What are some ways to use both major and minor incidents as opportunities to identify and address weaknesses in your organization's risk management processes?

Ideally, a lot of this comes to light during the drills you conduct. You should be testing for both minor occurrences and major outages, as well as everything in between on the disaster scale. The challenge becomes deciding on your approach to vendor selection. You can either take the best-of-breed approach, selecting different vendors for specific needs like CrowdStrike for endpoint security, Cisco for network, and Fortinet for VPN, or you can consolidate and pick one trusted partner. Each approach has its benefits and risks. For instance, a recent issue with CrowdStrike made us question if we should stick with our current approach or reconsider our vendor strategy. Even with reputable companies like SolarWinds, CrowdStrike, or Microsoft, which have deep R&D investments, it can be challenging to decide on the best path forward. With up-and-coming startups, we often conduct thorough code reviews and access their IP, but this level of diligence isn't always feasible with established firms.

From an iterative governance standpoint, any disruption, whether large or small, should involve collaboration between the business and IT teams to understand where we missed the mark. It's about learning from the incident and integrating those lessons into our disaster recovery plan. The key questions to ask are: What didn't work? What should we keep doing? What should we stop doing? And wha

There are many facets to consider. Reflecting on my experiences with JP Morgan Chase and a large nonprofit, the approach to risk management can vary significantly depending on the organization. In financial services, the urgency and level of scrutiny are much higher compared to other sectors. Risk management involves how issues are handled, communicated, escalated, and how bad actors are identified. These processes differ across industries and organizations. The opportunities lie in having a well-thought-out plan from start to finish, with strong stakeholder involvement and support for when issues, attacks, or outages occur.