WEBVTT

1
00:00:00.000 --> 00:00:03.879
<v Speaker 1>All right, So this stack of security management stuff you sent,

2
00:00:04.440 --> 00:00:08.400
<v Speaker 1>it's uh, we're going through excerpts from the official is

3
00:00:08.640 --> 00:00:14.279
<v Speaker 1>C two Guide to the eec IS smp CBK, which

4
00:00:14.839 --> 00:00:16.760
<v Speaker 1>I mean, this thing's huge.

5
00:00:17.039 --> 00:00:19.559
<v Speaker 2>Yeah, it's a dense, a lot, it's a lot, It's

6
00:00:19.559 --> 00:00:20.359
<v Speaker 2>packed with information.

7
00:00:20.399 --> 00:00:23.039
<v Speaker 1>It's the ultimate guide for security pros it really is.

8
00:00:23.120 --> 00:00:26.239
<v Speaker 2>Yeah. Our mission today is to kind of go through

9
00:00:26.280 --> 00:00:29.399
<v Speaker 2>this and extract the gold. Okay, you know, like the

10
00:00:29.480 --> 00:00:30.399
<v Speaker 2>actionable insights.

11
00:00:30.440 --> 00:00:32.399
<v Speaker 1>Okay, so like, how do we you can actually use

12
00:00:32.520 --> 00:00:34.119
<v Speaker 1>how do we make this? Yeah, how do we make

13
00:00:34.119 --> 00:00:36.600
<v Speaker 1>this applicable to what people are doing out there?

14
00:00:36.759 --> 00:00:37.200
<v Speaker 2>Exactly?

15
00:00:37.600 --> 00:00:40.280
<v Speaker 1>So we're aiming to give everyone a framework for not

16
00:00:40.359 --> 00:00:42.719
<v Speaker 1>just understanding security, but really living it.

17
00:00:42.799 --> 00:00:45.000
<v Speaker 2>Absolutely. By the end of this, we're going to be

18
00:00:45.079 --> 00:00:50.439
<v Speaker 2>covering how to build a really robust security framework, how

19
00:00:50.479 --> 00:00:54.159
<v Speaker 2>to proactively spot those weaknesses okay before they become like

20
00:00:54.240 --> 00:00:57.920
<v Speaker 2>big problems, and then also navigate the complex world of

21
00:00:57.960 --> 00:01:00.560
<v Speaker 2>compliance and incident response.

22
00:01:00.759 --> 00:01:04.040
<v Speaker 1>Okay, So let's unback this starting with the foundation security

23
00:01:04.079 --> 00:01:08.079
<v Speaker 1>leadership and management. I mean, why is this even important?

24
00:01:08.319 --> 00:01:08.480
<v Speaker 2>Sure?

25
00:01:08.519 --> 00:01:12.159
<v Speaker 1>Does it really matter if like the CEO understands firewalls?

26
00:01:12.599 --> 00:01:16.120
<v Speaker 2>It matters more than you think Okay, because you see

27
00:01:16.480 --> 00:01:20.560
<v Speaker 2>senior management, they set the tone for the entire organization,

28
00:01:21.879 --> 00:01:28.480
<v Speaker 2>so their understanding of risk it directly influences like budget decisions,

29
00:01:28.959 --> 00:01:33.159
<v Speaker 2>resource allocation, and even like the overall culture of security awareness.

30
00:01:33.400 --> 00:01:36.200
<v Speaker 1>So it's like a company can have all the latest

31
00:01:36.400 --> 00:01:39.359
<v Speaker 1>security tech, but if the leaders don't get the why

32
00:01:39.560 --> 00:01:40.719
<v Speaker 1>behind it, it's all.

33
00:01:40.640 --> 00:01:43.000
<v Speaker 2>For show exactly. It's just checking a box at that point.

34
00:01:43.040 --> 00:01:43.319
<v Speaker 1>Okay.

35
00:01:44.480 --> 00:01:47.879
<v Speaker 2>A really great example is the Department of Homeland Security.

36
00:01:47.959 --> 00:01:51.920
<v Speaker 2>If you look at their mission statement, it actually explicitly

37
00:01:51.959 --> 00:01:56.120
<v Speaker 2>includes safeguarding cyberspace. Wow, so it's not just an IT

38
00:01:56.480 --> 00:01:58.640
<v Speaker 2>thing for them. It's like, yeah, it's part breaked into

39
00:01:58.680 --> 00:02:00.519
<v Speaker 2>their Yeah, it's like baked into their purpose.

40
00:02:00.959 --> 00:02:04.359
<v Speaker 1>Okay, that makes sense for a government agency. But why

41
00:02:04.359 --> 00:02:07.359
<v Speaker 1>should a regular business, Like, why should they care about

42
00:02:07.400 --> 00:02:08.919
<v Speaker 1>this high level buy in?

43
00:02:09.759 --> 00:02:13.319
<v Speaker 2>Because a security breach can have a really devastating impact

44
00:02:13.400 --> 00:02:18.360
<v Speaker 2>on any business. Okay, imagine the financial costs of downtime,

45
00:02:19.479 --> 00:02:23.120
<v Speaker 2>the hit to your reputation, the legal ramifications.

46
00:02:23.319 --> 00:02:25.120
<v Speaker 1>Yeah, it's a nightmare.

47
00:02:25.199 --> 00:02:27.360
<v Speaker 2>Yeah, a total nightmare that you want to avoid. Right.

48
00:02:27.400 --> 00:02:30.479
<v Speaker 1>Prevention is key, But you know, I think a lot

49
00:02:30.520 --> 00:02:33.319
<v Speaker 1>of people think of security as mostly an it department issue.

50
00:02:33.400 --> 00:02:35.639
<v Speaker 2>Yeah, and while it is definitely at the forefront of

51
00:02:35.680 --> 00:02:39.879
<v Speaker 2>a lot of these things, effective security leadership involves way

52
00:02:39.919 --> 00:02:44.840
<v Speaker 2>more than just technical expertise. Okay, the soft skills they're

53
00:02:44.879 --> 00:02:46.000
<v Speaker 2>actually just as critical.

54
00:02:46.280 --> 00:02:48.639
<v Speaker 1>Okay, I like that, So let's unpack that. Sure, what

55
00:02:48.719 --> 00:02:50.240
<v Speaker 1>kind of soft skills are we talking about?

56
00:02:50.319 --> 00:02:56.360
<v Speaker 2>So think about things like really understanding business processes, assigning

57
00:02:56.479 --> 00:02:59.240
<v Speaker 2>roles and responsibilities appropriately.

58
00:02:59.520 --> 00:02:59.840
<v Speaker 1>Okay.

59
00:03:00.439 --> 00:03:04.199
<v Speaker 2>And then also this is a big one, communicating risk

60
00:03:04.919 --> 00:03:10.199
<v Speaker 2>in a way that people who aren't technical can grasp.

61
00:03:10.319 --> 00:03:15.759
<v Speaker 1>Okay, So like communication, collaboration, big picture thinking.

62
00:03:15.719 --> 00:03:16.240
<v Speaker 2>Big time.

63
00:03:16.520 --> 00:03:20.080
<v Speaker 1>It's almost like it's almost like being a security leader

64
00:03:20.120 --> 00:03:21.199
<v Speaker 1>is a management role.

65
00:03:21.599 --> 00:03:24.919
<v Speaker 2>It absolutely is a management role. You know, you can

66
00:03:24.960 --> 00:03:27.639
<v Speaker 2>have the most advanced technology in the world, but if

67
00:03:27.719 --> 00:03:33.599
<v Speaker 2>your employees don't understand the why behind security protocols, it's

68
00:03:33.639 --> 00:03:34.680
<v Speaker 2>all for nothing.

69
00:03:34.599 --> 00:03:37.039
<v Speaker 1>Right, Because a chain is only as strong as its

70
00:03:37.080 --> 00:03:40.280
<v Speaker 1>weakest link, exactly, and sometimes that weakest link is human.

71
00:03:40.639 --> 00:03:43.800
<v Speaker 2>Unfortunately, that's very often the case. So you need to

72
00:03:43.879 --> 00:03:47.639
<v Speaker 2>build like a culture of security awareness that really does

73
00:03:47.680 --> 00:03:49.159
<v Speaker 2>permeate the entire organization.

74
00:03:49.280 --> 00:03:52.319
<v Speaker 1>Okay, So strong leadership sets the stage. Now, how do

75
00:03:52.360 --> 00:03:56.080
<v Speaker 1>we actually translate that into a rock solid security structure, right,

76
00:03:56.479 --> 00:03:57.719
<v Speaker 1>what are the building blocks?

77
00:03:57.719 --> 00:04:00.599
<v Speaker 2>Okay? So that's where security life cycle managed comes in

78
00:04:00.919 --> 00:04:05.879
<v Speaker 2>and staler alert. It's not just for software development anymore.

79
00:04:05.919 --> 00:04:08.840
<v Speaker 2>Wait really yeah? Oh okay, So think of it like

80
00:04:08.960 --> 00:04:13.759
<v Speaker 2>building a house. You wouldn't start construction without a blueprint, right. Well,

81
00:04:13.800 --> 00:04:18.560
<v Speaker 2>you shouldn't launch any project without considering security at every

82
00:04:18.600 --> 00:04:22.160
<v Speaker 2>single stage, from the initial planning phase all the way

83
00:04:22.160 --> 00:04:24.079
<v Speaker 2>to deployment okay and beyond.

84
00:04:24.160 --> 00:04:26.639
<v Speaker 1>So it's not just about like checking off boxes on

85
00:04:26.680 --> 00:04:30.680
<v Speaker 1>a checklist, it's about baking security into like the DNA

86
00:04:30.879 --> 00:04:32.720
<v Speaker 1>of every project from the get go.

87
00:04:32.720 --> 00:04:36.160
<v Speaker 2>One hundred percent okay. And this is especially important when

88
00:04:36.160 --> 00:04:37.720
<v Speaker 2>you're dealing with prototypes.

89
00:04:38.079 --> 00:04:41.319
<v Speaker 1>Ah. Prototypes, Yes, fun, always exciting, yeah.

90
00:04:41.319 --> 00:04:45.319
<v Speaker 2>Buggy, a little buggy, right, and often insecure because prototypes

91
00:04:45.439 --> 00:04:49.879
<v Speaker 2>they're typically built for speed and functionality, not necessarily security. Okay.

92
00:04:50.279 --> 00:04:52.519
<v Speaker 2>So that can create a lot of risks if you're

93
00:04:52.519 --> 00:04:53.079
<v Speaker 2>not careful.

94
00:04:53.120 --> 00:04:56.160
<v Speaker 1>So how do you balance that need to move quickly

95
00:04:56.680 --> 00:04:59.120
<v Speaker 1>with need to protect sensitive data?

96
00:05:01.000 --> 00:05:05.079
<v Speaker 2>You need to be acutely aware of the risks that

97
00:05:05.160 --> 00:05:08.399
<v Speaker 2>are involved in prototype, and then you need to from

98
00:05:08.439 --> 00:05:13.920
<v Speaker 2>the very beginning implement safeguards. Okay, So like strong access controls,

99
00:05:14.319 --> 00:05:18.680
<v Speaker 2>data encryption, regular security assessments, like you need to treat

100
00:05:18.759 --> 00:05:22.000
<v Speaker 2>that prototype with the same level of security that you

101
00:05:22.040 --> 00:05:22.959
<v Speaker 2>would a live system.

102
00:05:23.040 --> 00:05:26.160
<v Speaker 1>Okay, that makes sense because I mean a data breach

103
00:05:26.279 --> 00:05:29.759
<v Speaker 1>during the prototype phase could be just as damaging as

104
00:05:29.800 --> 00:05:31.079
<v Speaker 1>a breach and a finished product.

105
00:05:31.279 --> 00:05:31.439
<v Speaker 2>Yeah.

106
00:05:31.600 --> 00:05:36.560
<v Speaker 1>Sure, But you know, how do we future proof security?

107
00:05:36.879 --> 00:05:37.079
<v Speaker 2>Yeah?

108
00:05:37.160 --> 00:05:39.560
<v Speaker 1>I mean technology changes so quickly it does.

109
00:05:39.600 --> 00:05:42.199
<v Speaker 2>It changes so fast it does, and that's where it

110
00:05:42.199 --> 00:05:50.360
<v Speaker 2>becomes really critical to understand how those emerging technologies impact security. Okay,

111
00:05:50.480 --> 00:05:54.800
<v Speaker 2>So like cloud computing, virtualization, these things, they bring a

112
00:05:54.800 --> 00:05:57.120
<v Speaker 2>lot of great opportunities I do, but they also bring

113
00:05:57.160 --> 00:05:59.079
<v Speaker 2>new vulnerabilities.

114
00:05:58.480 --> 00:06:01.879
<v Speaker 1>Right, because with new technology comes new ways to exploit

115
00:06:01.920 --> 00:06:05.519
<v Speaker 1>it exactly. So we need to be proactive, not reactive, one.

116
00:06:05.439 --> 00:06:08.240
<v Speaker 2>Hundred percent before you jump on the bandwagon of the

117
00:06:08.560 --> 00:06:11.720
<v Speaker 2>latest tech trend. Yeah, you need to really thoroughly assess

118
00:06:12.240 --> 00:06:16.120
<v Speaker 2>the security implications. And it's a continuous learning curve in

119
00:06:16.160 --> 00:06:16.639
<v Speaker 2>this field.

120
00:06:16.720 --> 00:06:19.959
<v Speaker 1>Okay, I'm already seeing that security management is way more

121
00:06:20.000 --> 00:06:23.000
<v Speaker 1>than just an IT issue. This is a company wide

122
00:06:23.120 --> 00:06:26.279
<v Speaker 1>it is endeavor. Okay. And speaking of company wide endeavors,

123
00:06:26.319 --> 00:06:28.040
<v Speaker 1>let's talk about compliance.

124
00:06:28.240 --> 00:06:28.399
<v Speaker 2>Right.

125
00:06:28.439 --> 00:06:32.439
<v Speaker 1>Compliance the word that strikes fear into the hearts.

126
00:06:32.160 --> 00:06:34.079
<v Speaker 2>Of many A lot of people don't like that word.

127
00:06:34.279 --> 00:06:36.319
<v Speaker 1>But honestly, where do we even begin with that?

128
00:06:36.519 --> 00:06:39.879
<v Speaker 2>Okay? Let let's kind of demystify compliance a little bit.

129
00:06:39.920 --> 00:06:40.199
<v Speaker 1>Okay.

130
00:06:40.600 --> 00:06:44.079
<v Speaker 2>You mentioned nissed SP eight hundred and fifty three, which

131
00:06:44.120 --> 00:06:47.319
<v Speaker 2>is a fantastic framework. Okay, especially if you're operating in

132
00:06:47.360 --> 00:06:49.920
<v Speaker 2>the US. Okay, but remember it's not the only game

133
00:06:49.959 --> 00:06:50.319
<v Speaker 2>in town.

134
00:06:50.519 --> 00:06:52.920
<v Speaker 1>So there are other options out there. Oh absolutely, Yeah,

135
00:06:52.959 --> 00:06:53.759
<v Speaker 1>what are some examples?

136
00:06:54.040 --> 00:06:57.480
<v Speaker 2>So, for instance, there's ISO twenty seven zero two point

137
00:06:57.480 --> 00:07:00.199
<v Speaker 2>two zero one team okay, which offers more more of

138
00:07:00.240 --> 00:07:04.600
<v Speaker 2>a global perspective, and it provides guidelines for implementing and

139
00:07:04.720 --> 00:07:07.680
<v Speaker 2>maintaining information security management systems.

140
00:07:07.759 --> 00:07:12.639
<v Speaker 1>Gotcha. Okay, So we've got these frameworks, but honestly, I'm

141
00:07:12.680 --> 00:07:14.959
<v Speaker 1>looking at them. They feel pretty dense.

142
00:07:15.439 --> 00:07:18.720
<v Speaker 2>Yeah, they can be a bit overwhelming. Yeah, and overwhelming

143
00:07:18.879 --> 00:07:19.319
<v Speaker 2>for sure.

144
00:07:19.399 --> 00:07:21.240
<v Speaker 1>So how do we actually use them in like a

145
00:07:21.319 --> 00:07:22.240
<v Speaker 1>practical way.

146
00:07:22.680 --> 00:07:25.680
<v Speaker 2>Think of them as blueprints, not like rigid rule books.

147
00:07:26.319 --> 00:07:30.519
<v Speaker 2>You can leverage these external frameworks to actually create your

148
00:07:30.600 --> 00:07:37.439
<v Speaker 2>own internal standard guidelines, procedures, ones that actually align with

149
00:07:37.519 --> 00:07:40.959
<v Speaker 2>your organization's specific needs and risk profile.

150
00:07:41.120 --> 00:07:43.680
<v Speaker 1>So it's kind of like taking inspiration from a recipe

151
00:07:43.720 --> 00:07:45.759
<v Speaker 1>but adapting it exactly to your own taste.

152
00:07:45.800 --> 00:07:47.920
<v Speaker 2>That's a great way to put it. Yeah, the key

153
00:07:48.439 --> 00:07:52.519
<v Speaker 2>is to understand the underlying principles of these frameworks and

154
00:07:52.560 --> 00:07:55.720
<v Speaker 2>then tailor them to fit your unique operational context.

155
00:07:56.319 --> 00:07:59.240
<v Speaker 1>Okay, that makes sense. Nobody wants to surprise audit.

156
00:08:00.240 --> 00:08:01.399
<v Speaker 2>He likes the surprise audit.

157
00:08:01.560 --> 00:08:04.439
<v Speaker 1>No, how can we proactively prepare for those?

158
00:08:05.120 --> 00:08:08.680
<v Speaker 2>Yeah, So audits can definitely be nerve wracking, but if

159
00:08:08.720 --> 00:08:11.800
<v Speaker 2>you understand what auditors are looking for, it becomes way

160
00:08:11.879 --> 00:08:17.079
<v Speaker 2>less daunting. Okay, So they're primarily looking for evidence that

161
00:08:17.160 --> 00:08:23.000
<v Speaker 2>you're following establish best practices and meeting those compliance requirements.

162
00:08:23.480 --> 00:08:28.120
<v Speaker 2>So having things like really clearly documented policies, conducting regular

163
00:08:28.160 --> 00:08:34.919
<v Speaker 2>security assessments, implementing a solid vulnerability management program, those are

164
00:08:34.960 --> 00:08:36.519
<v Speaker 2>all like key pieces of the puzzle.

165
00:08:36.639 --> 00:08:40.519
<v Speaker 1>Yeah, and don't forget about like those annual contingency plan exercises.

166
00:08:40.519 --> 00:08:44.039
<v Speaker 2>Those are always oh yeah, fun, those are crucial demonstrated

167
00:08:44.120 --> 00:08:44.360
<v Speaker 2>to make.

168
00:08:44.320 --> 00:08:46.279
<v Speaker 1>Sure that your plans are more than just words on

169
00:08:46.360 --> 00:08:49.720
<v Speaker 1>paper exactly. Yeah, oh yeah, those exercises not exactly my

170
00:08:49.720 --> 00:08:52.039
<v Speaker 1>favorite part of the job, but I get why they're important.

171
00:08:52.120 --> 00:08:56.159
<v Speaker 2>They're not the most exciting thing in the world. But yeah,

172
00:08:56.360 --> 00:09:00.200
<v Speaker 2>you know, the type of exercise you conduct should really

173
00:09:00.240 --> 00:09:03.120
<v Speaker 2>align with the impact level of the systems that you're

174
00:09:03.120 --> 00:09:06.600
<v Speaker 2>trying to protect, right, Okay, So for low impact systems, ye,

175
00:09:06.840 --> 00:09:10.320
<v Speaker 2>like a tabletop exercise might be enough, but for high

176
00:09:10.399 --> 00:09:14.120
<v Speaker 2>impact like mission critical systems, you need to be doing

177
00:09:14.519 --> 00:09:19.399
<v Speaker 2>more comprehensive, like full scale deployment exercise.

178
00:09:19.840 --> 00:09:23.399
<v Speaker 1>So it's all about aligning, like the intensity of your testing, yes,

179
00:09:23.440 --> 00:09:26.799
<v Speaker 1>with the potential consequences of a failure exactly.

180
00:09:26.879 --> 00:09:30.679
<v Speaker 2>Okay, And here's a pro tip, use those test results, Yeah,

181
00:09:30.720 --> 00:09:36.000
<v Speaker 2>to continuously improve your preparedness. Every single exercise is a

182
00:09:36.120 --> 00:09:39.039
<v Speaker 2>chance to learn and refine your processes.

183
00:09:39.120 --> 00:09:43.519
<v Speaker 1>So it's a cycle of like plan, test, adjust, repeat,

184
00:09:44.519 --> 00:09:45.440
<v Speaker 1>Never let those.

185
00:09:45.279 --> 00:09:46.919
<v Speaker 2>Plans, never let them get stale.

186
00:09:46.960 --> 00:09:48.120
<v Speaker 1>It's at stale. Yeah.

187
00:09:48.200 --> 00:09:51.919
<v Speaker 2>Security is a very dynamic process. It requires constant vigilance

188
00:09:51.919 --> 00:09:55.080
<v Speaker 2>and adit patient. And remember it's not just about your

189
00:09:55.120 --> 00:09:57.639
<v Speaker 2>internal team. You also need to consider.

190
00:09:57.360 --> 00:10:01.360
<v Speaker 1>It third party vendors, yes, and con your extended network

191
00:10:01.480 --> 00:10:04.600
<v Speaker 1>all that they need to be part of the equation too. Yeah, right,

192
00:10:04.639 --> 00:10:07.840
<v Speaker 1>because a weak link in your supply chain can undermine

193
00:10:07.879 --> 00:10:10.679
<v Speaker 1>your whole security posture. For sure, Yeah, so you need

194
00:10:10.720 --> 00:10:14.440
<v Speaker 1>to ensure that any third party you work with meets

195
00:10:14.480 --> 00:10:19.200
<v Speaker 1>your security standards absolutely, and that's where those service level agreements,

196
00:10:19.200 --> 00:10:21.720
<v Speaker 1>the slas, becomes so critical.

197
00:10:21.840 --> 00:10:24.799
<v Speaker 2>They are critical. Yeah, the slas, they're your way of

198
00:10:24.840 --> 00:10:30.440
<v Speaker 2>defining expectations and holding vendors accountable. So don't just blindly

199
00:10:30.559 --> 00:10:33.440
<v Speaker 2>sign on the dotted line. Make sure that that contract

200
00:10:33.440 --> 00:10:37.240
<v Speaker 2>clearly spells out the services that are being provided, the

201
00:10:37.279 --> 00:10:41.200
<v Speaker 2>performance metrics, and importantly the penalties for non compliance.

202
00:10:41.360 --> 00:10:44.960
<v Speaker 1>Right, so no surprises down the line exactly. But with contracts,

203
00:10:45.000 --> 00:10:47.440
<v Speaker 1>I always feel like the devil's in the details.

204
00:10:47.519 --> 00:10:48.360
<v Speaker 2>Oh, it always is.

205
00:10:48.919 --> 00:10:52.440
<v Speaker 1>So what specific things should we be paying really close

206
00:10:52.480 --> 00:10:53.039
<v Speaker 1>attention to?

207
00:10:55.679 --> 00:10:59.919
<v Speaker 2>I would say, always pay close attention to the resolution

208
00:11:00.159 --> 00:11:03.879
<v Speaker 2>processes that are outlined in the contract. Okay, so what

209
00:11:03.960 --> 00:11:07.159
<v Speaker 2>happens if there's a dispute? What are those escalation procedures?

210
00:11:07.639 --> 00:11:11.240
<v Speaker 2>You need a clear path to resolution in case things go.

211
00:11:11.240 --> 00:11:13.799
<v Speaker 1>Wrong, and we need to make sure those service levels

212
00:11:14.360 --> 00:11:18.080
<v Speaker 1>actually meet our needs, especially when dealing with mission critical systems.

213
00:11:18.159 --> 00:11:21.080
<v Speaker 2>Yeah, I mean a delayed response from a vendor in

214
00:11:21.120 --> 00:11:24.200
<v Speaker 2>a crisis that could have disastrous consequences.

215
00:11:24.360 --> 00:11:25.559
<v Speaker 1>Yeah, it could be really bad.

216
00:11:25.679 --> 00:11:29.480
<v Speaker 2>So it all comes back to due diligence, don't just

217
00:11:29.519 --> 00:11:33.799
<v Speaker 2>take their word for it, like, really scrutinize those contracts. Yeah,

218
00:11:33.840 --> 00:11:36.720
<v Speaker 2>and make sure they're actually aligning with your security requirements.

219
00:11:36.759 --> 00:11:38.440
<v Speaker 1>Okay. I think we've covered a lot of ground on

220
00:11:38.480 --> 00:11:42.879
<v Speaker 1>compliance we have. Is it time to finally tackle risk management?

221
00:11:43.240 --> 00:11:44.759
<v Speaker 2>I think it is. Yeah, all right, let's do it.

222
00:11:44.799 --> 00:11:48.799
<v Speaker 2>And we're talking risk management. It's really crucial to first

223
00:11:48.919 --> 00:11:52.000
<v Speaker 2>understand your organization's risk appetite.

224
00:11:52.519 --> 00:11:56.200
<v Speaker 1>Risk appetite, So like, how much risk are we comfortable with?

225
00:11:56.519 --> 00:12:00.000
<v Speaker 2>Yeah, exactly how much risk are we okay with access

226
00:12:01.080 --> 00:12:02.879
<v Speaker 2>in pursuit of our business objectives?

227
00:12:03.159 --> 00:12:05.720
<v Speaker 1>Right, So it's like we don't want to be too reckless,

228
00:12:06.240 --> 00:12:09.679
<v Speaker 1>but we also don't want to stifle innovation exactly.

229
00:12:09.679 --> 00:12:11.440
<v Speaker 2>You don't want to be so cautious that you're not

230
00:12:11.440 --> 00:12:12.279
<v Speaker 2>actually getting.

231
00:12:12.000 --> 00:12:13.759
<v Speaker 1>Anything done, right exactly.

232
00:12:13.799 --> 00:12:16.600
<v Speaker 2>So it's about striking that balance, that delicate balance.

233
00:12:16.759 --> 00:12:18.399
<v Speaker 1>That's a tightrope block. That's tough.

234
00:12:18.720 --> 00:12:20.120
<v Speaker 2>It is. It is a tightrope block.

235
00:12:20.399 --> 00:12:23.200
<v Speaker 1>And that's where a formal risk management program comes in.

236
00:12:23.159 --> 00:12:26.120
<v Speaker 2>Right, Yes, a well defined program. It provides you with

237
00:12:26.159 --> 00:12:33.279
<v Speaker 2>a really structured approach to identifying, assessing, and prioritizing risks.

238
00:12:33.720 --> 00:12:35.960
<v Speaker 1>Okay, so break it down. How do we actually do that?

239
00:12:36.480 --> 00:12:40.000
<v Speaker 2>So it's a multi step process. The first thing you

240
00:12:40.039 --> 00:12:42.399
<v Speaker 2>have to do is identify the assets that you're trying

241
00:12:42.399 --> 00:12:47.600
<v Speaker 2>to protect. Okay, so think data, systems, intellectual property, even

242
00:12:47.639 --> 00:12:48.080
<v Speaker 2>your people.

243
00:12:48.159 --> 00:12:50.639
<v Speaker 1>Okay, so those are like the crown jewels, right exactly.

244
00:12:50.679 --> 00:12:53.399
<v Speaker 2>You need to keep those the things you absolutely need

245
00:12:53.399 --> 00:12:57.120
<v Speaker 2>to protect safe. Yes, Next, you need to identify the

246
00:12:57.159 --> 00:12:58.639
<v Speaker 2>potential threats.

247
00:12:58.639 --> 00:13:01.759
<v Speaker 1>To those assets natural disasters.

248
00:13:01.240 --> 00:13:05.559
<v Speaker 2>Natural disasters, yes, cyber attacks. Cyber attacks big one these days,

249
00:13:05.679 --> 00:13:09.240
<v Speaker 2>big time, human error, even like a disgruntled employee.

250
00:13:09.320 --> 00:13:11.039
<v Speaker 1>Okay, so think broadly, think.

251
00:13:10.919 --> 00:13:12.679
<v Speaker 2>Broadly, and consider all angles.

252
00:13:12.759 --> 00:13:13.080
<v Speaker 1>Got it.

253
00:13:13.159 --> 00:13:16.639
<v Speaker 2>Okay, So we've got our assets and our threats. Right now,

254
00:13:16.679 --> 00:13:20.840
<v Speaker 2>you need to assess the vulnerabilities that could allow those

255
00:13:20.960 --> 00:13:23.639
<v Speaker 2>threats to exploit your assets.

256
00:13:23.799 --> 00:13:27.759
<v Speaker 1>So these are the weaknesses in our defenses exactly. Okay,

257
00:13:27.799 --> 00:13:28.720
<v Speaker 1>give me some examples.

258
00:13:28.759 --> 00:13:34.200
<v Speaker 2>So like weak passwords, unpatched software, lack of physical security.

259
00:13:34.519 --> 00:13:35.960
<v Speaker 1>Those are the cracks in the fortress wall.

260
00:13:36.039 --> 00:13:37.559
<v Speaker 2>Yeah, tho are the cracks that we need to seal up.

261
00:13:37.720 --> 00:13:38.440
<v Speaker 1>We need to seal up.

262
00:13:38.480 --> 00:13:42.519
<v Speaker 2>Yeah. So once you've identified those vulnerabilities, you need to

263
00:13:42.559 --> 00:13:46.279
<v Speaker 2>kind of evaluate two things. The likelihood of each threat

264
00:13:46.559 --> 00:13:49.759
<v Speaker 2>actually occurring, and then the potential impact if it does.

265
00:13:50.120 --> 00:13:53.519
<v Speaker 1>So that's where we assign a risk rating.

266
00:13:53.759 --> 00:13:55.039
<v Speaker 2>To each one, exactly.

267
00:13:55.159 --> 00:13:58.600
<v Speaker 1>Yeah, but how do we do that in like a

268
00:13:58.679 --> 00:13:59.600
<v Speaker 1>systematic way?

269
00:14:00.000 --> 00:14:02.600
<v Speaker 2>The risk matrix comes in. It's a visual tool actually,

270
00:14:02.679 --> 00:14:06.679
<v Speaker 2>like a grid, and it helps you assess both the

271
00:14:06.879 --> 00:14:10.679
<v Speaker 2>likelihood and impact of each risk and then helps you

272
00:14:10.799 --> 00:14:13.039
<v Speaker 2>categorize them based on their severity.

273
00:14:13.159 --> 00:14:16.320
<v Speaker 1>So you can visually see like which risks are low

274
00:14:16.440 --> 00:14:21.039
<v Speaker 1>level annoyances and which ones are like potential company killers exactly.

275
00:14:21.279 --> 00:14:25.559
<v Speaker 2>Exactly. So by plotting your risks on the matrix, you

276
00:14:25.600 --> 00:14:29.600
<v Speaker 2>get a really clear picture of which ones pose the

277
00:14:29.600 --> 00:14:32.559
<v Speaker 2>biggest threat right and require immediate attention.

278
00:14:33.120 --> 00:14:35.399
<v Speaker 1>Okay, So those are the ones that we prioritize when

279
00:14:35.399 --> 00:14:37.159
<v Speaker 1>it comes to mitigation strategies.

280
00:14:37.240 --> 00:14:37.559
<v Speaker 2>Exactly.

281
00:14:37.639 --> 00:14:40.440
<v Speaker 1>Okay, So what does risk mitigation actually look like?

282
00:14:40.639 --> 00:14:44.600
<v Speaker 2>So, risk mitigation is all about reducing the likelihood and

283
00:14:44.799 --> 00:14:47.399
<v Speaker 2>or impact of those high priority risks.

284
00:14:47.480 --> 00:14:53.120
<v Speaker 1>So we're talking about like implementing safeguards controls to protect

285
00:14:53.120 --> 00:14:59.519
<v Speaker 1>those vulnerable assets exactly. So things like strong passwords, multi

286
00:14:59.519 --> 00:15:05.720
<v Speaker 1>factor authentication, encryption, regular security awareness training for our employees.

287
00:15:06.200 --> 00:15:09.120
<v Speaker 2>You nailed it, okay, So it's all about layering those

288
00:15:09.159 --> 00:15:12.960
<v Speaker 2>defenses to create a really robust security posture.

289
00:15:13.080 --> 00:15:15.240
<v Speaker 1>I like that. This is like building a medieval castle.

290
00:15:15.480 --> 00:15:16.759
<v Speaker 2>That's a great way to think about it.

291
00:15:16.840 --> 00:15:20.759
<v Speaker 1>Multiple layers of protection, I get that much harder to breach.

292
00:15:21.039 --> 00:15:22.159
<v Speaker 2>Yeah, good analogy.

293
00:15:23.159 --> 00:15:26.519
<v Speaker 1>But even the best built castle needs constant upkeep right

294
00:15:26.679 --> 00:15:29.320
<v Speaker 1>it does. So, how do we make sure our risk

295
00:15:29.399 --> 00:15:35.440
<v Speaker 1>management efforts, yes, stay relevant in this ever changing threat landscape.

296
00:15:35.639 --> 00:15:38.919
<v Speaker 2>That's where the ongoing part of risk management comes in. Okay,

297
00:15:39.080 --> 00:15:41.799
<v Speaker 2>so you need to regularly reassess your risks, you know,

298
00:15:41.879 --> 00:15:46.399
<v Speaker 2>taking into account new technologies, yeah, emerging threats, right, and

299
00:15:46.559 --> 00:15:48.360
<v Speaker 2>changes within your own organization.

300
00:15:48.639 --> 00:15:50.679
<v Speaker 1>So it's not like set it and forget it.

301
00:15:50.840 --> 00:15:52.639
<v Speaker 2>No, it's definitely not a set it and forget it.

302
00:15:52.960 --> 00:15:56.399
<v Speaker 2>You need to be constantly evaluating in evolving your.

303
00:15:56.320 --> 00:15:59.480
<v Speaker 1>Approach, right, because new threats emerge all the time, all

304
00:15:59.519 --> 00:16:02.840
<v Speaker 1>the time, and old threats can resurface in new and

305
00:16:02.919 --> 00:16:03.720
<v Speaker 1>creative ways.

306
00:16:03.879 --> 00:16:04.519
<v Speaker 2>Oh for sure.

307
00:16:04.639 --> 00:16:07.200
<v Speaker 1>So this brings us back to the importance of security

308
00:16:07.240 --> 00:16:09.639
<v Speaker 1>awareness training absolutely for our employees.

309
00:16:09.879 --> 00:16:13.399
<v Speaker 2>Yeah, because even with the best technology in place, human

310
00:16:13.600 --> 00:16:15.879
<v Speaker 2>error can still be a major vulnerability.

311
00:16:16.279 --> 00:16:20.159
<v Speaker 1>Yeah. I mean people click on phishing links, they do,

312
00:16:20.320 --> 00:16:26.720
<v Speaker 1>they fall for social engineering scams, they inadvertently expose sensitive data.

313
00:16:27.080 --> 00:16:28.399
<v Speaker 2>It happens all the time.

314
00:16:28.279 --> 00:16:30.559
<v Speaker 1>And those mistakes can have huge.

315
00:16:30.240 --> 00:16:37.320
<v Speaker 2>Consequences, huge consequences. That's why regular engaging relevant security awareness

316
00:16:37.320 --> 00:16:39.240
<v Speaker 2>training is so crucial.

317
00:16:39.360 --> 00:16:43.679
<v Speaker 1>It's about making security everyone's responsibility. Yes, not just the

318
00:16:43.720 --> 00:16:46.960
<v Speaker 1>IT department's burden exactly. But how do we make sure

319
00:16:47.000 --> 00:16:48.399
<v Speaker 1>the training actually sticks.

320
00:16:48.519 --> 00:16:50.919
<v Speaker 2>That's a great question and one that will dive into

321
00:16:50.960 --> 00:16:53.320
<v Speaker 2>more in part three. Okay, but for now, let's maybe

322
00:16:53.320 --> 00:16:53.919
<v Speaker 2>take a pause.

323
00:16:54.039 --> 00:16:55.480
<v Speaker 1>Yeah, this is a good place to stop.

324
00:16:55.559 --> 00:16:57.799
<v Speaker 2>Give our listener a chance to absorb all this information.

325
00:16:57.879 --> 00:17:00.919
<v Speaker 1>Yeah, this is dense stuff, it is, but it's fascinating

326
00:17:01.000 --> 00:17:04.559
<v Speaker 1>how all these pieces fit together to create a holistic

327
00:17:04.640 --> 00:17:05.799
<v Speaker 1>security strategy.

328
00:17:06.400 --> 00:17:07.039
<v Speaker 2>It really is.

329
00:17:07.160 --> 00:17:09.000
<v Speaker 1>I'm starting to feel like I could actually pass a

330
00:17:09.039 --> 00:17:09.920
<v Speaker 1>security audit.

331
00:17:10.000 --> 00:17:13.000
<v Speaker 2>Now, don't get ahead of yourself. There's still more to learn. Okay,

332
00:17:13.000 --> 00:17:14.599
<v Speaker 2>but you're definitely on the right track.

333
00:17:14.720 --> 00:17:17.359
<v Speaker 1>Okay, So to our listener, if you're feeling a bit overwhelmed,

334
00:17:17.680 --> 00:17:18.519
<v Speaker 1>take a deep breath.

335
00:17:18.640 --> 00:17:19.240
<v Speaker 2>Yeah.

336
00:17:19.480 --> 00:17:21.400
<v Speaker 1>We'll be back soon with the final part of our

337
00:17:21.400 --> 00:17:25.359
<v Speaker 1>deep dive, where we'll tackle contingency planning and incident response.

338
00:17:25.519 --> 00:17:28.920
<v Speaker 2>That's right, Yeah, those what if scenarios. Yeah, nobody wants

339
00:17:29.000 --> 00:17:29.799
<v Speaker 2>to think about them.

340
00:17:29.920 --> 00:17:31.559
<v Speaker 1>No, but you have to be prepared.

341
00:17:31.680 --> 00:17:34.440
<v Speaker 2>But you have to be prepared exactly exactly.

342
00:17:35.000 --> 00:17:38.839
<v Speaker 1>Okay, So we're back back for more part two of

343
00:17:38.839 --> 00:17:43.759
<v Speaker 1>our deep dive into security management. We left off talking

344
00:17:43.759 --> 00:17:48.000
<v Speaker 1>about compliance, right, and honestly, I'm still a little fuzzy

345
00:17:48.039 --> 00:17:50.680
<v Speaker 1>on what that actually means like in practice.

346
00:17:51.039 --> 00:17:53.640
<v Speaker 2>Okay, Yeah, so let's try to break it down a

347
00:17:53.680 --> 00:17:57.279
<v Speaker 2>little bit. Okay. So you know, we were talking about

348
00:17:57.319 --> 00:18:01.599
<v Speaker 2>those frameworks like NISSED SP eight hundred fifty three, which is,

349
00:18:01.839 --> 00:18:04.240
<v Speaker 2>like I said, a great framework, particularly if you're operating

350
00:18:04.279 --> 00:18:06.640
<v Speaker 2>in the US, but it's not the only one out there.

351
00:18:07.599 --> 00:18:09.559
<v Speaker 1>Okay, so what are some other options?

352
00:18:10.440 --> 00:18:13.000
<v Speaker 2>So there's you know, like ISO twoty seven thousand and

353
00:18:13.119 --> 00:18:16.920
<v Speaker 2>two point two zero one team, which offers more of

354
00:18:16.920 --> 00:18:22.119
<v Speaker 2>a global perspective, okay, and it basically provides guidelines for

355
00:18:22.200 --> 00:18:26.279
<v Speaker 2>implementing and maintaining information security management systems.

356
00:18:26.359 --> 00:18:29.079
<v Speaker 1>Gotcha. Okay, So we've got these frameworks. Yeah, they can

357
00:18:29.119 --> 00:18:32.279
<v Speaker 1>feel really dense and overwhelming. They can, So how do

358
00:18:32.319 --> 00:18:34.839
<v Speaker 1>we actually use them in a practical way?

359
00:18:35.279 --> 00:18:36.920
<v Speaker 2>Right? So, I think the best way to think about

360
00:18:36.920 --> 00:18:40.279
<v Speaker 2>it is like they're blueprints okay, not rigid rule.

361
00:18:40.119 --> 00:18:43.319
<v Speaker 1>Books, right, So it's not just about checking boxes exactly.

362
00:18:43.480 --> 00:18:47.440
<v Speaker 2>Yeah. So you can leverage these like external frameworks to

363
00:18:47.519 --> 00:18:51.960
<v Speaker 2>create your own internal standards, guidelines, and procedures. Okay, and

364
00:18:52.000 --> 00:18:55.119
<v Speaker 2>you want these to really align with your organization's needs

365
00:18:55.160 --> 00:18:56.279
<v Speaker 2>and its risk profile.

366
00:18:56.359 --> 00:18:59.519
<v Speaker 1>Okay. So it's like taking inspiration from a recipe, yes,

367
00:18:59.799 --> 00:19:02.160
<v Speaker 1>adapting it to your own taste exactly.

368
00:19:02.240 --> 00:19:04.480
<v Speaker 2>That's a great analogy. The key is to understand the

369
00:19:04.519 --> 00:19:09.079
<v Speaker 2>underlying principles and then tailor them to fit your unique

370
00:19:09.079 --> 00:19:10.319
<v Speaker 2>operational context.

371
00:19:10.599 --> 00:19:14.720
<v Speaker 1>That makes sense. Okay, So nobody wants to surprise.

372
00:19:14.400 --> 00:19:15.960
<v Speaker 2>Audit, No, nobody does.

373
00:19:16.119 --> 00:19:19.839
<v Speaker 1>How can we proactively prepare for those and avoid any

374
00:19:20.079 --> 00:19:20.960
<v Speaker 1>major headaches?

375
00:19:21.119 --> 00:19:24.039
<v Speaker 2>Audits can definitely be nerve wracking, yeah for sure, but

376
00:19:25.519 --> 00:19:28.640
<v Speaker 2>if you understand what the auditors are actually looking for,

377
00:19:29.559 --> 00:19:34.079
<v Speaker 2>it becomes much less daunting. So they're primarily looking for

378
00:19:34.119 --> 00:19:38.279
<v Speaker 2>evidence that you are following establish best practices and meeting

379
00:19:38.319 --> 00:19:42.279
<v Speaker 2>those compliance requirements. So things like you know, having really

380
00:19:42.440 --> 00:19:48.599
<v Speaker 2>clearly documented policies, conducting regular security assessments, implementing a solid

381
00:19:48.720 --> 00:19:51.480
<v Speaker 2>vulnerability management program. Yeah, those are all key.

382
00:19:51.599 --> 00:19:54.799
<v Speaker 1>And don't forget about those annual contingency plan exercises.

383
00:19:54.839 --> 00:19:57.720
<v Speaker 2>Oh yeah, those are crucial too. They're really important for

384
00:19:57.759 --> 00:20:00.359
<v Speaker 2>demonstrating that your plans are more than just work it's.

385
00:20:00.200 --> 00:20:03.640
<v Speaker 1>On paper, right, Yeah, those exercises not exactly my favorite

386
00:20:03.640 --> 00:20:04.279
<v Speaker 1>part of the job.

387
00:20:04.599 --> 00:20:06.759
<v Speaker 2>Not always the most exciting though, but I get why

388
00:20:06.759 --> 00:20:09.480
<v Speaker 2>they're important. Yeah. And you know, the type of exercise

389
00:20:09.519 --> 00:20:13.799
<v Speaker 2>you conduct should really align with the impact level of

390
00:20:13.839 --> 00:20:16.200
<v Speaker 2>the systems that you're protecting, right right, So for low

391
00:20:16.240 --> 00:20:20.400
<v Speaker 2>impact systems, a tabletop exercise might be enough, but for

392
00:20:20.519 --> 00:20:23.720
<v Speaker 2>high impact, like mission critical systems, you really need to

393
00:20:23.759 --> 00:20:28.200
<v Speaker 2>be doing those more comprehensive, full scale deployment exercises.

394
00:20:28.200 --> 00:20:31.799
<v Speaker 1>Okay. So it's about aligning, like the intensity of your testing, yes,

395
00:20:31.880 --> 00:20:35.240
<v Speaker 1>with the potential consequences of a failure exactly exactly.

396
00:20:35.599 --> 00:20:39.079
<v Speaker 2>And here's a pro tip, use those test results, yeah,

397
00:20:39.119 --> 00:20:44.240
<v Speaker 2>to continuously improve your preparedness. Okay, So every exercise is

398
00:20:44.279 --> 00:20:47.400
<v Speaker 2>an opportunity to learn and refine your processes.

399
00:20:47.480 --> 00:20:52.599
<v Speaker 1>So it's that cycle, plan, test A, just repeat. Never

400
00:20:52.680 --> 00:20:53.640
<v Speaker 1>let those plans.

401
00:20:53.319 --> 00:20:54.720
<v Speaker 2>Get stale, you ever let them get stale?

402
00:20:54.799 --> 00:20:55.839
<v Speaker 1>Yeah, Okay, this is good.

403
00:20:56.039 --> 00:20:58.359
<v Speaker 2>Security is a very dynamic process. You got to remember

404
00:20:58.640 --> 00:21:04.000
<v Speaker 2>it requires constant visual adaptation and it's not just about

405
00:21:04.000 --> 00:21:05.000
<v Speaker 2>your internal team.

406
00:21:05.079 --> 00:21:07.920
<v Speaker 1>Yeah, we touched on this. You also need to consider

407
00:21:08.240 --> 00:21:10.880
<v Speaker 1>third party vendors and contractors, yes.

408
00:21:10.720 --> 00:21:13.119
<v Speaker 2>Your extended network, all of that. They need to be

409
00:21:13.160 --> 00:21:13.559
<v Speaker 2>part of the.

410
00:21:13.519 --> 00:21:16.680
<v Speaker 1>Equation as well, right, because a weak link in your

411
00:21:16.720 --> 00:21:21.400
<v Speaker 1>supply chain totally can really undermine your whole security posture.

412
00:21:21.680 --> 00:21:23.480
<v Speaker 2>It can bring down the whole house of cards.

413
00:21:23.599 --> 00:21:26.799
<v Speaker 1>Yeah, okay, so you need to ensure that any third

414
00:21:26.799 --> 00:21:30.640
<v Speaker 1>party you work with meets your security standards absolutely, and

415
00:21:30.640 --> 00:21:35.559
<v Speaker 1>that's where those service level agreements, the slas, Yes, those

416
00:21:35.559 --> 00:21:37.799
<v Speaker 1>are key, becomes so critical.

417
00:21:37.440 --> 00:21:41.599
<v Speaker 2>They are critical. Yeah, So the slas are basically your

418
00:21:41.680 --> 00:21:46.240
<v Speaker 2>way of defining those expectations and holding vendors accountable. Okay,

419
00:21:46.400 --> 00:21:50.319
<v Speaker 2>so don't just blindly sign on the dotted line. Make

420
00:21:50.359 --> 00:21:53.839
<v Speaker 2>sure that that contract clearly spells out the services that

421
00:21:53.880 --> 00:21:58.519
<v Speaker 2>are being provided, the performance metrics, and importantly the penalties

422
00:21:58.559 --> 00:21:59.519
<v Speaker 2>for non compliance.

423
00:22:00.079 --> 00:22:03.559
<v Speaker 1>So no surprises down the line. But with contracts, I

424
00:22:03.559 --> 00:22:05.599
<v Speaker 1>always feel like the devil is in the details.

425
00:22:05.920 --> 00:22:06.920
<v Speaker 2>Oh for sure, what.

426
00:22:07.119 --> 00:22:10.759
<v Speaker 1>Specific things should we be paying really close attention to?

427
00:22:12.359 --> 00:22:16.599
<v Speaker 2>I would say, always pay close attention to the resolution

428
00:22:16.759 --> 00:22:20.519
<v Speaker 2>processes that are outlined in the contract. So, like what

429
00:22:20.680 --> 00:22:24.000
<v Speaker 2>happens if there's a dispute. What are the escalation procedures?

430
00:22:24.000 --> 00:22:26.920
<v Speaker 2>You need a clear path to resolution in case things

431
00:22:26.960 --> 00:22:27.720
<v Speaker 2>go wrong.

432
00:22:27.720 --> 00:22:31.480
<v Speaker 1>And we need to make sure those service levels actually.

433
00:22:31.279 --> 00:22:33.759
<v Speaker 2>Meet our needs absolutely.

434
00:22:33.279 --> 00:22:35.960
<v Speaker 1>Especially when dealing with mission critical systems.

435
00:22:35.680 --> 00:22:38.160
<v Speaker 2>Right, because a delayed response from a vendor in a

436
00:22:38.200 --> 00:22:40.799
<v Speaker 2>crisis that could have disastrous consequences.

437
00:22:40.920 --> 00:22:41.480
<v Speaker 1>Yeah, for sure.

438
00:22:41.559 --> 00:22:43.880
<v Speaker 2>So it really all comes back to due diligence. Okay,

439
00:22:43.920 --> 00:22:46.599
<v Speaker 2>you know, don't just take their word for it. Really

440
00:22:46.640 --> 00:22:50.640
<v Speaker 2>scrutinize those contracts, make sure they're actually aligning with your

441
00:22:50.640 --> 00:22:51.680
<v Speaker 2>security requirements.

442
00:22:52.200 --> 00:22:54.559
<v Speaker 1>Okay, I think we've covered a lot of ground on compliance,

443
00:22:54.640 --> 00:22:57.880
<v Speaker 1>I think so, yeah, is it time to finally tackle

444
00:22:58.000 --> 00:22:58.720
<v Speaker 1>risk management?

445
00:22:58.799 --> 00:23:01.160
<v Speaker 2>I think it is. Yeah. All right, So when we're

446
00:23:01.160 --> 00:23:05.200
<v Speaker 2>talking about risk management, it's really crucial to first understand

447
00:23:05.599 --> 00:23:07.599
<v Speaker 2>your organization's risk appetite.

448
00:23:07.880 --> 00:23:11.039
<v Speaker 1>Risk appetite, so like, how much risk are we comfortable accepting?

449
00:23:11.359 --> 00:23:14.079
<v Speaker 2>Exactly how much risk are we willing to accept? Yeah,

450
00:23:14.480 --> 00:23:17.640
<v Speaker 2>in pursuit of you know, achieving our business objectives.

451
00:23:17.720 --> 00:23:19.920
<v Speaker 1>Right, So it's like we don't want to be too reckless,

452
00:23:20.400 --> 00:23:22.759
<v Speaker 1>but we also don't want to be so cautious exactly

453
00:23:22.759 --> 00:23:25.039
<v Speaker 1>that we like stifle innovation.

454
00:23:25.160 --> 00:23:27.119
<v Speaker 2>You don't want to stifle innovation. You don't want to

455
00:23:27.160 --> 00:23:30.079
<v Speaker 2>be so scared to do anything that you just like

456
00:23:30.680 --> 00:23:33.720
<v Speaker 2>stay stagnant exactly. So it's about striking that balance.

457
00:23:33.880 --> 00:23:36.640
<v Speaker 1>Yeah, that's that's a tightrope walk, for sure, it is.

458
00:23:36.720 --> 00:23:37.640
<v Speaker 2>It is a tightrope walk.

459
00:23:37.640 --> 00:23:40.319
<v Speaker 1>And that's where a formal risk management program comes in.

460
00:23:40.279 --> 00:23:43.920
<v Speaker 2>Right, Yes, so a well defined program. Okay, it gives

461
00:23:43.960 --> 00:23:50.799
<v Speaker 2>you that structured approach to identifying, assessing, and prioritizing risks.

462
00:23:51.359 --> 00:23:53.519
<v Speaker 1>So break it down. How do we actually do that?

463
00:23:53.680 --> 00:23:55.359
<v Speaker 2>Okay, So it's a multi step process.

464
00:23:55.599 --> 00:23:55.920
<v Speaker 1>Okay.

465
00:23:56.160 --> 00:23:58.359
<v Speaker 2>The first thing you have to do is identify the

466
00:23:58.559 --> 00:24:02.839
<v Speaker 2>assets that you're trying to protect. So think you know, data, systems,

467
00:24:02.839 --> 00:24:04.799
<v Speaker 2>intellectual property, yeah, even your people.

468
00:24:04.920 --> 00:24:07.279
<v Speaker 1>Okay, so these are like the crown jewels that we

469
00:24:07.319 --> 00:24:08.599
<v Speaker 1>need to protect.

470
00:24:08.440 --> 00:24:14.279
<v Speaker 2>Exactly, the things that you absolutely cannot afford to lose. Next,

471
00:24:14.319 --> 00:24:18.920
<v Speaker 2>you need to identify the potential threats to those assets.

472
00:24:19.079 --> 00:24:22.480
<v Speaker 1>So like natural disasters, natural disasters, yep, cyber attacks.

473
00:24:22.480 --> 00:24:25.559
<v Speaker 2>Cyber attack is a big one these days, huge human error,

474
00:24:26.799 --> 00:24:28.880
<v Speaker 2>even things like disgruntled employees.

475
00:24:29.079 --> 00:24:31.039
<v Speaker 1>Right, so think broadly.

476
00:24:30.839 --> 00:24:34.640
<v Speaker 2>Broadly, consider all angles. Okay, Right, so you've got your assets,

477
00:24:34.920 --> 00:24:37.640
<v Speaker 2>you've got your threats, right, now you need to assess

478
00:24:38.079 --> 00:24:42.359
<v Speaker 2>the vulnerabilities okay that could allow those threats to exploit

479
00:24:42.400 --> 00:24:43.039
<v Speaker 2>your assets.

480
00:24:43.079 --> 00:24:45.240
<v Speaker 1>So these are like the weaknesses in our defenses.

481
00:24:45.359 --> 00:24:47.119
<v Speaker 2>Exactly, the weaknesses in your defenses.

482
00:24:47.160 --> 00:24:48.799
<v Speaker 1>Okay, give me some examples.

483
00:24:49.240 --> 00:24:54.079
<v Speaker 2>So things like you know, weak passwords, patch software, yeah,

484
00:24:54.799 --> 00:24:56.359
<v Speaker 2>lack of physical security yeah.

485
00:24:56.400 --> 00:24:58.759
<v Speaker 1>Okay. So these are the cracks and the fortress walls

486
00:24:58.759 --> 00:24:59.680
<v Speaker 1>that we need to seal up.

487
00:25:00.039 --> 00:25:03.640
<v Speaker 2>Exactly the cracks we need to seal up. Okay. So

488
00:25:03.839 --> 00:25:08.279
<v Speaker 2>once you've identified those vulnerabilities, you need to evaluate two things,

489
00:25:09.359 --> 00:25:13.440
<v Speaker 2>the likelihood of each threat actually happening, and then the

490
00:25:13.480 --> 00:25:14.799
<v Speaker 2>potential impact if it does.

491
00:25:15.319 --> 00:25:20.119
<v Speaker 1>So that's where we assign that risk rating each one exactly. Okay,

492
00:25:20.160 --> 00:25:22.559
<v Speaker 1>But how do we do that in a systematic way?

493
00:25:22.720 --> 00:25:25.519
<v Speaker 2>Right? So that's where the risk matrix comes in. So

494
00:25:25.559 --> 00:25:28.720
<v Speaker 2>this is a visual tool. Usually it's like a grid,

495
00:25:30.039 --> 00:25:32.759
<v Speaker 2>and it helps you assess both the likelihood and impact

496
00:25:32.839 --> 00:25:36.680
<v Speaker 2>of each risk, and then helps you categorize them based

497
00:25:36.680 --> 00:25:40.480
<v Speaker 2>on their severity. So you can visually see like which

498
00:25:40.599 --> 00:25:44.119
<v Speaker 2>risks are low level annoyances and which ones are potential

499
00:25:44.319 --> 00:25:48.400
<v Speaker 2>company killers, right exactly. So by plotting your risks on

500
00:25:48.519 --> 00:25:51.640
<v Speaker 2>the matrix, you can get a really clear picture of

501
00:25:51.680 --> 00:25:55.079
<v Speaker 2>which ones pose the biggest threat and require your immediate attention.

502
00:25:55.640 --> 00:25:58.000
<v Speaker 1>So those are the ones that we prioritize when it

503
00:25:58.039 --> 00:25:59.920
<v Speaker 1>comes to mitigation.

504
00:25:59.559 --> 00:26:01.559
<v Speaker 2>Strategy use exactly, exactly.

505
00:26:01.720 --> 00:26:04.759
<v Speaker 1>Okay, So what does risk mitigation actually look like?

506
00:26:05.359 --> 00:26:09.640
<v Speaker 2>Okay, So risk mitigation it's all about reducing the likelihood

507
00:26:09.680 --> 00:26:13.160
<v Speaker 2>and parador impact of those high priority risks. Okay.

508
00:26:13.160 --> 00:26:17.680
<v Speaker 1>So we're talking about like implementing safeguards controls to protect

509
00:26:17.839 --> 00:26:23.000
<v Speaker 1>those vulnerable assets exactly. So things like you know, strong passwords,

510
00:26:23.200 --> 00:26:28.920
<v Speaker 1>John passwords, Yeah, multi factor authentication, encryption, regular security awareness

511
00:26:28.960 --> 00:26:31.799
<v Speaker 1>training for employees, you nailed it. Okay.

512
00:26:31.880 --> 00:26:35.559
<v Speaker 2>So it's all about layering those defenses to create that

513
00:26:35.759 --> 00:26:38.359
<v Speaker 2>really robust security posture.

514
00:26:38.519 --> 00:26:40.960
<v Speaker 1>I like this, This is like building a medieval castle.

515
00:26:41.359 --> 00:26:42.319
<v Speaker 2>It's great analogy.

516
00:26:42.680 --> 00:26:45.400
<v Speaker 1>Multiple layers of protection make it that much harder to.

517
00:26:45.359 --> 00:26:47.079
<v Speaker 2>Breath exactly, It's much harder to get through.

518
00:26:47.880 --> 00:26:51.160
<v Speaker 1>But even the best built castle needs constant upkeeper, it does.

519
00:26:51.240 --> 00:26:51.559
<v Speaker 2>Yeah.

520
00:26:51.599 --> 00:26:55.440
<v Speaker 1>So how do we make sure our risk management efforts

521
00:26:55.480 --> 00:26:59.200
<v Speaker 1>stay relevant in this ever changing threat landscape?

522
00:26:59.240 --> 00:27:02.119
<v Speaker 2>Yeah, that's where the ongoing part of risk management comes in.

523
00:27:02.240 --> 00:27:06.799
<v Speaker 2>You need to regularly reassess your risks, you know, taking

524
00:27:06.839 --> 00:27:11.720
<v Speaker 2>into account new technologies, emerging threats, changes within your own organization.

525
00:27:11.920 --> 00:27:13.279
<v Speaker 1>So it's not set it and forget it.

526
00:27:13.440 --> 00:27:15.119
<v Speaker 2>No, it's definitely not a set it and forget it.

527
00:27:15.279 --> 00:27:18.759
<v Speaker 2>You've got to be constantly evaluating and evolving.

528
00:27:18.319 --> 00:27:21.960
<v Speaker 1>Your approach because new threats emerge all the time, all

529
00:27:22.000 --> 00:27:25.279
<v Speaker 1>the time, and old threats can resurface in new and

530
00:27:25.400 --> 00:27:26.240
<v Speaker 1>creative ways.

531
00:27:26.599 --> 00:27:29.160
<v Speaker 2>Absolutely, the bad guys are always coming up with new stuff.

532
00:27:29.319 --> 00:27:32.039
<v Speaker 1>So it brings us back to the importance of that

533
00:27:32.519 --> 00:27:35.720
<v Speaker 1>security awareness training for employees.

534
00:27:35.799 --> 00:27:39.319
<v Speaker 2>Yeah, because even with the best technology in place, human

535
00:27:39.519 --> 00:27:41.759
<v Speaker 2>error can still be a major vulnerability.

536
00:27:41.839 --> 00:27:44.839
<v Speaker 1>I mean, people click on phishing links, they do, they

537
00:27:44.880 --> 00:27:46.680
<v Speaker 1>fall for social engineering scams.

538
00:27:46.720 --> 00:27:47.519
<v Speaker 2>Happens all the time.

539
00:27:47.559 --> 00:27:52.799
<v Speaker 1>They inadvertently expose sensitive data, and those mistakes can have huge.

540
00:27:52.519 --> 00:27:57.359
<v Speaker 2>Consequences, huge consequences. Yeaheah. That's why you know, regular engaging

541
00:27:58.319 --> 00:28:00.720
<v Speaker 2>relevant security awareness training is so important.

542
00:28:00.920 --> 00:28:04.680
<v Speaker 1>It's about making security everyone's responsibility, not just the IT

543
00:28:05.319 --> 00:28:08.039
<v Speaker 1>departments burden exactly. Yeah, but how do we make sure

544
00:28:08.079 --> 00:28:09.720
<v Speaker 1>the training actually sticks.

545
00:28:10.400 --> 00:28:12.440
<v Speaker 2>That's a great question, and it's one that we're actually

546
00:28:12.440 --> 00:28:13.799
<v Speaker 2>going to dive into in Part three.

547
00:28:14.000 --> 00:28:16.400
<v Speaker 1>Okay, all right, good, but.

548
00:28:16.400 --> 00:28:18.000
<v Speaker 2>Maybe for now, let's take a little pause.

549
00:28:18.480 --> 00:28:20.119
<v Speaker 1>Yeah, I think this is a good place to stop

550
00:28:20.119 --> 00:28:20.480
<v Speaker 1>for now.

551
00:28:20.599 --> 00:28:22.960
<v Speaker 2>Yeah, give our listeners a chance to absorb all of

552
00:28:22.960 --> 00:28:23.640
<v Speaker 2>this information.

553
00:28:23.799 --> 00:28:24.680
<v Speaker 1>Yeah, this is dense.

554
00:28:24.720 --> 00:28:27.000
<v Speaker 2>Stuff is dense. There's a lot to unpack here.

555
00:28:27.079 --> 00:28:30.039
<v Speaker 1>But it's really fascinating how all these pieces fit together

556
00:28:30.160 --> 00:28:33.039
<v Speaker 1>to create like a holistic security strategy.

557
00:28:33.200 --> 00:28:33.839
<v Speaker 2>It really is.

558
00:28:33.920 --> 00:28:35.559
<v Speaker 1>I'm starting to feel like I could actually pass the

559
00:28:35.599 --> 00:28:36.400
<v Speaker 1>security audit.

560
00:28:36.480 --> 00:28:38.920
<v Speaker 2>Now. Oh, don't get ahead of yourself. There's still more

561
00:28:38.960 --> 00:28:41.920
<v Speaker 2>to come. Okay, okay, but you're definitely on the right track.

562
00:28:42.039 --> 00:28:45.640
<v Speaker 1>Okay, So to our listener, if you're feeling a bit overwhelmed,

563
00:28:45.799 --> 00:28:46.640
<v Speaker 1>take a deep breath.

564
00:28:46.839 --> 00:28:47.759
<v Speaker 2>Yeah, take a break.

565
00:28:48.160 --> 00:28:50.599
<v Speaker 1>We'll be back soon with the final part of our

566
00:28:50.640 --> 00:28:54.720
<v Speaker 1>deep dive, where we'll tackle contingency planning and incident.

567
00:28:54.400 --> 00:28:56.880
<v Speaker 2>Response if scenarios, right.

568
00:28:56.799 --> 00:28:59.279
<v Speaker 1>Yes, those what if scenarios.

569
00:28:58.880 --> 00:29:00.680
<v Speaker 2>That nobody wants to think about, but we have to

570
00:29:00.680 --> 00:29:02.519
<v Speaker 2>be prepared for But we have to be prepared for

571
00:29:02.559 --> 00:29:03.400
<v Speaker 2>it exactly, exactly.

572
00:29:04.240 --> 00:29:06.640
<v Speaker 1>Okay, So we're back for the final act of our

573
00:29:06.680 --> 00:29:10.839
<v Speaker 1>security management deep dive, which covered a lot from leadership

574
00:29:11.279 --> 00:29:16.079
<v Speaker 1>to compliance to risk management. Now it's time to kind

575
00:29:16.079 --> 00:29:19.480
<v Speaker 1>of face the music, like what happens when despite our

576
00:29:19.519 --> 00:29:21.680
<v Speaker 1>best efforts, things go wrong.

577
00:29:21.799 --> 00:29:24.880
<v Speaker 2>That's where contingency planning and incident response come in. Okay,

578
00:29:25.240 --> 00:29:29.039
<v Speaker 2>So it's all about preparing for those what if scenarios,

579
00:29:29.039 --> 00:29:33.400
<v Speaker 2>the moments when a breach occurs, system goes down, or

580
00:29:33.440 --> 00:29:34.319
<v Speaker 2>disaster strikes.

581
00:29:34.440 --> 00:29:38.240
<v Speaker 1>Okay, So let's dive into contingency planning first. Okay, what

582
00:29:38.440 --> 00:29:41.559
<v Speaker 1>are the essential elements of a truly effective plan?

583
00:29:41.920 --> 00:29:45.000
<v Speaker 2>All right? So the foundation of any good contingency plan

584
00:29:45.799 --> 00:29:50.519
<v Speaker 2>is really identifying your critical business functions. So those are

585
00:29:50.559 --> 00:29:54.039
<v Speaker 2>the processes that are absolutely essential to keeping your operations

586
00:29:54.119 --> 00:29:55.839
<v Speaker 2>running and the revenue flowing.

587
00:29:56.200 --> 00:29:59.599
<v Speaker 1>So if those critical functions go offline, the entire business

588
00:29:59.599 --> 00:30:00.599
<v Speaker 1>grinds to a halt.

589
00:30:00.839 --> 00:30:01.359
<v Speaker 2>Exactly.

590
00:30:01.519 --> 00:30:02.640
<v Speaker 1>That's what we need to protect.

591
00:30:02.720 --> 00:30:04.279
<v Speaker 2>Yeah, those are the things you have to protect at

592
00:30:04.319 --> 00:30:08.160
<v Speaker 2>all costs, at all costs. So once you've pinpointed those

593
00:30:08.400 --> 00:30:12.039
<v Speaker 2>critical functions, you need to figure out, like, what's the

594
00:30:12.160 --> 00:30:14.319
<v Speaker 2>acceptable downtime for each one?

595
00:30:14.519 --> 00:30:14.759
<v Speaker 1>Okay.

596
00:30:14.960 --> 00:30:17.920
<v Speaker 2>So this is known as the recovery time objective or

597
00:30:18.200 --> 00:30:21.039
<v Speaker 2>RTO and RTO Okay, Yeah, So the RTO is basically

598
00:30:21.440 --> 00:30:24.160
<v Speaker 2>how long you can afford to have that particular function

599
00:30:24.319 --> 00:30:27.680
<v Speaker 2>offline before it really starts to hurt the business. Okay,

600
00:30:28.960 --> 00:30:31.480
<v Speaker 2>and it's going to vary depending on how critical that

601
00:30:31.519 --> 00:30:34.519
<v Speaker 2>function is. Some things need to be back online within

602
00:30:34.599 --> 00:30:38.640
<v Speaker 2>minutes to avoid major disruptions. Others might have a little

603
00:30:38.640 --> 00:30:40.039
<v Speaker 2>bit more of a flexible timeframe.

604
00:30:40.160 --> 00:30:43.559
<v Speaker 1>Okay, so we've identified what needs to be protected and

605
00:30:43.599 --> 00:30:47.000
<v Speaker 1>how quickly it needs to be restored. What comes next

606
00:30:47.119 --> 00:30:48.799
<v Speaker 1>in building out this plan?

607
00:30:48.920 --> 00:30:52.359
<v Speaker 2>So now you need to actually develop like detailed procedures

608
00:30:53.000 --> 00:30:55.519
<v Speaker 2>for recovering each of those critical functions.

609
00:30:55.640 --> 00:30:57.480
<v Speaker 1>Okay, So this is like, step by step how do

610
00:30:57.519 --> 00:30:59.000
<v Speaker 1>we get this thing back online?

611
00:30:59.359 --> 00:31:04.319
<v Speaker 2>Exactly? This includes things like, you know, identifying alternate processing sites,

612
00:31:04.920 --> 00:31:11.119
<v Speaker 2>establishing like clear communication channels, having a solid process for

613
00:31:11.279 --> 00:31:12.799
<v Speaker 2>restoring data from backups.

614
00:31:13.119 --> 00:31:15.680
<v Speaker 1>Okay, so it's like having a playbook for getting the

615
00:31:15.680 --> 00:31:18.680
<v Speaker 1>business back on its feet exactly. Yeah after a disaster.

616
00:31:18.839 --> 00:31:20.400
<v Speaker 2>Yeah, it's your roadmap for recovery.

617
00:31:20.960 --> 00:31:23.640
<v Speaker 1>Okay, and don't forget about the human element.

618
00:31:23.720 --> 00:31:26.400
<v Speaker 2>Well, the human element's huge, it is, right, So your

619
00:31:26.480 --> 00:31:32.319
<v Speaker 2>plan needs to address things like employee safety okay, communication

620
00:31:32.400 --> 00:31:36.480
<v Speaker 2>protocols during an actual crisis, and then of course you

621
00:31:36.519 --> 00:31:38.880
<v Speaker 2>need to be doing ongoing training to be cure that

622
00:31:38.880 --> 00:31:40.119
<v Speaker 2>everybody knows their roles.

623
00:31:40.400 --> 00:31:43.519
<v Speaker 1>Yeah, because in a crisis, clear communication and a well

624
00:31:43.559 --> 00:31:45.400
<v Speaker 1>trained team can make all the difference.

625
00:31:45.559 --> 00:31:48.519
<v Speaker 2>Absolutely, it can be the difference between a minor hiccup,

626
00:31:48.720 --> 00:31:50.720
<v Speaker 2>yeah and a complete catastrophe.

627
00:31:51.039 --> 00:31:53.599
<v Speaker 1>Okay, but how do we know if the plan actually works.

628
00:31:54.240 --> 00:31:55.400
<v Speaker 2>That's where testing comes in.

629
00:31:55.519 --> 00:31:55.920
<v Speaker 1>Okay.

630
00:31:56.240 --> 00:31:58.720
<v Speaker 2>You've got to put your plan through its paces.

631
00:31:58.680 --> 00:32:04.319
<v Speaker 1>Regularly, So like simulations, fire drills, tabletop exercises, whatever it takes,

632
00:32:04.359 --> 00:32:05.559
<v Speaker 1>whatever it takes to make.

633
00:32:05.440 --> 00:32:07.920
<v Speaker 2>Sure everyone knows what to do exactly when the pressure's on.

634
00:32:08.079 --> 00:32:11.960
<v Speaker 1>Yeah, because testing it helps you identify gaps in the plan.

635
00:32:12.440 --> 00:32:15.400
<v Speaker 1>You can refine your procedures, you can build confidence within

636
00:32:15.480 --> 00:32:16.240
<v Speaker 1>your team.

637
00:32:16.359 --> 00:32:18.799
<v Speaker 2>Right because it's a lot less stressful to work out

638
00:32:18.839 --> 00:32:21.759
<v Speaker 2>those kinks. Oh yes, in a simulation than in a

639
00:32:21.839 --> 00:32:22.559
<v Speaker 2>real crisis.

640
00:32:22.799 --> 00:32:23.799
<v Speaker 1>Way less stressful.

641
00:32:23.880 --> 00:32:26.160
<v Speaker 2>Yeah. Okay. So let's say the unthinkable happens. Ok and

642
00:32:26.200 --> 00:32:30.839
<v Speaker 2>despite our best efforts, a security incident does occur. What

643
00:32:30.920 --> 00:32:32.720
<v Speaker 2>are those immediate steps we need to take?

644
00:32:32.839 --> 00:32:35.599
<v Speaker 1>Okay? So that's when your incident response plan kicks in.

645
00:32:35.680 --> 00:32:36.039
<v Speaker 2>Okay.

646
00:32:36.119 --> 00:32:40.000
<v Speaker 1>So this plan should outline like a really clear set

647
00:32:40.039 --> 00:32:43.519
<v Speaker 1>of actions to take in the event of a security

648
00:32:43.559 --> 00:32:46.119
<v Speaker 1>breach okay, or any other type of incident.

649
00:32:46.200 --> 00:32:48.200
<v Speaker 2>So it's like a crisis management playbook.

650
00:32:48.359 --> 00:32:51.039
<v Speaker 1>Yes, specifically for security incidents.

651
00:32:51.079 --> 00:32:51.480
<v Speaker 2>Okay.

652
00:32:51.640 --> 00:32:54.839
<v Speaker 1>So the first priority is containment. Okay, you got to

653
00:32:54.880 --> 00:32:56.039
<v Speaker 1>stop the bleeding.

654
00:32:55.759 --> 00:33:00.599
<v Speaker 2>So so isolate the affected systems. Yeah, shut down those

655
00:33:00.640 --> 00:33:05.279
<v Speaker 2>compromised network connections, prevent the incident from spreading further.

656
00:33:05.519 --> 00:33:06.319
<v Speaker 1>Damage control.

657
00:33:06.440 --> 00:33:07.920
<v Speaker 2>Damage control is key, yes.

658
00:33:07.839 --> 00:33:09.359
<v Speaker 1>Okay, but then what okay, So.

659
00:33:09.319 --> 00:33:11.480
<v Speaker 2>Then you move into the investination phase. Okay, so you

660
00:33:11.519 --> 00:33:14.839
<v Speaker 2>need to start gathering evidence, okay, to figure out the

661
00:33:14.920 --> 00:33:18.240
<v Speaker 2>scope and the nature of the incident. Okay. This is

662
00:33:18.240 --> 00:33:21.799
<v Speaker 2>where those digital forensic skills that we talked about earlier

663
00:33:22.440 --> 00:33:23.799
<v Speaker 2>becomes super important.

664
00:33:23.839 --> 00:33:25.640
<v Speaker 1>So we're like digital detectives.

665
00:33:26.640 --> 00:33:29.480
<v Speaker 2>Carefully document Yeah, documenting the scene of.

666
00:33:29.440 --> 00:33:32.839
<v Speaker 1>The crime, preserving evidence for analysis.

667
00:33:32.160 --> 00:33:37.680
<v Speaker 2>Exactly, because proper evidence collection it's crucial for understanding what happened,

668
00:33:38.200 --> 00:33:39.720
<v Speaker 2>why it happened, who might be.

669
00:33:39.680 --> 00:33:42.519
<v Speaker 1>Responsible, and for any potential legal action.

670
00:33:42.759 --> 00:33:45.200
<v Speaker 2>Absolutely. Yeah, you need that solid evidence.

671
00:33:44.960 --> 00:33:46.640
<v Speaker 1>Right, and we've got to make sure we're following those

672
00:33:46.720 --> 00:33:47.920
<v Speaker 1>chain of custody procedures.

673
00:33:47.960 --> 00:33:49.480
<v Speaker 2>Oh yes, super important.

674
00:33:49.119 --> 00:33:54.039
<v Speaker 1>To keep that evidence untainted, untainted, yes, yeah, Compromised evidence

675
00:33:54.119 --> 00:33:55.319
<v Speaker 1>is just as bad as having no.

676
00:33:55.279 --> 00:33:58.920
<v Speaker 2>Evidence, right exactly. So once you've contained the damage, you've

677
00:33:58.920 --> 00:34:03.319
<v Speaker 2>gathered your evidence, it's time to move into eradication and recovery.

678
00:34:03.440 --> 00:34:05.480
<v Speaker 1>All right, so this is where we clean up the

679
00:34:05.519 --> 00:34:07.119
<v Speaker 1>mess and get things back to normal.

680
00:34:07.200 --> 00:34:09.800
<v Speaker 2>Exactly, get everything back to normal as quickly and as

681
00:34:09.800 --> 00:34:10.880
<v Speaker 2>securely as possible.

682
00:34:10.920 --> 00:34:12.840
<v Speaker 1>Okay, So what does that actually look like?

683
00:34:13.280 --> 00:34:18.280
<v Speaker 2>So this phase involves removing any malware, restoring data from backups,

684
00:34:18.840 --> 00:34:23.519
<v Speaker 2>rebuilding any compromise systems, basically taking all the steps to

685
00:34:23.599 --> 00:34:27.039
<v Speaker 2>get your operations back online and functioning securely.

686
00:34:27.239 --> 00:34:31.119
<v Speaker 1>It sounds like a really complex process. Can be potentially

687
00:34:31.159 --> 00:34:31.800
<v Speaker 1>time consuming.

688
00:34:31.880 --> 00:34:34.480
<v Speaker 2>It can be time consuming, it can be very resource intensive,

689
00:34:34.880 --> 00:34:38.239
<v Speaker 2>which is why having that really detailed incident response plan

690
00:34:38.880 --> 00:34:42.440
<v Speaker 2>is so important. The more you can anticipate and plan for,

691
00:34:43.079 --> 00:34:45.199
<v Speaker 2>the smoother the recovery process is going to be.

692
00:34:45.320 --> 00:34:47.679
<v Speaker 1>Okay, and once we've recovered, the work isn't done.

693
00:34:47.599 --> 00:34:49.519
<v Speaker 2>Right, No, the work's not done. You've got to learn

694
00:34:49.559 --> 00:34:50.280
<v Speaker 2>from what happened.

695
00:34:50.519 --> 00:34:52.519
<v Speaker 1>We need to learn from our mistakes.

696
00:34:52.760 --> 00:34:56.599
<v Speaker 2>Absolutely, every security incident, no matter how small, is a

697
00:34:56.679 --> 00:34:57.599
<v Speaker 2>learning opportunity.

698
00:34:57.679 --> 00:34:58.159
<v Speaker 1>I like that.

699
00:34:58.280 --> 00:35:03.280
<v Speaker 2>So it's crucial to conduct like a really thorough post

700
00:35:03.360 --> 00:35:04.360
<v Speaker 2>incident review.

701
00:35:04.519 --> 00:35:07.199
<v Speaker 1>All right, So we dig deep, dig deep, figure out

702
00:35:07.360 --> 00:35:11.920
<v Speaker 1>what went wrong, why it went wrong, and who can

703
00:35:11.960 --> 00:35:14.400
<v Speaker 1>we prevent it from happening again exactly.

704
00:35:14.440 --> 00:35:18.360
<v Speaker 2>The goal is to continuously improve, strengthen your defenses, make

705
00:35:18.400 --> 00:35:20.679
<v Speaker 2>it harder for the attackers to succeed in the future.

706
00:35:20.880 --> 00:35:25.719
<v Speaker 1>Okay, so we've covered contingency planning, incident response, the hope

707
00:35:25.719 --> 00:35:27.960
<v Speaker 1>for the best, prepare for the worst.

708
00:35:28.039 --> 00:35:29.280
<v Speaker 2>Yeah, you g gotta be ready for anything.

709
00:35:29.320 --> 00:35:31.920
<v Speaker 1>Any final words of wisdom before we wrap up this

710
00:35:32.360 --> 00:35:34.239
<v Speaker 1>epic deep.

711
00:35:34.039 --> 00:35:38.840
<v Speaker 2>Dive, I would say remember that security is not a destination.

712
00:35:39.519 --> 00:35:43.159
<v Speaker 2>It's a journey. The threat landscape's constantly evolving it is,

713
00:35:43.320 --> 00:35:48.199
<v Speaker 2>so you got stay vigilant, hm adaptable, proactive, never let

714
00:35:48.199 --> 00:35:51.440
<v Speaker 2>your guard down exactly, and don't be afraid to invest

715
00:35:51.920 --> 00:35:55.920
<v Speaker 2>in the right resources like PE people, technology, training, training.

716
00:35:56.039 --> 00:35:59.519
<v Speaker 2>You need all of that to build a really robust program.

717
00:36:00.199 --> 00:36:04.159
<v Speaker 1>In the end, a strong security posture is an investment,

718
00:36:04.360 --> 00:36:05.599
<v Speaker 1>not an expense.

719
00:36:05.400 --> 00:36:08.639
<v Speaker 2>Well said. It's about protecting your most valuable assets, right,

720
00:36:08.800 --> 00:36:11.159
<v Speaker 2>your reputation and your future.

721
00:36:11.920 --> 00:36:13.880
<v Speaker 1>Well, I have to say, I feel like I've earned

722
00:36:14.039 --> 00:36:17.960
<v Speaker 1>an honorary CISSP certification after this deep dive.

723
00:36:18.159 --> 00:36:20.599
<v Speaker 2>You're well on your way. You're a security champion.

724
00:36:20.760 --> 00:36:24.880
<v Speaker 1>And to our listener, we encourage you to take what

725
00:36:25.079 --> 00:36:28.039
<v Speaker 1>you've learned here. Yeah, put it into practice.

726
00:36:28.159 --> 00:36:30.480
<v Speaker 2>Yeah, don't just let this information sit Start.

727
00:36:30.280 --> 00:36:34.599
<v Speaker 1>Those conversations, assess those risks, build those defenses. Absolutely, never

728
00:36:34.639 --> 00:36:35.559
<v Speaker 1>stop learning.

729
00:36:35.400 --> 00:36:37.119
<v Speaker 2>Never stop learning. That's key in this field.

730
00:36:37.239 --> 00:36:40.480
<v Speaker 1>The world of security is constantly changing, but with the

731
00:36:40.559 --> 00:36:43.719
<v Speaker 1>right knowledge and a proactive mindset, you can stay ahead

732
00:36:43.760 --> 00:36:44.199
<v Speaker 1>of the curve.

733
00:36:44.360 --> 00:36:46.159
<v Speaker 2>You can stay safe out there.

734
00:36:46.000 --> 00:36:48.000
<v Speaker 1>Until next time. Stay safe and secure.