Steve Sullivan

Every environment has some form of governance. Architecture reviews. Change control. Approval processes. I’ve seen it handled a few different ways: 1. Tight governance up front Everything gets reviewed before it moves. Better consistency, fewer surprises. But it can slow things down and push work into side channels. 2. Minimal governance Teams move quickly and make decisions locally. Faster delivery. But consistency drifts and risk shows up later. 3. Lightweight governance with escalation Most work moves freely, with defined points where things get pulled in for review. Works well when people know when to engage it. Breaks down when that line isn’t clear. I’ve generally seen the best results when governance is predictable and selective, not constant. Too much governance, and people work around it. Too little, and you’re left figuring out who owns it, what exists, and whether anyone ever reviewed it. Where have you seen that balance land?

2

Day 21/ CRISC mock question 21: Jane, the Director of Sales, contacts you and demands that you add a new feature to the software your project team is creating for the organization. In the meeting she tells you how important the scope change would be. You explain to her that the software is almost finished and adding a change now could cause the deliverable to be late, cost additional funds, and would probably introduce new risks to the project. Jane stands up and says to you, "I am the Director of Sales and this change will happen in the project." And then she leaves the room. What should you do with this verbal demand for a change in the project? A. Include the change in the project scope immediately. B. Direct your project team to include the change if they have time. C. Do not implement the verbal change request. D. Report Jane to your project sponsor and then include the change. #aswinisrinath #infosec #aswinisrinath #infosec #CRISCstudygroup #CRISCexamprep #CRISC #infosecurity #informationsecurity #cybersecurity #CRISCcertification #CRISCaspirants #dailyCRISCquestion #CRISCQuestionOftheday

3

8 Comments

🔐 BitLocker Recovery After Update? Here’s What IT Must Know After BIOS updates, TPM reset, Secure Boot changes, or major Windows updates, laptops may suddenly enter BitLocker Recovery Mode. Why? BitLocker detects a hardware or boot environment change and protects the drive by asking for the 48-digit Recovery Key. Important: There is NO bypass method. If recovery key is not available in: • Microsoft Account • Azure AD / Entra ID • Active Directory The only option is formatting the device (data loss). Best Practices: ✔ Always back up recovery keys ✔ Ensure keys are stored in AD / Entra ID ✔ Verify BitLocker backup before BIOS/firmware updates ✔ Document encryption status in asset records --- How to Turn Off BitLocker (If Needed) Before major hardware changes, you can suspend or disable BitLocker. Option 1 – Suspend Protection (Recommended before BIOS update) Open Command Prompt as Administrator: manage-bde -protectors -disable C: This temporarily suspends BitLocker. To re-enable: manage-bde -protectors -enable C: Option 2 – Fully Turn Off BitLocker (Decrypt Drive) manage-bde -off C: This will start full decryption (may take time depending on drive size). Or via GUI: Control Panel → BitLocker Drive Encryption → Turn Off BitLocker Always ensure recovery key is backed up before making changes. Security is strong by design — but management must be stronger. Have you faced BitLocker lock after update in your environment? #BitLocker #WindowsSecurity #ITSupport #CyberSecurity #EndpointSecurity #SystemAdministration #EnterpriseIT

3

𝗪𝗵𝗮𝘁 𝗶𝗳 𝘄𝗲 𝘁𝗿𝗲𝗮𝘁𝗲𝗱 𝗮𝗴𝗲𝗻𝘁𝗶𝗰 𝗔𝗜 𝗹𝗶𝗸𝗲 𝗮 𝗻𝗲𝘄 𝘁𝗲𝗮𝗺 𝗺𝗲𝗺𝗯𝗲𝗿 𝗶𝗻𝘀𝘁𝗲𝗮𝗱 𝗼𝗳 𝗷𝘂𝘀𝘁 𝗮 𝘁𝗼𝗼𝗹? That mindset shift caught me off guard during a recent conversation with a vendor who built an AI agent specifically for Identity and Access Management (IAM). I asked:  • How do you train it?  • How do you make sure it doesn’t do something it shouldn’t?  • How do you know it’s ready for more responsibility? The vendor replied, “𝘏𝘰𝘸 𝘸𝘰𝘶𝘭𝘥 𝘺𝘰𝘶 𝘵𝘳𝘦𝘢𝘵 𝘢 𝘯𝘦𝘸 𝘩𝘪𝘳𝘦?” I said, “𝘐’𝘥 𝘵𝘳𝘢𝘪𝘯 𝘵𝘩𝘦𝘮. 𝘚𝘵𝘢𝘳𝘵 𝘸𝘪𝘵𝘩 𝘭𝘦𝘢𝘴𝘵 𝘱𝘳𝘪𝘷𝘪𝘭𝘦𝘨𝘦. 𝘉𝘶𝘪𝘭𝘥 𝘵𝘳𝘶𝘴𝘵. 𝘌𝘹𝘱𝘢𝘯𝘥 𝘢𝘤𝘤𝘦𝘴𝘴 𝘢𝘴 𝘵𝘩𝘦𝘺 𝘱𝘳𝘰𝘷𝘦 𝘵𝘩𝘦𝘮𝘴𝘦𝘭𝘷𝘦𝘴.” He nodded. “𝘌𝘹𝘢𝘤𝘵𝘭𝘺.” That moment stuck with me, not because of what was said, but because of what clicked. Agentic AI isn’t some mysterious black box. It’s something we guide, govern, and grow just like a new person joining the team.  • If we don’t trust it, we don’t give it access.  • If it needs more training, we provide it.  • As trust builds, access grows. Agentic AI is autonomous, but it must be shaped by the environment we design around it. It requires:  • Context  • Governance  • Oversight I’ll be doing a follow-up session soon to explore their platform in more detail. But this shift in perspective already changed how I think about AI adoption. Agentic AI is only as powerful as the trust, training, and structure we build around it. What’s your take? Are you thinking of AI as something to govern or something to fear? Would love to hear how others are approaching Agentic AI in security and identity contexts. #AgenticAI #IAM #AI #Cybersecurity #DigitalTrust #AIAdoption #Governance #Leadership #IdentityAccessManagement #AITraining #TechStrategy #FutureOfWork

10