SRMBOK Security Risk Management Masterclass

This masterclass is in three parts:

1. Overview of the Security Risk Management Body Of Knowlege (SRMBOK)
2. How to conduct comprehensive Security Risk Assessments (SRA)
3. How to become a Chief Security Officer

This masterclass will be an interactive workshop based on SRMBOK (the Security Risk Management Body Of Knowledge) and delivered by the lead author of SRMBOK. It is limited to a maximum of16 attendees as it is designed as an informal event where we can speak freely among our peers.

WHY ATTEND THIS TRAINING

At the end of this event, you will have learned:

1. Specific tools for consistently identifying and analyzing risks;
2. A common platform to establish agreed security risk management frameworks for government, NGO, and private sector organizations;
3. A consistent framework, methods, and terminology to support systematic and vulnerability analysis;
4. Detailed guidance for customizing and implementing organizational security standards consistent with better practice across industries;
5. Tools for the development of consistent in-house training, vocational training, and higher education; and,
6. Tangible skills, specific tools, and case studies to assist implementation

HOW TO PERSUADE YOUR BOSS TO SEND YOU, however,

It can be hard to gain support for risk management training. Even if you feel that this training is definitely for you and will improve your performance at work, it isn't always easy to get the time off or funding for training. Below is a template for a proposal to attend this training.

Dear

I would like to ask for your support to attend some work-related training. The cost of the training is <$cost> plus travel expenses of <$cost>.

As a result of this training, I will be better able to support our business objectives and would like to discuss with you what specific outcomes you would like to see from it. I firmly believe that all training should deliver a return on investment. This training is designed to provide the following skills and knowledge:

1. Specific tools for consistently identifying and analyzing risks;
2. A common platform to establish agreed security risk management frameworks for government, NGO, and private sector organizations;
3. A consistent framework, methods, and terminology to support systematic and vulnerability analysis;
4. Detailed guidance for customizing and implementing organizational security standards consistent with better practice across industries;
5. Tools for the development of consistent in-house training, vocational training, and higher education; and,
6. Tangible skills, specific tools, and case studies to assist implementation

I would suggest that this training will improve my ability to identify and address risk at . With your help, I would like to design a specific project that will allow me to practice my newly acquired skill when I get back to the workplace.

The training is designed and delivered by an international risk management expert, Julian Talbot, who is, among other things, the lead author of the Security Risk Management Body Of Knowledge (SRMBOK). The training is designed to provide practical tools and insights that lead to improved performance and measurable outcomes in the workplace.

Thank you for your support.

Kind regards,

PROGRAM

• 09:00 Overview and update to the Security Risk Management Body Of Knowledge (SRMBOK) and related frameworks
• 11:00 Coffee break
• 11:30 How to conduct security risk analysis, in particular, Enterprise Security Risk Assessments (ESRA) using ISO31000, the SRMBOK ESRA process, and based on our collective experiences.
• 13:30 Lunch
• 14:30 Career planning. Leadership, promotions, earning more income, communicating with CEOs and Boards, courses, certifications, and pathways to Chief Security Officer
• 16:30 General discussion and question time
• 17:00 Finish

This is a Masterclass so we have flexibility to focus on the issues or challenges that you want to focus on.

WHO SHOULD ATTEND

• Security Risk Managers
• Cybersecurity specialists
• Security Consultants
• Risk Managers
• Safety Managers
• Audit and Assurance professionals
• Chief Security Officers and CEO’s
• Researchers
• Students
• Aspiring security managers

OBJECTIVES OF THE EVENT

The main objectives of this event are to:

• help us advance in our careers as a security risk professional;
• build our networks;
• share our collective wisdom; and,
• enhance our ability to protect people, organizations, and society.

WHAT IS SRMBOK?

The SECURITY RISK MANAGEMENT BODY OF KNOWLEDGE (SRMBOK) is a publication that integrates knowledge, competency, methodologies and applications across the discipline.

WHAT IS SRMAM?

The Security Risk Management Aide-Memoire (SRMAM) is a book designed as a memory jogger for security risk professionals. It is based on the Security Risk Management Body of Knowledge (SRMBOK) with updates to include additional material, and changes in the 2018 update to ISO31000 Risk Management Standard.

WHAT YOU WILL GAIN FROM THIS EVENT

At the end of this Masterclass, you will be better prepared for:

• Liaising with clients and managers to explain the SRM process 
• Influencing and convincing senior managers about security plans
• Identifying organizational risks, risk tolerances, and vulnerabilities. 
• Protecting your people and your organization 
• Communicating with senior stakeholders
• Applying best practice international security risk management frameworks
• Gaining funding for security initiatives
• Understanding and describing how security adds value
• Developing a comprehensive security risk management framework
• Promotion to senior roles in security and risk management
• Advancing more quickly in your security career

Morning tea and light lunch is included.

ABOUT YOUR PRESENTER

Julian Talbot is the author of several books on security and risk management, including lead author of the Security Risk Management Body of Knowledge and author of the Security Risk Management Aide-Mémoire.

He has lived and worked on five continents with roles including as Security Manager for the Australian Trade Commission, Woodside Energy's $24 billion North West Shelf Gas Project, and Malaysian Smelting Corporation's Indonesian operations. 

His experience includes developing and managing $60 million international security risk management programs, leading security and emergency teams of up to 200 people, as well as enterprise security risk assessments (ESRA) for organizations such as the Australian Department of Defence, Department of Agriculture, Water, and Environment, Australian Antarctic Division, Australian Trade Commission, and the $24 billion NW Shelf Gas Project.

His clients include well known organisations such as the United Nations Office of Counter Terrorism (UNOCT), Aspen Medical, IMX Resources, ACT Government, Woodside, and Advisian.

Julian is a recipient of the Australian Security Medal, Fellow of the Institute of Strategic Risk Management (F.ISRM), Certified Information Systems Security Professional (CISSP), Fellow of the Risk Management Institution of Australasia, and a Graduate of the Australian Institute of Company Directors. He holds a Master of Risk Management, a Microsoft Certified Systems Engineer Qualification, a Diploma of Security Risk Management, and an Australian nationally accredited Certificate IV in training.

You can find out more about his writings via www.bit.ly/JulianTalbot and his background at www.linkedin.com/in/juliantalbot

What trainees and clients have to say about Julian:

“It is difficult to formulate words of recommendation about people who lead their industries."

"An expert in free thinking and pragmatic problem solving, Julian is a global leader in his field."

“There are few people I have met that even come close to Julian from both a personal and business perspective. He has a brilliant mind and a warm heart and is always on the lookout for ways he can add value to other people and inspire positive change. I have seen numerous examples of Julian truly going the extra mile, giving his time and sharing his wisdom. A speaker, an author, a thought leader, an extraordinary business man, a writer, a creator and someone who challenges the norm - and an absolute pleasure to be around."

THE HISTORY OF SRMBOK 

I first started in the security industry in 1985 as a security guard at night for a movie that nobody has ever heard of. My training was "Keep people away from the set. Coffee and toilets are over there"

A week later I interviewed for a job doing mobile patrols. At the interview they gave me a uniform. I came back that night and they gave me a snub-nose Colt 38 special and some bullets, and asked "Do you know how to load it?" The first night the Supervisor showed me the patrol run. The second night he watched me to see how much had stuck. That was my training. I did that for five years, leaving eventually as Operations Manager for the company.

There are many stories I could share from those days but not here. The 1980s weren't exactly the high water mark of the security profession. Rogues ran the industry. But it paid well, and the job comprised hours of boredom punctuated by moments of sheer terror. A great recipe for a young chap.

Times have thankfully changed, but the security profession is still in many respects, on the journey towards becoming a true profession. Countless people have worked behind the scenes and continue to toil to get the profession to where it needs to be.

In 2005, my friend Miles Jakeman and I were active in professional associations and decided that we could contribute to security professionalism by writing a book on security.

We circulated drafts for comment, dug into the research, and ran public workshops to share some models we had developed. With feedback and contributions from over 100 security professionals who generously shared their time, we developed a 500-page book of models, definitions, history, and frameworks. 

In 2008, we published the first edition of the Security Risk Management Body Of Knowledge (SRMBOK). It was our attempt at summarizing and integrating all the relevant information that there was to know about Security Risk Management.

It’s 2020 now and about time for an update. ISO31000 Risk Management Standard was updated in 2018, and volumes of research have unfolded since then. Cybersecurity, communications, systems and networks, nanotechnology, robotics, and artificial intelligence have all changed the world. 

But that's another story. The Security Risk Management Aide-Mémoire (www.srmam.com) is a bridging book until we get to the next edition of SRMBOK.

Below are a few of the models that I have found helfpul for security risk management. The first one is the ISO31000:2018 risk management process.

This is the original SRMBOK Security Risk Management Framework, albeit updated slightly to reflect ISO31000:2018.

This is our Enterprise Security Risk Assessment model which evolved from a process I first used in 2005, found it's way to SRMBOK, and was recently updated in SRMAM to reflect the changes to ISO31000. It is the basis for my ESRA presentation.

Host or Publisher Julian Talbot