Should Risk Lead GRC?

Apr 16, 2020

Marnie Wilking, Global Head of Security & Technology Risk Management at Wayfair, brings IRM experience aligning security to business goals. She discusses valuing assets before calculating likelihood. Conversations cover why risk is hard to quantify, getting stakeholder consensus, BIA-light workshops, and using risk to drive meaningful governance and compliance decisions.

Ask episode

AI Snips

Chapters

Transcript

Episode notes

INSIGHT

Start Risk With Asset Valuation

Risk should start with asset valuation rather than the textbook formula likelihood × impact.
Allan Alford reframes impact as the business value of an asset and risk as what happens when a threat touches that valued asset.

INSIGHT

Speak The Business Language Of Risk

Communicate security in the language of risk because the business understands risk more than technical controls.
Allan Alford emphasizes adopting enterprise risk models so security speaks ERM/IRM language instead of technical jargon.

ADVICE

Talk To The Business About C I A

Spend time with business leaders to learn what they worry about and translate those concerns into top-level risks tied to confidentiality, integrity, and availability.
Marnie Wilking advises mapping business concerns to C/I/A and using that to inform governance and controls.

Get the Snipd Podcast app to discover more snips from this episode

Get the app

All links and images for this episode can be found on CISO Series (https://cisoseries.com/defense-in-depth-should-risk-lead-grc/)

Defining risk for the business. Is that where a governance, risk, and compliance effort should begin? How does risk inform the other two, or does calculating risk take too long that you can't start with it?

Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Allan Alford (@AllanAlfordinTX). Our guest is Marnie Wilking (@mhwilking), global head of security & technology risk management, Wayfair.

Thanks to this week's podcast sponsor, Qualys.

Qualys is a pioneer and leading provider of cloud-based security and compliance solutions.

On this episode of Defense in Depth, you'll learn:

The model of risk = likelihood x impact doesn't take into account the value of assets. Assets have to be valued first before you calculate risk.
Is the reason risk isn't used to lead governance, risk, and compliance (GRC) because it's so darn hard to calculate? Many CISOs say their toughest job starting out is trying to understand what the crown jewels are and what the board's risk tolerance is.
Risk management allows the board to know when you have enough security. Some assets may require eight layers where others may only require one or two.
Determining likelihood of an attack involves a good amount of guesswork. We've discussed on a previous episode of CISO/Security Vendor Relationship Podcastthat we don't go back to see how good our risk predictions were. If you want to get better at it, you should. Otherwise, it will always be guesswork.
Even if you can get someone to agree what their risk tolerance is, or what asset is of importance, trying to get agreement among a group can be a blocker. Keep in mind that each person is going to have a different viewpoint and concerns.
Knowing risk appetite is critical. You can apply security controls without knowing it, but that's providing a unified security layer across all data, people, and applications when they are all not equal when it comes to asset valuation.