- Hi and welcome back to the channel
am Michael, InfoSec governance.
And in today's video, we're gonna discuss cyber security
risk governance, and compliance, otherwise known as GRC.
Before you all start whining, complaining
and leaving the video.
This video is hopefully gonna explain a few things
about how to keep your business secure, reduce the risk
within the business and make information security programme
a bit more robust, if you haven't already got one.
The GRC topic, can be massive and we're only gonna touch
the sides of it.
So if you wanna know a bit more about it,
feel free to drop a comment below the video
and let us know that you wanna know a bit more about it.
And then we can actually make a couple more videos about it
and just expand upon the topic, whether or not
it's governance, if it's risk, if it's compliance,
if it's cyber security, anything like that.
Just drop a note in and we'll go from there.
So let's get under there.
Now, again, in GRC and cyber security within the business.
If you didn't already know both topics
pretty much go hand in hand together with each other.
It makes a nice mature information security programme,
if you didn't already have one, it can help you work
towards building one up and going from then moving on.
But what exactly is cyber security and GRC?
Well, cyber security is a term that's primarily
used to define the protection of smart based devices
in your mobile phones, devices, tablets, computers
pretty much anything that's online.
Cyber security in itself can be a massive topic.
We won't really be touching on that
but it's pretty much going against anything that is online
is the security of the cyber.
(laughs) pretty much.
Cyber security is a vast topic,
however, it's all about ensuring that the(indistinct)
is protecting against unauthorised access
to any type of information within your business.
Whether it's personal information, it's IP information,
anything like that.
So there's a few steps that we're gonna do for businesses
to ensure that(indistinct)has put in place to protect it.
One of them is firewalls.
Ensuring that your firewalls are in place,
turned on both at the border, where the internet is
and on each device within the company.
So on your computers, on your smart devices
and things like that.
If it's got support for firewalls, stick it on.
The next one is a good debate firewalls.
Once that's done, you've got antivirus and antimalware.
This has a massive debate.
Some people say, "Yeah, put antivirus and antimalware on."
Some people say, don't use it if you don't need it.
My personal experience is, put it on,
if you've got to put it on, it's better than nothing.
Even with a windows defender these days
and windows 10, it will protect you against stuff.
And if you do get infected, if you do get a breach
inside your network, it can actually reduce
the lateral movement between attacks and stuff like that.
So I'll let you make it harder for anyone
who actually gets into your environment.
Another one, you could do as well as keeping your computers
and systems up to date, ensuring that thermos installed
and everything's patched up to date, operating systems
are up to date, your mobile operating systems
are up to date, third party apps are up to date.
Just making sure everything's kept up to date
and make it nice and easy for you.
And then obviously, depending upon what your business is,
you might even look at penetration testing
or anything like that as well.
Now, this hasn't covered all aspects of cyber security
because as I said, it's absolutely massive
but it gives you a little bit of a view of
how to protect your business, moving on from there.
So with that done, let's move on at GRC
and let's talk about it and find out what actually it is.
What's it made up of and going from there.
GRC, which is pretty much, governance, risk and compliance
is referred to a strategy which is pretty much used
within businesses, for managing
business overall risk management and compliance
against various regulations, which need to be performed.
I'd hear too, if you're in healthcare if you're in legal,
if you're in finance, stuff like that
you have to adhere to various regulations.
GRC helps that your business comply with that and
move forward.
Now your business doesn't have to be in these areas
to comply with GRC, but it fits every business.
But obviously it depends upon the size of the business,
depends upon the size or the complexity of your GRC programme.
But hopefully this video will give you
some food for thought, work through it,
understand what it is and how you can tailor it
for your own business itself.
GRC is a sort of standardised approach
for helping businesses design and align
their IT business objectives,
thereby effectively managing your risk
and helping you meet
those necessarily compliant requirements if you've got them.
GRC forms a framework, or can form a framework
within the business, such as standards like ISO 27,001 9,001
and things like that.
But GRC pretty much ensures that the processes are implicit
in your business and that you've got your processes
your policies, your standards, and everything put
in place that everyone follows and works from there.
And you've got that underlying framework that just
hopefully bonds and makes the business work.
Now by now, implement GRC within the business.
It can help your business identify it
and reduce the risk within the business.
It can help to control the effectiveness
of your security and compliance.
And it also helps you to remove those siloed departments
by bringing in the tip of team of people
who can actually work around within the business
identify all those risks, within the business
and look at adhering to all the policies
and procedures and things like that.
And actually working throughout the business itself.
You no longer have to have those siloed businesses
or departments that everyone just looks after.
For example, your QA environment
maybe only have certain dedicated people who work in QA.
You might have your development team that only look
after their own side.
You might have the HR that only look after them.
If you've got a nice GRC framework put in place
and you've got those dedicated people that actually work
for it, they have overall visibility
within the entire business and they can go around
and actually talk to the whole business.
And there's not actual isolation
between department or department.
They cannot sit right at the top
of the business and then naturally look over it,
look down and work with all the other teams
within the business.
Now that we have...I guess a brief understanding
of what GRC is, it's tempted actually break down
what GRC is, what the components are
and go through the following sections.
And we'll just discuss what governance is,
risk is, compliance is and how they all work for
your business and how it all, I guess, gels informs GRC.
So first component of GRC is governance,
governance defines the way that your business is managed
and controlled within the environment within GRC terms.
It's a weird that allows the business to
set that stage direction.
Now, this is usually based upon implementing strategies
policies, procedures within the business and
adhering to a standardised framework.
The governance is designed and signed off
by someone more senior within the business
'cause without your care or the CSO, senior management
then if any issues occur within the business
the people manager that compliance
or the risk of the business itself will have no backing.
So if there's any issues, any incidents
or anything like that, if you don't have the CSO
from the senior management, then nothing's gonna be done.
And then you haven't got the backing
and the CSO of saying, look, we need to do this.
We need to manage this risk.
We need to meet these compliances.
If you don't have that, then there's no system
in place there for you.
So as part of the GRC
and getting the governance sorted,
make sure you've got the senior management on board,
you've got the board level
or anyone like that on board like that, moving forward.
Now, additionally, without having the governance part
of the framework in place
there's no certainly control there
and measure your risk and compliance within the business.
And therefore it feels like I've just mentioned
everything that kind of all just falls apart.
If there's no bonding or there's no membership like that.
Moving onto a risk, a risk is identified as anything
that could 'cause harm or loss to your business.
A good example of risk is this pandemic,
how many people didn't actually identify
that might be a pandemic in the next couple of years.
Everyone was pretty much taken by surprise
the way Covid hit.
And everyone's just had to adapt
and move forward straight away.
You know, everyone's pretty much working
from home now or the, where are they gonna be.
So how does that risk affect your business?
Did you work for it?
Did you plan for it?
Did you have supplies in place for it?
Could everyone VPN into the machines, into the office?
Did everyone have laptops?
Could they actually work from home?
Is everything in the cloud as everything just
locally installed on the machines, in the business.
And then they've had to adapt, rush in and get that sorted.
So those are the kind of the areas
of the risks you've got to look at.
Although it doesn't have to end at that.
You could look at your supply chain just this week alone,
looking at solar winds and stuff like that
and all those incidents.
(phone beeping)
And that was my phone.
Apologies for that.
So yeah.
Now once you've identified your risks
you've got to keep them in store,
keep them in an asset register
and keep them up to date, continuous assess them
and look at them.
Now we've discussed risks and risk creditors before,
I'll stick a link into it up here somewhere.
And then you're gonna have a look at that.
If you don't know what it is, but by identifying your risks
no matter how small it is,
will improve your business, moving forward.
Now in GRC terms, risk management ensures
that your business identifies analyses
and coordinates any risks that have been found
could cause harm, or possibly do real the achievement
of your overall objectives within the business
that you've already defined.
Now with all that with risk, yes, it's a bit of a rant
but I will move on to compliance, which is next.
Now complliance in GRC terms.
And for the most part of businesses is ensuring
that your business follows and adheres
to a strict set of guidelines that you've implemented
or you've defined within your business.
Now, this usually forms around your policies
and procedures that you've got within the business itself.
Complaints ensures that you are achieving
and implementing the measures and controls
that you've you've set out for any requirements.
Compliance is a kind of a living thing
within the business like ISO 27,001
you need to mark it on homework and tourney.
So what you should be doing is performing
internal orders regularly, or at least reviewing your risks
your business, your supply chain
what accreditation you need, what compliance do you need?
Do you have to sign
up to third-party services or anything like that?
And go from there, especially with Brexit
and stuff like that for the UK
there's a lot going on in the coming couple of months
with us leaving the EU, have you defined,
what compliance procedures you need to do adhere
to supplying people outside into the EU
or anything coming in from the EU to the UK.
Have you identified all that sort of thing?
Now this might sound like a lot of work
and a lot of ranting.
And in theory, it can be at the start, especially
if you don't have any type of framework and player.
So you're not aware of ISO standards and things like that.
But once you actually started after
or do you need to do is kind of piecemeal it out
identify your risks, identify what assets you have
like pit works, assets, computers, things like that.
And then just identify those, write them down, look at them
build them all up, build the team
that we're gonna look after this.
If you're a small person, it might just be one member team.
If you're a larger company, it might have two, three
four people all working as part
of a team and also get the backing
of the management and go from there.
So now that we've covered all the boring stuff
why is GRC important in the business?
Well, basically it comes down
to the streamlining organisation of the business.
Yes, I've said business quite a lot in this video
but it helps you to implement the framework
and get the reassurance
and get the standardisation of the business.
You have everything covered.
Everything's running smoothly.
You've identified all the risks.
You've identified that the compliances
to all the compliances externally to the business
as well as in the business, you're identifying
that people are following your procedures, your policies
everyone knows what's going on.
What you might be thinking is,
How do I actually do this?
How do I piece it out?
Well, you can be productive, you can plan,
you can design your framework piece at work, build upon it.
As I've said before, you're not looking at it.
There is the business,
identify the risks within the business.
What can be resolved?
What have you changed?
Is there a change control programme in place?
If there's not build one, put it all.
So, yes, we're going to put this change in.
Who's gonna be in charge of this.
Who's gonna build this.
Who's gonna do that.
What are the risks?
What happens if X, Y, and Z happens?
How can I resolve this and go from there?
But GRC is all about risks,
identification of management auditing, having a look
checking every single note to make sure everything's fine.
And going from there.
Yes. This video has been a lot of talking
and yes I'm aware that we haven't covered
an awful lot of it because there's an awful lot to it.
But if people are interested in this
and want to know a bit more about it, put some content
below the video, we can break it out a lot more.
We can have dedicated videos on the governance aspect
a lot more on the risk
and a lot more on the compliance
and just work into it a little bit more
and delve into it a bit more.
Maybe show a bit more documentation
things like that and go from there.
So yeah, I hope you liked this video.
Feel free to like the video, please.
Like the video.
It helps us identify how many people watch it,
you like this, subscribe to the channel
to help us grow the channel and yeah.
Find out a bit more information
about what we're going to push out in the coming months.
We've got a lot of videos in the pipeline.
So hopefully this is gonna help you understand
and build the frameworks and that for your business
and just help you secure your business in the future.
Thanks a lot.
(upbeat music)