Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operations

10/27/2014
05:40 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

How I Became a CISO: Janet Levesque, RSA

RSA's newest chief information security officer says she landed the job because of her ability to build relationships, not a background in crypto or a pile of certs.

One might assume that the CISO of RSA -- one of the world's premier suppliers of encryption technology -- would have been breaking codes in nursery school. Yet Janet Levesque, RSA's new CISO, did not start thinking about cryptography until quite a while later.

"It was certainly not an intentional path," she says of the years leading her to the top information security position. "It was an accidental path, which, over the years, I've become very passionate about."

During the course of her career, Levesque did roll up her sleeves and get her hands plenty dirty, but what really led her into security management was not getting her hands on the technology. It was asking the right questions and building the right relationships.

Though Levesque graduated from the University of Vermont with a liberal arts degree, her first job out of school was programming in COBOL, which she learned on the job. From there, she moved to an insurance company, working as an electronic data process (EDP) auditor, interviewing people in detail about how their systems worked. This led to IT risk management, in the salad days before Sarbanes-Oxley.

"Then, like many people, I decided to take a swing at the dot-com world." She ran IT for a grocery delivery service, doing a variety of hands-on technological work that she says she "had no business doing."

Like countless other dot-coms, the company burned $100 million in one year and then went out of business. "I got the experience of shutting down a company, literally turning off the lights. I got great hands-on experience and found I really enjoy it."

The opportunity to roll up her sleeves was a big asset to her next job -- at a credit card concierge service -- where she had to build a security program from nothing. And when she says "nothing," she means that the datacenter was not equipped with locks on the door, but it was equipped with an open container of alcohol.

Not surprisingly, RSA had higher security standards, yet the CISO position there is quite new. RSA did not create the job until 2011, a few months after the breach that exposed the company's intellectual property and raised questions about the sanctity of SecurID.

Levesque says the company was most interested in hiring her because of her relationship-building skills -- something that has become more important for RSA as it expands its hosting services business, and for CISOs across the board as companies outsource more of their IT functions.

Before she took the job, she made certain that she would not report to the CIO. Previously, as a director of IT security, she reported to the CIO, who reported to the CFO. At RSA, both she and the CIO report directly to the general manager. "It's hard to identify risk and controls in an IT department when your IT department is writing your check."

Levesque has managed to have this success without having a long string of abbreviations on her business card. She never bothered with a CISSP certification. She let her CISA lapse. On one hand, she acknowledges that certs set a baseline knowledge and can therefore help hiring managers weed out candidates. On the other hand, if people have time to take that many tests, how much time have they spent in the trenches?

Networking is important, says Levesque. Someone she knew socially helped get her resume seen when she applied for the RSA job. She successfully returned to the field after taking a few years off to be home with her young children, because a former boss who valued her talent employed her as a consultant, helping her to keep a hand in the industry.

If Levesque were not a security pro, she'd like to spend her time doing volunteer work to help underprivileged children and/or running a gourmet takeout restaurant.

In the meantime, "I love it" at RSA. "I'm having a really good time understanding the technology, understanding the services we have. I enjoy my colleagues... It's great working for a company that understands security."

This story is part of a new Dark Reading series about how to become a CISO. Catch up on last week's interview with the president of a security staffing firm, and come back next Monday to hear the origin story of Boston University's CISO -- from fixing his friends' toys as a kid through training Navy sailors about nuclear physics.

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
11/10/2014 | 8:11:21 AM
Re: Some very interesting points -- credentials
It certainly seems that because the demand for infosec talent exceeds the supply there are tremendous opportunities. But still, the road map to getting (and keeping) the job seems fairly undefined. In other words, the career path for Janet Levesque at RSA won't necessarily be replicated at Boston University for Quinn Shamblin, who Sara profiled last week.  I don' know whether that's a good thing for the industry or not. 

 

 

ClassC
50%
50%
ClassC,
User Rank: Apprentice
11/9/2014 | 11:46:47 PM
Re: Some very interesting points -- credentials

Kudos to Ms. Levesque, she certainly proves that you don't necessarily have to take the advertised road to entire the field of security.  This is good for those on the fence to know that even though you might not have what the industry lists as required skills, you can acquire experience over time and if security is your thing - give it a go !

 

Obviously it is a field that will have no shortage of need going forward.

Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
10/31/2014 | 1:52:30 PM
Re: Some very interesting points -- credentials
What do folks think about the fact that Janet doesnt have a long string of credentials. Is it an anomaly or a trend? How important are they to the role?
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
10/31/2014 | 1:43:16 PM
Re: Some very interesting points
@Kelly  Definitely. A few years ago I hadn't heard of a single CISO who didn't report to a CIO. Now that's changing. We probably have big scary breaches to thank for that.  :)
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
10/31/2014 | 1:37:46 PM
Re: Some very interesting points
I also think it's interesting how the CISO role has evolved so quickly, too. 
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
10/31/2014 | 1:28:03 PM
Re: Some very interesting points
@Kelly   Thanks! I find it intriguing, because there are so many people who get these jobs without following the "rules." In my conversations so far, the "who you know" factor has been a big one. 
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
10/28/2014 | 3:32:40 PM
Re: Some very interesting points
This series is really interesting and refreshing, @sarapeters. It's intriguing to get some insight into what makes today's CISO and what makes them tick. Great stuff.
savoiadilucania
50%
50%
savoiadilucania,
User Rank: Moderator
10/28/2014 | 1:31:34 PM
Re: RSA Who?
@asksqn

Which "more reputable" companies might you suggest?

asksqn,
GonzSTL
50%
50%
GonzSTL,
User Rank: Ninja
10/28/2014 | 9:27:37 AM
Some very interesting points
"During the course of her career, Levesque did roll up her sleeves and get her hands plenty dirty, but what really led her into security management was not getting her hands on the technology. It was asking the right questions and building the right relationships." A soft skill like the ability to communicate and build relationships is a critical part of the role. I know a lot of security pros who possess incredible technical skills and knowledge, but are unable to communicate the security message effectively to their peers, much less upwards and downwards in a corporate structure. This issue is probably the most important factor in the selection of a security leader.

"It's hard to identify risk and controls in an IT department when your IT department is writing your check." Separation of duties to avoid a conflict of interest is critical. I have personally seen this result in exactly the wrong decision. The tie breaker between IT and Security must rest on someone who acts in the best interest of the organization, and not just to a certain group within it. If IT and security are in a linear structure, then there is no guarantee that the tie breaker is not heavily influenced by the needs of one specific group, or that the final decision is right for the organization. Although rooted in the same foundation, IT and security sometimes diverge and the proper balance between the two, a compromise if you will, must sometimes be forged to benefit the organization. An organization may argue that their current CIO is impartial and can break the tie without leaning towards any one group, but what happens when that CIO leaves? What is the guarantee that the replacement will be equally impartial? Is that the proper legacy for that office? To me, forming this type of linear structure displays a lack of vision at best.

"On one hand, she acknowledges that certs set a baseline knowledge and can therefore help hiring managers weed out candidates. On the other hand, if people have time to take that many tests, how much time have they spent in the trenches?" I tend to believe that certifications are not the defining qualifier for security leaders. On the other hand, I do possess certifications, and I do know that I only tested once for each one, and keeping up with the CPEs is almost a trivial task. Additionally, what security pro does not keep up with technology, and incidentally, keeping up with technology can also lead to obtaining appropriate CPEs. So really, it's like getting a two-fer. And for those who deride certs, obtaining something like a CISSP is not a trivial task. In addition to that long test, there is the matter of required experience that must be certified to by someone else.

"If Levesque were not a security pro, she'd like to spend her time doing volunteer work to help underprivileged children and/or running a gourmet takeout restaurant." So it seems that Ms. Levesque is the exact person for the CISO position at RSA. She not only possesses technical skills, but also the soft skills necessary to effectively pull it off. Not only that, but apparently, IT security does not by itself define her as a person. Not a very common mix of traits among security pros. She is definitely not a geek with the personality of a doorknob.
Marilyn Cohodas
100%
0%
Marilyn Cohodas,
User Rank: Strategist
10/28/2014 | 9:13:09 AM
Re: I agree with some points and disagree with others
Peter Principal aside, in my experience, when someone like Janet Levesque achieves the level of a CISO, I have to believe that she can both talk the talk and walk the walk, both in terms of technical knowledge and the savvy it takes to run a strategic department on which a company's good fortune increasingly  depends. 
Page 1 / 2   >   >>
Florida Town Pays $600K to Ransomware Operators
Curtis Franklin Jr., Senior Editor at Dark Reading,  6/20/2019
Pledges to Not Pay Ransomware Hit Reality
Robert Lemos, Contributing Writer,  6/21/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-12960
PUBLISHED: 2019-06-25
LiveZilla Server before 8.0.1.1 is vulnerable to SQL Injection in functions.internal.build.inc.php via the parameter p_dt_s_d.
CVE-2019-12961
PUBLISHED: 2019-06-25
LiveZilla Server before 8.0.1.1 is vulnerable to CSV Injection in the Export Function.
CVE-2019-12962
PUBLISHED: 2019-06-25
LiveZilla Server before 8.0.1.1 is vulnerable to XSS in mobile/index.php via the Accept-Language HTTP header.
CVE-2019-12963
PUBLISHED: 2019-06-25
LiveZilla Server before 8.0.1.1 is vulnerable to XSS in the chat.php Create Ticket Action.
CVE-2019-12964
PUBLISHED: 2019-06-25
LiveZilla Server before 8.0.1.1 is vulnerable to XSS in the ticket.php Subject.