Latest / CYBR.Signal / Risk Prioritization

Transcript

Risk Prioritization · CYBR.Signal

• 0:00
  SPEAKER_00: And hello everybody.
• 0:01
  SPEAKER_00: Happy Cyber Sunday.
• 0:02
  SPEAKER_00: Hope you're doing well.
• 0:04
  SPEAKER_00: So a few weeks ago on Cyber Sunday, I talked about the not the prioritization.
• 0:10
  SPEAKER_00: I am going to talk about the prioritization of risk on this one.
• 0:13
  SPEAKER_00: I talked about the acceptance of risk.
• 0:15
  SPEAKER_00: And when you have in an organization, when you go through risk assessment and you figure out what your risks are, there are certain risks you're going to have to accept within your organization.
• 0:28
  SPEAKER_00: But then you need to go back and do a review of what you accepted every once in a while.
• 0:35
  SPEAKER_00: So that you just basically that risk acceptance and review.
• 0:39
  SPEAKER_00: But what I didn't talk about then is about how you even get to the point where you're accepting risk in the first place, and then the prioritization of that risk.
• 0:52
  SPEAKER_00: So there's, you know, there's a whole conversation about what risk is and everything else.
• 0:57
  SPEAKER_00: Not going to get into that here.
• 0:58
  SPEAKER_00: But essentially what you're doing is going into your organization, doing an assessment of all your different business areas, what your priorities are within that organization.
• 1:08
  SPEAKER_00: And when you get to that point, you have to figure out how to prioritize those risks, the any of the threats you have.
• 1:16
  SPEAKER_00: And risk can be, you know, the larger risk conversation, or it can be you even want to look at individual threats within your organization that come down to very, you know, things like vulnerabilities within whatever's in your organization.
• 1:33
  SPEAKER_00: So your servers, your workstations, any kind of uh your technology stack that you have.
• 1:39
  SPEAKER_00: And in order to even get to the point where you can prioritize those, you even have to back up even more and you have to have visibility into them in the first place.
• 1:46
  SPEAKER_00: Um so when it comes to an individual machine, or like if you've got IoT devices in your network, or you've got whatever you've got in your network's technologies connected to your network in your infrastructure, you've got to be able to see those things in the first place and to be able to and to be able to see those and to get that visibility.
• 2:09
  SPEAKER_00: You've got to see what's going on in the wire, you've got to prioritize or start categorizing those things to know how you're gonna treat them.
• 2:17
  SPEAKER_00: So you've got to know what you're doing to those devices or what those devices are capable of doing, what they're made up of, you know, the different components and that kind of stuff, what vulnerabilities are in those components, and how it's gonna affect your network.
• 2:30
  SPEAKER_00: So you have to have that visibility, you have to know all that stuff, and that can get pretty difficult to do.
• 2:35
  SPEAKER_00: I always joke around, and uh if you've if you're familiar with the movie Saving Private Ryan, I say it's like finding a needle in a stack of needles, which is one thing that their character Tom Hanks said in there when they were trying to find Private Ryan and a bunch of other different soldiers in a war zone, it's the same thing, right?
• 2:53
  SPEAKER_00: You're looking for visibility of knowing what's in your environment.
• 2:58
  SPEAKER_00: And it's there's all kinds of stuff that's gonna be on your network.
• 3:03
  SPEAKER_00: So you're kind of finding trying to find a needle in a stack of needles there.
• 3:06
  SPEAKER_00: There's just a lot of stuff to look for.
• 3:08
  SPEAKER_00: But once you've got that visibility, before you could even know what risks to accept, and then start doing those reviews, you've got to go in and prioritize those.
• 3:19
  SPEAKER_00: Now, we always talk about priority prioritization of risks and threats and all the vulnerabilities and what you're gonna look at first through the lens of the business itself.
• 3:29
  SPEAKER_00: What is gonna have the most effect on your business if something happens within a certain business unit?
• 3:36
  SPEAKER_00: It's the same thing I talked about with the acceptance of risks.
• 3:39
  SPEAKER_00: You've got to be able to figure out what's gonna have the most impact in your organization first if there's a problem.
• 3:46
  SPEAKER_00: But, and that's it, that that's pretty much the base reason you prioritize threats and risks, why you do that.
• 3:54
  SPEAKER_00: But it sounds kind of obvious when I think it through.
• 3:57
  SPEAKER_00: But what it does is give you the ability to be more efficient with what you're doing for your organization and how you're treating those.
• 4:06
  SPEAKER_00: I remember hearing years ago a um a pretty prominent security person say, we just need to patch all the vulnerabilities and then we don't have to worry about prioritization.
• 4:18
  SPEAKER_00: And my head kind of exploded.
• 4:20
  SPEAKER_00: I was like, but no, that's just really not how that works.
• 4:22
  SPEAKER_00: It's not, there's too much, and especially today.
• 4:25
  SPEAKER_00: I mean, that was years ago when environments were a little bit more simple and they're just not there now.
• 4:31
  SPEAKER_00: Um, they've gotten nothing but more complicated.
• 4:33
  SPEAKER_00: So you can't do that.
• 4:35
  SPEAKER_00: You have to prioritize those risks.
• 4:37
  SPEAKER_00: It lets you be more efficient, it'll let you be more efficient in reporting how well your environment uh or your company is, your organization is from a regulations and standards perspective as well.
• 4:49
  SPEAKER_00: Let's you get through audits faster, that kind of thing.
• 4:52
  SPEAKER_00: So prioritization of risks is extremely important.
• 4:59
  SPEAKER_00: You can't even get to the point where I was talking about on the other Cyber Sunday of accepting those risks until you prioritize them and get the visibility.
• 5:07
  SPEAKER_00: You have to have visibility in your environment before you can even do the prioritization.
• 5:13
  SPEAKER_00: So, so that's it for Cyber Sunday today.
• 5:15
  SPEAKER_00: Thank you.
• 5:16
  SPEAKER_00: And I want to also thank Fourscout for sponsoring this.
• 5:18
  SPEAKER_00: They're our first sponsor of uh Cyber Sunday, really appreciate it.
• 5:22
  SPEAKER_00: Go check them out.
• 5:23
  SPEAKER_00: They uh they help enable some of the very things that I'm talking about on this Cyber Sunday.
• 5:27
  SPEAKER_00: So go check them out, and uh, we'll see you next time.