Archive for the ‘Security Risk Assessment’ Category

Best practices for implementing a company-wide risk analysis program

The associated risk management programs are also constantly evolving, and that’s likely due to outside influences such as client contract requirements, board requests and/or specific security incidents that require security teams to rethink and strengthen their strategy. Not surprisingly, CISO’s today face several dilemmas: How do I define the business impact of a cyber event? How much […]

Leave a Comment

Risk Management Toolkit

“By implementing sound #management of our #risks and the threats and opportunities that flow from them we will be in a stronger position to deliver our organisational objectives, provide improved services to the community, achieve better value for money and demonstrate compliance with the Local Audit and Accounts Regulations. #Riskmanagement will therefore be at the heart of our good management practice […]

Leave a Comment

Why chasing risk assessments will have you chasing your tail

Third-party risk assessments are often described as time-consuming, repetitive, overwhelming, and outdated. Think about it: organizations, on average, have over 5,000 third parties, meaning they may feel the need to conduct over 5,000 risk assessments. In the old school method, that’s 5,000 redundant questionnaires. 5,000 long-winded Excel sheets. No wonder they feel this way. The reason why […]

Leave a Comment

Risk Management document templates

Risk Assessment and Risk Treatment Methodology The purpose of this document is to define the methodology for assessment and treatment of information risks, and to define the acceptable level of risk. The document is optimized for small and medium-sized organizations – we believe that overly complex and lengthy documents are just overkill for you. There […]

Leave a Comment

Top 3 data security risks facing businesses

There are many ways that data security risks can occur, and it is important to be aware of them in order to protect our information. Data security issues, continuous data breaches, and advanced cyber-criminal activity make it harder for businesses to stay updated with the latest strategy to keep their accounts and customer data protected. […]

Comments (1)

How to read a SOC 2 Report

The following conversation about reviewing a SOC 2 report is one to avoid.  Potential Customer: â€śHi Vendor Co., do you have a SOC 2?” Vendor Co. Sales Rep: â€śYes!” Potential Customer: â€śGreat! We can’t wait to start using your service.”  The output of a SOC 2 audit isn’t just a stamp of approval (or disapproval). Even companies that […]

Leave a Comment

Integrating Cybersecurity and Enterprise Risk Management (ERM)

Source: https:// doi.org /10.6028/NIST.IR.8286-draft2 ISO 31000: 2018 Enterprise Risk Management (CERM Academy Series on Enterprise Risk Management)

Leave a Comment

What Is Information Risk Management? Definition & Explanation

Information risk management is the process of identifying the ways an organisation can be affected by a disruptive incident and how it can limit the damage. It encompasses any scenario in which the confidentiality, integrity and availability of data is compromised. As such, it’s not just cyber attacks that you should be worried about. Information […]

Leave a Comment

LOG4SHELL REPORT

VULNERABILITY ASSESSMENT AND MITIGATION Download Log4Shell report – VULNERABILITY ASSESSMENT AND MITIGATION How the role of open-source maintainers could be professionalized, as the maintainer who fixed the log4j zero-day says he works on the project in his spare time — Open Source software runs the Internet, and by extension the economy. This is an undisputed […]

Comments (1)

Governance, Risk Management and Compliance for InfoSec

Manage all your compliance documentation in one place | Access, customize and collaborate whenever, wherever and however you need | Shop toolkits 

Leave a Comment

An Adoption Guide for FAIR

Jack draws on years of experience introducing quantified risk analysis to organizations like yours, to write An Adoption Guide For FAIR. In this free eBook, he’ll show you how to: Lay the foundation for a change in thinking about risk Plan an adoption program that suits your organization’s style. Identify stakeholders and key allies for socialization of FAIR Select and achieve […]

Leave a Comment

CISA releases Insider Risk Mitigation Self-Assessment Tool

The US CISA has released a new tool that allows to assess the level of exposure of organizations to insider threats and devise their own defense plans against such risks. The US Cybersecurity and Infrastructure Security Agency (CISA) has released the Insider Risk Mitigation Self-Assessment Tool, a new tool that allows organizations to assess their level […]

Leave a Comment

Calculating Your Company’s Total Cybersecurity Risk Exposure

In the first part of my blog post I focused on calculating the impact of a cybersecurity breach in relation to a company’s size and industry. In part two, I present an approach to better understand how often a company will experience security breaches. The probability is usually the big unknown. Not particularly helpful is that our […]

Leave a Comment

A leadership guide for mitigating security risks with low code platforms

The lingering question of application code security follows, as stories of security breaches continue to pour, and remote teams across the world adopt low code for faster application delivery. Even as Gartner predicts that 65% of applications will be built using the low-code paradigm by 2024, it is important to understand the security implications that come with […]

Leave a Comment

Risk-based vulnerability management has produced demonstrable results

Risk-based vulnerability management Risk-based vulnerability management doesn’t ask “How do we fix everything?” It merely asks, “What do we actually need to fix?” A series of research reports from the Cyentia Institute have answered that question in a number of ways, finding for example, that attackers are more likely to develop exploits for some vulnerabilities […]

Leave a Comment

Infection Monkey: Open source tool allows zero trust assessment of AWS environments

Guardicore unveiled new zero trust assessment capabilities in Infection Monkey, its open source breach and attack simulation tool. Available immediately, security professionals will now be able to conduct zero trust assessments of AWS environments to help identify the potential gaps in an organization’s AWS security posture that can put data at risk. Infection Monkey helps IT security teams […]

Leave a Comment

Understanding Cyber Risk Quantification – A Four Minute Journey Into Your Future

Cyber Risk Quantification (CRQ) is now viewed as a core pillar of any effective Integrated Risk Management program. This short explainer video walks you through and gives you a glimpse into your future as a top tier cyber risk management organization.  A FAIR Approach

Leave a Comment

Why is financial cyber risk quantification important?

In its 10th annual Risk Barometer, Allianz found that cyber incidents ranked third in a list of the most important global business risks for the upcoming year, coming in second behind risks stemming from the pandemic itself. We can expect cyber incidents to increase in frequency and sophistication as cyber criminals continue to leverage the […]

Leave a Comment

Risk management in the digital world: How different is it?

Prioritizing and communicating risk Last year, the number of active phishing websites increased 350% from January to March alone. Now that employees are connecting to the office from their own remote networks and not through their office’s secure network, the chance of a security breach is higher than ever. While risk managers know this already, securing […]

Leave a Comment

The cyber security risks of working from home

Luke Irwin Organisations have had to overcome countless challenges during the pandemic, but one that has continued to cause headaches is IT security for home workers. A remote workforce comes with myriad dangers, with employees relying on their home networks – and sometimes their own devices – and without the assurance of a member of […]

Leave a Comment