Sarah Bryson of Kudelski Security and Desta Bailey of Southwest Airlines explain how overlaying threat intelligence on incident data exposed control gaps, and how an intel pipeline into governance, risk and compliance puts those gaps in front of the risk committee.
Threat intelligence, red team results and purple team exercises can be rich and practical, yet hard to turn into strategy. The risk register often swallows what teams find. Sean Martin talks with two practitioners who built a way around that.
Sarah Bryson, Senior SRC Advisor at Kudelski Security, and Desta Bailey, Cyber Threat Intelligence Analyst at Southwest Airlines, presented their session at ISC2 Security Congress. They worked together at Southwest Airlines, and Bryson has since moved to the advisory side.
The conversation starts with a number. When Bryson's team overlaid threats, tactics and controls on anomalous event and incident data, she says, about half of the findings were control gaps that should have been in place for policy. From there, Bryson and Bailey describe the intel pipeline they built to feed the intelligence program into governance, risk and compliance (GRC).
Bailey walks through how an executive's headline question gets answered: pull the intelligence, map it to NIST Cybersecurity Framework (CSF) 2.0 outcomes and the company's control set, then pass it to GRC partners. Bryson explains what owning the control lifecycle allows, and what the finding meant for an incident response team she describes as among the most overworked in cyber.
They also cover tying a patch request to a specific threat, documenting the process so it runs the same way whoever does it, and where audits fit alongside a threat-driven approach.
For security leaders, the takeaway is practical: bring gaps to the risk committee before they become incidents, and get intelligence and GRC teams talking first.
Read the full story on ITSPmagazine: https://www.itspmagazine.com/blog?p=about-half-of-the-anomalous-incident-findings-were-policy-violations
The NIST Cybersecurity Framework (CSF) 2.0 | https://www.nist.gov/publications/nist-cybersecurity-framework-csf-20