Latest / CYBR.Signal / Risk Communication

Transcript

Risk Communication · CYBR.Signal

• 0:00
  SPEAKER_00: And hello, everybody.
• 0:01
  SPEAKER_00: Happy Cyber Sunday.
• 0:02
  SPEAKER_00: Hope you're doing well.
• 0:03
  SPEAKER_00: So I've been talking about risk assessments a lot lately.
• 0:08
  SPEAKER_00: And it's just because I've been digging into this topic a little bit more.
• 0:11
  SPEAKER_00: So I kind of wanted to continue on that track a little bit.
• 0:14
  SPEAKER_00: So last week I talked about uh the value of risk assessments, the value of a security program, and how you can have implicit and explicit value in those, how your organization can take advantage of that.
• 0:28
  SPEAKER_00: What I kind of want to talk about now is what you do about risk.
• 0:33
  SPEAKER_00: I've talked about kind of the risk assessment methodology a little bit and how you have to go back and review those, um, how you have to know your piece.
• 0:43
  SPEAKER_00: But I kind of want to talk about what you do about the risk, once you find it in a few episodes.
• 0:48
  SPEAKER_00: Some you'll hear the term risk treatment.
• 0:51
  SPEAKER_00: Uh, it's basically what are you doing about the risk once you find it.
• 0:55
  SPEAKER_00: And all of this, you you have to understand.
• 0:59
  SPEAKER_00: I mean, from a if you're a CISO or somebody who's doing, you know, a consultant who's somebody's doing the risk assessment, especially if you're a CISO, a key to all of this is communicating with your business.
• 1:12
  SPEAKER_00: And that's your main role as anybody who's doing this, who has that leadership role within.
• 1:17
  SPEAKER_00: I mean, you don't have to be a CISO, whatever your title is, if you're doing this and you're in charge of that, that tends to be the CISO, especially in large organizations.
• 1:26
  SPEAKER_00: You have to be that main conduit for communicating to the organization on what the risk is, and then what you need to do about it, or what's the recommended methodology for dealing with that risk.
• 1:40
  SPEAKER_00: Now you need to understand that it is not, and to some people this might seem elementary, to other people, it may be eye-opening and earth-shattering, I don't know.
• 1:52
  SPEAKER_00: Um, but the CISO of an organization or whatever that title is of that person who's working in that, they do not own that risk.
• 2:04
  SPEAKER_00: So, in order to determine what needs to be done about that risk, the I'm just gonna use the title CISO just to give it, you know, make it easy.
• 2:16
  SPEAKER_00: The CISO is the person who needs to work with whoever the asset owners are to determine what the risk is and then what to do about it.
• 2:28
  SPEAKER_00: That's really a recommendation by the CISO potentially.
• 2:32
  SPEAKER_00: That is up to the asset owner, the business owner, to determine ultimately what to do about that.
• 2:40
  SPEAKER_00: So it I think it's been a long-held belief, and it's still held in some circles, especially people for people who don't work regularly in cybersecurity, that are just working on the business unit, that the CISO is the one who owns all of that.
• 2:56
  SPEAKER_00: Just like it's been a common kind of a mistake to believe that IT owns all of the assets or the you know, the IT infrastructure and that kind of stuff.
• 3:10
  SPEAKER_00: It is responsibility of cybersecurity to figure out what to do in a lot of those areas or to help give recommendations to mitigate a risk in whatever way that is, it's ultimately up to the business unit leader, asset owner, whoever that person is, to determine what needs to be done about that.
• 3:32
  SPEAKER_00: Now, the part of the problem is you get to that point where you're trying to do a risk assessment.
• 3:36
  SPEAKER_00: And if an organization doesn't have a fairly mature risk assessment uh program put in place or none at all, any kind of security program that's just really not built out, then you may have trouble even figuring out who the asset owner is in the first place.
• 3:52
  SPEAKER_00: So you really have to come into an organization being prepared if you're the first person that's been in there in a CISO role, or if you're not, but maybe the previous role was ineffective for whatever reason, that doesn't necessarily mean the person who was in that role wasn't good at it.
• 4:10
  SPEAKER_00: There just may be cultural issues that you've got to figure out within that organization.
• 4:14
  SPEAKER_00: But you have to determine who the owners of those assets are, who those business unit leaders are in the first place, and then figure out a communication path with them.
• 4:23
  SPEAKER_00: If you don't have that in the first place, then all of the risk treatment that you can talk about all that you want, and you're never gonna get anywhere with it.
• 4:33
  SPEAKER_00: So I wanted to get that out first before I started digging into the other risk treatments.
• 4:39
  SPEAKER_00: Um, that and there's four main ones, and different people look at this different way.
• 4:43
  SPEAKER_00: This is influenced in a lot of ways by ISO, and you can go look that up like 27,005.
• 4:50
  SPEAKER_00: But um, well, you kind of have to pay for that.
• 4:52
  SPEAKER_00: So, but it's kind of influenced that way.
• 4:54
  SPEAKER_00: But I wanted to get that out first is the communication aspect, learning who you need to talk to, and figuring out getting some of that goodwill put in place before you can do any of the risk treatment stuff.
• 5:06
  SPEAKER_00: I'll spend a few um probably four episodes talking about the risk treatment options themselves afterwards, but I wanted to get this out.
• 5:13
  SPEAKER_00: So let me know what you think.
• 5:15
  SPEAKER_00: Talk to you next time.