Cisco, Oracle, and LinkedIn security leaders share their challenges in communicating with business teams and advice for how CISOs can navigate the relationship.

Kelly Sheridan, Former Senior Editor, Dark Reading

September 12, 2019

9 Slides

CISOs historically have reported to the CIO. Now, more CISOs are being invited into executive- and board-level discussions as more organizations begin to prioritize cybersecurity initiatives.

The CISO is "a relatively new executive role," says Greg Jensen, senior principal director of security for Oracle. While the position has been around for a number of years, he explains, it hasn't always been welcomed in boardroom conversations. Even with a stronger voice, CISOs are the ones in hot water when areas of compromise or a breach is identified, Jensen notes.

Security leads take the brunt of some reputational risks and threats to a corporation when a security incident takes place. "It's the best but worst job someone could have," he adds.

Jensen believes there is a silver lining for security leaders. The CISO's role is changing as more people across the business realize the blame for security incidents shouldn't solely fall to the CISO, who traditionally handles security, privacy, compliance, and regulation responsibilities. We are at a point when responsibilities, priorities, and expectations of the CISO are starting to shift.

"Historically, members of the security team have been viewed as solely being technical in nature," says LinkedIn CISO Geoff Belknap. The long-term relationship between CISOs and business teams has been governed by the CISO's willingness and ability to view big-picture corporate challenges while inwardly focusing on technical challenges. Now, as more board members learn about and value cybersecurity, it's essential everyone is on the same page.

The CISO's goal is to align security with the organization and enable business strategy. Security should be folded into the business strategy, says Steve Martino, senior vice president and CISO at Cisco. It shouldn't be viewed as a hurdle or compliance box to check.

"The major security breaches that have happened in the past several years [have] educated executives on the importance of cybersecurity," Martino explains. Now the challenges have shifted from "why security?" to "how can we implement security efficiently and effectively?"

This involves both sides adjusting expectations, learning one another's priorities, clarifying misconceptions, and asking the right questions. Here, security leaders share their thoughts on the CISO's relationship to the business and offer insight on how they can navigate boardroom conversations. Have any tips we didn't include? Feel free to share them in the comments.

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Community Projects Highlight Need for Security Volunteers."

About the Author(s)

Kelly Sheridan

Former Senior Editor, Dark Reading

Kelly Sheridan was formerly a Staff Editor at Dark Reading, where she focused on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial services. Sheridan earned her BA in English at Villanova University. You can follow her on Twitter @kellymsheridan.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights