Please Don’t Investigate Our Impeccable Risk Predictions

It’s easy to calculate risk if no one ever checks the accuracy of those predictions after the fact. It’s all coming up on CISO/Security Vendor Relationship Podcast.


This episode is hosted by me, David Spark (@dspark), producer of CISO Series and founder of Spark Media Solutions and Mike Johnson. Our sponsored guest this week is Bob Huber (@bonesrh), CSO, Tenable.

Thanks to this week’s podcast sponsor Tenable

Effective vulnerability prioritization helps you answer three questions: Where should we prioritize based on risk? Which vulnerabilities are likeliest to be exploited? What should we fix first? Tenable gives you the accurate and actionable data you need to answer these questions and better secure your business. Learn more: tenable.com/predictive-prioritization.

Got feedback? Join the conversation on LinkedIn.

On this week’s episode

What’s the ROI?

Do we analyze how good we are at predicting risk?

Phil Huggins, GoCardless said, “We conduct detailed rigorous risk assessments to support security transformation business cases and identify a series of mitigation actions and then declare success if those actions are completed on time and on budget… We never revisit our risk assessments a year later and see how good we were at predicting risk occurrence. I worry that the avoidance of feedback contributes to the underperformance of security.”

Are we looking back and seeing how good we are at analyzing risk?

Close your eyes. Breathe in. It’s time for a little security philosophy.

We have evolved from an unchecked “Cloud first” model to a more thoughtful “cloud smart” strategy. Are these just PR slogans apparently implemented by the last two administrations, or is there something to them? Looking ten years ago vs. today, have we really become smarter about implementing cloud technologies? In what way have we made the greatest strides? How are we falling short and where would you like us to be smarter?

What’s Worse?!

What would you sacrifice to get all the training you could get?

Please, Enough. No, More.

Our topic is DevSecOps. It’s a big one. Mike, what have you heard enough of on the topic of DevSecOps, what would you like to hear a lot more?

What do you think of this pitch?

Shazeb Jiwani of Dialpad forwarded me this pitch from Spanning Cloud Apps. He asks, “how they feel about vendors using an availability issue from a partner (not even a competitor) as a sales pitch.”

Parkinson’s Law states that “work expands to fill the time available,” and any IT specialist knows this applies equally to data and can be stated as “Data expands to fill the storage available.” 

As cloud service providers – and the cloud itself both continue to expand, the opportunity to transport and store all of your data seems to be a great convenience. But data management requires oversight, control and governance. The more data – and daily data flow –one has, the greater the potential for misuse, redundancy, errors, and costly maintenance. 

Companies and organizations need to be diligent about the types and volume of data that need to be transported, stored archived and/or retrieved. Data in transit, for example, poses a specific level of security threat that can accelerate logarithmically and can open the door for additional hazards. Think about the conundrum between ransomware and data backups, for example. 

It becomes a topic of strategy, to be discussed by the C-suite and the IT department together to prioritize the most important data sets and to assign the appropriate resources to its ongoing maintenance. 

Check out lots more cloud security tips sponsored by OpenVPN.

David Spark
David Spark is the founder of CISO Series where he produces and co-hosts many of the shows. Spark is a veteran tech journalist having appeared in dozens of media outlets for almost three decades.