Apex Threat Agents, More HITRUST, Quant/Qual Showdown, and Iran

Time for another roundup! Below are some works I’ve recently done on Apex Threat Agents, HITRUST, my time at the Gartner Summit, and some thoughts on Iranian attacks.

How to Model Risk in an Apex Predator Cyber-World

Enhancing HITRUST Risk Assessments with Cyber Risk Quantification (CRQ)

Gartner 2019 Debate: Quantitative vs. Qualitative Cyber Risk Analysis

Podcast: Jack Freund on How to Prepare for an Iranian Cybersecurity Threat

 

ZombieLoad, Business Acumen, HITRUST, and DHS Directive

As a part of my new role with RiskLens, I’ve been publishing several articles. Included here is a recap of my work over the past month:

  • The ZombieLoad speculative execution bug raised the specter of a possible 40% hit in performance. I gave a plan to evaluate this new bug in the context of risk trade-offs here and here.
  • For the @ISACA newsletter, I wrote about the importance of understanding business processes when conducting risk analyses. The specific list of business concepts I thought were important are included in the article here and RiskLens promoted it here (where they called me a security nerd LOL).
  • I presented on integrating FAIR into the HITRUST CSF model along with Jason Martin from Highmark Health. The slides from this presentation are here.
  • The new DHS Binding Operational Directive requires accelerated patching for critical and high security vulnerabilities. My thoughts on this are here for Homeland Security Today.

Using Risk to Justify Security Strategy and Spending

I wrote a piece for RiskLens* recently that talks about how to utilize FAIR for building and justifying an information security budget and strategic initiatives. Its an interesting problem space as there is a need to have the appropriate level of abstraction (program level versus technology level) but its also a very solvable problem to add risk reduction justification to these annual budgetary exercises.

Fun story: one time I did this exercise years ago, I actually rated one initiative as *increasing* risk. It started an interesting discussion but the lesson is that not everything will result in less risk to your organization. Budgeting is a complicated amalgam of math, politics, and priorities; be sure to bolster your budgeting process with some risk arguments.

Click here for the RiskLens article: How CISOs Use FAIR to Set Strategic Priorities for Spending

*I am a professional advisor for RiskLens

Joined RiskLens as Professional Advisor

I recently accepted a position with RiskLens as a professional advisor. I’m looking forward to working with Jack Jones again as well the great team they have assembled there. My immediate project there will be advising on the product roadmap and assist them with taking their amazing quantitative risk platform to the next level.

Official announcement here.