Cybersecurity Risk

Send us Fan Mail

There are many stakeholders in cybersecurity, and it makes sense to outline roles and responsibilities in terms of how each role impacts cyber resiliency.

1. The board of directors
   1. February 21, 2018, SEC guidance requires board oversight in terms of cyber (https://www.sec.gov/rules/interp/2018/33-10459.pdf).
2. Chief Information Security Officer (CISO)
   1. There are two types of CISOs; a governance CISO and an Operational CISO.
3. Data Privacy Officer (DPO)
   1. General Data Protection Regulation (GDPR) requires that organizations process privacy data to have a DPO.
4. Compliance Manager or Officer
   1. This is an individual with the responsibility to ensure the company complies with its outside regulatory obligations and internal policies.
5. Auditors
   1. Auditors are responsible for developing, planning, and executing IT audit programs based on risk assessments.
6. Legal team
   1. The legal team will be involved in cyber when a breach occurs and most likely will review all external communications before they are released to the media or regulatory authorities.

========

• Blog: https://www.execcybered.com/blog
• Training: https://www.execcybered.com/iso27001foundationcourse
• Linkedin: https://www.linkedin.com/company/exceccybered/
• Twitter: https://twitter.com/DrBillSouza
• Instagram: https://www.instagram.com/drbillsouza/

Thanks.

Dr. Bill Souza
CEO | Founder
www.execcybered.com

Send us Fan Mail

The initial public draft of NIST IR 8286D provides comprehensive asset confidentiality and integrity impact analyses to accurately identify and manage asset risk propagation from system to organization and from organization to enterprise, which in turn better informs Enterprise Risk Management deliberations. This document adds expanded BIA protocols to inform risk prioritization and response by quantifying the organizational impact and enterprise consequences of compromised IT Assets.

========

• Blog: https://www.execcybered.com/blog
• Training: https://www.execcybered.com/iso27001foundationcourse
• Linkedin: https://www.linkedin.com/company/exceccybered/
• Twitter: https://twitter.com/DrBillSouza
• Instagram: https://www.instagram.com/drbillsouza/

Thanks.
Dr. Bill Souza
CEO | Founder
www.execcybered.com

Send us Fan Mail

Choosing a Cybersecurity Framework

Three common pitfalls of cybersecurity or risk frameworks:

1. Finding the “perfect” framework. No single framework fits an organization’s risk profile perfectly. Frameworks like ISO 27001, ISO 3100, NIST CSF, NIST RMF, COBIT, and many others. 
2. Using custom frameworks that do not map to regulators or industry standards.
3. Failing to assign a single project leader with appropriate deadlines and resources. 

========

• Blog: https://www.execcybered.com/blog
• Training: https://www.execcybered.com/iso27001foundationcourse
• Linkedin: https://www.linkedin.com/company/exceccybered/
• Twitter: https://twitter.com/DrBillSouza
• Instagram: https://www.instagram.com/drbillsouza/

Thanks.
Dr. Bill Souza
CEO | Founder

Send us Fan Mail

There are several measurements or metrics an organization can put in place to monitor; some of them can be turned into Key Risk Indicators (KRIs) and Key Performance Indicators (KPIs).

========
Training: https://www.execcybered.com/iso27001foundationcourse
Linkedin: https://www.linkedin.com/company/exceccybered/
Twitter: https://twitter.com/DrBillSouza
Instagram: https://www.instagram.com/drbillsouza/

Send us Fan Mail

These 3 steps you can take to perform a risk assessment:

1. Identify and document the scope and assets to be assessed. I suggest starting with your critical assets.
2. Identify and collect your assessment data.
   1. Vulnerability scan (including applications)
   2. Minimum security baseline scan
   3. Access management at the OS and application levels
   4. Standard exceptions against your scoped systems
   5. Security information and event management (SIEM) logging and alerting
3. Analyze and report
   The most important part is the analysis, since quantitative data alone may not provide the correct information.

========

Training: https://www.execcybered.com/iso27001foundationcourse

Linkedin: https://www.linkedin.com/company/exceccybered/

Twitter: https://twitter.com/DrBillSouza

Instagram: https://www.instagram.com/drbillsouza/

Author: Dr. Bill Souza | Jun 28, 2022 

Send us Fan Mail

What to Focus on FIRST
Mission-based cybersecurity

• Systems supporting the mission, vision, and services
• Regulatory systems - PCI, HIPAA, SOX, GDPR

Prioritizing remediation is based on quantifying the three primary financial impacts:

1. Business interruption cost
2. Data exfiltration cost
3. Regulatory cost

===
Blog: https://www.execcybered.com/blog
Training: https://www.execcybered.com/store
Linkedin: https://www.linkedin.com/company/exceccybered/
Twitter: https://twitter.com/DrBillSouza
Instagram: https://www.instagram.com/drbillsouza/

Thanks.
Dr. Bill Souza
CEO | Founder
www.execcybered.com

Send us Fan Mail

There are some simple rules that you can start today to ensure improvements to your cyber risk program.

1. Define the problem
2. Define risk
3. Define critical
4. Identify and inventory critical assets or systems
5. Identify risks

These rules apply to small, medium, and large businesses with corresponding difficulty levels.

Thanks.
Dr. Bill Souza
CEO | Founder
E|CE - Executive Cyber Education
https://www.execcybered.com 

Send us Fan Mail

Today I’ll discuss risk probability and impact and give you some examples to build your own impact and probability table.

• Probability
• Impact

Thanks.
Dr. Bill Souza
CEO/Founder
E|CE - Executive Cyber Education
https://www.execcybered.com 

Send us Fan Mail

Today I’ll touch on the topic of Cyber Risk & Cyber Investment challenges.

• Improving
• Exploits
• Attack paths
• Attacker behavior
• Investment

Thanks.
Dr. Bill Souza
CEO/Founder
E|CE - Executive Cyber Education
https://www.execcybered.com 

Send us Fan Mail

The show today is based on an article titled, “Global utilities lacking basic cybersecurity practices.” Although the article was focused on utilities, the guidance is applicable to every industry, so I will touch on a few recommendations that could be useful to you as well, regardless of industry.

Links mentioned on the show:
Article: Global utilities lacking basic cybersecurity practices says expert (powerengineeringint.com)
Webinar: https://www.execcybered.com/nist-csf-replay

Thanks.
Dr. Bill Souza
CEO/Founder
E|CE - Executive Cyber Education
https://www.execcybered.com