Latest / CYBR.Signal / Is GRC Technical?

Transcript

Is GRC Technical? · CYBR.Signal

• 0:00
  SPEAKER_00: And hello everybody.
• 0:01
  SPEAKER_00: My name is Michael Farnum and happy Cyber Sunday.
• 0:04
  SPEAKER_00: Hope you're doing well.
• 0:05
  SPEAKER_00: Wanted to talk about a conversation that was going on the other day, and it may be still going on on LinkedIn.
• 0:12
  SPEAKER_00: Guy by the name of Mike Miller, who is uh a VC so and does some other stuff.
• 0:17
  SPEAKER_00: I don't know him, but I saw the post come across and I'm uh kind of talking to him about it, hopefully, connecting with him.
• 0:24
  SPEAKER_00: But and I'll include a link down below where the LinkedIn conversation was happening.
• 0:30
  SPEAKER_00: But essentially what it was was he said that you don't have to be technical to be in cybersecurity because you can go through a route of governance, risk, and compliance or GRC.
• 0:43
  SPEAKER_00: And my initial thought on that was, well, no, you don't have to be technical to be in GRC.
• 0:54
  SPEAKER_00: I mean, I've had that conversation and talked about that in the past as well.
• 0:58
  SPEAKER_00: But then I started thinking about it, and I was like, well, you have to have some kind of technical capabilities.
• 1:03
  SPEAKER_00: And then as soon as I I was going to respond, like, well, what do you mean by technical?
• 1:08
  SPEAKER_00: I noticed that two or three other people had said the same thing.
• 1:11
  SPEAKER_00: So it's kind of a common thought process, is what we are what we really need to sit down and define what technical means.
• 1:19
  SPEAKER_00: So I think, and and I haven't looked through all of the conversation, but I think what Mike is saying, and Mike, please correct me if I'm wrong, uh, I'll send you this link.
• 1:30
  SPEAKER_00: But I think what Mike is saying is that you don't have to be that person who is on the keyboard and is you know putting in configurations on firewalls to get them plugged into a network in a certain space, and you don't have to know how routing works necessarily.
• 1:50
  SPEAKER_00: You know, you don't have to have all the ins and outs, and you don't have to necessarily know exactly how to go into a cloud environment and configure all of the security stuff in that.
• 2:03
  SPEAKER_00: Basically, what you need to know is what technical things need to go into what place and how they need to essentially be configured in order to be the most secure.
• 2:19
  SPEAKER_00: And you need to know that because, in order to grade or audit a company or an environment based on how well they meet certain requirements, which is what governance, risk, and compliance is in cybersecurity, then you you have to have some at least acumen or understanding of what that environment looks like and how it's going to be built out in the best way.
• 2:51
  SPEAKER_00: So that's kind of where that break happens between what does technical mean and does it mean you just basically need to know those things and know how they fit into an environment.
• 3:07
  SPEAKER_00: It kind of goes back to the whole argument that are not argument, conversation, could be an argument, I don't know, whether a CISO, a chief information security officer, should be technical or should be business driven.
• 3:23
  SPEAKER_00: And there are a lot of CISOs that come into our and into cybersecurity who are more business-driven and business-minded versus technical.
• 3:32
  SPEAKER_00: And they'll be the first one many times to tell you, look, I haven't gone in and done all of these configurations on all these things.
• 3:39
  SPEAKER_00: I haven't gone in and done penetration tests, I've never been a developer, I've never done these things.
• 3:44
  SPEAKER_00: However, I understand the ins and outs of cybersecurity and what makes a good program and how you measure that, and how you measure that against certain risks, how you measure that against certain frameworks, those kind of things.
• 3:58
  SPEAKER_00: And that's what's important.
• 3:59
  SPEAKER_00: And you don't have to be technical as far as being deep in the weeds to be able to do that as a CISO, and you don't have to do that to know, you don't have to know that to be able to get into cybersecurity via GRC.
• 4:13
  SPEAKER_00: You just have to understand how that gets laid out.
• 4:16
  SPEAKER_00: That doesn't mean you can just immediately get into governance risk of compliance and be good at measuring a security program.
• 4:24
  SPEAKER_00: I do think there's a distinction that needs to be made there.
• 4:27
  SPEAKER_00: You can do some measurements of a program if you've got standards, but if your standard gets into the weeds like some like PCI does or HIPAA or some of those things where they start getting into the weeds of what part of what programs need to be in place and how you measure whether those things are done effectively, you do need to have understanding of how that gets laid out, and you can't just walk in the door and go, I'm an auditor or I'm a GRC person and expect to just be in the industry.
• 4:56
  SPEAKER_00: You have to have some of that understanding.
• 4:58
  SPEAKER_00: So, anyway, thought it was a good conversation.
• 5:01
  SPEAKER_00: It's definitely a valid point on being technical and being able to get into GRC.
• 5:07
  SPEAKER_00: Let me know what you think.
• 5:08
  SPEAKER_00: I'll include the link to Mike's post as well, and uh maybe we can broaden the conversation.
• 5:14
  SPEAKER_00: Talk to you next time.