 security by design part 5 security by design part 5 hemraj thu 10162025 750 security by design part 5 joseph f norton sort by latest trending joseph fnorton latest trending image my last blog post presented the changes released by the security and exchange commission on july 26 2023 to their sec new rules on cybersecurity risk management strategy governance and incident disclosure by public companies these changes are quite impactful to public companies and their regulatory reporting concerning cybersecurity and have been welcomed by professional practitioners in the cybersecurity fields some of us may wish that the sec had gone a little further in and with their new rules but progress is progress if you are a member of a private company breathing a sigh of relief that you are not required to make such reporting and disclosures i would suggest that you take a close look at these new sec rules and consider how your cybersecurity practices compare to these rules for public companies i will be coming back to this topic in future posts to explore some of these new rules in more depth these are just a small sample of things we learn about as children that can harm us or cause injury these are threats to our wellbeing these four threats are very specific each of these threats has a specific range of impacts we can easily be hit by a car when crossing a street and be injured or killed some strangers may wish to do us physical harm being struck by lightning will cause grievous bodily harm or outright death we can easily suffer frostbite or hypothermia and potential death if exposed to cold temperatures for an extended period the specific actions we have been taught as children to avoid harm are very specific threat avoidance and mitigation actions we can practice every time we check traffic before crossing a street or intersection to determine if we can cross safely  we are evaluating the probability of a potential event  ie that we may be struck and injured by a vehicle practicing risk management in our personal lives is no different from practicing risk management in our business lives and roles risk management entails acknowledging that threats exist determining the probability that a potential threat will occur understanding and assessing the potential impact of a threat event if it occurs ranking or scoring threat risks for their impacts ie probability x impact risk score implementing risk actions plans to avoid and or mitigate the impact of threat events  effective risk management requires both knowing and doing now let me circle back to risk behaviors i stated earlier that throughout my career i have been amazed by the disconnect i have seen and experienced between the way we behave in our personal lives as compared to how we behave in our business lives regarding risk in our daily lives we naturally embrace our roles as risk managers for our own safety and the safety of our family members and loved ones yet it always seems that as soon as we enter our work environments in an office place or remotely from home or hotel we often witness employees at staff management and executive levels unconsciously ignore or abandon any sense of understanding of business risk most risk event impacts occurring today in business especially related to cybersecurity and cyber insecurity occur because individuals did not practice the same level of acceptance and ownership of their roles as managers of risk in their business lives as they do every day when they leave their work environments and enter their personal life environments if we did no staff member manager or executive of a company would ever click on a phishing link be fooled by social scamming or not fund mandatory security awareness training and certification for every employee of a company from bottom to top in my next blog post it is my intention to explore systemic risk in business with you  feedback and comments are welcome as well as any specific cybersecurity or cyber insecurity topic you might want me to comment upon joseph f norton is a risk security and crisis management professional he is a founding member and qualified technology executive of the digital directors network chair of the advisory board with next era transformation group and chief security officer with apf technologies he has served as chief security officer svp at atos chief technology officer and head of operations svp at philips chief technology officer svp at novartis executiveinresidence with mckinsey company and chief technology officer at mcdonald s he has also held professional roles during his career with jpmorgan bank oracle sybase and grumman aerospace corporation and the united states navy latest webinars our proven track of record view all image webinar clone of the ciso exchange for a safer digital world image webinar the ciso exchange for a safer digital world image webinar zero trust architecture adoption in federal government image webinar zero trust architecture adoption in federal government image webinar zero trust architecture adoption in federal government popular articles unleashing business potential the power of adaptive enterprise architecture in the digital age businesses must adopt an adaptive enterprise architecture to succeed doug picirillo 15 best practices in salesforce development many businesses have decided to use salesforce s customer relationship management solution kannan venkataraman 