One of the original authors of the ESRM framework, now in it's tenth year,  and Caffeinated Risk's first guest returns to discuss how data science is changing security and risk management.  While alchemy may be a bit of a stretch, Ms. Loyear ongoing focus of including human behaviour in the risk equation is leading to the development of data science based detection capabilities that would have appeared magical even 5-10 years ago.

Rachelle Loyear is the Vice President of Integrated Security Solutions for Allied Universal and co-author of The Manager's Guide to Enterprise Security Risk Management.

Threat modeling expert and inventor of one of the world's first attack tree modeling  products talks about how to integrate subject matter expertise into the risk equation, the answer may be surprising.

Bonus content  not included in the original interview with Terry which dove deep into the history of attack trees, modern applications and exploring why there is no AI magic when it comes to identifying events that could end your organization.  Well worth a listen if you missed it.

Factor Analysis of Information Risk (FAIR) and Enterprise Security Risk Management (ESRM) took different evolutionary paths yet share a lot more commonality than catchy 4 letter acronyms and  mainstream adoption by notable organizations like NIST, The Open Group and ASIS international.  Jack Freund personifies the term "risk management thought leader" with professional qualifications and public recognitions too long to list, but co-author of Measuring and Managing Information Risk can't go unmentioned since industry peers inducted this seminal title into the Cybersecurity Cannon.   

With risk management discussions ranging from banking  to defeating door locks, Dr. Freund was consistently insightful, humorous, and a delightful guest.

 In addition to hybrid work and regular time in the office being the new normal, 2023 marks the year Caffeinated Risk's co-host Tim McCreight serves as the president of ASIS international.  ASIS has long been a proponent of both physical and cyber security professionalism and one of the first organizations to explore and embrace Enterprise Security Risk Management (ESRM) as an integral element of security.

Scholarly articles on cyber-physical security convergence started appearing in the late 1990s,  more than 25 years later the convergence buzz has ebbed and flowed but silo's remain. In this episode Tim shares his insights from the past 40 years, the benefits to a converged approach as well as some of the paths toward success. 

Realtors have long advocated  "location, location, location" as a path to investment  success. Fast forwarding  a few generations,  location intelligence applied to risk management is paying dividends well beyond real-estate and Esri is a world leader in this fascinating application  of geo-spatial information.  Esri business solutions leader Alex Martonik shares examples of businesses making improvements to  resilience and the bottom line  by combining  GIS, financial, technological and political data  into risk calculations. Mr. Martonik  also shares Esri's approach to "democratizing risk insights", helping solve the all to common problem of procuring buy-in.    

A great discussion point that didn't make it to air from the original 2021. Not all data is of equal value to the organization and the viable shelf life is seldom tracked or even discussed.

This espresso shot takes a humorous look at a serious question about privacy considerations during the development cycle and check out the original full episode with privacy thought leader Michelle Finneran Dennedy.

Communication isn't effective until the receiver understands the message well enough to take action. That pretty much sums up the challenge facing many risk professionals today, something Paul Mercer resolved, out of necessity, by building  risk management software that is proving to be a welcome solution for many notable customers.

Mr. Mercer is no stranger to the front lines of risk management, starting with the Royal Navy then extensive risk & crisis consulting for international clients. Well known ESRM practitioners are also recognizing the value of Mercer's approach to digital safety and security risk management.

Co-author of the original book on Enterprise Security Risk Management, it only made sense to have Rachelle be the first Caffeinated Risk guest.  Like many guests, there was just too much material for a 30 minute episode. This espresso shot encore digs into that nuanced  topic of truly partnering with business stakeholders. 
 

Anyone with a bit of time in the security industry is well acquainted with Murphy's law but  crisis management specialists are who you call when things suddenly get very real.  While common security guidance advocates protection,  readying your organization to weather the inevitable failure in prevention measures starts with resilience.

international crisis management thought leader  Alexandra Hoffman and 2022 IFSEC Global Influencer and Meta's head of Global Security Protective Intelligence Tim Wenzel  dive deep into what resilience really means at the organizational level.

Security folks are fond of saying "it's not if but when ...", listen in to learn  more about how to prepare your organization for that eventuality from those who have been there with some of the biggest companies in the world. 

Recorded two days after the July 2022  nationwide telecom outage,  co-hosts Tim and Doug explore the deeper ramifications of losing access to the very services that are so tightly integrated into our lifestyle.  While the complete root cause of the Rogers' outage may never be publicly shared, most organizations face similar constraints, leading to a discussion about ethics and our shared commitment to the common good.

Documents referenced in the show:
ACM Code of Ethics
Energy sector asset management