Risk

CISOs Offer Soup-to-Nuts C-Suite Strategy

Chief information security officers from Dell, RCB Bank and other organizations share what it takes to become a security exec, sit in the C-Suite, and keep the job.

Reports peg the average lifespan of a chief information security officer at just 18 months. Yet a number of Infosec professionals still aspire to be a CISO, and those who have made the grade want more – a seat at the executive table. What follows is sage advice from CISOs who have been there and done that, based on interviews and panel sessions at this week's at ISC(2) Security Congress in Austin, Texas.

Bits Twiddler or People Person?

One of the first steps in assessing whether a CISO path makes sense is a deep self-analysis, Gordon Rudd, RCB Bank's CISO, told Dark Reading in an interview at the ISC(2) Congress. "You need a certain personality to be a CISO," Rudd said. "Do you want to be a bits twiddler, or do you want to be interacting with people? As a CISO, you have to interact with people."

Additionally, the role not only calls for leading a security team but also working with executives and, potentially, the board of directors to secure their buy-in on security proposals, budget, and other issues, according to Rudd.

Once a decision is made to pursue a CISO path, the next step is finding the right company to join. Rudd divided the landscape into green companies, which are relatively young and growing with little legacy technology, and brown companies that are more mature with a relatively large base of legacy software and hardware. He noted brown companies tend to face greater security challenges, given the technology is older and may no longer be supported with security updates.

Newly minted CISOs should also be prepared to network with other CISOs and CIOs.

"I like to hang out with people who are smarter than me and who I can learn something from," Rudd said, adding that newbie CISOs should also dress for success: "You need to dress like your boss' boss," Rudd advised. "As a company matures, you want to look more Madison Avenue than surfer dude."

Think like a Business Leader 

CISOs and CEOs often have different backgrounds when it comes to education and career paths, but they are on the same team and have a shared mission: to do what is best for the organization. To be an effective CISO and a greater asset to the CEO, security chiefs need to modify their thinking. 

"It's a challenge to step outside of the day-to-day of being operational and technical, and to transform yourself to think through the lens of a business leader," John Scimone, Dell's CSO, told Dark Reading during an interview at ISC(2).

This lens should takes into account the financials of the businesses that support and overlay areas of the company that face the greatest risk of attack, and also the development of a framework for where the primary concern should lay. "The risk lens can be very different than the revenue lens," Scimone says. "The area that may generate the smallest revenue may also have the greatest risk."

M&A: the Ticket to the Table

CISOs should be talking to their CEO, general counsel and chief financial officer about the value they bring to the mergers and acquisition process, advised Scimone and Amjed Saffarini, CyberVista CEO, during a panel at the ISC(2)'s convention.

A CISO, for example, can perform security due diligence on a target company during the general due diligence process, and the results should be pointed out to the C-suite, Scimone suggested.  If, for example, the CISO's security team finds massive vulnerabilities in the target company's technology, or the target company had a recent breach, the finding could potentially lower the buyout price, which in turn would make the CISO "joined at the hip" with the CEO going forward. In Verizon Communications' acquisition of Yahoo, the Internet pioneer's massive breach ultimately resulted in a $350 million reduction in the buyout price to $4.48 billion, according to an announcement by the companies.

"The M&A conversation should happen early in the process, so the company does not overpay," said Saffarini.

Talk the Talk, Walk the Walk

When it comes to communication styles, there is sometimes a disconnect between the way a CISO and C-Suite exec talk. Explained Rudd: "Management wants a simple answer to a question versus a long answer. But since we have come up from the technology ranks, it's likely we give long answers [making] the CEO look like a deer in headlights."

CISOs should explain "why" certain actions should be taken before they delve into the "what" and "how" of a situation, advised Mark Adams, Optiv Security's executive director of consulting services, who spoke on an ISC(2) panel.

Michael Eisenberg, Optiv Security's vice president of executive consulting, added that it is important to talk to the C-suite about the outcomes of security actions, rather than the technical solutions to be used.

CISOs also need to have the courage to shine a bright light on issues that others are willing to sweep under the rug. If a network operator is not willing to deploy a security patch for fear it will either break the system or require the system to be taken offline, Rudd said CISOs should be prepared to move the issue up the chain of command. Bottom line, according to Rudd: "CISOs have to have the courage to say that our systems aren't any good." 

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Dawn Kawamoto is an Associate Editor for Dark Reading, where she covers cybersecurity news and trends. She is an award-winning journalist who has written and edited technology, management, leadership, career, finance, and innovation stories for such publications as CNET's ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
High Stress Levels Impacting CISOs Physically, Mentally
Jai Vijayan, Freelance writer,  2/14/2019
Valentine's Emails Laced with Gandcrab Ransomware
Kelly Sheridan, Staff Editor, Dark Reading,  2/14/2019
Making the Case for a Cybersecurity Moon Shot
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  2/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-15380
PUBLISHED: 2019-02-20
A vulnerability in the cluster service manager of Cisco HyperFlex Software could allow an unauthenticated, adjacent attacker to execute commands as the root user. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by connecting to the cluster serv...
CVE-2019-3474
PUBLISHED: 2019-02-20
A path traversal vulnerability in the web application component of Micro Focus Filr 3.x allows a remote attacker authenticated as a low privilege user to download arbitrary files from the Filr server. This vulnerability affects all versions of Filr 3.x prior to Security Update 6.
CVE-2019-3475
PUBLISHED: 2019-02-20
A local privilege escalation vulnerability in the famtd component of Micro Focus Filr 3.0 allows a local attacker authenticated as a low privilege user to escalate to root. This vulnerability affects all versions of Filr 3.x prior to Security Update 6.
CVE-2019-10030
PUBLISHED: 2019-02-20
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.52 and earlier in RejectASTTransformsCustomizer.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
CVE-2019-10030
PUBLISHED: 2019-02-20
A exposure of sensitive information vulnerability exists in Jenkins Cloud Foundry Plugin 2.3.1 and earlier in AbstractCloudFoundryPushDescriptor.java that allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through anoth...