How To Sign California Banking Document

How to industry sign banking california document secure

hi folks a tomorrow so here and in this video I want to introduce a topic known as governance risk and compliance or GRC it's a discipline that's well known in business and government it involves for the most part doing those three activities governance risk and compliance let's talk through them so governance first of all involves sort of a high level oversight of the direction of an organization with respect to security risk controls attacks and so on so really tends to be an oversight kind of role often by a group a board of executives some senior folks with experience who can make sure that decisions are being made that will make some sense so that's the G part in GRC the middle and our risk is all about whatever needs to be done to reduce the likelihood of cyber attack and to reduce the consequence of attack and usually we keep track of a lot of different risks and and and issues where a requirement and maybe some better or intended requirement exists we refer to that as a gap and I'll get to that in a minute and then the third the C the compliance part really does in fact measure whether or not what you're doing matches some standard or framework that's either been imposed on you or that you've decided is a good idea to use a lot of times these frameworks will come from governments or from regulators or for third party auditors so governance risk compliance is the discipline and every business now has some sort of a GRC function probably supported by a platform now when you give you a night like an idea of how a GRC platform and a set of framework requirements can be used to improve security in a company let's say for example that a corporate security requirements document included a couple of different requirements one of them saying passwords have to be six characters long and the second requirement saying managers have to approve critical access requests fair enough and there may be some local definition of critical versus non-critical let's see that's the corporate security requirements that are in place and then for whatever reason a third party imposes on that corporate group a framework set of requirements let's say it's framework security requirements let's call it that and that embedded in that framework are two different requirements the first being that passwords have to be 8 characters long and that any type of request all access requests has to be approved by managers so what would happen is that as part of the GRC process the security team would go in and take a look at these things and say huh our requirement is that we want you know passwords to be six characters long that's good enough but this new framework coming along saying hey we've got to make them eight characters long that difference is referred to as a gap the gap means what you are doing is not as strong not as tight not as good as the thing you're being asked to do if it was the reverse if you were doing eight and the requirement was six you have no gap if you follow it's the strength difference if you're six and they want eight eight is stronger you have a gap so that's a gap in the first one the second we said in in our corporate requirements that managers only reprove critical access requests as opposed to non-critical but now we've got this framework requirement that says managers have to approve all access requests stronger requirement I have a gap that make sense in my requirements I have a framework that has some stronger requirements I measure a gap the GRC tool would help you identify that gap and would list you out so what do you do well you make the change you know you start with six and critical the requirements are eight in all what do you do you change your corporate requirements to eight character passwords and all requests have to be approved by managers now look this is not a simple matter of doing paperwork as you can imagine that paperwork implies all sorts of different implications on systems in the antor prize you have to go system by system group by group business unit by business unit perhaps individual by individual device by device checking to see if there's a requirement or a control that is okay with six characters now you have to change that to eight that could be a lot of work you can apply expense time complexity on the enterprise but again that's the purpose of the framework model the framework says you have to fix this six is too easy to guess it's too easy to hack so you go through that similarly the access request you have to go through all the different workflow activities in a business look and see well right now non-critical requests for access to whatever like I want access to this database it's not deemed critical so I don't have to have managers remove any sort of approval now with the new framework requirement I have to change the workflow there might be automation changes might require things to take more time it introduces bureaucracies all these negatives but the positive is it's more secure do you follow so GRC really is about adjusting requirements making them somewhat more in line with the threat model that makes sense in the environment and then when you make those changes think of all the backend work activities tend to say that GRC is best done when it's embedded in business processes and it has to be if you're going to comply with these types of changes you're going to be embedded in password access you're going to be embedded in management approval of access to resources and on and on these are just two examples there could be thousands of requirements so think how complicated this really can be for a business to establish compliance to a non-trivial set of requirements now the good news is if you pick one good solid framework and you do it once then chances are any subsequent framework that comes along will be met like for example in the United States you might be following a big national framework let's say you follow the requirements you do it needs to be done and you live in a state let's say you live in California and they come along with their own set of requirements so for example let's put a second framework here framework 2 and framework 2 comes in and it says uh passwords just need to be six characters and access just to the critical systems well you would look at that and you'd say six we already have eight critical we changed all we have no gap here so you could say you're now compliant with framework two without really having to do much but you may have some paperwork that would be attendant and did it let's see another a third framework comes along and they say passwords have to be seven and that access has to be all well I have access all in my passwords right again no gap do you see how subsequent framework compliance activities might result in little or no work now that's good news bad news it's good news because you're probably not going to have a lot of that attendant activity the backend activity in the business process of workflow to manage the compliance problem the bad news it's all this paperwork so I just did framework two and three I might have to work with an auditor to convince them that everything is already met I may have to fill out a bunch of forms I made a bunch of meetings that takes time and you could argue that that's time and effort that's wasted because you're not really improving security the first time I did it that was great that rocked III got requirements that weren't strong enough and I went in and improved things these latter two examples we went through we didn't change anything all we did was the paperwork and attended the meetings it's one of the reasons why a lot of cyber security experts are critical that compliance has gone too far that there are too many different frameworks and really what needs to be done is that it be done once and be done properly so I hope there's been a good example let's do a little quiz so the answer is D all of the above those are all true statements with respect to GRC platforms I think this is this is an area that has increased in its relevance in cybersecurity in recent years I think exponentially it's become absolutely vital but what we need is we need policymakers to think through how we can do one good solid framework once instead of driving so much paperwork for cybersecurity teams that could be better spent doing operational security so I hope this has been a useful introduction to GRC with our little case study and I hope this will inspire you inspire you to maybe look into GRC is something that you do in your own business Thanks