Blog

Today I’ll discuss risk probability and impact and give you some examples to build your own impact and probability table.

• Probability
• Impact

Thanks.
Dr. Bill Souza
CEO/Founder
E|CE - Executive Cyber Education
https://www.execcybered.com 

Five challenges 

First, the objective of improving cybersecurity is vague and broad. Sometimes organizations struggle on how to measure any improvements to their cybersecurity posture or post-investment. What is even worst, it’s that you may be measuring the wrong thing. In 2015, the Global Information Security Workforce Study (GISWS) conducted a survey of more than 14,000 security professionals, of which 1,800 were federal employees. The survey concluded that we are not just getting better, but we are going backward.  

Although it seems pessimistic, it is supported by facts; in 2014, one billion records were compromised the year before the survey, which triggered Forbes magazine to refer to 2014 as “the year of the data breach.” If you jump forward to 2021 and benefit from hindsight, we can confirm that the GISWS survey’s conclusion that we are going...

I read an article the other day titled, “Global utilities lacking basic cybersecurity practices.” Although the article was focused on utilities, the guidance applies to every industry, so I will touch on a few recommendations that could be useful to you as well, regardless of industry.
The article was based on an interview with Rafael Narezzi, Chief Technology Officer at CF Partners. In the webinar, Narezzi urged energy companies to increase investments in cybersecurity and be proactive. In addition to investments, he encouraged companies to make cybersecurity a main driving force of the business.
Let’s reflect on this statement; it says to increase investment in cybersecurity, which would be wise for any organization; however, increasing investment without a strategy would be detrimental to any business, especially small to medium-sized companies. Perhaps I’m taking this statement out of context, and Narezzi’s audience knew what he meant with it, but let...

We are so focused on the threats and the vulnerabilities that allowed a hack to occur that we forget the basics. The protection necessary to prevent or slow down these attacks already exists, and they exist for a long time.

Welcome to the Executive Cyber Education podcast, cyber risk management driving real impact; I am Dr. Bill Souza. As I mentioned in my previous episode, today we will discuss exceptions tracking and expirations.

Exceptions to any cybersecurity policy or standards must be reviewed and approved by management and then tracked for expiration and mitigation. Here are a few elements you should have in your exception record:

• Title (perhaps goes without saying, but just in case)
• Business justification
• Mitigation or remediation plan
• Owner

These elements are the minimum required from the individual entering the exception; everything else will be entered by the cybersecurity department, such as inherent risk, residual risk, expiration date, security control, and who in the organization will be signing/accepting the risk. The rule of thumb is the following:

• Very high or high exceptions not to exceed 12 months (or six months if you have the resources)
• Medium...

As I mentioned in my previous episode, there’s much more to discuss on cybersecurity exceptions, such as the risk they pose to the organization and the hidden dangers of cumulative risk.  

Exceptions to any cybersecurity policy or standards must be reviewed and approved by management, and this will vary by organization; however, a good rule to follow is the basis on residual risk, for example: 

• Very high: Senior Vice President 
• High: Vice President 
• Medium: Director 

• Low/Very low: Senior Manager 

Your organization may have different titles or a three-tier risk level (high, medium, and low) instead of a five-tier level. It is also vital that two individuals sign off on the exception, the requestor’s management, following the same residual risk-based process, and the cybersecurity leadership. The only difference is that the...

If your cybersecurity standards were written to protect the organization, why do you have security exceptions? Today, I will dive into why security exceptions are the norm, discuss the risk they posed, cumulative risk, tracking, expirations, and exception metrics.

Your standard development team writes an excellent standard; it follows all the best practices of the NIST Cybersecurity Framework, the ISO 27001, or any other industry-recognized standards and frameworks, but most of all, it is common sense, right? Anyone working on or with a cybersecurity team in a large organization knows this does not happen! Exceptions happen. The typical exceptions vary; however, the pattern usually falls into three categories:

• First, it comes from projects or any deployments, such as new servers (or replacement/upgrades) or applications.
• Second, and this one is more typical in larger organizations. That is when the corporate office or parent company pushes new security standards to strategic...

Assets Classification

Let us start with why asset classification is so essential; asset classification is the foundation of everything else to come in cybersecurity; it will help your organization, for example, small or large, to better understand, manage, identify, and classify your assets. Here is the challenge, the business will hear, "oh, you want to spend how much, just to know what we have, which you should have known to begin with?" These are tricky questions to answer, as the business sees no value in this effort, it is not making their product or service better, the customer does not see any improvements in service or features, and so on.

However, it will assist your leadership in determining which processes and assets are the most important in assuring critical operations, service delivery, and overall business resilience. This, in turn, indicates where to focus your cybersecurity investments in a world of limited budgets and increasing costs. Now you could...

In this episode, I discuss how to leverage your risk framework to make sound cybersecurity investment decisions. I addressed two critical questions that you will need to know the answers; first, how can you tell your program is doing the right thing? and second, How can you tell you are protecting the organization in a financially healthy way?

Dr. B.
Executive Cyber Education
www.execcybered.com

eBook: https://www.execcybered.com/risk-identification-ebook

In today’s episode, I discussed what questions you as a cybersecurity SME should be asking to drive results. Identifying revenue-generating systems is part of the journey, one of the many challenges you will face it might be in your own department. Here I discussed a few of them and how to approach it. I created an infographic to assist you in this process: https://executive-cyber-education.mykajabi.com/identification-analysis

Listen Here!

Listen on Apple Podcasts