27. GRC - Governance, Risk Mgmt, Compliance Flashcards
GRC - Governance, Risk Mgmt, Compliance
Governance
IT goals and processes align with business objectives
- Making sure leadership, processes, structures allow this to happen
- Security investments should meet the business needs
- Ensure we have enough resources to meet the needs
1. Human resource
2. Financial resource
3. Technological resource - Monitoring - how well is program performing against its objectives
GRC - Governance, Risk Mgmt, Compliance
Risk Management
Process of identifying, assessing and responding to risks
1. Identification
2. Assessment
3. Risk Response
4. Control monitoring and reporting
- Identification
- Assessment
- Risk Response
- Control and monitoring
GRC - Governance, Risk Mgmt, Compliance
Compliance
Conforming with stated requirement
1. Laws and regulations
2. Auditing and monitoring
3. Ehtids and privacy
GRC - Governance, Risk Mgmt, Compliance
Governance:
Objectives
Performance program
- Monitoring how well the program is performing against its objectives
- KPI - Key Performance Indicator
- KRI - Key Risk Indicator
GRC - Governance, Risk Mgmt, Compliance
Governance:
Value Delivery
Value Delivery
- Finding right balance between security requirements and the business needs
GRC - Governance, Risk Mgmt, Compliance
Risk Managment:
Identification
To have a risk;
1. Need the vulnerability
2. Need to have the threat
GRC - Governance, Risk Mgmt, Compliance
Risk Management:
Assessment
Analyse likelihood and potential impact
1. Qualative
2. Quantative
- Qualative risk assessments
GRC - Governance, Risk Mgmt, Compliance
Risk Assessment:
Qualitive
Based on feeling;
“I think this is low probability and its probably high impact”
GRC - Governance, Risk Mgmt, Compliance
Risk Management:
Quantitive risk analysis
Conducted on the risks deemed high enough risk
“apply numbers to the feelings - this is the likely cost of this happening”
- Quantative risk analysis - numbers i.e. financials
GRC - Governance, Risk Mgmt, Compliance
Risk Response
- Acceptance
- Avoidance
- Mitigation
- Transference
- Risk rejection - never ok! Do not just ignore the risk
GRC - Governance, Risk Mgmt, Compliance
Risk Response:
Acceptance
We know risk is there, have done our due dilligence
Accepting risk makes more financial sense than mitigating it
GRC - Governance, Risk Mgmt, Compliance
Risk Response:
Avoidance
Stop doing whatever is putting us at risk
GRC - Governance, Risk Mgmt, Compliance
Risk Response:
Mitigation
Put something in place that mitigates part of the risk
Reduce the risk level to an acceptable level
- Accept whatever is left over from the mitigating controls
- Risk left over is residual risk
GRC - Governance, Risk Mgmt, Compliance
Risk Response:
Transference
Getting insurance against the identified risk
i.e. insurance for the data center flooding
- going into partnership with someone means that they own 50% of the risk
GRC - Governance, Risk Mgmt, Compliance
Risk Management:
Control Monitoring and Reporting
Esnuring that controls function as they should and no new risks are emerging that require mitigation
GRC - Governance, Risk Mgmt, Compliance
Compliance:
Laws and regulations
- If your industry has to be compliant, ensuring that the business is in compliance
- Ensure what you do is inline with your internal policies, standards and procedures
GRC - Governance, Risk Mgmt, Compliance
Compliance:
Auditing and monitoring
On a regular schedule confirm that the business is compliant over time
- Internal audits - done by ourselves
- External audits - outside company
GRC - Governance, Risk Mgmt, Compliance
Compliance:
Ethics and Privacy
Inside the organisation, need to promote ethical behaviour
- Ethical behaviour needs to be part of organisations compliance program
GRC - Governance, Risk Mgmt, Compliance
Governance:
Overall strategy
- Direction of the organisation
- Defines the risk appetite
- Establishes the business ethical, legal and procedural guidelines
- risk appetite - level of risk the organisation is willing to accept
- Risk appetite will guide the risk management process
- Lack of governenace means there is lack of direction, so security program cannot be effective
GRC - Governance, Risk Mgmt, Compliance
Risk Management:
Strategy
Aligns with the risk appetite defined in governance
- If business has low appetite for risk, likely to implement much stronger controls to mitigate risk
- With no risk strategy, the business could be open to risks and security team will not prioritize the right initiatives
- May mitigate things that are not a problem whilst leaving critical services wide open
GRC - Governance, Risk Mgmt, Compliance
Compliance:
Strategy
Ethical, legal and porcedural guidelines are establish by governance
Compliance requirements are used in creation of policies and procedures
- For example, if the business wants a secure cloud environment, you will write procedures that ensure a secure configuration it used on deployment
- Financial losses and penalties
GRC - Governance, Risk Mgmt, Compliance
Risk Management & Compliance
Risk management focues on the threats and vulnerabilities
Compliance focuses on what can cause us to be non compliant
- Understanding how you will not be compliant with a law or regulation feeds into the risk assessment where there will be a lower “low” tolerance to accept risk and risk will be higher
