampolskiy.

“A simple example would be, you look at a website, and you see on the bottom of the site, ‘copyright 2005’. Well, it’s 2024, right? So it’s not a vulnerability, you can’t exploit it, but you just determined that they’re not updating the website proactively [so] how diligent are they going to be in resisting an attack of another sort?”

To this information it then applies a statistical model based on almost a decade of historical data to benchmark the organisation against others in its peer group, arriving at a final score. The algorithm it uses is published publicly, Yampolskiy being a big advocate for transparency in how the organisation operates.

The effort and resources needed to build this up have been significant, and it’s an ongoing challenge, says Yampolskiy. “We have 600 people in the company, and about 35% to 40% of them are in research and development. We’ve built a technology over the past nine years that collects billions of signals every day.

“For example, we run one of the largest malware sinkholes in the world, where we capture signals about what machines are infected worldwide – and we’ve got to make sure it’s accurate and trustworthy. It requires a lot of engineering effort. It’s not easy to build this type of technology.”

And is the data accurate? Apparently so. “We have demonstrated – and companies like Marsh McLennan, for example, have proven – that companies with a bad score are eight times more likely to suffer a data breach than those with a good score,” he says.

But the service doesn’t stop there. “We don’t just give you a score and say good luck. We also give you recommendations on how you can become more resilient, [and] we allow you to take the scores and insights and integrate them into workflows,” says Yampolskiy.

“We have demonstrated that companies with a bad score are eight times more likely to suffer a data breach than those with a good score”

SecurityScorecard integrates with over 100 other platforms to enable users to establish and define all kinds of different elements of their risk profiles – for example, regulatory compliance with the General Data Protection Regulation (GDPR) or equivalent state-level regulations in the US – and, crucially, understand security issues and discrepancies among their suppliers that need to be factored into their risk planning.

Ever-increasing threats

When SecurityScorecard first got off the starting blocks almost 10 years ago, the world of cyber security looked very different to how it does today. We have moved from a world where security was considered very much the domain of technical experts and people steeped in hacker culture, to one where ransomware attacks make primetime TV news bulletins and security is a topic for dinner party conversation.

For Yampolskiy, three core trends are contributing to this. First, the attack surface has become vastly more complex and interconnected. Second, there has been an explosion in third-party risk – the firm’s own statistics show that almost 30% of all breaches now originate through a third party. Third, threat actors have access to a more sophisticated and cheaper variety of weaponry, from distributed denial-of-service (DDoS) attacks procurable for a few dollars, to zero days starting in the thousands.

“We cannot change the fact that the world became more complex. We cannot change the fact that attackers became more sophisticated,” says Yampolskiy.

“What we can influence is that most companies are still focusing on robustness instead of resilience. They’re trying to prevent an adversary from breaking in instead of flipping the assumption and saying, sooner or later, with enough effort, the adversary is going to get in, [so] how do I make it as hard as possible for them?”

The view that addressing third-party risk forms part of this shift towards resilience is one that many share. With an eye on the future, Yampolskiy is hopeful that as organisations move towards a resilience-focused security practice, SecurityScorecard’s KPI-backed methodology will ultimately help them make a more appropriate purchasing decision, instead of just turning a firehose on the problem.

Future developments

SecurityScorecard is also ramping up services that can sit alongside and enhance its ratings system, something customers have been asking it for. After all, quantifying your security risk and that of your partner and supplier ecosystem will only get you so far – and you’re probably still going to get attacked at some point.

“I’m quite excited also about not just giving you security ratings to measure, but also giving you solutions,” says Yampolskiy.

“A big focus, a big push for us right now is how to expand from ratings to solutions. We now have a business unit that does tabletop exercises where we come and train your executive team. We have a unit that does forensics, so if your computer gets hacked or you are infected with ransomware, we can help you.”

Yampolskiy is particularly interested in helping bridge the long-acknowledged communication gap between security teams and their board-level leaders.

“Boards and the CISOs lack a common language. Board members are from Mars, and CISOs are from Venus”

“Boards and the CISOs lack a common language. Board members are from Mars, and CISOs are from Venus,” he says.

“A CISO often speaks in a technical language, technical jargon, so he might say, ‘I deployed Akamai Prolexic on 124.1.1.3/24 to mitigate endpoint attacks’, and the board member has no idea what the CISO just said. The CISO should have said, ‘I’ve implemented denial-of-service prevention. It cost me $200,000 and will save us $3m in outages’.

“There’s also an onus on board members to learn more about cyber security. If you’re a board member and during a meeting, you ask, ‘What’s gross margin?’, you’re going to get a tap on your shoulder and a break where people are going to say, ‘You really need to learn more about financials, you need to know what gross margin is’. But if a board member asks, ‘What’s a denial-of-service attack?’ nobody cares. It’s normal. It’s expected.

“Unfortunately, board members are not entirely technically literate, and that has to change – it’s already changing. So we’re seeing more engaged boards, we’re seeing boards standardise on risk measuring and reporting, and we’re seeing boards adopt security ratings like ours to vet what they’re doing. The world is changing in a positive direction in cyber security.”