Episode 203 - Evaluating Your Security Program: Threat Mapping

Show Notes Episode 203 - Evaluating Your Security Program: Threat Mapping Why Evaluate Your Program Part of annual policy review If you don't evaluate you will never improve Continual review will help protect your budget Awareness and Education is how most people in your org know the program Threat Mapping maps the outside threats to your inside controls & tech Communications is that final turn from the inside out Start At The Outside and Move Your Way In How is this different from threat modeling? Threat modeling is listing what could happen to you. Threat mapping is mapping the holes in your program. What is "Threat Mapping"? Must have a assessment management program you can't protect what you don't know about This isn't "I have a CMDB". It's actually taking actions based on what you know about what you have Map assets to known threats industry entry points technology Online threat maps What are you doing to know this? What controls do you currently have in place to mitigate or reduce the risk? Understand what your "real" threats are Apps Infrastructure 3rd parties etc Scope and prioritize - break down into areas to tackle How To Get Started Scorecard (KRI) What is important and helpful Risk Registry How To Measure Use your risk registry or GRC tool to track progress and keep management updated. You need them onboard to improve. once you have some areas mapped don't ignore them implement solid change control and change management processes keep risk scores updated so you aren't focusing on unimportant things How To Improve/Modify

You can listen to Episode 203 - Evaluating Your Security Program: Threat Mapping online on Radio and Podcast. Open the player on this page to stream the available audio.

Episode 203 - Evaluating Your Security Program: Threat Mapping is an episode from The Southern Fried Security Podcast by Martin Fisher.

This episode is 24:12 long.

This episode was published on Feb 13, 2018.

Yes. Use the heart button on the episode page to add it to your favorite episodes list.

Yes. This page shows related episodes from The Southern Fried Security Podcast when more episodes are available from the podcast feed.