Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
How I Became a CISO: Janet Levesque, RSA
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
11/10/2014 | 8:11:21 AM
Re: Some very interesting points -- credentials
It certainly seems that because the demand for infosec talent exceeds the supply there are tremendous opportunities. But still, the road map to getting (and keeping) the job seems fairly undefined. In other words, the career path for Janet Levesque at RSA won't necessarily be replicated at Boston University for Quinn Shamblin, who Sara profiled last week.  I don' know whether that's a good thing for the industry or not. 

 

 

ClassC
50%
50%
ClassC,
User Rank: Apprentice
11/9/2014 | 11:46:47 PM
Re: Some very interesting points -- credentials

Kudos to Ms. Levesque, she certainly proves that you don't necessarily have to take the advertised road to entire the field of security.  This is good for those on the fence to know that even though you might not have what the industry lists as required skills, you can acquire experience over time and if security is your thing - give it a go !

 

Obviously it is a field that will have no shortage of need going forward.

Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
10/31/2014 | 1:52:30 PM
Re: Some very interesting points -- credentials
What do folks think about the fact that Janet doesnt have a long string of credentials. Is it an anomaly or a trend? How important are they to the role?
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
10/31/2014 | 1:43:16 PM
Re: Some very interesting points
@Kelly  Definitely. A few years ago I hadn't heard of a single CISO who didn't report to a CIO. Now that's changing. We probably have big scary breaches to thank for that.  :)
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
10/31/2014 | 1:37:46 PM
Re: Some very interesting points
I also think it's interesting how the CISO role has evolved so quickly, too. 
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
10/31/2014 | 1:28:03 PM
Re: Some very interesting points
@Kelly   Thanks! I find it intriguing, because there are so many people who get these jobs without following the "rules." In my conversations so far, the "who you know" factor has been a big one. 
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
10/28/2014 | 3:32:40 PM
Re: Some very interesting points
This series is really interesting and refreshing, @sarapeters. It's intriguing to get some insight into what makes today's CISO and what makes them tick. Great stuff.
savoiadilucania
50%
50%
savoiadilucania,
User Rank: Moderator
10/28/2014 | 1:31:34 PM
Re: RSA Who?
@asksqn

Which "more reputable" companies might you suggest?

asksqn,
GonzSTL
50%
50%
GonzSTL,
User Rank: Ninja
10/28/2014 | 9:27:37 AM
Some very interesting points
"During the course of her career, Levesque did roll up her sleeves and get her hands plenty dirty, but what really led her into security management was not getting her hands on the technology. It was asking the right questions and building the right relationships." A soft skill like the ability to communicate and build relationships is a critical part of the role. I know a lot of security pros who possess incredible technical skills and knowledge, but are unable to communicate the security message effectively to their peers, much less upwards and downwards in a corporate structure. This issue is probably the most important factor in the selection of a security leader.

"It's hard to identify risk and controls in an IT department when your IT department is writing your check." Separation of duties to avoid a conflict of interest is critical. I have personally seen this result in exactly the wrong decision. The tie breaker between IT and Security must rest on someone who acts in the best interest of the organization, and not just to a certain group within it. If IT and security are in a linear structure, then there is no guarantee that the tie breaker is not heavily influenced by the needs of one specific group, or that the final decision is right for the organization. Although rooted in the same foundation, IT and security sometimes diverge and the proper balance between the two, a compromise if you will, must sometimes be forged to benefit the organization. An organization may argue that their current CIO is impartial and can break the tie without leaning towards any one group, but what happens when that CIO leaves? What is the guarantee that the replacement will be equally impartial? Is that the proper legacy for that office? To me, forming this type of linear structure displays a lack of vision at best.

"On one hand, she acknowledges that certs set a baseline knowledge and can therefore help hiring managers weed out candidates. On the other hand, if people have time to take that many tests, how much time have they spent in the trenches?" I tend to believe that certifications are not the defining qualifier for security leaders. On the other hand, I do possess certifications, and I do know that I only tested once for each one, and keeping up with the CPEs is almost a trivial task. Additionally, what security pro does not keep up with technology, and incidentally, keeping up with technology can also lead to obtaining appropriate CPEs. So really, it's like getting a two-fer. And for those who deride certs, obtaining something like a CISSP is not a trivial task. In addition to that long test, there is the matter of required experience that must be certified to by someone else.

"If Levesque were not a security pro, she'd like to spend her time doing volunteer work to help underprivileged children and/or running a gourmet takeout restaurant." So it seems that Ms. Levesque is the exact person for the CISO position at RSA. She not only possesses technical skills, but also the soft skills necessary to effectively pull it off. Not only that, but apparently, IT security does not by itself define her as a person. Not a very common mix of traits among security pros. She is definitely not a geek with the personality of a doorknob.
Marilyn Cohodas
100%
0%
Marilyn Cohodas,
User Rank: Strategist
10/28/2014 | 9:13:09 AM
Re: I agree with some points and disagree with others
Peter Principal aside, in my experience, when someone like Janet Levesque achieves the level of a CISO, I have to believe that she can both talk the talk and walk the walk, both in terms of technical knowledge and the savvy it takes to run a strategic department on which a company's good fortune increasingly  depends. 
Page 1 / 2   >   >>


Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5615
PUBLISHED: 2020-08-04
Cross-site request forgery (CSRF) vulnerability in [Calendar01] free edition ver1.0.0 and [Calendar02] free edition ver1.0.0 allows remote attackers to hijack the authentication of administrators via unspecified vectors.
CVE-2020-5616
PUBLISHED: 2020-08-04
[Calendar01], [Calendar02], [PKOBO-News01], [PKOBO-vote01], [Telop01], [Gallery01], [CalendarForm01], and [Link01] [Calendar01] free edition ver1.0.0, [Calendar02] free edition ver1.0.0, [PKOBO-News01] free edition ver1.0.3 and earlier, [PKOBO-vote01] free edition ver1.0.1 and earlier, [Telop01] fre...
CVE-2020-5617
PUBLISHED: 2020-08-04
Privilege escalation vulnerability in SKYSEA Client View Ver.12.200.12n to 15.210.05f allows an attacker to obtain unauthorized privileges and modify/obtain sensitive information or perform unintended operations via unspecified vectors.
CVE-2020-11583
PUBLISHED: 2020-08-03
A GET-based XSS reflected vulnerability in Plesk Obsidian 18.0.17 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter.
CVE-2020-11584
PUBLISHED: 2020-08-03
A GET-based XSS reflected vulnerability in Plesk Onyx 17.8.11 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter.