| | MARCH - 2020ENTERPRISE SECURITY8here have been numerous much-needed discussions in the last few years about the risk-based approach to cybersecurity instead of simply focusing on the maturity-based approach.Even more encouraging is the progress that has been made on the alignment of expected-maturity with risk-priority. The financial Industry, in general, is always at the forefront of these conversations and has led the way in most cases. Despite all the shortcomings and agony that the Federal Financial Institutions Examination Council Cybersecurity Assessment Tool (FFIEC CAT) created, the tool has attempted to map inherent risk to maturity expectations.Though the FFIEC CAT and National Institute of Science and Technology Cyber Security Framework (NIST CSF) reignited a lot of conversations around the risk-based approach, they were neither the only ones nor the first to do so. ISO standards such as ISO 27001/2 and ISO 27005 were encouraging a risk-based approach to cybersecurity for a while. Gartner analysts have been writing and encouraging on this topic for at least a decade.However, there are a lot of things that still need to be done. Most of us are still employing simple maturity-based cybersecurity, which tends to be costly and, a lot of times, becomes just a checklist exercise. Is it because of a lack of will or lack of ability, or is it something else?Listed below are some of my thoughts on this issue and how to address those based on my own experience as well as talking to various practitioners over the years.TA Risk-Based Approach to Cybersecurity: Challenges and SolutionsBy Sajan Gautam, CISO, Arvest BankSajan Gautam1. Tell me "How": There are a lot of publications and guidelines on "Why" a risk-based approach to cybersecurity is required; it has been going on for more than a decade now. Lately, there have been more publications and guidelines on "What" could be done and what that looks like. However, there is not a whole lot of guidance on "How" that could be achieved. I am not suggesting that a regulator comes up with a prescriptive methodology that one should be adopting; I am merely suggesting that as practitioners we should make this "How" part a little bit easier to follow.2. Develop Cross-Disciplinary Skill-Sets: Most of the cybersecurity practitioners come from a technical IN MY OPINION
< Page 7 | Page 9 >