Kirk Hogan, CIO and Practice Lead, Security Operations at Iceberg Networks and Bill Vollono, Sales Engineer at Recorded Future sat down to answer more questions about how organizations should evaluate their cyber risk programs. The following is an edited transcript of the conversation.
Kirk Hogan: Investing in your cyber program is a tough question because people are challenged with the question “Do we know it’s working in the first place?” so the question becomes “How do I know I should continue to invest in the program?” First and foremost, we need to understand the difference between effectiveness and efficiency. A lot of people are trying to do programs with a volume of information or a volume of vulnerabilities or threats, but being able to target the right ones first helps you identify and build out models that are effective because I’ll guarantee you, if you can prove what you’re doing is doing the right things, then you’re going to get more investment. So, how do you find the “right things”? That’s the challenge that this question is really about.
Bill Vollono: The right things – it’s got to be around higher fidelity data that is…
