AskACISO Interview With Paul Rivers, CISO at Yale University

The truth is that in today’s hyperconnected world, maturity-based cybersecurity programs are no longer adequate for combatting cyberrisks. A more strategic, risk-based approach is imperative for effective and efficient risk management (Exhibit 2).

Roles and responsibilities should be drawn up not only for big-picture strategic decision-making, but also for tactical incident response plans and playbooks to lay out who does what when things hit the fan. “If your playbook does not include everyone in the chain of command — legal, communications, the CEO, and other executive representatives — th

To achieve cyber resilience, it is crucial for organizations to align their cybersecurity priorities with their overarching business objectives. Jen Easterly, Director of the US Cybersecurity and Infrastructure Security Agency (CISA), emphasizes the need for security leaders to frame risks in relatable business terms and provide metrics that demons

I saw a few tweets about this article tongue in cheek saying "time to update your threat model" - but how many actually do that? Who is at work this week creating a document that illustrates how a data breach of their external council could lead to their own data loss event? I'd guess it is a very small number of folks. I'm making the cas