Keynote speech at The 24th Colloquium for Information Systems Security Education

As workers develop and deploy technology without any reviews or security assessments, they often increase the organization’s exposure to various risks, said Kayne McGladrey, a senior member of the IEEE and field CISO at Hyperproof, a compliance management software company, based in Seattle.

Employees should be aware that the IT department conducts thorough research to ensure the organization’s technology is safe and compliant with company policies. The technology itself could be vulnerable to cyberattacks, as unauthorized tech rarely goes through the same level of scrutiny that technology selected and onboarded by IT does, he said.

The practice of shadow IT could open the organization to critical weaknesses. Hackers are known to look for such vulnerabilities, further upping the cybersecurity risk, McGladrey said. IT teams might face challenges in managing unfamiliar technologies not approved by the organization. As the unauthorized technology falls outside of IT’s knowledge and control, the IT team might have less visibility into and a diminished ability to monitor its use, he said.

In this episode of InfoSec Pros On the Road at RSA 2024, I had the pleasure of interviewing Brenda Bernal, VP of Product Security and Compliance at Digicert. It was a great opportunity to finally meet Brenda in person after numerous Zoom calls. We discussed various topics, starting with the advancements in AI governance and the key risks organizations should focus on, including data privacy, security, and third-party risk management.

Brenda shared her insights on integrating AI into existing control frameworks and the importance of sustainability and adaptability in AI governance. She emphasized the need for transparency in AI implementations and how it parallels the evolution of ESG reporting.

We also explored the benefits of automation in GRC processes, drawing from Brenda’s experience as an external auditor and her current work with platforms like Hyperproof. The discussion highlighted the significant time savings and improved risk management that automation brings to compliance efforts.