Razorthorn Security
Razorthorn Security
  • 465
  • 298 467
Insider Threats & Third Party Risk: How to Manage Security Threats | Razorthorn Security
Every vendor you trust and every employee you hire could be your next security crisis-explore the realities of third party risk and insider threats on this episode of Razorwire!
Join us for a discussion on the multifaceted challenges of third party risk and how they can destabilise your organisation. From the growing complexities of cloud providers like AWS and Azure to detecting and dealing with insider threats, our conversation covers it all.
We also break down a case study involving indemnity and insurance settlements following a breach incident, providing you with practical takeaways for enhancing your own security protocols.
Key takeaways:
Strengthen Your Third Party Risk Management -
Implement contractual audit rights early in vendor relationships
Develop resilience plans for vendor service failures
Understand the risks of supply chain dependencies (third parties of third parties)
Plan for scenarios where key service providers might fail or be compromised
Understand and Mitigate Insider Threats -
Identify different types of insider threats (accidental, disgruntled employees, corporate espionage)
Monitor for behavioural changes and suspicious activity patterns
Implement ongoing background checks and security clearance reviews
Balance monitoring with employee privacy and company culture considerations
Address Modern Security Challenges -
Evaluate the cost-benefit trade-offs between in-house and outsourced services
Implement monitoring solutions that correlate data from multiple sources
Develop security strategies that account for both human and technical factors
Create comprehensive risk assessments that include both internal and external threats.
Join us on Razorwire as we untangle the complexities of third party risk and insider threats, providing you with actionable insights to fortify your organisation's cyber defences.
On the inevitability and scale of third-party breaches:
"It's inevitable. You're gonna have a third party breach. There's about, what, 10 a day... You could do all the due diligence in the world and all the security checks about this. You could have a very robust vendor risk management, whatever you wanna call it. At the end of the day, it's gonna take one little, maybe insider threat on the third party side, and that will cause a breach."
Iain Pye
Listen to this episode on your favourite podcasting platform: razorwire.captivate.fm/listen
In this episode, we discuss:
● Implementing Third Party Audit Rights: Secure your organisation by establishing robust audit rights in vendor contracts before engagement begins.
● Evaluating Cloud Provider Stability: Assess and mitigate risks when selecting cloud providers by verifying their financial stability and data migration capabilities.
● Preventing Insider Security Breaches: Distinguish and protect against both intentional and accidental internal security threats through targeted controls.
● Building a Strong Security Culture: Foster an environment where employees actively report and respond to security warnings rather than normalising them.
● Managing Employee-Related Risks: Develop strategies to identify and address employee dissatisfaction before it becomes a security threat.
● Controlling Access Privileges: Implement strict access management protocols to prevent credential misuse and unauthorised access sales.
● Managing Supply Chain Security: Build resilience into your supply chain by mapping dependencies and establishing clear liability frameworks.
● Implementing Comprehensive Behavioural Monitoring: Deploy systems that analyse multiple data sources (login patterns, email access, data transfers) to identify suspicious user behaviour patterns.
● Protecting Against Espionage: Apply updated legal frameworks like the UK National Secrets Act to safeguard intellectual property and sensitive information.
● Deploying Dynamic Security Monitoring: Establish continuous monitoring systems for both employees and third parties to detect threats early.
Other episodes you'll enjoy
Cybersecurity Burnout and Organisational Culture with Yanya Viskovich & Eve Parmiter
www.razorthorn.com/cybersecurity-burnout-and-organisational-culture-with-yanya-viskovich-eve-parmiter/
The Art of Cyber Deception: How To Get Inside The Mind of A Hacker with Rob Black
www.razorthorn.com/the-art-of-cyber-deception-how-to-get-inside-the-mind-of-a-hacker-with-rob-black/
Connect with your host James Rees
For more information about us or if you have any questions you would like us to discuss email podcast@razorthorn.com.
If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.
Website: www.razorthorn.com
Переглядів: 515

Відео

How to Optimise Your GRC Tools: Improving Value, Efficiency & True Risk Management
Переглядів 1,9 тис.14 днів тому
In this episode of Razorwire, we're joined by Jack Jones, creator of the FAIR risk model, to explore the complexities of Governance, Risk and Compliance (GRC) tools. We cut through the noise to deliver actionable insights on how to truly manage risk and improve the value and efficiency of your GRC solutions. Key Takeaways: The Real Cost of GRC Tools: Uncover the hidden expenses and renewal pric...
Navigating Mental Health, Narcissism & Burnout in Cybersecurity with Lisa Ventura MBE
Переглядів 4 тис.Місяць тому
Navigating Mental Health, Narcissism & Burnout in Cybersecurity with Lisa Ventura MBE
ChatGPT vs Cyber Threats: The REAL Role of AI in Cybersecurity | Razorthorn Security
Переглядів 4,6 тис.Місяць тому
ChatGPT vs Cyber Threats: The REAL Role of AI in Cybersecurity | Razorthorn Security
DORA & NIS2: The Cybersecurity Regulation Revolution | Razorthorn Security
Переглядів 2,8 тис.2 місяці тому
DORA & NIS2: The Cybersecurity Regulation Revolution | Razorthorn Security
Contextual Security and Beyond: The Future of Cybersecurity | Razorthorn Security
Переглядів 2,4 тис.2 місяці тому
Contextual Security and Beyond: The Future of Cybersecurity | Razorthorn Security
Top Cybersecurity Priorities for 2024 | Razorthorn Security
Переглядів 1,1 тис.2 місяці тому
Top Cybersecurity Priorities for 2024 | Razorthorn Security
DORA Compliance: Insights & Strategies with Paul Dwyer | Razorwire Podcast | Razorthorn Security
Переглядів 4,3 тис.3 місяці тому
DORA Compliance: Insights & Strategies with Paul Dwyer | Razorwire Podcast | Razorthorn Security
Secrets of a Cyber CEO: The Truth About Running a Cybersecurity Business with Jane Frankland
Переглядів 2,1 тис.3 місяці тому
Secrets of a Cyber CEO: The Truth About Running a Cybersecurity Business with Jane Frankland
Redefining Cyber Insurance to Meet Today’s Cybersecurity Challenges
Переглядів 504 місяці тому
Redefining Cyber Insurance to Meet Today’s Cybersecurity Challenges
What Really Grinds My Gears In Infosec!
Переглядів 1624 місяці тому
What Really Grinds My Gears In Infosec!
The Art of Cyber Deception: How To Get Inside The Mind of A Hacker with Rob Black
Переглядів 8765 місяців тому
The Art of Cyber Deception: How To Get Inside The Mind of A Hacker with Rob Black
Trust vs Control - Is Zero Trust Inevitable in Cybersecurity?
Переглядів 2,6 тис.5 місяців тому
Trust vs Control - Is Zero Trust Inevitable in Cybersecurity?
Hacking Cybersecurity Training: Escape Rooms & Entrepreneurial Thinking with Amy Stokes-Waters
Переглядів 1,4 тис.6 місяців тому
Hacking Cybersecurity Training: Escape Rooms & Entrepreneurial Thinking with Amy Stokes-Waters
Cybersecurity Burnout and Organisational Culture with Yanya Viskovich & Eve Parmiter
Переглядів 22 тис.6 місяців тому
Cybersecurity Burnout and Organisational Culture with Yanya Viskovich & Eve Parmiter
Can FAIR Really Revolutionize Your Risk Management Strategy?
Переглядів 7567 місяців тому
Can FAIR Really Revolutionize Your Risk Management Strategy?
The Real Impact of the Lockbit Ransomware Takedown | Razorthorn Security
Переглядів 6 тис.7 місяців тому
The Real Impact of the Lockbit Ransomware Takedown | Razorthorn Security
The Rise of Cyber Mercenaries: Governments' Secret Weapons in Cyber Warfare | Razorthorn Security
Переглядів 7027 місяців тому
The Rise of Cyber Mercenaries: Governments' Secret Weapons in Cyber Warfare | Razorthorn Security
Cyber Trends in Identity and Access Management with Simon Moffatt || Razorthorn Security
Переглядів 8628 місяців тому
Cyber Trends in Identity and Access Management with Simon Moffatt || Razorthorn Security
Adapting to Legislative Demands: Insights on Cyber Security Compliance in Critical Infrastructure
Переглядів 7598 місяців тому
Adapting to Legislative Demands: Insights on Cyber Security Compliance in Critical Infrastructure
Cybersecurity in 2024: Expert Predictions You Need to Know || Razorthorn Security
Переглядів 6719 місяців тому
Cybersecurity in 2024: Expert Predictions You Need to Know || Razorthorn Security
Beyond Buzzwords: The Truth About AI
Переглядів 5369 місяців тому
Beyond Buzzwords: The Truth About AI
Unleashing the Hidden World of Cybercriminals: The Growing Threat of Cybercrime-as-a-Service
Переглядів 47210 місяців тому
Unleashing the Hidden World of Cybercriminals: The Growing Threat of Cybercrime-as-a-Service
SolarWinds’ CISO Under SEC Scrutiny: The Impact On The Infosec Community || Razorthorn Security
Переглядів 26010 місяців тому
SolarWinds’ CISO Under SEC Scrutiny: The Impact On The Infosec Community || Razorthorn Security
Decoding Generative AI: Myths, Realities and Cybersecurity Insights || Razorthorn Security
Переглядів 26211 місяців тому
Decoding Generative AI: Myths, Realities and Cybersecurity Insights || Razorthorn Security
Lessons from an InfoSec Icon: A Fireside Chat with PCI Guru Jeff Hall || Razorthorn Security
Переглядів 37411 місяців тому
Lessons from an InfoSec Icon: A Fireside Chat with PCI Guru Jeff Hall || Razorthorn Security
The Use Of AI In Cybersecurity - Consultants Roundtable || Razorthorn Security
Переглядів 313Рік тому
The Use Of AI In Cybersecurity - Consultants Roundtable || Razorthorn Security
Cyber Insurance - Does it Create More Problems than it Solves?
Переглядів 103Рік тому
Cyber Insurance - Does it Create More Problems than it Solves?
The Human Psychology Behind Cybersecurity with Bec McKeown
Переглядів 116Рік тому
The Human Psychology Behind Cybersecurity with Bec McKeown
DORA Compliance Made Clear: Essential Training for Safeguarding Financial Institutions w/ Paul Dwyer
Переглядів 236Рік тому
DORA Compliance Made Clear: Essential Training for Safeguarding Financial Institutions w/ Paul Dwyer

КОМЕНТАРІ

  • @seth7745
    @seth7745 16 днів тому

    Microsoft 365 is ransomware. The cure is Open Office

  • @seth7745
    @seth7745 16 днів тому

    Never pay. Make it illegal to. That's how you stop ransomware.

  • @idanhen10
    @idanhen10 17 днів тому

    Great

  • @HosseinAzadehrad
    @HosseinAzadehrad 18 днів тому

    Good

  • @HosseinAzadehrad
    @HosseinAzadehrad 18 днів тому

  • @vieighnsche
    @vieighnsche Місяць тому

    This is such an outdated understanding of LLM's. We describe LLM's with vector spaces now. If 2 tokens appear next to each other it combines the vector arrows to point to the next token in the latent space.

  • @NavySeal2k
    @NavySeal2k Місяць тому

    Simmilar, you want an emergency shutoff on an intelligent robot. He will fight you to push it if it is hindering him on performing its task or push it himself because it is the fastest way to an endpoint in his tasks depending how you implement it

  • @bryanzam1412
    @bryanzam1412 2 місяці тому

    Its only technology when it serves the entire human race . Otherwise it only serves those who are going to enslave you .

  • @elizabethramonvargas3322
    @elizabethramonvargas3322 3 місяці тому

    P😢😢😮😅😅😊😂🎉❤❤

  • @gavin1506
    @gavin1506 4 місяці тому

    I think the three word answer has been frowned on. Education teaches you it should be a well rounded answer of atleast a thousand words. Communication is failing.

  • @gavin1506
    @gavin1506 4 місяці тому

    Dora is a name that basically means God's Gift. a little bit OTT to call your act that.

  • @gavin1506
    @gavin1506 5 місяців тому

    Indeed. It's a game of chess

  • @gavin1506
    @gavin1506 5 місяців тому

    The Subscription model is far more difficult to get out of that than having Hardware onsite. 24:33

  • @gavin1506
    @gavin1506 5 місяців тому

    It's extremely interesting to note threat management by the end user is not a "training" limit. I have found most Security training skirts around the Threat modelling and relies on example. I think if you manage the threat models in your Organisation and lead training and running exercises. This then changes everything in your organisation and you promote team work. I think if you rely on an end user, they will make a mistake. I think if it's an Organisation/Business/Department/Team that is being relied on, you have a much better chance at defending your Systems a lot better.

  • @user-vt5lh6lm3n
    @user-vt5lh6lm3n 6 місяців тому

    So true. 😢

  • @gavin1506
    @gavin1506 6 місяців тому

    YES! I get annoyed when I have to interpret from technical to normal.. it's just frustrating. Modern IT people have to get they are no longer technical sit in the cupboard geeks. They have to be customer focused and understand business needs and work out the technical piece. Techies are employed to be the technologist for the business.

  • @gavin1506
    @gavin1506 6 місяців тому

    Errors are an opportunity to improve. If you are "perfect|" you just learn arrogance.

  • @mrnobodyfightingirish7376
    @mrnobodyfightingirish7376 7 місяців тому

    Well said 👍

  • @baronbadger1241
    @baronbadger1241 7 місяців тому

    This is a great little video.

  • @gavin1506
    @gavin1506 7 місяців тому

    Look at Close Quatre protection. They are all ensuring Cyber Security is on their syllabus

  • @gavin1506
    @gavin1506 9 місяців тому

    Safeguarding by government is "ban". However Safeguarding is explaining why you shouldn't but giving the choice.

  • @gavin1506
    @gavin1506 9 місяців тому

    AI fighting AI is the matrix

  • @gavin1506
    @gavin1506 9 місяців тому

    NCSC just advises to turn every Security measure on. We need a PROPER INFOSEC Council. It should be a volunteer basis for selection.

  • @gavin1506
    @gavin1506 9 місяців тому

    I think, while people before didn't trust the media it was more a hidden thing. People still watched the news without thinking. Now it's open hostility against the mainstream media. It's a fact checking exercise, or find your trusted sources for viewing.

  • @gavin1506
    @gavin1506 9 місяців тому

    the main things I think info Sec is missing, When it's government anything, the market for the software required is very very small. Which has an impact on support and responding to security issues. Until development comes back in house, that will never change. Departments simply can't afford to do that.

  • @הדרקומינר
    @הדרקומינר 9 місяців тому

    Maybe you would see the good side of them if every once in a while you would get up from your chair

    • @zooblok8272
      @zooblok8272 9 місяців тому

      You should do the same with no credibility you bum

  • @EarthMoneyz
    @EarthMoneyz 9 місяців тому

    Sounds interesting, but what is AGI and LLM mean

    • @RazorthornSecurity
      @RazorthornSecurity 9 місяців тому

      AGI - Artificial general intelligence (AGI) is a form of AI that possesses the ability to understand, learn and apply knowledge across a wide range of tasks and domains. LLM - Large language models (LLM) are very large deep learning models that are pre-trained on vast amounts of data. The underlying transformer is a set of neural networks that consist of an encoder and a decoder with self-attention capabilities.

  • @TS-00
    @TS-00 10 місяців тому

    standing UART/FW/SW back doors by design. Create Problem. Anticipate Reaction. Provide Gates' funded Hegelian Digital-ID "Solution".

  • @gavin1506
    @gavin1506 11 місяців тому

    Perhaps it's seen as responsibility lays with Ciso.

  • @gavin1506
    @gavin1506 11 місяців тому

    CISO has ultimate responsibility to highlight/Create a task/Write policy. However as an employee, they "MUST" protect themselves.

    • @gavin1506
      @gavin1506 11 місяців тому

      I think you made a huge assumption about Risk management. I think a lot of "security" or IT teams rely on third parties to tell them about risks and assign priority.

  • @TalmageL-pn2pv
    @TalmageL-pn2pv 11 місяців тому

    the thing about Bank robbers is that very very few get away, the vast majority of people who think they can get away with it, don't last through the first night before they are arrested.. CAMERAS ARE EVERYWHERE, you can't get away from them, even trail cameras are catching people now days..

  • @gavin1506
    @gavin1506 11 місяців тому

    I found it very good. I found that as it's stated, you need to train it. You need to know your questions, and you need to know the answer it's potentially going to get out of it. It's a tool or the dyslexic. I even ran a table top role play game from it. It started well but then starts including things outside of the perimeters you gave it.

  • @gavin1506
    @gavin1506 11 місяців тому

    I think compliance is always just basic. It's the same with accessibility compliance as well. The biggest issue is compliance is see as the highest standard and that needs to change

  • @thememedaddy9621
    @thememedaddy9621 Рік тому

    Tai ai or something like that, days not months and you could force it say what ever you wanted it to say

  • @travelmore9626
    @travelmore9626 Рік тому

    Insightful, thanks!

  • @WeTheLittlePeople
    @WeTheLittlePeople Рік тому

    In a Raytheon IRAD, (non-classified), I proposed that Decision Engines would need a human authentication at any critical event. So everyone needs to chill on AI taking on more than a workflow/authorization/RBAC AIM model needs to understand at basic fundamental levels. Anyone doing counter to human authorization should get their ass sued off for being... dumb...

    • @WeTheLittlePeople
      @WeTheLittlePeople Рік тому

      40 years ago, system admins and sysops didn't even think to put passwords on TimeShare systems. Lot of same brains are repeating same mistakes with AI...

    • @WeTheLittlePeople
      @WeTheLittlePeople Рік тому

      Had to spank the Feds bottom when I was a kid to show them how I got a total list of ARPANET & MILNET Addresses before there were laws against it, they had to use fraud by wire... it didn't stick. :)

  • @MichaelDaOne1
    @MichaelDaOne1 Рік тому

    Interesting

    • @ThePlug420-
      @ThePlug420- Рік тому

      How is this interesting that’s concerning!

  • @bettylang7894
    @bettylang7894 Рік тому

    Promo-SM 🙂

  • @gavin1506
    @gavin1506 Рік тому

    You also fund the higher the rates, the more likely breaches will happen as it makes it more fiscally viable

  • @geekytechycool
    @geekytechycool Рік тому

    James, you give some great advice here. Thanks again for your guidance along the way!

  • @CavemanTravels
    @CavemanTravels Рік тому

    So what do we do? WE GO TO THE FUCKING GYM!

  • @mikfax
    @mikfax Рік тому

    This is what I say to women to seduce them. It gets them wet everytime

  • @BobBobOnYouTube
    @BobBobOnYouTube Рік тому

    This guy talks too slowly.

  • @saluztaguba1757
    @saluztaguba1757 Рік тому

    Babe. Galit. Ka

  • @MrAndrew941
    @MrAndrew941 Рік тому

    This isn’t something I really thought of doing for some reason, I’m in the middle of leaving the army and have been thinking of a multitude of careers from being a blade technician in the wind industry to just driving a truck. Haven’t got a clue what I want to do and I will be out by the end of the year, and I’m still in two minds, this is definitely something I could look at, thank for the video.

  • @Guide7300
    @Guide7300 Рік тому

    Good video bro

  • @michaeltye2359
    @michaeltye2359 Рік тому

    Idk man maybe they have some of the best cybersecurity professionals because they're literally surrounded by enemies and have been in perpetual war for decades

    • @RazorthornSecurity
      @RazorthornSecurity Рік тому

      I think you are probably right, but then again pretty much every major country and quite a few smaller ones have been actively undertaking low grade probes and attacks on one another for some time now. We are seeing a huge uptick though, due to what's going on in the world at the moment. Now we have cyber combatants actively practising their craft with many more interesting and damaging attacks.

  • @ballicium
    @ballicium Рік тому

    Great content and I agree, People need to be at the forefront of a solid cyber practice. It's not easy to find people with the right skills - they often move around together between jobs. This is why it's so important to provide a positive day-to-day experience for cyber teams and try to, as a leader, remove frustrations and build a team and environment where continous improvement and innovation can thrive.

    • @RazorthornSecurity
      @RazorthornSecurity Рік тому

      I totally agree, cyber security is a tough area to be in, where the professionals are quite often frustrated and under fire from other departments in the organisation to not hold up projects or to stop meddling with innovation - it can get pretty demoralising. Lots of work needs to be done in hearts and minds around the other departments to realize we are not there to be their enemy; we are there to protect them from the things/people that can be harmful to the organisation. This can do wonders for positive reinforcement to the members of the Security teams… that and buy them beer or a bunch of doughnuts once in a while!

  • @kelcitangri4429
    @kelcitangri4429 Рік тому

    👏 ρɾσɱσʂɱ

  • @codyaaron725
    @codyaaron725 2 роки тому

    Thanks for sharing me, we actually have a lot of lives that we have did catching the demonic to show it's real. Impossible to fake a lot of what we have caught