- 465
- 298 467
Razorthorn Security
United Kingdom
Приєднався 3 лип 2020
We are Razorthorn Security - we've been in the cyber and information security industry for over 20 years and have consequently got a LOT of thoughts on the matter. Join us as we share some useful insights, advice and news from the weird and wonderful world we work in. News and views are entirely our own - join us at your own peril.
Find us online: www.razorthorn.com
Or on LinkedIn: www.linkedin.com/company/razorthorn-security
Find us online: www.razorthorn.com
Or on LinkedIn: www.linkedin.com/company/razorthorn-security
Insider Threats & Third Party Risk: How to Manage Security Threats | Razorthorn Security
Every vendor you trust and every employee you hire could be your next security crisis-explore the realities of third party risk and insider threats on this episode of Razorwire!
Join us for a discussion on the multifaceted challenges of third party risk and how they can destabilise your organisation. From the growing complexities of cloud providers like AWS and Azure to detecting and dealing with insider threats, our conversation covers it all.
We also break down a case study involving indemnity and insurance settlements following a breach incident, providing you with practical takeaways for enhancing your own security protocols.
Key takeaways:
Strengthen Your Third Party Risk Management -
Implement contractual audit rights early in vendor relationships
Develop resilience plans for vendor service failures
Understand the risks of supply chain dependencies (third parties of third parties)
Plan for scenarios where key service providers might fail or be compromised
Understand and Mitigate Insider Threats -
Identify different types of insider threats (accidental, disgruntled employees, corporate espionage)
Monitor for behavioural changes and suspicious activity patterns
Implement ongoing background checks and security clearance reviews
Balance monitoring with employee privacy and company culture considerations
Address Modern Security Challenges -
Evaluate the cost-benefit trade-offs between in-house and outsourced services
Implement monitoring solutions that correlate data from multiple sources
Develop security strategies that account for both human and technical factors
Create comprehensive risk assessments that include both internal and external threats.
Join us on Razorwire as we untangle the complexities of third party risk and insider threats, providing you with actionable insights to fortify your organisation's cyber defences.
On the inevitability and scale of third-party breaches:
"It's inevitable. You're gonna have a third party breach. There's about, what, 10 a day... You could do all the due diligence in the world and all the security checks about this. You could have a very robust vendor risk management, whatever you wanna call it. At the end of the day, it's gonna take one little, maybe insider threat on the third party side, and that will cause a breach."
Iain Pye
Listen to this episode on your favourite podcasting platform: razorwire.captivate.fm/listen
In this episode, we discuss:
● Implementing Third Party Audit Rights: Secure your organisation by establishing robust audit rights in vendor contracts before engagement begins.
● Evaluating Cloud Provider Stability: Assess and mitigate risks when selecting cloud providers by verifying their financial stability and data migration capabilities.
● Preventing Insider Security Breaches: Distinguish and protect against both intentional and accidental internal security threats through targeted controls.
● Building a Strong Security Culture: Foster an environment where employees actively report and respond to security warnings rather than normalising them.
● Managing Employee-Related Risks: Develop strategies to identify and address employee dissatisfaction before it becomes a security threat.
● Controlling Access Privileges: Implement strict access management protocols to prevent credential misuse and unauthorised access sales.
● Managing Supply Chain Security: Build resilience into your supply chain by mapping dependencies and establishing clear liability frameworks.
● Implementing Comprehensive Behavioural Monitoring: Deploy systems that analyse multiple data sources (login patterns, email access, data transfers) to identify suspicious user behaviour patterns.
● Protecting Against Espionage: Apply updated legal frameworks like the UK National Secrets Act to safeguard intellectual property and sensitive information.
● Deploying Dynamic Security Monitoring: Establish continuous monitoring systems for both employees and third parties to detect threats early.
Other episodes you'll enjoy
Cybersecurity Burnout and Organisational Culture with Yanya Viskovich & Eve Parmiter
www.razorthorn.com/cybersecurity-burnout-and-organisational-culture-with-yanya-viskovich-eve-parmiter/
The Art of Cyber Deception: How To Get Inside The Mind of A Hacker with Rob Black
www.razorthorn.com/the-art-of-cyber-deception-how-to-get-inside-the-mind-of-a-hacker-with-rob-black/
Connect with your host James Rees
For more information about us or if you have any questions you would like us to discuss email podcast@razorthorn.com.
If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.
Website: www.razorthorn.com
Join us for a discussion on the multifaceted challenges of third party risk and how they can destabilise your organisation. From the growing complexities of cloud providers like AWS and Azure to detecting and dealing with insider threats, our conversation covers it all.
We also break down a case study involving indemnity and insurance settlements following a breach incident, providing you with practical takeaways for enhancing your own security protocols.
Key takeaways:
Strengthen Your Third Party Risk Management -
Implement contractual audit rights early in vendor relationships
Develop resilience plans for vendor service failures
Understand the risks of supply chain dependencies (third parties of third parties)
Plan for scenarios where key service providers might fail or be compromised
Understand and Mitigate Insider Threats -
Identify different types of insider threats (accidental, disgruntled employees, corporate espionage)
Monitor for behavioural changes and suspicious activity patterns
Implement ongoing background checks and security clearance reviews
Balance monitoring with employee privacy and company culture considerations
Address Modern Security Challenges -
Evaluate the cost-benefit trade-offs between in-house and outsourced services
Implement monitoring solutions that correlate data from multiple sources
Develop security strategies that account for both human and technical factors
Create comprehensive risk assessments that include both internal and external threats.
Join us on Razorwire as we untangle the complexities of third party risk and insider threats, providing you with actionable insights to fortify your organisation's cyber defences.
On the inevitability and scale of third-party breaches:
"It's inevitable. You're gonna have a third party breach. There's about, what, 10 a day... You could do all the due diligence in the world and all the security checks about this. You could have a very robust vendor risk management, whatever you wanna call it. At the end of the day, it's gonna take one little, maybe insider threat on the third party side, and that will cause a breach."
Iain Pye
Listen to this episode on your favourite podcasting platform: razorwire.captivate.fm/listen
In this episode, we discuss:
● Implementing Third Party Audit Rights: Secure your organisation by establishing robust audit rights in vendor contracts before engagement begins.
● Evaluating Cloud Provider Stability: Assess and mitigate risks when selecting cloud providers by verifying their financial stability and data migration capabilities.
● Preventing Insider Security Breaches: Distinguish and protect against both intentional and accidental internal security threats through targeted controls.
● Building a Strong Security Culture: Foster an environment where employees actively report and respond to security warnings rather than normalising them.
● Managing Employee-Related Risks: Develop strategies to identify and address employee dissatisfaction before it becomes a security threat.
● Controlling Access Privileges: Implement strict access management protocols to prevent credential misuse and unauthorised access sales.
● Managing Supply Chain Security: Build resilience into your supply chain by mapping dependencies and establishing clear liability frameworks.
● Implementing Comprehensive Behavioural Monitoring: Deploy systems that analyse multiple data sources (login patterns, email access, data transfers) to identify suspicious user behaviour patterns.
● Protecting Against Espionage: Apply updated legal frameworks like the UK National Secrets Act to safeguard intellectual property and sensitive information.
● Deploying Dynamic Security Monitoring: Establish continuous monitoring systems for both employees and third parties to detect threats early.
Other episodes you'll enjoy
Cybersecurity Burnout and Organisational Culture with Yanya Viskovich & Eve Parmiter
www.razorthorn.com/cybersecurity-burnout-and-organisational-culture-with-yanya-viskovich-eve-parmiter/
The Art of Cyber Deception: How To Get Inside The Mind of A Hacker with Rob Black
www.razorthorn.com/the-art-of-cyber-deception-how-to-get-inside-the-mind-of-a-hacker-with-rob-black/
Connect with your host James Rees
For more information about us or if you have any questions you would like us to discuss email podcast@razorthorn.com.
If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.
Website: www.razorthorn.com
Переглядів: 515
Відео
How to Optimise Your GRC Tools: Improving Value, Efficiency & True Risk Management
Переглядів 1,9 тис.14 днів тому
In this episode of Razorwire, we're joined by Jack Jones, creator of the FAIR risk model, to explore the complexities of Governance, Risk and Compliance (GRC) tools. We cut through the noise to deliver actionable insights on how to truly manage risk and improve the value and efficiency of your GRC solutions. Key Takeaways: The Real Cost of GRC Tools: Uncover the hidden expenses and renewal pric...
Navigating Mental Health, Narcissism & Burnout in Cybersecurity with Lisa Ventura MBE
Переглядів 4 тис.Місяць тому
Navigating Mental Health, Narcissism & Burnout in Cybersecurity with Lisa Ventura MBE
ChatGPT vs Cyber Threats: The REAL Role of AI in Cybersecurity | Razorthorn Security
Переглядів 4,6 тис.Місяць тому
ChatGPT vs Cyber Threats: The REAL Role of AI in Cybersecurity | Razorthorn Security
DORA & NIS2: The Cybersecurity Regulation Revolution | Razorthorn Security
Переглядів 2,8 тис.2 місяці тому
DORA & NIS2: The Cybersecurity Regulation Revolution | Razorthorn Security
Contextual Security and Beyond: The Future of Cybersecurity | Razorthorn Security
Переглядів 2,4 тис.2 місяці тому
Contextual Security and Beyond: The Future of Cybersecurity | Razorthorn Security
Top Cybersecurity Priorities for 2024 | Razorthorn Security
Переглядів 1,1 тис.2 місяці тому
Top Cybersecurity Priorities for 2024 | Razorthorn Security
DORA Compliance: Insights & Strategies with Paul Dwyer | Razorwire Podcast | Razorthorn Security
Переглядів 4,3 тис.3 місяці тому
DORA Compliance: Insights & Strategies with Paul Dwyer | Razorwire Podcast | Razorthorn Security
Secrets of a Cyber CEO: The Truth About Running a Cybersecurity Business with Jane Frankland
Переглядів 2,1 тис.3 місяці тому
Secrets of a Cyber CEO: The Truth About Running a Cybersecurity Business with Jane Frankland
Redefining Cyber Insurance to Meet Today’s Cybersecurity Challenges
Переглядів 504 місяці тому
Redefining Cyber Insurance to Meet Today’s Cybersecurity Challenges
What Really Grinds My Gears In Infosec!
Переглядів 1624 місяці тому
What Really Grinds My Gears In Infosec!
The Art of Cyber Deception: How To Get Inside The Mind of A Hacker with Rob Black
Переглядів 8765 місяців тому
The Art of Cyber Deception: How To Get Inside The Mind of A Hacker with Rob Black
Trust vs Control - Is Zero Trust Inevitable in Cybersecurity?
Переглядів 2,6 тис.5 місяців тому
Trust vs Control - Is Zero Trust Inevitable in Cybersecurity?
Hacking Cybersecurity Training: Escape Rooms & Entrepreneurial Thinking with Amy Stokes-Waters
Переглядів 1,4 тис.6 місяців тому
Hacking Cybersecurity Training: Escape Rooms & Entrepreneurial Thinking with Amy Stokes-Waters
Cybersecurity Burnout and Organisational Culture with Yanya Viskovich & Eve Parmiter
Переглядів 22 тис.6 місяців тому
Cybersecurity Burnout and Organisational Culture with Yanya Viskovich & Eve Parmiter
Can FAIR Really Revolutionize Your Risk Management Strategy?
Переглядів 7567 місяців тому
Can FAIR Really Revolutionize Your Risk Management Strategy?
The Real Impact of the Lockbit Ransomware Takedown | Razorthorn Security
Переглядів 6 тис.7 місяців тому
The Real Impact of the Lockbit Ransomware Takedown | Razorthorn Security
The Rise of Cyber Mercenaries: Governments' Secret Weapons in Cyber Warfare | Razorthorn Security
Переглядів 7027 місяців тому
The Rise of Cyber Mercenaries: Governments' Secret Weapons in Cyber Warfare | Razorthorn Security
Cyber Trends in Identity and Access Management with Simon Moffatt || Razorthorn Security
Переглядів 8628 місяців тому
Cyber Trends in Identity and Access Management with Simon Moffatt || Razorthorn Security
Adapting to Legislative Demands: Insights on Cyber Security Compliance in Critical Infrastructure
Переглядів 7598 місяців тому
Adapting to Legislative Demands: Insights on Cyber Security Compliance in Critical Infrastructure
Cybersecurity in 2024: Expert Predictions You Need to Know || Razorthorn Security
Переглядів 6719 місяців тому
Cybersecurity in 2024: Expert Predictions You Need to Know || Razorthorn Security
Beyond Buzzwords: The Truth About AI
Переглядів 5369 місяців тому
Beyond Buzzwords: The Truth About AI
Unleashing the Hidden World of Cybercriminals: The Growing Threat of Cybercrime-as-a-Service
Переглядів 47210 місяців тому
Unleashing the Hidden World of Cybercriminals: The Growing Threat of Cybercrime-as-a-Service
SolarWinds’ CISO Under SEC Scrutiny: The Impact On The Infosec Community || Razorthorn Security
Переглядів 26010 місяців тому
SolarWinds’ CISO Under SEC Scrutiny: The Impact On The Infosec Community || Razorthorn Security
Decoding Generative AI: Myths, Realities and Cybersecurity Insights || Razorthorn Security
Переглядів 26211 місяців тому
Decoding Generative AI: Myths, Realities and Cybersecurity Insights || Razorthorn Security
Lessons from an InfoSec Icon: A Fireside Chat with PCI Guru Jeff Hall || Razorthorn Security
Переглядів 37411 місяців тому
Lessons from an InfoSec Icon: A Fireside Chat with PCI Guru Jeff Hall || Razorthorn Security
The Use Of AI In Cybersecurity - Consultants Roundtable || Razorthorn Security
Переглядів 313Рік тому
The Use Of AI In Cybersecurity - Consultants Roundtable || Razorthorn Security
Cyber Insurance - Does it Create More Problems than it Solves?
Переглядів 103Рік тому
Cyber Insurance - Does it Create More Problems than it Solves?
The Human Psychology Behind Cybersecurity with Bec McKeown
Переглядів 116Рік тому
The Human Psychology Behind Cybersecurity with Bec McKeown
DORA Compliance Made Clear: Essential Training for Safeguarding Financial Institutions w/ Paul Dwyer
Переглядів 236Рік тому
DORA Compliance Made Clear: Essential Training for Safeguarding Financial Institutions w/ Paul Dwyer
Microsoft 365 is ransomware. The cure is Open Office
Never pay. Make it illegal to. That's how you stop ransomware.
Great
Good
❤
This is such an outdated understanding of LLM's. We describe LLM's with vector spaces now. If 2 tokens appear next to each other it combines the vector arrows to point to the next token in the latent space.
Simmilar, you want an emergency shutoff on an intelligent robot. He will fight you to push it if it is hindering him on performing its task or push it himself because it is the fastest way to an endpoint in his tasks depending how you implement it
Its only technology when it serves the entire human race . Otherwise it only serves those who are going to enslave you .
P😢😢😮😅😅😊😂🎉❤❤
I think the three word answer has been frowned on. Education teaches you it should be a well rounded answer of atleast a thousand words. Communication is failing.
Dora is a name that basically means God's Gift. a little bit OTT to call your act that.
Indeed. It's a game of chess
The Subscription model is far more difficult to get out of that than having Hardware onsite. 24:33
It's extremely interesting to note threat management by the end user is not a "training" limit. I have found most Security training skirts around the Threat modelling and relies on example. I think if you manage the threat models in your Organisation and lead training and running exercises. This then changes everything in your organisation and you promote team work. I think if you rely on an end user, they will make a mistake. I think if it's an Organisation/Business/Department/Team that is being relied on, you have a much better chance at defending your Systems a lot better.
So true. 😢
YES! I get annoyed when I have to interpret from technical to normal.. it's just frustrating. Modern IT people have to get they are no longer technical sit in the cupboard geeks. They have to be customer focused and understand business needs and work out the technical piece. Techies are employed to be the technologist for the business.
Errors are an opportunity to improve. If you are "perfect|" you just learn arrogance.
Well said 👍
This is a great little video.
Thank you!
Look at Close Quatre protection. They are all ensuring Cyber Security is on their syllabus
Safeguarding by government is "ban". However Safeguarding is explaining why you shouldn't but giving the choice.
AI fighting AI is the matrix
NCSC just advises to turn every Security measure on. We need a PROPER INFOSEC Council. It should be a volunteer basis for selection.
I think, while people before didn't trust the media it was more a hidden thing. People still watched the news without thinking. Now it's open hostility against the mainstream media. It's a fact checking exercise, or find your trusted sources for viewing.
the main things I think info Sec is missing, When it's government anything, the market for the software required is very very small. Which has an impact on support and responding to security issues. Until development comes back in house, that will never change. Departments simply can't afford to do that.
Maybe you would see the good side of them if every once in a while you would get up from your chair
You should do the same with no credibility you bum
Sounds interesting, but what is AGI and LLM mean
AGI - Artificial general intelligence (AGI) is a form of AI that possesses the ability to understand, learn and apply knowledge across a wide range of tasks and domains. LLM - Large language models (LLM) are very large deep learning models that are pre-trained on vast amounts of data. The underlying transformer is a set of neural networks that consist of an encoder and a decoder with self-attention capabilities.
standing UART/FW/SW back doors by design. Create Problem. Anticipate Reaction. Provide Gates' funded Hegelian Digital-ID "Solution".
Perhaps it's seen as responsibility lays with Ciso.
CISO has ultimate responsibility to highlight/Create a task/Write policy. However as an employee, they "MUST" protect themselves.
I think you made a huge assumption about Risk management. I think a lot of "security" or IT teams rely on third parties to tell them about risks and assign priority.
the thing about Bank robbers is that very very few get away, the vast majority of people who think they can get away with it, don't last through the first night before they are arrested.. CAMERAS ARE EVERYWHERE, you can't get away from them, even trail cameras are catching people now days..
I found it very good. I found that as it's stated, you need to train it. You need to know your questions, and you need to know the answer it's potentially going to get out of it. It's a tool or the dyslexic. I even ran a table top role play game from it. It started well but then starts including things outside of the perimeters you gave it.
I think compliance is always just basic. It's the same with accessibility compliance as well. The biggest issue is compliance is see as the highest standard and that needs to change
Tai ai or something like that, days not months and you could force it say what ever you wanted it to say
Insightful, thanks!
Glad it was helpful!
In a Raytheon IRAD, (non-classified), I proposed that Decision Engines would need a human authentication at any critical event. So everyone needs to chill on AI taking on more than a workflow/authorization/RBAC AIM model needs to understand at basic fundamental levels. Anyone doing counter to human authorization should get their ass sued off for being... dumb...
40 years ago, system admins and sysops didn't even think to put passwords on TimeShare systems. Lot of same brains are repeating same mistakes with AI...
Had to spank the Feds bottom when I was a kid to show them how I got a total list of ARPANET & MILNET Addresses before there were laws against it, they had to use fraud by wire... it didn't stick. :)
Interesting
How is this interesting that’s concerning!
Promo-SM 🙂
You also fund the higher the rates, the more likely breaches will happen as it makes it more fiscally viable
James, you give some great advice here. Thanks again for your guidance along the way!
So what do we do? WE GO TO THE FUCKING GYM!
This is what I say to women to seduce them. It gets them wet everytime
This guy talks too slowly.
Babe. Galit. Ka
This isn’t something I really thought of doing for some reason, I’m in the middle of leaving the army and have been thinking of a multitude of careers from being a blade technician in the wind industry to just driving a truck. Haven’t got a clue what I want to do and I will be out by the end of the year, and I’m still in two minds, this is definitely something I could look at, thank for the video.
Good video bro
Idk man maybe they have some of the best cybersecurity professionals because they're literally surrounded by enemies and have been in perpetual war for decades
I think you are probably right, but then again pretty much every major country and quite a few smaller ones have been actively undertaking low grade probes and attacks on one another for some time now. We are seeing a huge uptick though, due to what's going on in the world at the moment. Now we have cyber combatants actively practising their craft with many more interesting and damaging attacks.
Great content and I agree, People need to be at the forefront of a solid cyber practice. It's not easy to find people with the right skills - they often move around together between jobs. This is why it's so important to provide a positive day-to-day experience for cyber teams and try to, as a leader, remove frustrations and build a team and environment where continous improvement and innovation can thrive.
I totally agree, cyber security is a tough area to be in, where the professionals are quite often frustrated and under fire from other departments in the organisation to not hold up projects or to stop meddling with innovation - it can get pretty demoralising. Lots of work needs to be done in hearts and minds around the other departments to realize we are not there to be their enemy; we are there to protect them from the things/people that can be harmful to the organisation. This can do wonders for positive reinforcement to the members of the Security teams… that and buy them beer or a bunch of doughnuts once in a while!
👏 ρɾσɱσʂɱ
Thanks for sharing me, we actually have a lot of lives that we have did catching the demonic to show it's real. Impossible to fake a lot of what we have caught