The Path from Information Security Risk Assessment to Compliance

FromSoftware Engineering Institute (SEI) Podcast Series

Start listening View podcast show

The Path from Information Security Risk Assessment to Compliance

FromSoftware Engineering Institute (SEI) Podcast Series

ratings:

Length:

26 minutes

Released:

Nov 13, 2007

Format:

Podcast episode

Description

Information security risk assessment, performed in concert with operational risk management, can contribute to compliance as an outcome. Related Course Assessing Information Security Risk Using the OCTAVE Approach Listen on Apple Podcasts.

Released:

Nov 13, 2007

Format:

Podcast episode

Titles in the series (100)

The SEI Podcast Series presents conversations in software engineering, cybersecurity, and future technologies.

Skip carousel

Inside Defense-in-Depth: In this podcast, participants discuss defense-in-depth, a path toward enterprise resilience. by Software Engineering Institute (SEI) Podcast Series
16 min listen
The Real Secrets of Incident Management: In this podcast, participants explain that incident management is not just technical response, but a cross-enterprise effort. by Software Engineering Institute (SEI) Podcast Series
21 min listen
Evolving Business Models, Threats, and Technologies: A Conversation with CERT's Deputy Director for Technology: In this podcast, participants discuss how business models are evolving as security threats become more covert and technology enables information migration. by Software Engineering Institute (SEI) Podcast Series
22 min listen
Compliance vs. Buy-in: In this podcast, Julia Allen explains why integrating security into standard business processes is more effective than treating security as a compliance task. by Software Engineering Institute (SEI) Podcast Series
9 min listen
The ROI of Security: In this podcast, Julia Allen explains how ROI is a useful tool because it enables comparison among investments in a consistent way. by Software Engineering Institute (SEI) Podcast Series
21 min listen
Assuring Mission Success in Complex Environments: In this podcast, participants discuss analysis tools for assessing complex organizational and technological issues that are beyond traditional approaches. by Software Engineering Institute (SEI) Podcast Series
18 min listen
Building Staff Competence in Security: In this podcast, Barbara Laswell describes specifications that define the knowledge, skills, and competencies required for a range of security positions. by Software Engineering Institute (SEI) Podcast Series
22 min listen
Insider Threat and the Software Development Life Cycle: In this podcast, Dawn Cappelli explains how insider threat vulnerabilities can be introduced during all phases of the software development lifecycle. by Software Engineering Institute (SEI) Podcast Series
24 min listen
Why Leaders Should Care About Security: In this podcast, Julia Allen urges leaders to be security conscious and treat adequate security as a non-negotiable requirement of being in business. by Software Engineering Institute (SEI) Podcast Series
18 min listen
Proactive Remedies for Rising Threats: In this podcast, participants discuss how threats to information security are increasingly stealthy and must be mitigated through sound policy and strategy. by Software Engineering Institute (SEI) Podcast Series
20 min listen
CERT Lessons Learned: A Conversation with Rich Pethia, Director of CERT: In this podcast, Richard Pethia voices his view of the internet security landscape and the future of the CERT Division. by Software Engineering Institute (SEI) Podcast Series
24 min listen
Privacy: The Slow Tipping Point: In this podcast, participants discuss a trend toward more data disclosure that may cause users to become desensitized to privacy breaches. by Software Engineering Institute (SEI) Podcast Series
18 min listen
Protecting Against Insider Threat: In this podcast, Dawn Cappelli describes the real and substantial threat of attack from insiders. by Software Engineering Institute (SEI) Podcast Series
27 min listen
The Legal Side of Global Security: In this podcast, participants encourage business leaders, including legal counsel, to understand how to tackle complex security issues for a global enterprise. by Software Engineering Institute (SEI) Podcast Series
26 min listen
Change Management: The Security 'X' Factor: In this podcast, Gene Kim reports how a recent security survey found one factor that separated high performers from the rest of the pack: change management. by Software Engineering Institute (SEI) Podcast Series
19 min listen
The Value of De-Identified Personal Data: In this podcast, participants discuss the complex legal compliance landscape and how de-identification can help organizations share data more securely. by Software Engineering Institute (SEI) Podcast Series
31 min listen
A New Look at the Business of IT Education: System administrators increasingly need business savvy in addition to technical skills, and IT training courses must try to keep pace with this trend. by Software Engineering Institute (SEI) Podcast Series
18 min listen
Convergence: Integrating Physical and IT Security: In this podcast, participants recommend deploying common solutions for physical and IT security as a cost-effective way to reduce risk and save money. by Software Engineering Institute (SEI) Podcast Series
29 min listen
Computer Forensics for Business Leaders: Building Robust Policies and Processes: In this podcast, participants discuss how business leaders can play a key role in computer forensics by establishing and testing strong policies. by Software Engineering Institute (SEI) Podcast Series
12 min listen
Computer Forensics for Business Leaders: A Primer: In this podcast, participants discuss how computer forensics is often overlooked when planning an incident response strategy. by Software Engineering Institute (SEI) Podcast Series
17 min listen
Initiating a Security Metrics Program: Key Points to Consider by Software Engineering Institute (SEI) Podcast Series
12 min listen
Security Risk Assessment Using OCTAVE Allegro: In this podcast, Lisa Young describes OCTAVE Allegro, a streamlined assessment method that focuses on risks to information used by critical business services. by Software Engineering Institute (SEI) Podcast Series
18 min listen
Resiliency Engineering: Integrating Security, IT Operations, and Business Continuity: In this podcast, Lisa Young suggests that by taking a holistic view of business resilience, business leaders can help their organizations stand up to threats. by Software Engineering Institute (SEI) Podcast Series
18 min listen
Crisis Communications During a Security Incident: In this podcast, participants alert business leaders to be prepared to communicate with the media and their staff during high-profile security incidents. by Software Engineering Institute (SEI) Podcast Series
14 min listen
Getting Real About Security Governance: In this podcast, participants explain that enterprise security governance can be achieved by implementing a defined, repeatable process. by Software Engineering Institute (SEI) Podcast Series
19 min listen
Tackling the Growing Botnet Threat: In this podcast, Nicholas Ianelli cautions business leaders to understand the risks to their organizations caused by the proliferation of botnets. by Software Engineering Institute (SEI) Podcast Series
21 min listen
Building a Security Metrics Program: In this podcast, Betsy Nichols explains that reporting meaningful security metrics depends on topic selection, context definition, and data access. by Software Engineering Institute (SEI) Podcast Series
23 min listen
Connecting the Dots Between IT Operations and Security: In this podcast, Gene Kim describes how high performing organizations must integrate information security controls into their IT operational processes. by Software Engineering Institute (SEI) Podcast Series
25 min listen
What Business Leaders Can Expect from Security Degree Programs: In this podcast, participants discuss whether information security degree programs meet the needs of business leaders seeking knowledgeable employees. by Software Engineering Institute (SEI) Podcast Series
19 min listen
Information Compliance: A Growing Challenge for Business Leaders: In this podcast, Tom Smedinghoff reminds directors and executives that they are personally accountable for protecting information entrusted to their care. by Software Engineering Institute (SEI) Podcast Series
22 min listen

More Episodes from Software Engineering Institute (SEI) Podcast Series

Skip carousel

My Story in Computing with Sam Procter: Sam Procter started out studying computer science at the University of Nebraska, but he didn’t love it. It wasn’t until he took his first software engineering course that he knew he’d found his career path. In this podcast from the Carnegie... by Software Engineering Institute (SEI) Podcast Series
37 min listen
Developing and Using a Software Bill of Materials Framework: With the increasing complexity of software systems, the use of third-party components has become a widespread practice. Cyber disruptions, such as SolarWinds and Log4j, demonstrate the harm that can occur when organizations fail to manage third-party... by Software Engineering Institute (SEI) Podcast Series
38 min listen
The Importance of Divesity in Cybersecurity: Carol Ware: In this podcast from the Carnegie Mellon University Software Engineering Institute, Carol Ware, a senior cybersecurity engineer in the SEI’s CERT Division, discusses her career path, the value of mentorship, and the importance of diversity in... by Software Engineering Institute (SEI) Podcast Series
27 min listen
The Importance of Diversity in Software Engineering: Suzanne Miller: In this podcast from the Carnegie Mellon University Software Engineering Institute (SEI), Suzanne Miller, a principal researcher in the SEI’s Software Solutions Division, discusses her career path, the value of mentorship, and the... by Software Engineering Institute (SEI) Podcast Series
29 min listen
The Importance of Diversity in Artificial Intelligence: Violet Turri: Across the globe, women account for less than 30 percent of professionals in technical fields. That number drops to 22 percent in the field of Artificial Intelligence (AI). In this podcast from the Carnegie Mellon University Software Engineering... by Software Engineering Institute (SEI) Podcast Series
17 min listen
Using Large Language Models in the National Security Realm: At the request of the White House, the Office of the Director of National Intelligence (ODNI) began exploring use cases for large language models (LLMs) within the Intelligence Community (IC). As part of this effort, ODNI sponsored the Mayflower... by Software Engineering Institute (SEI) Podcast Series
35 min listen
Atypical Applications of Agile and DevSecOps Principles: Modern software engineering practices of and have provided a foundation for producing working software products faster and more reliably than ever before. Far too often, however, these practices do not address the non-software concerns of business... by Software Engineering Institute (SEI) Podcast Series
34 min listen
When Agile and Earned Value Management Collide: 7 Considerations for Successful Interaction: Increasingly in government acquisition of software-intensive systems, we are seeing programs using Agile development methodology and earned value management. While there are many benefits to using both Agile and EVM, there are important considerations... by Software Engineering Institute (SEI) Podcast Series
35 min listen
The Impact of Architecture on Cyber-Physical Systems Safety: As developers continue to build greater autonomy into (CPSs), such as unmanned aerial vehicles (UAVs) and automobiles, these systems aggregate data from an increasing number of sensors. However, more sensors not only create more data and... by Software Engineering Institute (SEI) Podcast Series
34 min listen
ChatGPT and the Evolution of Large Language Models: A Deep Dive into 4 Transformative Case Studies: To better understand the potential uses of large language models (LLMs) and their impact, a team of researchers at the Carnegie Mellon University Software Engineering Institute CERT Division conducted four in-depth case studies. The case studies span... by Software Engineering Institute (SEI) Podcast Series
46 min listen
The Cybersecurity of Quantum Computing: 6 Areas of Research: Research and development of quantum computers continues to grow at a rapid pace. The U.S. government alone spent more than $800 million on quantum information science research in 2022. Thomas Scanlon, who leads the data science group in the SEI CERT... by Software Engineering Institute (SEI) Podcast Series
23 min listen
User-Centric Metrics for Agile: Far too often software programs continue to collect metrics for no other reason than that is how it has always been done. This leads to situations where, for any given environment, a metrics program is defined by a list of metrics that must be... by Software Engineering Institute (SEI) Podcast Series
32 min listen
The Product Manager’s Evolving Role in Software and Systems Development: In working with software and systems teams developing tech products, Judy Hwang, a senior software engineer in the SEI CERT Division, observed that teams weren’t putting in enough time and effort into thoroughly assessing the product by talking to... by Software Engineering Institute (SEI) Podcast Series
24 min listen
Measuring the Trustworthiness of AI Systems: The ability of artificial intelligence (AI) to partner with the software engineer, doctor, or warfighter depends on whether these end users trust the AI system to partner effectively with them and deliver the outcome promised. To build appropriate... by Software Engineering Institute (SEI) Podcast Series
19 min listen
Actionable Data in the DevSecOps Pipeline: In this podcast from the Carnegie Mellon University Software Engineering Institute, Bill Nichols and Julie Cohen talk with Suzanne Miller about how automation within DevSecOps product-development pipelines provides new opportunities for program... by Software Engineering Institute (SEI) Podcast Series
32 min listen
Insider Risk Management in the Post-Pandemic Workplace: In the wake of the COVID pandemic, the workforce decentralized and shifted toward remote and hybrid environments. In this podcast from the Carnegie Mellon University Software Engineering Institute (SEI), Dan Costa, technical manager of enterprise... by Software Engineering Institute (SEI) Podcast Series
48 min listen
An Agile Approach to Independent Verification and Validation: Independent verification and validation (IV&V) is a significant step in the process of deploying systems for mission-critical applications in the Department of Defense (DoD). In this podcast from the Carnegie Mellon University Software Engineering... by Software Engineering Institute (SEI) Podcast Series
32 min listen
Zero Trust Architecture: Best Practices Observed in Industry: Zero trust architecture has the potential to improve an enterprise’s security posture. There is still considerable uncertainty about the zero trust transformation process, however, as well as how zero trust architecture will ultimately appear in... by Software Engineering Institute (SEI) Podcast Series
28 min listen
Automating Infrastructure as Code with Ansible and Molecule: In Ansible, roles allow system administrators to automate the loading of certain variables, tasks, files, templates, and handlers based on a known file structure. Grouping content by roles allows for easy sharing and reuse. When developing roles,... by Software Engineering Institute (SEI) Podcast Series
40 min listen
Identifying and Preventing the Next SolarWinds: In this podcast from the Carnegie Mellon University Software Engineering Institute (SEI), Gregory J. Touhill, director of the SEI CERT Division, talks with principal researcher Suzanne Miller about the 2020 attack on Solar Winds software and how to... by Software Engineering Institute (SEI) Podcast Series
46 min listen
A Penetration Testing Findings Repository: In this podcast from the Carnegie Mellon University Software Engineering Institute (SEI) Marisa Midler and Samantha Chaves, penetration testers with the SEI’s CERT Division, talk with Suzanne Miller about a penetration-testing repository that... by Software Engineering Institute (SEI) Podcast Series
26 min listen
Rust Vulnerability Analysis and Maturity Challenges: While the of the Rust programming language can be effective in many situations, Rust’s compiler is very particular on what constitutes good software design practices. Whenever design assumptions disagree with real-world data and assumptions, there... by Software Engineering Institute (SEI) Podcast Series
37 min listen
We Live in Software: Engineering Societal-Scale Systems: Societal-scale software systems, such as today’s commercial social media platforms, are among the most widely used software systems in the world, with some platforms reporting billions of daily active users. These systems have created new mechanisms... by Software Engineering Institute (SEI) Podcast Series
40 min listen
Secure by Design, Secure by Default: In this podcast from the Carnegie Mellon University Software Engineering Institute (SEI) Gregory J. Touhill, director of the SEI CERT Division, talks with Suzanne Miller about secure by design, secure by default, a longstanding tenet of the work... by Software Engineering Institute (SEI) Podcast Series
54 min listen
Key Steps to Integrate Secure by Design into Acquisition and Development: Secure by design means performing more security and assurance activities earlier in the product and system lifecycles. A secure-by-design mindset addresses the security of systems during the requirements, design, and development phases of lifecycles... by Software Engineering Institute (SEI) Podcast Series
49 min listen
An Exploration of Enterprise Technical Debt: Like all technical debt, enterprise technical debt consists of choices expedient in the short term, but often problematic over the long term. In enterprise technical debt, the impact reaches beyond the scope of a single system or project. Because... by Software Engineering Institute (SEI) Podcast Series
26 min listen
The Messy Middle of Large Language Models: The recent growth of applications that leverage large language models, including ChatGPT and Copilot, has spurred reactions ranging from fear and uncertainty to adoration and lofty expectations. In this podcast from the Carnegie Mellon University... by Software Engineering Institute (SEI) Podcast Series
34 min listen

Related podcast episodes

Skip carousel

Security: A Key Enabler of Business Innovation: In this podcast, participants describe how making security strategic to business innovation involves seven strategies. by Software Engineering Institute (SEI) Podcast Series
24 min listen
Concrete Steps for Implementing an Information Security Program: In this podcast, Jennifer Bayuk explains how successful security programs are based on strategy, policy, awareness, implementation, monitoring, and remediation. by Software Engineering Institute (SEI) Podcast Series
21 min listen
Predicting Software Assurance Using Quality and Reliability Measures: In this podcast, the authors discuss how a combination of software development and quality techniques can improve software security. by Software Engineering Institute (SEI) Podcast Series
19 min listen
Rethinking Risk Management: In this podcast, Christopher Alberts urges business leaders to adopt new approaches to addressing risks across the life cycle and supply chain. by Software Engineering Institute (SEI) Podcast Series
30 min listen
Integrated, Enterprise-Wide Risk Management: NIST 800-39 and CERT-RMM: In this podcast, participants explain why and how business leaders must address risk at the enterprise, business process, and system levels. by Software Engineering Institute (SEI) Podcast Series
28 min listen
Getting Real About Security Governance: In this podcast, participants explain that enterprise security governance can be achieved by implementing a defined, repeatable process. by Software Engineering Institute (SEI) Podcast Series
19 min listen
Connecting the Dots Between IT Operations and Security: In this podcast, Gene Kim describes how high performing organizations must integrate information security controls into their IT operational processes. by Software Engineering Institute (SEI) Podcast Series
25 min listen
Analyzing Internet Traffic for Better Cyber Situational Awareness: In this podcast, Derek Gabbard discusses automation, innovation, reaction, and expansion as the foundation for meaningful network traffic intelligence. by Software Engineering Institute (SEI) Podcast Series
30 min listen
The CERT Software Assurance Framework: In this podcast, Carol Woody and Christopher Alberts introduce the prototype Software Assurance Framework, a collection of cybersecurity practices that programs can apply across the acquisition lifecycle and supply chain. by Software Engineering Institute (SEI) Podcast Series
19 min listen
The Real Secrets of Incident Management: In this podcast, participants explain that incident management is not just technical response, but a cross-enterprise effort. by Software Engineering Institute (SEI) Podcast Series
21 min listen
EP133 The Shared Problem of Alerting: More SRE Lessons for Security: Guest: , Reliability Advocate at Google Cloud , Developer Relations Engineer at Google Cloud Topics: What is the shared problem for SRE and security when it comes to alerting? Why is there reluctance to reduce noise? How do... by Cloud Security Podcast by Google
36 min listen
Inside Defense-in-Depth: In this podcast, participants discuss defense-in-depth, a path toward enterprise resilience. by Software Engineering Institute (SEI) Podcast Series
16 min listen
Prisma Cloud 2.0, Blackpoint RISK, & Tenable Lumin - ESW #203: Palo Alto Networks announces cloud native security platform, Akamai launches new API security tool, SentinelOne secures patent for unique approach to uncovering exploits in their initial payload stage, Splunk helps security teams modernize and unify... by Enterprise Security Weekly (Video)
26 min listen
Prisma Cloud 2.0, Blackpoint RISK, & Tenable Lumin - ESW #203: Palo Alto Networks announces cloud native security platform, Akamai launches new API security tool, SentinelOne secures patent for unique approach to uncovering exploits in their initial payload stage, Splunk helps security teams modernize and unify... by Security Weekly Podcast Network (Video)
26 min listen
EP62 Protect Modern Applications in the Cloud: Union of APIs and Application Security: Guest: , Senior Security and Compliance Specialist, Office of the CISO @ Google Cloud Topics: Why is API security hot now? What happened that made it a priority for many? Is API security different from application security? Doesn't the first... by Cloud Security Podcast by Google
27 min listen
Real-World Security for Business Leaders: In this podcast, William Wilson advises business leaders to use international standards to create a business- and risk-based information security program. by Software Engineering Institute (SEI) Podcast Series
20 min listen
Security Modeling Tools: In this podcast, Julien Delange discusses security modeling tools that his team developed and how to use them to capture vulnerabilities and their propagation path in an architecture. by Software Engineering Institute (SEI) Podcast Series
24 min listen
API Security by The Cloudcast
38 min listen
Anton Chuvakin: Remapping Mental Models in IT, Security, and Compliance for the Cloud by Cloud Ace
50 min listen
Predicting Quality Assurance with Software Metrics and Security Methods: In this podcast, Dr. Carol Woody explores the connection between measurement, methods for software assurance, and security. by Software Engineering Institute (SEI) Podcast Series
11 min listen
Week in Review | March 1-5, 2021: Link to Blog Post This week’s Cyber Security Headlines - Week in Review, March 1-5, 2021, is hosted by () with our guest, (), vp, security, CareCentrix Thanks to our episode sponsor, TrustMAPP Maturity Assessment, Profile, and Plan... by Cyber Security Headlines
24 min listen
Software Assurance Cases: In this podcast, Charles Weinstock introduces assurance cases and how they can be used to assure safety, security, and reliability. by Software Engineering Institute (SEI) Podcast Series
20 min listen
Securing DevOps: Security in the Cloud with Julien Vehent: Are you looking for an approach to continuous security? In this episode, we’ll talk with Julien Vehent about his book Securing DevOps: Security in the cloud. Discover why security is an integral component of your product development efforts, and how... by TestGuild Security Testing Podcast
30 min listen
Smarter Testing = Safer Digital Experiences: Application testing is a critical component of a software development lifecycle. A complete testing battery for any application includes not only functionality and usability testing but security and reliability testing as well. However, helping ensur... by ISACA Podcast
32 min listen
1640: Discussing the Increase in Cloud Attacks with Aqua Security: Assessing Cloud Infrastructure Risks by The Tech Talks Daily Podcast
25 min listen
Chronicle Security with Dr. Anton Chuvakin and Ansh Patniak: It's cyber security week on the podcast as Priyanka Vergadia joins Mark Mirchandani to talk with the folks of Chronicle Security Team. by Google Cloud Platform Podcast
38 min listen
#135 Emerging SaaS Trends in Health and Safety: With the pandemic being the driving force behind more remote working than ever before, health and safety professionals are becoming increasingly tech-savvy. All evidence points to them increasing their reliance on Software as a Service (SaaS)... by The ISO Show
48 min listen
Successful Security Needs a Streamlined UX - Benedek Gagyi - ASW #278: One of the biggest failures in appsec is an attitude that blames users for security problems. A lot of processes and workflows break down because of an insecure design or insecure defaults. Benedek Gagyi chats with us about the impact of the user... by Security Weekly Podcast Network (Audio)
69 min listen
Thunderdome Technique - ASW #131: This week, in the first segment, Mike, Adrian, and John discuss Threat Modeling! We threat model every day without realizing it. And, of course, we often threat model with systems and products within our organizations. So how formal does our approach... by Security Weekly Podcast Network (Audio)
64 min listen
How to Measure Human Cyber-Risk, Finally! - Ragnar Sigurdsson - ESW #286: Since the dawn of the internet, companies have been fighting cyber vulnerabilities with a myriad of traditional technologies. And assigning cybersecurity training to people without really knowing its effectiveness or being able to tell the difference... by Security Weekly Podcast Network (Video)
36 min listen

Discover this podcast and so much more

The Path from Information Security Risk Assessment to Compliance

The Path from Information Security Risk Assessment to Compliance

Description

Titles in the series (100)

More Episodes from Software Engineering Institute (SEI) Podcast Series

Related podcast episodes