Cybersecurity Risk

Send us Fan Mail

Cyber attacks targetting small businesses that often do not have the resources to defend against devastating attacks like ransomware have grown. As a small business CEO or CIO, you have likely come across outdated security advice that does not help prevent the most common attacks. The security landscape has changed, and your cybersecurity knowledge needs to evolve with it. Here are 5 tips to get you started:

Establish a culture of [cyber] security
Talk about cybersecurity to leadership and staff, communicate cybersecurity program initiatives in your regular communications, and set measurable quarterly cybersecurity goals are just a few examples.

Hire a vCISO or part-time CISO
Due to the ever-changing nature of the cybersecurity threat environment, consider having a part-time CISO (vCISO) on a retainer to assist your organization with all cybersecurity initiatives. A vCISO can lead your staff in developing DRP, IRP, Acceptable Use Policy, Cybersecurity Policy, Remote Access requirements, etc.

Develop and implement an incident response plan (IRP)
An incident response plan (IRP) has different objectives depending on the author; if the authoring source is IT, the IRP will focus on service restoration; however, investigating a cyber incident and potentially a forensic investigation will be a cybersecurity function, where a vCISO could assist your organization.

Perform regular tabletop exercises
Regular simulation exercises, such as tabletop exercises, will condition your team to respond appropriately to incidents.

Support IT Leaders
There are places where the support of a vCISO, CIO, and CEO is critical, especially when a good cybersecurity program will require the help of every staff member in your organization. For example, don’t rely on the IT team to persuade busy employees to use Multi-Factor Authentication (MFA); instead, have your vCISO or CEO make the announcement.

========

Blog: https://www.execcybered.com/blog
Training: https://www.execcybered.com/iso27001foundationcourse
Linkedin: https://www.linkedin.com/company/exceccybered/
Twitter: https://twitter.com/DrBillSouza
Instagram: https://www.instagram.com/drbillsouza/

Thanks.
Dr. Bill Souza
CEO | Founder
www.execcybered.com

Send us Fan Mail

Third-Party Risk Management

The third-party outsourcing trend will continue to grow in the coming years, which places third-party risk as a significant concern for organizations, large or small. Depending on which statistics you read, 39-63% of breaches are caused by third parties. One of the most notorious breaches is the case of Target, where the HVAC vendor’s credential was stolen, resulting in the retailer's breach of 40 million credit and debit card numbers and 70 million records of personal information stolen. 

How you manage this risk vector is the inspiration of several books and articles; however, it will all start in the contract and what you were able to negotiate upfront; then a mixed methodology assessment, where you use qualitative and quantitative elements to assess the vendor based on industry-accepted standards, such as NIST CSF or ISO 27001. 

I would use caution in leveraging Service Organization Control (SOC) 2 reports; these reports vary by organization and may not cover all cybersecurity controls you may be looking for. 

Once the assessment is complete, work with the vendor to mitigate any findings; if not possible, enter the findings in your cybersecurity standard exception program or a vendor exception program. 

It will be the responsibility of the business to accept or reject the amount of risk proposed by this third-party vendor relationship. 

========

Blog: https://www.execcybered.com/blog
Training: https://www.execcybered.com/iso27001foundationcourse
Linkedin: https://www.linkedin.com/company/exceccybered/
Twitter: https://twitter.com/DrBillSouza
Instagram: https://www.instagram.com/drbillsouza/

Thanks.
Dr. Bill Souza
CEO | Founder
www.execcybered.com

Send us Fan Mail

Chasing Perfection

Pursuing perfection takes a lot of resources, financially and people. In Cybersecurity risk management, there are two key questions: 

• When will enough be enough? 
• What is the correct amount of time and effort should your organization spend to achieve a reasonable level of cybersecurity against an attacker?

The answer to these questions will be your risk tolerance. Chasing perfection has challenges and may not get you where you want to be. Chasing perfection may also risk missing the big picture, leaving security gaps in other areas of your organization, and burning out your staff.

A holistic and mission-driven approach to cybersecurity, with reasonable and measurable goals, will help secure your organization. To get you started, keep in mind three questions:

1. What are your organization’s cybersecurity risks?
2. How are you managing the organization’s cybersecurity risks?
3. How are you measuring your cybersecurity risk reduction?

========

• Blog: https://www.execcybered.com/blog
• Training: https://www.execcybered.com/iso27001foundationcourse
• Linkedin: https://www.linkedin.com/company/exceccybered/
• Twitter: https://twitter.com/DrBillSouza
• Instagram: https://www.instagram.com/drbillsouza/

Thanks.

Dr. Bill Souza
CEO | Founder
www.execcybered.com

Send us Fan Mail

Amid a global financial crisis and potentially facing cybersecurity budget challenges, you are now facing a tough decision; how to do more with less. What if I told you that you can; change the focus of your cybersecurity risk management program from a threat/vulnerability-centric focus to a mission-centric focus. Using the same people, processes, and technologies you have but targeting critical systems in your organization.

This change in strategy will allow your cybersecurity organization to provide valuable services by redirecting the same resources to a mission-centric approach, hence, innovating your cybersecurity strategy while being a good steward of your financial resources.

========

• Blog: https://www.execcybered.com/blog
• Training: https://www.execcybered.com/iso27001foundationcourse
• Linkedin: https://www.linkedin.com/company/exceccybered/
• Twitter: https://twitter.com/DrBillSouza
• Instagram: https://www.instagram.com/drbillsouza/

Thanks.

Dr. Bill Souza
CEO | Founder
www.execcybered.com

Send us Fan Mail

Rules for Effective Cybersecurity Metrics

First, you must establish agreement among your leadership on the actual risk(s) to measure, then select which data will provide the most accurate representation of the risk.

The following are 5 fundamental rules for measuring cybersecurity risk:

1. Select informative measures with actionable value to leadership
2. Research other subject matter experts have done and worked
3. Keep the math simple and clear
4. Develop a standard reporting format and reporting governance
5. Keep consistent and allow your measures and metrics to mature over time

Bonus rule: Gain buy-in from your stakeholders.

========

• Blog: https://www.execcybered.com/blog
• Training: https://www.execcybered.com/iso27001foundationcourse
• Linkedin: https://www.linkedin.com/company/exceccybered/
• Twitter: https://twitter.com/DrBillSouza
• Instagram: https://www.instagram.com/drbillsouza/

Thanks.

Dr. Bill Souza
CEO | Founder
www.execcybered.com

Send us Fan Mail

Mission Centric Risk Assessment

In a mission-based risk assessment, the question is, how do you perform one? 

A four-layer approach will be a good start: 

1. Mission layer
2. Operational layer
3. Application layer
4. Infrastructure layer

========

Blog: https://www.execcybered.com/blog
Training: https://www.execcybered.com/iso27001foundationcourse
Linkedin: https://www.linkedin.com/company/exceccybered/
Twitter: https://twitter.com/DrBillSouza
Instagram: https://www.instagram.com/drbillsouza/

Thanks.

Dr. Bill Souza
CEO | Founder
www.execcybered.com

Send us Fan Mail

When measuring risk in your organization, you’ll typically discover two challenges: First, top key risk measures that do not have supporting data (aspirational). Second, you’ll be developing middle to low measures with supporting data that do not entirely address the risk. 

The lack of data to calculate a particular measure is no reason not to measure the risk; these are your aspirational measures; setting an organizational ambition or goal for your cybersecurity program to report over time is a good strategy; allow your cybersecurity program mature.

To calculate the percentage of assets identified as critical will require two data points, first, the total number of assets, and second, the total number of critical assets; if you don’t have these numbers, you can start by collecting secondary data and establishing secondary measures that will drive towards the aspirational goal of calculating the percentage of assets identified as critical.

========

• Blog: https://www.execcybered.com/blog
• Training: https://www.execcybered.com/iso27001foundationcourse
• Linkedin: https://www.linkedin.com/company/exceccybered/
• Twitter: https://twitter.com/DrBillSouza
• Instagram: https://www.instagram.com/drbillsouza/

Thanks.

Dr. Bill Souza
CEO | Founder
www.execcybered.com

Send us Fan Mail

Cybersecurity Report Framework to the Board of Directors

There is a three-point framework to keep in mind when preparing a report to the Board, especially if you are a small to medium-size business with annual revenue between $100M to $700M with [potentially] no CISO in your organization.

1. What are key risks the Board should be aware of at a high level? What should they be offered a deeper understanding of?
2. How do these risks align with the organization's strategic initiatives?
3. What is your opinion? What do you recommend? - A solution.

One key factor to remember is to be prepared to answer how your organization compares to others in the industry. I suggest discussing with other organizations in the same industry and of similar size.

========

• Blog: https://www.execcybered.com/blog
• Training: https://www.execcybered.com/iso27001foundationcourse
• Linkedin: https://www.linkedin.com/company/exceccybered/
• Twitter: https://twitter.com/DrBillSouza
• Instagram: https://www.instagram.com/drbillsouza/

Thanks.

Dr. Bill Souza
CEO | Founder
www.execcybered.com

Send us Fan Mail

How do you understand a digital asset's business value?

First, let’s define what a digital asset is; a digital asset is a system, process, data, and technology that is used. A cyber event could affect one or more of these digital assets, resulting in a loss for the business.

These digital assets have a hierarchical relationship:

• Organization
  • Function
• Business Unit
  • Own & Use
• Business Process
  • Own & Use
• System
  • Supports
• Technology 
  • Process & Store
• Data Type

Understanding this hierarchy in your organization will lead you to the critical systems in your organization. 

========

• Blog: https://www.execcybered.com/blog
• Training: https://www.execcybered.com/iso27001foundationcourse
• Linkedin: https://www.linkedin.com/company/exceccybered/
• Twitter: https://twitter.com/DrBillSouza
• Instagram: https://www.instagram.com/drbillsouza/

Thanks.

Dr. Bill Souza
CEO | Founder
www.execcybered.com

Send us Fan Mail

NIST has developed a cybersecurity risk management framework that addresses the issue as a comprehensive process that requires organizations to:

1. Frame risk
2. Assess the vulnerabilities
3. Respond to risk once determined
4. Monitor risk on an ongoing basis

These four pillars must be addressed by all small and midsize businesses. A small and midsize business (SMB) is a business that, due to its size, has different IT requirements — and often faces different IT challenges — than do large enterprises, and whose IT resources (usually budget and staff) are often highly constrained.

========

• Blog: https://www.execcybered.com/blog
• Training: https://www.execcybered.com/iso27001foundationcourse
• Linkedin: https://www.linkedin.com/company/exceccybered/
• Twitter: https://twitter.com/DrBillSouza
• Instagram: https://www.instagram.com/drbillsouza/ 

Dr. Bill Souza
CEO | Founder
www.execcybered.com