03 - Strictly Business: Why Security Is Always a Risk Management Function

Um, thank you very much Jason Murray for coming to talk about Strictly Business, why security is always a risk management function. >> So, let me see if I notice anybody that I recognize before I spoke here not here previous location about eight years ago. So, let's get going. We only got 25 minutes together. I uh would like to thank the people who selected this talk because it's a little bit out of the ordinary with like Bides tends to be quite deep and technical. The last one we we we risked the demo gods and it worked. Okay, he came out okay. I'm going to be stepping way back and way up and talking more about what what's the

motivating factor for why we're doing what we're doing, everything that we're doing within our profession, why we do it this way. [snorts] So, if you take a look, if you go if you go deep, there's a bunch of words that you could use to describe information security. Anyone got any favorites in there? Don't don't attach any meaning to the relative size. This was just throw stuff up there and capture some stuff. There's a lot of frameworks, there's a lot of standards, there's a lot of news, there's a lot of hype, there's a lot of stuff. And lately, it looks a lot more like this, right? AI is saturating everything. Are we all a little sick of

it yet? Yeah, I noticed there was only a couple AI talks here today. If you want AI, go to sector. I'm sure you'll be getting enough plenty of AI there. Um, I'll be there on Wednesday manning me a Rancia booth if you want to come and see me. Um, but even even this apparently we're supposed to call it super intelligence now, not not artificial intelligence. Well, just like the lake south of us is still called Lake Ontario. I'm going to still call it AI. Um because to quote a a to quote Shakespeare a roses arose a rose and while we're misquing famous dead people I borrowed this from Milton Freriedman as an inspiration for summing

up what this talk is about. This is my thesis my operating thesis for why I do what I do and what's motivated me for at least 15 years and that is that security is always and everywhere a riskmanagement function. There's lots of stuff we do underneath that statement, but it all ties back to this. So, let's dive in. Is our security program working? How would we answer that? Do you ever get asked this? And how do you answer it? Is it working? Are we more secure? So, some ways that I've seen answered. Oh, so first of all, uh you may not see the gray in my hair, but that's cuz I'm blonde. It's there. I've

been at this for close to 30 years. Um, spent a lot of my time in consulting, but before that I was in the trenches at a company called Telus, if anyone Oh, excuse me. Clearet, if anyone remembers them. Um, that's where I first started cutting my teeth. So, I hope you don't think that I'm just an old guy blowing smoke out my butt, but when I go out there, this is what I see people trying to answer to their board or their senior level team about questions like, "Is the security program working?" Well, we passed our audit. Okay, that's great. How many have been through an audit and think that that's that's good. Is that sufficient?

Yeah, it's sufficient. No. Okay, I thought you were agreeing. It's like, no, that's not sufficient. Yeah, the attackers don't care about your sock, too. They're just going to eat right through it. Um, we haven't had a breach. Okay, that's good that you know of, right? Maybe maybe you have and you just haven't discovered it yet. Or maybe you haven't had a breach. But regardless of which way that falls, um the absence of that, this is just ev that's just absence of evidence. It doesn't necessarily mean that you're going to withstand the next breach or the vulnerability apocalypse that apparently Geni is throwing at us. Um our maturity scores have improved. I keep hearing this one more and more and it seems like

a lot of senior leaders in business want to boil down security into one number like our security is 3.5. But what out of what? And what are the units out of 10? What is the security units? Like what are we talking about here? Um and if you took a given framework and figured out how to do math on the framework and then man managed to increase your maturity, did you actually reduce your risk? Which is really what mo matters at the end of the day. I have a whole three-hour talk that I could give on that one. Um and who works in healthcare? Yeah, your profess your your your industry is particularly obsessed with maturity scores.

So rather than this, I have hit upon this. I I think this sums it up really nicely. Now I recently read this book by Rick Howard. Um, for anyone who doesn't know the name Rick Howard, he's the unit 42 guy. He's the cyber security cannon book list guy. He's been around. He's he's done a lot of things. So, he wrote this book and I was like, "Sure, okay, let's read it." And actually, it was really good. Uh, I gave it four out of five stars. Usually, people who write titles like this are overblown windbags, right? Like, oh, I'm going to single-handedly recreate cyber security because we're all doing it wrong. Now he he doesn't quite go that

far but the first principle that he trots out in this book that he uses it as a structure for the whole book is this statement and that is we are simply trying to reduce simply reduce the probability of a material cyber event in the next business cycle. So, let's pick apart some of these words here. Probability of a material of the probability. [snorts] We're not going to turn this into a probability and stats talk. Um, but how many people have done threat modeling and things like that? And you'll get or or tabletop exercises and you'll get the one guy in the room or girl all in the room who gets up with these crazy movie

plot ideas. Okay, is it possible? Well, yes, it's possible. But is it probable? Right? like let's talk about the balance of probabilities of whether we should actually focus on these things or not. I'll jump to the end of the statement here and talk about the business cycle. So what's the business cycle? Um a lot of you probably have an audit cycle that you have to comply with annually roughly. Um some of you might have a business cycle that's more aligned to a budget cycle of say two years. Back to the health care thing. Now you have a reporting obligation because of EDSA which was what was bill 194 became EDSTA. That's every two years you're

supposed to report to the ministry, right? So you have a cycle that you can frame this around. Um you have some flexibility. But let's pick a little bit more into material. And this is the one where I think a lot of people get caught up on and why I'm going to hang why I hang a lot of things around risk management. So let's jump into material. Materiality requires business understanding. How many have heard this before? You need to speak the language of business. What's the language of business? It's not PowerPoint. It's money and probabilities. What's the likelihood of something happening and what are we going to do about it? But even before we get there,

we need to understand what's important to the business. And I'm using the term business loosely here. You all probably are involved in some kind of organization and that organization does something for its customers or constituents or what have what have you, right? Um if you're working for a nonprofit, customers is not necessarily the best fit, but the concept still works. You're in an organization that exists for a reason and to deliver that purpose out to its constituents. But what's what's important to that organization? While materiality is something that you need to figure out, right? What assets if compromised would cause existential damage to the organization and now you can't do what you want to do. Maybe permanently, maybe

for a long ter maybe for a long time, maybe for a short time. Um, operations, what would stop your your business from functioning? And this is not necessarily just for let's take a for-profit business. This is not necessarily for-profit stuff, right? If the payroll system goes down, who's showing up for work. Some people will, but you need to make sure some of this other operational stuff stays stays up and running. Now, payroll, we outsource that to ADT. Yeah. So does 80% of the businesses out there. So now you have a concentration of risk problem. You still have to pay attention to it. Regulatory, I'm willing to bet that most people in the room work for

well, let let's say 50/50. half the people in the room work for some kind of company that has some kind of regulatory obligation, especially if you're in finance, health, that's getting better, that's getting more difficult. Um, that's going to have an impact on what materiality means. And reputation, this is the one that gets senior leaders all up in arms about it. Oh, we don't want the dam, we don't want the brand to be damaged. We don't want the brand to be damaged. Okay, but there's breaches every single week. And those businesses don't go out of business. they rebound and they continue and they may take a hit and their stock price may take a hit

and their share value or their their their market share may take a hit but they rebound back. So that's some things that we can think about when it comes to materiality. Now how who's familiar with that term materiality? It's it's a finance kind of term. They talk about it that way. We might know it as risk appetite. That's kind of a more general term that we use in the industry to to to reflect, okay, well, what exactly is the business comfortable with? Right now, this is a perpetual frustration of mine as a consultant because I ask this question and I'm asking it of it or infosc and they're afraid to talk to the business. But

let's break down the div division of the rules, right? So, what's security's role here? I'm not going to read this stuff to you. you can read it and if you want the presentation, hit me up on I my QR codes up. Hit me up and I I'll send it to you. Um really we're there to explore and illuminate the risks and communicate them as effectively as we can so that the business can make decisions on what it wants to do. That's really what it comes down to. That's where we fit in here. We fit in here this way the best because we can use risk as our foundation and we can ask these types of questions to

demonstrate is the security program working. Did we reduce probability of a material impact? Oh, there's an echo of that statement from before, right? Did we reduce the probability of impact? [snorts] What was our risk posture last year versus this year? Your controls maybe got better. Maybe they got better implemented. Maybe your processes get better, but the bad guys don't sleep and that changed too, right? Your vulnerability management program from two years ago isn't going to work very well in today's threat environment. Did you change that? So, that is your risk posture just changed because you didn't change to to to adjust. But you can ask these questions and get answers. And what's our residual risk? So, we did

a risk assessment. We found out this is what we're going to do. We're going to make these controls residual risk. Leadership okay with this? Did they approve the budget? Are they accepting it knowingly? [snorts] Now, that's a back to this slide. That's leadership's responsibility, not our responsibility. We communicate it. We accept the decision and off we go. If you're not happy and you think the business is accepting too much risk, security isn't where you need to be. It's somewhere else in the business making those shots and pulling and making those calls. resign yourself to that. Okay, so this sets the stage. So let's ask like I I practice out there. A lot of you people

are out there in the field right now. Is this how it's working? I'd say no, not very well. Why higher education? So here's a sampling of some educational institutions at the excuse me, different levels that offer wonderful courses on information security, cyber security, whatever you want to call it. All right. Can we go back to calling it information security, please? Can we can we? Because because cyber oh my god. Anyway, that's a different talk. Um, I can't put everything on here because there's so many schools that offer this now. And before anyone says, "Oh, Jason's saying uh the schools are teaching garbage." No, absolutely not. Uh, you go on LinkedIn because we have to, not because we want to. And we see

people asking questions like, "How do I break into cyber? go take one of these courses, go do the fundamental learning, right? How do I break into law? You go to law school. How do I break into cyber? You go get some education. The thing now that when I looked at this, there's a pattern. And the pattern is that all of those courses with a couple exceptions will have at least one course about how to run a risk management program and how to run a risk assessment and less so how to do a risk analysis. But none teaches you that risk is the glue holding it all together. I make this choice for this control because it

reduces the risk in this way. None of them teaches you that which is fine. They're heavily technically oriented degrees and programs and that's the frame that's the frame the the lens that they take to the world. The couple exceptions that I found were actually taught in conjunction with business and finance schools. So the business and finance programs tend to do in tend to introduce a little bit more of why would you do this? What's the function to the business of why you would why would you listen to the security guys who keep telling you to stop doing things? Why would you listen to them? Because it reduces your exposure to risk. All right. So certifications. How many have

some of these? Come on. All the hands have to go up. I know you all have something. Um, ISC and ISAC are the two big ones out there. Most people either have a CIS or a SISM. I have a CISP. I have a low I have a lowdigit CISP. I also have a C- risk. When you go through them, what you'll find is one of the however many domains usually talks about risk. And again, this is the same pattern every covers that risk teaches you how to run a risk process. You should run a risk management program. You should do risk assessments. You should do them. And this is what they look like. And then if

you go deep and go into like the C- risk, sorry, this one for instance, or this one, you'll learn six ways to Sunday how to do that, right? But they don't which one's better. I don't know. That's that that's up for you to decide. But they also, again, they do not they do not emphasize that this is why risk is why you're doing all the rest of the stuff. Thank you. All the rest of the stuff in your program. your information security management program. So, last bit, well, last last nitpick here. Frameworks. How many love their frameworks? We love a framework. Oh my god, we love a framework. Um, and I don't even have all of them on here that

week. Like, I could do three slides of frameworks, but the two big ones out there, ISO, very European, and NIST, very American. Um, I believe Canada has one. We just stole NIST and we put maple syrup on it and call it Canadian. But it's the they say they these ones here that I've labeled as the depth being deep meaning they speak very much throughout it about you should structure what we're saying in all of these controls around a risk management program ISO 2701 which usually is 2702 that everyone is focusing on. They go and implement the controls but completely omit the fact that why did we do this? Well, we should have done it because of a riskmanagement approach.

What's the risk to the business? How are we reducing it? How are we controlling it? Um the other ones have risk is kind of yet another control in the framework particularly with the CIS which doesn't have any of that actually. If you look in CIS which is a very popular one there's no risk control. There's implementation groups and you can ask me later how I what I think about those. So look at the same pattern right the deep frameworks I'm making the statement that risk is the architecture that you're supposed to build it all around the moderate frameworks risk is one of the controls but it doesn't matter how deeply a framework integrates risk if

the people us implementing it we're never taught that risk is the point because you're going to go and you're going to do the checklist thing because you're you're busy right you're busy I just want to get these checklists done so that I can get through it so here's a cycle that perpetuates itself educ Education teaches the framework execution. Certification validates that you know the framework. The framework structure how it goes and then audit confirms this whole loop is running. But never in this loop have we actually asked what's material to this organization? Is what we're doing reducing the probability of a material cyber event in the next business cycle? So to sum up this loop

that's I'll restate my uh thesis which is that security is always and everywhere a riskmanagement function. It's the bridge between the security practice what most of us in this room are doing and the risk appetite of the business and it runs in both directions right the business has to communicate what its risk appetite is so that we can do our job well. I think that sometimes in our profession we're frustrated because we're not given very clear direction because the business is uh falling asleep on the job there. So Monday morning unless you're going to sector then this could be next Monday morning I'm going to ask you to this is my call to action. Think about one or two or all three of

these things. Next time someone talks to you about that's risky. Ask yourself who's it material to? What's the likelihood? Did that likelihood change for the better or for the worse? What's the impact going to be? Is it more expensive or less expensive? Did we buy insurance for it? Break down those risk factors. Two, you could translate one initiative that you're doing at work. So, whatever you're working on, take a look at it and go, okay, I'm I'm I'm going to implement this. And it might be I got one customer right now who wants to implement conditional access controls in their Entra ID. And I'm thinking, okay, why? What risk is it addressing? You're going to go through this work.

You're going to cause a lot of hassle. You're going to create a lot of tickets at help desk. What's the benefit? Right? What risk is it address is it addressing? Let's make it concrete so that when the senior man when management comes down on your head, you can say, "No, I did this for this reason. It addresses this risk. If we don't do it, this is the likelihood if we do do it, we're doing this." Three, evaluate one framework honestly. So pick your framework that you are using and the stuff that you're doing to close out the gaps in the framework. Maybe some of you have been audited recently and you have a lot of audit findings. Okay. When

you're closing out an audit finding, evaluate it from a risk perspective. What risk reduction is this work actually cause is actually resulting in? And maybe it's not. That's fair too. But at least you know we're doing this because it's an audit finding and it's an obligation rather than a risk reduction because we're not getting out of the audit cycle anytime soon. We're going to have these obligations, right? So we need to know whether in my opinion we need to know whether the work we're putting there is towards meeting an obligation or reducing the risk and increasing the safety of the business. One five minutes. All right. So I'll put this up here. I'm not trying to

What's the phrase for QR fishing? Quishing. >> I'm not trying to do that. Those are my uh if you go to only one, just go to the Substack one. That's the best one. I write there. I write in this kind of vein. Um so I I had an example here to use of how we might break down something, but I I touched on it earlier, which is the vulnerability management one. So nine months ago or whenever it was before the the mythos moment vulnerability management was really triaged around was really about volume right how fast can I patch this stuff and can I keep pace with the vulnerabilities that are coming out well okay that changed should we panic

what should we do instead what changed in the risk equation now I'm hinting at something here that I haven't spoken about which is fair. Who's heard of fair? Okay, if you haven't, go look it up. Factor analysis of information risk. It takes likelihood and impact and breaks it down further. It's very useful for you to conceptualize and think about how you might um deconstruct something like this. So, the velocity of the number of vulnerabilities found just went through the roof and it's not going to come down anytime soon. So, what should you do instead? You can't patch. You can't keep up that way. What could you do instead? Well, we could maybe increase our resources towards triaging and make sure

that we only patch the things that are really critical based on I don't know ex actually being exploited in the wild. Fortunately, KEV does that or that we probabilistically think are being exploited. Well, fortunately EPSS does that. So we can move away from a CVSs score as a risk score and towards other things to actually help reduce the risk thereby reducing the material impact the probability of a excuse me the probability of a material impact over the next business cycle. With that thank you. Any any questions? [applause]

And I don't think I'm sticking around unfortunately, but I will be like, hit me up here. LinkedIn is fine. Connect, ask me anything you want. And I will be at sector on Wednesday if you're going to be there as well. I'll be I work for our rans. So come by the booth. Thank you very much for your presentation. Since I assume most of the people in this room are on the technical side either within IT or cyber security, >> if they do find a vulnerability and trying to map it or try to convert a vulnerability to a risk and determining whether that risk is material, how would they do so? Because from from my experience, just because an IT person

or a cyber security person thinks it's material doesn't necessarily mean that it's actually material. >> Absolutely. So the two things that I think that you could lean on is don't just look at the CBSS score anymore. That that ship has sailed. In fact, uh I can't I think it's CISA in the States actually issued new guidance that said we're not going to look just at CVSS scores. You need to go look at the KEV status of a vulnerability. You need to go look at other things like the exploit prediction scoring system, the EPSS. Figure out what the actual impact might be. Now, what hap the the shortcoming for you in the trenches as it you found

the vulnerability, you don't necessarily know what the materiality of that is to the business because you don't know the importance of the asset necessarily nor is nor does that your responsibility to know that, right? you're there for the care and feeding and patching of this database or this system or whatever. Nothing wrong with that. You need to someone else though in the chain hopefully has done some kind of business impact analysis and understands what the relevance is to that system because the question you didn't really ask but you're hinting at is okay I found this vulnerability it's exploited in the wild it's very likely to be exploited in the wild okay but so what is it an important

system or is it Is it this projector, right? Yeah. Yeah. So, someone else up the chain has to make a call on some kind of change advisory board based on the more useful information that you just provided. I hope that answers your question.

>> Yeah. Yeah. Yeah. Yeah.

try to >> Yeah, >> I I I agree with that that it is I see a lot of people also who come up through the IT and reach kind of more senior levels of management, but they've been um we'll call them technologists for a long time and they still love their toys and they're not able haven't necessarily communicated it effectively and to the point where I've seen it also where they okay we got to get the board presentation together and they're afraid to report stuff to the board like your job is to communicate to the board communicate to the board oh they might ask me questions uh duh >> can we have one more question

>> and um if you can just disconnect your computer whilst you answer >> thank you >> a quick question Jason and since you mentioned fair and uh all the other presentations so I I I realize guys where you settle in terms of quantitative versus qualitative. Uh any thoughts around how to uh get the business to stop looking at red, yellow, green and start looking at probabilities and dollars. [sighs] I'll come back next year with a talk on that. Um seriously, it's a it's it's a it's I've been struggling with it for a while because um there's an excellent book that just got published by I can't remember his last name. First name is to interrupt.

>> Yeah, >> because I have to catch you. >> Oh, it's catching sector. >> From heat maps to histograms. Go look up that book. >> Thank you. >> Thank you. >> Thank you. Byebye. [applause]