The Risk Transfer Conundrum

Incessant cyber attacks are creating tremendous pressure on the insurance industry, thus creating a looming risk transfer problem. There are two general types of risk: inherent and residual. • There is an inherent risk with implementing any technology or leveraging third parties (MSP/MSSPs) • We manage RISK in 4 ways: Avoid, Reduce Transfer and Accept • Residual risk is what is left over after you "manage risk." The problem is, when it comes to cyber, for the last decade, the world has been trying to transfer inherent risk, and that is NOT the right way, and it is terribly fraught with its own risk. Businesses need to return to the basic tenants of risk management and the use of transfer. You build a resilient business by doing the things that demonstrably defeat the actions of threat actors and attacks - by doing the stuff - doing it right, doing it consistently. It is a cost of doing business. Whatever is left, buy insurance for or self-insure (that residual risk that remains after all weaknesses have been treated). SANS Cybersecurity Leadership Summit 2023 Title: The Risk Transfer Conundrum Speaker: Jess Walpole, Chief Technology Officer, Fortress SRM View upcoming Summits: http://www.sans.org/u/DuS