Dan Desko’s Post

The opening Gartner keynote address covered third-party cyber risk management as one of the two key investment focus areas for organizations. The keynote discussed the increasing interruptions caused by third parties, which surged by a staggering 45% from last year. Gartner experts mentioned that despite the cyber risks, 40% of the time, business sponsors move forward with vendors because of lack of effective third-party risk management programs. The session recommended organizations follow strategies such as bringing business continuity management to Third-Party Cyber Risk Management as well the recommended partnering with the third parties to mature their risk management practices. Third-party risk management also took center stage in the discussion on emerging technologies in security and risk management for the year ahead. This shift in emphasis might have initially seemed surprising, but the statistics shed light on its relevance, where third-party breaches occur much more frequently than organizations realize. If you are interested to learn more about Safe Security let me know!

Today our paper 'Cyber Risk Management and Organisational Alignment Using Endley’s Risk Management Model' was accepted. What the paper is about is summarized by one of the reviewers as follows: 'This paper presents a novel approach to enhancing cyber risk management and organizational alignment at Amsterdam Airport Schiphol. Utilizing Endsley's Risk Management Model, the study addresses threats at various levels through a network model tailored to Schiphol's cyber domain. This model captures the interconnectedness of vulnerabilities and includes self-adaptation mechanisms for evolving threats. The research follows a phased plan, establishing a theoretical foundation and designing the network model meticulously. A controlled experiment has demonstrated the model's effectiveness in improving situational awareness and its impact on risk management and alignment. The study also uses What-If analysis and probabilistic assessment to explore future risks. The model's continuous refinement based on these findings offers a comprehensive view of the threat landscape and a proactive approach to risk mitigation. The network model introduces a novel assessment methodology, capable of simulating attacks and incorporating real-time data for up-to-date risk assessments. It can also integrate with existing frameworks for a more comprehensive approach. Future research should adapt the model for other airports, incorporate human factors, and explore machine learning for enhanced threat prediction and risk assessment. This research has the potential to advance cyber risk management strategies for critical infrastructure operators significantly.' We will present it at CoMeSySo'24,the 8th Conference on Computational Methods in Systems and Software 2024": https://lnkd.in/eW7aqB_c

Beyond the Basics: Advanced Compliance Strategies for Third-Party Engagements in 2024 As we navigate through 2024, organizations continue to grapple with the complexities of third-party risk management (TPRM). The ever-evolving regulatory landscape demands a proactive and sophisticated approach to ensure compliance and mitigate risks. Here are some advanced strategies that can help organizations stay ahead in managing third-party engagements: I. Expand Your Attack Surface Awareness The expansion of the Internet of Things (IoT) has significantly increased organizational attack surfaces. Each third-party vendor brings its own set of vulnerabilities, potentially exposing your organization to cyber threats. It’s crucial to eliminate blind spots and gain visibility across your entire supply chain. Tools like UpGuard’s Vendor Risk can provide a centralized dashboard to monitor threats and conduct vendor due diligence effectively. II. Elevate Vendor Risk Management With the sophistication of supply chain attacks reaching new heights, it’s imperative to maintain a robust vendor risk management (VRM) plan. Incorporate continuous assessment and monitoring of vendors to protect against breaches that could have far-reaching consequences. III. Lifecycle-Based Third-Party Risk Management Adopting a lifecycle-based approach to TPRM is essential. This means managing the entire vendor relationship from onboarding to offboarding, understanding the context of risks at each stage. A comprehensive approach ensures that risks are not just checked off but are managed effectively throughout the vendor lifecycle. IV. Stay Informed and Agile Regulatory changes are constant, and staying informed is key. Organizations must assess third-party supplier risk and implement robust business continuity plans that include software escrow agreements to ensure operational resilience. V. Strategic Compliance Monitoring Effective risk identification and remediation require robust processes and oversight. Compliance leaders must strategize compliance monitoring to ensure that third-party activities align with organizational standards and regulations. V. Prioritize Cybersecurity in TPRM Cybersecurity should be a top priority in your TPRM program. As threats evolve, so should your strategies to protect sensitive data and prevent breaches. Engage in continuous learning and adapt your cybersecurity measures to address emerging trends. Conclusion The regulatory challenges of 2024 demand that organizations not only understand the risks associated with third-party engagements but also implement advanced strategies to manage them. By expanding attack surface awareness, elevating VRM, adopting a lifecycle-based approach, staying informed and agile, strategically monitoring compliance, and prioritizing cybersecurity, organizations can navigate the regulatory maze and mitigate third-party compliance risks effectively.

Why the role of Risk Management is so vital in ISMS with ISO 27001:2022 and how Abhijnah CyberFin LLP™ helps you safeguard your business with ISO 27001:2022? In today’s digital age, managing information security risks is more critical than ever. Risk management is at the core of an effective Information Security Management System (ISMS) 🛡️ and is the foundation of ISO 27001:2022. But how can your organization effectively identify and mitigate these risks? This is where Abhijnah CyberFin LLP™ steps in. We specialize in guiding organizations through the ISO 27001:2022 implementation process, helping you build a resilient ISMS that not only safeguards your assets but also aligns with your business goals 🎯. 🌟 The Importance of Risk Management in ISMS🌟 Risk management within an ISMS is about understanding potential threats to your information assets and taking proactive measures to mitigate them. Key steps include: 1. Identifying Risks: 🔍 The first step is to recognize what could go wrong. Whether it’s data breaches, cyber-attacks, or internal vulnerabilities, identifying risks helps you focus on the most critical areas. 2. Assessing Impact: 📊 Not all risks are equal. Assessing the likelihood and potential impact of each risk allows you to prioritize and allocate resources effectively. 3. Mitigating Threats: 🛠️ After identifying and assessing risks, the next step is to mitigate them. This involves implementing controls to reduce the likelihood of risks materializing or minimizing their impact. How Abhijnah CyberFin LLP™ helps you manage risks? Here’s how we assist: 1. Comprehensive Risk Assessment: We help identify all potential risks to your information security, both internal and external, ensuring that no threat is overlooked 🧐. 2. Tailored Risk Treatment Plans: Based on the assessment, we help develop a customized risk treatment plan 🎨, outlining specific controls to mitigate the risks relevant to your business, ensuring efficient resource allocation. 3. Continuous Monitoring: Risk management is ongoing. We help establish procedures for continuous monitoring 🔄, so you can adapt to new threats as they arise and keep your ISMS strong. 4. Training and Awareness: It’s vital that your team understands their role in risk management. We offer training sessions that build awareness and empower employees to contribute to a secure environment 🧑🏫. Ready to elevate your information security? Let’s connect and discuss how we can help you identify and mitigate your security risks effectively. Vijay Ramachandran Bhaskara, CISA, ACCA akansha mahajan For more updates follow Abhijnah CyberFin LLP™ #ISO27001 #InformationSecurity #india #management #technology #startups #vulnerability #cybersecurity #infosec #tech #australia #usa #uk #netherlands #germany #uae #middleeast #dubai #founder #cofounder #ceo #enterpreneur #secureyourdata #dataprotection #securityawareness #cloud

🔴 Elements Of Security Risk Management ✅ - Part "I"💯 🔹 Security risk management involves a wide range of different activities, procedures, and practices. 🔹 It is a dynamic process that needs to be constantly monitored throughout the program cycle and adapted to changes in your organization’s operating environment. ⚫ Context Analysis & Actor Mapping ✅ 🔻Context analysis examines all the factors and information available about the context your organization is working in. 🔻 It is critical to start actor mapping and context analysis as early as possible, and continue the process throughout the entire program lifecycle. 🔻Actor mapping is an exercise that identifies all the individuals, stakeholders, and organizations that will have an impact on the operating environment where your organization is working. 🔻The main purpose of actor mapping is to identify key actors and define their power relationships. ⚫ Risk Assessment ✅ 🔻The purpose of a security risk assessment is to identify different threats, vulnerabilities, and risks your organization and staff may face in order to develop appropriate mitigation measures to reduce those risks and enable the safe delivery of programs.   ⚫ Security Strategies ✅ 🔻There are 03 types of security strategies — acceptance, protection, deterrence — that your organization can use depending on what is most appropriate for the context you are operating in. ⚫ Risk Management Measures ✅ 🔻Once you determine the security strategies for your organization, you can develop specific risk management measures to support these strategies, such as : ▪ Standard Operating Procedures (SOPs). ▪ Contingency plans. ▪ Advocacy. ▪ Risk sharing (working in partnership with local and / or international NGOs). ▪ Secondment of subject matter experts (SMEs). ⚫Security Plan ✅ 🔻A security plan is a simple document that provides all staff with guidance on how to safely perform their different roles, responsibilities, and work-related activities. ⚫Standard Operating Procedures (SOPs) ✅ 🔻Standard Operating Procedures (SOPs) define the measures staff should take to mitigate the specific threats identified in your organization's risk assessment.   ⚫Contingency Plans ✅ 🔻 Contingency plans are a set of pre-established procedures and measures that guide staff in coordinating a rapid and effective response to specific incidents or situations.   ⚫Facility Security ✅ 🔻Upholding facility security relies on identifying and mitigating the threats, vulnerabilities, and risks to all property used by your organization including offices, compounds, and facilities.   ⚫Communications and Information Security ✅ 🔻Communication systems are essential for keeping staff and the communities they work in safe. 🔻Information Security involves the safe storage and protection of all organizational information, data, and documents. OMAR TALBI 🧑✈️🔵

I'm delighted to contribute to the inaugural issue of the new journal, Risk Sciences, edited by Runhuan Feng, PhD, FSA, CERA from Tsinghua University. I would like to say many thanks to my academic advisor and colleague, Martin Eling, at the Institute of Insurance Economics of the University of St. Gallen for his contribution to this study, where we examine the impact of potential optimism bias on decision-making in cyber risk management with a partial framework of prospect theory. More detailed summary can be found in the following repost from Runhuan. I very much look forward to seeing the growth of this journal with many critical contributions from risk societies. #RiskSciences #CyberRiskManagement #CyberInsurance #LossAversion #DecisionMaking

🚨 Understanding Risk Management in Today’s Digital Landscape 🚨 In our fast-evolving digital world, effective Risk Management is no longer optional—it's necessary for sustainable growth and resilience. A good way to visualize risk management is by analyzing the intersection of Threats, Assets, and Vulnerabilities, as seen in this Venn diagram. Here’s how these components work together: 🔵 Threats: These are external elements that could harm your organization, such as cyberattacks, market shifts, or operational disruptions. Proactively identifying threats is the first step toward preparing for them. 🟢 Assets: These include your organization’s resources, data, and reputation—the essential elements that drive your business forward. Protecting your assets is key to retaining value and growth potential. 🔴 Vulnerabilities: Weak points within your system, such as outdated software, untrained staff, or inadequate controls. Knowing where your vulnerabilities lie helps you fortify your defenses. The Intersection: RISK 🛡️ When these three elements overlap, we encounter Risk—the potential for loss or damage when a threat targets a vulnerability in an asset. This central area is where we need to focus our risk management efforts to prevent or mitigate harm. 📊 Proactive Risk Management Steps: - Identify and assess all potential threats. - Evaluate and secure assets with robust protection measures. - Address vulnerabilities by strengthening internal defenses and educating your team. By understanding the dynamics of Threats, Assets, and Vulnerabilities, we can better anticipate risks, safeguard our assets, and navigate today’s complex digital landscape with confidence. 🌐

Keeper Introduces Risk Management Dashboard for Enhanced Risk Visibility and Proactive Threat Mitigation: Keeper Security have announced the launch of Risk Management Dashboard, a new feature within the Keeper Admin Console. The dashboard empowers administrators with broad visibility into their organisation’s security practices and compliance posture, setting a new standard for streamlined cybersecurity management. The Risk Management Dashboard provides an intuitive risk assessment score based on key metrics […] The post Keeper Introduces Risk Management Dashboard for Enhanced Risk Visibility and Proactive Threat Mitigation appeared first on IT Security Guru.

Cybersecurity Risk Management Procedure Template Comprehensive Cybersecurity Risk Management Framework This detailed procedure template outlines a structured approach for organizations to effectively manage cybersecurity risks. The key phases include: 1. Defining Scope, Context and Criteria: Identifying relevant assets, processes, and establishing risk evaluation parameters. 2. Cybersecurity Risk Assessment: Thorough risk identification, analysis, and evaluation against defined criteria. 3. Cybersecurity Risk Treatment: Selecting appropriate mitigation strategies like risk reduction, avoidance, transfer, or acceptance. 4. Recording and Reporting: Maintaining a comprehensive cybersecurity risk register and providing access to relevant stakeholders. 5. Communication and Monitoring: Ensuring ongoing stakeholder engagement and continuous review of risks and controls. By following this end-to-end process, organizations can build a robust cybersecurity risk management program. Key benefits include: - Aligning cybersecurity efforts with business objectives and risk appetite - Prioritizing and addressing the most critical cybersecurity risks - Ensuring consistent documentation and reporting of cybersecurity risks - Enabling continuous improvement through regular monitoring and review Adopting this comprehensive framework can be a valuable step in strengthening an organization's overall cybersecurity posture and resilience.

Continuous Vendor Risk Management: Enhancing Security Maturity Beyond Compliance Checks In today’s interconnected business environment, supply chain vulnerabilities are a prime target for cybercriminals. Unfortunately, one-time audits and periodic assessments leave critical gaps in risk oversight, exposing businesses to emerging threats that evolve faster than traditional compliance frameworks can address. Why Settle for Basic Compliance? Compliance is essential, but it provides only a snapshot of vendor security at a single point in time. Cyber threats, however, are dynamic and require an adaptive, continuous approach to ensure the safety and resilience of your supply chain. Achieving true security maturity means moving beyond reactive, compliance-only measures and adopting a proactive strategy that evolves with the threat landscape. Introducing RiskXchange’s 360° Vendor Risk Management We provide a comprehensive solution for continuous vendor risk management, delivering: -Real-Time Visibility Gain ongoing insights into the security posture of vendors and partners, allowing you to spot vulnerabilities as they emerge. -Proactive Risk Identification Continuously assess and monitor vendor risks to address potential threats before they escalate into costly incidents. -Strengthened Supply Chain Resilience Build a more secure and trustworthy ecosystem by addressing weaknesses across your vendor network with data-driven insights. -Enhanced Security Maturity Go beyond compliance by fostering a culture of continuous improvement, ensuring your organization stays ahead of threats while meeting regulatory requirements. Why Choose Ours Over Competitors? We stand apart by combining advanced technology with user-friendly tools to provide: -Comprehensive Risk Scoring We offer detailed, actionable risk scoring based on real-time data and industry benchmarks, giving businesses unparalleled insights into vendor security. -Customizable Alerts & Reporting Unlike other platforms, we allow you to tailor alerts and reports to your organization’s specific risk tolerance and compliance needs, ensuring you focus on what matters most. -Seamless Integration We integrate easily into your existing workflows, requiring minimal disruption while delivering maximum value. -Global Perspective Leverage insights from a vast, global database of vendors, ensuring you’re equipped to address risks no matter where your suppliers are located. By choosing ours, you’re not just monitoring risks—you’re empowering your organization with the tools to anticipate and mitigate them effectively. 📘 Explore the Benefits of Continuous Monitoring RiskXchange’s 360° approach empowers businesses to transform their risk management strategies, fostering stronger security resilience and ensuring a full-spectrum defense against supply chain threats. ➡️ Learn how to enhance your risk management strategy today: https://buff.ly/49aTSgC