If you've studied SABSA to foundation level, you may recall how systemic risk navigates the domain model. If a risk materialises in a domain, the impact it has can act on the superdomain causing a risk event to occur there. Ok, simples right? W

Blindsided by an Unknown Unknown

Nov 8th, 2021 36m 30s

With hindsight, declaring a risk an unknown unknown is often no more than an admission of a lack of foresight, a lack of imagination. How many risks that are actually realised were really inconceivable in advance? Risk identification is a proce

The World is in Flux, Are You Ready to Adapt?

Sep 21st, 2021 39m 34s

The last two years have seen changes that few were prepared for. In the aftermath we can argue whether it was a black swan, grey rhino, or octarine unicorn event but ultimately once the overture is done what matters is your ability to adapt to

Risk Management is a Game of Snakes AND Ladders

Jul 2nd, 2021 38m 26s

Is your risk management one-sided, designed to minimise the likelihood and negative impacts of uncertain events. How is the uncertainty of events with positive business impacts managed? Not by the security team or using the same risk management

Supply Chain Risk (with Vincent Thiele)

May 13th, 2021 47m 27s

News of business impacts from the realisation of cyber risks is all around us. Many of the largest breaches in recent years have involved one or more suppliers in some way. Few will be unaware of Sunburst/Solorigate, and many will have been dir

Privacy: Security's New Clothes?

Apr 5th, 2021 39m 38s

The desire for privacy is nothing new, but societal expectations have certainly come a long way since the middle ages. Over the last two decades many have seen additional rights enshrined in law. Businesses increasingly face sanctions for not

Certifications - Value or Vanity

Feb 22nd, 2021 35m 4s

The information security field is awash with certifications. To an outsider many job adverts, in what is increasingly a sellers market, are full of impenetrable acronyms. But who do all these certifications serve? Is the content relevant and do

Risk & Risk Appetite (with Jaco Jacobs)

Dec 21st, 2020 41m 19s

Enlightened risk management frameworks say we should manage risks to the business within the risk appetite. But what is the risk appetite? Can anyone in the organisation articulate it beyond vague statements such as “medium risk appetite”, “pru

Zero Trust - Revolutionary, Evolutionary or Snake Oil? (with Chris Blunt)

Nov 26th, 2020 45m 29s

Do you trust your network? Did you resist the lure of cloud services and network virtualisation, content with your on premise network security, only to suffer from attackers or malware able to move laterally at will? Did you have a perimeter ba

SWOT - Context, Capability, Challenge & Course

Oct 29th, 2020 32m 39s

What threats does your project, or business, face? What opportunities have you identified that you could pursue? What strengths do you have that you can leverage to achieve your goals? What weaknesses might hold you back or cause you to fail? U

Business Risk & Risk Ownership (with Bill Schultz)

Sep 27th, 2020 40m 43s

Does the CISO own all cyber related risks to the business? It depends, but in many businesses that is the default position. Who is responsible for risk identification and analysis; identification, rating and selection of treatment options; and

Compliance

Sep 9th, 2020 29m 51s

In our previous episode we referenced not being in business to be compliant. Of course, that doesn't mean that compliance is never important; in some instances, it is critical to maintaining a licence to operate in an industry or market.Complia

Ransomware

Aug 27th, 2020 46m 43s

Ransomware does not appear to have fallen victim to the pandemic. On the contrary, successful attacks appear to have increased and the impacts are escalating too. Hardly a day goes by without news of another ransomware attack on a prominent org

Trust

Aug 17th, 2020 47m 23s

In the light of recurring instances of security issues in foundational components of modern IT and software stacks, and the superfast world our businesses are operating in, Maurice and Martin talk about trust. What can it mean to say we trust a

Rate