Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Top Advice for CISOs
Newest First  |  Oldest First  |  Threaded View
praneeth.goud
praneeth.goud,
User Rank: Apprentice
4/15/2015 | 3:33:23 AM
Re: Changing our approach
nice information thank you
Sara Peters
Sara Peters,
User Rank: Author
4/2/2014 | 11:15:49 AM
Re: Changing our approach
@RyanSepe  Budgets are NEVER simple, and you're right: no matter what department you're in you won't necessarily get the money you need/deserve, even if you use the budget you have perfectly. However, it is a useful exercise to ask yourself what you could be doing differently with the budget you have before you ask for more money.
RyanSepe
RyanSepe,
User Rank: Ninja
4/1/2014 | 3:30:50 PM
Re: Changing our approach
I think this might be the case to some extent. However, even if you express the importance of security and it is well received within your organization that doesn't mean that you will necessarily be provided the funds needed. Remember, that where security professionals express the needs for security there are other business endeavors that may also take precendence from other types of professionals. For example from a healthcare perspective, if a new heart monitor needs to be incorporated and funds are being divided to support that endeavor it may be difficult to acquire the funds needed for security.

The main point that I am trying to make is that even if the security aspect is acknowledged we need to remember that organizations are multi-faceted and that its not just a matter of yes budget approved, no budget denied. Or y amount of dollars to go to x security. Its a balance of y total dollars, then x to security and z to marketing and w to clincial and not necessarily that funds are being improperly used. It may be slightly more complicated. Thoughts?
Sara Peters
Sara Peters,
User Rank: Author
4/1/2014 | 10:38:32 AM
Re: Changing our approach
@tmccreight  As you say, "it's interesting to see how your position in an organization can change if you focus on supporting the business and become an enabler, instead of someone who can only say 'no.'"

One thing I wasn't able to include in the video was something else that Andy Ellis from Akamai said. I asked him about budget. And he said that if you feel like you don't have enough budget, then you're probably not spending what you have well. You're not showing the value of security and of your department, and you're not supporting the business. And if you started doing a better job of those things, your budget would increase. Do you think that's the case?
RyanSepe
RyanSepe,
User Rank: Ninja
3/31/2014 | 7:57:33 PM
Re: Changing our approach
tmccreight, I agree very much with your statement that points need to be delineated in a manner that is clearly understable to all. There is an element that is lost in translation when you are overly technical and I think the gravity of most situations can be better grasped with simplicity. 

Also, there needs to be a balance between yes-Security, no-Security and cosi-cosi security. I think the business plan and policies here is what will guide security decisions here. What is the overall goal? How to be secure while maintaining workflow, things of this nature.

My biggest interest in the video was with the technical engineer from Rapid7, in regards to his statement about the holistic view. What are peoples thoughts on; Do we want the best security tools from different vendors (possibly not purchased all at once) or is the benefit in one vendor many tools? Some times the different tools from multiple vendors may not mesh as well but singularly they can be quite an asset; whereas, tools all under one brand may mesh fantastically together but may not perform as well as the industry leaders. Thoughts to this?
tmccreight
tmccreight,
User Rank: Apprentice
3/31/2014 | 2:34:32 PM
Changing our approach
I really enjoyed the comments from Richard and Andy in the video.  I can relate to their comments and truly believe if all a CISO can do is talk about jargon and risks at a technical level, they will never be truly appreciated by their business peers.

We need to hone our communication skills and speak to business in their terms.  It's a tough skill to master, but when you begin focusing your message at a business level, you'll see a far different response from business leaders.  I've watched it - it's interesting to see how your position in an organization can change if you focus on supporting the business and become an enabler, instead of someone who can only say "no".


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Improving Enterprise Cybersecurity With XDR
Enterprises are looking at eXtended Detection and Response technologies to improve their abilities to detect, and respond to, threats. While endpoint detection and response is not new to enterprise security, organizations have to improve network visibility, expand data collection and expand threat hunting capabilites if they want their XDR deployments to succeed. This issue of Tech Insights also includes: a market overview for XDR from Omdia, questions to ask before deploying XDR, and an XDR primer.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-32284
PUBLISHED: 2022-07-04
Use of insufficiently random values vulnerability exists in Vnet/IP communication module VI461 of YOKOGAWA Wide Area Communication Router (WAC Router) AW810D, which may allow a remote attacker to cause denial-of-service (DoS) condition by sending a specially crafted packet.
CVE-2022-33208
PUBLISHED: 2022-07-04
Authentication bypass by capture-replay vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, Automation software 'Sy...
CVE-2022-33948
PUBLISHED: 2022-07-04
HOME SPOT CUBE2 V102 contains an OS command injection vulnerability due to improper processing of data received from DHCP server. An adjacent attacker may execute an arbitrary OS command on the product if a malicious DHCP server is placed on the WAN side of the product.
CVE-2022-33971
PUBLISHED: 2022-07-04
Authentication bypass by capture-replay vulnerability exists in Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, and Machine automation controller NJ series all models V 1.48 and earlier, which may allow an ...
CVE-2022-34151
PUBLISHED: 2022-07-04
Use of hard-coded credentials vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, Automation software 'Sysmac Studi...