9 Steps, the Big 8, & 7 Super Bowl Rings! – BSW #205
In the leadership and communications section, 9 Steps for Effective Cybersecurity Risk Management, The Big 8: How to heighten cybersecurity governance, 7 Super Bowl rings for Tom Brady, and more!
Announcements
Don't forget to check out our library of on-demand webcasts & technical trainings at securityweekly.com/ondemand.
We're always looking for great guests for all of the Security Weekly shows! Submit your suggestions by visiting https://securityweekly.com/guests and completing the form!
Hosts
Matt Alderman
Chief Product Officer at CyberSaint
- 1. 9 Steps for Effective Cybersecurity Risk ManagementTo ensure effective cybersecurity risk management, follow this checklist: 1. Understand the organization’s security landscape 2. Identify the gaps 3. Create a team 4. Assign responsibilities 5. Train and upskill employees 6. Implement cyber awareness across departments 7. Implement a risk management framework 8. Develop risk assessment programs 9. Create and maintain a sound incident response and business continuity plan However, don't take all the advice from their next blog, THE NEXT CYBERSECURITY RISK MANAGEMENT MODEL POST THE COVID-19 CRISIS, https://blog.eccouncil.org/the-next-cybersecurity-risk-management-model-post-the-covid-19-crisis/.
- 2. The Big 8: How to heighten cybersecurity governanceBelow are eight steps organizations can implement to heighten cybersecurity governance: 1. Recognize that the worst-case scenario has escalated 2. Empower the CISO to directly report to the CEO 3. Conduct reviews of internal cybersecurity policy 4. Confirm your processes and controls are bulletproof 5. Stay up to date on regulations 6. Allocate at least 10 percent of your IT budget to cybersecurity 7. Develop and regularly update a comprehensive incident response strategy 8. Communicate with customers and suppliers
- 3. Security and privacy laws, regulations, and compliance: The complete guideThis handy directory provides summaries and links to the full text of each security or privacy law and regulation.
- 4. 3 ways to speak the board’s language around cyber riskFraming the cyber risk conversation in ways that resonate with the board will help close the chasm between cyber risk and enterprise objectives. Here are three tips for communicating cyber risk to the board. 1. Understand the board's responsibility 2. Present data in a familiar format 3. Know your benchmarks
- 5. How to translate threats and risk to C-suiteWhen communicating with the C-suite or shareholders, CISOs have to speak equal parts security and bottom line. How security experts derive business value from risk and threat-based analysis can be done by using the "three P's": prediction, prevention and proaction. In doing so, security leaders are able to unpack a business risk to their C-suite and board. Here are two ways CISOs can cut to the chase: 1. In a quarterly report, reserve a single slide for the business risks accumulated during that period in a graphic. 2. Choose relevant information to share, not the full cyber threat intelligence report.
- 6. 12 security career-killers (and how to avoid them)Here are 12 common traits that security leaders say will keep you from advancing your cybersecurity career – and how you can avoid such a fate: 1. Believing security is the end goal 2. Getting stuck 3. Acting like the smartest one in the room 4. Being too timid 5. Losing your cool 6. Talking tech 7. Sticking to yourself 8. Failing to build other skills 9. Staying still 10. Staying in security 11. Mistaking vulnerabilities for risks 12. Being tactical, but not strategic
