If you've studied SABSA to foundation level, you may recall how systemic risk navigates the domain model. If a risk materialises in a domain, the impact it has can act on the superdomain causing a risk event to occur there. Ok, simples right? Well Maurice was recently asked if this effect can occur in the opposite dire... more
With hindsight, declaring a risk an unknown unknown is often no more than an admission of a lack of foresight, a lack of imagination. How many risks that are actually realised were really inconceivable in advance? Risk identification is a process that is resource constrained, and reasonably so. But with more time, more... more
The last two years have seen changes that few were prepared for. In the aftermath we can argue whether it was a black swan, grey rhino, or octarine unicorn event but ultimately once the overture is done what matters is your ability to adapt to the new world order. Even if you had a specific plan in place, as such event... more
Is your risk management one-sided, designed to minimise the likelihood and negative impacts of uncertain events. How is the uncertainty of events with positive business impacts managed? Not by the security team or using the same risk management framework, right?Threats and opportunities both rely on uncertainty. Add fa... more
News of business impacts from the realisation of cyber risks is all around us. Many of the largest breaches in recent years have involved one or more suppliers in some way. Few will be unaware of Sunburst/Solorigate, and many will have been directly impacted or know people that have been. But it is not just your direct... more
The desire for privacy is nothing new, but societal expectations have certainly come a long way since the middle ages. Over the last two decades many have seen additional rights enshrined in law. Businesses increasingly face sanctions for not respecting the privacy of those they associate with.Businesses have privacy ... more
The information security field is awash with certifications. To an outsider many job adverts, in what is increasingly a sellers market, are full of impenetrable acronyms. But who do all these certifications serve? Is the content relevant and do they effectively demonstrate knowledge, capability, and desire to learn? Ar... more
Enlightened risk management frameworks say we should manage risks to the business within the risk appetite. But what is the risk appetite? Can anyone in the organisation articulate it beyond vague statements such as “medium risk appetite”, “prudent basis” or “risk adverse basis”? Risk appetite is dynamic, and we need t... more
Do you trust your network? Did you resist the lure of cloud services and network virtualisation, content with your on premise network security, only to suffer from attackers or malware able to move laterally at will? Did you have a perimeter based, network-centric security model when the COVID-19 pandemic hit and reali... more
What threats does your project, or business, face? What opportunities have you identified that you could pursue? What strengths do you have that you can leverage to achieve your goals? What weaknesses might hold you back or cause you to fail? Underlying all of these questions, is your situation and the external factors... more
Does the CISO own all cyber related risks to the business? It depends, but in many businesses that is the default position. Who is responsible for risk identification and analysis; identification, rating and selection of treatment options; and for managing residual risks within the defined risk appetite? Is it the secu... more
In our previous episode we referenced not being in business to be compliant. Of course, that doesn't mean that compliance is never important; in some instances, it is critical to maintaining a licence to operate in an industry or market.Compliance isn’t a mission, a purpose or a goal. Compliance provides some fencepost... more
Ransomware does not appear to have fallen victim to the pandemic. On the contrary, successful attacks appear to have increased and the impacts are escalating too. Hardly a day goes by without news of another ransomware attack on a prominent organisation or further details of a previous attack are shared. Has the massiv... more
In the light of recurring instances of security issues in foundational components of modern IT and software stacks, and the superfast world our businesses are operating in, Maurice and Martin talk about trust. What can it mean to say we trust a vendor or a partner? Can we ever really trust one of the Internet giants? C... more