10-24-19 - Which Security Framework Will Our Bachelorette Choose?

Which Security Framework Will Our Bachelorette Choose?

October 24, 2019

CISO | Security Vendor Relationship Series

This week's episode of Defense in Depth

Best Starting Security Framework

 On this episode of Defense in Depth:

Co-host Allan Alford and our Omar Khawaja, CISO, Highmark Health., discussed:

  • When determining a starting security framework, always lead with the "Why?" What are you trying to accomplish and achieve?

  • In some cases you're building a framework to build trust.

  • Although most in security take a risk-based approach. That's not always necessary when picking a framework. Frameworks are often very regulatory driven.

  • Framework decisions will be built on both internal and external pressures.

  • If you don't have a specific security problem, a specific security solution makes no sense.

  • The Secure Controls Framework is a free meta-framework that allows users to pick and choose elements from multiple frameworks.

  • Check out Allan Alford's four-year mapping of NIST CSF, CIS CSC 20, and ISO 27001.

  • While there are plenty of great frameworks out there, for someone who is truly starting from scratch, many security professionals pointed to the CIS top 20 because it maps to frameworks like NIST and ISO.

Special thanks to this week's Defense in Depth podcast sponsor, Palo Alto Networks.

Palo Alto Networks

Palo Alto Networks, the global cybersecurity leader, is shaping the cloud-centric future with technology that is transforming the way people and organizations operate. By delivering an integrated platform and empowering a growing ecosystem of partners, we are at the forefront of protecting tens of thousands of organizations across clouds, networks, and mobile devices. 

Adrian Ludwig, CISO, Atlassian on trusting users

TOMORROW! October 25th: Video Chat: How to Create Attractive Entry Level Cybersecurity Jobs

Join me, Taylor Lehmann, vp, CISO, athenahealth and Michael Piacente, managing partner, Hitch Partners. CISO Series for a discussion on getting people into the field of cybersecurity. These discussions are wide open for anyone to participate. Go ahead and register. The fun happens at 10 AM Pacific tomorrow.Here's one question to think about for tomorrow's discussion.

Mike Johnson said, when you explain your AI it doesn't mean we're going to build it ourselves

SUBSCRIBE TO BOTH PODCASTS

Go ahead and click on any of these links to subscribe to the podcast feed of your favorite podcast catcher.

If you're already a subscriber, THANK YOU! If you like either or both shows, please tell all your friends on social media and write a review on iTunes.