Call us now:
Know your enemy and know yourself to build an effective defence. Cyber threat modelling along-side vulnerability assessment and a clear managed enterprise wide architecture are important components to cybersecurity risk management.
However this is the challenge. The Securities and Exchange commission is looking at proposals to regulated cybersecurity risk management, governance, strategy and incident disclosure, and cybersecurity risk management is not the same as cybersecurity. If one wants to understand what the SEC has to go through to manage and report its cyber risk, take a look at its 2021 FISMA audit, and the policies it adopts to comply.
Our traditional methods of cybersecurity have mostly sat within the controls bucket of cybersecurity risk management, between inherent risk and residual risk. Invariably not taking an enterprise wide, supply chain wide view of cybersecurity risk management (how many companies can say that they can accommodate cyber-supply chain risk?). Cybersecurity risk management requires the adoption of a risk management framework including a risk taxonymy and evaluation of control effectiveness. (inherent to residual risk).
Threat modelling is an important component of cybersecurity risk management, alongside a knowledge of an organisations vulnerabilities, that in turn is built from a understanding of its enterprise architecture.
Ted Dziekanowski
#threatintelligence #FISMA #cybersecurityriskmanagement #securitiesandexchangecommission #cyberregulation
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6930785022295617537