Thoughts on Breach of Trust vs. a Breach of Security
April 26, 2018
·
By
Peter Gregory ,
James Robinson
·
General thought: A breach of trust is different than a breach of security. Trust and security, while related, are very different from each other. In recent years, we have seen information security continuing to be defined with strong frameworks, guidelines, and support from regulators to security offices, while the concept of “trust” has just begun to emerge. In recent years we have seen Offices of Trust being defined in companies with the role of Chief Trust Officer.
Continue reading
Third-Party Breaches Will Continue Until Morale Improves
November 9, 2017
·
By
Peter Gregory
·
I have some bad news for you: breaches at third parties are not going to stop – not any time soon. Various studies show that somewhere between one-third and two-thirds of all breaches have their nexus in third-party service providers. Given the decade-long outsourcing trend that is not showing any signs of slowing down, this means that your organization has a decent chance of experiencing one directly or through one of your third parties.
Continue reading
Recovering From a Credential Breach, Part 2
August 10, 2017
·
By
Peter Gregory
·
Probably the most important step to take when a user suspects that his or her user account has been compromised is to notify the organization’s IT service desk. End users should notify the IT service desk right away in the event of the loss or theft of a laptop computer, tablet or smartphone.
Continue reading
Recovering From a Credential Breach, Part 1
August 3, 2017
·
By
Peter Gregory
·
A few years ago while on a business trip, I was out to dinner and left my luggage in my rental car (I had not yet checked in to my hotel). When I finished dinner and went back to my rental car, I found it had been broken into and my luggage was gone. My keyring with keys to my house, car and other places was in my luggage.
Continue reading
Control Maturity vs. Control Risk: A Client Discussion
July 18, 2017
·
By
Peter Gregory
·
A client for whom I serve as CISO advisor posed an interesting question to me last week, “What if we measure and report on control maturity instead of risk?” A productive and interesting discussion on the topic ensued over the next forty-five minutes. I had never before received this question, so I had to literally think on my feet.
Continue reading
Three Steps to Enhancing Your Third-Party Risk Program
April 6, 2017
·
By
Peter Gregory ,
James Robinson
·
In the world of third-party and vendor risk management, many new practices are being adopted. Over the past few weeks, members of Optiv’s third-party risk team have initiated conversations with key industry leaders through a series of roundtable discussions. These thought leaders own or participate in their organizations’ third-party strategies. During these sessions, we shared leading practices and principles, and identified a number of common trends.
Continue reading
OCC Updated Guidance on Third-Party Risk
March 16, 2017
·
By
Peter Gregory
·
Recently, the Office of the Comptroller of the Currency (OCC), released updated guidance for bank examiners as they scrutinize third-party risk programs in banks and other financial institutions.
Continue reading
What Makes Organizations Resilient and Why You Should Care
August 17, 2015
·
By
Peter Gregory
·
Information systems are inherently fragile. Operating systems and applications are very complex machinery, and considering how many changes (such as security patches and feature upgrades) are made, it should not be surprising to see how unstable they can be at times.
Continue reading
Why Wait for a Security Breach?
August 13, 2014
·
By
Peter Gregory
·
Headline-making security breaches have hardly faded away since the beginning of the year. Looking back on statements Neiman Marcus made to journalist Brian Krebs following their January 2014 breach might provide an answer as to why.
Continue reading
Recovery Capacity Objective: A New Metric for Business Continuity and Disaster Recovery Planning
June 17, 2014
·
By
Peter Gregory
·
Business continuity and disaster recovery planning professionals rely on well-known metrics that are used to drive planning of emergency operations procedures and continuity of operations procedures. These metrics are...
Continue reading
(10 Results)
