Paul Figini

Congratulations to the KPMG UK Cyber Risk Insights (CRI) team for being selected as The National Cyber Awards finalists in the Startup Innovation in Cyber Award 2024. Yet another nomination for this team and product! 🏅CRI is a Cyber Risk Quantification (CRQ) SaaS product developed in-house by a multi-disciplinary team, including Cyber Security, Data Modelling, Software and Cloud Engineering, Econometrics, Digital Design, and Actuarial expertise. 🔀 Combining Boolean logic-based cyber scenario attack paths, threat intelligence and organisational context. CRI enables clients to make more accurate and confident decisions on budget adequacy, investment selection/ prioritisation, resource allocation, and level of cyber insurance cover. 💰Core features include the cost-benefit analysis and ‘Where to Invest?’ analysis helping clients to build benefit cases (in financial terms) of risk reduction at an individual investment level and an overall portfolio level. 🎯 Using a multi-variate analysis (running millions of combinations) helps CISOs determine optimal investment strategies to best combat the cyber threats facing their organisation. Martin Tyley | James Hanbury | Jack Whitaker | Thomas Ballard | Mike Y. | Laurie Gibbett | Andra Mihu | Zsofia Szabo

157

11 Comments

Working with clients recently the big fear has been cyber any yet so many seem to focus the response exclusively around IT security and resilience. Some useful tips below.....

2

What do all the following job titles have in common? Take your time and really read them. Board-Qualified CISO Global Client Security Manager Global Head of Security Governance, Risk and Compliance Consultant Information Security Manager Information Security Officer Information Security Professional IT, Risk & Security Professional Lead Consultant Cyber Security Consultant Cyber Security Company Founder Cyber Security Advisor Cybersecurity public speaker Cyber Security Strategist Cyber Security Professional Cyber Security Lead Experienced Senior Associate Security, HSE and Risk Manager Security and Risk Manager Security Engineer Security Governance Lead Security, Intelligence, IAM and Risk Management Leader Security Consultant Senior Security Engineer Senior Cybersecurity consultant Physical Security Manager Risk Management Trusted Advisor Is it that they all sound very impressive? Close. Is it that they all bear significant organisational responsibility? True, but that's not it, either. Note that these are not entry-level job titles, folks. What could it possibly be? They all belong to people who got my poll this week WRONG. I shit you not. A poll about the most basic fucking thing in security practice. In fact, 70% got it wrong. Consistent with every other week that I have run The Bitter Pill. Now...tell me again how wrong I am about the state of the industry and the calibre of the people who claim to be 'professionals' in it. Tell me that my hostility to these people is unfair or unjustified. I fucking dare you. Every now and again, someone contacts me for coaching, and our conversations reveal that their biggest career fear is 'being exposed'. If that's you, consider what that means. It means that you are concerned that you are not presenting a true version of yourself and that if the real truth were revealed, you'd fear the consequences. If that is you, I suggest you consult your integrity and do something to fully understand and improve the truth of what you do. If you prefer not to...my contempt is well-earned, and you should be run out of the industry on a rail.

9

12 Comments

Organisations worldwide suffered large-scale disruption last week from a defective content update. We highlight the importance of effective operational resilience and third-party supply chain oversight. #financialservices #operationalresilience #thirdparty #risk #crowdstrike #outage

20

The new BNSS Criminal Procedure Code has thrown up a massive opportunity for cybersecurity experts focussed on the integrity of the chain of evidence. With videographed evidence to become the norm, with electronic delivery of documents now authorized, there needs to be a discussion on data encryption, data delivery, data protection, tagging, dating, and last of all storage. The scale is enormous. #data #cybersecurity #encryption #blockchain #storage

4