The New CISO

What it Means to be an Honest Broker As a former CISO in Hanover Insurance Group, Brian Haugli shares what it means to be an honest broker in the context of security leadership, which might be better described as an agent of trust and transparency for a business. Brian and Steve Moore talk about strategies for delivering the right message to executives and the Board, the learning opportunities that come with candor and the honest truth about managing the inherent stress of the position. Advice to future or current leaders One big feedback I would give my younger self is don't focus so much on one area or another. Really be open to the ancillary spaces within security. Looking at human behavior, looking at the legal side of things, and pulling that information in to help round you out. Is there a core of bad leadership in information security? Not everyone is born to be a leader. It's something that you're born with that type of a capability. I think you look back at like type A/type B personalities. A lot of security folks are the type B, and there's nothing wrong with that, but I think there's a different level of getting leadership out of that that isn't as natural for them as somebody who is a type A, an outgoing type of a person. I don't think there's bad leaders in InfoSec. I just don't think there's enough of them. Transitioning on a small team vs large team On a smaller organization, you're going to wear more hats because there's just not enough people for that work to go around. The larger organizations, what I learned was I could sit down a team or four or five analysts, teach them in one or two hours how I would do something. And now, I've multiplied my capabilities by five. And that's much more effective than me trying to do that individually. The smaller teams, smaller orgs, they are struggling with being able to address this and I think that's where I want to find a niche for developing some work and some support and driving insight and guidance to these groups because they need help. The start of Side Channel Security We saw the need that small and medium businesses, nonprofits, VC-backed software firms, don't need a CISO full time but still need that kind of guidance and expertise. We started by supporting a nonprofit ... realizing the questions and the concerns were the same things that we had heard from our peers in larger organizations or our own organizations at the time. It just built upon itself. Where are people most ignorant as it relates to information security and running a good program? I've got a bit of a mantra that I can't defend what I don't know exists and that's really asset identification, asset allocation. Being able to answer what is your business obligations? And what are your business objectives? Can you identify the things that keep you running and could you tell me what a bad day looks like? You have to make them understand that your new reliance on technology and you storing all of this data and/or allowing access to these systems equates to your ability to provide services to your customers, whatever that is then. Those are usually ah-ha moments for folks and it's a good one to be there for because you can quickly help them realize what their concerns really should be from a security standpoint, but then quickly get them to how do we tackle this? How do we make this not an issue any longer? How do we mitigate that risk? What is an honest broker when delivering a security message to the ELT or the Board? I think it's just about transparency and integrity. Security, the definition of security, is confidentiality, integrity, and availability. As the CISO, your ability to obviously protect those things is one aspect. Your ability to showcase and embody the integrity of what it is that is being expected of you. Turning that around and then being able to explain that in terms that honestly chances are nontechnical person and somebody who definitely doesn't understand information security is going to understand. Do they always really want the truth? Everybody always wants the truth but what they want is to make sure that you're not positioning as if the sky is falling on every conversation you're having. It's about talking about the level of risk at an appropriate level. What most senior leaders really want to hear is that you've got it under control. What you can do is be completely honest in the fact that you don't know what you don't know and then promise that you're going to go figure it out and come back to them with something. What are things that we forget to do? I think the thing that gets missed a lot is that security doesn't exist without the business. We're not in the position for the sake of a company or an organization. What’s the worst archetype of a CISO? I think there's a major difference between the CISO who has a real technical understanding of everybody on his team or her team and those who came through the CIO track or the business track. I think you can

The Ins and Outs of Budgeting Andrew Wild, CISO at QTS Data Centers, sits down with Steve Moore to talk about IT security budgets, the challenges of prioritizing resources to balance risk and the value of cooperation. IT Security Budget Managing an IT security budget isn't just about spreadsheets and internal procurement processes, it's about understanding your organization's business priorities. Add to that, the management of your vendors and VARs with which you work. A CISO's focus is to protect the organization and measurably reduce risk, which often requires the acquisition of technology. However, those decisions aren't just about tech. There's a lot of management planning that must occur. The combination of transparency, forecasting and relationship building is good for business. Challenges of Prioritizing Resources to Balance Risk Anyone that aspires to have a more senior leadership role in an organization, needs to understand how things are budgeted and financed and paid for. Look at the amount that was budgeted in previous years and what was actually spent. Sometimes that is a way to glean some insight into how well that role is functioning. In some cases, an organization may be growing so fast that you or your budget is continually being adjusted upward which can be a great thing. An indicator perhaps of some issues either in execution or enough resources to execute would be if the amount that was budgeted exceeds by a not insignificant amount the amount that was spent. If you're not spending everything that you were allocated, that's an indication of a problem within the organization. The Value of Cooperation In the information security arena, there is very little that the information security team itself is able to accomplish without support across the organization. The infosec team is leading part of the effort, but there's always another team that's needed, whether it's the team that's racking the hardware. Whether it's the team that's going through and supporting you in the procurement process. Whether it's the legal team in terms of contract reviews. You are, to a very large extent, dependent upon other organizations to be able to accomplish your mission. It's important to try to learn how the procurement process works. What is the mechanism through which the value added resellers, the VARs, are selected, do you have the ability to influence which VARs you will get to work with for your information security solutions and services. It's not always just about within your organization too. It's about how you work with both the vendors and the VARs. Be considerate of the fact that the vendors and VARs work on a forecasting model where they have to be able to, with some level of precision, predict when opportunities are gonna close. Be up front and be transparent. What is Being Forecasted? In any kind of a sales organization, the organization expects to be able to know what kind of transactions are gonna happen, what opportunities have been identified and that there is a definite progression through the sales process or the funnel as some people call it, where an opportunity for sales is identified--there's a need, there's a solution developed. People depend upon being able to plan because that's how companies be able to better plan and meet their numbers particularly if it is a publicly traded company. What Makes a Good VAR? Someone that has likely either deployed the technology in their own environment or has deployed it in other customer environments and knows the solution it sells, and they're almost an extension of the company's sales engineering team. VARs will provide some very valuable information that you might not get working directly with the company itself. A Better Relationship with Sales Go talk to people outside your organization. It can be very inspiring and helpful. It can also potentially lead to new opportunities. If you don't interact with people, it's really hard to be able to plan out your career. Either to know what you're interested in, or to become aware potentially of opportunities. It’s really about engaging with the larger part of the organization, recognizing that at some level, every member of the organization is a representative of that company, and is in some way assisting the organization in achieving its goals. Whether it be directly, through supporting the sales process, or cost management, or getting a project done on time or early. Growth of the CISO Position It's certainly getting bigger from a risk perspective. It's becoming a larger position because it's less focused on just implementing technology and more focused on managing business relationships and identifying and guiding an organization through the navigation of risk management. Resources: Exabeam - Website QTS Data Centers - Website Steve Moore - LinkedIn Andrew Wild - LinkedIn

Lessons Learned from a Virtual CISO Matt Klein, Virtual CISO and Executive Advisor at Optiv, sits down with Steve Moore to share his insights on teamwork, getting visibility at the executive level, and the right prep for effective board conversations. What is a Virtual CISO? Think of it as a trusted advisor, an executive advisor, talking about strategic elements of your security program, even some technical elements, at a high to medium level. They are a trusted person to work with a company and make sure that they're headed in the right direction. Also, they are that person to bounce concepts off of and to make sure they're doing the right things as they're building their information security program. There are times where the virtual CISO model comes into play where either the CISO has left the company, or possibly a small to medium size business that doesn't have the need for a full time CISO. Another situation is where a CISO is gone, or they're creating a CISO role, and they believe they had somebody on staff who is capable of doing the role but needs some guidance. What is a bad CISO? Usually they're not talking the same language as the business. Everyone tries to get to that language of talking risk, but really talking about the business. What does the business do? What are the crown jewels? What are those elements of the business that are core to protect? Whether it be data in a regulated industry, most industries would love to protect their brand. They don't want their brand drug through the mud in terms of a data breach. It's those types of things. It's really those situations where the CISO is either removed so far from the executive team or from the board of directors, that the voice of the CISO is never heard. Is the CISO role measurably impossible? There are folks doing a fantastic job. They have what they need to get the job done and that's really the root of CISO success. It's budget, it's staffing, it's all of those core elements to a security program, but it's more than personal interaction with the business. There's an understanding of what the business does and what protection should be in place. You can't place a blanket over everything, it's impossible, it's expensive. You never have enough staff. You really have to pick and choose what you want to get done inside of your program. In a risk-based approach that makes sense for your business. Set the base line at an executive level. Interaction with the Board It was just getting to know who I was talking to. In this case it was the board of trustees of a private state institution. Just understanding who the players were and getting to the point where I was talking at a very rudimentary level about what a security program was. There were no numbers for that initial meeting. It was really concepts. It was bringing some of the concepts of protecting the institution, protecting the brand. It's really a huge asset for them to consider from a protection standpoint. It was really setting a foundation of here's what we're trying to protect, here's the important things to the institution. Not so much asking for what I needed or statistics. It was very high level, get to know what the information security program is and what it does for the institution. You would want to be at least a little bit comfortable with standing in front of a group of folks and delivering a message. When you're helping create a presentation, there's really two in one. It's a larger presentation, that if you had all the time in the world--the set of slides that you would use, kind of walk through, and give people time to ask questions and be really open with your presentation. And then there's the scenario where you got to cut down to three minutes--that’s maximum two slides. It's really going through those two exercises together, continuously on almost any presentation you do, the long version and the short version. And deciding how you're going to deliver both of those messages. Leadership during crisis The first message is that you want to be [physically] together, because [a data breach] is a serious situation and it's something that most everyone had never imagined could happen. So you want it to be together and at least give people an outlet to say, "Can you believe this happened? How could this happen?" And just give people an outlet as a leader. Number two is just to be calm. Nobody wants to see the leadership running around losing their cool, acting outside of character, and it just doesn't go well. It doesn't give a sense of calm to your staff so that they can deliver you know, the tasks and the activities they need to do to get to the root of the problem and fix the problem. You're always going to have gaps in your program. Yet, always document what the gaps are and certainly document what it would take to fill the gap at a minimal level and then at a perfect level. Always have a plan It doesn’t have to be a three year plan, but it at least has to go 12 to 18 mo