Magazine menu Close Magazine menu

CISO

Latest stories

cybersecurity new team sport

Why cybersecurity is the new team sport

  • min read
    • The pace of technological change is accelerating, and we readily adopt its many advantages. But despite this massive technological change, approaches to the threats it brings have changed little. The result is, we're losing the battle against constant attacks and breaches. For CEOs and Chief Information Security Officers (CISOs,) history may supply an answer – not in the form of technological genius, but in the form of humanity. Our recent history and deepest past show why cybersecurity must become the new team sport. The futuristic wild west of IT When I started working with computers in the early 1980s, they were controlled by men with beards in woolen tank tops. They ruled from a refrigerated IT throne – refrigerated because the IT team would often share the room with servers that need to be kept cool – knowing everything that went on in their realm. If something happened that was not allowed, it was fixed and hidden from the outside world with a combination of embarrassment and corporate secrecy. Today, we're in more of a futuristic wild west. The business perimeter contains many more applications, devices and entry points. Specialist 'gun slingers' – in the form of CISOs – have the IT administrator's security responsibilities. Each tries their best to cope with the onslaught of potential threats – anything from a nation-state attack to an employee accidentally sending data somewhere they shouldn't. Start-up mentality not all it's cracked up to be "Fail fast" and "move fast and break things" are often hailed as mantras of tech start-up success. But history also shows bad people have these same mentalities. They don't worry about due diligence or putting new ideas and technologies through rigorous testing. They try anything they think will work without considering if it will breach compliance. Meanwhile, budget, resources and red tape often tie CISO hands. They can feel held hostage by a board that doesn't understand the need for rapid reaction to combat the latest advance in 'dark tech.' We've seen this challenge before Up to now, I've described a futile, dystopian, 'Mad Max' world. But I think the battles CISOs fight today are our history, not of our future. Companies, and those in cybersecurity, often call their critical data and intellectual property the 'crown jewels,' referencing the ceremonial treasures acquired by English kings and queens. Those crown jewels are protected by thick walls, with guards and few entry points – like how IT administrators guarded our data back in the 80s. CISOs are inevitably 'outgunned,' under-resourced and underfunded in a battle against an agile and risk-indifferent enemy. So how do we 'fight the good fight' and win? Again, history has answers. Early 1900s business theorist Harrington Emerson is sometimes paraphrased, "Methods are many, principles are few. Methods may change, but principles never do." So let's go back to first principles. We're stronger together Humans first formed settlements as they started farming some 14,000 years ago. Having individuals in these settlements with different skillsets and abilities facilitated their growth. Some of us have an aptitude for the cerebral, like designing and inventing. Others are more physical, excelling in building and protecting. Settlements developed when we used complementary skills to advance a common goal, like making a safer, more prosperous place to live. Settlements collaborated – sometimes merging, sometimes building coalitions. And in times of crisis, while a few favored 'everyone for themselves,' most joined together for the greater good. Charles Darwin said, "It is the long history of humankind (and animal kind, too) that those who learned to collaborate and improvise most effectively prevailed." History has countless examples of international teamwork, from expeditions into unchartered territory to the allied nations of World War II, and more recent history. COVID-19: Each taking on a little During the recent COVID-19 pandemic, as individuals, we took precautions to keep ourselves and our families safe. But our actions of self-isolation, social distancing and complying with lockdowns knowingly served to protect society. Some countries legally enforced these measures. In others, it was a request. Regardless, most adhered, each playing their part by taking on a little of the responsibility to keep everyone safe. Eventually, the infection rate dropped and with much help from modern medical science, the world could open up. During the pandemic, countries teamed up, sharing information about infections – different strains, different consequences and symptoms. The data grew as individuals and teams combined findings, leading to the creation of vaccines to reduce the impact of the virus. It didn't stop there – sharing goes on, so vaccines can be tweaked to ensure continued efficacy. Extrapolating from this, the roadmap for cybersecurity should see the CISO as part of a team – not just within one organization, but within a global network, openly sharing intelligence and insight. On the other side of the planet, a CISO who has seen similar adds more context. As the chain passes from CISO to CISO, value increases. Quantity and depth of data grow, like crowdsourced security. This level of open collaboration may sound far-fetched, but intelligence agencies worldwide have shared information on threats similarly since September 11, 2001. This operating model may be closer than we think. CISOs already attend lunches or drinks where they swap 'war stories' under the Chatham House rule: You may use the information, but you may not disclose its source. Cybersecurity researchers in different companies and institutions worldwide combine their findings, writing shared reports. We already collaborate this way, instinctively reaching out for help, as we did in the days of early human settlements, but mostly we do it individually. Corporate legalities and organizational culture tend to restrict rather than encourage inter-company information exchange – it doesn't have to be that way. History shows collaboration naturally happens between groups with a common cause, and today is no different. By encouraging CISOs, staff and researchers to exchange knowledge and skills through a system for sharing threat information, we can nurture the communication of cooperation. We are better together, and together we can play the new team sport of cybersecurity.
non technical ciso header

The accidental CISO: How to lead tech teams without a tech background

  • min read
    • The role of the CISO, the Chief Information Security Officer, has traditionally been a technical one. With organizations taking a technology-first approach to secure their infrastructure and data, it seemed natural to elevate technical members of staff into the role to make the best use of their knowledge. But not everyone in this role is a hands-on technical security expert. What do you do if you don't have a technical background and you're a CISO (or the equivalent level of task responsibility) and people expect you to understand all of their technical security problems and issues? You'll most likely be encumbered with many non-technical requirements: personnel management of direct and indirect reports, all of the admin that goes with a senior position, being able to understand the new language those around you are using or the concepts they're referring to, translating between technical and non-technical staff, understanding and prioritizing business outcomes over purely technical or security-related results, threat modelling issues around compliance and liability and litigation… all of this… while trying to learn the technical knowledge at the same time. Or even if you were in a technical position before, you're expected to maintain up-to-date knowledge in an ever-changing field, while learning all the new skills required for your management role. Thankfully, many organizations now realize how important mental health concerns are for their people, particularly senior staff, where impaired decision making or forced absence from work can have a detrimental effect on the business. But while trying to stay balanced, you still have a problem to solve: how do you stay up to date with technical developments when you're not in a technical position? Here are a few solutions to consider, depending on the situation you're in. Talk to your staff openly When you're the most senior person within a particular discipline in your organization, it can feel that you need to be the most knowledgeable and most incisive. But that attitude is more suited to bosses in video games and Hollywood villains than to a corporate hierarchy today. Talk to your staff. Find the experts and ask them for their opinion, or ask them to brief you on the latest developments in the field. Not only are they saving you considerable time and effort, but this common ground where you're asking for advice helps build a much better relationship with your team. Being a source of knowledge to you is part of their duties, and if you honor this task with that level of importance then they will too. Of course, you need to be aware of any local considerations and biases, for example, a technical expert in data loss prevention (DLP) is unlikely to advocate the abandonment of this technology for a different platform, but with this context in mind, you can access decades of their accumulated knowledge in a few hours. Build good relationships with your vendors Image credit: Getty Images Find a good vendor, ideally, a good systems integrator (SI). They usually have a poor reputation in the industry, but it's unfairly so. However with this being a technology-led field, you're going to have to refer to experts, and who better than organizations that sell multiple types of solutions. Find a good SI. Ensure they're aware of your budgets and constraints; also that they know you're looking to build a relationship rather than make a quick purchase. As there's a greater upside for them than an immediate sale, your chosen SI should see you as a long-term relationship, and as your organization grows, so will your budget to spend with them. Subpar salespeople think in the short term to make a quick sale today. Better salespeople realize the pressure you're under and know how valuable they can be to you if they're trustworthy and offer high-quality advice – and, in return, if you go straight to them for your next purchase, they've just saved a considerable amount of sales effort. Befriend the technical staff at your vendors My opinion of salespeople is built around those I've worked with, so it might be more favorable than yours. Maybe the vendors you deal with simply aren't that trustworthy, or you don't have the budget to attract any of the SIs. In that case, focus on the technical staff at your vendor, the pre-sales support who accompanies the salesperson. This technical person will either be a dedicated pre-sales resource or a developer or architect for smaller vendors. It's unlikely they'll be on commission and evaluated on sales performances, so they won't be financially influenced to deceive you. It's also quite likely that they're blunter, technically minded and a bit of a problem solver – they'll see your situation as a puzzle to be solved rather than a business opportunity to be exploited. And if their current employer's product doesn't fit, then they're more likely to explain why. In particular, keep this in mind at conferences. See if you can catch the technical sales support person away from their stand or after a talk to get an honest opinion of their solution. Alternatively, at either a conference or a sales meeting, see it as your job is to discuss the financials with the sales rep and protect the technical person you've brought along with you; that way your technical team member can talk, unhindered, to the technician from the vendor. While you're soaking up the infographics and sales numbers, your technical person can get a more honest view and report back to you afterward. How to avoid bluff or burnout It's common for security leaders to pick one of two approaches: Bluff – especially for non-technical or formerly technical leaders, it's easy to try and bluff your way through decisions, to give confident guesses, expecting your team to make the best out of what you've decided. You might get lucky for a while, but bravado alone can lead to staff taking you out of the decision-making loop to avoid your mistakes. Burnout – try to take on all the new business skills while maintaining your existing specialist skills, to be the leader everyone expects you to be. This approach isn't sustainable. The strategies I've proposed are more difficult as they need more investment and commitment, but it's a better way forward in the long term that will lead you to make more effective technology decisions in the future. The opinions in this article reflect those of the author.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries