Session 2
Details session 2 and evaluates key implications for security practitioners.
Summary
Risk as danger and opportunity
OneTrust GRC engineer Jorge Ferrera's Scot-Secure session reframes risk as balancing danger and opportunity—not only loss. Managing risk well can drive revenue, certifications, and recognition; ISO 27001 Annex A links risks to objectives and controls.
Context and measurement
He asks whether organizations assess risk from past incidents, threat intel, or predictive scanning amid heightened ransomware from geopolitical conflict. Shared risk repositories and guidelines align diverse stakeholders who interpret risk differently.
Board communication
Ferrera emphasizes linking risks to business objectives to secure sponsorship, coordinating across lines of defense, and summarizing context for executives so mitigation is actionable. The talk outlines a five-step methodology tying human factors and organizational specifics to measurable risk management.
