April 21, 2021

Data Risk Governance w/ Patrick Benoit

by Cyber Ranch

Listen Now

test
Data Risk Governance w/ Patrick Benoit

April 21, 2021 Cyber Ranch

00:00:00

Show Notes

Howdy, y’all, and welcome to The Cyber Ranch Podcast! With us today is Patrick Benoit, Global Head of Cyber GRC, and BISO at CBRE. Patrick is here to talk about Data Risk Governance, a slightly new twist on an old problem. Like our host, Patrick is also from the Dallas-Fort Worth area of Texas. To start the conversation, Allan asks Patrick to share a little about himself, his background in information security and what he does at his day job. Patrick began his career in the military, eventually coming over to consulting and enterprise. He has built out more than one BISO program, and has run multiple GRC programs as well. Patrick has a customer-facing security role and believes that all security leaders are also, to some degree, sales leaders. Allan and Patrick walk through a very practical approach to Data Risk Governance, starting with 'big chunks' and working towards the future with data tagging. They discuss briefly various rules for dealing with older data and various means of risk measurement. Ultimately their model is designed to work over a three-year or five-year period, encompassing all data in the organiztion by that time. Key Takeaways 0:23 Allan introduces Patrck 1:36 Patrick shares his cyber background and his jay job 4:10 Patrick introduces his model of Data Risk Governance, which began as a sales/marketing tool and evolved into a "real" practice 5:59 Patrick introduces the precursors to setting up a proper Data Risk Governance program, which includes data classification among others 8:01 Allan explains how data disocvery and classification can be expensive and yet still only partially succesful 9:12 Patrick advocates his 'one bite at a time' method based at first on broad strokes of known valuable/risky data 10:45 Allan describes multiple data loss stories from his past 12:10 Patrick delineates in more detail the 'big chunks of data' method and his firewall analogy of allow/deny 13:23 Patrick notes that classification followed by tagging is a great approach 13:57 Allan proposes a new-data-only go-forward plan and Patrick agrees 15:56 Patrick talks about how the legal department owns data retention rules 17:30 Talks about how chat messages should be volatile 19:00 Allan proposes usese tagging to manage destruction and retention 21:00 Patrick notes that reducing risk by tagging some of your data is better than tagging none of it 23:30 Patrick discusses his model for quantifying risk vs investment as an 'orders of magnitude' problem with dollars as unit of measure 25:17 Allan proposes the car insurance model to counter Patrick's life insurance model 26:00 Allan talks about accurizing risk measurement and discusses briefly models like FAIR and Bayesian math vs. Patrick's orders of magnitude method 27:09 Patrick uses the 5x5 method not as a specific measurement but more as a visual aid and heatmap 29:11 Patrick explains what keeps him going in information security Links: Learn more about Patrick Benoit on LinkedIn and on Twitter Follow Allan Alford on LinkedIn and Twitter Learn more about Hacker Valley Studio and The Cyber Ranch Podcast Sponsored by our good friends at Axonius
Read more

Recent Episodes

March 29, 2023
by Cyber Ranch

Becoming a CISO means changing a lot of perspectives.  Individual contributors need to learn this, and the CISO is the best one to teach them.  "They're never going to get it!" is a mantra used by both sides of that dialogue, and that is not a soluti...

March 22, 2023
by Cyber Ranch

This episode is a story about an entire vendor encounter gone horribly wrong.  Allan is joined by Paul Moreno, VP of InfoSec at Catawii, formerly SVP of Cybersecurity at Adyen, investor and advisor.  Paul found a cybersecurity vendor.  Paul found goo...

March 15, 2023
by Cyber Ranch

Join Allan and Dr. Mike Brass (whose degree is in archaeology!) as they jointly explore the technical side of the house vs. the GRC side of the house, noting that GRC can be a great path to CISO. Hear Mike's journey from IT technician to GRC to CISO....

March 8, 2023
by Cyber Ranch

We have this idea that we can be perfect.  And we know that idea is unsound.  So we settle for imperfection.  But are we doing that purposefully?  Do we have a conscious plan for embracing imperfection?  How can we, as cyber professionals, embrace ou...

March 1, 2023
by Cyber Ranch

In this episode, Allan is joined by Omkhar Arasaratnam, a force in the industry and an expert in the intersection of software and security (you may remember Omkhar from an earlier show about supply chain security). They challenge each other to a game...

February 22, 2023
by Cyber Ranch

Join Allan, Shaun Marion (CISO of McDonald's) and ChatGPT itself for a lively conversation about the implications of this new tool, AI in general, and nuances about ChatGPT's usage. Even after controls were put into place to prevent ChatGPT from help...

February 15, 2023
by Cyber Ranch

How important are communications after your company has been breached?  They can make or break customer perception, and the perception of the world.  Bad communications are perceived as bad intent. Joining Allan this week is Heather Noggle, owner of ...

February 8, 2023
by Cyber Ranch

Do you want to be a CISO one day?  Are you a CISO today who wants to strengthen your ties into the rest of the business?  The Business Information Security Officer (BISO) role is one you should explore. The role can vary quite a bit, as you will hear...

February 1, 2023
by Cyber Ranch

Joining Allan today are two folks who are passionate about leadership – not just practicing good leadership, but instilling good leadership in future generations.  Joey Rachid is CISO in the ecommerce and financial services industry, is on advisory b...

January 25, 2023
by Cyber Ranch

This week Allan is joined by Nipun Gupta, and industry veteran who has been a consultant, practitioner, vendor, advisor and investor. The topic is "What are we really protecting in cyber?" and the nuances of that question are explored in depth - as w...