Why You Should Scroll Further
Welcome to my website, dedicated to helping businesses with cybersecurity and risk management. My name is Todd Hammond, and I specialize in helping businesses understand that cybersecurity is not just a technical issue, but a business risk that can significantly impact success and survival. By investing in cybersecurity, physical security, and risk management, businesses can establish and maintain resilience. My website focuses on providing foundational insights and strategies to help businesses navigate cybersecurity and establish continuity of operations.
My Professional Guiding Principles
Do The Right Thing
Even If It's Difficult
Stay true to values and code of ethics, and always do what is right, especially when it is not easy or popular.
Build & Support
Other People
Build high-performers and support and encourage others in their endeavors, even if only as a small part of their success story.
Maintain Business Velocity Within Risk Appetite
Help companies maintain operational velocity while thoughtfully maintaining safety and managing risk.
People Centric
Being people-centric is key to creating a proactive security-aware culture, and two leadership approaches that can help achieve this are extreme ownership and servant leadership. Extreme ownership means taking complete responsibility for the success or failure of a mission, which in this case is creating a security-aware culture. This approach requires leaders to lead by example and hold themselves and others accountable for their actions. Servant leadership, on the other hand, focuses on putting the needs of others first and empowering them to achieve their full potential. In cybersecurity, this means empowering employees with the knowledge and tools to prevent security breaches and proactively manage risks. By combining extreme ownership and servant leadership, leaders can create a culture where everyone takes ownership of cybersecurity and risk management, and security is integrated into all aspects of the business. This reduces the risk of cyber-attacks and creates a more resilient and successful business overall.
It is best to find and address risk issues closest to when and where they are happening.
- If a front-line person finds an issue, it is better than your risk team
- If your risk, people find it. That’s better than your auditors
- If your auditors find the gap, it’s better than your regulators
- If your regulators find a matter, it is better than a judge or jury
Security Aware & Risk Informed
Create a Culture Of Security & Risk Awareness
Promote Risk Awareness
Promote identification and evaluation of threats & risks to the business, and encourage employees to speak up.
Addressing potential issues early in the product or service lifecycle prevents delays, re-engineering and disruptions later.
Inform Decisions
Decision-making processes include an evaluation of threats and risks as well as mitigation costs & complexity.
Understanding risks and the plans to address them helps leaders make better financial, administrative, operational, and technological decisions.
Govern & Oversee
Evaluate risk treatment effectiveness from three perspectives: the front line, risk governance and audit.
Leaders with an aggregated view of risk can better ensure risk levels remain within their appetite, mitigation efforts are cost-effective, and working as designed.
Minimize Disruption
Every day, take steps to make it harder to disrupt the business and improve your ability to recover.
Though not all threats can be prevented, building security and awareness and risk mitigation into your every day will help minimize disruptions when they occur.
Symptom
Solution
Symptom
Solution
Symptom
Solution
Symptom
Solution
Symptom
Solution
Tactical Remediate While Developing Strategic Solutions to These Challenges
Documentation is Not Paper Shuffling
If it is not documented, it will not happen consistently, it cannot be measured effectively, and you can't prove it did happen.
Documentation, including references to authoritative sources, is crucial for building a solid cybersecurity capability. It helps create a methodology for collecting metrics, creating reports, understanding risk, and ensuring risk controls are effectively mitigating risk as desired.
You can start by prioritizing the documentation of critical business processes.
This involves establishing policies, setting standards, defining frameworks, programs and service level expectations, establishing recovery time objectives and recovery point objectives, inventorying critical assets, drawing workflows, diagraming data and information flows, recording stakeholder roles and responsibilities, inventorying process dependencies and creating a list of next-level subprocesses and supporting technologies.
