Latest / CYBR.Signal / Risk Avoidance vs. Risk Mitigation

Transcript

Risk Avoidance vs. Risk Mitigation · CYBR.Signal

• 0:00
  SPEAKER_00: And hello, everybody.
• 0:01
  SPEAKER_00: Happy Cyber Sunday.
• 0:02
  SPEAKER_00: Hope you're doing well.
• 0:04
  SPEAKER_00: I want to stay in the new year on a little bit on this risk assessment, risk management kick I've been on.
• 0:10
  SPEAKER_00: And I want to tell a story that differentiates between two different risk treatment methods, which are risk avoidance and risk mitigation.
• 0:20
  SPEAKER_00: So there's a distinction between the two that's important, and it has to do with how your organization generally treats risk at all and kind of which way you want to go, but also involves different risk calculations and things.
• 0:37
  SPEAKER_00: So the story is I worked for an organization that collected a lot of different data on uh customers, and there were two types of data specifically that were involved here that were uh made us make a decision on whether we were going to avoid the risk or we were gonna mitigate the risk.
• 0:55
  SPEAKER_00: So specifically, what it was is we had vulnerability a lot of vulnerability data on our customers, and we also had data that was more marketing type of data.
• 1:06
  SPEAKER_00: So, and we used that for various purposes, didn't sell the data or anything, it was just used for research things internally.
• 1:14
  SPEAKER_00: So, uh, and and for marketing stuff that we put externally out, um, but again, not identifiable, but it was data on the customer.
• 1:23
  SPEAKER_00: So, when um what we did with that data though is we kept it in two different places within our this was before cloud was like really, really popular.
• 1:32
  SPEAKER_00: So we had our own infrastructure, our own data center, and we kept that in two different places.
• 1:37
  SPEAKER_00: And because of the sensitivity of the vulnerability data, we kept that more secure storage, and because of the marketing data, research data that we kept, we uh it wasn't as sensitive, at least how we classified it.
• 1:51
  SPEAKER_00: And so we kept that in less secure storage.
• 1:56
  SPEAKER_00: So when we had a big customer come in, want to buy our services, and they said contractually that all of their data they didn't differentiate.
• 2:04
  SPEAKER_00: They did internally, I think, within their own organization, but they kind of made the decision to not differentiate that when it came to third parties, that any data that we collected had to be in the most secure level of storage that we had.
• 2:17
  SPEAKER_00: And this was a big contract.
• 2:19
  SPEAKER_00: We really wanted to get this contract.
• 2:24
  SPEAKER_00: So legally we had conversations with them and said this is how we do our storage.
• 2:28
  SPEAKER_00: They said that's not acceptable.
• 2:30
  SPEAKER_00: You have to put all of that in the most secure storage.
• 2:34
  SPEAKER_00: So, what did that mean for us?
• 2:36
  SPEAKER_00: So, from a risk standpoint, we had already made the decision to split those off because it was less risky to keep the uh less sensitive data in one place, and it cost less because we didn't have to put as much around it.
• 2:51
  SPEAKER_00: Um, we could access it more, we could give better access to it, that kind of thing.
• 2:55
  SPEAKER_00: So we made a risk decision based on multiple calculations.
• 2:59
  SPEAKER_00: What we had to do is make a risk calculation here.
• 3:03
  SPEAKER_00: Did we want to avoid the risk, which was we just would stop collecting that data whatsoever for marketing purposes, or we could mitigate the risk, which was do what the customer wanted, which was move all data collected from them into the more secure storage.
• 3:26
  SPEAKER_00: The other calculation that came into that was like it we didn't really have it set up where we could split that out for customers, and it was going to cost a lot.
• 3:37
  SPEAKER_00: So basically, the least costly method was just to start storing all customer data that we collected into the sensitive storage and work out some things in other ways where we gave the right access.
• 3:48
  SPEAKER_00: So that's the whole story.
• 3:49
  SPEAKER_00: What we ended up doing is collecting all of that data, moving it into the most secure storage, and doing some other stuff to split it out where we could still give access to our marketers and anybody else in our data researchers, that kind of stuff, and then keep all of the sensitive data still in there and but still put more controls around that.
• 4:10
  SPEAKER_00: Um, so so that's what we ended up doing.
• 4:14
  SPEAKER_00: So we we could have avoided the risk, which would have just been collect not collect that data whatsoever, get rid of that, or we could mitigate it, which was move all of that data into secure storage and then put some other controls around it that gave the right access to the right people who needed to get in there.
• 4:35
  SPEAKER_00: And we decided from a risk standpoint and from a cost standpoint, we did a calculation that the risk mitigation of moving that data into secure storage was the way to go instead of avoiding the risk, which was just not collect the data.
• 4:49
  SPEAKER_00: And that's the difference between the two.
• 4:51
  SPEAKER_00: Risk avoidance is just getting rid of the problem.
• 4:54
  SPEAKER_00: We don't need to have that anymore.
• 4:56
  SPEAKER_00: Drop it, or risk mitigation, which is actually put some kind of control in place or move it to a place where in this case it was more secure.
• 5:05
  SPEAKER_00: So that's my story.
• 5:06
  SPEAKER_00: Uh, interesting differentiator between the two, and it really has a lot to do with what your company's in the immediate risk calculation is and all the all the calculations about cost and the benefit, and then long term, what the risk appetite and risk tolerance of your organization is, and what what has been put forward from your uh your upper management, your executive management, on what the company's status or uh state is in that in general, or an attitude in that in general.
• 5:35
  SPEAKER_00: So let me know what you think.
• 5:37
  SPEAKER_00: Talk to you next time.