Risk Management for Cyber Security Managers - Third-Party Cyber Risk Management

The video discusses the complexities of third party risk management, emphasizing the importance of understanding and mitigating risks when sharing data with external parties. It highlights the growing threat of supply chain attacks, using the SolarWinds incident as a case study. The video explains the concepts of inherent and residual risks in cyber risk management and stresses the need for a structured approach to manage these risks effectively. The session concludes with a preview of the next video, which will cover practical steps for implementing third party cyber risk management.

What is a major risk when sharing data with third parties?

• The third party might charge extra fees.

• The data might become outdated.

• The data might get lost in transit.

• The third party might not have strong cybersecurity measures.

How do supply chain attacks typically occur?

• By sending phishing emails to employees.

• By infiltrating through an external partner with access.

• By directly attacking the main company.

• By hacking into the company's website.

What was the method used by cybercriminals in the SolarWinds attack?

• They stole passwords from employees.

• They disrupted the company's network traffic.

• They hacked into the company's email system.

• They injected malware into the Orion software.

What is the primary focus of third-party cyber risk management?

• Analyzing and controlling inherent risks.

• Eliminating all risks completely.

• Monitoring and mitigating residual risks.

• Focusing only on internal security measures.

What is the difference between inherent and residual risks?

• Inherent risks exist without controls, residual risks remain after controls.

• Inherent risks are controlled, residual risks are not.

• Inherent risks are external, residual risks are internal.

• Residual risks are more dangerous than inherent risks.