Caffeinated Risk

A while back we were fortunate enough to spend time with Jack Freund, coauthor and thought leader responsible for bring the FAIR methodology and practice into the main stream. A bonus from that original recording is now an espresso shot discussing how to fast track an assessment when the threat vectors are numerous. While the metaphor Jack used is somewhat unexpected it's both memorable and an excellent approach to dealing with an entire class of attacks in a single assessment. A pro tip from one of the original practitioners of the FAIR methodology well worth a listen.

At 45-50%, depending on your statistical source, there is no denying that small to medium sized businesses are a significant economic engine from both an employment and innovation perspective.  In 1978 Microsoft numbered 11 people. Unfortunately small businesses are also the least likely to survive a major disruption, an experience that changed Rochelle Clarke's corporate leadership trajectory to a business founder.The Continuity Strength founder shares insights on the needs of small to medium businesses and how to develop resilience plans while simultaneously addressing the two biggest concerns of most SMB owners, time and money.   Prior to founding Continuity Strength, Ms. Clarke was the Country Manager, Global Strategy for Heineken, a management consultant and is on multiple board and academic committees. 

A surprising number of digital innovations began in Alberta, be it the world's first public digital cellular network in 1985, the DNP3 industrial controls protocol and  becoming the first Google international research lab in 2017.  CyberAlberta is another innovative collaboration focused on strengthening the cyber resilience of Alberta organizations.  At almost 330 billion annually, protecting the Alberta economy and it's citizens from digital attacks is an important mission.  In a very candid conversation, Rachel Hayward, Executive Director of CyberAlberta shares both successes and challenges observed with cyber workforces and organizational readiness. Her previous tenure with the Alberta Privacy commissioner adds some additional nuance in these times of ever greater tests of personal rights.   

Ever wondered how top universities protect their cutting-edge research from prying eyes while ensuring seamless access for their scholars? Join us as Michael Spaling, Principal Security Architect at the University of Alberta, takes us behind the scenes of this high-stakes balancing act. Just like any other large organization, research universities have many different stakeholder, operational and regulatory requirements, thousands of employees and tens of thousands of customers. In a strange twist, both Mr. Spaling and podcast cohost Tim McCreight are also recent recipients of industry awards, prompting a few questions that reveals some darker elements of social media while continuing to offer security leadership.

The practice of engineering dates back thousands of years, incorporating science and mathematics to solve problems in the ancient world, and remains a key requirement for developing the complex digital systems controlling the physical systems core to our modern way of life. Unfortunately connectivity and complexity have created a vulnerability we must now engineer our way out of, and just like risk management, engineering is about balancing constraints.Andrew Ginter is a recognized thought leader within the industrial security space with decades of real world experience and the willingness to distill that knowledge into a series of book on operational technology cybersecurity. Mr. Ginter's latest book "Engineering-Grade OT Security, a manager's guide" explores risk elements over multiple chapters and provided a great intersection with ESRM principles.  A self professed collector of industry wisdom, Andrew was quick to highlight Cyber Informed Engineering principles for security engineering within OT and call out calculation issues when risk assessing black swans yet also offering an elegant approach to resolution. Due to a technical glitch, this episode joins Andrew, Tim and Doug in mid-conversation about Cyber Informed Engineering instead of the typical introduction banter of most episodes. 

Technological change is inevitable and often one of the aspects that attracts people toward careers in information and operational technology. Although risk management is a part of navigating advancement in any area, the fundamental flaw in any management system is our human tendencies. This episode explores how organizations can make slow, steady migration from first principles to risky undertakings without noticing. Marco Ayala, an operational technology cybersecurity expert and current Houston InfraGard president, joins this episode to further explore the reasons behind this normalization of deviance, a concept first introduced to OT cyber specialists at S4 in 2024. Mr. Ayala is also CCE proponent and facilitator leading to a discussion on possible options for course correction back off the normalization path.  Although solutions must always be tailored to work within organizational constraints, the early contributors to catastrophic outcomes associated with the Challenger space shuttle and Boeing 737 Max warrant exploration or we will inevitably repeat.  

Darren Gallop, a serially successful Canadian tech entrepreneur, shares his insights on supply chain risk management. He revisits significant breaches like Target's, emphasizing the evolution of compliance standards. Darren discusses challenges in vendor risk management and critiques traditional approaches that focus more on compliance than proactive assessments. He highlights the need for startups to integrate meaningful cybersecurity practices into their culture. Despite current risks, he sees a promising future for organizations willing to adapt.

Winn Schwartau, an internationally recognized security thinker, shares his insights on navigating the complexities of our tech-saturated world. He discusses the battle between big tech and our cognitive faculties while promoting the need for mental resilience. The conversation dives into the lessons from his new book, addressing challenges posed by AI and disinformation. Schwartau emphasizes the importance of enhancing security awareness, fostering critical thinking, and building cognitive defenses against information overload.

Adam McMath, an expert in incident response with a rich background in both cyber and physical security, dives into resilience and risk management. He shares transformative lessons from his firefighting days, emphasizing structured incident response frameworks. Adam advocates for a business-centric approach to cybersecurity, aligning security measures with organizational goals. He also discusses the vital connection between organizational culture and effective security, highlighting the human element in navigating threats and the pivotal role of training.

Radek Havlis, VP at O2 Telefonica, discusses the evolution of ESRM in the telecommunications industry, emphasizing the importance of visionary leadership, risk management philosophy, and security as a business enabler. Topics include navigating regulations, security transformation, cultural integration, and the evolving role of risk advisors within organizations.