CyberRisk Collaborative

VP, Cybersecurity Programs and Content

Headshot for Tom Scurrah from HubSpot

Security Staff Acquisition & Development

Virtual Briefing

Archived: Security Metrics in the Boardroom and in the Backroom

Vulnerability Management

Archived: A CISO’s Guide to Effective Vulnerability Management

<body>
With the potential of cost savings, reduced operational complexities, and speed to market, many organizations are migrating from on-premises and third-party data centers to Cloud computing environments.  However, accompanying these “cloud first” strategies are many challenges that include protecting confidential data and operating new security technologies.     In this CISO Stories webinar, panelists share their experiences about migrating to and managing the security of Cloud environments. Guidance tools developed by a cross sector task force of CISOs are shared as well, highlighting:    • Overview of Cloud services and Cloud Service Providers  • Best Practices for migrating to the Cloud  • Tools and services for managing the security of Cloud environments  • Methods for protecting tenant data  • Defining security roles and responsibilities for the tenant and Cloud Service Provider  • Managing shadow IT Cloud implementations     Join us for key insights and tools to help your organization effectively address security requirements in cloud computing environments.
</body>

Cloud Security

Cybercast

Archived: A CISOs Guide to Effective Security Practices in Cloud Computing Environments

<body>
The secure and efficient administration of user and technology identities across multiple Cloud and on-premises environments has been a challenge for organizations. Consequently, many CISOs are examining new Identity Governance and Administration (IGA) platforms and authentication mechanisms, which will involve large investments and implementation support.



In this CISO Stories webinar, panelists share their experiences dealing with IAM challenges, planned architectures, and technology optimization. They will also discuss best practices and tools developed by a cross sector task force of CISOs, highlighting:



• Effective IAM technologies and practices for the Cloud and hybrid environments • Rearchitecting IAM • Artificial Intelligence as an enabler and risk • Managing privileged users • Conducting access reviews effectively and efficiently • Identity and access management for mergers and acquisitions • Zero Trust



Join us for key insights and tools to help your organization improve the effectiveness of your IAM practices and technologies.
</body>

Identity

IAM Technologies

Archived: A CISOs Guide to Effective Identity & Access Management (IAM) Practices and Technologies

<body>
A Third-Party Risk Management Implementation Guide and Toolkit Third parties, whether they provide software or services to an organization, can introduce significant security risks, including ransomware, software vulnerabilities, loss of services, and breaches of confidential information. For this reason, companies have established third party risk management (TPRM) processes and dedicated staff to evaluating the security postures of existing and potential third parties. In this CISO Stories webinar, panelists share their experiences dealing with managing security risks in third party software and services. They will also discuss best practices and tools developed by a cross sector task force of CISOs, highlighting:



• A six-phase third party risk management program lifecycle whose steps are critical to a successful third-party risk management program, including (supplier identification, classification, assessment, management, monitoring, and relationship termination) • A TPRM Standard • A TPRM Program Workbook (supplier inventory and automated security questionnaire) • Strategies for addressing new supplier threats and regulations



Join us for key insights and tools to help your organization improve the effectiveness of your Third-Party Risk Management Program.
</body>

Risk Assessments/Management

Archived: A Third-Party Risk Management Implementation Guide and Toolkit

<body>
Securing Operational Technology is a challenge for many organizations that depend on the continual availability of ICS/SCADA systems to manufacture their products. For example, maintenance windows for security patches are often hard to find and raise concerns about ““breaking”” systems. Furthermore, OT systems require Internet access and, therefore, are vulnerable to threat actors who are often nation-states. 



In this CISO Stories webinar, panelists share their experiences dealing with the security of OT in their organizations. They will also discuss best practices and tools developed by a cross sector task force of CISOs, highlighting:



<ul class="wp-block-list">
<li>Gaining senior management support for OT security</li>



<li>Organizing an incident response process</li>



<li>Improving the security of suppliers providing OT equipment and systems</li>



<li>Current and proposed OT security regulations and standards</li>



<li>Addressing technical debt</li>



<li>Effective security controls and compensating controls</li>
</ul>



Join us for key insights and tools to help your organization improve the security of your Operational Technology environment.  
</body>

Security Operations

Archived: A CISO’s Guide to Effective Operational Technology (OT) Security Practices

<body>
By operating Records &amp; Information Management (RIM) functions, data security and lifecycle management practices have been employed by organizations even before computing became the norm.  However, these practices are continually stretched to keep pace with new technologies, like AI, which can pose threats to data confidentiality and integrity — at its source, in how it is used, and the validity of outcomes.   In this CISO Stories webinar, panelists share their experiences dealing with data management challenges on different platforms and expanding technologies, like AI. They will also discuss best practices and tools developed by a cross sector task force of CISOs, highlighting:



<ul class="wp-block-list">
<li>Data discovery methods.</li>



<li>Data classification methods.</li>



<li>Data protection controls, including encryption, DLP, and access management.</li>



<li>Data lifecycle management practices, including generation, acquisition, processing, storage, use, retention, and destruction.</li>



<li>The impact of regulations on data privacy, security, and regionalization.</li>



<li>Data governance practices for AI, including addressing confidentiality and integrity concerns and the need for data lineage management.</li>



<li>Data governance practices for different technology platforms, including Cloud, end-user messaging, shared file locations, and social media posts.</li>



<li>Managing third-party data use.</li>



<li>Data governance tools.</li>
</ul>



Join us for key insights and tools to help your organization improve your data governance practices.



<figure class="wp-block-image size-full is-resized"><img loading="lazy" decoding="async" width="2696" height="1414" src="https://cms.cyberriskalliance.com/wp-content/uploads/2024/05/Spirion-Logo-update-2.png" alt="" class="wp-image-721407" style="width:422px;height:auto"></figure>
</body>

AI/ML

Archived: A CISOs Guide to Data Governance at the Dawn of AI

<body>
CISOs strive to develop and use security metrics as an objective way to: (1) portray the state of their security programs; and (2) effect positive change to security controls, like patching within SLAs and improving phishing email awareness. However, they are challenged by data collection difficulties, limitations of reporting tools, and uncertainties about what metrics are relevant for different audiences (e.g., board, management, IT and security personnel).



During this month of CISO Stories, practitioners will share their experiences and challenges with implementing a cybersecurity metrics program. Guidance and tools developed by a cross sector task force of CISOs are shared as well, highlighting:



<ul class="wp-block-list">
<li>The Cybersecurity Collaborative Security Metrics Framework</li>



<li>Criteria for an effective security metric</li>



<li>Methods for metrics reporting and decision-making</li>



<li>Guidance for initiating a metrics program</li>



<li>Strategies for expanding the program</li>



<li>Tools for collecting and reporting metrics</li>



<li>The Cybersecurity Collaborative Security Metrics Workbook (working metrics examples)</li>
</ul>



Practitioners will also connect the dots on how such metrics should be used to continuously improve identity, application, cloud and network security, anti-ransomware efforts, zero trust, email security, threat intelligence, AI and third-party risk management.
</body>

Threat Intelligence

Archived: Building an effective cybersecurity metrics program

<body>
Vulnerability management remains an uphill challenge for security teams. In this month of CISO Stories, we look at the findings of a cross-sector task force of CISOs and staff who shared their challenges and best practices for developing effective vulnerability management practices. Topics include:



<ul class="wp-block-list">
<li>Managing vulnerabilities on premises, in the cloud, and in third-party environments</li>



<li>Identification, classification, prioritization, and remediation best practices</li>



<li>Standards and charters</li>



<li>Organizational structures</li>



<li>Scanning tools.</li>
</ul>



Supporting tools to be shared include a CISO’s Guide to Effective Vulnerabilities; and a Vulnerability Management Maturity Checklist.



Practitioners will also connect the dots on how effective vulnerability management can be used to continuously improve identity, application, cloud and network security, anti-ransomware efforts, zero trust, email security, threat intelligence, AI and third-party risk management.
</body>

Vulnerability management remains an uphill challenge for security teams. In this month of CISO Stories, we look at the findings of a cross-sector task force of CISOs and staff who shared their challenges and best practices for developing effective vulnerability management practices. Topics include:
<ul>
<li>Managing vulnerabilities on premises, in the cloud, and in third-party environments</li>
<li>Identification, classification, prioritization, and remediation best practices</li>
<li>Standards and charters</li>
<li>Organizational structures</li>
<li>Scanning tools.</li>
</ul>
Supporting tools to be shared include a CISO’s Guide to Effective Vulnerabilities; and a Vulnerability Management Maturity Checklist.
Practitioners will also connect the dots on how effective vulnerability management can be used to continuously improve identity, application, cloud and network security, anti-ransomware efforts, zero trust, email security, threat intelligence, AI and third-party risk management.