Vic Mankotia’s Post

Are you looking for the latest on governance, risk management, information security program management, and incident management and response? Look no further than #CISOMELBOURNE this week, where Zimperium will be at booth #4 to discuss why you should put #MobileSecurity at the core of corporate strategy Simon Scaife Jason S. Peter Athanasiou Vic Mankotia Pat S. Gerald Chun Liang TAN Gerald Y.

Are you looking for the latest on governance, risk management, information security program management, and incident management and response? Look no further than #CISOMELBOURNE next week, where Zimperium will be at booth #4 to discuss why you should put #MobileSecurity at the core of corporate strategy Simon Scaife Peter Athanasiou Jason S. Vic Mankotia Pat S. Gerald Chun Liang TAN

Sonatype - NEW DEMO: Sonatype Lifecycle Policy Engine. Did you know Sonatype Lifecycle simplifies risk management by allowing your organization to define and automatically enforce specific policies for open-source components? To learn more about Lifecycle, watch: https://bit.ly/43SJS9e Contact 9TH BIT Consulting for a #Sonatype Lifecycle demo today!

How are you managing your Security Risk Register? It is the process that matters the most, but technology can greatly help in managing the process and the storytelling. In my opinion, a great system makes the risk information more accessible to the appropriate stakeholders and clearly ties the risk remediation work to the identified risks. Many engineering organizations use Atlassian Jira to manage work. It is a standard part of the software company toolkit. I am curious: - Have you had success operating a security risk register out of Jira? - What technology are you using to help operationalize your risk program? - What challenges did you have to overcome in order to connect the risk remediation work to the Security Risk Register? #securityriskmanagement #nistcybersecurityframework #nistcsf

⛔Myth: EVERYTHING must fall within an authorization boundary under the National Institute of Standards and Technology (#NIST) Risk Management Framework (#RMF)⛔ Let’s bust this myth and embrace informed strategies together! 🔎WHAT: authorization boundaries set the parameters for what an organization agrees to safeguard, including people, processes, and IT assets supporting the mission and business functions. 👥WHO: organizations have flexibility in determining the authorization boundary for a system or set of system elements based on mission or business functions, whether they reside in the same environment of operation, similarities in characteristics or security and privacy requirements, and what information the elements process, store, and transmit. ⏲️WHEN: organizations establish boundaries during the RMF Prepare step and periodically revisit the authorization boundary during the continuous monitoring process. 🔑OTHER CONSIDERATIONS: boundary size matters -- excessively large authorization boundaries lead to unnecessary complexity in the RMF process, but limited boundaries may increase the number of systems requiring individual management, increasing security and privacy costs. 💡Ready to learn more? Check out the Rise8 #cATO Playbook and dig into the Prepare step with scenario-based examples for developing authorization boundaries: playbook.rise8.us/prepare/ #RiskManagement #Agile #DevOps #GovTech #TechMythBusting

Our application security expert Chris Wood shares tips for building an effective DevSecOps team, including: 🙌 Eliminate silos from the top down 👫 Establish trust between teams 🔥 Balance risk management, together Get more insights, here: https://lnkd.in/dVRY4r_N

Mutual understanding of shared goals and challenges is essential for a successful DevSecOps.

Even if you don't work in GovTech, how you manage integration points and "contracts" between system/product boundaries, responsibility boundaries, or even service boundaries is an important aspect of your risk management game. Anything that can be codified with the intent of providing mutual value, and excellent user/customer experience, when designing these integrations and contracts, is something I would say is a must have to be successful.

Software defects and resulting outages cost organizations time and money – yet these defects are often accepted as an unavoidable risk. But what if Security and Operations could collaborate like #DevOps to mitigate risk? Drive your #SecOps collaboration by taking a holistic approach to risk management. #SoftwareDefects #SoftwareBugs #DevSecOps

Is your team constantly grappling with the challenge of compiling accurate information every month for FedRAMP reports? With RiskGuardian360, this struggle is a thing of the past. Our platform seamlessly integrates ticketing, Risk Management, POA&M, ConMon, and report generation, making the entire process hassle-free. In just minutes, you can have a comprehensive monthly report ready to go. Experience the efficiency firsthand by taking RiskGuardian360 for a test drive and conducting a proof of concept. You'll quickly see how it streamlines your reporting tasks and empowers your team to focus on higher-value activities. Say goodbye to the frustrations of manual data gathering and hello to a smoother, more efficient workflow with RiskGuardian360.