Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
CISOs' Salaries Expected to Edge Above $240,000 in 2018
Threaded  |  Newest First  |  Oldest First
REISEN1955
REISEN1955,
 User Rank: Ninja
9/1/2017 | 12:42:45 PM
India
So how long will it take before American Management tags this expense as just another IT budget bloat, can the security staff and replace with Wipro, Infosys, Tata, et al at LOWER SALARY AND BENEFIT cost???  It would say it can happen now. 
JRBuckley
JRBuckley,
 User Rank: Apprentice
9/1/2017 | 1:57:55 PM
CISO Salaries Expected to... meanwhile...
Executive teams in multiple industries struggle to comprehend what a CISO does and equates the job itself as an "IT Problem", thus are setup for reporting into the IT Department, straining the IT budget, with very limited resources, tools, and ability to do their job.  What sounds like a ridiculous idea actually becomes reality when the IT Manager or even the person on the helpdesk is gloriously promoted to "Pseudo CISO" with none of the governance, real responsibilities of such a role, very limited visibility with regards to the business, and of course ALL the blame when things go terribly wrong due to a decision by the CCBDO "Chief Catastrophically Bad Decisions Officer".  The Board of Directors and Executive Leadership team shy completely away from calling the role a true CISO role by giving the position pet names like, "ISO" or "IT Security Manager" to lessen its overall influence.  Never mind the conflict of interests that present when the department you're auditing is the same department that controls your workload, priorities, and budget.  Meanwhile, the "Pseudo CISO" then is tasked with tackling a field he knows little about, told to check the boxes of compliance, and then held fully accountable when they are compromised aka fired.  In my line of work, I see this VERY often and there is no surprise at the amount of breaches we're seeing because of this mentality.  Many eTeams wish to spend as little money on security as possible and avoid a real CISO at all costs.
Joe Stanganelli
Joe Stanganelli,
 User Rank: Ninja
9/2/2017 | 1:36:06 PM
Seems quite high
I'd be interested to know more about the methodology and sourcing of this study, because I find this highly dubious. In my experience (which, I grant, is anecdotal#, CISO and CISO-like roles are being undervalued.

#Plus, FWIW, and ad hominem as the point may be, as somebody who knows TONS of people who have worked with Robert Half, I don't know anybody who has the slightest good thing to say about that company except people who work at Robert Half.)
JRBuckley
JRBuckley,
 User Rank: Apprentice
9/4/2017 | 7:35:07 PM
Re: Seems quite high
There is a rule about working for Robert Half as a consultant.  Robert Half takes HALF.  It sounds like a joke, but it's actually not.  No one is laughing, especially the person that is doing all the work.
REISEN1955
REISEN1955,
 User Rank: Ninja
9/6/2017 | 1:56:25 PM
On Robert Half
I have found them to be the most difficult people to get in touch with, contact or align one for a contract job in the world.  It is as if they DO NOT WANT to do business with you.  I have met some good reps in their offices and they always LEAVE for another job somewhere else.  I  have found TEKSYSTEMS to be fair and honest.  Their reps are fantastic and go the extra mile. 
JRBuckley
JRBuckley,
 User Rank: Apprentice
9/6/2017 | 3:37:42 PM
Re: On Robert Half
My experience with TekSystems was nice and clean for many years until my last experience.  They called me up, said they had reviewed my information, and wanted to meet with me to discuss a new role with a local client.  It's their policy to meet with each candidate in person, the recruiter said via phone.  I pointed out the fact that I've met with them in-person many times over the years and even worked with them but they wouldn't take no for an answer.  So I met with them.  Turns out, the whole thing was fake.  There was no job.  None.  It was a sales mining exercise.  They wanted my references and any work I've done through other recruiting firms so they could mine them for business.  When I made it clear that I wasn't going to provide them people for their sales pitch, the recruiter got defensive.  "Well, you should know that our branch manager has a special talent and knows within seconds if the person is the right person for the job or not."   Turns out, I wasn't the "right fit" for the fake job they didn't really have in the first place.
REISEN1955
REISEN1955,
 User Rank: Ninja
9/6/2017 | 3:46:27 PM
Re: On Robert Half
This series has gone off subject but your experience is indeed horrible.   
Joe Stanganelli
Joe Stanganelli,
 User Rank: Ninja
9/6/2017 | 7:09:59 PM
Re: On Robert Half
I once sat in the waiting room of a Robert Half many years ago waiting for a meeting with someone. I witnessed a man storm out of an office and have a yelling match with an employee. The disagreement had something to do with how he was being directed to fill out forms that he had already filled out repeatedly.

He stormed out, shouting that he would never work with them again, and to not contact him again.

I was baffled. I could understand being upset at bureaucracy, but I couldn't understand how a person hard up for a job could so cavalierly toss away an opportunity -- particularly as the Great Recession had freshly begun.

Now, being older and wiser, and knowing many people who have had working relationships with Robert Half (all of whom dearly regret it) and having heard their tales of woe, I completely understand that man's frustration that day.
graciemilligan
graciemilligan,
 User Rank: Apprentice
9/8/2017 | 1:09:51 AM
Re: On Robert Half
Inspiring article, this one gives a good expectation on salary; we need more money to sustain in this world. Work hard to get good result and t provide better service. 
cybersavior
cybersavior,
 User Rank: Strategist
9/8/2017 | 2:53:39 PM
Acronym truth
As it's said, "Career Is Soon Over".
Joe Stanganelli
Joe Stanganelli,
 User Rank: Ninja
9/22/2017 | 11:31:20 PM
Re: Acronym truth
@cybersavior: Clever! And apt. CISOs are often hired to be scapegoats more than anything else -- as an insurance policy in the form of a sacrificial lamb with which to appease the regulators.


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Everything You Need to Know About DNS Attacks
It's important to understand DNS, potential attacks against it, and the tools and techniques required to defend DNS infrastructure. This report answers all the questions you were afraid to ask. Domain Name Service (DNS) is a critical part of any organization's digital infrastructure, but it's also one of the least understood. DNS is designed to be invisible to business professionals, IT stakeholders, and many security professionals, but DNS's threat surface is large and widely targeted. Attackers are causing a great deal of damage with an array of attacks such as denial of service, DNS cache poisoning, DNS hijackin, DNS tunneling, and DNS dangling. They are using DNS infrastructure to take control of inbound and outbound communications and preventing users from accessing the applications they are looking for. To stop attacks on DNS, security teams need to shore up the organization's security hygiene around DNS infrastructure, implement controls such as DNSSEC, and monitor DNS traffic
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-33196
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.
CVE-2023-33185
PUBLISHED: 2023-05-26
Django-SES is a drop-in mail backend for Django. The django_ses library implements a mail backend for Django using AWS Simple Email Service. The library exports the `SESEventWebhookView class` intended to receive signed requests from AWS to handle email bounces, subscriptions, etc. These requests ar...
CVE-2023-33187
PUBLISHED: 2023-05-26
Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `type="text"` via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates `ty...
CVE-2023-33194
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was...
CVE-2023-2879
PUBLISHED: 2023-05-26
GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file