Latest / CYBR.Signal / Reviewing Accepted Risk

Transcript

Reviewing Accepted Risk · CYBR.Signal

• 0:00
  SPEAKER_00: And hello, everybody.
• 0:01
  SPEAKER_00: Happy Cyber Sunday.
• 0:02
  SPEAKER_00: Hope you're doing well.
• 0:03
  SPEAKER_00: So, I want to talk today about risk assessments, specifically about the reviewing of your risk assessments, and even more specifically, of your accepted risks.
• 0:17
  SPEAKER_00: So, I was talking to a vendor the other day that focused on uh risk assessments and vulnerabilities and accepting of those vulnerabilities as you know what their risk level is, that kind of thing.
• 0:29
  SPEAKER_00: And I asked them the specific question do you have a way of going back and reviewing the risks that you have accepted or the vulnerabilities that you've accepted?
• 0:38
  SPEAKER_00: And they said, yes, we absolutely do.
• 0:40
  SPEAKER_00: Showed me the way to go about it.
• 0:41
  SPEAKER_00: That was great.
• 0:43
  SPEAKER_00: Um, and and this is not a knock on them because this is not what the world, you know, they don't go this far with it.
• 0:48
  SPEAKER_00: But basically what I didn't see in that was, you know, here are some of our recommendations of what you do when you accept those risks and how to go back and review them on a regular basis.
• 0:59
  SPEAKER_00: And again, this that they were very technically focused on vulnerabilities and the risks that those created.
• 1:06
  SPEAKER_00: So I didn't expect this of them, but it just made me start thinking about what you need to do when you're going through a risk assessment and you accept certain risks and how you go back and review them.
• 1:19
  SPEAKER_00: So there's a lot of best practices in that area, but one of the things, or a few of the things that I tend to focus on is that first you have to take into consideration your company's risk tolerance when you're accepting risks and when you're in reviewing those risks.
• 1:36
  SPEAKER_00: And why I bring that up specifically is even though this doesn't generally change a massive amount quickly, it can change over time.
• 1:45
  SPEAKER_00: And you need to keep into consideration what your management of your organization is willing to accept in risk, what their risk tolerance is, how how much they want as a general business as an overall organization, what their business risk acceptance is, and to some degree mirror that.
• 2:03
  SPEAKER_00: I mean, not exactly because you you know there's different considerations when it comes to cybersecurity, but let's take into consideration what the business is generally willing to accept on risk.
• 2:12
  SPEAKER_00: Let's measure those, and then when we go review that, we need to consider whether that environment within our organization has changed, that view is changed to a great extent or to a small extent or whatever, and then kind of reflect that when you're doing your um your risk review, when you're trying to figure out whether or not you're gonna bring some of that back in as a possible risk that you need to mitigate.
• 2:37
  SPEAKER_00: Um, second is and more kind of a tactical thing, is you need to document what those risks are that you accepted before and now are pulling back out because you've got to update your risk assessment and to to reflect those things.
• 2:56
  SPEAKER_00: So like we were willing to accept this before.
• 3:00
  SPEAKER_00: Now this has become maybe we created a new business unit, or we refocused on a particular business unit within our organization, and now there's more revenue coming from that that area or whatever, whatever the situation is that makes you pull that back in and start reviewing it.
• 3:21
  SPEAKER_00: You need to document that and then make sure you update your risk assessment from that point on.
• 3:58
  SPEAKER_00: So you don't keep coming back to that and wonder why we do that.
• 4:00
  SPEAKER_00: Look at the documentation, go, okay, just go ahead and update your risk assessment methodology, and that way you don't have to worry about it.
• 4:06
  SPEAKER_00: And then kind of another thing, and again, there's a lot of best practices and risk review and going back and looking at those things, but make sure that you're um engaging with other teams in those business units, not just cybersecurity, like kind of the not, I mean, you can bring third parties in to help you with this, but make sure you're talking to those individual business units every time too to go through however often you do that.
• 4:34
  SPEAKER_00: You can do it quarterly, annually, semi-annually, whatever that is.
• 4:39
  SPEAKER_00: Again, that comes down to your company's risk tolerance or your organization's risk tolerance.
• 4:42
  SPEAKER_00: But however often you review that, bring in all of those business units to review that because they may have an emphasis of change inside their business unit that you didn't know about.
• 4:54
  SPEAKER_00: Um so you got to make sure that you bring all that together.
• 4:56
  SPEAKER_00: So, anyways, to summarize, when you do risk reviews, you do that periodically, whatever your risk tolerance is, tie that to your company's risk tolerance to a great degree.
• 5:07
  SPEAKER_00: Make sure you document it when you go back and find out that you're gonna bring a risk back in to try to remediate that somehow.
• 5:13
  SPEAKER_00: And make sure you're updating your risk assessment methodology once you do that.
• 5:18
  SPEAKER_00: And then bring in the other business units when you do your business uh your risk reviews to make sure that something hasn't changed within their business unit that you didn't know about.
• 5:28
  SPEAKER_00: Anyway, let me know what you think.
• 5:30
  SPEAKER_00: Talk to you next time.