I am currently looking to merge two frameworks into one – One related to operational technical controls and one related to Risk and Governance controls. This is required to enable translation of actual security threats being targeted at an organisation from a technical standpoint into the correct level of business risk to the business based on the frequency and targeted area of the available attack surface of the threat (to determine probability) aligned with the impact to the business based on the availability of the systems that would be affected by the actualisation of the threat.
For some time I have been working to realign the different layers of the GRC framework (mainly subjective) starting at the highest to the lowest into a technical mathematically based measurement tool (absolute) to enable qualified and more accurate upstream Risk reporting based upon actual not subjective technical risk exposure within an organisation, without much success. Asking the question ‘Why not reverse the sequence or rotate it’ has enabled me to identify an easier way of mapping the technical viewpoint to the governance viewpoint accurately at only the lowest level of the framework greatly simplifying a working solution to the requirement.
Genealogy research, or family history research, is very ‘messy’. It seems to be a matter of trail & error. Data sources are incomplete & sometimes even inaccurate. Data ‘silos’ are unconnected. How does one discover insights in such an environment? I am trying to ask ‘why not’ questions as I start researching my family history.
Sounds familiar? The ‘data problem’ confronting genealogists may be a common business problem in today’s world. There may be a connection between genealogy and big data.
I am currently looking to merge two frameworks into one – One related to operational technical controls and one related to Risk and Governance controls. This is required to enable translation of actual security threats being targeted at an organisation from a technical standpoint into the correct level of business risk to the business based on the frequency and targeted area of the available attack surface of the threat (to determine probability) aligned with the impact to the business based on the availability of the systems that would be affected by the actualisation of the threat.
For some time I have been working to realign the different layers of the GRC framework (mainly subjective) starting at the highest to the lowest into a technical mathematically based measurement tool (absolute) to enable qualified and more accurate upstream Risk reporting based upon actual not subjective technical risk exposure within an organisation, without much success. Asking the question ‘Why not reverse the sequence or rotate it’ has enabled me to identify an easier way of mapping the technical viewpoint to the governance viewpoint accurately at only the lowest level of the framework greatly simplifying a working solution to the requirement.
yes of course, this is about test and learn. small low risk and invite failure. pretty common approach to be frank
Genealogy research, or family history research, is very ‘messy’. It seems to be a matter of trail & error. Data sources are incomplete & sometimes even inaccurate. Data ‘silos’ are unconnected. How does one discover insights in such an environment? I am trying to ask ‘why not’ questions as I start researching my family history.
Sounds familiar? The ‘data problem’ confronting genealogists may be a common business problem in today’s world. There may be a connection between genealogy and big data.