Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
How I Became a CISO: Janet Levesque, RSA
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
11/10/2014 | 8:11:21 AM
Re: Some very interesting points -- credentials
It certainly seems that because the demand for infosec talent exceeds the supply there are tremendous opportunities. But still, the road map to getting (and keeping) the job seems fairly undefined. In other words, the career path for Janet Levesque at RSA won't necessarily be replicated at Boston University for Quinn Shamblin, who Sara profiled last week.  I don' know whether that's a good thing for the industry or not. 

 

 

ClassC
50%
50%
ClassC,
User Rank: Apprentice
11/9/2014 | 11:46:47 PM
Re: Some very interesting points -- credentials

Kudos to Ms. Levesque, she certainly proves that you don't necessarily have to take the advertised road to entire the field of security.  This is good for those on the fence to know that even though you might not have what the industry lists as required skills, you can acquire experience over time and if security is your thing - give it a go !

 

Obviously it is a field that will have no shortage of need going forward.

Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
10/31/2014 | 1:52:30 PM
Re: Some very interesting points -- credentials
What do folks think about the fact that Janet doesnt have a long string of credentials. Is it an anomaly or a trend? How important are they to the role?
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
10/31/2014 | 1:43:16 PM
Re: Some very interesting points
@Kelly  Definitely. A few years ago I hadn't heard of a single CISO who didn't report to a CIO. Now that's changing. We probably have big scary breaches to thank for that.  :)
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
10/31/2014 | 1:37:46 PM
Re: Some very interesting points
I also think it's interesting how the CISO role has evolved so quickly, too. 
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
10/31/2014 | 1:28:03 PM
Re: Some very interesting points
@Kelly   Thanks! I find it intriguing, because there are so many people who get these jobs without following the "rules." In my conversations so far, the "who you know" factor has been a big one. 
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
10/28/2014 | 3:32:40 PM
Re: Some very interesting points
This series is really interesting and refreshing, @sarapeters. It's intriguing to get some insight into what makes today's CISO and what makes them tick. Great stuff.
savoiadilucania
50%
50%
savoiadilucania,
User Rank: Moderator
10/28/2014 | 1:31:34 PM
Re: RSA Who?
@asksqn

Which "more reputable" companies might you suggest?

asksqn,
GonzSTL
50%
50%
GonzSTL,
User Rank: Ninja
10/28/2014 | 9:27:37 AM
Some very interesting points
"During the course of her career, Levesque did roll up her sleeves and get her hands plenty dirty, but what really led her into security management was not getting her hands on the technology. It was asking the right questions and building the right relationships." A soft skill like the ability to communicate and build relationships is a critical part of the role. I know a lot of security pros who possess incredible technical skills and knowledge, but are unable to communicate the security message effectively to their peers, much less upwards and downwards in a corporate structure. This issue is probably the most important factor in the selection of a security leader.

"It's hard to identify risk and controls in an IT department when your IT department is writing your check." Separation of duties to avoid a conflict of interest is critical. I have personally seen this result in exactly the wrong decision. The tie breaker between IT and Security must rest on someone who acts in the best interest of the organization, and not just to a certain group within it. If IT and security are in a linear structure, then there is no guarantee that the tie breaker is not heavily influenced by the needs of one specific group, or that the final decision is right for the organization. Although rooted in the same foundation, IT and security sometimes diverge and the proper balance between the two, a compromise if you will, must sometimes be forged to benefit the organization. An organization may argue that their current CIO is impartial and can break the tie without leaning towards any one group, but what happens when that CIO leaves? What is the guarantee that the replacement will be equally impartial? Is that the proper legacy for that office? To me, forming this type of linear structure displays a lack of vision at best.

"On one hand, she acknowledges that certs set a baseline knowledge and can therefore help hiring managers weed out candidates. On the other hand, if people have time to take that many tests, how much time have they spent in the trenches?" I tend to believe that certifications are not the defining qualifier for security leaders. On the other hand, I do possess certifications, and I do know that I only tested once for each one, and keeping up with the CPEs is almost a trivial task. Additionally, what security pro does not keep up with technology, and incidentally, keeping up with technology can also lead to obtaining appropriate CPEs. So really, it's like getting a two-fer. And for those who deride certs, obtaining something like a CISSP is not a trivial task. In addition to that long test, there is the matter of required experience that must be certified to by someone else.

"If Levesque were not a security pro, she'd like to spend her time doing volunteer work to help underprivileged children and/or running a gourmet takeout restaurant." So it seems that Ms. Levesque is the exact person for the CISO position at RSA. She not only possesses technical skills, but also the soft skills necessary to effectively pull it off. Not only that, but apparently, IT security does not by itself define her as a person. Not a very common mix of traits among security pros. She is definitely not a geek with the personality of a doorknob.
Marilyn Cohodas
100%
0%
Marilyn Cohodas,
User Rank: Strategist
10/28/2014 | 9:13:09 AM
Re: I agree with some points and disagree with others
Peter Principal aside, in my experience, when someone like Janet Levesque achieves the level of a CISO, I have to believe that she can both talk the talk and walk the walk, both in terms of technical knowledge and the savvy it takes to run a strategic department on which a company's good fortune increasingly  depends. 
Page 1 / 2   >   >>


COVID-19: Latest Security News & Commentary
Dark Reading Staff 5/22/2020
How an Industry Consortium Can Reinvent Security Solution Testing
Henry Harrison, Co-founder & Chief Technology Officer, Garrison,  5/21/2020
Is Zero Trust the Best Answer to the COVID-19 Lockdown?
Dan Blum, Cybersecurity & Risk Management Strategist,  5/20/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13438
PUBLISHED: 2020-05-24
ffjpeg through 2020-02-24 has an invalid read in jfif_encode in jfif.c.
CVE-2020-13439
PUBLISHED: 2020-05-24
ffjpeg through 2020-02-24 has a heap-based buffer over-read in jfif_decode in jfif.c.
CVE-2020-13440
PUBLISHED: 2020-05-24
ffjpeg through 2020-02-24 has an invalid write in bmp_load in bmp.c.
CVE-2020-13433
PUBLISHED: 2020-05-24
Jason2605 AdminPanel 4.0 allows SQL Injection via the editPlayer.php hidden parameter.
CVE-2020-13434
PUBLISHED: 2020-05-24
SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.