Study Notes: https://www.cpatocybersecurity.com/p/accrp-tprm

Transcript

An awesome new YouTube video just came out on the Simply Cyber channel. It's called "Learn to Assess Third-Party Risk" and it's Dr. Auger's walkthrough of a TryHackMe challenge. Very cool from TryHackMe to see in their Advent of Cyber program with different challenges on every day of Advent in 2024, giving a nod to GRC and having, I think it was on day nine, a challenge which is a vendor security questionnaire, which is something that is very typical for a GRC practitioner to perform. So it's a must watch to check out Dr. Auger's YouTube video.

And then in this lesson, I want to go through the concepts he covered and go deeper on them and apply them and align them to the course for that practical application to see how to use these in the field, these concepts. All right? So at the beginning, we've already covered this in terms of another name for third-party risk management is supply chain risk management, if we use the NIST-CSF terminology. And it's very important as the third parties we depend on get bigger and we're more dependent on them.

You've heard, we live in exponential times. And one of the drivers of risk here is complexity for cyber risk and the cyber risk related to third parties from trillions of lines of code and billions of devices with ubiquitous connectivity across the globe. Something we haven't covered is the concept of the Magnificent Seven. We touched on how in looking at security org design and kind of benchmarking the number of headcount in your organization that does cybersecurity to its revenue. We got that guidance from IONS and we showed how considering Salesforce.com with 300 GRC people and Equifax that hired a thousand InfoSec people, like it broke the mold. You can't apply that cookie cutter IANS template to every company, especially when you get into the tech titans.

And that is certainly the case with the Magnificent Seven where you might've heard of Fang, Facebook, Amazon, Netflix, Google, or then it turned into FANGM adding Microsoft. And now it's the Mag Seven where seven companies in the top 500 public listed companies in Standard & Poor's 500 index today account for 58% of the return on investment they yielded in 2023. So that is historically very high and shows a high degree of concentration risk in terms of typically the top 10 companies of those 500 account for 14% of the Standard & Poor's 500 return. We're talking about here, seven companies being 58%. So high dependence on third parties, especially when it comes to Alphabet, Amazon, Apple, Meta, Microsoft, NVIDIA, and Tesla. So that makes supply chain risk management more important and let's get right into it.

All right. So Dr. Auger starts the video with an intro of what is GRC. And for that component, I wanna show you my 49 second elevator pitch, which I'll play for you right now. To do good compliance work, we strive to be brief, be brilliant, be gone. In that spirit, here's what is GRC in less than 60 seconds. The G is for governance. Everyone knows the company's objectives and risk appetite and they make decisions that are aligned to it. Risk, we reliably achieve objectives because guardrails and due diligence are in place. Not to slow you down, the fastest cars have the best brakes. Compliance, we do what we say we do and can prove it. That's also called integrity, which is the foundation of everything.

Cool bonus sections, customer assurance, trust center, providing customers with trust and assurance through our cybersecurity compliance and audits, certifications, and security questionnaires. Supply chain risk management, that's where we do due diligence on our vendors. Security awareness, borrowing from Bauceron security, we get the sheepdog effect, taking employees from passive targets to active defenders.

All right, so up next, we've talked about how cybersecurity is hard and it's mission impossible to balance having infinite cyber threats with finite resources. And that's why we're adding value with our CRMAP process, prioritizing the top risk to focus on and showing reasonable due diligence and due care. Two key points to wrap our heads around this is, we talked about as an executive, you encounter infinite cyber risks that could impact your organization, but it's crucial to prioritize them effectively given your limited resources. And building on that, not only is it mission impossible in terms of having limited resources for an infinite challenge, you can't just write a check to buy down the risk. There's more to it, that's when we talked about widen your scope, right?

So Dr. Auger noted that even if you had infinite money, here's a blank check, go buck wild, you got a genie with three wishes, you know what you can't do? You can't buy all the security tools, you can't train all the staff, you can't keep staff who know what they're doing because they might go somewhere else. So infinite money doesn't equal infinite security. And this reminds me of project management when they talked about how a pregnancy always takes nine months, you can't throw money at that problem to speed it up. Or to quote Dr. Auger, you can't rack and stack security culture. And to quote Jamil Farshi from Equifax, security culture is not something you can just buy off the shelf and plug in. So that's why we talked about widening scope and as per our "Mastering Cyber Resilience" textbook and the book before it from one of the same authors, Kip Boyle, "Cyber Risk Management Needs a Comprehensive Assessment of People, Processes, Management, and Technology."

We can't just buy more tech; we need all of the elements considered to move the needle on cyber risk reduction. And then, on this idea of not having infinite money, we need to prioritize and we need to be reasonable, and that's where our zero to 10 score key is very helpful, trying to figure out the Goldilocks zone between too much security and friction and too little where we're too vulnerable and not demonstrating due diligence and due care. So that's why we have this legend and this risk to cost and control curve to help us be reasonable and repeatable and find something that is defensible in terms of the work we perform.

Next, Dr. Auger has a governance explainer. He talks about governance being the rules of the business and the attitude of the business, the tone from the top from management. We've talked about how cyber risk management is the perfect storm, and our cyber risk management action plan work provides the executive team with a compass to help steer through it. So it starts at the top. He then talks about how governance includes frameworks. He loves CSF and CIS Top 18 for smaller companies, and these allow you a repeatable mature process in order to grow into a mature InfoSec program. Make sure you're hitting comprehensively all of the elements of a cyber program, right? We've talked about the comprehensiveness that comes from baselining and benchmarking yourself into CSF, left and right of boom, all the subcategories or categories. Make sure you're looking at the people, process, and technology we were just talking about that, the four cylinders and the engine of cyber risk management and follow the simply cyber mantra, lather, inch, repeat to grow into a mature InfoSec program.

We've got our CRMAP check-ins every month, every quarter, every year, the summit, and that's about moving our capabilities up and to the right. Being comprehensive is key for demonstrable due diligence and due care. And we talked about how that comes up in the FTC safeguards rule for financial data. And that's important in a court of law and a court of public opinion to be able to say that the reason I think our program is comprehensive is because we align it to the NIST cybersecurity framework as industry best practices.