ciso thoughts

In my previous post, I discussed the ambiguous nature of cyber risk. There was some healthy engagement on the topic, and I thought I would continue from where I left off. In this two-part post I will explore some shortcomings of the cyber risk assessment practice and follow on by looking at when certain risk techniques should and should not be used. The Cyber Risk Assessment I’m going to start off with something that would be familiar to many of you: the risk workshop. For those that are unfamiliar, the basic premise of this risk activity is to bring people together to brainstorm ideas about “bad things that might happen”. These ideas are then typically prioritised on a company risk matrix (heat map) and later organised in a list, to be tracked and periodically communicated. This process, whether done in a group or an individual setting, is fairly typical of most cyber risk assessment methodologies. A typical cyber risk assessment methodology will look something like this: Identify ris

The more I learn, the more I realise how little I know. This is especially true for  risk . I have been practicing risk management (whatever that means) for a little over 10 years now. Even with this experience, risk still confuses me. You can hardly blame me; especially when the industry  itself  can't agree on what risk is. Take, for example, this list of risk definitions I compiled from industry sources. Not only does each standard have its own distinct way of describing risk, they each have their own way of calculating risk, too! Before going further, I want to briefly diverge and discuss where I see cyber risk in the broader risk picture. There’s a great HBR article by Robert Kaplan and Anette Mikes on risk strategy which I highly recommend (you can check it out  here ). In it, they discuss three broad categories of risks: Preventable Risks, External Risks and Strategic Risks. Each has their own distinct way of dealing with risk. Preventable risks  are those risks that arise f