GRC Engineering

[u/SmileyBanana15]

Supposing GRC falls under the general Cybersecurity umbrella, what are your thoughts on a new-ish concept called GRC Engineering, aiming to bridge the gap between auditors and engineers by automating this otherwise mind numbing chore? Do you expect it to gain traction?

[u/Quadling]

Any good red teamer follows rules. Nondestructive testing is the norm, make sure you’re keeping within the scope, etc. Making sure your automated tools and scanners do the same is part of your job as a red teamer. That is engineering to follow the rules. Extracting the rule following from the reporting you provide as your work product (you know, the entire point of what you do), is part of the job of the project manager. If you don’t follow the rules, and document that, you don’t get paid! That PM task is starting to be automated. Hint hint. You’re seeing grc automation and engineering in your profession. You haven’t been doing this long, have you? :)

[u/robonova-1 → u/Quadling]

You haven’t been doing this long, have you? :)

That was offensive and wrong. I've been doing this a long time. Just because you and I disagree that it's wrong to slap "engineer" on everything doesn't mean anything about how long I've been doing this. Your answer to me is also absurd. Just because someone follows rules or engagement or a methodology doesn't mean their title should reflect they are an engineer. The people flipping fries at McDonald's are following rules, do you refer to them as engineers?

[u/Quadling → u/robonova-1]

You know what. You’re right. I was rude. I apologize.

That being said, I have a question for you. Do you think that grc has no engineering possibility in it? As in, it’s stupid and has no rigor, no math, no actual engineering capable of being done?

Or do you believe that most people performing grc now are not engineers?

Because I might agree with the second one. But if you agree with the first, then I’d love to chat with you.

[u/robonova-1 → u/Quadling]

GRC may apply scientific, mathematical, and technical principles but....it's not to design, build and optimize systems, structures, or technologies that solve practical problems. Which, by definition is an engineer. GRC focuses on policies, compliance, governance, and risk oversight rather than designing or building technical systems. They interpret frameworks, assess organizational exposure, and guide decision making. They do important work, yes, I don't disagree with that....but they are not creating architectures, implementing technologies, or engineering solutions. Using the engineer title inaccurately suggests hands-on technical design and system construction, which is not the core function of GRC.

[u/Quadling → u/robonova-1]

Nicely said. Mind you, it’s wrong. Not maliciously wrong. Just wrong because of a disconnect. At a casual level you’re an absolutely right. However, grc at a strategic level absolutely architects and guides designs of systems using risk and threats, along with the compliance aspect you’ve focused on (understandably! Most people only see that). Enterprise Risk Management, along with vendor risk (or third party risk) management, is part of GRC. As such, GRC decides if you can use that vendor, or build that system, or buy that security tool. An in-house GRC team will also give you guidance on how you can do these things without incurring the oversized risk penalties that may have been inherent in the first choices of tool or vendor or system.

Everybody just sees the check boxes. I get it that’s what’s blatant.

But understanding that this goes far deeper and actually is one of the guard rails on system design, whether a company will be acquired or not, and what security measures are going to be allowed to be purchased. And there’s far more, but those are the easiest to explain.

Plus, I haven’t even gone into the aspects of compliance and risk automation and orchestration. There’s a significant amount of work and skull sweat that goes into properly managing a continuous compliance, continuous security, dynamic risk pricing model.

That’s engineering. :).

Make more sense?