Risk assessment is the process of identifying, estimating, and prioritizing information security risks. Assessing risk requires the careful analysis of threat and vulnerability information to determine the extent to which circumstances or events could adversely impact an organization and the likelihood that such cases or events will occur.

In the NIST 800-30 Guide for Conduction Risk Assessments document, you’ll find much more detailed qualitative, quantitative, and semi-quantitative information, including risk models, assessment approaches, and much more. However, let me make it simple and actionable for you to start today if you want.

These 3 steps you can take to perform a risk assessment:

1. Identify and document the scope and assets to be assessed. I suggest starting with your critical assets.
2. Identify and collect your assessment data.
   1. Vulnerability scan (including applications)
   2. Minimum security baseline scan
   3. Access management at the OS and application levels
   4. Standard...

What to Focus on FIRST Mission-based cybersecurity

• Systems supporting the mission, vision, and services
• Regulatory systems - PCI, HIPAA, SOX, GDPR

Prioritizing remediation is based on quantifying the three primary financial impacts:

1. Business interruption cost
2. Data exfiltration cost
3. Regulatory cost

Linkedin: https://www.linkedin.com/company/exce... 

Twitter: https://twitter.com/DrBillSouza 

Instagram: https://www.instagram.com/drbillsouza/ 

Training: https://www.execcybered.com/store  

Author: Dr. Bill Souza | Jun 27, 2022 

Announcement

I'm excited to announce the long-awaited ISO 27001 Foundation Course has been launched!

The ISO 27001 is popular framework organizations use to establish mature cybersecurity programs. 

---

75% of market capitalization is now driven by intangible assets, according to a 2019 Ponemon study. So, as with any critical asset, it requires protection.

---

https://www.execcybered.com/iso27001foundationcourse

Author: Dr. Bill Souza | Jun 26, 2022 

There are some simple rules that you can start today to ensure improvements to your cyber risk program.

1. Define the problem
2. Define risk
3. Define critical
4. Identify and inventory critical assets or systems
5. Identify risks

These rules apply to small, medium, and large businesses with corresponding difficulty levels.

Author: Dr. Bill Souza | Jun 25, 2022 

From E|CE to YOU!! Happy Father's Day!

Before even discussing cyber risks to the organization, you need to have identified the systems supporting the mission, vision, and services your organization provides (a.k.a. revenue streams).
This step will allow you to establish "value," so when you discuss cyber risks, you'll confidently be able to discern which risks you'll be able to accept, mitigate, or transfer.
The ISO 27001, specifically clause 4.1, starts with you identifying the organization's objectives; NIST Cybersecurity Framework (NIST CSF) starts with ID.AM-1 & ID.AM-2 starts with identifying and inventorying physical devices and software platforms.
Skipping this critical step will only drive your cybersecurity strategy from an operational to a tactical realm, making it difficult to connect your approach (investment and strategy) to what is important to the organization.

Author: Dr. Bill Souza | Jun 11, 2022 

A strong cybersecurity risk management strategy manages uncertainty cost-effectively and efficiently. Risk management identifies risks early and implements mitigation to avoid or mitigate events.

This encourages well-informed decision-making in the context of your goals and has 5 aspects.

-Goals-and-objectives alignment
-Risk-finding
-Risk-response selection
-Risk monitoring
-Reporting hazards


Visit our website to learn more!

#CyberRisk #CyberRiskManagement #RiskManagement #RiskAppetite #Risk #RiskAssessment 

#RiskTolerance #RiskAnalysis #NISTCSF #CyberRisk #AssetManagement

Author: Dr. Bill Souza | Jun 09, 2022 

Cybersecurity has changed more in the last five years than it has in the ten years preceding it. Cyberattacks are constantly changing and evolving, but cybersecurity professionals must have structure and strategy; without structure and a plan, cybersecurity professionals will continue aimlessly in their pursuit of protecting the organizations they serve.

All this change is chaos and disorder, a new form of fear, uncertainty, and doubt (FUD), one, although backed by facts, fails to have direction or a documented strategy.

If it is so difficult for us to document our cyber assets and identify those assets that have an impact on our organization's revenue, how in the world are we going to do anything about the threats we face?

We can’t, it’s that simple. And any CISO call to arms that suggest we can is a stopgap measure, a call to disillusionment and ultimate disaster because our stopgaps are not solutions. 

Fortunately, there are tools to assist us with strategy...

With laws and regulations increasingly requiring organizations to demonstrate that mission or business-critical information systems and IT infrastructures are protected; the challenge becomes, with over 164,000 known vulnerabilities in the Common Vulnerability Exposure (CVE) database and 546 attack patterns, so far identified and documented by Common Attack Patterns Enumeration and Classification (CAPEC), where do you start?

In a study that became known as the “Jam Experiment,” Iyengar and Lepper (2000) were the first to demonstrate the choice overload effect, referring that large choice sets attract people. Still, at the same time, these wide choice sets increase the choice difficulties. As we draw a parallel, cybersecurity professionals face many vulnerabilities (>164,000) and many assets to protect against, leading to unsatisfactory solutions. 

Most guidance offered to Subject Matter Experts (SMEs) or organizations for that matter, lead them to identify the...

President Biden’s Statement on National Cybersecurity

President Biden stated, “If you have not already done so, I urge our private sector partners to harden your cyber defenses immediately by implementing the best practices we have developed together over the last year. You have the power, the capacity, and the responsibility to strengthen the cybersecurity and resilience of the critical services and technologies on which Americans rely.”

However, the real question is, are organizations ready to implement cyber defenses? The basis for this rhetorical question is that with the speed of change, IT transformations, new mandates, and the great resignation, among others, organizations may be challenged to implement cybersecurity strategically. There’s no lack of guidance for Critical Infrastructure or Corporate Infrastructure, with standards and frameworks, such as:

• ISO/IEC 27001
• ISO/IEC 27032 on cybersecurity 
• the multipart ISO/IEC 27033 on network...