How are you defending yourself against ransomware?
I have a similar approach for Data Loss Prevention (DLP). DLP, is a beast by itself, so I don't have a single pane of glass for it. The tool itself is the metric there. When I joined this organization, I did not do an entire inventory assessment, I did a risk assessment of it. I took an inventory of what my attack surface is like: What is the risk and what is the potential of those risks being realized as threats? I mapped it into an OWASP or MITRE ATT&CK framework, and came up with a strategy to let the risk drive my implementations and initiatives, as opposed to just classifying assets and other initiatives.
That's what you have to do. KPIs and risk assessments are valuable—especially with boards and CEOs—to be able to get the funding you need.
Exactly. Your data is speaking, so there is no reason for senior management to turn down some of this logic. Second thing, you readily have these metrics to share with the board on, whenever, on a quarterly or biannual basis, so that it's already there.
And off-site storage of my resume
Content you might like
crowd strike38%
sentinel one58%
carbon black5%
cynet0%
Most of the time the legals and or DPO don't have the technical acumen to understand when data is floating to third party services.
Lets ...read more
Yes - Maine did the right thing. There are too many security risks with free versions of these tools. Not enough copyright or privacy protections of data.31%
No, but.... - You must have good security and privacy policies in place for ChatGPT (and other GenAI apps). My organization has policies and meaningful ways to enforce those policies and procedures for staff.52%
No - Bans simply don't work. Even without policies, this action hurts innovation and sends the wrong message to staff and the world about our organization.12%
I'm not sure. This action by Maine makes me think. Let me get back to you in a few weeks (or months).3%
organized a virtual escape room via https://www.puzzlebreak.us/ - even though his team lost it was a fun subtitue for just a "virtual happy hour"
Fortunately, none of our customers have had ransomware incidents, but they are all very concerned about it. They’re looking at ways in which they can better manage their situation, including education. Technology's one solution, but they feel like the first thing they need to do is to educate their people to ensure that they understand the simple things. So it becomes a cohesive effort. Our organization is worried about ransomware and the first thing we're doing is educating everyone to take the right steps, like not opening emails of a suspicious nature, but also to plan for failure.