CvCISO Podcast Episode 32: Navigating the Assessment Landscape Pt 2

CvCISO Podcast

Summary
In this episode of the CvCISO Podcast, the hosts continue their assessment discussion, focusing on the roles of CEO, CFO, and VC. They explore the importance of separation of duties, risk management, and the impact of experience on wisdom. The conversation transitions into the assessment process, covering topics such as screening and background checks, security policies, employee monitoring, and training for privileged users. The hosts emphasize the need for awareness training and the significance of having a structured approach to security in small businesses. In this conversation, the speakers delve into various aspects of information security, focusing on the definitions and roles of privileged users, the importance of post-employment processes, and the management of assets and inventories. They discuss the need for formal information classification guidelines and the handling of removable media. The conversation also touches on the disposal of media, the inventory of cloud services, and the relationship between compliance and risk management, emphasizing the importance of foundational security practices over compliance minutiae.
Takeaways

• Separation of duties is crucial in risk management.
• Experience with pain can lead to wisdom.
• High turnover necessitates thorough background checks.
• Employee training should include security awareness.
• Privileged users require specialized training.
• Monitoring employees can help detect cybersecurity events.
• Transparency is key during technical difficulties.
• Assessments can reveal gaps in security practices.
• Risk acceptance is a legitimate strategy.
• Regular reviews of security policies are essential.
• All admins are considered privileged users.
• It's essential to define what constitutes a privileged user in an organization.
• A solid onboarding and offboarding process is crucial for security.
• Asset management includes both physical devices and software.
• Information classification should be formalized to enhance security.
• Removable media poses unique risks that need to be managed.
• Media disposal processes should be clearly defined and followed.
• Organizations often lack a complete inventory of cloud services.
• Compliance requirements can influence how assessments are conducted.
• It's important to focus on foundational security practices rather than compliance minutiae.