Title

AWS re:Invent 2023 - Cyber risk management: Bringing security to the boardroom (SEC204)

Summary

Fernando Cardoso, Director for Product Management for Vision One Cloud Security at Trend Micro, discusses cyber risk management and how to communicate cloud security risks to the board.
The session covers the evolving landscape of cloud security, the importance of aligning cloud security with business objectives, and the complexity of assessing risks across hybrid and cloud-native infrastructures.
Statistics from ESG and PwC highlight the challenges in threat detection and compliance in cloud environments.
Cardoso emphasizes the importance of visibility into hybrid cloud infrastructures and the need for a unified platform to manage security risks.
He introduces the concept of risk scoring and the importance of prioritizing risks based on their impact on cloud assets.
The talk outlines steps for assessing cloud risks, including understanding inventory, risk prioritization, and contextual visibility.
Cardoso stresses the importance of board involvement in cloud security, real-time risk communication, alignment with business goals, and incident response planning.
He predicts that by 2026, 70% of boards will include a member with cybersecurity experience.
The session concludes with strategies for improving cloud security and engaging the board in meaningful discussions about cybersecurity investments and objectives.

The dynamic nature of cloud security requires continuous adaptation and the use of appropriate tools to manage risks effectively.
Visibility across all cloud assets is crucial for identifying and prioritizing risks, which is a challenge for many organizations due to the sheer volume of assets.
Risk scoring is a valuable method for quantifying and prioritizing risks, enabling better decision-making and resource allocation.
Board members are increasingly recognizing the importance of cybersecurity and are more involved in discussions and decisions related to it.
Real-time metrics and clear communication of risks and strategies are essential for gaining board support for cybersecurity initiatives.
Establishing clear cybersecurity goals and aligning them with business objectives helps in securing the necessary resources and support from the board.
The integration of security into the development pipeline and ensuring runtime protection for workloads can significantly reduce risks and costs associated with security breaches.
The session highlights the importance of a comprehensive approach to cybersecurity that includes proactive measures, education, and strategic planning to effectively manage cyber risks at the board level.