What is GRC in cybersecurity?

governance risk compliance the grc

component of information security gets a

bad rap in the cyber security game

this week i'm going to throw some love

towards grc and tell you what you need

to know about it

to be successful coming up

[Music]

hey everybody welcome to simply cyber

the youtube channel designed to help you

make

or take a cyber security career further

faster i'm your host gerald dozier and

i'd like to give a special shout out to

our sponsor coastal information security

group

for uh being our sponsor really

appreciate that also in the background a

little shout out to

hacker spoiled another youtube content

creator and excellent excellent resource

on the internet

uh more on the bug bounty pen testing

side but check out his uh link below in

the show notes

just he's he does amazing work um

and be sure to stay tuned to the end

where i have my one cool thing segment

where i share something completely

um you know what i think is cool and

that i wanted you to know about

but let's get into grc so grc or

governance risk and compliance

is a critical piece of any mature

information security program so a lot of

times the red team the blue team

hands on hard skills technical scanners

you know hacking passing the hash like

popping shells all that stuff

that's all sexy and cool and it's

definitely an important part of

information security

however governance risk and compliance

has its place and it's equally important

in some regards now i will preface it by

saying

smaller businesses smaller programs

are not going to typically have a grc

component they will have some compliance

requirements in some situations

whether or not they're actually adhering

to them or doing anything

due diligence do care to meet them is a

separate issue grc

is going to be for more of your medium

size organizations and definitely

definitely large enterprise

organizations so think fortune 500

companies there's absolutely zero

question

that they have a grc component to their

information security program

and there's jobs there so that's why

it's so important

to a understand if you want to go into

that particular

field of information security but b

having the context of what that function

does

even if you are a blue team or a sock

analyst or something like that

it's important to understand that so

what exactly

is grc so grc is these three things

right governance risk and compliance

governance is basically how the

organization itself governs the way

things are done

and you know what does that kind of look

like right so that looks like

um can anyone in the organization

install

any software they want on any system

probably not

but there's rules around that right can

you go can you go to a

website on your lunch break can you

bring in an xbox and plug it into the

network and have a lan party

if people still do that um maybe maybe

not i don't know

those are acceptable use policies and

all of that is how

the organization governs both its end

users

and its it assets and it's it's um

itself really like what is acceptable

behavior what is the culture of the

organization

and that's what governance is it's not a

tool

although tools can help you implement it

effectively it's not it's not a skill

there's no github repo for governance

it's it's it's a

organizational cultural element of how

it's implemented okay so it's very

difficult to wrap your head around

um until you until you get it and then

it makes sense right

next is compliance compliance is

complying with whatever federal

regulations

industry regulations uh whatever

regulations and requirements you have to

so quick

quick big ones for example pci the

payment card industry

they have their own compliance standard

called pci

so if you work at a business or an

organization that takes credit cards

or you take credit cards you have to

comply

with pci you don't have to but if they

find out that you're not compliant

they the credit card companies will

restrict you

from being able to use credit cards so

think about your food truck

right and you're using credit cards but

you're not complying with a pci standard

they could take that away and now you're

a cash only food truck i don't know it's

20 20

where i am i don't carry cash so

you you're incentivized to comply with

that standard because you want to be

able to take credit cards another one

is hipaa right if you work in healthcare

or you've probably heard of it

hipaa compliance and basically

compliance standards are

a minimum set of security controls and

or privacy controls or whatever it's

some minimum set of standards

that an organization must implement

to be compliant with the standard and

then there's a whole host of like

um a testing that you've implemented and

auditing and passing an audit and having

an action plan for closing out

findings where there's gaps you know et

cetera

so that is what the compliance piece of

it is now

compliance and governance kind of work

hand in hand because if you have certain

things that you have to comply with like

um like i said with pci like all credit

card data needs to be encrypted

okay so then you can have some policy

that states

all cred all credit card data must be

encrypted or all data at rest must be

encrypted whatever

so now you like you put the policy in

place but if people are like oh

f off like i i'm not going to follow

that i'm like assist admin i don't have

time for encrypt and stuff or

i'm the i'm the uh the data uh analytics

person on our team and

it's like inconvenient for it to be

encrypted because i have to go decrypt

it every time

i want to train an algorithm or

something like that well

now it becomes governance tone at the

top which is

absolutely critical to any

organization's success tone being

the leadership who's defining what is

acceptable behavior in the organization

um standing behind what the govern the

governance model of those policies and

procedures are

are you following them and then

ultimately if you aren't what they do

about it right sanctions

um you know terminations etc

that's the only way it really works okay

third is risk now um spoiler alert if

this is new to

you but you cannot be 100 secure

ever i don't care how good you are

national security systems

submarines with missiles on them like

there are

vulnerabilities whether it's human

vulnerabilities uh attacking the human

social engineering

whether it's technical vulnerabilities

through exploitation

not patching physical security you can

walk in and plug a usb drive in whatever

it is

there is going to be

rip some risk right but what is that

risk how do you how do you qualify that

how do you quantify that and that's what

this piece of the risk

in grc is and it's actually a fairly

large one

and one that gets a lot more attention

than the other two

so risk is either assessed either

qualitatively or quantitative that means

you

say like we have some risk our list our

risk is

moderate our risk is low it's some

qualified subjective

uh value that people kind of agree on

but it's not it's not it's difficult to

measure

quantifiable is measurable where you say

you know

our risk was uh of whatever is that 34

of risk and we're going to implement

these three controls

and that's going to reduce our risk to

17 and organizationally

at the governance level we're

comfortable with 20 um

risk so quantifiable is a little bit

harder you need to be like a much more

mature organization in order to have the

metrics to support what that

quantification is

qualitative you'll see a lot more often

a couple resources that i want to share

with you again there aren't really

tools necessarily within the grc space

but um

so nist has some special publications

that you should be aware of 800-39

that is kind of showing you how to

implement an organizational kind of

risk management framework it's not 837

which is the risk management framework

you can check that as well but 839 talks

about risk at the organizational level

risk at the system level which is what

most people think of when they think of

like an unpatched system and stuff like

that um

as you do audits and things like that

like you can you have to do an audit

right so

let's say you're going to put in some

controls then you have to test the

effectiveness of them because a they

might be configured wrong b

you might have uh end users that are

intentionally circumventing them for

whatever reason

once you assess them you get some score

uh and then you find out where the

weaknesses are and then you put an

action plan in place to

remediate those and then you have to

report that up to leadership or the

board or whoever

on where you are today and where you are

tomorrow and what your plan is and how

you implement

and then all of these things come with

financial uh

obligations oftentimes where you need to

um

purchase a tool or purchase some access

to some

configuration baselines for example or

something like that or some knowledge

um or or hire people in order to

implement or maintain appliances or get

contractors to do it

so grc is a big thing

it takes time again it's more angled for

medium to larger organizations although

small ones do need to really worry about

the compliance one

but from a governance and risk

perspective small organizations are

typically

in really even compliance they're just

flying by the seat of their pants

they're assuming that they're compliant

with whatever standard or they're

unaware of the standard

and they have a

basically a naive idea of what their

current risk posture is and what they're

willing to accept and it's really naive

because they're

unaware um and i'll just point out like

you know whatever shameless plug my

entire dissertation for my phd

was focused on this naivety of what

their risk tolerance was and what

actually led to why that risk existed

so if you're interested in digging into

a 200 page book i wrote on it

you can you can dig in there so again

i just wanted to spend a minute this is

important right so the blue team is

defending the

red team is attacking but like what are

like

where should they focus their efforts

they can't defend everything right so

governance

and compliance and and really what your

risk profile is

defines where they should spend their

efforts or how you should spend your

money

on what controls and tools just buying

the coolest new tool that's at black hat

or like the vendor that has the biggest

booth yeah you can do that but like

is it is it quantifiably is it a

material improvement to your wrist

posture or is it literally doing you

bought a pa firewall

now you're gonna buy a four net firewall

and you already got them so it didn't

actually improve your security posture

it just hit your budget

right so grc it gets complicated

uh but that's basically it there are

some tools that help you manage and

communicate out to organizations what

your policies are

uh but you know oh another like quick

pro tip

policies like don't write 400 policies

for the sake of uh

compliance right you should write

minimum a couple policies that are

important to your organization

and uh communicate them uh throughout

the organization and have governance

and senior leadership buy-in or else

you're never gonna succeed

with that okay if you've got any

questions about grc

put them in the uh comments below i'll

i'll answer them i love engaging with

you all

um and i'm happy to have spent some time

throwing some

throwing some love and showering it uh

the the grc to the side of the house

instead of just new tools and cool

uh hacks and stuff like that so now it's

time for our one cool thing

my one cool thing is i can't remember

the name of it right now but it's going

it's a netflix show i watched last night

and it's actually really

interesting i'll put it right here i

forget the title

but it's basically about how social

media companies have developed

um how like basically how engineers have

engineered user interfaces to

promote uh interaction and the time

spent on the platform

uh there is like a whole kind of

dramatic use case that they they splice

in periodically about like the abuse of

um

of how it could affect a family it's a

dramatization and i didn't care for that

part

but they're interviewing like the

president of uh

uber and the the ceo of pinterest or

former president of pinterest and

lead engineers at google and interface

engineers at twitter like

high-end really smart you know stanford

graduate type people

who are talking about the humane uh

humane elements of technology and how

you know

like it it's it's it's it's interesting

i'll put it this way it's worth checking

out i personally

um spent a lot of time on my phone you

know it's the first thing i look at when

i wake up i typically check it when i go

to bed like

i went in right after i was watching

this or while i was watching it and

disabled notifications on just about

everything that i don't really care

about i left my

you know messages and my email because

that's how people normally communicate

with me but

just all the superfluous app that wants

to send you notifications and

steal your attention and disrupt um your

your focus on whatever it is i

i disabled all those and i felt better

about it so uh great little documentary

i recommend checking it out

okay thanks everybody uh love love

engaging with you love

uh doing the show and until next week

stay secure