Transcript

Risk Wrap Up · CYBR.Signal

0:00
SPEAKER_00: And hello, everybody.
0:01
SPEAKER_00: Happy Cyber Sunday.
0:02
SPEAKER_00: Hope you're doing well.
0:03
SPEAKER_00: So I am going to wrap up, to maybe some people's delight, the uh risk management, risk assessment conversation series videos that I've been having.
0:13
SPEAKER_00: And I'm going to do that with two main points.
0:17
SPEAKER_00: The first point I want to talk about is choosing the right framework that you're going to use for your risk management.
0:23
SPEAKER_00: So there are several out there.
0:25
SPEAKER_00: Some are industry specific, some are not.
0:29
SPEAKER_00: Some started out kind of more governmental, but a lot of people have adopted adopted them for regular industry risk frameworks.
0:38
SPEAKER_00: That would though that specifically I'm talking about is NIST CSF.
0:42
SPEAKER_00: But you can look at IS ISO 27001 slash two.
0:46
SPEAKER_00: You can look at the CIS top 10 controls.
0:50
SPEAKER_00: There's there's several of them out there.
0:51
SPEAKER_00: Again, you need to you need to look at see which one fits you the best.
0:56
SPEAKER_00: To the point of that some of them are specific to an industry.
1:01
SPEAKER_00: You may need to do multiples.
1:04
SPEAKER_00: Either do multiples or do a mix of them.
1:08
SPEAKER_00: If you've got something that's industry specific, especially if you've got a regulation that you've got to meet certain criteria, you may need to use one specifically and report on that.
1:20
SPEAKER_00: But maybe you use a larger framework like NIST CSF to reach a certain point and then just map all of the controls that are in there back to your specific framework.
1:35
SPEAKER_00: So just something to think about.
1:37
SPEAKER_00: But you generally what you want to do is find something that aligns with your organization.
1:42
SPEAKER_00: I think most of them work.
1:44
SPEAKER_00: NIST CSF happens to be a favorite of mine.
1:46
SPEAKER_00: I like it because it lets you almost do, it's almost like a pseudo-maturity model.
1:54
SPEAKER_00: So instead of doing like a typical secure maturity model that you would do to see, you know, if you're one through four or whatever, one through five, however they rate them.
2:04
SPEAKER_00: Uh NIST CSF has some of that in there as well.
2:07
SPEAKER_00: Uh so it, if you want to do almost like a maturity model type of score, but also using a risk security framework, then you can a risk management framework, then you can uh you can use NIST CSF for that.
2:18
SPEAKER_00: Also, it has a lot of the mappings to other frameworks already included in the um kind of in the appendix.
2:28
SPEAKER_00: So if you've got some other frameworks that you're using and you need to map controls, you can do that.
2:33
SPEAKER_00: But that's you know, that's a matter of opinion.
2:34
SPEAKER_00: You can do whatever you want, whatever works for you.
2:37
SPEAKER_00: Second thing I want to talk about is when you're putting a framework like that into place or whatever you're gonna do in order to do your risk management and control that within your organization, you need to figure out how to track it.
2:50
SPEAKER_00: So, word of caution here is that there are a lot of GRC tools out there, governance risk compliance tools.
2:58
SPEAKER_00: They're gonna help you track controls.
3:02
SPEAKER_00: And generally, most of them are gonna be fairly effective.
3:06
SPEAKER_00: Word of caution is that you need to figure out whether you need a tool like that right out of the gate, or whether you need to just start tracking this stuff, quite frankly, in some kind of spreadsheet and then make the move to that later.
3:24
SPEAKER_00: The reason I say that's a word of caution is because one, if you're a small organization and you're doing risk assessment and risk management, then a lot of times a tool like that's overkill.
3:37
SPEAKER_00: You don't necessarily need something that hefty.
3:40
SPEAKER_00: And what it's gonna end up doing is causing you to kind of slow down on getting the process going because you're trying to figure out how to implement this tool and get all that stuff in place.
3:50
SPEAKER_00: And that's actually a caution no matter what, no matter how large your organization is, because it that you can have all this concentration on the tool instead of trying to get the risk assessment done and get your risk management program in place where you can start tracking those controls.
4:07
SPEAKER_00: So just be cautious of that.
4:09
SPEAKER_00: You might want to start just, I mean, all of those frameworks, you have the ability to export that stuff out.
4:16
SPEAKER_00: They, you know, they have spreadsheets that you can pull it out and you can start tracking those controls right there.
4:20
SPEAKER_00: Uh, just be cautious of just right out of the gate getting a tool and having the wrong focus.
4:26
SPEAKER_00: Not saying you shouldn't.
4:28
SPEAKER_00: Maybe that's where you need to start, but sometimes those tools can just cause you to get distracted.
4:32
SPEAKER_00: So just be wary of that.
4:33
SPEAKER_00: I do think in the long run, the more sophisticated you get, the more you're gonna need a tool like that because it also involves doing third-party tracking and questionnaires and stuff, and a lot of those tools make that actually easier.
4:44
SPEAKER_00: So something to consider.
4:46
SPEAKER_00: So, anyway, so those are my top two things on wrap up.
4:49
SPEAKER_00: Uh, make sure you choose the right framework.
4:51
SPEAKER_00: It might be a mixture of frameworks, you got to figure that out and be cautious of jumping right into a GRC tool.
4:57
SPEAKER_00: Um, but know that they do have some value.
5:00
SPEAKER_00: So, anyway, that's the end of this series.
5:03
SPEAKER_00: Let me know what you think.
5:04
SPEAKER_00: And we'll see you on another suburb Sunday, and I'll be doing a different topic.
5:09
SPEAKER_00: All right.
5:09
SPEAKER_00: Thanks, everybody.
5:10
SPEAKER_00: Talk to you next time.