All Articles

As organizations grapple with escalating risks in the digital realm, the imperative for robust risk management has never been more pressing. In this era of increased scrutiny from regulators and stakeholders, businesses are compelled to demonstrate airtight security postures and transparency in their operations. The emergence of Chief Risk Officers, Privacy Officers, and Third-Party Risk Management programs reflects a paradigm shift in how companies approach risk mitigation.

Here is the verbatim discussion:

Similar to what bees is mentioning the tools that he has in place that reduces the burden on the it organizations it allows them to provide that information to the third- party risk management programs and what I've been seeing across the industry customers vendors are going through a lot more scrutiny so the the the customers have have to show to their uh their the customers have to show that that um sorry the vendors have to have to show to their customers the different uh the different measures that they put in place you can't just do business with other companies nowadays without providing some of that evidence that you have the right security posture in place so anything that can automate that anything that can show that hey we we have continuous uh security scanning on our environment here's our exposure here's our external threat uh threat ATT or to surface and that we've scanned it and we've we've put the appropriate measures in place so that that uh it's one of the big drivers that you're seeing in addition to Regulators is that customer vendor relationship that vendor management uh relationship so onboarding offboarding customers working with other vendors uh that is you need to provide some kind of security before it was a MSA you sign you do business with someone now it's show me that you have a good security posture we can connect to your environment and providing that evidence to all your your your vendors or your customers depending on the relationship is a challenge so I would definitely leverage this ass solution to provide me with that evidence that that we've continuously have that program in place uh risk management so that's the other part I know I stayed at a very philosophical level but it's very hard to go tactical it would probably need days or weeks to build a program for risk management now back to nashin the other thing which you mentioned like uh one thing we would be very happy to uh for anybody in the audience um if you would like we would be happy to offer you a kind of uh free discovery of your attex surface and how does the hackers view of your attack surface look like what kind of exposure you have we would be happy to conduct an assessment and provide you with the results so you will have a kind of good view of how does the attack surface look like are there some unknown unknowns any any surprises if you are on Sand and if you don't go enough depth and figure out a really solid structure whatever you build on top of it it really doesn't matter that might look very strong the um the walls and doors and windows but if the fundamentals are not strong it's going to just collapse and that is something which happens a lot with this kind of risk management models the fundamental assumptions and the fundamental models are not strong enough so unless you really have a very mature process I would say like doing some kind of risk quantification like that is very hard so mature not just process very mature organization where you have really tested out those models and there are a lot of organizations who does it decently well like any any underwriter for insurance they have to build a very strong model otherwise their companies at stake right like they have built certain things but even they know that their assumptions has to be tested over a period of time when you do insurance for people's life life insurance they have data for like 50 60 years or even more for this it's new so but they know the RIS they adequate time so if you do not have very high maturity going that route is not very helpful so that's one thing which I wanted to mention then what is the other way to solve this I think a better way or a easier way in certain ways which could also be more practical and more useful is to look at it from the perspective of adversity go and look at Verizon DB and see what kind of attacks the bad guys are doing which are causing Brees look at from that perspective look at the various threat intelligence data and use that information like my adversary or our adversary are XYZ and they use these kind of techniques and they use this kind of attacks so let me prioritize based on that so definitely you can prioritize your assets that's very that's much easier if you know the assets you can prioritize you know which has got high value.