Real-world Risk Assessment
Transcript
As a company principal, it’s important to realize that risk assessment is performed at every level of the organization and for every activity you do. You’ve been doing it instinctively most of the time. In your operations you consider, if I do this thing, what is the bad thing that might come of it? In my history, I’ve seen policies around margarita Fridays within an organization because there were inherent risks in having everybody have a good time on a Friday afternoon. And the company owner took the time to establish potential threats. Talking about things like, “What happens if someone has a bit too much and wants to drive home?” Ranging to, “What happens if somebody doesn’t want to participate and feels left out or pressured?” Addressing those in policy became something important to the company and its culture. That risk assessment, that activity of sitting down and looking at what threats an activity present is key to what we do. If all of this risk assessment “thing” that we’ve been talking about seems a bit arcane and out there, remember, it can be for anything. Even a good Friday afternoon.
As a company principal, it’s important to realize that risk assessment is performed at every level of the organization and for every activity you do. You’ve been doing it instinctively most of the time. In your operations you consider, if I do this thing, what is the bad thing that might come of it? In my history, I’ve seen policies around margarita Fridays within an organization because there were inherent risks in having everybody have a good time on a Friday afternoon. And the company owner took the time to establish potential threats. Talking about things like, “What happens if someone has a bit too much and wants to drive home?” Ranging to, “What happens if somebody doesn’t want to participate and feels left out or pressured?” Addressing those in policy became something important to the company and its culture. That risk assessment, that activity of sitting down and looking at what threats an activity present is key to what we do. If all of this risk assessment “thing” that we’ve been talking about seems a bit arcane and out there, remember, it can be for anything. Even a good Friday afternoon.
Related Videos
3 Risk Assessment Methodologies
4 Ways to Treat Risk
A Typical Journey with Risk
Auditor Insight: The Top 3 Issues with Your Risk Assessment [WEBINAR]
Benefits of Risk Management
Business Environment
Cloud Services Are Assets with Risk
Communicating Risk Assessment Results
Create an Assessment Together
Creating Unity Through Risk Assessment
Cyber Threat Intelligence
Defining Likelihood and Impact
Defining Risk, Threat and Vulnerability
Definitions for Risk Assessment Components
Determining Impact to Your Assets
Do You Have to Do PCI?
Does Zero Risk Exist
Don't Discount Likelihood
Evaluating Likelihood and Impact
Getting Started with PCI Compliance
HIPAA Risk Analysis
HIPAA Safe Harbor
HIPAA and Risk Analysis
HITRUST and Risk Assessment
How Much Time Does An Assessment Take?
How Often Should We Assess Risk
How to Define Your Scope
ISO 27001 Clause 6.1.1
ISO 27001 Clause 6.1.2
ISO 27001 Risk Assessment Documentation
Identify Your Assets
Industry Standards for Risk Assessment
Introduction to NIST SP 800-30
Introduction to NIST SP 800-39
Just start!
Monitoring Changing Risk
NIST CSF Identify Function
Overview of Environmental Risk
PCI Compliance One Step at a Time
PCI DSS and Risk Assessment
PCI v3.2.1 vs. PCI 4.0: What's Changed?
PCI v4.0 - 3.1.1 & 3.1.2: Have Requirement 3 Policies and Procedures Assigned and In Place
PCI v4.0 - 3.2.1: Only Retain the Minimum Account Data Needed
PCI v4.0 - 3.3.1, 3.3.1.1, 3.3.1.2, & 3.3.1.3: Do Not Retain Any Sensitive Authentication Data
PCI v4.0 - 3.3.2: Encrypt Sensitive Authentication Data If Retained for Any Length of TIme
PCI v4.0 - 3.3.3: (Issuers Only) Store Only the Minimum Amount of Sensitive Authentication Data Needed
PCI v4.0 - 3.4.1: Mask Displayed Primary Account Number
PCI v4.0 - 3.4.2: Do Not Allow Primary Account Numbers to Be Copied When Using Remote Access
PCI v4.0 - 3.5.1.1: Ensure All Hashes Are Keyed
PCI v4.0 - 3.5.1.2: Correctly Utilize Disk-Level Encryption of Primary Account Numbers
PCI v4.0 - 3.5.1.3: Ensure Disk-Level Encryption Meets Requirements
PCI v4.0 - 3.5.1: Store Primary Account Numbers Appropriately
PCI v4.0 - 3.6.1.1: (Service Providers) Document and Describe the Cryptographic Architecture
PCI v4.0 - 3.6.1.3 & 3.6.1.4: Use Fewest Possible Custodians and Locations for Cryptographic Keys
PCI v4.0 - 3.6.1: Use Fewest Possible Number of Key Custodians Locations and Forms
PCI v4.0 - 3.7.1: Utilize Procedures to Generate Strong Cryptographic Keys
PCI v4.0 - 3.7.2 & 3.7.3: Implement Policies and Procedures to Safely Distribute and Store Keys
PCI v4.0 - 3.7.4: Define Cryptoperiods in Policies and Procedures for Key Management
PCI v4.0 - 3.7.5: Properly Retire Replace or Destroy Keys When Appropriate
PCI v4.0 - 3.7.6: Use Split Knowledge and Dual Control for Manual Cleartext Key Management
PCI v4.0 - 3.7.7: Do Not Allow Unauthorized Key Substitution
PCI v4.0 - 3.7.8: Require Key Custodians to Acknowledge and Accept Their Responsibilities
PCI v4.0 - 4.1.1 & 4.1.2: Have Requirement 4 Policies and Procedures Assigned and In Place
PCI v4.0 - 4.2.1.1: Maintain Inventory of Trusted Keys and Certificates
PCI v4.0 - 4.2.1.2: Utilize Strong Cryptography When Transmitting Primary Account Numbers on Wireless Networks
PCI v4.0 - 4.2.1: Properly Secure Primary Account Numbers During Transmission
PCI v4.0 - 4.2.2: Secure Primary Account Numbers When Transmitting via End User Messaging
Partner With Risk Assessment Experts
Partner with a Risk Assessment Expert
Penetration Testing for AWS Segmentation Controls
Personnel Risk
Preparing for a Risk Assessment
Protect Your Data with PCI DSS
Ranking Risk
Register for a Risk Assessment Workshop
Risk Assessment Obstacles
Risk Assessment Policy
Risk Assessment Requirements
Risk Management Strategy
Risk Treatment for ISO 27001
Should I Share Our Risk Assessment
Six Types of Risk
Step One for Risk Assessment
The Assessment of Fraud for SOC 2
The Importance of a Gap Analysis
Thinking About Likelihood and Impact
Third Parties are Threats Too
Three Types of Controls
Tips for Getting Started with Risk Assessment
Types of Assets to Consider
Understanding NIST SP 800-39
Using Your Risk Assessment Results
What Are The Steps to Risk Assessment
What Does An Auditor Want In Our Risk Assessment
What Is the Process for Risk Assessment
What Risk Assessment Documentation is Necessary
What Risk Assessment Method is Appropriate
What Should Be Included in Your Risk Assessment
What Threats Should Be Considered
What are Threats
What is Scoping
What's the Point of PCI DSS?
Who Should Be Involved in the Assessment
Who is Involved in a Risk Assessment
Why Risk Assessment?
You're Already Assessing Risk
