Jason Murray
With 27 years in information security, I've recognized the need for a transformative approach that goes beyond traditional compliance-focused methods. My philosophy centers on capability-driven strategies, quantitative risk management, and the integration of diverse management principles.
As a trusted security advisor to organizations across banking & finance, insurance, municipal government, healthcare, higher education, retail, service providers, and commercial sectors, I bring extensive technical knowledge of computing and networking systems in a wide range of scales from single desktops to cloud computing to corporate environments.
Key Aspects of My Approach:
• Advocating for capability-focused methodologies like C2M2 and CMMC
• Prioritizing quantitative risk management in security processes
• Integrating quality management, and agile approaches into information security
I believe effective information security extends beyond technology, encompassing:
• Capability-driven security policies
• Efficient processes aligned with organizational goals
• Flexible security controls adaptable to changing threats
I see the future of information security as:
- Shifting from compliance-centric to capability-driven security models
- Embracing quantitative risk management for informed decision-making
- Seamlessly integrating security capabilities into business processes
- Fostering a culture of continuous improvement in security practices
Session
Cybersecurity is always and everywhere a risk management function.
NIST CSF, ISO 27001, PCI DSS, C2M2, ATT&CK; the frameworks and methodologies are many. Professional associations publish competing Bodies of Knowledge. Colleges and universities offer an expanding array of diplomas and degrees. Everyone has an answer to how we should do cybersecurity.
But step back and ask a simpler question: what are we actually trying to accomplish?
It's easy to lose sight of this. We get absorbed in achieving compliance, implementing the architecture du jour, or chasing the latest threat intelligence. We optimize for framework alignment rather than outcomes. We confuse the map for the territory.
Author and practitioner Rick Howard offers a clarifying formulation: the purpose of cybersecurity is to reduce the probability of a material cyber event in the next business cycle.
This talk traces that thread across the profession. We start with risk itself, not as an abstract concept but as the fundamental tradeoff that underpins every security decision. We examine what higher education is teaching the next generation of practitioners and what the major Bodies of Knowledge say we should master. We dissect several popular frameworks, many of which explicitly call for a risk-based approach yet are routinely implemented as compliance checklists. We close by reconceptualizing the multifaceted practice that is cybersecurity through the focusing lens of risk.