April 21, 2021

Data Risk Governance w/ Patrick Benoit

by Cyber Ranch

Listen Now

Data Risk Governance w/ Patrick Benoit

April 21, 2021 Cyber Ranch

00:00:00

Show Notes

Howdy, y’all, and welcome to The Cyber Ranch Podcast! With us today is Patrick Benoit, Global Head of Cyber GRC, and BISO at CBRE. Patrick is here to talk about Data Risk Governance, a slightly new twist on an old problem. Like our host, Patrick is also from the Dallas-Fort Worth area of Texas. To start the conversation, Allan asks Patrick to share a little about himself, his background in information security and what he does at his day job. Patrick began his career in the military, eventually coming over to consulting and enterprise. He has built out more than one BISO program, and has run multiple GRC programs as well. Patrick has a customer-facing security role and believes that all security leaders are also, to some degree, sales leaders. Allan and Patrick walk through a very practical approach to Data Risk Governance, starting with 'big chunks' and working towards the future with data tagging. They discuss briefly various rules for dealing with older data and various means of risk measurement. Ultimately their model is designed to work over a three-year or five-year period, encompassing all data in the organiztion by that time. Key Takeaways 0:23 Allan introduces Patrck 1:36 Patrick shares his cyber background and his jay job 4:10 Patrick introduces his model of Data Risk Governance, which began as a sales/marketing tool and evolved into a "real" practice 5:59 Patrick introduces the precursors to setting up a proper Data Risk Governance program, which includes data classification among others 8:01 Allan explains how data disocvery and classification can be expensive and yet still only partially succesful 9:12 Patrick advocates his 'one bite at a time' method based at first on broad strokes of known valuable/risky data 10:45 Allan describes multiple data loss stories from his past 12:10 Patrick delineates in more detail the 'big chunks of data' method and his firewall analogy of allow/deny 13:23 Patrick notes that classification followed by tagging is a great approach 13:57 Allan proposes a new-data-only go-forward plan and Patrick agrees 15:56 Patrick talks about how the legal department owns data retention rules 17:30 Talks about how chat messages should be volatile 19:00 Allan proposes usese tagging to manage destruction and retention 21:00 Patrick notes that reducing risk by tagging some of your data is better than tagging none of it 23:30 Patrick discusses his model for quantifying risk vs investment as an 'orders of magnitude' problem with dollars as unit of measure 25:17 Allan proposes the car insurance model to counter Patrick's life insurance model 26:00 Allan talks about accurizing risk measurement and discusses briefly models like FAIR and Bayesian math vs. Patrick's orders of magnitude method 27:09 Patrick uses the 5x5 method not as a specific measurement but more as a visual aid and heatmap 29:11 Patrick explains what keeps him going in information security Links: Learn more about Patrick Benoit on LinkedIn and on Twitter Follow Allan Alford on LinkedIn and Twitter Learn more about Hacker Valley Studio and The Cyber Ranch Podcast Sponsored by our good friends at Axonius
Read more

Recent Episodes

September 20, 2023
by Cyber Ranch

Allan is joined by AJ Grotto: William J. Perry International Security Fellow and Founding Director of the Program on Geopolitics, Technology and Governance at Stanford University.  He also serves as the faculty lead for the cyber policy specializatio...

September 13, 2023
by Cyber Ranch

Warning: Some naughty language in this show, but well placed naughty language! Challenge issued!!!! Allan has teamed up with TWO other podcasts to take on the insufferable marketing that floods the cybersecurity industry in the month of October! Who ...

September 7, 2023
by Cyber Ranch

Nearly 43% of cyber-attacks are on small businesses. 82% of ransomware attacks were targeted at companies with less than 1000 employees. 61% of SMBs were the target of a Cyberattack in 2021. 37% of companies hit by ransomware had fewer than 100 emplo...

August 30, 2023
by Cyber Ranch

You know you're being watched, right? Imagine for some reason you needed to bury a treasure where nobody would ever find it.  In today's society, how could you even do that?  How can you get from Point A to Point B without being observed or tracked i...

August 23, 2023
by Cyber Ranch

In this LIVE! show at Black Hat, Allan and his friend George Finney (recurring guest, CISO @ SMU, multi-times author and CEO of Well Aware Security) discuss cybersecurity in popular culture.  They talk about the impact on real-world cybersecurity pra...

August 16, 2023
by Cyber Ranch

Did you miss Black Hat this year?  Well you won't miss the great conversations that were had, as Allan captured so many good ones for this special Black Hat retrospective episode.   Did you get to attend Black Hat this year?  See if your experience w...

August 9, 2023
by Cyber Ranch

A brief thank you to our listeners and a request for feedback on the show. We'll catch y'all next week!

August 2, 2023
by Cyber Ranch

The OpenSSF is doing invaulable work for the cybersecurity community.  And their new managing director happens to be Omkhar Arasaratnam, whose appearance on the show a while back created one of our most popular episodes ever!  Omkhar is back to talk ...

July 26, 2023
by Cyber Ranch

Cloud security remediation can be a daunting task that impacts Dev, Sec and Ops teams all.  And it can be a huge, manual, pain in the...  You get the idea.  But there are techniques to navigate it and to overcome many of the common traps and hurdles....

July 19, 2023
by Cyber Ranch

In this episode, Allan and Drew tackle and interesting subject that was suggested by Drew and that Allan posted for the LinkedIn community to gather around: things we believe in cybersecurity that we cannot prove. The LinkedIn conversation was phenom...