Transcript

STEVE: And actually, I love that you're kind of segwaying to, you know, how do I articulate the essence of what GRC is and evaluate as? Because that relates, I had a backup course title and it was "Cover Your Assets" with a T in parentheses, right? And so I didn't coin that myself. I got it actually from a lawyer colleague because we're talking about due diligence and due care.

And I think maybe if we think about all the different things that we do, we have a compass to make decisions, right? But maybe it always comes back to due diligence and due care. Because if I look at my colleagues, the cool red team pen testers, the engineer blue team, who is just the backbone of our defenses, they've got cooler jobs, but they really do need me for due diligence and due care, right?

And I don't want a baseball team of all pitchers or all shortstops. They have their specific skills. And in GRC, we're measuring, we're testing, we're documenting, and we can help the team have defensible compliance. Due diligence, due care. So I don't know. I think that's actually really what it all boils down to. It's about cover your assets, due diligence, due care. It's kind of where I've landed, but like a mentor check in here. Like, how am I doing? Can you help me with my blind spots? Is that what it's all about for you? Or maybe we should take it in a different direction.

GERRY: No, I mean, cover your assets is certainly a funny alternative title to the course. But I do think it is a little myopic. And I mean this in a very constructive way, Steve. I think I love your analogy of you can't have all pitchers on the team. Or you can have one basketball superstar on the team, but he's not going to take on all five other players on the other team. You need someone to facilitate. You need someone to block, right?

STEVE: Yep.

GERRY: So everyone's got their roles. And I think that one of the, you do come in initially, especially at new organizations that are just cutting teeth on cybersecurity from a, oh, we need someone to answer these questionnaires, or we had some small breach and we need to hire someone. And a lot of times it is kind of a Jack or Jill of all trades. And they typically kind of fall into the GRC vein because the immediate need for actionable tasking is responding to external requests and stuff like this.

But one thing that I guess is the one blind spot that I guess kind of jumped into my mind is I'd almost like to think of, sticking with the sports analogy, I'd almost like to think of the GRC person as either the coach of the football team, like a hybrid coach quarterback. And actually, you know what? Being Canadian, Steve, I'm going to take this back because if you're younger, you might not know this. It wasn't uncommon in hockey, pro hockey, years ago for the coach of the team to also play on the team. Do you remember how that was popular in the 70s?

STEVE: Sorry to do this to you, Jerry. I need to check with my dad. Oh, my God. Okay, so I guess I'm aging myself. But anyways, like Mike Milbury, for example, was coach of the Bruins and a player at the same time. Anyways, the point is that... Don Cherry was a coach and a player with the Bruins.

GERRY: Okay. Yeah, yeah, yeah. Okay, so exactly. So maybe I'm confusing those two, but it wasn't super common, but it did happen.

Anyways, let me tie it all together. This is why GRC has a value add that people really should clue in on, right? So the SOC analyst, the engineer, the backbone of the program, yeah, they're killing it. They got their eyes on the wire and they're basically stiff arming threat actors out and hitting the quarantine button and all these other things. But why do they have the quarantine button? Why do they have the ability to see what's on the wire? It's because likely an architect or a GRC professional went and said, they did an audit. They did an assessment of their environment. Where are our blind spots?

And remember, Steve and student, you only have so much money, right? You're a cost center. You're not gonna get infinite budget. So if your boss says, or your business says, listen, we'll give you $100,000 to secure all of us. Well, guess what? You're not closing all the doors for $100,000, like spoiler alert. So now where do you invest that money? Where do you get your highest value risk reduction return on your finite investment of a hundred grand, or you get 20 hours of this IT professional a week, right? It could be a human resource constraint.

So now you tell me, right? Like, okay, we're going to invest everything in DLP because we're afraid of secrets being stolen. Good luck because now you don't have an MFA capability. You don't have centralized patch management capabilities. You don't have awareness training. You're shooting yourself in the leg, right?

So this to me is like, mad value because yes, the executing of the play itself, the running of the play, that's cool. And that's where all the action is. And that's where you do the highlights and instant replays. But who called the play? Why do you have those players on the team on the field at that moment? That was the brain. That was the strategy that went into the decision that allowed that transaction to execute. It allowed that process or business operation to exist in the first place. And this is the real value of GRC, among all the other things that we've talked about.

STEVE: I think that's a perfect segue. I love that you brought up DLP with other solutions there and how to prioritize those. All of the solutions come up in the course, and there's a deep dive on DLP. I think I'm inspired. I'm fired up. I want to learn more about risk to help be that compass. This all makes sense to me coming from accounting, right? You want to be a compass, help make decisions, and we can do that too from a cyber risk perspective. So thank you, Jerry. And I look forward to your cameos in other lessons.

GERRY: Yeah, thanks a lot.