What are key elements of risk-based cybersecurity management?
The answers emphasize prioritization, mapping objectives to risks, governance, layered controls, and continuous monitoring, though they differ on whether governance or technical processes are most foundational.
5 answers
Answers
James J Azar
Chief Information Security Officer · Artera Services
Prioritization, Controls, Monitoring
James J. Azar says risk-based security requires prioritization by exploitation, business impact, exposure and privileges, compensating controls and containment when no patch exists, and continuous monitoring, since patching alone can't address chained zero-days.
CISO Talk by James Azar · CISO Talk by James Azar · Read
Heather Ceylan
SVP & Chief Information Security Officer · Box
Map Priorities to Risks
Heather Ceylan says her security team maps all of its core objectives and priorities to one of its top risks, because if a priority isn't mitigating a top risk, she asks why it's there.
Security Weekly - A CRA Resource · Watch on YouTube
Brennan Baybeck
SVP & CISO - Customer Success Services · Oracle
Governance
Brennan Baybeck says governance is foundational and critical, citing a continued lack of strong governance for AI services and functions among customers.
SiliconANGLE theCUBE · Watch on YouTube
Mayank Agarwal
Head of Cyber Security, America · Infosys
Reveal, Remediate, Recover
Mayank Agarwal lays out a three-step process: remediate whatever you can, put compensating controls in place for what you can't remediate, and third, for cyber resiliency, get back up and running if anything happens.
SiliconANGLE theCUBE · Watch on YouTube
Dr. Justin Ubert
Division Chief (Component CISO) · U.S. Department Of Transportation
Contextualization and Threat Hunting
Dr. Justin Ubert says the two pillars are contextualization of vulnerabilities and threat hunting across all the signal from the environment, which he calls a modern approach and a modernization of cybersecurity itself.
Fed Gov Today · Watch on YouTube
