Risk Management in 2022: Take it Up a Notch - Seguridad Mania.com - España y América Latina

The conventional risk management approach lacks accuracy and often doesn't include strategies that provide quantitative information. When it comes to third party risk management, those strategic challenges become even more apparent. • Discuss the difference between classification-based and risk-based strategies - This is WHY risk management today is broken • Examples from PayPal and Target/Fazio HVAC attack • Security ratings - They are not a single solution • Why CISOs dislike them • Jack Jones analogy • 6 steps to solve the problem: • Quantitative assessment • Use existing security artifacts more strategically (i.e. SOC2) • Approach situations like a hacker • Use industry open standards • Automate processes with measurable value • Use business language that will resonate with people throughout the organization • How do we manage risk at Black Kite? Bob to share examples of what he does to manage third parties