Latest / CYBR.Signal / Showing Value in Risk

Transcript

Showing Value in Risk · CYBR.Signal

• 0:00
  SPEAKER_00: And hello, everybody.
• 0:01
  SPEAKER_00: Happy Cyber Sunday.
• 0:02
  SPEAKER_00: Hope you're doing well.
• 0:04
  SPEAKER_00: So I've been talking about a on the last couple of Cyber Sundays.
• 0:08
  SPEAKER_00: I have talked about uh risk and being able to assess risk and being able to deter or go back and look at your risk program and see if you've got accepted risks in there.
• 0:22
  SPEAKER_00: Um, really kind of talking about risk treatment in general.
• 0:25
  SPEAKER_00: Like what do you what do you do with your risk?
• 0:27
  SPEAKER_00: Um and and there's more to it than what I've been talking about.
• 0:30
  SPEAKER_00: I've been trying to stay focused on some things.
• 0:33
  SPEAKER_00: But one of the I think missed points sometimes when it comes to when you're doing a risk assessment for an organization is even though we say it out loud and we talk about it, I think what tends to happen is the value of the risk assessment to the business gets missed.
• 0:56
  SPEAKER_00: So, and then there's kind of two ways of looking at that.
• 0:59
  SPEAKER_00: Um, and I guess kind of the cybersecurity program as a whole and how it adds value to your organization.
• 1:06
  SPEAKER_00: So, from a risk assessment specifically, you're looking at the what you should be doing is looking at the assets of the organization, however you define that, the applications or whatever, basically the business units, that kind of stuff, of where you get the most revenue or where you're going to have the most loss if there's a problem in that area.
• 1:32
  SPEAKER_00: And what you're doing there inherently is providing value to the organization in a way of you're making sure that they don't lose, or you're trying to make sure they don't lose revenue or don't, you know, don't suffer a huge loss within that business unit to the whole business because that is the most valuable business unit, or one of them.
• 2:00
  SPEAKER_00: So, you know, you kind of prioritize those.
• 2:02
  SPEAKER_00: So that in and of itself is providing value to the organization because you are basically just like I said, making sure that the company doesn't suffer a major loss, doesn't suffer revenue loss, those kind of things, or doing the best you can by prioritizing.
• 2:21
  SPEAKER_00: But there's another school of thought, I don't know, it's really another school of thought, but and there's a lot of dependencies on this.
• 2:30
  SPEAKER_00: And and I was um following a Twitter thread with Rob Graham and Matt Johansson about this.
• 2:36
  SPEAKER_00: And basically, the idea is is that can you show that your security program and the risk assessment and putting cybersecurity controls into place?
• 2:51
  SPEAKER_00: Can you show those things can actually help grow revenue for your organization?
• 2:59
  SPEAKER_00: Now, I as long as I've been in cybersecurity, that's a controversial topic.
• 3:05
  SPEAKER_00: Um just like quantitative versus qualitative risk and all of that stuff.
• 3:11
  SPEAKER_00: But I do believe that there are ways of showing your business leaders that, hey, look, if we show that our cybersecurity program is going to increase, increase value and revenue of the organization itself, then that that will get funding for it right there.
• 3:34
  SPEAKER_00: And now the question is, how do you do that?
• 3:36
  SPEAKER_00: Well, a lot of it depends on your organization.
• 3:38
  SPEAKER_00: But if there's a way you can enable, and I've said this for years, um, and and there's again, it a lot of the time depends on your business model, that kind of thing.
• 3:47
  SPEAKER_00: But if you've got salespeople that are out in the field, this is just an example, and you're by default in their package or what they talk about, what they're trained to talk about.
• 3:57
  SPEAKER_00: Hey, look, we've got a strong cybersecurity program.
• 4:01
  SPEAKER_00: We value this as part of the organization.
• 4:05
  SPEAKER_00: We value making sure that your data does not get into the hands of the bad people out there.
• 4:12
  SPEAKER_00: And we're doing our dead level best.
• 4:15
  SPEAKER_00: And, you know, not throwing FUD on your competitors, but basically, if they don't have that in their package or their salespeople aren't talking about that, and you're pulling in a lot of customer data into your organization, to me, that's that's a selling point, and that could increase your revenue.
• 4:32
  SPEAKER_00: Doesn't mean it absolutely will, but hey, why not try this for six months or a year and make this a proven, make this a point that your salespeople use when they go out into the field?
• 4:47
  SPEAKER_00: There's ways of doing that, even with third parties.
• 4:50
  SPEAKER_00: If you've got third parties that, you know, business B2B type of work and they want to use you as a provider and you show by default, and I'm not just talking about here's a SOC 2 type two compliance.
• 5:01
  SPEAKER_00: I mean, really say what we do, what's our security program look like to a level of your placing importance?
• 5:09
  SPEAKER_00: I'm not saying make the salespeople security experts, but there is ways of doing that.
• 5:13
  SPEAKER_00: So basically, all in all, what I'm saying is that you're providing deep you're providing inherent value by doing a risk assessment if you do it right, by prioritizing the right areas of your organization, but you can also prove value from a revenue perspective if you can show how you can increase revenue with having a good cybersecurity program.
• 5:37
  SPEAKER_00: So something to think about.
• 5:39
  SPEAKER_00: Also, again, controversial topic in this world, but hope you got some value out of this.
• 5:43
  SPEAKER_00: Let me know what you think.
• 5:44
  SPEAKER_00: See you next time.