Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
How I Became a CISO: Janet Levesque, RSA
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
11/10/2014 | 8:11:21 AM
Re: Some very interesting points -- credentials
It certainly seems that because the demand for infosec talent exceeds the supply there are tremendous opportunities. But still, the road map to getting (and keeping) the job seems fairly undefined. In other words, the career path for Janet Levesque at RSA won't necessarily be replicated at Boston University for Quinn Shamblin, who Sara profiled last week.  I don' know whether that's a good thing for the industry or not. 

 

 

ClassC
50%
50%
ClassC,
User Rank: Apprentice
11/9/2014 | 11:46:47 PM
Re: Some very interesting points -- credentials

Kudos to Ms. Levesque, she certainly proves that you don't necessarily have to take the advertised road to entire the field of security.  This is good for those on the fence to know that even though you might not have what the industry lists as required skills, you can acquire experience over time and if security is your thing - give it a go !

 

Obviously it is a field that will have no shortage of need going forward.

Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
10/31/2014 | 1:52:30 PM
Re: Some very interesting points -- credentials
What do folks think about the fact that Janet doesnt have a long string of credentials. Is it an anomaly or a trend? How important are they to the role?
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
10/31/2014 | 1:43:16 PM
Re: Some very interesting points
@Kelly  Definitely. A few years ago I hadn't heard of a single CISO who didn't report to a CIO. Now that's changing. We probably have big scary breaches to thank for that.  :)
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
10/31/2014 | 1:37:46 PM
Re: Some very interesting points
I also think it's interesting how the CISO role has evolved so quickly, too. 
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
10/31/2014 | 1:28:03 PM
Re: Some very interesting points
@Kelly   Thanks! I find it intriguing, because there are so many people who get these jobs without following the "rules." In my conversations so far, the "who you know" factor has been a big one. 
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
10/28/2014 | 3:32:40 PM
Re: Some very interesting points
This series is really interesting and refreshing, @sarapeters. It's intriguing to get some insight into what makes today's CISO and what makes them tick. Great stuff.
savoiadilucania
50%
50%
savoiadilucania,
User Rank: Moderator
10/28/2014 | 1:31:34 PM
Re: RSA Who?
@asksqn

Which "more reputable" companies might you suggest?

asksqn,
GonzSTL
50%
50%
GonzSTL,
User Rank: Ninja
10/28/2014 | 9:27:37 AM
Some very interesting points
"During the course of her career, Levesque did roll up her sleeves and get her hands plenty dirty, but what really led her into security management was not getting her hands on the technology. It was asking the right questions and building the right relationships." A soft skill like the ability to communicate and build relationships is a critical part of the role. I know a lot of security pros who possess incredible technical skills and knowledge, but are unable to communicate the security message effectively to their peers, much less upwards and downwards in a corporate structure. This issue is probably the most important factor in the selection of a security leader.

"It's hard to identify risk and controls in an IT department when your IT department is writing your check." Separation of duties to avoid a conflict of interest is critical. I have personally seen this result in exactly the wrong decision. The tie breaker between IT and Security must rest on someone who acts in the best interest of the organization, and not just to a certain group within it. If IT and security are in a linear structure, then there is no guarantee that the tie breaker is not heavily influenced by the needs of one specific group, or that the final decision is right for the organization. Although rooted in the same foundation, IT and security sometimes diverge and the proper balance between the two, a compromise if you will, must sometimes be forged to benefit the organization. An organization may argue that their current CIO is impartial and can break the tie without leaning towards any one group, but what happens when that CIO leaves? What is the guarantee that the replacement will be equally impartial? Is that the proper legacy for that office? To me, forming this type of linear structure displays a lack of vision at best.

"On one hand, she acknowledges that certs set a baseline knowledge and can therefore help hiring managers weed out candidates. On the other hand, if people have time to take that many tests, how much time have they spent in the trenches?" I tend to believe that certifications are not the defining qualifier for security leaders. On the other hand, I do possess certifications, and I do know that I only tested once for each one, and keeping up with the CPEs is almost a trivial task. Additionally, what security pro does not keep up with technology, and incidentally, keeping up with technology can also lead to obtaining appropriate CPEs. So really, it's like getting a two-fer. And for those who deride certs, obtaining something like a CISSP is not a trivial task. In addition to that long test, there is the matter of required experience that must be certified to by someone else.

"If Levesque were not a security pro, she'd like to spend her time doing volunteer work to help underprivileged children and/or running a gourmet takeout restaurant." So it seems that Ms. Levesque is the exact person for the CISO position at RSA. She not only possesses technical skills, but also the soft skills necessary to effectively pull it off. Not only that, but apparently, IT security does not by itself define her as a person. Not a very common mix of traits among security pros. She is definitely not a geek with the personality of a doorknob.
Marilyn Cohodas
100%
0%
Marilyn Cohodas,
User Rank: Strategist
10/28/2014 | 9:13:09 AM
Re: I agree with some points and disagree with others
Peter Principal aside, in my experience, when someone like Janet Levesque achieves the level of a CISO, I have to believe that she can both talk the talk and walk the walk, both in terms of technical knowledge and the savvy it takes to run a strategic department on which a company's good fortune increasingly  depends. 
Page 1 / 2   >   >>


7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-3154
PUBLISHED: 2020-01-27
CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.
CVE-2019-17190
PUBLISHED: 2020-01-27
A Local Privilege Escalation issue was discovered in Avast Secure Browser 76.0.1659.101. The vulnerability is due to an insecure ACL set by the AvastBrowserUpdate.exe (which is running as NT AUTHORITY\SYSTEM) when AvastSecureBrowser.exe checks for new updates. When the update check is triggered, the...
CVE-2014-8161
PUBLISHED: 2020-01-27
PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message.
CVE-2014-9481
PUBLISHED: 2020-01-27
The Scribunto extension for MediaWiki allows remote attackers to obtain the rollback token and possibly other sensitive information via a crafted module, related to unstripping special page HTML.
CVE-2015-0241
PUBLISHED: 2020-01-27
The to_char function in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a (1) large number of digits when processing a numeric ...