Identity at the Center #331 - RSM & IDAC Present - Risk Management & Digital Identity with Matt Franko
Feb 17, 2025
Matt Franko, Principal at RSM who leads cyber strategy and IAM work, joins to discuss where identity fits in risk management. They cover top attack vectors like phishing and weak passwords. Conversation touches on IAM ownership, limiting admin access, zero trust basics, AI and cloud impacts, and leadership lessons from coaching youth sports.
AI Snips
Chapters
Transcript
Episode notes
Security Is Risk Management
- Security is fundamentally a practice in risk management focused on reducing likelihood and impact of bad events.
- Matt Franko ties identity controls (MFA, strong auth, least privilege) directly to lowering phishing, weak-password, and BEC attack vectors.
Prioritize Attack Vectors Not Infinite Scenarios
- Build your risk view around attack vectors (phishing, internet exposures, wireless, physical) rather than exhaustive scenarios.
- Use NIST 800-30, MITRE ATT&CK and ISAC threat feeds to map your specific vectors and prioritize controls.
Measure Risk With Threats Vulnerabilities And Countermeasures
- Calculate risk using threats × vulnerabilities minus countermeasures, and prioritize by impact and likelihood.
- Map critical data/systems to impact and tie likelihood to industry, exposure, and open attack vectors before applying controls.