If you've studied SABSA to foundation level, you may recall how systemic risk navigates the domain model. If a risk materialises in a domain, the impact it has can act on the superdomain causing a risk event to occur there. Ok, simples right? Well Maurice was recently asked if this effect can occur in the opposite direction, i.e. from a domain to its subdomain. The search for a concrete example or a contradiction started.

In this episode we consider this question which leads to further questions about the nature of hierarchy in the domain model and co-existent parallel domain models – but no quantum entanglement (yet). Have a listen and then join the debate, or if you have the answer put an end to it.

With hindsight, declaring a risk an unknown unknown is often no more than an admission of a lack of foresight, a lack of imagination. How many risks that are actually realised were really inconceivable in advance? Risk identification is a process that is resource constrained, and reasonably so. But with more time, more perspectives, more insights, more intelligence the chances are you'd have identified the risk. Perhaps to do so would have not been cost effective; or you may have decided to limit analysis and not successfully managed an outlier risk. But to declare it an unknown unknown (after the fact) is rejecting an opportunity to learn. Is it not fatalistic to shrug one's shoulders and say "How could I have known"?

In this episode we discuss Unknown Unknowns, along with their bedfellows Known Knowns, Known Unknowns and Unknown Knowns, and their place in the identification and management of business risks.

The last two years have seen changes that few were prepared for. In the aftermath we can argue whether it was a black swan, grey rhino, or octarine unicorn event but ultimately once the overture is done what matters is your ability to adapt to the new world order. Even if you had a specific plan in place, as such events unfold the situation will likely evolve in unpredictable directions.

Over time, change external to your sphere of control is inevitable. Some changes are large shocks that affect nations, regions or the entire world. Some only affect certain industries or a subset of business in an industry. While mitigating and planning response to known, but uncertain, events is important it is also important to avoid assumptions about future states and to build organisational structures and processes that can adapt no matter what comes over the horizon.

In this episode, we discuss being Adaptable and Adaptive. Listen to our conversation to hear our thoughts on the maybe subtle but important differences between these very similar terms.

Is your risk management one-sided, designed to minimise the likelihood and negative impacts of uncertain events. How is the uncertainty of events with positive business impacts managed? Not by the security team or using the same risk management framework, right?

Threats and opportunities both rely on uncertainty. Add factors including likelihood (or frequency) and impact to either and you derive a risk. A risk that can be influenced by actions you take and external factors you don't control. While some terminology will likely need to be revised (for example we don't want to mitigate upside risks, we want to promote them) can we not manage all risk using the same framework?

In this episode we talk about Balanced Risk. A holistic view on risk and risk management. One that considers both threats and opportunities, with risk treatment driven by business goals and tempered by risk appetites. Risk treatments that are rarely simple and may affect multiple risks and themselves introduce new risks. Reimagine risk management not as minimising (downside) risk, but as gaining confidence in achieving business goals.

News of business impacts from the realisation of cyber risks is all around us. Many of the largest breaches in recent years have involved one or more suppliers in some way. Few will be unaware of Sunburst/Solorigate, and many will have been directly impacted or know people that have been. But it is not just your direct suppliers, or your technology supply chain, that can suffer from a cyber attack that impacts you, as is clear to many following the Colonial Pipeline attack. Do you know who your suppliers suppliers are? Are you gaining any assurance of the cyber security of your non-technology suppliers? Are you assessing during on-boarding only or monitoring over time?

In this episode Martin and Maurice are joined by Vincent Thiele to discuss Supply Chain Risk. How can you identify threats and manage risks originating from the whole graph of your suppliers, their suppliers, ...? Where should you concentrate your efforts and what can you do to meaningfully measure the security posture of suppliers?

The desire for privacy is nothing new, but societal expectations have certainly come a long way since the middle ages. Over the last two decades many have seen additional rights enshrined in law. Businesses increasingly face sanctions for not respecting the privacy of those they associate with.

Businesses have privacy related risks, they are required to protect personal data. But they also have security risks - are the approaches to mange these not broad enough to cover privacy, or could they not be readily expanded to do so?

If you were asked to draw a Venn diagram of security and privacy on the back of a beer mat (remember those?), what would it look like? Is privacy a subset of security? Is there a large intersection, a small intersection, or maybe even none?

In this episode Martin and Maurice discuss privacy and how it relates to security. Is privacy materially different to risk-driven security? Do you need different teams with different frameworks to deliver privacy and security?

The information security field is awash with certifications. To an outsider many job adverts, in what is increasingly a sellers market, are full of impenetrable acronyms. But who do all these certifications serve? Is the content relevant and do they effectively demonstrate knowledge, capability, and desire to learn? Are they a part of the supposed skills gap rather than its solution?

In this episode Martin and Maurice discuss the value of certifications and different ways in which we can assess and discover knowledge, skills and practitioner capability in our industry.

Enlightened risk management frameworks say we should manage risks to the business within the risk appetite. But what is the risk appetite? Can anyone in the organisation articulate it beyond vague statements such as “medium risk appetite”, “prudent basis” or “risk adverse basis”? Risk appetite is dynamic, and we need to be able to change it and identify the impacts on our risk management this has when we do.

Armed with an understanding of our risk appetite, what risk management challenges are we better equipped to address. Can we leverage it to identify areas where we might actually want to consciously take more risk? Can we improve risk decisions?

In this episode regular hosts Martin and Maurice are joined by COSAC regular Jaco Jacobs to discuss cyber risk appetite.