Combine Security Risk Management Components Into One Program

Primary benefits of the workshop to SGC: 1 - Opportunity to formally introduce concepts to senior management. It is often helpful when a third-p... Read More

Primary benefits of the workshop to SGC: 1 - Opportunity to formally introduce concepts to senior management. It is often helpful when a third-party is part of the communication 2 - Structured workshop "forced" the SGC Information Security & Assurance team to set aside dedicated time to consider the structured go forward within the cyber/IT risk domain and provided newest members of the team to further acclimate to the environment 3 - Opportunity to get experienced outside input Limitations: 1 - STRIDE approach will likely not be the methodology we focus on 2 - Spreadsheet-based tools are not where we think we want to go with things. We are primarily focused on mapping to the CIS control framework, they have a risk assessment toolset (RAM - risk assessment method) as well - but also spreadsheet based. If we were to settle on a spreadsheet-based toolset as a place to start we would focus on RAM. Due to this we focused more on process and then some surrounding documentation within the workshop Thank you. Read Less

I attended a workshop recently that was truly excellent. The leader, Fritz, had a deep understanding of our specific needs and was able to guide us... Read More

I attended a workshop recently that was truly excellent. The leader, Fritz, had a deep understanding of our specific needs and was able to guide us through the process of creating an enterprise risk management program with great speed and precision. I have been to many workshops in the past, but this one was definitely one of the best. Read Less

The Stride model and tool were not explained at the beginning of the sessions. I was not clear on the methodology or intended outcomes. The initi... Read More

The Stride model and tool were not explained at the beginning of the sessions. I was not clear on the methodology or intended outcomes. The initial spreadsheet tools were not formatted well and it appeared there were calculation errors. The scoring model is not apparent. The first-day session to evaluate risk tolerance was not well developed. The spreadsheet used for that did not make sense to me. The quantitative measures in the spreadsheets were actually qualitative. There is no way to determine or weight the schedule of financial impact with these spreadsheets. So any number provided for impact would be a subjective guess based on general risk scenarios. To perform a quantitative analysis of risk scenarios, a specific case with known financial and schedule impact is needed with weighting criteria. The value in this exercise was discussing the risk cases with the managers from non-IT units. I strongly believe an enterprise risk management application should be used if we are to develop a risk management practice. Spreadsheets are not appropriate for organizations of this size and there is no effective way to share information at the executive level. I am happy to discuss further if there is an interest. Brian Read Less