As a part of my new role with RiskLens, I’ve been publishing several articles. Included here is a recap of my work over the past month:
- The ZombieLoad speculative execution bug raised the specter of a possible 40% hit in performance. I gave a plan to evaluate this new bug in the context of risk trade-offs here and here.
- For the @ISACA newsletter, I wrote about the importance of understanding business processes when conducting risk analyses. The specific list of business concepts I thought were important are included in the article here and RiskLens promoted it here (where they called me a security nerd LOL).
- I presented on integrating FAIR into the HITRUST CSF model along with Jason Martin from Highmark Health. The slides from this presentation are here.
- The new DHS Binding Operational Directive requires accelerated patching for critical and high security vulnerabilities. My thoughts on this are here for Homeland Security Today.
For this months @ISACA Tips column, I wrote about the conundrum of defining and assessing emerging risk. Its an interesting space to assess; technologies and trends so cutting edge that they sorta defy precision assessments, yet also so important as to require them.
You can check it out here.
I wrote an article to help ISACA introduce its Digital Transformation research in the Financial Services industry.
There are some interesting findings in here about AI, IOT, Cryptocurrency, and Blockchain.
My article in Bankingexchange.com is here
ISACA’s Digital Transformation Barometer research is here
I’m very pleased to announce that I have been awarded an ISACA Global Achievement Award, specifically the John W. Lainhart IV Common Body of Knowledge Award. Full citation below:
ISACA John W. Lainhart IV Common Body of Knowledge Award
Scope: Recognizes an individual for major contributions to the development and enhancement of the common body of knowledge used by the ISACA community.
Jack Freund, Ph.D., CISA, CISM, CRISC
“For contributions in developing the CRISC Certification and for ensuring the integrity and quality of the CRISC Certification exam content.”
I’ll be granted this award on 28 May at the ISACA EuroCACS conference in Edinburgh, Scotland.
The full list of this year’s award winners is here.
I’m very proud of the time I’ve spent working on the CRISC certification (almost 8 years now) and it’s astronomical growth since its launch. I truly do believe that it is a very high quality IT risk certification that employers can rely on to ensure that their staff has core IT risk knowledge. I’m very humbled to have my small contributions acknowledged in this way.
I was interviewed for, and quoted in, this ISACA publication around Smart Contracts.
Upon reflection, what we are really seeing is just a continuation of the concept of Code = Law as pointed out by Lawrence Lessig in his 1999 book, Code and Other Law of Cyberspace.
The Smart Contracts doc is a free download (after registration) and can be found here:
In my latest column I wanted to call out some of the dichotomy that exists in the cyber world today. There are so many exciting new technologies in the world, and so much more risk inherent in them. Working in risk means that you can’t avoid bad things entirely (any more than you can stop the future from becoming the present), but you also have to weigh the risk of NOT participating in the latest new technology. And that is what makes working in cybersecurity and risk so interesting!
You can read my thoughts on this here.
My latest @ISACA column was published today and in it, I talk about a concept called “pure risk.” It flies in the face of notions of “positive risk” that are in popular use. Understanding Pure Risk can help dispel any notion that Cyber Risk can be a good thing. You can read it here.