Threat Intelligence Meets GRC: Why Half the Findings Were Control Gaps | An On Location Conversation at ISC2 Security Congress with Desta Bailey and Sarah Bryson

Threat intelligence, red team results and purple team exercises can be rich and practical, yet hard to turn into strategy. The risk register often swallows what teams find. Sean Martin talks with two practitioners who built a way around that.

Sarah Bryson, Senior SRC Advisor at Kudelski Security, and Desta Bailey, Cyber Threat Intelligence Analyst at Southwest Airlines, presented their session at ISC2 Security Congress. They worked together at Southwest Airlines, and Bryson has since moved to the advisory side.

The conversation starts with a number. When Bryson's team overlaid threats, tactics and controls on anomalous event and incident data, she says, about half of the findings were control gaps that should have been in place for policy. From there, Bryson and Bailey describe the intel pipeline they built to feed the intelligence program into governance, risk and compliance (GRC).

Bailey walks through how an executive's headline question gets answered: pull the intelligence, map it to NIST Cybersecurity Framework (CSF) 2.0 outcomes and the company's control set, then pass it to GRC partners. Bryson explains what owning the control lifecycle allows, and what the finding meant for an incident response team she describes as among the most overworked in cyber.

They also cover tying a patch request to a specific threat, documenting the process so it runs the same way whoever does it, and where audits fit alongside a threat-driven approach.

For security leaders, the takeaway is practical: bring gaps to the risk committee before they become incidents, and get intelligence and GRC teams talking first.

Read the full story on ITSPmagazine: https://www.itspmagazine.com/blog?p=about-half-of-the-anomalous-incident-findings-were-policy-violations

Resources

The NIST Cybersecurity Framework (CSF) 2.0 | https://www.nist.gov/publications/nist-cybersecurity-framework-csf-20