Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
How I Became a CISO: Janet Levesque, RSA
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
11/10/2014 | 8:11:21 AM
Re: Some very interesting points -- credentials
It certainly seems that because the demand for infosec talent exceeds the supply there are tremendous opportunities. But still, the road map to getting (and keeping) the job seems fairly undefined. In other words, the career path for Janet Levesque at RSA won't necessarily be replicated at Boston University for Quinn Shamblin, who Sara profiled last week.  I don' know whether that's a good thing for the industry or not. 

 

 

ClassC
50%
50%
ClassC,
User Rank: Apprentice
11/9/2014 | 11:46:47 PM
Re: Some very interesting points -- credentials

Kudos to Ms. Levesque, she certainly proves that you don't necessarily have to take the advertised road to entire the field of security.  This is good for those on the fence to know that even though you might not have what the industry lists as required skills, you can acquire experience over time and if security is your thing - give it a go !

 

Obviously it is a field that will have no shortage of need going forward.

Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
10/31/2014 | 1:52:30 PM
Re: Some very interesting points -- credentials
What do folks think about the fact that Janet doesnt have a long string of credentials. Is it an anomaly or a trend? How important are they to the role?
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
10/31/2014 | 1:43:16 PM
Re: Some very interesting points
@Kelly  Definitely. A few years ago I hadn't heard of a single CISO who didn't report to a CIO. Now that's changing. We probably have big scary breaches to thank for that.  :)
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
10/31/2014 | 1:37:46 PM
Re: Some very interesting points
I also think it's interesting how the CISO role has evolved so quickly, too. 
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
10/31/2014 | 1:28:03 PM
Re: Some very interesting points
@Kelly   Thanks! I find it intriguing, because there are so many people who get these jobs without following the "rules." In my conversations so far, the "who you know" factor has been a big one. 
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
10/28/2014 | 3:32:40 PM
Re: Some very interesting points
This series is really interesting and refreshing, @sarapeters. It's intriguing to get some insight into what makes today's CISO and what makes them tick. Great stuff.
savoiadilucania
50%
50%
savoiadilucania,
User Rank: Moderator
10/28/2014 | 1:31:34 PM
Re: RSA Who?
@asksqn

Which "more reputable" companies might you suggest?

asksqn,
GonzSTL
50%
50%
GonzSTL,
User Rank: Ninja
10/28/2014 | 9:27:37 AM
Some very interesting points
"During the course of her career, Levesque did roll up her sleeves and get her hands plenty dirty, but what really led her into security management was not getting her hands on the technology. It was asking the right questions and building the right relationships." A soft skill like the ability to communicate and build relationships is a critical part of the role. I know a lot of security pros who possess incredible technical skills and knowledge, but are unable to communicate the security message effectively to their peers, much less upwards and downwards in a corporate structure. This issue is probably the most important factor in the selection of a security leader.

"It's hard to identify risk and controls in an IT department when your IT department is writing your check." Separation of duties to avoid a conflict of interest is critical. I have personally seen this result in exactly the wrong decision. The tie breaker between IT and Security must rest on someone who acts in the best interest of the organization, and not just to a certain group within it. If IT and security are in a linear structure, then there is no guarantee that the tie breaker is not heavily influenced by the needs of one specific group, or that the final decision is right for the organization. Although rooted in the same foundation, IT and security sometimes diverge and the proper balance between the two, a compromise if you will, must sometimes be forged to benefit the organization. An organization may argue that their current CIO is impartial and can break the tie without leaning towards any one group, but what happens when that CIO leaves? What is the guarantee that the replacement will be equally impartial? Is that the proper legacy for that office? To me, forming this type of linear structure displays a lack of vision at best.

"On one hand, she acknowledges that certs set a baseline knowledge and can therefore help hiring managers weed out candidates. On the other hand, if people have time to take that many tests, how much time have they spent in the trenches?" I tend to believe that certifications are not the defining qualifier for security leaders. On the other hand, I do possess certifications, and I do know that I only tested once for each one, and keeping up with the CPEs is almost a trivial task. Additionally, what security pro does not keep up with technology, and incidentally, keeping up with technology can also lead to obtaining appropriate CPEs. So really, it's like getting a two-fer. And for those who deride certs, obtaining something like a CISSP is not a trivial task. In addition to that long test, there is the matter of required experience that must be certified to by someone else.

"If Levesque were not a security pro, she'd like to spend her time doing volunteer work to help underprivileged children and/or running a gourmet takeout restaurant." So it seems that Ms. Levesque is the exact person for the CISO position at RSA. She not only possesses technical skills, but also the soft skills necessary to effectively pull it off. Not only that, but apparently, IT security does not by itself define her as a person. Not a very common mix of traits among security pros. She is definitely not a geek with the personality of a doorknob.
Marilyn Cohodas
100%
0%
Marilyn Cohodas,
User Rank: Strategist
10/28/2014 | 9:13:09 AM
Re: I agree with some points and disagree with others
Peter Principal aside, in my experience, when someone like Janet Levesque achieves the level of a CISO, I have to believe that she can both talk the talk and walk the walk, both in terms of technical knowledge and the savvy it takes to run a strategic department on which a company's good fortune increasingly  depends. 
Page 1 / 2   >   >>


Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Major Brazilian Bank Tests Homomorphic Encryption on Financial Data
Kelly Sheridan, Staff Editor, Dark Reading,  1/10/2020
Will This Be the Year of the Branded Cybercriminal?
Raveed Laeb, Product Manager at KELA,  1/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-3682
PUBLISHED: 2020-01-17
The docker-kubic package in SUSE CaaS Platform 3.0 before 17.09.1_ce-7.6.1 provided access to an insecure API locally on the Kubernetes master node.
CVE-2019-17361
PUBLISHED: 2020-01-17
In SaltStack Salt through 2019.2.0, the salt-api NEST API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.
CVE-2019-19142
PUBLISHED: 2020-01-17
Intelbras WRN240 devices do not require authentication to replace the firmware via a POST request to the incoming/Firmware.cfg URI.
CVE-2019-19801
PUBLISHED: 2020-01-17
In Gallagher Command Centre Server versions of v8.10 prior to v8.10.1134(MR4), v8.00 prior to v8.00.1161(MR5), v7.90 prior to v7.90.991(MR5), v7.80 prior to v7.80.960(MR2) and v7.70 or earlier, an unprivileged but authenticated user is able to perform a backup of the Command Centre databases.
CVE-2019-19802
PUBLISHED: 2020-01-17
In Gallagher Command Centre Server v8.10 prior to v8.10.1134(MR4), v8.00 prior to v8.00.1161(MR5), v7.90 prior to v7.90.991(MR5), v7.80 prior to v7.80.960(MR2) and v7.70 or earlier, an authenticated user connecting to OPCUA can view all data that would be replicated in a multi-server setup without p...