Howdy, y’all, and welcome to The Cyber Ranch Podcast! With us today is Patrick Benoit, Global Head of Cyber GRC, and BISO at CBRE. Patrick is here to talk about Data Risk Governance, a slightly new twist on an old problem. Like our host, Patrick is also from the Dallas-Fort Worth area of Texas.
 
 

To start the conversation, Allan asks Patrick to share a little about himself, his background in information security and what he does at his day job. Patrick began his career in the military, eventually coming over to consulting and enterprise. He has built out more than one BISO program, and has run multiple GRC programs as well. Patrick has a customer-facing security role and believes that all security leaders are also, to some degree, sales leaders.
 
 

Allan and Patrick walk through a very practical approach to Data Risk Governance, starting with 'big chunks' and working towards the future with data tagging.
 
 

They discuss briefly various rules for dealing with older data and various means of risk measurement.
 
 

Ultimately their model is designed to work over a three-year or five-year period, encompassing all data in the organiztion by that time.
 
 

Key Takeaways 
 

0:23 Allan introduces Patrck
 

1:36 Patrick shares his cyber background and his jay job
 

4:10 Patrick introduces his model of Data Risk Governance, which began as a sales/marketing tool and evolved into a "real" practice
 

5:59 Patrick introduces the precursors to setting up a proper Data Risk Governance program, which includes data classification among others
 

8:01 Allan explains how data disocvery and classification can be expensive and yet still only partially succesful
 

9:12 Patrick advocates his 'one bite at a time' method based at first on broad strokes of known valuable/risky data
 

10:45 Allan describes multiple data loss stories from his past
 

12:10 Patrick delineates in more detail the 'big chunks of data' method and his firewall analogy of allow/deny
 

13:23 Patrick notes that classification followed by tagging is a great approach
 

13:57 Allan proposes a new-data-only go-forward plan and Patrick agrees
 

15:56 Patrick talks about how the legal department owns data retention rules
 

17:30 Talks about how chat messages should be volatile
 

19:00 Allan proposes usese tagging to manage destruction and retention
 

21:00 Patrick notes that reducing risk by tagging some of your data is better than tagging none of it
 

23:30 Patrick discusses his model for quantifying risk vs investment as an 'orders of magnitude' problem with dollars as unit of measure
 

25:17 Allan proposes the car insurance model to counter Patrick's life insurance model
 

26:00 Allan talks about accurizing risk measurement and discusses briefly models like FAIR and Bayesian math vs. Patrick's orders of magnitude method
 

27:09 Patrick uses the 5x5 method not as a specific measurement but more as a visual aid and heatmap
 

29:11 Patrick explains what keeps him going in information security
 
 
Links: 

Learn more about Patrick Benoit on <a href='https://www.linkedin.com/in/patricklbenoit/'>LinkedIn</a> and on <a href='https://twitter.com/patrickbenoit'>Twitter</a> 

Follow <a href='https://allanalford.com/'>Allan Alford</a> on <a href='https://linkedin.com/in/allanalford'>LinkedIn</a> and <a href='https://twitter.com/AllanAlfordinTX'>Twitter</a> 

Learn more about <a href='https://hackervalley.com/'>Hacker Valley Studio</a> and <a href='https://hackervalley.com/cyberranch'>The Cyber Ranch Podcast</a> 

Sponsored by our good friends at <a href='https://axonius.com/'>Axonius</a>

Howdy, y’all, and welcome to The Cyber Ranch Podcast! With us today is Patrick Benoit, Global Head of Cyber GRC, and BISO at CBRE. Patrick is here to talk about Data Risk Governance, a slightly new twist on an old problem. Like our host, Patrick is also from the Dallas-Fort Worth area of Texas.



To start the conversation, Allan asks Patrick to share a little about himself, his background in information security and what he does at his day job. Patrick began his career in the military, eventually coming over to consulting and enterprise. He has built out more than one BISO program, and has run multiple GRC programs as well. Patrick has a customer-facing security role and believes that all security leaders are also, to some degree, sales leaders.



Allan and Patrick walk through a very practical approach to Data Risk Governance, starting with 'big chunks' and working towards the future with data tagging.



They discuss briefly various rules for dealing with older data and various means of risk measurement.



Ultimately their model is designed to work over a three-year or five-year period, encompassing all data in the organiztion by that time.



Key Takeaways


0:23 Allan introduces Patrck


1:36 Patrick shares his cyber background and his jay job


4:10 Patrick introduces his model of Data Risk Governance, which began as a sales/marketing tool and evolved into a "real" practice


5:59 Patrick introduces the precursors to setting up a proper Data Risk Governance program, which includes data classification among others


8:01 Allan explains how data disocvery and classification can be expensive and yet still only partially succesful


9:12 Patrick advocates his 'one bite at a time' method based at first on broad strokes of known valuable/risky data


10:45 Allan describes multiple data loss stories from his past


12:10 Patrick delineates in more detail the 'big chunks of data' method and his firewall analogy of allow/deny


13:23 Patrick notes that classification followed by tagging is a great approach


13:57 Allan proposes a new-data-only go-forward plan and Patrick agrees


15:56 Patrick talks about how the legal department owns data retention rules


17:30 Talks about how chat messages should be volatile


19:00 Allan proposes usese tagging to manage destruction and retention


21:00 Patrick notes that reducing risk by tagging some of your data is better than tagging none of it


23:30 Patrick discusses his model for quantifying risk vs investment as an 'orders of magnitude' problem with dollars as unit of measure


25:17 Allan proposes the car insurance model to counter Patrick's life insurance model


26:00 Allan talks about accurizing risk measurement and discusses briefly models like FAIR and Bayesian math vs. Patrick's orders of magnitude method


27:09 Patrick uses the 5x5 method not as a specific measurement but more as a visual aid and heatmap


29:11 Patrick explains what keeps him going in information security


Links:

Learn more about Patrick Benoit on <a href='https://www.linkedin.com/in/patricklbenoit/'>LinkedIn</a> and on <a href='https://twitter.com/patrickbenoit'>Twitter</a>

Follow <a href='https://allanalford.com/'>Allan Alford</a> on <a href='https://linkedin.com/in/allanalford'>LinkedIn</a> and <a href='https://twitter.com/AllanAlfordinTX'>Twitter</a>

Learn more about <a href='https://hackervalley.com/'>Hacker Valley Studio</a> and <a href='https://hackervalley.com/cyberranch'>The Cyber Ranch Podcast</a>

Sponsored by our good friends at <a href='https://axonius.com/'>Axonius</a>

Howdy, y’all, and welcome to The Cyber Ranch Podcast!  With us today is Patrick Benoit, Global Head of Cyber GRC, and BISO at CBRE.  Patrick is here to talk about Data Risk Governance, a slightly new twist on an old problem.  Like our host, Patrick...

Howdy, y’all, and welcome to The Cyber Ranch Podcast!  With us today is Patrick Benoit, Global Head of Cyber GRC, and BISO at CBRE.  Patrick is here to talk about Data Risk Governance, a slightly new twist on an old problem.  Like our host, Patrick is also from the Dallas-Fort Worth area of Texas.

To start the conversation, Allan asks Patrick to share a little about himself, his background in information security and what he does at his day job. Patrick began his career in the military, eventually coming over to consulting and enterprise.  He has built out more than one BISO program, and has run multiple GRC programs as well.  Patrick has a customer-facing security role and believes that all security leaders are also, to some degree, sales leaders.

Allan and Patrick walk through a very practical approach to Data Risk Governance, starting with 'big chunks' and working towards the future with data tagging.

They discuss briefly various rules for dealing with older data and various means of risk measurement.

Ultimately their model is designed to work over a three-year or five-year period, encompassing all data in the organiztion by that time.

Key Takeaways
0:23 Allan introduces Patrck

1:36 Patrick shares his cyber background and his jay job

4:10 Patrick introduces his model of Data Risk Governance, which began as a sales/marketing tool and evolved into a "real" practice

5:59 Patrick introduces the precursors to setting up a proper Data Risk Governance program, which includes data classification among others

8:01 Allan explains how data disocvery and classification can be expensive and yet still only partially succesful

9:12 Patrick advocates his 'one bite at a time' method based at first on broad strokes of known valuable/risky data

10:45 Allan describes multiple data loss stories from his past

12:10 Patrick delineates in more detail the 'big chunks of data' method and his firewall analogy of allow/deny

13:23 Patrick notes that classification followed by tagging is a great approach

13:57 Allan proposes a new-data-only go-forward plan and Patrick agrees

15:56 Patrick talks about how the legal department owns data retention rules

17:30 Talks about how chat messages should be volatile

19:00 Allan proposes usese tagging to manage destruction and retention

21:00 Patrick notes that reducing risk by tagging some of your data is better than tagging none of it

23:30 Patrick discusses his model for quantifying risk vs investment as an 'orders of magnitude' problem with dollars as unit of measure

25:17 Allan proposes the car insurance model to counter Patrick's life insurance model

26:00 Allan talks about accurizing risk measurement and discusses briefly models like FAIR and Bayesian math vs. Patrick's orders of magnitude method

27:09 Patrick uses the 5x5 method not as a specific measurement but more as a visual aid and heatmap

29:11 Patrick explains what keeps him going in information security
Links:
Learn more about Patrick Benoit on LinkedIn and on Twitter
Follow Allan Alford on LinkedIn and Twitter
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at Axonius

Data Risk Governance w/ Patrick Benoit

Apple

Google

Spotify

Amazon

Ride the cyber trails with one CISO (Allan Alford) and a diverse group of friends and experts who bring a human perspective to cybersecurity.