4THBIN News:CyberSec Michael Marrano

Part 1: Cybersecurity Threats - Do you know if your data is safe?

Cybersecurity Q&A Series with Michael Marrano

published
January 28, 2021
News

Welcome to the first installment of a three-part series on Cybersecurity.  Protecting your sensitive data from theft or unintentional leaks continues to be a top risk to companies and governments alike. But where should you start, and what steps should you take to ensure your data is safe?

To explore this topic further, we sat down with Michael Marrano, the founder of Riskigy, a Certified Information Systems Security Professional (CISSP) and a member of 4THBIN’s advisory board, to talk about the importance of conducting a cybersecurity audit. 

Q:  What is a cybersecurity audit?

A:  A cybersecurity audit, also known as a cybersecurity risk assessment, is the process of identifying the threats facing an organization and conducting steps to bring risks to within a level determined to be acceptable to the organization's leadership's risk appetite. Risk Assessments are not about eradicating all risk completely (which is not possible) but identifying and managing it in a proactive, reasonable, and knowledgeable way. Risk management is a never-ending process. Managing risk is an ongoing exercise and must be continuously performed as the organization and threats evolve and change over time. A Risk Registry or Risk Tracking Matrix is utilized to track known risks and the efforts to resolve, mitigate and accept the risks.

Q:  How often should you do a Cybersecurity Risk Assessment/Audit?

Organizations must perform risk assessments to comply with regulatory requirements and demands from clients. Financial regulators such as the SEC, FINRA and NYDFS, require member firms to perform an annual cybersecurity risk assessment. Services organizations aiming to demonstrate a mature security posture to clients and prospects will perform the SOC-2 Audit annually. To comply with SOC-2 requirements, an annual risk assessment, vulnerability scans, and other security testing are necessary.

Q:  Who is responsible and should be involved in these risk assessments/audits?

A:  Cybersecurity is critical to any company, and support must start with the executive team and awareness of its importance by everyone inside the organization in order to combat the scams, hacks, and cyberattacks that have become commonplace in today’s headlines.  Therefore, it is crucial to expand risk assessments beyond Technology and Cybersecurity teams. A holistic assessment of the organization is necessary to identify security gaps and weaknesses throughout the organization.  Including Human Resources, Finance, Accounting, Facilities Management, and Marketing in the risk assessment is a must. During the COVID-19, digital transformation, and move to cloud services, many teams have adopted platforms and services that IT and Cybersecurity teams have not vetted for security.

Q:  What tools are available to companies to help navigate this assessment?

A:  These assessments are so critical the United States Cybersecurity & Infrastructure Security Agency (CISA) provides no-cost evaluation tools so organizations can perform self-assessments.  The National Institute of Standards and Technology (NIST) has also developed a Cybersecurity Framework to provide best practice for organizations.  And the FTC produced a more user friendly cybersecurity risk assessment resource which follows the NIST Framework.

For organizations without resources and knowledgeable staff capable of accomplishing a cybersecurity self-assessment, there are other options available that utilize technology and third-party consultants to assist with the audit.

Q:  There are lots of risk management platforms and web-based software services being offered, what should we know about these solutions?

A:  Yes, the market is inundated with technology that promises to simplify the complex, time-consuming, and resource-intensive audit process.  Claims of automating a lengthy audit such as the AICPA’s SOC2- SOC for Service Organizations and collecting evidence faster than you can read this is good for a quick laugh while attempting to figure out the difference between Governance, Risk and Compliance (GRC) and Integrated Risk Management (IRM), the many types of audits as well as the alphabet soup of cybersecurity framework acronyms.   The key to successfully accomplish any audit is having skilled people to do the job.

Q:  What other trends are you seeing in this area?

A:  Instead of engaging a third-party consultancy focused on cybersecurity auditing and testing, some organizations are starting to take advantage of a more cost-effective solution by utilizing a cybersecurity subject matter expert (SME), often called a Virtual Chief Information Officer (vCISO), to lead the audit program. A vCISO often reports to the executive management board, quickly fills the gap in resources and internal skill sets. They assist with pre-audit readiness as well as the audit, support ongoing maintenance, and compliance between audits.

Q:  What have been some surprises or lessons learned that you have seen when conducting these audits?

After 20+ years in the industry, I wish I could say I have seen it all, but even veterans like myself still get surprised. Surprisingly and unfortunately, cybersecurity is still an area that is allocated limited resources until the worst happens. For some organizations it takes an event such as a cyberattack or data breach before cybersecurity receives the necessary resources. As you can imagine, a data breach is a very expensive learning experience that could be avoided by proactively focusing on cybersecurity.

Q: And what about the data on old electronics or devices?

A:  Often cybersecurity focuses on the high-tech networks, clouds, and internet security controls, leaving physical technology assets such as hard drives, laptops, mobile phones as a lower priority, especially at the end of lifecycle.  Data breaches can happen when companies are retiring old electronics or devices.  Secure handling of the data on your end-of-life electronics is just as critical as your online data.  It requires the same level of discipline and safeguarding. You need to ensure you are working with a certified e-recycler who complies with the highest standards for data erasure, NIST 800-88 data compliance, provides proof of data destruction with a certificate of data erasure or destruction, and is audited annually by third parties like e-Stewards and NAID.

Stay tuned for part two of “Cyber Security Threats” where we talk to Michael about the challenges of remote working

-------

About Michael Marrano:

Michael Marrano is the founder of Riskigy and a cybersecurity professional focused on providing Virtual CISO and Cybersecurity services for clients. With his boutique cybersecurity consulting and advisory firm, he provides high-quality services to organizations of all sizes. Michael has been honing his skills as a real-world technology and information security practitioner over the last three decades. Michael is a Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), and Certified Information Systems Auditor (CISA) with extensive experience in consulting, audit and business leadership roles. Michael is the author of “The Human Firewall Builder – Weakest Link to Human Firewall in Seven Days”, a Cyber and Homeland Security master’s scholar at Fairleigh Dickinson University (NJ) and previously held roles such as Senior Principal Cybersecurity Consultant, Managing Director, a former Chief Technology Officer (CTO) and Chief Information Security Officer (CISO).Connect with Michael today on LinkedIn.

More News

News

Celebrate Earth Month with 4THBIN

April is Earth Month, and at 4THBIN, we see this time as an opportunity to double down on our commitment to protecting the planet. E-waste is the fastest-growing waste stream globally, and it’s not just a tech problem. Improper disposal of old electronics can leak hazardous materials into the environment, while also posing serious risks to your data security.

News

Empowering Education Through Responsible E-Waste Recycling with 4THBIN

As technology becomes more embedded in the educational experience, it’s crucial for students to not only understand how it benefits their learning but also how it affects the world around them. E-waste, the growing amount of discarded electronics, poses significant environmental and health risks, particularly when not recycled responsibly. As future leaders, students have the opportunity to take action and drive change by learning the importance of proper e-waste recycling.

News

Falling in Love with E-Waste Recycling

Valentine’s Day is all about love - whether it’s for a special someone, your favorite dessert, or just a good rom-com. But this year, why not show some love for something that actually gives back? We’re talking about e-waste recycling - the secure, sustainable, and responsible way to part with your old electronics.

News

Celebrate Data Privacy Week 2025 with 4THBIN: Take Control of Your Data

Data Privacy Week 2025 is here, and it’s the perfect time to think about how we manage our data, both online and offline. The theme this year, "Take Control of Your Data," emphasizes the importance of understanding the value of the data we create every day. From browsing habits to health data tracked by apps, our personal information is constantly being collected. This data is valuable to companies, but the good news is you have the power to control how it’s used. At 4THBIN, we believe data privacy should be a priority not just for individuals, but for businesses as well - and it extends beyond the digital world to your old electronics. 

News

A Responsible Holiday Season - Secure Your E-Waste Before the New Year

While we’re busy decking the halls and making New Year’s resolutions, it’s easy to forget the environmental impact of all the electronic waste we generate year-round. With tech advancing faster than ever, devices often have short lifespans and are discarded in large quantities. 4THBIN is ready to help you responsibly close out the year and keep both your data and the planet safe!

Event

Spring Into Sustainability: E-Waste Recycling Events in NYC
Drop-off Event

Spring Into Sustainability: E-Waste Recycling Events in NYC

This spring, 4THBIN is proud to continue our partnership with the Lower East Side Ecology Center to host a new season of free residential e-waste recycling events throughout New York City. These events are part of our 4THBIN 4ALL initiative, a citywide effort to expand access to responsible electronics recycling and encourage sustainable action in every neighborhood.

Recycle and Replant with 4THBIN
April 24, 2025
Drop-off Event

Go Green with Us! 4THBIN + 51 Astor Place invite tenants to a Recycle & Replant event at 51 Astor.

This Earth Month, 4THBIN is partnering with HqO to host a Recycle and Replant event for the tenants of 51 Astor Place. It is a simple and meaningful way to support sustainability by responsibly recycling old electronics and receiving something green in return.

4THBIN and Broadway Green Alliance Team Up for a Fall 2024 E-Waste Drive
November 20, 2024
Drop-off Event

4THBIN and Broadway Green Alliance Team Up for a Fall 2024 E-Waste Drive

We are excited to announce our collaboration with environmental innovators, Broadway Green Alliance (BGA) for a Fall E-Waste Drive.