Kelly White

Recent Posts

What You Need to Know about the NYDFS Cybersecurity Regulations

Posted by Kelly White on May 16, 2019 12:17:14 PM

If you’re even loosely connected to the financial services industry, you’ve no doubt heard about the newest cybersecurity requirements issued by the New York State Department of Financial Services (called 23 NYCRR 500). Though right now these requirements just apply to regulated entities within the jurisdiction of the NYDFS, they’re likely indicative of future regulations to come to industries across the board.

Read More

Topics: risk exposures, risk measurements, CISO, Risk Surface

What's Risk Surface?

Posted by Kelly White on Apr 12, 2019 1:48:14 PM

You’ve likely never heard the term “risk surface” before, but it’s an important concept that captures the way modern enterprises must manage risk. To that end, we’re providing an in-depth definition of what risk surface is so you can begin to expand your understanding of cyber risk management in the current landscape.

Read More

Topics: risk exposures, risk measurements, Third Party Risk, Risk Surface

You Can’t Manage What You Can’t Measure – Integrating Risk Formulas into Your Cyber Risk Management Framework

Posted by Kelly White on Jul 2, 2018 11:37:06 AM

 

By Kelly White | July 2, 2018 

Calculating cyber risk is a key element of any sound risk management strategy. While traditional risk management models have focused on financial, process, workplace and IT factors, for many organizations cyber risk is still a new component in their risk assessment practices. Yet issues such as accurately measuring exposure, understanding the correct level of security spend, and whether or not to buy cyber insurance (and how much to buy) depend on hard numbers. How do you tackle quantifying these concerns in practical business terms?

Read More

Topics: Vendor Risk Management, Vendor Security, Third Party Risk

Security Vulnerabilities Don’t Equal Security Risk – So How Do You Prioritize?

Posted by Kelly White on May 31, 2018 1:53:50 PM

 

By Kelly White | May 31, 2018 

While security vulnerabilities are found in many technologies, their presence doesn’t necessarily equal risk. Borrowing the FAIR Institute’s definition, risk is the probable frequency and magnitude of loss. Knowing what security vulnerabilities are present in your infrastructure can help you understand the probable frequency, but it offers no indication of loss magnitude. Rather, solving risk requires two foundational data points: what security vulnerabilities your technology has, and the value of the assets in which those vulnerabilities exist. Without that context, a given vulnerability is the same as any other.

Read More

Topics: Scalability, Vendor Risk Management, Security Ratings, Vendor Security, Third Party Risk

Why the Security of Your Vendor’s Entire Enterprise Matters

Posted by Kelly White on May 15, 2018 11:34:14 AM

 

By Kelly White | May 14, 2018  

Reliably protecting systems and data over time requires the disciplined execution of a robust security program that spans an entire enterprise. As a former CISO and now advisor to third-party risk management teams, I’ve seen some vendors take the contrary position, arguing that customers need only be concerned with security of the systems that host their data.  

Read More

Topics: Vendor Risk Management, Vendor Security, 3PRM

What is the True Cost of Administering Your Vendor Security Questionnaire?

Posted by Kelly White on May 8, 2018 7:04:45 PM

 

By Kelly White | May 8, 2018

The more questions you ask in your third party assessments, the higher the cost. But how much does an extra question really cost? And what is its value?

In late 2017, we at RiskRecon explored this issue as part of a detailed study in which we analyzed the third-party cyber risk management practices of thirty firms. Let’s walk through a few of the study data points that led us to the answer.

Read More

Topics: Scalability, Vendor Risk Management, Vendor Security

Public Customer Vendor References – Good Partnership but Risky Business

Posted by Kelly White on May 3, 2018 9:38:32 PM

 

By Kelly White, Founder and CEO, RiskRecon

A public testimonial from a satisfied customer is marketing gold for most any business. Who isn’t proud to display the logos of respected brands on your customer list, or to publish case studies about the great work you did for them? When I was a CISO of a top-30 financial institution, vendors frequently offered us financial incentives for permission to leverage our brand. There’s also a human element – people like helping other people. In the digital age where a negative customer experience can spread like wildfire through social channels, positive testaments are more important than ever.  

Read More

Topics: Vendor Risk Management, Vendor Security

When the media wrongly implicates you in a third-party data breach

Posted by Kelly White on May 1, 2018 6:48:15 PM

Be Prepared: The Media Might Drag you into a Vendor Data Breach Mess Even if Your Data Wasn’t Compromised

Kelly White | May 1, 2018

When your vendor gets breached, you might be dragged into the mess by media even if your data was not compromised. Consider the recent case of [24]7.ai data breach.

On April 4, 2018, online chat application vendor [24]7.ai publicly reported that they had “an incident potentially affecting the online customer payment information of a small number of our client companies…” Shortly afterwards, well-known corporations Delta, Sears, Kmart and Best Buy released statements acknowledging that their customer data was impacted by this breach.

Read More

Topics: Vendor Risk Management, Third Party Risk

You Can’t Outsource Risk - A regulatory guide to third-party cyber security risk management

Posted by Kelly White on Apr 26, 2018 12:44:54 PM

 

 

Kelly White | April 29, 2018

Third parties are integral to the value chain—any given organization can have up to hundreds of vendors, depending on its size. Along with business process, IT bandwidth and application functionality, data also flows through that chain. While you can outsource systems and services, you cannot outsource your risk associated with that data and how it’s managed. Regulators have been consistently and clearly giving that message for years, in writing and in practice.

Read More

Topics: Vendor Risk Management, Whitepaper, Third Party Risk