In this episode of The New CISO, Steve is joined by guest Brad Sexton, Chief Information Officer, and Information Security Officer at Terrible’s.After having issues with a Dot Matrix printer, Brad was inspired to transition from a career in education to IT. Through conflict, change, and self-reflection, Brad has become the effective leader he is today. Tune into today’s episode to learn more about Brad’s career journey, the consequences of “ego,” and how to leave a job gracefully.Listen to Steve and Brad discuss how leaders can walk the fine line between confidence and arrogance and the right motives for becoming a leader:Meet Brad (1:44)Host Steve Moore introduces our guest today, Brad Sexton, who started working at Terrible’s in Las Vegas last April.Brad shares that before becoming a CISO, he worked at a boys and girls type club where they all shared one printer. Wanting to be able to print from different areas of the office, Brad took on the task of updating the printer to fit his office’s needs. Brad has been in IT ever since.Next Steps (5:09)Brad reveals the next steps of his career transition. His boss at the education center asked Brad for IT-related help. Brad was then moved into the IT department and used this moment to finish his education.During this time, Brad could see tech from a bigger picture and eventually was designing a forklift upgrade for the theater. He started working with routers and did more and more. By the time Brad settled in Vegas, he could use his experience to manage teams successfully.Checking The Ego (11:13)Steve presses Brad on the lessons he learned from his first IT job. Brad believes that his ego got in the way of his ability to do his job. After many years, Brad finally understood what he could have done differently. Thankfully, his boss knew he had potential and was willing to have a difficult conversation that resonated with him later.The Clues (16:30)Brad explores the clues of a person with an ego problem. In addition, Brad explains that leaders should always create a safe space for their employees to communicate with them.Everyone has strengths and weaknesses, and it’s helpful when leaders can help their employees identify theirs. Ultimately, there is a “fine line between confidence and arrogance,” and leaders must have the confidence to articulate challenging feedback.The Right Motives (25:54)Steve presses Brad on what his motives were for becoming a leader. Brad reflects that he wanted a sphere of influence and recognized that he could make more of a difference in a higher position.Brad suggests always knowing your “why” before approaching leadership roles.The Wrong Fit (29:53)Brad worked in government and realized two things. He was in the wrong place, and they didn’t want them there either. Knowing there was tension from the beginning made Brad’s time in this role very challenging.Brad learned later that this company did not want anyone in that position, but he was the most qualified. Now, Brad understands the importance of finding the right fit for a role and considers that when interviewing future colleagues.Mutual Contact (34:58)Brad and Steve discuss a mutual connection named David, who is an individual who helped Brad move into the casino gaming space. Brad appreciates that David took a chance on him and is still in touch.Relationships are critical as you advance in your career because no one knows everything.Leaving Gracefully (40:04)Brad shares his tips on leaving a job gracefully. He suggests managing the emotion that you let someone down. Having an open communication line with your boss and feeling comfortable articulating your goals makes this process less challenging—the key is to cultivate that relationship before it gets to this point.The New CISO (47:50)To Brad, being a new CISO means understanding your staff and the challenges that they’ve had. You then must build relationships in the business.

In this episode of The New CISO, Steve is joined by guest Brad Sexton, Chief Information Officer, and Information Security Officer at Terrible’s.After having issues with a Dot Matrix printer, Brad was inspired to transition from a career in education to IT. Through conflict, change, and self-reflection, Brad has become the effective leader he is today. Tune into today’s episode to learn more about Brad’s career journey, the consequences of “ego,” and how to leave a job gracefully.Listen to Steve and Brad discuss how leaders can walk the fine line between confidence and arrogance and the right motives for becoming a leader:Meet Brad (1:44)Host Steve Moore introduces our guest today, Brad Sexton, who started working at Terrible’s in Las Vegas last April.Brad shares that before becoming a CISO, he worked at a boys and girls type club where they all shared one printer. Wanting to be able to print from different areas of the office, Brad took on the task of updating the printer to fit his office’s needs. Brad has been in IT ever since.Next Steps (5:09)Brad reveals the next steps of his career transition. His boss at the education center asked Brad for IT-related help. Brad was then moved into the IT department and used this moment to finish his education.During this time, Brad could see tech from a bigger picture and eventually was designing a forklift upgrade for the theater. He started working with routers and did more and more. By the time Brad settled in Vegas, he could use his experience to manage teams successfully.Checking The Ego (11:13)Steve presses Brad on the lessons he learned from his first IT job. Brad believes that his ego got in the way of his ability to do his job. After many years, Brad finally understood what he could have done differently. Thankfully, his boss knew he had potential and was willing to have a difficult conversation that resonated with him later.The Clues (16:30)Brad explores the clues of a person with an ego problem. In addition, Brad explains that leaders should always create a safe space for their employees to communicate with them.Everyone has strengths and weaknesses, and it’s helpful when leaders can help their employees identify theirs. Ultimately, there is a “fine line between confidence and arrogance,” and leaders must have the confidence to articulate challenging feedback.The Right Motives (25:54)Steve presses Brad on what his motives were for becoming a leader. Brad reflects that he wanted a sphere of influence and recognized that he could make more of a difference in a higher position.Brad suggests always knowing your “why” before approaching leadership roles.The Wrong Fit (29:53)Brad worked in government and realized two things. He was in the wrong place, and they didn’t want them there either. Knowing there was tension from the beginning made Brad’s time in this role very challenging.Brad learned later that this company did not want anyone in that position, but he was the most qualified. Now, Brad understands the importance of finding the right fit for a role and considers that when interviewing future colleagues.Mutual Contact (34:58)Brad and Steve discuss a mutual connection named David, who is an individual who helped Brad move into the casino gaming space. Brad appreciates that David took a chance on him and is still in touch.Relationships are critical as you advance in your career because no one knows everything.Leaving Gracefully (40:04)Brad shares his tips on leaving a job gracefully. He suggests managing the emotion that you let someone down. Having an open communication line with your boss and feeling comfortable articulating your goals makes this process less challenging—the key is to cultivate that relationship before it gets to this point.The New CISO (47:50)To Brad, being a new CISO means understanding your staff and the challenges that they’ve had. You then must build relationships in the business.

Confidence or Arrogance? Ego Problems and How to Solve Them

In this episode of The New CISO, Steve is joined by guest Andrew Wilder, Adjunct Professor at Washington University in St. Louis and a multi-time CISO.After eighteen years, Andrew left a job he loved to transition into global security. Now, he gives back to the cybersecurity community by sharing his insight as a professor and mentor. Tune into today’s episode to learn more about his IT journey, expanding your network, and company red flags.Listen to Steve and Andrew discuss his five-step mentorship plan and essential interview guidelines for CISOs:Meet Andrew (1:38)Host Steve Moore introduces our guest today, Andrew Wilder, who has worked in cyber security for twenty years.Andrew got his start in cybersecurity by working at a paper company, where he worked in marketing, sales, inventory, customer service, and more. One day the owner came to him, wanting to change their computer systems. Being the youngest in the office, Andrew was given the project, beginning his IT journey.Eighteen Years (6:23)Andrew reveals why he stayed at Nestle for eighteen years. Andrew loved the people and culture and even met his wife on the job.Steve presses Andrew on why he didn’t stay longer, and Andrew reveals that he progressed as far as he could go. Wanting to move forward in his career, Andrew felt inclined to make the jump.A Difficult Move (8:12)Andrew shares how challenging it was to leave Nestle. Although his co-workers were shocked, Andrew knew going was right for him.If you’re in a similar situation, you may always find something to regret, but no situation is perfect. Ultimately, you have to do what’s best for you.Care About Your Career (11:50)When contemplating a career transition, Andrew recommends finding a mentor. Of course, no one will care for your career for you. You will make time for something and seek the necessary resources if you care about it.The Five-Step Plan (13:59)Andrew shares his five-step plan for changing careers, which includes creating a development plan with your mentor and filling in the gaps in your desired skill set.In addition, Andrew shares a helpful tip he received from Nestle, which is that 70% of your learning should be learning by doing. 20% of learning is through relationships, while 10% should be through a course or learning program.Getting In The Room (20:00)Steve presses Andrew on what steps CISOs should take to get in the room. Andrew recommends ensuring people know who you are and your expertise.If people don’t know you, you’ll never be able to prove yourself. That is the value of expanding your network.What To Ask (24:47)If you’re offered a board-type position, it’s essential to learn about the company culture and the CEO and review any incident reports that allow you to bring your expertise to the position.Interview Questions (28:24)Enterprise risk management is an excellent framework to focus on during an interview. Asking questions based on prior risks will reveal much about an organization, including red flags.Andrew also reveals other red flags to look for in an interview. If companies don’t show change or progress with security, the work culture will be less desirable for a CISO. The worst cyberculture you could join is one where they won’t admit when they’ve experienced a breach.Business Continuity Planning (37:20)Business continuity planning is ignored a lot in cybersecurity because it is business driven. In Andrew’s opinion, cybersecurity should be separate.Andrew and Steve discuss other business dynamics and what should or shouldn’t be the responsibility of the CISO.Why Teaching (41:43)Steve presses Andrew on why he teaches. Andrew likes to think it’s to give back, but he recognizes it’s a two-way street.Andrew teaches deputy CISOS, CIOs, and executives seeking to transition into the CISO role. He has created his own lesson plans from scratch to give security professionals the highest value in their education.The New CISO (47:55)To Andrew, being a new CISO means seeing cyber security as a business enabler. This mindset can include expanding your network and learning what different people in the field do.LinkedInQuote: Well, I'm a strong believer that if we're not constantly learning and growing and progressing, that we will become obsolete. The skills you were using five years ago are not the ones you're using. And the same thing goes for five years from now. [00:50:30] They also talk about the jobs that our kids are gonna have don't exist today. So whenever I have people reporting to me, I dedicate 10% of their time to learning and training, and growing so that they will develop the new skills and be able to take on those n

In this episode of The New CISO, Steve is joined by guest Andrew Wilder, Adjunct Professor at Washington University in St. Louis and a multi-time CISO.After eighteen years, Andrew left a job he loved to transition into global security. Now, he gives back to the cybersecurity community by sharing his insight as a professor and mentor. Tune into today’s episode to learn more about his IT journey, expanding your network, and company red flags.Listen to Steve and Andrew discuss his five-step mentorship plan and essential interview guidelines for CISOs:Meet Andrew (1:38)Host Steve Moore introduces our guest today, Andrew Wilder, who has worked in cyber security for twenty years.Andrew got his start in cybersecurity by working at a paper company, where he worked in marketing, sales, inventory, customer service, and more. One day the owner came to him, wanting to change their computer systems. Being the youngest in the office, Andrew was given the project, beginning his IT journey.Eighteen Years (6:23)Andrew reveals why he stayed at Nestle for eighteen years. Andrew loved the people and culture and even met his wife on the job.Steve presses Andrew on why he didn’t stay longer, and Andrew reveals that he progressed as far as he could go. Wanting to move forward in his career, Andrew felt inclined to make the jump.A Difficult Move (8:12)Andrew shares how challenging it was to leave Nestle. Although his co-workers were shocked, Andrew knew going was right for him.If you’re in a similar situation, you may always find something to regret, but no situation is perfect. Ultimately, you have to do what’s best for you.Care About Your Career (11:50)When contemplating a career transition, Andrew recommends finding a mentor. Of course, no one will care for your career for you. You will make time for something and seek the necessary resources if you care about it.The Five-Step Plan (13:59)Andrew shares his five-step plan for changing careers, which includes creating a development plan with your mentor and filling in the gaps in your desired skill set.In addition, Andrew shares a helpful tip he received from Nestle, which is that 70% of your learning should be learning by doing. 20% of learning is through relationships, while 10% should be through a course or learning program.Getting In The Room (20:00)Steve presses Andrew on what steps CISOs should take to get in the room. Andrew recommends ensuring people know who you are and your expertise.If people don’t know you, you’ll never be able to prove yourself. That is the value of expanding your network.What To Ask (24:47)If you’re offered a board-type position, it’s essential to learn about the company culture and the CEO and review any incident reports that allow you to bring your expertise to the position.Interview Questions (28:24)Enterprise risk management is an excellent framework to focus on during an interview. Asking questions based on prior risks will reveal much about an organization, including red flags.Andrew also reveals other red flags to look for in an interview. If companies don’t show change or progress with security, the work culture will be less desirable for a CISO. The worst cyberculture you could join is one where they won’t admit when they’ve experienced a breach.Business Continuity Planning (37:20)Business continuity planning is ignored a lot in cybersecurity because it is business driven. In Andrew’s opinion, cybersecurity should be separate.Andrew and Steve discuss other business dynamics and what should or shouldn’t be the responsibility of the CISO.Why Teaching (41:43)Steve presses Andrew on why he teaches. Andrew likes to think it’s to give back, but he recognizes it’s a two-way street.Andrew teaches deputy CISOS, CIOs, and executives seeking to transition into the CISO role. He has created his own lesson plans from scratch to give security professionals the highest value in their education.The New CISO (47:55)To Andrew, being a new CISO means seeing cyber security as a business enabler. This mindset can include expanding your network and learning what different people in the field do. <a href="https://www.linkedin.com/in/apwilder/" rel="noopener noreferrer nofollow" target="_blank">LinkedIn</a> Quote: Well, I'm a strong believer that if we're not constantly learning and growing and progressing, that we will become obsolete. The skills you were using five years ago are not the ones you're using. And the same thing goes for five years from now. [00:50:30] They also talk about the jobs that our kids are gonna have don't exist today. So whenever I have people reporting to me, I dedicate 10% of their time to learning and training, and growing so that they will develop the new skills and be able to take on those n

The 70-20-10 Rule: Steps You Can Take for Professional Growth

In this episode of The New CISO, Steve is joined by guest Suid Adeyanju, CEO and Co-Founder of RiverSafe Ltd.Although his parents dreamed of Suid becoming a lawyer or a doctor, Suid had a passion for technology. Although his path was challenging, Suid shares how he successfully transitioned from a security engineer to an entrepreneur. Tune into this week’s episode to learn more about Suid’s early career journey, the mindset differences between engineering and business leadership, and the catalyst for starting his business.Listen to Steve and Suid discuss navigating the corporate ladder and how security professionals can become business leaders:Meet Suid (1:39)Host Steve Moore introduces our guest today, Suid Adeyanju, a security professional and entrepreneur. At RiverSafe Ltd., Suid’s team specializes in cyber security, data operations, and demo. Since childhood, Suid wanted to work in technology. Recently, he found his old yearbook from Nigeria and saw that he wanted to be a computer engineer even then. Even though that goal was unusual then, it demonstrates that Suid always wanted to be in technology.At University (6:24)While at university, Suid initially went for computer science and mathematics. After studying accounting for two years, his professor steered him toward business information systems. As much as Suid loves computers, understanding how organizations deliver their services was a better fit. Think About Impact (10:26)Steve and Suid discuss how security leaders need to consider how their security work impacts the business. If leaders focus on making the business secure, they need to work with the business and understand the risks associated with the work.The Transition (13:40)Suid reflects on his transition from engineer to entrepreneur. As an engineer, Suid saw things in black and white. To run his business, he needed a different mindset because there is a difference between working with people versus computers.Workplace Challenges (20:03)Steve presses Suid on his time at Reuters. After two years of contracting, Suid saw that he was stuck in his role while his teammates gained more responsibility. Initially, Suid believed he needed to work harder and gain his master's in information security. Now, he understands that this mindset is common with ethnic minorities and reflects on the challenges he’s faced. Valuing Yourself (28:55)Suid realized that this particular work environment did not value the additional education he had gained or the extra work he put in. Without another job lined up, Suid decided to quit.Suid could take this risk because he had made good financial decisions, which gave him enough savings to rely on. Suid also had the proper professional skill set, preparing him to take a chance. Starting A Business (34:24)Suid reveals that this time led him to start his own business. Although it’s challenging to transition from engineer to entrepreneur, Suid knew his team was talented and could show value to their customers.The Big Break (38:14)Suid’s company got their big break when a senior manager at a major corruption chose to work with them. This manager took a chance on them with a significant project, which set Suid up for future momentum.Sound Advice (43:43)For the listeners who feel that the corporate world is not for them, Suid shares his advice. First, take a course that teaches how to set up a business. Secondly, find a mentor who can share with you valuable insight.The New Security Leader (47:21)To Suid, a new leader focuses on people. One must have empathy and the mentality that leaders are meant to serve.Links mentioned:LinkedIn

In this episode of The New CISO, Steve is joined by guest Suid Adeyanju, CEO and Co-Founder of RiverSafe Ltd.Although his parents dreamed of Suid becoming a lawyer or a doctor, Suid had a passion for technology. Although his path was challenging, Suid shares how he successfully transitioned from a security engineer to an entrepreneur. Tune into this week’s episode to learn more about Suid’s early career journey, the mindset differences between engineering and business leadership, and the catalyst for starting his business.Listen to Steve and Suid discuss navigating the corporate ladder and how security professionals can become business leaders:Meet Suid (1:39)Host Steve Moore introduces our guest today, Suid Adeyanju, a security professional and entrepreneur. At RiverSafe Ltd., Suid’s team specializes in cyber security, data operations, and demo. Since childhood, Suid wanted to work in technology. Recently, he found his old yearbook from Nigeria and saw that he wanted to be a computer engineer even then. Even though that goal was unusual then, it demonstrates that Suid always wanted to be in technology.At University (6:24)While at university, Suid initially went for computer science and mathematics. After studying accounting for two years, his professor steered him toward business information systems. As much as Suid loves computers, understanding how organizations deliver their services was a better fit. Think About Impact (10:26)Steve and Suid discuss how security leaders need to consider how their security work impacts the business. If leaders focus on making the business secure, they need to work with the business and understand the risks associated with the work.The Transition (13:40)Suid reflects on his transition from engineer to entrepreneur. As an engineer, Suid saw things in black and white. To run his business, he needed a different mindset because there is a difference between working with people versus computers.Workplace Challenges (20:03)Steve presses Suid on his time at Reuters. After two years of contracting, Suid saw that he was stuck in his role while his teammates gained more responsibility. Initially, Suid believed he needed to work harder and gain his master's in information security. Now, he understands that this mindset is common with ethnic minorities and reflects on the challenges he’s faced. Valuing Yourself (28:55)Suid realized that this particular work environment did not value the additional education he had gained or the extra work he put in. Without another job lined up, Suid decided to quit.Suid could take this risk because he had made good financial decisions, which gave him enough savings to rely on. Suid also had the proper professional skill set, preparing him to take a chance. Starting A Business (34:24)Suid reveals that this time led him to start his own business. Although it’s challenging to transition from engineer to entrepreneur, Suid knew his team was talented and could show value to their customers.The Big Break (38:14)Suid’s company got their big break when a senior manager at a major corruption chose to work with them. This manager took a chance on them with a significant project, which set Suid up for future momentum.Sound Advice (43:43)For the listeners who feel that the corporate world is not for them, Suid shares his advice. First, take a course that teaches how to set up a business. Secondly, find a mentor who can share with you valuable insight.The New Security Leader (47:21)To Suid, a new leader focuses on people. One must have empathy and the mentality that leaders are meant to serve.Links mentioned: <a href="https://www.linkedin.com/in/suid-adeyanju-1961959/?originalSubdomain=uk" rel="noopener noreferrer nofollow" target="_blank">LinkedIn</a>

Security Engineer to CEO: Taking a Chance on Yourself

In this episode of The New CISO, Steve is joined by guest Jeff Schilling, Global CISO for Teleperformance.Jeff returns to discuss a pressing issue for CISOs: Insider threats. With credentialed attacks on the rise, Jeff shares his take on the “flattening” of this evolving threat. Tune into today’s episode to learn more about the ABCs of bad actors, how Covid has contributed to the problem and complex recruiting scams.Listen to Steve and Jeff discuss which strategies are being employed to comprise employees’ credentials:The Return Of Jeff (1:42)Host Steve Moore introduces our returning guest today, Jeff Schilling of Teleperformance.Steve reveals this is Jeff's third time on the podcast. Unlike other episodes, where guests discuss their career journeys, Jeff is here to share necessary research regarding insider threats.The Problem (4:24)Jeff explores the fundamental issue of insider threats. He reveals the different levels of the skill pyramid that threat actors can be evaluated at. The “A” actors become insiders to exploit specific targets, which should be considered when creating a security system.The Flattening (12:46)Steve presses Jeff on what he means by “flattening techniques” that have led to our current state of attacks. Jeff explains how malware software and targeted phishing scams have been used to access their mark, an issue exasperated by remote work.Adversaries and Targets (19:54)Jeff explains how to communicate threat issues across departments, especially when there are language barriers. The biggest challenge is making messaging as simple as possible.Depending on the job functions of others, there are different responses and success results. This is why Jeff’s team focuses on training and additional monitoring and security control.More Tactics (23:28)There are many strategies that threat actors use to breach one’s security. Bad actors target companies through social media, such as Linkedin.Threat actors also learn about their target countries and reach out to them through more region-specific platforms. Jeff then asserted that insider threats must be part of every CISO’s security plan. Preventative Steps (31:42)Jeff assures us that there are things we can do to detect threats and explains those actions. Identifying the machine where phishing emails come from and implementing new technologies is key.The Near Future (35:50)With the evolving functions of AI, it may be easier for threat actors to be more convincing in their scams. Their messaging is getting more believable, which is why Jeff believes they are taking advantage of new technologies, despite there being safeguards.However, Jeff is not convinced that certain aspects of AI, like voice mimicking, will get more sophisticated. The New CISO (39:42)To Jeff, being a new CISO is constantly learning and having your finger on the pulse. If you think you know everything, it is likely you do not.Links mentioned:LinkedInQuote:“I used to say multifactor authentication at the edge was a big barrier for the threat actor to get over. That's no longer, I can't say that anymore. It's more like a small fence. And now, you got to look at how do you manage your privileges and how do you conduct IT operations inside of your wire, and how would a threat do it if they were an insider? And then what controls do you have to be able to detect that activity because they're going to be using IT tools, and they're going to look like they're coming in with a legitimate account.”

In this episode of The New CISO, Steve is joined by guest Jeff Schilling, Global CISO for Teleperformance.Jeff returns to discuss a pressing issue for CISOs: Insider threats. With credentialed attacks on the rise, Jeff shares his take on the “flattening” of this evolving threat. Tune into today’s episode to learn more about the ABCs of bad actors, how Covid has contributed to the problem and complex recruiting scams.Listen to Steve and Jeff discuss which strategies are being employed to comprise employees’ credentials:The Return Of Jeff (1:42)Host Steve Moore introduces our returning guest today, Jeff Schilling of Teleperformance.Steve reveals this is Jeff's third time on the podcast. Unlike other episodes, where guests discuss their career journeys, Jeff is here to share necessary research regarding insider threats.The Problem (4:24)Jeff explores the fundamental issue of insider threats. He reveals the different levels of the skill pyramid that threat actors can be evaluated at. The “A” actors become insiders to exploit specific targets, which should be considered when creating a security system.The Flattening (12:46)Steve presses Jeff on what he means by “flattening techniques” that have led to our current state of attacks. Jeff explains how malware software and targeted phishing scams have been used to access their mark, an issue exasperated by remote work.Adversaries and Targets (19:54)Jeff explains how to communicate threat issues across departments, especially when there are language barriers. The biggest challenge is making messaging as simple as possible.Depending on the job functions of others, there are different responses and success results. This is why Jeff’s team focuses on training and additional monitoring and security control.More Tactics (23:28)There are many strategies that threat actors use to breach one’s security. Bad actors target companies through social media, such as Linkedin.Threat actors also learn about their target countries and reach out to them through more region-specific platforms. Jeff then asserted that insider threats must be part of every CISO’s security plan. Preventative Steps (31:42)Jeff assures us that there are things we can do to detect threats and explains those actions. Identifying the machine where phishing emails come from and implementing new technologies is key.The Near Future (35:50)With the evolving functions of AI, it may be easier for threat actors to be more convincing in their scams. Their messaging is getting more believable, which is why Jeff believes they are taking advantage of new technologies, despite there being safeguards.However, Jeff is not convinced that certain aspects of AI, like voice mimicking, will get more sophisticated. The New CISO (39:42)To Jeff, being a new CISO is constantly learning and having your finger on the pulse. If you think you know everything, it is likely you do not.Links mentioned:<a href="https://www.linkedin.com/in/jefferyschilling/" rel="noopener noreferrer nofollow" target="_blank">LinkedIn</a>Quote:“I used to say multifactor authentication at the edge was a big barrier for the threat actor to get over. That's no longer, I can't say that anymore. It's more like a small fence. And now, you got to look at how do you manage your privileges and how do you conduct IT operations inside of your wire, and how would a threat do it if they were an insider? And then what controls do you have to be able to detect that activity because they're going to be using IT tools, and they're going to look like they're coming in with a legitimate account.”

The ABCs of Threat Actors: How to Stop Attackers From Becoming Insiders

In this episode of The New CISO, Steve is joined by guest Chris Nolke, multi-time CISO, and founder of Skycrane.Chris had decades of cybersecurity experience before starting his own company. As a neurodivergent leader and life-long learner, Chris navigates the workplace with self-reflection and candor. Tune into today’s episode to learn more about Chris’ professional journey, his human approach to leadership, and his definition of happiness.Listen to Steve and Chris discuss the values that drive career decisions and how vulnerability can serve or harm you in the workplace:Meet Chris (1:41)Host Steve Moore introduces our guest today, Chris Nolke, the founder of Skycrane.Chris first started his cybersecurity journey while studying electrical engineering in college. From there, he got a job as an engineer, which eventually led him to his current path. As a life-longer learner, Chris followed the most interesting path to him: cyber security.Defining The Interesting Path (8:36)Chris wishes he had done a “values” exercise earlier in his career to determine his professional wants. He advises other people joining the workforce to consider a process where they discover what they believe in.When you understand your values, you can make more straightforward choices toward your career.Evaluating Jobs (10:59)Chris admits that every job he’s taken has been different than he initially believed. In those circumstances, it’s essential to determine your desire to stay in that position or pivot.Personal Characteristics (14:40)Steve presses Chris on what three bullet points his colleagues would list for him. Chris states that vulnerability, being a conversationalist, and expertise have become his brand in the workplace, which has made him successful.Going Further By Saying Less (25:16)Chris shares that many people who practice impulsive communication use that as a means of connection. Reflecting on this, Chris acknowledges the difference between impact and attention.After trial and error, Chris learned he would go further in his career if he said less.Sound Advice  (30:31)For leaders, Chris shares that neurodiversity is a superpower. If you can harness the pattern-recognizing skills of neurodivergent employees, you can build an incredible security team.To understand how to use this superpower, Chris recommends leaders have mindful conversations with their employees. People need to learn what they’re good at to get ahead.The Subject of Happiness (40:06)As a CISO, Chris is fascinated by the construct of happiness and what comes with it. Happiness is made up of joy but also contentment. Balancing between the two is the key to understanding and taking advantage of this construct.Chris recommends that every CISO creates a “happiness” process to avoid burnout, though burnout led Chris to start his own business.The New CISO (49:10)To Chris, being a new CISO is about creating a system of business relevance. You can improve your job when you understand the business's daily needs.Links mentioned:LinkedIn

In this episode of The New CISO, Steve is joined by guest Chris Nolke, multi-time CISO, and founder of Skycrane.Chris had decades of cybersecurity experience before starting his own company. As a neurodivergent leader and life-long learner, Chris navigates the workplace with self-reflection and candor. Tune into today’s episode to learn more about Chris’ professional journey, his human approach to leadership, and his definition of happiness.Listen to Steve and Chris discuss the values that drive career decisions and how vulnerability can serve or harm you in the workplace:Meet Chris (1:41)Host Steve Moore introduces our guest today, Chris Nolke, the founder of Skycrane.Chris first started his cybersecurity journey while studying electrical engineering in college. From there, he got a job as an engineer, which eventually led him to his current path. As a life-longer learner, Chris followed the most interesting path to him: cyber security.Defining The Interesting Path (8:36)Chris wishes he had done a “values” exercise earlier in his career to determine his professional wants. He advises other people joining the workforce to consider a process where they discover what they believe in.When you understand your values, you can make more straightforward choices toward your career.Evaluating Jobs (10:59)Chris admits that every job he’s taken has been different than he initially believed. In those circumstances, it’s essential to determine your desire to stay in that position or pivot.Personal Characteristics (14:40)Steve presses Chris on what three bullet points his colleagues would list for him. Chris states that vulnerability, being a conversationalist, and expertise have become his brand in the workplace, which has made him successful.Going Further By Saying Less (25:16)Chris shares that many people who practice impulsive communication use that as a means of connection. Reflecting on this, Chris acknowledges the difference between impact and attention.After trial and error, Chris learned he would go further in his career if he said less.Sound Advice (30:31)For leaders, Chris shares that neurodiversity is a superpower. If you can harness the pattern-recognizing skills of neurodivergent employees, you can build an incredible security team.To understand how to use this superpower, Chris recommends leaders have mindful conversations with their employees. People need to learn what they’re good at to get ahead.The Subject of Happiness (40:06)As a CISO, Chris is fascinated by the construct of happiness and what comes with it. Happiness is made up of joy but also contentment. Balancing between the two is the key to understanding and taking advantage of this construct.Chris recommends that every CISO creates a “happiness” process to avoid burnout, though burnout led Chris to start his own business.The New CISO (49:10)To Chris, being a new CISO is about creating a system of business relevance. You can improve your job when you understand the business's daily needs.Links mentioned: <a href="https://www.linkedin.com/in/chris-nolke/" rel="noopener noreferrer nofollow" target="_blank">LinkedIn</a>

Great Minds Think Differently: Neurodiversity and Vulnerability in Leadership

In this episode of The New CISO, Steve is joined by guest Peter Frochtenicht, National Manager for Security and Compliance and CISO at NEC Australia.A technician by nature, Peter has decades of experience across multiple countries. Today, he joins the podcast to discuss the complexities of AI and the benefits of time-saving tools. Tune into today’s episode to learn more about Peter’s technical journey, the most common security threats, and his advice for new CISOs.Listen to Steve and Peter discuss why automation is a critical component of security tools and how the threat landscape has changed globally:Meet Peter (1:36)Host Steve Moore introduces our guest today, Peter Frochtenicht, who has worked at NEC for nine years.Before NEC, Peter started his career as a systems engineer twenty years ago. Peter has worked in Africa and Australia and has worked his way up through different organizations.Catching Up (5:21)Ten years ago, the CISO role in Australia would be rare. Steve presses Peter as to why.Since the Australian population is smaller than the states with fewer big-name organizations, it took Australia longer to catch up in the security industry.Australia’s Biggest Threats (9:37)From a defense perspective, Australia is doing much business with the states, especially with submarines. From a threat perspective, they border China and some of the eastern countries, which makes a security threat from those countries more imminent.Increased Attacks (13:17)The most typical security attack that Peter witnesses is phishing, which affects organizations and citizens. According to Peter, it is human nature to be curious about and click on an email link. For outside threats, financial benefits and access to information are to be gained.AI has also advanced quickly, which can contribute to increased threats since you can mimic someone's voice. Organizations should be prepared to use AI for good but also be prepared for when there are more insidious reasons for using this new technology.The Benefits of AI (18:05)Steve presses Peter on what defense benefits he predicts will come from AI.Peter shares the automation tools his team uses that help reduce his analysts' headcount and save time. Chat GPT may help you personally, but Peter believes in partnering with known vendors that can help limit human error.What To Look For  (21:11)Peter shares what CISOs should or should not look for when choosing AI tools. Analytic tools are standard and can save much time and effort. As a result, organizations can save money and trust that there will be an increase in accuracy.If tools can help CISOs detect abnormalities with less effort, that would be of service. Of course, abnormal actions may not be malicious but could be a mistake by a well-meaning person. Investing In Employees (28:32)Peter believes in training his people to bring the best out of them. People don’t always have the right skills at the right time, but you build a strong team when you invest in your employees and their relationship with your vendors. Adding Skillsets (31:05)Steve asks Peter what skillsets he had to add, besides technical abilities, to perform his role. Peter discusses his career journey, including his transition into leadership.Peter had to gain a governance mindset and consider policies and when to update said policies. It’s challenging to ask for money to pursue your endeavors, but if you have a budget, you must spend it.Sound Advice (38:56)Looking up back at his career, Peter wouldn’t change much. But Peter recommends getting training and certifications to keep yourself up to date. You don’t need to wait for your company to suggest it to take on a new challenge.The New CISO (42:41)To Peter, being a new CISO means supporting the business and business structure. The biggest challenge for a CISO is adapting fast to new security changes while asking for money as needed.Links mentioned:LinkedIn

In this episode of The New CISO, Steve is joined by guest Peter Frochtenicht, National Manager for Security and Compliance and CISO at NEC Australia.A technician by nature, Peter has decades of experience across multiple countries. Today, he joins the podcast to discuss the complexities of AI and the benefits of time-saving tools. Tune into today’s episode to learn more about Peter’s technical journey, the most common security threats, and his advice for new CISOs.Listen to Steve and Peter discuss why automation is a critical component of security tools and how the threat landscape has changed globally:Meet Peter (1:36)Host Steve Moore introduces our guest today, Peter Frochtenicht, who has worked at NEC for nine years.Before NEC, Peter started his career as a systems engineer twenty years ago. Peter has worked in Africa and Australia and has worked his way up through different organizations.Catching Up (5:21)Ten years ago, the CISO role in Australia would be rare. Steve presses Peter as to why.Since the Australian population is smaller than the states with fewer big-name organizations, it took Australia longer to catch up in the security industry.Australia’s Biggest Threats (9:37)From a defense perspective, Australia is doing much business with the states, especially with submarines. From a threat perspective, they border China and some of the eastern countries, which makes a security threat from those countries more imminent.Increased Attacks (13:17)The most typical security attack that Peter witnesses is phishing, which affects organizations and citizens. According to Peter, it is human nature to be curious about and click on an email link. For outside threats, financial benefits and access to information are to be gained.AI has also advanced quickly, which can contribute to increased threats since you can mimic someone's voice. Organizations should be prepared to use AI for good but also be prepared for when there are more insidious reasons for using this new technology.The Benefits of AI (18:05)Steve presses Peter on what defense benefits he predicts will come from AI.Peter shares the automation tools his team uses that help reduce his analysts' headcount and save time. Chat GPT may help you personally, but Peter believes in partnering with known vendors that can help limit human error.What To Look For (21:11)Peter shares what CISOs should or should not look for when choosing AI tools. Analytic tools are standard and can save much time and effort. As a result, organizations can save money and trust that there will be an increase in accuracy.If tools can help CISOs detect abnormalities with less effort, that would be of service. Of course, abnormal actions may not be malicious but could be a mistake by a well-meaning person. Investing In Employees (28:32)Peter believes in training his people to bring the best out of them. People don’t always have the right skills at the right time, but you build a strong team when you invest in your employees and their relationship with your vendors. Adding Skillsets (31:05)Steve asks Peter what skillsets he had to add, besides technical abilities, to perform his role. Peter discusses his career journey, including his transition into leadership.Peter had to gain a governance mindset and consider policies and when to update said policies. It’s challenging to ask for money to pursue your endeavors, but if you have a budget, you must spend it.Sound Advice (38:56)Looking up back at his career, Peter wouldn’t change much. But Peter recommends getting training and certifications to keep yourself up to date. You don’t need to wait for your company to suggest it to take on a new challenge.The New CISO (42:41)To Peter, being a new CISO means supporting the business and business structure. The biggest challenge for a CISO is adapting fast to new security changes while asking for money as needed.Links mentioned:<a href="https://www.linkedin.com/in/peter-fr%C3%B6chtenicht-149a709/?originalSubdomain=au" rel="noopener noreferrer nofollow" target="_blank">LinkedIn</a>

The Power of Automation: Which Tools Can Help Your Security Team?

In this episode of The New CISO, Steve is joined by guest Michael Meis, Associate CISO of the University of Kansas Health System.Beginning his career in the U.S. Army Signal Corp, Michael eventually transitioned into government consulting and the private sector. Today, he shares his philosophies on leadership and ownership in the cybersecurity field. Listen to the episode to learn more about his extensive technology background, the importance of inter-department friendships, and how he helps fellow service members make their professional transitions.Listen to Steve and Adam discuss how to navigate bureaucracy and adapt to corporate environments:Meet Michael (1:41)Host Steve Moore introduces our guest today, Michael Meis. Michael has been in IT and security for fifteen years and healthcare for two years. Michael met Steve a year ago during a security conference, leading to their connecting around the industry and their philosophies on leadership.Michael also reflects on his role in the military, which began with him working with radios and evolved into performing general technology support.Getting His Start (6:09)Michael was always interested in computers but initially never saw it as a career. He decided to join the military instead. However, his military recruiter encouraged him to take a tech-related job, and his security journey began. This first army signal corps job was less computer-heavy than expected, but Michael still learned a lot.Dealing With Corporate Politics (9:07)For ten years, Michael worked as a government consultant. This experience taught Michael to navigate complex bureaucratic dynamics to get past red tape.Michael highlights the importance of having solid relationships in different departments to get things done. You can determine which workplace rules to bend when you understand how things are and how your organization operates. Finding a Path (14:01)Michael expands on the importance of relationships in a corporate setting. You can leverage those relationships when needed to promote your department’s agendas.The more you understand your organization’s rules and politics, the less friction you will face, and the more you can build a trusted security culture. Government Challenges (22:44)Steve presses Michael on his quote, “Governance is important, but alone won’t solve all of your problems.”Anyone who has worked in government understands that there are always challenges within its IT environments. Since the government has total control over its IT, Michael learned early on that more than governance is needed to perfect these systems. Collaboration is needed between parties.Excuses, Excuses (28:13)Michael shares the security community’s common excuses that tend to irk him. Budget professionals can be challenging to work with from a leadership perspective. He also gets frustrated when people use a lack of training as a reason not to try something. Michael values training, but he understands that sometimes you have to take action before that formal training comes.Behavioral Norms (33:50)Michael explores the behavioral norms that came out of his military service.Learning how to function in a corporate environment is essential for people to know when leaving the military. The benefits of this experience were the rigor and structure, which can provide direction in life. On the flip side, it can be challenging to transition from that structure because you can grow dependent on it.Helping Others (39:07)As a leader, Michael tries to help other service members remove their need for a manual when making corporate transitions. That way, they can learn to embrace their creativity, benefiting their long-term careers.Ultimately, Michael aims to empower his teams and shift their professional mindsets.The New CISO (47:27)To Michael, being a new CISO means recognizing that they are not just security practitioners but business executives. The more security evolves as an industry, the more CISOs can adapt to these modern changes.Links mentioned:LinkedIn

In this episode of The New CISO, Steve is joined by guest Michael Meis, Associate CISO of the University of Kansas Health System.Beginning his career in the U.S. Army Signal Corp, Michael eventually transitioned into government consulting and the private sector. Today, he shares his philosophies on leadership and ownership in the cybersecurity field. Listen to the episode to learn more about his extensive technology background, the importance of inter-department friendships, and how he helps fellow service members make their professional transitions.Listen to Steve and Adam discuss how to navigate bureaucracy and adapt to corporate environments:Meet Michael (1:41)Host Steve Moore introduces our guest today, Michael Meis. Michael has been in IT and security for fifteen years and healthcare for two years. Michael met Steve a year ago during a security conference, leading to their connecting around the industry and their philosophies on leadership.Michael also reflects on his role in the military, which began with him working with radios and evolved into performing general technology support.Getting His Start (6:09)Michael was always interested in computers but initially never saw it as a career. He decided to join the military instead. However, his military recruiter encouraged him to take a tech-related job, and his security journey began. This first army signal corps job was less computer-heavy than expected, but Michael still learned a lot.Dealing With Corporate Politics (9:07)For ten years, Michael worked as a government consultant. This experience taught Michael to navigate complex bureaucratic dynamics to get past red tape.Michael highlights the importance of having solid relationships in different departments to get things done. You can determine which workplace rules to bend when you understand how things are and how your organization operates. Finding a Path (14:01)Michael expands on the importance of relationships in a corporate setting. You can leverage those relationships when needed to promote your department’s agendas.The more you understand your organization’s rules and politics, the less friction you will face, and the more you can build a trusted security culture. Government Challenges (22:44)Steve presses Michael on his quote, “Governance is important, but alone won’t solve all of your problems.”Anyone who has worked in government understands that there are always challenges within its IT environments. Since the government has total control over its IT, Michael learned early on that more than governance is needed to perfect these systems. Collaboration is needed between parties.Excuses, Excuses (28:13)Michael shares the security community’s common excuses that tend to irk him. Budget professionals can be challenging to work with from a leadership perspective. He also gets frustrated when people use a lack of training as a reason not to try something. Michael values training, but he understands that sometimes you have to take action before that formal training comes.Behavioral Norms (33:50)Michael explores the behavioral norms that came out of his military service.Learning how to function in a corporate environment is essential for people to know when leaving the military. The benefits of this experience were the rigor and structure, which can provide direction in life. On the flip side, it can be challenging to transition from that structure because you can grow dependent on it.Helping Others (39:07)As a leader, Michael tries to help other service members remove their need for a manual when making corporate transitions. That way, they can learn to embrace their creativity, benefiting their long-term careers.Ultimately, Michael aims to empower his teams and shift their professional mindsets.The New CISO (47:27)To Michael, being a new CISO means recognizing that they are not just security practitioners but business executives. The more security evolves as an industry, the more CISOs can adapt to these modern changes.Links mentioned: <a href="https://www.linkedin.com/in/michaelmeis/" rel="noopener noreferrer nofollow" target="_blank">LinkedIn</a>

Taking Extreme Ownership: How 3 Common Excuses Hurt Security Leaders

In this episode of The New CISO, Steve is joined by guest Adam Currie, CSO at HCL Software.Adam started his career 27 years ago, working the night shift as a main frame operator before working his way up in the security world. Today, he shares how he builds trust within his team, company, and himself. Listen to the episode to learn more about his expansive career journey, when to encourage your team, and dealing with imposter syndrome.Listen to Steve and Adam discuss the right time to challenge yourself and when leaders should foster an environment where it is safe to fail:Meet Adam (1:38)Host Steve Moore introduces our guest today, Adam Currie.Adam was first the head of security operations and architecture at HCL before transitioning into the CSO role. When Adam joined HCL, he brought his breadth of technical knowledge and understanding of how their user base consumed their tools. In this business, it's essential to understand how these programs are used while ensuring they are secure, a mentality that helped Adam move into the CSO position.The Main Framer (4:41)Steve asks Adam about his experience on the main frame.When Adam was a student, he worked as a tape librarian. This after-school job led to him taking classes and learning about mainframe operations and basic coding language. Desktop Support (8:26)Adam believes that having a desktop support background benefits security professionals because it provides an understanding of how end users operate. Communicating with this community with empathy adds significant value to any security team.Unexpected Steps: CISO to Soc to CISO (12:38)Adam did end-user support work at Bloomberg before moving into backend enterprise applications. Then he was asked to run Bloomberg's tier one and tier two service desks, a type of work Adam did not plan on returning to. However, this opportunity offered Adam his first management role, and he credits this position as getting him to where he is today.Building Trust With Your Team(20:05)Upon reflecting on his job journey at Bloomberg, Adam shares why people seek new opportunities.When people leave positions or accept roles, it is for job growth. Most people want to consider how a job will help their families and goals before making a career transition. Adam would rather help his team explore their options than subdue it–though no one wants to lose valuable employees. He wants his team to trust him enough to be honest with him about when they want to make a change.A Challenge (25:21)For Adam, it is always a struggle to stay out of the weeds of the tech side of the business. He gravitates toward technology but understands that that is different from his role now. For leaders, it is more important to nurture an environment where employees are safe to fail because that is how people learn and grow. You shouldn't be reckless, but being inactive is more risky.Owning Failure (29:02)Steve presses Adam on how far he will go to own his team's failures. Adam thinks it is his job to communicate with senior management and shield his team from scrutiny.No matter what, we must be honest about what we can do to improve and have productive, unemotional conversations.Building a Brand (36:13)Building a brand comes with trial and error but is critical to success. Often this comes with changing the perception that security is a necessary evil. Demonstrating that security is a value-add partnership that leaders actively want to engage in is essential.Putting Yourself Out There (47:54)Though Adam is not a fan of public speaking, he believes in pushing himself past his comfort zone. Although he has experienced imposter syndrome about his experience, he is putting himself out there as a  podcast guest today to share his career journey.The New CISO (54:23)To Adam, a new CISO establishes a strong team and establishes trust within the business and with your peers. Trust is necessary to claim success.Links mentioned:LinkedInBio:A proprietor of service excellence and incubator of change, operating at the intersection of people, processes, and technology with 26 years' experience successfully partnering with business leaders to build strategies aligning to corporate and client needs, resulting in realization of value-add with a holistic approach to business, technology, and security.

In this episode of The New CISO, Steve is joined by guest Adam Currie, CSO at HCL Software.Adam started his career 27 years ago, working the night shift as a main frame operator before working his way up in the security world. Today, he shares how he builds trust within his team, company, and himself. Listen to the episode to learn more about his expansive career journey, when to encourage your team, and dealing with imposter syndrome.Listen to Steve and Adam discuss the right time to challenge yourself and when leaders should foster an environment where it is safe to fail:Meet Adam (1:38)Host Steve Moore introduces our guest today, Adam Currie.Adam was first the head of security operations and architecture at HCL before transitioning into the CSO role. When Adam joined HCL, he brought his breadth of technical knowledge and understanding of how their user base consumed their tools. In this business, it's essential to understand how these programs are used while ensuring they are secure, a mentality that helped Adam move into the CSO position.The Main Framer (4:41)Steve asks Adam about his experience on the main frame.When Adam was a student, he worked as a tape librarian. This after-school job led to him taking classes and learning about mainframe operations and basic coding language. Desktop Support (8:26)Adam believes that having a desktop support background benefits security professionals because it provides an understanding of how end users operate. Communicating with this community with empathy adds significant value to any security team.Unexpected Steps: CISO to Soc to CISO (12:38)Adam did end-user support work at Bloomberg before moving into backend enterprise applications. Then he was asked to run Bloomberg's tier one and tier two service desks, a type of work Adam did not plan on returning to. However, this opportunity offered Adam his first management role, and he credits this position as getting him to where he is today.Building Trust With Your Team(20:05)Upon reflecting on his job journey at Bloomberg, Adam shares why people seek new opportunities.When people leave positions or accept roles, it is for job growth. Most people want to consider how a job will help their families and goals before making a career transition. Adam would rather help his team explore their options than subdue it–though no one wants to lose valuable employees. He wants his team to trust him enough to be honest with him about when they want to make a change.A Challenge (25:21)For Adam, it is always a struggle to stay out of the weeds of the tech side of the business. He gravitates toward technology but understands that that is different from his role now. For leaders, it is more important to nurture an environment where employees are safe to fail because that is how people learn and grow. You shouldn't be reckless, but being inactive is more risky.Owning Failure (29:02)Steve presses Adam on how far he will go to own his team's failures. Adam thinks it is his job to communicate with senior management and shield his team from scrutiny.No matter what, we must be honest about what we can do to improve and have productive, unemotional conversations.Building a Brand (36:13)Building a brand comes with trial and error but is critical to success. Often this comes with changing the perception that security is a necessary evil. Demonstrating that security is a value-add partnership that leaders actively want to engage in is essential.Putting Yourself Out There (47:54)Though Adam is not a fan of public speaking, he believes in pushing himself past his comfort zone. Although he has experienced imposter syndrome about his experience, he is putting himself out there as a  podcast guest today to share his career journey.The New CISO (54:23)To Adam, a new CISO establishes a strong team and establishes trust within the business and with your peers. Trust is necessary to claim success.Links mentioned:<a href="https://www.linkedin.com/in/adam-m-currie/" rel="noopener noreferrer nofollow" target="_blank">LinkedIn</a>Bio:A proprietor of service excellence and incubator of change, operating at the intersection of people, processes, and technology with 26 years' experience successfully partnering with business leaders to build strategies aligning to corporate and client needs, resulting in realization of value-add with a holistic approach to business, technology, and security.

How To Build Trust Within Your Team, Your Business, and Yourself

In this episode of The New CISO, Steve is joined by guest Mike Kelley, CISO of the E.W. Scripps Company.Mike worked as an auditor before eventually jumping into cyber security. Reflecting on his past, Mike shares how balancing ambition with transparency is critical to success. Listen to the episode to learn more about Mike’s auditing experience, falling into cyber security, and his advice for CISOs when interviewing.Listen to Steve and Mike discuss how leaders should assist their team with career development and why “fake it until you make it” makes for bad career advice:Meet Mike (1:44)Host Steve Moore introduces our guest today, Mike Kelley.Mike shares his role in the enterprise and consumer-based security field and how his duties differ from those in an internal security environment. Although he would say that consumer-based security is not clearly defined, his goal is to keep all things related to the consumer secure, in addition to the typical CISO goals.His Start (3:36)Before working at E.W. Scripps, Mike worked at KPMG, one of the big four firms. There, Mike performed external audits but also did some compliance consulting as well.Although no one wanted an auditor there, especially to answer his questions, Mike had to work on building a rapport with people in difficult situations. Through this role, Mike was exposed to numerous companies, allowing him to learn constantly. He may not have wanted to start in audits if he could do it all again, but this experience prepared him for his cyber security career.Adapting With Transparency (9:02)Mike has become comfortable with being uncomfortable and transparent when he doesn’t know something. When he got his CISO job, he told HR that this position was new to him and that he had a lot to learn. Being confident enough to say “I don’t know” is Mike’s mental motto because he knows he can adapt to new challenges. Ultimately anything is learnable as long as you push yourself, a mentality he encourages in his team.The Burn the Boats Method (17:42)After reflecting on his career decisions, including telling a company to fire him if he didn’t succeed as a director, Steve presses Mike on how he would react to someone sharing this approach.If one of Mike’s employees wanted to try a position out and see what happens, Mike would like to ease them into that role. He would let them transition through responsibilities first before changing that person’s title. Ultimately, trying and failing is okay, but Mike wants his team to fail soft versus hard.Falling Into Cyber Security (21:42)After looking for cyber security jobs for three years, Mike eased into this field through a position in compliance. Working side-by-side with security professionals, Mike was able to dip his toes.After lunch with his manager, he was offered the CISO role, and Mike immediately said yes. Mike admitted he didn’t know what he was doing but was encouraged to take this job.Rolling With It (25:01)Steve asks Mike if he ever wishes he said no when offered the CISO job. Mike knew this was the field he wanted to pursue, and he felt comfortable being transparent about his experience.Interview Questions (31:18)If you are a new CISO wanting to ask good questions in an interview, Mike suggests asking the purpose of that role at that company. Another helpful question concerns the company’s approach to trying new things and handling challenges.The Definition of Success (34:13)When evaluating a company during an interview, it’s essential to find out what that company’s definition of success is. Mike defines success as being aligned with the business that employs you and being seen beyond the security status.The Important People (36:50)If you don’t know where to start when beginning a new position, Mike suggests finding out who has influence in the organization and who delivers results.Once you know who those people are, you can nurture those relationships and get their input about the initiatives you want to implement. Bad Advice (42:21)The worst advice Mike received was “fake until you make it.” Although that approach may have good intentions, it is better to be transparent about your abilities. A quick way to imposter syndrome is to fake it. When you have humility, more people are inspired to help you toward your career goals.The New CISO (44:04)To Mike, a new CISO is having input in your organization’s strategic direction and getting an opportunity to take that to the next level. Having a leadership position is how he defines a successful CISO.Links mentioned:LinkedIn

In this episode of The New CISO, Steve is joined by guest Mike Kelley, CISO of the E.W. Scripps Company.Mike worked as an auditor before eventually jumping into cyber security. Reflecting on his past, Mike shares how balancing ambition with transparency is critical to success. Listen to the episode to learn more about Mike’s auditing experience, falling into cyber security, and his advice for CISOs when interviewing.Listen to Steve and Mike discuss how leaders should assist their team with career development and why “fake it until you make it” makes for bad career advice:Meet Mike (1:44)Host Steve Moore introduces our guest today, Mike Kelley.Mike shares his role in the enterprise and consumer-based security field and how his duties differ from those in an internal security environment. Although he would say that consumer-based security is not clearly defined, his goal is to keep all things related to the consumer secure, in addition to the typical CISO goals.His Start (3:36)Before working at E.W. Scripps, Mike worked at KPMG, one of the big four firms. There, Mike performed external audits but also did some compliance consulting as well.Although no one wanted an auditor there, especially to answer his questions, Mike had to work on building a rapport with people in difficult situations. Through this role, Mike was exposed to numerous companies, allowing him to learn constantly. He may not have wanted to start in audits if he could do it all again, but this experience prepared him for his cyber security career.Adapting With Transparency (9:02)Mike has become comfortable with being uncomfortable and transparent when he doesn’t know something. When he got his CISO job, he told HR that this position was new to him and that he had a lot to learn. Being confident enough to say “I don’t know” is Mike’s mental motto because he knows he can adapt to new challenges. Ultimately anything is learnable as long as you push yourself, a mentality he encourages in his team.The Burn the Boats Method (17:42)After reflecting on his career decisions, including telling a company to fire him if he didn’t succeed as a director, Steve presses Mike on how he would react to someone sharing this approach.If one of Mike’s employees wanted to try a position out and see what happens, Mike would like to ease them into that role. He would let them transition through responsibilities first before changing that person’s title. Ultimately, trying and failing is okay, but Mike wants his team to fail soft versus hard.Falling Into Cyber Security (21:42)After looking for cyber security jobs for three years, Mike eased into this field through a position in compliance. Working side-by-side with security professionals, Mike was able to dip his toes.After lunch with his manager, he was offered the CISO role, and Mike immediately said yes. Mike admitted he didn’t know what he was doing but was encouraged to take this job.Rolling With It (25:01)Steve asks Mike if he ever wishes he said no when offered the CISO job. Mike knew this was the field he wanted to pursue, and he felt comfortable being transparent about his experience.Interview Questions (31:18)If you are a new CISO wanting to ask good questions in an interview, Mike suggests asking the purpose of that role at that company. Another helpful question concerns the company’s approach to trying new things and handling challenges.The Definition of Success (34:13)When evaluating a company during an interview, it’s essential to find out what that company’s definition of success is. Mike defines success as being aligned with the business that employs you and being seen beyond the security status.The Important People (36:50)If you don’t know where to start when beginning a new position, Mike suggests finding out who has influence in the organization and who delivers results.Once you know who those people are, you can nurture those relationships and get their input about the initiatives you want to implement. Bad Advice (42:21)The worst advice Mike received was “fake until you make it.” Although that approach may have good intentions, it is better to be transparent about your abilities. A quick way to imposter syndrome is to fake it. When you have humility, more people are inspired to help you toward your career goals.The New CISO (44:04)To Mike, a new CISO is having input in your organization’s strategic direction and getting an opportunity to take that to the next level. Having a leadership position is how he defines a successful CISO.Links mentioned: <a href="https://www.linkedin.com/in/mikekelleyciso/" rel="noopener noreferrer nofollow" target="_blank">LinkedIn</a>

Be Comfortable Being Uncomfortable: Managing New Roles and Next Steps

In this episode of The New CISO, Steve is joined by Martin Fisher, CISO at Northside Hospital.An information security veteran, Martin has worked in the commercial aviation, finance, and healthcare industries and was an award-winning podcast host. Today, he shares how to build a unified team and his approach to managing mental health. Listen to the episode to learn more about the value of hobbies, defining company culture, and being an empowering leader.Listen to Steve and Martin discusses the importance of shared team culture and how CISOs can balance the stress of the job:Meet Martin (1:50)Host Steve Moore introduces our guest today, Martin Fisher. Over his decades-long tech career, Martin has worked in several industries. His podcast, Southern Fried Security Podcast, lasted ten years and was an incredible learning experience. While a podcast host, Martin discovered that he used too much jargon for non-security listeners, encouraging him to expand to a larger audience.Other Hobbies (5:52)Martin considers himself an original nerd, playing Dungeons and Dragons as a kid and an adult. A fan of role-playing tabletop games, Martin has backed many Kickstarters and has a great gaming community within his group of friends.Mental Healthcare (8:22)A CISO for a hospital, Martin stresses that mental healthcare is healthcare. Martin believes in what his non-profit-based workplace stands for, which is why he has chosen this role.The Bad Day Factor (10:27)Martin manages his mental health by setting boundaries. People need to separate their work and personal life because it’s essential to have time to decompress. In the IT and security fields, there is a high percentage of neurodivergent employees who may need additional support in dealing with stress. Leaders must have employee assistance programs to help their staff with mental healthcare safely.Being Authentic (16:50)To build lasting relationships, you have to be your authentic self. When Martin looks for people to promote within his team, he looks for genuine individuals. Growing the Team (18:33)When Martin started his current position, he and the company culture aligned.Starting as the original security employee, Martin has been able to grow his team. His company understands that security is an investment and helps protect its patients, which has led to its success. Martin hires employees with their personalities in mind and how they fit the company culture.Patient Safety  (22:53)Confidentiality is paramount to uphold in the medical security field. Since they are a patient-safety-first organization, Martin ensures he hires employees who understand that mentality.Defining Work Culture (28:25)Northside lists its company culture on job listings to attract the right candidates, which includes kindness. Since Martin focuses on patient safety and quality care with his CISO work, he hires people who match those ideals.When you have this approach to hiring, you can create a positive feedback loop while forming a strong team.Culture Over Security? (33:35)Steve presses Martin on what’s more important: culture or preventing security issues?For Martin, security is still, of course, the focus. People are human and make mistakes, but they’ve never had a problem they couldn’t control. Bad Advice (38:43)The worst career advice Martin ever received was to work for a hedge fund. This environment was not a good fit for Martin, further emphasizing his point on authenticity's value.Military Experience (39:56)Martin explores how he has applied his military service experience to security crises. He has confidence in his CISO role because he has gone through worse. Having army training, he has a quiet confidence that has made him a better leader who empowers his team rather than micromanages them.The New CISO (48:18)To Martin, being a CISO at Northside is the best role he’s ever had. Protecting patients is both gratifying and terrifying, but he believes in his colleagues and the company’s mission.Links mentioned:LinkedIn@armorguy@infosec.exchange

In this episode of The New CISO, Steve is joined by Martin Fisher, CISO at Northside Hospital.An information security veteran, Martin has worked in the commercial aviation, finance, and healthcare industries and was an award-winning podcast host. Today, he shares how to build a unified team and his approach to managing mental health. Listen to the episode to learn more about the value of hobbies, defining company culture, and being an empowering leader.Listen to Steve and Martin discusses the importance of shared team culture and how CISOs can balance the stress of the job:Meet Martin (1:50)Host Steve Moore introduces our guest today, Martin Fisher. Over his decades-long tech career, Martin has worked in several industries. His podcast, Southern Fried Security Podcast, lasted ten years and was an incredible learning experience. While a podcast host, Martin discovered that he used too much jargon for non-security listeners, encouraging him to expand to a larger audience.Other Hobbies (5:52)Martin considers himself an original nerd, playing Dungeons and Dragons as a kid and an adult. A fan of role-playing tabletop games, Martin has backed many Kickstarters and has a great gaming community within his group of friends.Mental Healthcare (8:22)A CISO for a hospital, Martin stresses that mental healthcare is healthcare. Martin believes in what his non-profit-based workplace stands for, which is why he has chosen this role.The Bad Day Factor (10:27)Martin manages his mental health by setting boundaries. People need to separate their work and personal life because it’s essential to have time to decompress. In the IT and security fields, there is a high percentage of neurodivergent employees who may need additional support in dealing with stress. Leaders must have employee assistance programs to help their staff with mental healthcare safely.Being Authentic (16:50)To build lasting relationships, you have to be your authentic self. When Martin looks for people to promote within his team, he looks for genuine individuals. Growing the Team (18:33)When Martin started his current position, he and the company culture aligned.Starting as the original security employee, Martin has been able to grow his team. His company understands that security is an investment and helps protect its patients, which has led to its success. Martin hires employees with their personalities in mind and how they fit the company culture.Patient Safety  (22:53)Confidentiality is paramount to uphold in the medical security field. Since they are a patient-safety-first organization, Martin ensures he hires employees who understand that mentality.Defining Work Culture (28:25)Northside lists its company culture on job listings to attract the right candidates, which includes kindness. Since Martin focuses on patient safety and quality care with his CISO work, he hires people who match those ideals.When you have this approach to hiring, you can create a positive feedback loop while forming a strong team.Culture Over Security? (33:35)Steve presses Martin on what’s more important: culture or preventing security issues?For Martin, security is still, of course, the focus. People are human and make mistakes, but they’ve never had a problem they couldn’t control. Bad Advice (38:43)The worst career advice Martin ever received was to work for a hedge fund. This environment was not a good fit for Martin, further emphasizing his point on authenticity's value.Military Experience (39:56)Martin explores how he has applied his military service experience to security crises. He has confidence in his CISO role because he has gone through worse. Having army training, he has a quiet confidence that has made him a better leader who empowers his team rather than micromanages them.The New CISO (48:18)To Martin, being a CISO at Northside is the best role he’s ever had. Protecting patients is both gratifying and terrifying, but he believes in his colleagues and the company’s mission.Links mentioned: <a href="https://www.linkedin.com/in/martinjfisher/" rel="noopener noreferrer nofollow" target="_blank">LinkedIn</a>@armorguy@infosec.exchange

The Patient Safety Model: Developing a Hospital’s Security Culture

The New CISO is hosted by Exabeam Chief Security Strategist, Steve Moore. A former IT security leader himself, Steve sits down with Chief Information Security Officers to get their take on cybersecurity trends, what it takes to lead security teams and how things are changing in today’s world.

I do not consider myself a tech-oriented person.  However, I am a lawyer that understands that cyber security risks have become an omnipresent issue in our professional and personal lives.  This podcast is an insightful discussion from individuals who clearly understand this space.  It is well worth the time.

Useful Podcast for Techs and Non-Techs Alike

This is real world experience translating into real value for the practitioner. Even though it’s new, I’m thoroughly enjoying this podcast and think it bodes well for the future.

Real World

The New CISO

The Slow Evolution Of The CISO The role of the CISO is changing but maybe not at the preferable speed. The role has been changing throughout the existence of the CISO from a small technical role to an IT position, to a role that is more demanding than ever. It is becoming a much more executive role than in the past.    Connecting The Changing CISO Position To The Business Needs To understand the business needs, as the CISO the business needs to understand you, and your role with the company. Paint a clear picture to the executives and stakeholders on your scope of practice. How these higher positions see you is pivotal in fitting the role with the business functions. Don’t be afraid to ask for help outside of your department for a fresh perspective, let them help-you-help-them. Within the security industry things are moving fast, and they are moving towards digitalization, date, and technology. Many titles are changing within the workplace but the core responsibilities are remaining the same, but with more specific points of interest.    Automation And The Impact On The CISO There are so many micro-services and technology improvement products coming onto the market all the time, all this automation really changes the way the CISO has to create their system structure. Being able to have a solid security design and mission can allow for these smaller pieces to fit into the CISO puzzle. Automation is the future of technology and having a position or perhaps even a team to focus on automation is ideal for any large business with a security team. If the automation isn’t being done correctly or the wrong things are being automated it’s useless. If you are spending a ton of time fixing your automation mistakes, it isn’t being adequately placed for the issues at hand.    Taking A Look At The Risks Within Building a strong, coherent, and trustworthy team is just as important as the technology used to keep outside attackers away. Educating your team on what is personal property and what is a security risk is crucial. Insider attacks are becoming more and more prevalent in the security industry. Some of these incidents are done with innocent intentions and are just based on negligent naiveté, and aren’t malicious, but some are and having the understanding between security, HR, and management is critical in how these issues are dealt with.  Each department has its own purpose within the organization and when they all work together it makes for a well-oiled machine. As a security officer there are some pieces of information that cannot be shared with other departments. It’s your position as the CISO to do something if you see something that is negatively impacting the security. As an executive officer it is your responsibility to take these security breach actions in your own hands.    Potential 2020 Trends Doing more with less is trending in cybersecurity, retaining the same size team but having more responsibility with that team. Getting creative in problem solving when the resources aren’t available can prove the real value of your team to the organization. Using fresh perspective ideas when the team is small and resources are limited can really show you what you and your team are capable of.    Resources:  Steve Moore Linkedin Brian Haugli Linkedin Scott Morris Linkedin Exabeam Website Side Channel Website

The Slow Evolution Of The CISO The role of the CISO is changing but maybe not at the preferable speed. The role has been changing throughout the existence of the CISO from a small technical role to an IT position, to a role that is more demanding than ever. It is becoming a much more executive role than in the past.  Connecting The Changing CISO Position To The Business Needs To understand the business needs, as the CISO the business needs to understand you, and your role with the company. Paint a clear picture to the executives and stakeholders on your scope of practice. How these higher positions see you is pivotal in fitting the role with the business functions. Don’t be afraid to ask for help outside of your department for a fresh perspective, let them help-you-help-them. Within the security industry things are moving fast, and they are moving towards digitalization, date, and technology. Many titles are changing within the workplace but the core responsibilities are remaining the same, but with more specific points of interest.  Automation And The Impact On The CISO There are so many micro-services and technology improvement products coming onto the market all the time, all this automation really changes the way the CISO has to create their system structure. Being able to have a solid security design and mission can allow for these smaller pieces to fit into the CISO puzzle. Automation is the future of technology and having a position or perhaps even a team to focus on automation is ideal for any large business with a security team. If the automation isn’t being done correctly or the wrong things are being automated it’s useless. If you are spending a ton of time fixing your automation mistakes, it isn’t being adequately placed for the issues at hand.  Taking A Look At The Risks Within Building a strong, coherent, and trustworthy team is just as important as the technology used to keep outside attackers away. Educating your team on what is personal property and what is a security risk is crucial. Insider attacks are becoming more and more prevalent in the security industry. Some of these incidents are done with innocent intentions and are just based on negligent naiveté, and aren’t malicious, but some are and having the understanding between security, HR, and management is critical in how these issues are dealt with.  Each department has its own purpose within the organization and when they all work together it makes for a well-oiled machine. As a security officer there are some pieces of information that cannot be shared with other departments. It’s your position as the CISO to do something if you see something that is negatively impacting the security. As an executive officer it is your responsibility to take these security breach actions in your own hands.  Potential 2020 Trends Doing more with less is trending in cybersecurity, retaining the same size team but having more responsibility with that team. Getting creative in problem solving when the resources aren’t available can prove the real value of your team to the organization. Using fresh perspective ideas when the team is small and resources are limited can really show you what you and your team are capable of.  Resources:  Steve Moore <a href="http://www.linkedin.com/in/stephenrmoore/" rel="nofollow" target="_blank">Linkedin</a> Brian Haugli <a href="http://www.linkedin.com/in/brianhaugli/" rel="nofollow" target="_blank">Linkedin</a> Scott Morris <a href="http://www.linkedin.com/in/morrisesquire/" rel="nofollow" target="_blank">Linkedin</a> Exabeam <a href="http://www.exabeam.com" rel="nofollow" target="_blank">Website</a> Side Channel <a href="http://www.sidechannel.com" rel="nofollow" target="_blank">Website</a>

2020 Cyber Security Trends

Moving From Consultant to CISO  As a consultant you gain a lot of work experience very quickly, because you are working with a lot of clients on many issues. Seeing the transition from consultant to CISO is fairly common. As a consultant you don’t get to see the changes you’ve made grow over time, you only see the short-term effects and move on. If the decision is made to leave consulting and sign on full-time with one company as CISO, you see how everything you do evolves overtime, and are able to put all of your focus into one place.    Advice To Younger Consultants And Future CISOs  In every professional career there is a desire to succeed, sometimes we make ourselves crazy trying to get there. Knowing when to ask the right questions to clients is so important, they might not even know what they need and by steering the conversation with questions we can all get the desired outcome we are looking for. Having a clear perspective on what they actually are looking for can help you to deliver an appropriate result, while keeping you work load balanced.     Security Reporting Structures  Every company and organization is different; there is no golden rule of reporting when it comes to security. By understanding the dynamics of the organization you can get a clearer picture as to reporting. As a CISO reporting too low of the chain of command can cause problems, as well as reporting too high with someone who doesn’t understand the risks you are reporting. Get to know the dynamics and see how every part works together to better help you report.       Evaluating A Problem At A New Workplace  Coming into a new place of work you have to learn how the organization functions quickly. Watch closely to understand how the different departments work internally and with each other. When a problem arises and you have this knowledge you will be able to effectively report to right place, at the right time. Doing the right thing for the organization as a whole is always better than doing what is best for one single department.     Frequency Of Reporting  Normal information that doesn’t include a severe incident is typically looked over monthly, and again quarterly. For standard incidents doing monthly reports about what goals were achieved, what is projected to happen, and how it is going to be handled is common and those monthly reports will be revisited in quarterly reports. If there is a severe problem or incident that needs to be handled in real time, don’t risk a small issue becoming a huge one by not reporting.     Identifying Warning Signs And Red Flags  The security of information effects everyone in the organization, if you are speaking with a leader of an organization and you realize that there is no involvement of other departments in security that should be viewed as a red flag. All departments can weigh in on security, it’s important to have multiple perspectives on an issue. Security also needs to have a separate budget, it should never be a line item on the IT budget, and you don’t want to work for a place that invest in the security of the organization. Being able to speak with CEOs about the needs of the security team is very important, if they are unwilling to learn and listen about your expertise, that is a major red flag.     Lenny Defines Being The New CISO  It has always been about lifelong learning, being able to grow and develop. It’s good to constantly grow and evolve, challenge yourself professionally.     Resources:  Exabeam Website  Steve Moore Linkedin  Lenny Levy Linkedin 

Moving From Consultant to CISO  As a consultant you gain a lot of work experience very quickly, because you are working with a lot of clients on many issues. Seeing the transition from consultant to CISO is fairly common. As a consultant you don’t get to see the changes you’ve made grow over time, you only see the short-term effects and move on. If the decision is made to leave consulting and sign on full-time with one company as CISO, you see how everything you do evolves overtime, and are able to put all of your focus into one place.  Advice To Younger Consultants And Future CISOs  In every professional career there is a desire to succeed, sometimes we make ourselves crazy trying to get there. Knowing when to ask the right questions to clients is so important, they might not even know what they need and by steering the conversation with questions we can all get the desired outcome we are looking for. Having a clear perspective on what they actually are looking for can help you to deliver an appropriate result, while keeping you work load balanced.   Security Reporting Structures  Every company and organization is different; there is no golden rule of reporting when it comes to security. By understanding the dynamics of the organization you can get a clearer picture as to reporting. As a CISO reporting too low of the chain of command can cause problems, as well as reporting too high with someone who doesn’t understand the risks you are reporting. Get to know the dynamics and see how every part works together to better help you report.   Evaluating A Problem At A New Workplace  Coming into a new place of work you have to learn how the organization functions quickly. Watch closely to understand how the different departments work internally and with each other. When a problem arises and you have this knowledge you will be able to effectively report to right place, at the right time. Doing the right thing for the organization as a whole is always better than doing what is best for one single department.   Frequency Of Reporting  Normal information that doesn’t include a severe incident is typically looked over monthly, and again quarterly. For standard incidents doing monthly reports about what goals were achieved, what is projected to happen, and how it is going to be handled is common and those monthly reports will be revisited in quarterly reports. If there is a severe problem or incident that needs to be handled in real time, don’t risk a small issue becoming a huge one by not reporting.   Identifying Warning Signs And Red Flags  The security of information effects everyone in the organization, if you are speaking with a leader of an organization and you realize that there is no involvement of other departments in security that should be viewed as a red flag. All departments can weigh in on security, it’s important to have multiple perspectives on an issue. Security also needs to have a separate budget, it should never be a line item on the IT budget, and you don’t want to work for a place that invest in the security of the organization. Being able to speak with CEOs about the needs of the security team is very important, if they are unwilling to learn and listen about your expertise, that is a major red flag.   Lenny Defines Being The New CISO  It has always been about lifelong learning, being able to grow and develop. It’s good to constantly grow and evolve, challenge yourself professionally.   Resources:  Exabeam <a href="http://www.exabeam.com/" rel="noopener nofollow" target="_blank">Website</a> Steve Moore <a href="http://www.linkedin.com/in/stephenrmoore/" rel="noopener nofollow" target="_blank">Linkedin</a> Lenny Levy <a href="http://www.linkedin.com/in/lennylevy/" rel="noopener nofollow" target="_blank">Linkedin</a>

Assessing Security Reporting Structures

Partnering with Higher Education to Prepare Students for a Career in Cybersecurity Being associated with an advisory committee gives you a lot of freedom to really create the programs a future CISO needs to be hirable right out of school. The committee is able to see what classes need to be added to the curriculum, or if more classes aren’t plausible seminars are always an option. By being part of a larger advisory committee you can brainstorm with members from different industries and create an entire program from what you learn works in other industries.     The Biggest Issues With Being Hired Right Out Of School  Education is huge when it comes to being prepared for a job. Years of dedicated study and focus should not be taken lightly.  However, some aspects of the job that can’t be taught from a lesson plan, you just have to get out there in the industry. There are certifications that can be obtained after graduating, but real life experience is irreplaceable.  Internships, and job shadowing are great ways to get that experience while still completing your education.     Advice To A Young CISO  Don’t be afraid to take risks, get out there and align yourself with the right people. Go get that certification, ask to be mentored by someone you admire, learn from those who are ready to help. Don’t live too cautiously with your career, you can always build yourself back up.     Finding A Mentor Or Mentee  There are many ways to find a mentor in the age of technology. There may be someone within your company that can mentor you, but don’t limit yourself to that. Linkedin is a great resource for finding a mentor. You can also look at other companies with in your industry. On finding a mentee, just be open to teaching someone what you know about the industry, they may end up being an employee of your company in the future.     The Importance Of Presenting Your Knowledge  Being able to get up there and show your knowledge within the industry is so important. When you get to show what all you’ve been working for and get feedback from your peers on the subject, you really put yourself out there in a unique way. It can be very gratifying to share your knowledge and experience with others, whether you are speaking about problems or solutions.     Redundancy Within The Industry   There are many point solutions that don’t let us get to the root of the problem quickly. For a solution product to be effective there needs to be better communication between the product producers and the CISO so the products will remain relevant within the industry. If there are too many programs trying to get the same result, you know you have an efficiency problem and it’s time re-evaluate.     Discovering The Big Picture   Having a real and candid conversation about what you need to do your job effectively is very helpful. For a product to work effectively the producers need to know who is using it and why. Invest in products that have teams who are willing to learn about your specific pain points and needs as a CISO.  There needs to be more consultation between the CISO and VAR.     What Being A New CISO Means To Marc  It has evolved so much over the years; the CISO has a bigger responsibility than ever before. There are so many ways the CISO is being pulled in their modern environment that a serious hands-on approach is necessary. Understanding business, your peers, and technical enough to understand the scope of the entire company are key elements in being a modern CISO.     Resources:  Steve Moore: Linkedin  Marc Crudgington: Linkedin  Woodforest Bank: Website  Exabeam: Website 

Partnering with Higher Education to Prepare Students for a Career in Cybersecurity Being associated with an advisory committee gives you a lot of freedom to really create the programs a future CISO needs to be hirable right out of school. The committee is able to see what classes need to be added to the curriculum, or if more classes aren’t plausible seminars are always an option. By being part of a larger advisory committee you can brainstorm with members from different industries and create an entire program from what you learn works in other industries.   The Biggest Issues With Being Hired Right Out Of School  Education is huge when it comes to being prepared for a job. Years of dedicated study and focus should not be taken lightly.  However, some aspects of the job that can’t be taught from a lesson plan, you just have to get out there in the industry. There are certifications that can be obtained after graduating, but real life experience is irreplaceable.  Internships, and job shadowing are great ways to get that experience while still completing your education.   Advice To A Young CISO  Don’t be afraid to take risks, get out there and align yourself with the right people. Go get that certification, ask to be mentored by someone you admire, learn from those who are ready to help. Don’t live too cautiously with your career, you can always build yourself back up.   Finding A Mentor Or Mentee  There are many ways to find a mentor in the age of technology. There may be someone within your company that can mentor you, but don’t limit yourself to that. Linkedin is a great resource for finding a mentor. You can also look at other companies with in your industry. On finding a mentee, just be open to teaching someone what you know about the industry, they may end up being an employee of your company in the future.   The Importance Of Presenting Your Knowledge  Being able to get up there and show your knowledge within the industry is so important. When you get to show what all you’ve been working for and get feedback from your peers on the subject, you really put yourself out there in a unique way. It can be very gratifying to share your knowledge and experience with others, whether you are speaking about problems or solutions.   Redundancy Within The Industry   There are many point solutions that don’t let us get to the root of the problem quickly. For a solution product to be effective there needs to be better communication between the product producers and the CISO so the products will remain relevant within the industry. If there are too many programs trying to get the same result, you know you have an efficiency problem and it’s time re-evaluate.   Discovering The Big Picture   Having a real and candid conversation about what you need to do your job effectively is very helpful. For a product to work effectively the producers need to know who is using it and why. Invest in products that have teams who are willing to learn about your specific pain points and needs as a CISO.  There needs to be more consultation between the CISO and VAR.   What Being A New CISO Means To Marc  It has evolved so much over the years; the CISO has a bigger responsibility than ever before. There are so many ways the CISO is being pulled in their modern environment that a serious hands-on approach is necessary. Understanding business, your peers, and technical enough to understand the scope of the entire company are key elements in being a modern CISO.   Resources:  Steve Moore: <a href="http://www.linkedin.com/in/stephenrmoore/" rel="noopener nofollow" target="_blank">Linkedin</a> Marc Crudgington: <a href="http://www.linkedin.com/in/marccrudgington" rel="noopener nofollow" target="_blank">Linkedin</a> Woodforest Bank: <a href="http://www.woodforest.com/" rel="noopener nofollow" target="_blank">Website</a> Exabeam: <a href="http://www.exabeam.com/" rel="noopener nofollow" target="_blank">Website</a>

Partnering with Higher Education to Prepare Students for a Career in Cybersecurity

Identifying Burnout In The Workplace Burnout is a common occurrence in any industry, but especially among those looking to carve out their place in the industry. No one works well when they aren’t at their best, identifying burnout early on can stop it in its tracks. If you’re noticing someone is acting out of character or being short, they may be experiencing burnout. Another tell can be the hours you’re seeing someone put in, no one should be up at midnight still working.    Advice To A Younger You Networking can get you to great places, starting early in your career can really put you where you want to be a few years down the road. Don’t be shy, get out there and meet people within the industry. Network both inside and outside of the company you’re a part of.    Transitioning Into Leadership Not everyone is cutout for management. When taking a leadership role you need to be able to prioritize your team and realize you’re directly responsible for those who work with you. To be a good leader you have to take all the knowledge you’ve learned up to this point and be able to teach it to others in a way that makes sense to each individual. Empathy plays a huge role in leadership, you must be able to put yourself in the position of others and understand their point of view. Being open to feedback and being able to take it with an open mind is essential in leadership; it’s going to come both solicited and non-solicited.     Third Party Risks And Why We Don’t Love It What is third party risk? It’s when a company brings in another company to handle a certain project or service. Within security this plays a huge risk because you’re essentially giving this other company access or information to the inner workings of your company. From a security standpoint this is a huge risk and variable, so doing thorough and meticulous research into the companies brought is key. This can ruffle some feathers with the third party, but at the end of the day you’re in charge of security so you need to fulfill your duties to the company you’re employed with. The real issue arises when you’ve done the research, and don’t feel that the third party is a good match for the company, yet leadership above you wants to move forward regardless. The CISO is now tasked with trying to figure out how they can make this work with the third party, whether that means changing language within the contract, adjusting the work the third party is doing, or reworking how you present your findings to leadership above you.    Warning Signs Of A Bad Third Party Review How many exceptions are you making to be able to work with this vendor? Does it seem it like some rules are being bent? Policies and procedures aren’t being followed? These are all huge warning signs.  Another warning sign is an across the board process for each new vendor, this isn’t the most effective way to lower risks, and this can lower sales and revenue. Some vendors will be more risky then others, so there should be separate policies for different companies based on their risks.    What Being A New CISO Means To Me Building relationships while being honest and transparent is key to being a CISO. If we all viewed ourselves as a vendor and service provider we could all get the tasks at hand done.  Also be on the lookout for my book being released in summer 2020: Startup Secure Banking In Cybersecurity, From Founding To Exit   Resources: Steve Moore: Linkedin Chris Castaldo: Linkedin Exabeam: Website Dataminr: Website

Identifying Burnout In The Workplace Burnout is a common occurrence in any industry, but especially among those looking to carve out their place in the industry. No one works well when they aren’t at their best, identifying burnout early on can stop it in its tracks. If you’re noticing someone is acting out of character or being short, they may be experiencing burnout. Another tell can be the hours you’re seeing someone put in, no one should be up at midnight still working.  Advice To A Younger You Networking can get you to great places, starting early in your career can really put you where you want to be a few years down the road. Don’t be shy, get out there and meet people within the industry. Network both inside and outside of the company you’re a part of.  Transitioning Into Leadership Not everyone is cutout for management. When taking a leadership role you need to be able to prioritize your team and realize you’re directly responsible for those who work with you. To be a good leader you have to take all the knowledge you’ve learned up to this point and be able to teach it to others in a way that makes sense to each individual. Empathy plays a huge role in leadership, you must be able to put yourself in the position of others and understand their point of view. Being open to feedback and being able to take it with an open mind is essential in leadership; it’s going to come both solicited and non-solicited.   Third Party Risks And Why We Don’t Love It What is third party risk? It’s when a company brings in another company to handle a certain project or service. Within security this plays a huge risk because you’re essentially giving this other company access or information to the inner workings of your company. From a security standpoint this is a huge risk and variable, so doing thorough and meticulous research into the companies brought is key. This can ruffle some feathers with the third party, but at the end of the day you’re in charge of security so you need to fulfill your duties to the company you’re employed with. The real issue arises when you’ve done the research, and don’t feel that the third party is a good match for the company, yet leadership above you wants to move forward regardless. The CISO is now tasked with trying to figure out how they can make this work with the third party, whether that means changing language within the contract, adjusting the work the third party is doing, or reworking how you present your findings to leadership above you.  Warning Signs Of A Bad Third Party Review How many exceptions are you making to be able to work with this vendor? Does it seem it like some rules are being bent? Policies and procedures aren’t being followed? These are all huge warning signs.  Another warning sign is an across the board process for each new vendor, this isn’t the most effective way to lower risks, and this can lower sales and revenue. Some vendors will be more risky then others, so there should be separate policies for different companies based on their risks.  What Being A New CISO Means To Me Building relationships while being honest and transparent is key to being a CISO. If we all viewed ourselves as a vendor and service provider we could all get the tasks at hand done.  Also be on the lookout for my book being released in summer 2020: Startup Secure Banking In Cybersecurity, From Founding To Exit Resources: Steve Moore: <a href="http://www.linkedin.com/in/stephenrmoore/" rel="nofollow" target="_blank">Linkedin</a> Chris Castaldo: <a href="http://www.linkedin.com/in/chriscastaldo/" rel="nofollow" target="_blank">Linkedin</a> Exabeam: <a href="http://www.exabeam.com" rel="nofollow" target="_blank">Website</a> Dataminr: <a href="http://www.dataminr.com" rel="nofollow" target="_blank">Website</a>

Why 3rd Party Security Testing is the New Password Rotation

Understanding the Adversary Mick Jenkins, Chief Information Security Officer at Brunel University &amp; a former Counter Terrorism officer in the British Armed Forces speaks with Steve Moore about the ideological similarities between defending against terrorists versus cyber criminals, the benefits of mentorship throughout your career in security, and the re-emergence of Soviet era espionage techniques. Building a career in security can be a challenge, even for those of us who start off early. For some however, the job can be a natural progression from her Majesty's armed forces to helping secure the 2012 Olympics and ultimately becoming a CISO. So how do you channel these unique experiences into something that will withstand the diverse threats organizations face today?   Who is Mick Jenkins? My career &amp; professional involvements these days are in cybersecurity and sort of lie in the world I exist in as a non-executive director. At the moment I do all sorts of different things on the computer in terms of dealing with investigations, dealing with IT directors, and current strategies. I signed up &amp; started working in her majesty's armed forces when I was sixteen and a half years old. I certainly never expected to end up as a CISO dealing with strategic cyber security because my life began as a soldier in the British Army.   Working with a Mentor During the Transformation Process I think you and I are both very keen on spotting &amp; identifying the leaders of tomorrow and investing in them. And I think this is particularly important because as we know, over the next 5-10 years, the cyber world is going to need the best of leaders to support boards and deliver strategies that are coherent.  For me having had such wonderful careers, I want to be able to pay some of that back to younger men &amp; ladies. These are people who have the talent to go all the way to the top of the cyber tree as CISOs or strategic leaders both in government and the private sector. Luckily I'm connected with a number of people and different organizations here in the UK, and one of the wonderful ones is a small company taking veterans, who have done something like 22 years or more in service in the military. These are very loyal servants, very disciplined, very capable, and quick learners. The organization takes them out of the forces and retrains them as cyber specialists, cyber analysts, or information security managers, and then places them in industries. It has been very important and key for me that I try to help people who've got the talent. And just like in the military, it's all about thought and actual leadership. It’s about leading by example, having good strategic foresights and acting as a mentor or coach. At the moment I have 2 individuals who are much younger than me who I believe have got the talent. I’m earmarking them for the right career progression over the course of 5-10 years and trying to make sure that they do progress all the way to the top of the cyber tree. I was lucky as my mentor used to take me for lunch quite often every 2-3 months. And he would ask, ‘Are you in the right job here?’, ‘Is there anything I can do?’, ‘Tell me about this company you're working for’, ‘I really think you need to be doing this and this next.’ I had that for the 15 years I had in both the military and in my ultimate career in cyber security. And so I think mentorship and identifying good talent is something we owe ourselves for the future, which is something I particularly enjoy doing.   Mick’s Advice for the Transformation Process As I look back at my career, one thing about me is that I was always striving to achieve excellence and be honest in whatever I was asked to do or serve in her Majesty's service. And I think many of us in the professional armed forces do strive for sheer excellence. And if you've got that kind of psyche to achieve excellence, you'll go above &amp; beyond to learn from people. In my case a lot of it was about learning about the adversary. When I started working as an explosive disposal officer, particularly involved in high risk research, I wanted to beat the terrorist and so I needed to be at the top of my game. I took every opportunity to talk to some of the more experienced ground operators who had served in Iraq and Afghanistan. I looked up to my mentor as well. It's always a fabulous thing for someone going through multiple careers to have a mentor or coach. My particular mentor is a wonderful chap called John Almonds. He is in his seventies now, and he is the guy I aspire to be. I hope to achieve everything he did throughout his military &amp; civilian careers. He is still a very fit man - fitness in body &amp; mind, which kind of exists all the way through your military career into retirement. And this certainly helps when dealing with high stress/ high pressure situations.   Understanding Your Adversary In the army, I finished as an Intelligence Officer within the British Defense Intelligence. And then I made the transformation into civilian streets where I was working on information security, initially working with ultra-high security data centers. Then I made a transition through Olympics where I was the Lead Security Practitioner/Strategic for London 2012. After that I moved to the University world. Throughout all this transformation I moved from the adversary in the counter-terrorism world to the adversary in the cyber space world. Doctrinally there's no difference; we have an enemy, we have an adversary and they use a variety of tactics, techniques, and procedures that you as the defender need to know. You need to know how they will damage your organization or critical infrastructure. I had to learn about the technical elements of how the attacker exploited vulnerabilities, how they got their target asset, or how they used a particular technology to be able to attack. So for me it was all about excellence and trying to know/understand the adversary because if you know him and can predict the threats arising over the next couple of years, you can begin to build your own defense mechanism to protect your organization.   The Kompromat Kill This is my second book. I chose the title about 18 months ago and then from the title I wrote the story. What I think you or the American community will find interesting is the word “Kompromat”. Since 2016, all of a sudden it’s been immersed into American folklore. And of course it's a Russian term. For a very long time the  Russians have used the tactic of using compromising material against ministers, soldiers, and anybody in the community that they could use to their advantage. Effectively what they use is blackmail material and they have been the masters of this for decades. Now we see the terminology coming through because of the linkages and allegations put across into the current US administration. In addition, we now see this term being used quite radically in American media. But it’s less so over here in Britain. The novel gives a little bit of insight to readers about how this tactic is applied in the intelligence community, in the world of high breed warfare, and dodgy dossiers that we've seen on both sides of the Atlantic. I wanted to immerse the reader to see what is effectively a spy thriller linking the geo-political situation with ground operators doing the work of collecting intelligence. There are also elements of cyber technology &amp; attacks in the novel.   How to Combat Shady Online Information I think this is about continual improvement, and one of the elements of this is your organizations' ability to react to different levels of incidents. Here in the UK, The National Cyber Security Centre does a great job in providing out of the box exercises. They go out of their way to try &amp; assist because quite often in companies there isn't that experience, and many times you have to buy the expertise to conduct screening and policing.  I also think that there is a big shift here in the UK to actually make sure that the board understands the risks they face and some of the serious consequences that their business or physical infrastructure could face. And for organizations that actually do the exercises, each person can witness or be exposed to the roles and responsibilities of others and what they will actually be doing during a major incident. This ranges from the legal team, board level individuals all the way through disaster recovery people, IT, physical security &amp; policing. All these entities need to come together regularly to exercise and understand who will be doing what. Another important thing is that it's very important to coach the executive board on what their roles and responsibilities are during a major incident. This includes a terrorist incident or cyber-attack, and is part of consequence management. This is why a CISO has to have a good relationship with all members of the executive board.   Resources: Exabeam - Website Exabeam Spotlight Conference - Website Steve Moore - LinkedIn Michael Jenkins  - Website The National Cyber Security Centre - Website

Understanding the Adversary Mick Jenkins, Chief Information Security Officer at Brunel University &amp; a former Counter Terrorism officer in the British Armed Forces speaks with Steve Moore about the ideological similarities between defending against terrorists versus cyber criminals, the benefits of mentorship throughout your career in security, and the re-emergence of Soviet era espionage techniques. Building a career in security can be a challenge, even for those of us who start off early. For some however, the job can be a natural progression from her Majesty's armed forces to helping secure the 2012 Olympics and ultimately becoming a CISO. So how do you channel these unique experiences into something that will withstand the diverse threats organizations face today? Who is Mick Jenkins? My career &amp; professional involvements these days are in cybersecurity and sort of lie in the world I exist in as a non-executive director. At the moment I do all sorts of different things on the computer in terms of dealing with investigations, dealing with IT directors, and current strategies. I signed up &amp; started working in her majesty's armed forces when I was sixteen and a half years old. I certainly never expected to end up as a CISO dealing with strategic cyber security because my life began as a soldier in the British Army. Working with a Mentor During the Transformation Process I think you and I are both very keen on spotting &amp; identifying the leaders of tomorrow and investing in them. And I think this is particularly important because as we know, over the next 5-10 years, the cyber world is going to need the best of leaders to support boards and deliver strategies that are coherent.  For me having had such wonderful careers, I want to be able to pay some of that back to younger men &amp; ladies. These are people who have the talent to go all the way to the top of the cyber tree as CISOs or strategic leaders both in government and the private sector. Luckily I'm connected with a number of people and different organizations here in the UK, and one of the wonderful ones is a small company taking veterans, who have done something like 22 years or more in service in the military. These are very loyal servants, very disciplined, very capable, and quick learners. The organization takes them out of the forces and retrains them as cyber specialists, cyber analysts, or information security managers, and then places them in industries. It has been very important and key for me that I try to help people who've got the talent. And just like in the military, it's all about thought and actual leadership. It’s about leading by example, having good strategic foresights and acting as a mentor or coach. At the moment I have 2 individuals who are much younger than me who I believe have got the talent. I’m earmarking them for the right career progression over the course of 5-10 years and trying to make sure that they do progress all the way to the top of the cyber tree. I was lucky as my mentor used to take me for lunch quite often every 2-3 months. And he would ask, ‘Are you in the right job here?’, ‘Is there anything I can do?’, ‘Tell me about this company you're working for’, ‘I really think you need to be doing this and this next.’ I had that for the 15 years I had in both the military and in my ultimate career in cyber security. And so I think mentorship and identifying good talent is something we owe ourselves for the future, which is something I particularly enjoy doing. Mick’s Advice for the Transformation Process As I look back at my career, one thing about me is that I was always striving to achieve excellence and be honest in whatever I was asked to do or serve in her Majesty's service. And I think many of us in the professional armed forces do strive for sheer excellence. And if you've got that kind of psyche to achieve excellence, you'll go above &amp; beyond to learn from people. In my case a lot of it was about learning about the adversary. When I started working as an explosive disposal officer, particularly involved in high risk research, I wanted to beat the terrorist and so I needed to be at the top of my game. I took every opportunity to talk to some of the more experienced ground operators who had served in Iraq and Afghanistan. I looked up to my mentor as well. It's always a fabulous thing for someone going through multiple careers to have a mentor or coach. My particular mentor is a wonderful chap called John Almonds. He is in his seventies now, and he is the guy I aspire to be. I hope to achieve everything he did throughout his military &amp; civilian careers. He is still a very fit man - fitness in body &amp; mind, which kind of exists all the way through your military career into retirement. And this certainly helps when dealing with high stress/ high pressure situations. Understanding Your Adversary In the army, I finished as an Intelligence Officer within the British Defense Intelligence. And then I made the transformation into civilian streets where I was working on information security, initially working with ultra-high security data centers. Then I made a transition through Olympics where I was the Lead Security Practitioner/Strategic for London 2012. After that I moved to the University world. Throughout all this transformation I moved from the adversary in the counter-terrorism world to the adversary in the cyber space world. Doctrinally there's no difference; we have an enemy, we have an adversary and they use a variety of tactics, techniques, and procedures that you as the defender need to know. You need to know how they will damage your organization or critical infrastructure. I had to learn about the technical elements of how the attacker exploited vulnerabilities, how they got their target asset, or how they used a particular technology to be able to attack. So for me it was all about excellence and trying to know/understand the adversary because if you know him and can predict the threats arising over the next couple of years, you can begin to build your own defense mechanism to protect your organization. The Kompromat Kill This is my second book. I chose the title about 18 months ago and then from the title I wrote the story. What I think you or the American community will find interesting is the word “Kompromat”. Since 2016, all of a sudden it’s been immersed into American folklore. And of course it's a Russian term. For a very long time the  Russians have used the tactic of using compromising material against ministers, soldiers, and anybody in the community that they could use to their advantage. Effectively what they use is blackmail material and they have been the masters of this for decades. Now we see the terminology coming through because of the linkages and allegations put across into the current US administration. In addition, we now see this term being used quite radically in American media. But it’s less so over here in Britain. The novel gives a little bit of insight to readers about how this tactic is applied in the intelligence community, in the world of high breed warfare, and dodgy dossiers that we've seen on both sides of the Atlantic. I wanted to immerse the reader to see what is effectively a spy thriller linking the geo-political situation with ground operators doing the work of collecting intelligence. There are also elements of cyber technology &amp; attacks in the novel. How to Combat Shady Online Information I think this is about continual improvement, and one of the elements of this is your organizations' ability to react to different levels of incidents. Here in the UK, The National Cyber Security Centre does a great job in providing out of the box exercises. They go out of their way to try &amp; assist because quite often in companies there isn't that experience, and many times you have to buy the expertise to conduct screening and policing.  I also think that there is a big shift here in the UK to actually make sure that the board understands the risks they face and some of the serious consequences that their business or physical infrastructure could face. And for organizations that actually do the exercises, each person can witness or be exposed to the roles and responsibilities of others and what they will actually be doing during a major incident. This ranges from the legal team, board level individuals all the way through disaster recovery people, IT, physical security &amp; policing. All these entities need to come together regularly to exercise and understand who will be doing what. Another important thing is that it's very important to coach the executive board on what their roles and responsibilities are during a major incident. This includes a terrorist incident or cyber-attack, and is part of consequence management. This is why a CISO has to have a good relationship with all members of the executive board. Resources: Exabeam - <a href="https://www.exabeam.com/" rel="nofollow" target="_blank">Website</a> Exabeam Spotlight Conference - <a href="https://www.exabeam.com/spotlight/" rel="nofollow" target="_blank">Website</a> Steve Moore - <a href="https://www.linkedin.com/in/stephenrmoore/" rel="nofollow" target="_blank">LinkedIn</a> Michael Jenkins  - <a href="https://www.michaeljenkins.org/" rel="nofollow" target="_blank">Website</a> The National Cyber Security Centre - <a href="https://www.ncsc.gov.uk/" rel="nofollow" target="_blank">Website</a>

Understanding the Adversary

The Basics Of Being A Global CISO  The various pillars include security, which is, operations, corporate, product, customer, production, and automation.  It also includes compliance, undergoing audits and certifications throughout each year. You need to maintain trust between platforms, products, and customers. Quality management, data protection, privacy principals, customer advocacy, risk and assurance, are also major pieces of the CISO puzzle.     How Lakshmi Got Where Is Today  Lakshmi built herself up over the past 24 years with a vast background of experience. She’s been in the information risk-management/security field for a long time and has developed her view of the position over that time. Beginning as a security engineer, she has elevated her career to where it is today.     Empathy In The Professional Realm  Lakshmi has worn many hats in her long career, which lets her understand where her colleagues are coming from. She is able to put herself in their shoes, because she has been there. This has created an empathetic environment around her work and lets her effectively communicate with others. As a child she developed a strong sense of empathy, which wasn’t lost as an adult, she has kept this with her and was able to incorporate this mindset in her professional life. Being in the business of trust, empathy goes along way to gaining that trust you need to provide the work for your clients and colleagues.     What Is The Trust Office?  The Trust Office is comprised of all the teams working with Lakshmi; she is the head of this office at Box. Trust is the key to any and every aspect of her position. The mission statement of this office is protect the Box brand with secure products, secure operations, and continued compliance. She believes that seeing through a lens of trust leads to a less fragmented and more cohesive view of how to engage, invest, converse, and prioritize around risks.     The Cloud And How Customers Are Confused  No cloud provider comes without risks involved, the customer needs to weigh the risks involved between the platforms they are researching. If all platforms were more transparent with their customers, some of this confusion could be alleviated. Customers are also entering into a partnership with their provider, both playing their own unique roles in this relationship. The takeaway; understand the risks and understand that this is a partnership.     Recognizing Red Flags  It is very important to understand your own risk appetite before getting too deep with any platform, have the conversations with your team to be able to pinpoint what will and will not be acceptable to the company. Secondly, understanding what the actual risks are. If you aren’t getting the level of transparency you’re looking for with that platform, this probably shouldn’t end in a partnership. Another important aspect to consider is mutual understanding, the platform should understand how and why you going to be using their product. There should be open dialogue about what both parties need from each other beforehand.     The Concept Of Zero Touch Defined  This can be explained by looking into the three different layers. RPA or rapid process automation, the most basic layer, the next layer up is ML or machine learning, followed by AI or augmented intelligence. These are the three phases a customer could be in on their way to zero touch. By utilizing this concept, and minimizing human intervention a company can retain their manpower to focus on strategy and more proactive work. This is also beneficial for the customer by saving time, remaining consistent, keeping manual errors at a lower rate, and a general better user experience.       Understanding The Risks Security Teams Face In The Era Of Cloud Services  The major risk is a security team becoming obsolete; the team is only as valuable as they are irreplaceable. If the security team isn’t highly educated on the specific needs of the business, why are they necessary? A few way to educate yourself on the needs of the business, is understanding where the business comes from and who utilizes it, knowing the risks and pain points the business faces regularly, and be able to clearly define how your organization provides value.     Using Communication To Create Change Or Partnerships  So many aspects of running a business can be automated, some can’t, an open dialogue about responsibilities, wants, needs, and stressors can’t be automated. This comes back to transparency and empathy, when opening up the conversation remain authentic, clearly state what you believe your responsibilities are, inquire about your counterpart’s role. This transparency can lead to building trust, which can create necessary change or partnerships. This human element shouldn’t be overlooked, showing vulnerability can make everyone feel connected and comfortable with each other, knowing they come confidently come back to a dialogue whenever necessary.     Single Pane Of Glass: The Mindset  The term “single pane of glass” is used pretty frequently, but to Lakshmi it’s a mindset. The single pane of glass for her is the process of getting the result, when faced with a specific issue she uses this approach and asks pointed questions. Do we have a process in place for this issue? Is there a common denominator of the impact, the risk narrative? What are the consequences of inaction? So the single pane of glass mindset on risks involve all three; the impact, the risk narrative, and consequences of inaction.     What Being The New CISO Means to Lakshmi  Understanding the current environment, business, talent, people, their motivations and inspirations all come into play. Building operational excellence, having a team with the same vision, and finding the talent to compliment the vision you have. For Lakshmi it’s the journey, and that’s what inspires her to continue.     Resources:  Exabeam Website  Steve Moore Linkedin  Lakshmi Hanspal Linkedin  Box Website 

The Basics Of Being A Global CISO  The various pillars include security, which is, operations, corporate, product, customer, production, and automation.  It also includes compliance, undergoing audits and certifications throughout each year. You need to maintain trust between platforms, products, and customers. Quality management, data protection, privacy principals, customer advocacy, risk and assurance, are also major pieces of the CISO puzzle.   How Lakshmi Got Where Is Today  Lakshmi built herself up over the past 24 years with a vast background of experience. She’s been in the information risk-management/security field for a long time and has developed her view of the position over that time. Beginning as a security engineer, she has elevated her career to where it is today.   Empathy In The Professional Realm  Lakshmi has worn many hats in her long career, which lets her understand where her colleagues are coming from. She is able to put herself in their shoes, because she has been there. This has created an empathetic environment around her work and lets her effectively communicate with others. As a child she developed a strong sense of empathy, which wasn’t lost as an adult, she has kept this with her and was able to incorporate this mindset in her professional life. Being in the business of trust, empathy goes along way to gaining that trust you need to provide the work for your clients and colleagues.   What Is The Trust Office?  The Trust Office is comprised of all the teams working with Lakshmi; she is the head of this office at Box. Trust is the key to any and every aspect of her position. The mission statement of this office is protect the Box brand with secure products, secure operations, and continued compliance. She believes that seeing through a lens of trust leads to a less fragmented and more cohesive view of how to engage, invest, converse, and prioritize around risks.   The Cloud And How Customers Are Confused  No cloud provider comes without risks involved, the customer needs to weigh the risks involved between the platforms they are researching. If all platforms were more transparent with their customers, some of this confusion could be alleviated. Customers are also entering into a partnership with their provider, both playing their own unique roles in this relationship. The takeaway; understand the risks and understand that this is a partnership.   Recognizing Red Flags  It is very important to understand your own risk appetite before getting too deep with any platform, have the conversations with your team to be able to pinpoint what will and will not be acceptable to the company. Secondly, understanding what the actual risks are. If you aren’t getting the level of transparency you’re looking for with that platform, this probably shouldn’t end in a partnership. Another important aspect to consider is mutual understanding, the platform should understand how and why you going to be using their product. There should be open dialogue about what both parties need from each other beforehand.   The Concept Of Zero Touch Defined  This can be explained by looking into the three different layers. RPA or rapid process automation, the most basic layer, the next layer up is ML or machine learning, followed by AI or augmented intelligence. These are the three phases a customer could be in on their way to zero touch. By utilizing this concept, and minimizing human intervention a company can retain their manpower to focus on strategy and more proactive work. This is also beneficial for the customer by saving time, remaining consistent, keeping manual errors at a lower rate, and a general better user experience.   Understanding The Risks Security Teams Face In The Era Of Cloud Services  The major risk is a security team becoming obsolete; the team is only as valuable as they are irreplaceable. If the security team isn’t highly educated on the specific needs of the business, why are they necessary? A few way to educate yourself on the needs of the business, is understanding where the business comes from and who utilizes it, knowing the risks and pain points the business faces regularly, and be able to clearly define how your organization provides value.   Using Communication To Create Change Or Partnerships  So many aspects of running a business can be automated, some can’t, an open dialogue about responsibilities, wants, needs, and stressors can’t be automated. This comes back to transparency and empathy, when opening up the conversation remain authentic, clearly state what you believe your responsibilities are, inquire about your counterpart’s role. This transparency can lead to building trust, which can create necessary change or partnerships. This human element shouldn’t be overlooked, showing vulnerability can make everyone feel connected and comfortable with each other, knowing they come confidently come back to a dialogue whenever necessary.   Single Pane Of Glass: The Mindset  The term “single pane of glass” is used pretty frequently, but to Lakshmi it’s a mindset. The single pane of glass for her is the process of getting the result, when faced with a specific issue she uses this approach and asks pointed questions. Do we have a process in place for this issue? Is there a common denominator of the impact, the risk narrative? What are the consequences of inaction? So the single pane of glass mindset on risks involve all three; the impact, the risk narrative, and consequences of inaction.   What Being The New CISO Means to Lakshmi  Understanding the current environment, business, talent, people, their motivations and inspirations all come into play. Building operational excellence, having a team with the same vision, and finding the talent to compliment the vision you have. For Lakshmi it’s the journey, and that’s what inspires her to continue.   Resources:  Exabeam <a href="http://www.exabeam.com/" rel="noopener nofollow" target="_blank">Website</a> Steve Moore <a href="http://www.linkedin.com/in/stephenrmoore/" rel="noopener nofollow" target="_blank">Linkedin</a> Lakshmi Hanspal <a href="http://www.linkedin.com/in/lakshmi-hanspal/" rel="noopener nofollow" target="_blank">Linkedin</a> Box <a href="http://www.box.com/home" rel="noopener nofollow" target="_blank">Website</a>

Digital Trust For Digital Transformation

Marketing In Relation To Security Marketing is all about getting a certain message to the right audience. A background in this field can be a great way to transition into other positions including the CISO. Being able to take a look at the bigger picture and then funnel that picture down to solve the problem at hand can be aided with a marketing approach.    Advice To Those Just Starting Out  Being new in an industry can be isolating by itself alone, but being female in a male dominated industry can emphasize that isolation. Being able to feel comfortable in your individuality will help anyone in any position. Also being gentler with yourself as a person, and attempting to enjoy the path you’re on can provide you with a higher sense of self-worth.      Being The Only Woman In The Meeting Speaking in general terms men tend to be more direct and interact differently within their own gender. Being the only woman there you have to adapt, speaking more directly, and bluntly for example. This being said the same would be true of a man working in a female dominated industry, adapting to the culture of the industry will set you apart. Having the proper certification and licenses can set you apart as well, it is unfortunate that the business culture is this way, but it will prove on paper that you are capable and have the skillset to demand respect in the industry. Being prepared and researching beforehand is key to success as well, spend a little extra time researching your client.    Why Women Are Encouraged To Pursue A Career In Security Women are highly detail-oriented which is huge in the realm of security, yet a common misconception of security is that it is a technical only position. Technical has a place in security, but that isn’t the only aspect of the industry. Being able to communicate, see the bigger picture, work within a team, and cooperate with the company are other aspects within the security field that women can strive in whether being a technical person or not.    Friendly Advice To Men In The Workplace In meeting be an active listener, do not interrupt women, do not repeat their ideas and state them as your own. Women who have children also have different life pressures, but when you schedule a happy hour meeting that almost immediately excludes the women on your team with children. Having lunch meetings are a great way to keep the whole team involved and at the table. Having meeting over a round of golf is fairly typical, but don’t exclude the women on your team, the conscience of who your team is and how to involve everyone in the productivity in the workplace. Keep it equal, don’t interrupt, and be aware of how you are interacting.  Women want to be treated like equals, women don’t want to be separated by gender in their industry.    Advice To Women In The Security Industry You are going to face adversity, harassment, isolation, and many other challenges when you are the minority in the industry. It is not going to be easy, you are definitely going to have to put the work in. That being said, the higher you climb the less of a minority you are. So stay focused, toughen up, and climb the latter.    Resources:  Steve Moore: Linkedin Olivia Rose: Linkedin Exabeam: Website MailChimp: Website

Marketing In Relation To Security Marketing is all about getting a certain message to the right audience. A background in this field can be a great way to transition into other positions including the CISO. Being able to take a look at the bigger picture and then funnel that picture down to solve the problem at hand can be aided with a marketing approach.  Advice To Those Just Starting Out  Being new in an industry can be isolating by itself alone, but being female in a male dominated industry can emphasize that isolation. Being able to feel comfortable in your individuality will help anyone in any position. Also being gentler with yourself as a person, and attempting to enjoy the path you’re on can provide you with a higher sense of self-worth.    Being The Only Woman In The Meeting Speaking in general terms men tend to be more direct and interact differently within their own gender. Being the only woman there you have to adapt, speaking more directly, and bluntly for example. This being said the same would be true of a man working in a female dominated industry, adapting to the culture of the industry will set you apart. Having the proper certification and licenses can set you apart as well, it is unfortunate that the business culture is this way, but it will prove on paper that you are capable and have the skillset to demand respect in the industry. Being prepared and researching beforehand is key to success as well, spend a little extra time researching your client.  Why Women Are Encouraged To Pursue A Career In Security Women are highly detail-oriented which is huge in the realm of security, yet a common misconception of security is that it is a technical only position. Technical has a place in security, but that isn’t the only aspect of the industry. Being able to communicate, see the bigger picture, work within a team, and cooperate with the company are other aspects within the security field that women can strive in whether being a technical person or not.  Friendly Advice To Men In The Workplace In meeting be an active listener, do not interrupt women, do not repeat their ideas and state them as your own. Women who have children also have different life pressures, but when you schedule a happy hour meeting that almost immediately excludes the women on your team with children. Having lunch meetings are a great way to keep the whole team involved and at the table. Having meeting over a round of golf is fairly typical, but don’t exclude the women on your team, the conscience of who your team is and how to involve everyone in the productivity in the workplace. Keep it equal, don’t interrupt, and be aware of how you are interacting.  Women want to be treated like equals, women don’t want to be separated by gender in their industry.  Advice To Women In The Security Industry You are going to face adversity, harassment, isolation, and many other challenges when you are the minority in the industry. It is not going to be easy, you are definitely going to have to put the work in. That being said, the higher you climb the less of a minority you are. So stay focused, toughen up, and climb the latter.  Resources:  Steve Moore: <a href="http://www.linkedin.com/in/stephenrmoore/" rel="nofollow" target="_blank">Linkedin</a> Olivia Rose: <a href="http://www.linkedin.com/in/oliviarosecybersecurity/" rel="nofollow" target="_blank">Linkedin</a> Exabeam: <a href="http://www.exabeam.com" rel="nofollow" target="_blank">Website</a> MailChimp: <a href="http://www.mailchimp.com" rel="nofollow" target="_blank">Website</a>

Unique Challenges, but More Opportunities for Women in Cybersecurity

What it Means to be an Honest Broker As a former CISO in Hanover Insurance Group, Brian Haugli shares what it means to be an honest broker in the context of security leadership, which might be better described as an agent of trust and transparency for a business.  Brian and Steve Moore talk about strategies for delivering the right message to executives and the Board, the learning opportunities that come with candor and the honest truth about managing the inherent stress of the position. Advice to future or current leaders One big feedback I would give my younger self is don't focus so much on one area or another. Really be open to the ancillary spaces within security. Looking at human behavior, looking at the legal side of things, and pulling that information in to help round you out. Is there a core of bad leadership in information security? Not everyone is born to be a leader. It's something that you're born with that type of a capability. I think you look back at like type A/type B personalities. A lot of security folks are the type B, and there's nothing wrong with that, but I think there's a different level of getting leadership out of that that isn't as natural for them as somebody who is a type A, an outgoing type of a person. I don't think there's bad leaders in InfoSec. I just don't think there's enough of them. Transitioning on a small team vs large team On a smaller organization, you're going to wear more hats because there's just not enough people for that work to go around. The larger organizations, what I learned was I could sit down a team or four or five analysts, teach them in one or two hours how I would do something. And now, I've multiplied my capabilities by five. And that's much more effective than me trying to do that individually. The smaller teams, smaller orgs, they are struggling with being able to address this and I think that's where I want to find a niche for developing some work and some support and driving insight and guidance to these groups because they need help. The start of Side Channel Security We saw the need that small and medium businesses, nonprofits, VC-backed software firms, don't need a CISO full time but still need that kind of guidance and expertise. We started by supporting a nonprofit ... realizing the questions and the concerns were the same things that we had heard from our peers in larger organizations or our own organizations at the time.  It just built upon itself. Where are people most ignorant as it relates to information security and running a good program? I've got a bit of a mantra that I can't defend what I don't know exists and that's really asset identification, asset allocation.  Being able to answer what is your business obligations? And what are your business objectives? Can you identify the things that keep you running and could you tell me what a bad day looks like? You have to make them understand that your new reliance on technology and you storing all of this data and/or allowing access to these systems equates to your ability to provide services to your customers, whatever that is then. Those are usually ah-ha moments for folks and it's a good one to be there for because you can quickly help them realize what their concerns really should be from a security standpoint, but then quickly get them to how do we tackle this? How do we make this not an issue any longer? How do we mitigate that risk? What is an honest broker when delivering a security message to the ELT or the Board? I think it's just about transparency and integrity. Security, the definition of security, is confidentiality, integrity, and availability. As the CISO, your ability to obviously protect those things is one aspect. Your ability to showcase and embody the integrity of what it is that is being expected of you. Turning that around and then being able to explain that in terms that honestly chances are nontechnical person and somebody who definitely doesn't understand information security is going to understand. Do they always really want the truth? Everybody always wants the truth but what they want is to make sure that you're not positioning as if the sky is falling on every conversation you're having. It's about talking about the level of risk at an appropriate level. What most senior leaders really want to hear is that you've got it under control.  What you can do is be completely honest in the fact that you don't know what you don't know and then promise that you're going to go figure it out and come back to them with something. What are things that we forget to do? I think the thing that gets missed a lot is that security doesn't exist without the business. We're not in the position for the sake of a company or an organization. What’s the worst archetype of a CISO? I think there's a major difference between the CISO who has a real technical understanding of everybody on his team or her team and those who came through the CIO track or the business track. I think you can just be much more effective as a leader if you understand all the roles that your team members are capable of and doing. And I think that's one thing I've differentiated myself on is I've done just about anything that anybody on my team is I'm charging to do. Is CISO a good job? I feel like some days it can be but I keep volunteering and keep pursuing them so there's got to be either there's something wrong with me in that respect or it's not actually as bad as we think about it. Is there any time where you go and you present this messaging and leaders of membership don't want to hear it? Hearing about a risk is difficult for people to comprehend and maybe even be able to accept. Take the approach of positioning the best idea that you pay me to bring you.  There's really no reason to get into an argument or really try to hammer on something that a business owner doesn't want to tackle. Any lessons or any observations in terms of doing more with less? Biggest thing I learned out of the military was the concept of BLUF, bottom line up front. So, just position the idea that is the most impactful, the key term or concept that you want that person or that group to walk away from, just put it right up front. Get there, put it out there, speak to it, and then, build, if you have the time obviously in the presentation slides or whatever material to be to actually do it. Build out from there. But drive at least the one thing that you want them to know right up front. Resources: Exabeam - Website Side Channel Security - Website Steve Moore - LinkedIn Brian Haugli - LinkedIn

What it Means to be an Honest Broker As a former CISO in Hanover Insurance Group, Brian Haugli shares what it means to be an honest broker in the context of security leadership, which might be better described as an agent of trust and transparency for a business.  Brian and Steve Moore talk about strategies for delivering the right message to executives and the Board, the learning opportunities that come with candor and the honest truth about managing the inherent stress of the position. Advice to future or current leaders One big feedback I would give my younger self is don't focus so much on one area or another. Really be open to the ancillary spaces within security. Looking at human behavior, looking at the legal side of things, and pulling that information in to help round you out. Is there a core of bad leadership in information security? Not everyone is born to be a leader. It's something that you're born with that type of a capability. I think you look back at like type A/type B personalities. A lot of security folks are the type B, and there's nothing wrong with that, but I think there's a different level of getting leadership out of that that isn't as natural for them as somebody who is a type A, an outgoing type of a person. I don't think there's bad leaders in InfoSec. I just don't think there's enough of them. Transitioning on a small team vs large team On a smaller organization, you're going to wear more hats because there's just not enough people for that work to go around. The larger organizations, what I learned was I could sit down a team or four or five analysts, teach them in one or two hours how I would do something. And now, I've multiplied my capabilities by five. And that's much more effective than me trying to do that individually. The smaller teams, smaller orgs, they are struggling with being able to address this and I think that's where I want to find a niche for developing some work and some support and driving insight and guidance to these groups because they need help. The start of Side Channel Security We saw the need that small and medium businesses, nonprofits, VC-backed software firms, don't need a CISO full time but still need that kind of guidance and expertise. We started by supporting a nonprofit ... realizing the questions and the concerns were the same things that we had heard from our peers in larger organizations or our own organizations at the time.  It just built upon itself. Where are people most ignorant as it relates to information security and running a good program? I've got a bit of a mantra that I can't defend what I don't know exists and that's really asset identification, asset allocation.  Being able to answer what is your business obligations? And what are your business objectives? Can you identify the things that keep you running and could you tell me what a bad day looks like? You have to make them understand that your new reliance on technology and you storing all of this data and/or allowing access to these systems equates to your ability to provide services to your customers, whatever that is then. Those are usually ah-ha moments for folks and it's a good one to be there for because you can quickly help them realize what their concerns really should be from a security standpoint, but then quickly get them to how do we tackle this? How do we make this not an issue any longer? How do we mitigate that risk? What is an honest broker when delivering a security message to the ELT or the Board? I think it's just about transparency and integrity. Security, the definition of security, is confidentiality, integrity, and availability. As the CISO, your ability to obviously protect those things is one aspect. Your ability to showcase and embody the integrity of what it is that is being expected of you. Turning that around and then being able to explain that in terms that honestly chances are nontechnical person and somebody who definitely doesn't understand information security is going to understand. Do they always really want the truth? Everybody always wants the truth but what they want is to make sure that you're not positioning as if the sky is falling on every conversation you're having. It's about talking about the level of risk at an appropriate level. What most senior leaders really want to hear is that you've got it under control.  What you can do is be completely honest in the fact that you don't know what you don't know and then promise that you're going to go figure it out and come back to them with something. What are things that we forget to do? I think the thing that gets missed a lot is that security doesn't exist without the business. We're not in the position for the sake of a company or an organization. What’s the worst archetype of a CISO? I think there's a major difference between the CISO who has a real technical understanding of everybody on his team or her team and those who came through the CIO track or the business track. I think you can just be much more effective as a leader if you understand all the roles that your team members are capable of and doing. And I think that's one thing I've differentiated myself on is I've done just about anything that anybody on my team is I'm charging to do. Is CISO a good job? I feel like some days it can be but I keep volunteering and keep pursuing them so there's got to be either there's something wrong with me in that respect or it's not actually as bad as we think about it. Is there any time where you go and you present this messaging and leaders of membership don't want to hear it? Hearing about a risk is difficult for people to comprehend and maybe even be able to accept. Take the approach of positioning the best idea that you pay me to bring you.  There's really no reason to get into an argument or really try to hammer on something that a business owner doesn't want to tackle. Any lessons or any observations in terms of doing more with less? Biggest thing I learned out of the military was the concept of BLUF, bottom line up front. So, just position the idea that is the most impactful, the key term or concept that you want that person or that group to walk away from, just put it right up front. Get there, put it out there, speak to it, and then, build, if you have the time obviously in the presentation slides or whatever material to be to actually do it. Build out from there. But drive at least the one thing that you want them to know right up front. Resources: Exabeam - <a href="https://www.exabeam.com/" rel="nofollow" target="_blank">Website</a> Side Channel Security - <a href="https://www.sidechannelsec.com/" rel="nofollow" target="_blank">Website</a> Steve Moore - <a href="https://www.linkedin.com/in/stephenrmoore/" rel="nofollow" target="_blank">LinkedIn</a> Brian Haugli - <a href="https://www.linkedin.com/in/brianhaugli/" rel="nofollow" target="_blank">LinkedIn</a>

What it Means to be an Honest Broker

Securing a Cybersecurity Organization Chief Information Security Officer of Netskope, Lamont Orange, talks with Steve Moore about the unique differences between working as a CISO for a private company versus doing it on the vendor side of things; securing a cyber security organization.  As cyber security becomes entrenched in the business cycle, other business functions have expanded their interactions with security teams. That said, the understanding of what a CISO does hasn't always followed the same trajectory. How do we as security professionals, help our organizations interact with our security teams and help them understand the role we play in an increasingly at risk world?     The major difference between being a CISO for a vendor vs private organization  Working for a vendor, you have a direct line into change and solving the problems that really need to be solved.   Working with a private organization, it's everybody's opinion and no one knows really what you're talking about.   Lamont encourages everyone to spend time in both worlds because when you're working for a company, you're in a particular vertical so you have ground floor opportunity to understand all the challenges, whether they're business challenges, technology challenges, people challenges, you really get to understand the industry in which you're working and serving some of that.     How did Lamont get his start?  He has had the opportunity of serving in a consulting capacity to organizations. That gave him more of that, that multi vertical multi industry perspective. Lamont wanted to give back and go to an organization where he got to grow something from the ground up, watch it grow and watch it be something really valuable and a differentiator to the business.  He also wanted to see what the opportunities were on the vendor side because it seemed very intriguing and an opportunity was presented. What he found is that the language barrier is gone. The challenge then became to take all of that industry expertise and all of that business knowledge and apply it to a way where he can lead the vendor side.  When you're on the vendor and product side, you get to effect masses of companies. You get to interact with so many different thought leaders and coaches. You get to make the industry better from the solutions and tools perspective that we have to offer. But you're also growing people’s careers at the same time discussing the path that you've gone through.  Find opportunities to speak. There's just so much goodness in it that helps you grow as a professional also. There are so many lives that you can touch from a career perspective and making a difference and how we deal with our adversaries.     Figuring out how to share in the security community  When you look at our adversaries, they're definitely sharing. They talk about the latest way they use and abuse. We need to do some of the same thing. “This is what was effective with this particular adversary.” “This was what was effective in this particular vertical because this is how we do business and this is what's effective”. Those types of conversations are priceless and we need to figure out a way to have more of them.     What is change management?  There'll be changes in infrastructure. There'll be changes in operating model and there's a board that we have to go through to get the changes approved.  We implement those changes. If we start going back to fundamentals and what's happening in cybersecurity, what's happening with the role of the CISO and the CSO and all the technology players, we are back to the basic definition of change management. Not only do we have to adapt to change, we have to embrace it for what it brings.  We have to look forward to what the positives are with this change. We have to demonstrate to others why this change was either good or is not the best plan of attack, and then we adjust. You don't want to have a stagnation in anything that you do because it either becomes boring or you become complacent. What this is showing us is that our industry is neither boring or complacent.  It is very dynamic and we need to figure out how to manage that.    What change are you excited about?  Lamont is excited about the movement to cloud.   The industry as a whole, it's a new operating model. We've so long looked at all of these different solutions that we've cobbled together to keep filling gaps of whatever the threat landscape brought to us with this movement. Now we get to take a fresh look and if we are at a point where we have a seat at the table, we get to walk with the business and actually consult with them and talk to them about what this new paradigm that they want to go into will really bring.  With our fresh look, we can say that we're really looking to enable you to be able to take away some of this friction cause we don't have all of these different hoops and a different control frameworks and the whole let's lock it down mentality anymore. We know that you need to be open and now we need solutions. We need to look for those solutions that will allow the openness.     What advice would you have for a new CISO?  you got to build relationships.  Just keep it simple. Security needs to be a friend of the business. It needs to be a partner to the business. We need to build those relationships in order to show how we cannot be a pimple in the path to progress, but be that progress, be that innovator and progress.     Is there a difference between authority and influence as it relates to the movement of the cloud?  The dynamic is definitely changing to influence. Influence is much stronger than authority. When you breed influence through an organization, you're creating the emissaries of the division and you're getting consensus around that. Once you get the spirit of how you want to move forward and making sure all decisions map to that, you won't have to use your authority.     How are challenges different for large vs small organizations in moving to the Cloud?  The challenges are different.  The larger the organization, the more politics, the more structure around, we've always done it this way. There's more teachable moments that have to be identified and teach that organization, team, individual, why you're looking at it from this particular perspective. In smaller companies, there's less politics. There are more consolidated functions and one or two individuals which makes it easier to influence across those teams. The smaller companies are more nimble too.     What is the change that is happening to security leaders?  Over the course of the profession, the security leaders, we've all tried to center this activity of security and really believe that we can manage it from a central perspective. In many cases before this disruption really started to occur with the disruption of cloud, there was all these different types of disruption. We are now trying to decentralize and bill those influences and emissaries and the different groups within dev ops.    What is the definition of the new CISO?  The modern CISO is really going to look to embrace change management and actually have a roadmap to how they are going to embrace this change. Whether that's moving to the cloud, whether that's moving to hybrid infrastructures and looking at this in a way where it's as a positive restart for our profession and a restart for all the complexity of controls and processes and policies that we've put in place to make it something less friction to the business and realizing that we're in the business of managing risks and realizing that control frameworks are just that.  They're a framework. In many of these new paradigms and structures, the control frameworks when applicable may actually cost the business something in productivity.  Page Break    Resources:  Exabeam – Website  Steve Moore – LinkedIn  Lamont Orange – LinkedIn  Netskope – Website 

Securing a Cybersecurity Organization Chief Information Security Officer of Netskope, Lamont Orange, talks with Steve Moore about the unique differences between working as a CISO for a private company versus doing it on the vendor side of things; securing a cyber security organization.  As cyber security becomes entrenched in the business cycle, other business functions have expanded their interactions with security teams. That said, the understanding of what a CISO does hasn't always followed the same trajectory. How do we as security professionals, help our organizations interact with our security teams and help them understand the role we play in an increasingly at risk world?   The major difference between being a CISO for a vendor vs private organization  Working for a vendor, you have a direct line into change and solving the problems that really need to be solved.   Working with a private organization, it's everybody's opinion and no one knows really what you're talking about.   Lamont encourages everyone to spend time in both worlds because when you're working for a company, you're in a particular vertical so you have ground floor opportunity to understand all the challenges, whether they're business challenges, technology challenges, people challenges, you really get to understand the industry in which you're working and serving some of that.   How did Lamont get his start?  He has had the opportunity of serving in a consulting capacity to organizations. That gave him more of that, that multi vertical multi industry perspective. Lamont wanted to give back and go to an organization where he got to grow something from the ground up, watch it grow and watch it be something really valuable and a differentiator to the business.  He also wanted to see what the opportunities were on the vendor side because it seemed very intriguing and an opportunity was presented. What he found is that the language barrier is gone. The challenge then became to take all of that industry expertise and all of that business knowledge and apply it to a way where he can lead the vendor side.  When you're on the vendor and product side, you get to effect masses of companies. You get to interact with so many different thought leaders and coaches. You get to make the industry better from the solutions and tools perspective that we have to offer. But you're also growing people’s careers at the same time discussing the path that you've gone through.  Find opportunities to speak. There's just so much goodness in it that helps you grow as a professional also. There are so many lives that you can touch from a career perspective and making a difference and how we deal with our adversaries.   Figuring out how to share in the security community  When you look at our adversaries, they're definitely sharing. They talk about the latest way they use and abuse. We need to do some of the same thing. “This is what was effective with this particular adversary.” “This was what was effective in this particular vertical because this is how we do business and this is what's effective”. Those types of conversations are priceless and we need to figure out a way to have more of them.    What is change management?  There'll be changes in infrastructure. There'll be changes in operating model and there's a board that we have to go through to get the changes approved.  We implement those changes. If we start going back to fundamentals and what's happening in cybersecurity, what's happening with the role of the CISO and the CSO and all the technology players, we are back to the basic definition of change management. Not only do we have to adapt to change, we have to embrace it for what it brings.  We have to look forward to what the positives are with this change. We have to demonstrate to others why this change was either good or is not the best plan of attack, and then we adjust. You don't want to have a stagnation in anything that you do because it either becomes boring or you become complacent. What this is showing us is that our industry is neither boring or complacent.  It is very dynamic and we need to figure out how to manage that.  What change are you excited about?  Lamont is excited about the movement to cloud.   The industry as a whole, it's a new operating model. We've so long looked at all of these different solutions that we've cobbled together to keep filling gaps of whatever the threat landscape brought to us with this movement. Now we get to take a fresh look and if we are at a point where we have a seat at the table, we get to walk with the business and actually consult with them and talk to them about what this new paradigm that they want to go into will really bring.  With our fresh look, we can say that we're really looking to enable you to be able to take away some of this friction cause we don't have all of these different hoops and a different control frameworks and the whole let's lock it down mentality anymore. We know that you need to be open and now we need solutions. We need to look for those solutions that will allow the openness.   What advice would you have for a new CISO?  you got to build relationships.  Just keep it simple. Security needs to be a friend of the business. It needs to be a partner to the business. We need to build those relationships in order to show how we cannot be a pimple in the path to progress, but be that progress, be that innovator and progress.   Is there a difference between authority and influence as it relates to the movement of the cloud?  The dynamic is definitely changing to influence. Influence is much stronger than authority. When you breed influence through an organization, you're creating the emissaries of the division and you're getting consensus around that. Once you get the spirit of how you want to move forward and making sure all decisions map to that, you won't have to use your authority.   How are challenges different for large vs small organizations in moving to the Cloud?  The challenges are different.  The larger the organization, the more politics, the more structure around, we've always done it this way. There's more teachable moments that have to be identified and teach that organization, team, individual, why you're looking at it from this particular perspective. In smaller companies, there's less politics. There are more consolidated functions and one or two individuals which makes it easier to influence across those teams. The smaller companies are more nimble too.    What is the change that is happening to security leaders?  Over the course of the profession, the security leaders, we've all tried to center this activity of security and really believe that we can manage it from a central perspective. In many cases before this disruption really started to occur with the disruption of cloud, there was all these different types of disruption. We are now trying to decentralize and bill those influences and emissaries and the different groups within dev ops.  What is the definition of the new CISO?  The modern CISO is really going to look to embrace change management and actually have a roadmap to how they are going to embrace this change. Whether that's moving to the cloud, whether that's moving to hybrid infrastructures and looking at this in a way where it's as a positive restart for our profession and a restart for all the complexity of controls and processes and policies that we've put in place to make it something less friction to the business and realizing that we're in the business of managing risks and realizing that control frameworks are just that.  They're a framework. In many of these new paradigms and structures, the control frameworks when applicable may actually cost the business something in productivity.  Page Break  Resources:  Exabeam – <a href="https://www.exabeam.com/" rel="noopener nofollow" target="_blank">Website</a> Steve Moore – <a href="https://www.linkedin.com/in/stephenrmoore/" rel="noopener nofollow" target="_blank">LinkedIn</a> Lamont Orange – <a href="https://www.linkedin.com/in/lamont-orange-99540a/" rel="noopener nofollow" target="_blank">LinkedIn</a> Netskope – <a href="https://www.netskope.com/" rel="noopener nofollow" target="_blank">Website</a>

Securing a Cybersecurity Organization

Building an Effective Relationship with a Board Colin Anderson, Chief Information Security Officer at Levi Strauss &amp; Co sits down with Steve Moore to talk about interacting and building an effective relationship with an organization’s board, managing expectations and sharing narratives that resonate, the makeup of a board meeting, and the different personalities associated with it.    What the CISO &amp; a Board Have in Common The CISO and the board share something in common, which is to manage risk and make the business successful. However, the CISO has to earn the board's trust even when it's well established that he is the security subject matter expert.    Successful relationships must be nurtured, and this one is no different. Each board member comes to the table with a different point of view, background, expectations, and personality. Getting to know the board and how to best communicate with them is one of the CISO's top priorities.   Advice to a Younger Self The first rule is to know your board, because every board is different. Some are savvy &amp; cyber aware while others have little technology &amp; security exposure. You need to do your homework to better understand your board members' areas of expertise and experience. You want to know if any of them have had a security incidence or breach in the past, and if they have a deep understanding of security.   Another important question to ask yourself is whether you know any security leaders that have worked with some of your board members.    It's also important to know your narrative; what's the plan for your security function, how do you measure progress, and how best do you communicate and earn the trust and support from that board? I've seen a lot of leaders present in front of board committees and the most common mistake I see is the presenter not being prepared for that board audience. The presenter knows his stuff but he fails in communicating it in a way that earns the board's trust &amp; confidence.    That story-telling skill is very important because your board is going to remember the narrative you tell them. They may resonate with the statistics you put in front of them temporarily, but a few months down the road they're not going to remember the numbers. They will remember the narrative you gave, that example you crafted to emphasize the point you wanted to put across.   The Different Types of Boards There are different types of boards, where some are security savvy while others are not. Generally, they don't care, they have an IT background, or they don't. But a day of reckoning is here for them. They need to figure out and no longer be ignorant to these issues or be dismissive of them. They should know what the security department, and especially what the CISO, does.    However, the security topic with boards is relatively new and still in its infancy. They don't really know how to measure whether that security program or security leader is being effective. The NACD (National Association of Corporate Directors) has put out some pretty prescriptive guidance for boards on how to effectively manage security risk. This helps educate the board and also helps the security leader know how the board will be measuring them.   Presenting to a Board Earning your board's trust is the most important thing you can do for your long-term success as a CISO. Educate them &amp; build that partnership where you both work to manage risk to the business and enable it succeed.    The other board members bring skills and experience you don't possess, and you have skills and information they likely do not possess. They're looking at you as a subject matter expert on security to help them make more informed business decisions. So if a situation is bad &amp; there's a problem, don't be afraid to put that concerning information to your board. Don't be afraid to say that you don't have all the answers. Tell them what you're doing or what you’re not going to do &amp; why. In reality you have to make some hard choices. And that transparency gives credibility to your message and plans.   The board is relying on you based on what you think is critical or important because they may not have all the background information. Your assessment of the situation carries a lot more weight with the board.   Bringing in a 3rd Party to a Board Meeting A 3rd party can be brought in to emphasize a specific plan or concern you have. That extra voice can carry a lot of weight in some boards. The board may also bring in a 3rd party like an audit person to ask questions or give more insight on a given topic.   If another CISO is to be brought in, he needs to bring more than just the security skillset to a board to be an effective board member.   The Toughest Board Member Ever Presented to There was a telecommunications executive who had previously experienced a major security breach. He was new to the specific retail company in question and so he didn't have a really big understanding of the business. Also, he didn't fully understand that the business risk and often adversaries were quite different between retail and telecommunication companies.    He was incredibly concerned that something similar could happen at the new organization he was joining as a board member. This challenge was not solved in one meeting. It took Anderson 3-6 months of talking to this individual member. He worked on educating him on the new business, what was different and what was similar. The board member came in very concerned because of the event he had experienced. So he was not very trusting.   Getting the executive on board involved conversations in and out of the boardroom. Sometimes it was one-on-one and at other times the general counsel was present. Anderson educated him about the business, how he viewed risk and the risks he was most concerned about, and what they were doing to manage those risks. The executive brought up questions about what happened at the previous telecommunications company &amp; Anderson would share his perspectives on how he would handle a similar situation. Over time trust was built &amp; he appreciated that Anderson understood where he came from.   Building Effective Relationships  To build an effective relationship, you want to learn about the business at hand &amp; how you can help them. What are they doing &amp; how can you help? Focus on how you can be more effective for them. Security is often a support function &amp; the business leaders are the ones generating business revenue for the organization. And as a CISO you are there to help them succeed. If you can build that beneficial relationship, then it's a win-win.   Sometimes in a board meeting you may be asked questions that are not in your specific area of expertise. It may be advisable to avoid such questions. There are also some metrics you would avoid with the board. Anderson likes to present metrics that tell a story or trend, metrics that can be used to make important decisions. This is because they are relevant &amp; more aligned to the business &amp; the board will care about them. Use metrics to emphasize specific decisions you're making.   One good piece of advice is to try to think &amp; plan through the questions you're likely to get from the board based on the content you're presenting. This will lead to more success with the board.   Also, if you’re short of time to make a presentation, it's good to send your content about 1 week in advance. This way you go in with the expectation that they've read it &amp; you can focus on a few things on the presentation. But if you're really cut to very few minutes, just hit the most important points and adjust your presentation accordingly.    Anderson’s Take on Working in Levi Strauss &amp; Co Levi Strauss &amp; Co is an amazing company that attracts people that believe in a mission. The company believes in doing right. It supports the community and embraces diversity &amp; inclusion. It believes in giving back &amp; on philanthropy. It's a wonderful place to work.   Resources: Exabeam - Website Steve Moore - LinkedIn Colin Anderson - LinkedIn NACD - Website

Building an Effective Relationship with a Board Colin Anderson, Chief Information Security Officer at Levi Strauss &amp; Co sits down with Steve Moore to talk about interacting and building an effective relationship with an organization’s board, managing expectations and sharing narratives that resonate, the makeup of a board meeting, and the different personalities associated with it.  What the CISO &amp; a Board Have in Common The CISO and the board share something in common, which is to manage risk and make the business successful. However, the CISO has to earn the board's trust even when it's well established that he is the security subject matter expert.  Successful relationships must be nurtured, and this one is no different. Each board member comes to the table with a different point of view, background, expectations, and personality. Getting to know the board and how to best communicate with them is one of the CISO's top priorities. Advice to a Younger Self The first rule is to know your board, because every board is different. Some are savvy &amp; cyber aware while others have little technology &amp; security exposure. You need to do your homework to better understand your board members' areas of expertise and experience. You want to know if any of them have had a security incidence or breach in the past, and if they have a deep understanding of security. Another important question to ask yourself is whether you know any security leaders that have worked with some of your board members.  It's also important to know your narrative; what's the plan for your security function, how do you measure progress, and how best do you communicate and earn the trust and support from that board? I've seen a lot of leaders present in front of board committees and the most common mistake I see is the presenter not being prepared for that board audience. The presenter knows his stuff but he fails in communicating it in a way that earns the board's trust &amp; confidence.  That story-telling skill is very important because your board is going to remember the narrative you tell them. They may resonate with the statistics you put in front of them temporarily, but a few months down the road they're not going to remember the numbers. They will remember the narrative you gave, that example you crafted to emphasize the point you wanted to put across. The Different Types of Boards There are different types of boards, where some are security savvy while others are not. Generally, they don't care, they have an IT background, or they don't. But a day of reckoning is here for them. They need to figure out and no longer be ignorant to these issues or be dismissive of them. They should know what the security department, and especially what the CISO, does.  However, the security topic with boards is relatively new and still in its infancy. They don't really know how to measure whether that security program or security leader is being effective. The NACD (National Association of Corporate Directors) has put out some pretty prescriptive guidance for boards on how to effectively manage security risk. This helps educate the board and also helps the security leader know how the board will be measuring them. Presenting to a Board Earning your board's trust is the most important thing you can do for your long-term success as a CISO. Educate them &amp; build that partnership where you both work to manage risk to the business and enable it succeed.  The other board members bring skills and experience you don't possess, and you have skills and information they likely do not possess. They're looking at you as a subject matter expert on security to help them make more informed business decisions. So if a situation is bad &amp; there's a problem, don't be afraid to put that concerning information to your board. Don't be afraid to say that you don't have all the answers. Tell them what you're doing or what you’re not going to do &amp; why. In reality you have to make some hard choices. And that transparency gives credibility to your message and plans. The board is relying on you based on what you think is critical or important because they may not have all the background information. Your assessment of the situation carries a lot more weight with the board. Bringing in a 3rd Party to a Board Meeting A 3rd party can be brought in to emphasize a specific plan or concern you have. That extra voice can carry a lot of weight in some boards. The board may also bring in a 3rd party like an audit person to ask questions or give more insight on a given topic. If another CISO is to be brought in, he needs to bring more than just the security skillset to a board to be an effective board member. The Toughest Board Member Ever Presented to There was a telecommunications executive who had previously experienced a major security breach. He was new to the specific retail company in question and so he didn't have a really big understanding of the business. Also, he didn't fully understand that the business risk and often adversaries were quite different between retail and telecommunication companies.  He was incredibly concerned that something similar could happen at the new organization he was joining as a board member. This challenge was not solved in one meeting. It took Anderson 3-6 months of talking to this individual member. He worked on educating him on the new business, what was different and what was similar. The board member came in very concerned because of the event he had experienced. So he was not very trusting. Getting the executive on board involved conversations in and out of the boardroom. Sometimes it was one-on-one and at other times the general counsel was present. Anderson educated him about the business, how he viewed risk and the risks he was most concerned about, and what they were doing to manage those risks. The executive brought up questions about what happened at the previous telecommunications company &amp; Anderson would share his perspectives on how he would handle a similar situation. Over time trust was built &amp; he appreciated that Anderson understood where he came from. Building Effective Relationships  To build an effective relationship, you want to learn about the business at hand &amp; how you can help them. What are they doing &amp; how can you help? Focus on how you can be more effective for them. Security is often a support function &amp; the business leaders are the ones generating business revenue for the organization. And as a CISO you are there to help them succeed. If you can build that beneficial relationship, then it's a win-win. Sometimes in a board meeting you may be asked questions that are not in your specific area of expertise. It may be advisable to avoid such questions. There are also some metrics you would avoid with the board. Anderson likes to present metrics that tell a story or trend, metrics that can be used to make important decisions. This is because they are relevant &amp; more aligned to the business &amp; the board will care about them. Use metrics to emphasize specific decisions you're making. One good piece of advice is to try to think &amp; plan through the questions you're likely to get from the board based on the content you're presenting. This will lead to more success with the board. Also, if you’re short of time to make a presentation, it's good to send your content about 1 week in advance. This way you go in with the expectation that they've read it &amp; you can focus on a few things on the presentation. But if you're really cut to very few minutes, just hit the most important points and adjust your presentation accordingly.  Anderson’s Take on Working in Levi Strauss &amp; Co Levi Strauss &amp; Co is an amazing company that attracts people that believe in a mission. The company believes in doing right. It supports the community and embraces diversity &amp; inclusion. It believes in giving back &amp; on philanthropy. It's a wonderful place to work. Resources: Exabeam - <a href="https://www.exabeam.com/" rel="nofollow" target="_blank">Website</a> Steve Moore - <a href="https://www.linkedin.com/in/stephenrmoore/" rel="nofollow" target="_blank">LinkedIn</a> Colin Anderson - <a href="https://www.linkedin.com/in/colin-anderson-9bb778" rel="nofollow" target="_blank">LinkedIn</a> NACD - <a href="https://www.nacdonline.org/" rel="nofollow" target="_blank">Website</a>

Winning Over the Board

Advice To A Younger Self, Before Becoming A CISO Perfectionism can hinder the natural learning experience. As someone fresh in their career it can be hard to not want to be perfect, there are expectations to be met. Yet making mistakes and learning from them is real job experience. Don’t be afraid to take risks and fail, you’ll learn from your mistakes. Being new in your career can feel isolating, vulnerable, and flat out scary. It is okay to make mistakes, just learn from them    Gender In The Workplace Sometimes being the only woman in the class or the office can work to your advantage. Being able to provide that thought diversity can really work well for women in the workplace. Having a fresh perspective and ideas brings a well-rounded view to task at hand. Use your unique position to your advantage. As a leader you should be building a diverse, inclusive team.    Technical Expertise, Necessary Or Not Having a baseline technical knowledge will absolutely never hurt you in a cyber security career. That being said, a mix of technical knowledge and business understanding is the sweet spot for problem solving. As a CISO being able to partner with others, even other teams is pivotal to fast, effective, problem solving. Having a good knowledge of both will be most beneficial because you have a general knowledge of both the business side and the technical side. There are many ways to define the actual role of a CISO, and they will all depend on the specific company. CISOs wear a lot of hats for a lot of different companies, and they may completely differ based on the company. Yet with the new regulations rolling out around cyber security this could change soon and become more streamlined.    Company Organization And Security Burial  One of the most frustrating aspects of looking for a job in the cyber security filed can be the company organization. We are constantly bombarded with news of security and data breaches, yet some companies have their security team basically buried under other, potentially less essential teams. With the rise of data breaches and data hacking, you want to work for a company that values all you bring to the table, because this is an uphill battle when it comes to cyber security. Being valued too low in the organization can lead to internal conflict. Being able to report not only actual issues, but also the risks before it gets to the critical breaking point.    Reporting Risks In A Proactive Manner There are tons of risks with any company, being able to identify the risks before they are problems and create solutions around the specific issues at hand can save you from major issues in the future. Analyzing user behavior and seeing how negligent or risky a specific set of people are and creating solutions around that is going to really resonate with executives because it nips the problem before it becomes a problem. Talking about how the team is enabled to handle threats is another big one. Looking at the numbers of threats, seeing what could be automated, and what an analyst needed to follow up as well. Automation saves time, money, and keeps history from repeating itself.    Psychology And User Behavior  Having contextual training is so important. There are many certifications that security teams get year after year, but they have almost no impact. If the training isn’t directly relevant to the company and even the specific team there will be no impact, or even a negative impact. Prevention is key, so have the relevant training and technology, look at programs and make sure that security is built into the programs already in place. If that isn’t what is happening, then something needs to change, the programs need to be cleaned up and modernized to the potential risks surrounding it. This training will be used not just in the workplace but the teams will take this home and use it in their everyday life, almost like modern life skills.    What Being A New CISO Means To You Everything is a learning experience, being able to use the experience form your past to propel your future career. It has been really great working for a company that is 5 years old and learning new, modern ways of cyber security has been a great learning experience.    Resources:  Steve Moore: Linkedin Rinki Sethi: Linkedin Exabeam: Website Rubrik: Website

Advice To A Younger Self, Before Becoming A CISO Perfectionism can hinder the natural learning experience. As someone fresh in their career it can be hard to not want to be perfect, there are expectations to be met. Yet making mistakes and learning from them is real job experience. Don’t be afraid to take risks and fail, you’ll learn from your mistakes. Being new in your career can feel isolating, vulnerable, and flat out scary. It is okay to make mistakes, just learn from them  Gender In The Workplace Sometimes being the only woman in the class or the office can work to your advantage. Being able to provide that thought diversity can really work well for women in the workplace. Having a fresh perspective and ideas brings a well-rounded view to task at hand. Use your unique position to your advantage. As a leader you should be building a diverse, inclusive team.  Technical Expertise, Necessary Or Not Having a baseline technical knowledge will absolutely never hurt you in a cyber security career. That being said, a mix of technical knowledge and business understanding is the sweet spot for problem solving. As a CISO being able to partner with others, even other teams is pivotal to fast, effective, problem solving. Having a good knowledge of both will be most beneficial because you have a general knowledge of both the business side and the technical side. There are many ways to define the actual role of a CISO, and they will all depend on the specific company. CISOs wear a lot of hats for a lot of different companies, and they may completely differ based on the company. Yet with the new regulations rolling out around cyber security this could change soon and become more streamlined.  Company Organization And Security Burial  One of the most frustrating aspects of looking for a job in the cyber security filed can be the company organization. We are constantly bombarded with news of security and data breaches, yet some companies have their security team basically buried under other, potentially less essential teams. With the rise of data breaches and data hacking, you want to work for a company that values all you bring to the table, because this is an uphill battle when it comes to cyber security. Being valued too low in the organization can lead to internal conflict. Being able to report not only actual issues, but also the risks before it gets to the critical breaking point.  Reporting Risks In A Proactive Manner There are tons of risks with any company, being able to identify the risks before they are problems and create solutions around the specific issues at hand can save you from major issues in the future. Analyzing user behavior and seeing how negligent or risky a specific set of people are and creating solutions around that is going to really resonate with executives because it nips the problem before it becomes a problem. Talking about how the team is enabled to handle threats is another big one. Looking at the numbers of threats, seeing what could be automated, and what an analyst needed to follow up as well. Automation saves time, money, and keeps history from repeating itself.  Psychology And User Behavior  Having contextual training is so important. There are many certifications that security teams get year after year, but they have almost no impact. If the training isn’t directly relevant to the company and even the specific team there will be no impact, or even a negative impact. Prevention is key, so have the relevant training and technology, look at programs and make sure that security is built into the programs already in place. If that isn’t what is happening, then something needs to change, the programs need to be cleaned up and modernized to the potential risks surrounding it. This training will be used not just in the workplace but the teams will take this home and use it in their everyday life, almost like modern life skills.  What Being A New CISO Means To You Everything is a learning experience, being able to use the experience form your past to propel your future career. It has been really great working for a company that is 5 years old and learning new, modern ways of cyber security has been a great learning experience.  Resources:  Steve Moore: <a href="http://www.linkedin.com/in/stephenrmoore" rel="nofollow" target="_blank">Linkedin</a> Rinki Sethi: <a href="http://www.linkedin.com/in/rinkisethi" rel="nofollow" target="_blank">Linkedin</a> Exabeam: <a href="http://www.exabeam.com" rel="nofollow" target="_blank">Website</a> Rubrik: <a href="http://www.rubrik.com/en" rel="nofollow" target="_blank">Website</a>

From the 'Basement' to the Board: Giving Cybersecurity Teams Greater Visibility

Transitioning Into CISO And The Initial Challenges Becoming the head of any department, and having all that responsibility on you can be very intimidating at first. Going from more behind the scenes to front and center can be uncomfortable, but reflect back on all your experience and let that guide your decision-making. Delegation is important in leadership roles, so get the team together and put your minds together to build a great security team. Identify the top priorities for your position, focus on those, and identify what can be delegated.    Mentorship Advice To A Younger Self When you are able to put yourself in other’s shoes, you can understand their motivations and how to work well within their realm. Understanding people and their professional wants and needs can make for lasting and reliable partnerships. Being transparent with your needs can many times lead to seeing you have similar professional goals, now that both parties see the end goal they can now work together much more smoothly.  Building trust with other members of the organization before an issue arises can also make solving these issues much less intimidating in the future when something does come up that requires their attention.   Collecting Feedback &amp; Continuing Improvement The security industry is constantly in flux, so the need for continuing improvement is pivotal to the success.  Have a conversation about the constraints your team is working within. Look outside your direct colleagues, outside of your team, go to other departments and ask them the same questions you ask your team. Having a fresh set of eyes on an issue at hand can lead to progressive solutions that may have been overlooked by those directly working within security.  Moving specific test from manual to automation based can free up time and capital that may need to be invested in another area of security. The frequency of security patching may need to change, as well as the speed of the testing process. The feedback events can be so helpful, getting the organization together to solve the issues being faced. Going into these events there needs to be a focus on the problems that need solving, look to the experts in these areas, and having these conversations in-person, and if possible hosted by an outside unbiased party.    Celebrating Success Security teams face a plethora of issues and problems constantly. This is a taxing industry that takes dedication and focus to be successful in. So when there is success we need to all be better at celebrating it. Giving credit where it’s due, having conversations about the successful methods used to achieve this success, and keeping team morale high can make for a more pleasant work experience.    Resources &amp; Links: Steve Moore: Linkedin Steve Person: Linkedin Exabeam: Website Cambia Health Solutions: Website Speed Of Trust Book: Website

Transitioning Into CISO And The Initial Challenges Becoming the head of any department, and having all that responsibility on you can be very intimidating at first. Going from more behind the scenes to front and center can be uncomfortable, but reflect back on all your experience and let that guide your decision-making. Delegation is important in leadership roles, so get the team together and put your minds together to build a great security team. Identify the top priorities for your position, focus on those, and identify what can be delegated.  Mentorship Advice To A Younger Self When you are able to put yourself in other’s shoes, you can understand their motivations and how to work well within their realm. Understanding people and their professional wants and needs can make for lasting and reliable partnerships. Being transparent with your needs can many times lead to seeing you have similar professional goals, now that both parties see the end goal they can now work together much more smoothly.  Building trust with other members of the organization before an issue arises can also make solving these issues much less intimidating in the future when something does come up that requires their attention. Collecting Feedback &amp; Continuing Improvement The security industry is constantly in flux, so the need for continuing improvement is pivotal to the success.  Have a conversation about the constraints your team is working within. Look outside your direct colleagues, outside of your team, go to other departments and ask them the same questions you ask your team. Having a fresh set of eyes on an issue at hand can lead to progressive solutions that may have been overlooked by those directly working within security.  Moving specific test from manual to automation based can free up time and capital that may need to be invested in another area of security. The frequency of security patching may need to change, as well as the speed of the testing process. The feedback events can be so helpful, getting the organization together to solve the issues being faced. Going into these events there needs to be a focus on the problems that need solving, look to the experts in these areas, and having these conversations in-person, and if possible hosted by an outside unbiased party.  Celebrating Success Security teams face a plethora of issues and problems constantly. This is a taxing industry that takes dedication and focus to be successful in. So when there is success we need to all be better at celebrating it. Giving credit where it’s due, having conversations about the successful methods used to achieve this success, and keeping team morale high can make for a more pleasant work experience.  Resources &amp; Links: Steve Moore: <a href="http://www.linkedin.com/in/stephenrmoore/" rel="nofollow" target="_blank">Linkedin</a> Steve Person: <a href="http://www.linkedin.com/in/cisosteve/" rel="nofollow" target="_blank">Linkedin</a> Exabeam: <a href="http://www.exabeam.com" rel="nofollow" target="_blank">Website</a> Cambia Health Solutions: <a href="http://www.cambiahealth.com" rel="nofollow" target="_blank">Website</a> Speed Of Trust Book: <a href="http://www.speedoftrust.com" rel="nofollow" target="_blank">Website</a>

Lessons in Leadership: Taking a Step back and Learning to Trust the Experts on Your Team.mp3

Contributing to the Cybersecurity Community Scott Morris, Vice President, Chief Information Security Officer at BlueCross BlueShield Western New York sits down to talk to Steve Moore about how to be active on cybersecurity communities. They  talk about how to encourage young security professionals to find their voice, and the importance of sharing information as a means of strengthening the industry as a whole.   What Advice Would You Have for Your Younger Self? I'm not one to really hold regrets or look back at the past, but I would say I've always pursued the uncomfortable things. I always try to find things to solve or problems I could help with, which is how I got around in the day. So always challenge yourself and make sure that you always make the right choices. I would tell my younger self to continue pushing.   What Was Your Actual Start in InfoSec? My starting point was in information technology, more importantly in web development. I used to be a web developer by trade &amp; quickly came to understand the risks involved in that. I continued to grow in my information security knowledge &amp; experience, and for a while I was an expert in my former organization. And then I grew from there with a keen desire to know as much as I can and to help as much as I can in information security. Through observation &amp; conversation, Steve Moore has come to realize that some of the best people in InfoSec didn't actually start off in it. You kind of have to learn to build and create things and ultimately break them before you can know how to defend and protect them. And this is a great foundation As I look back on my career, I recently realized that even from the early days and in previous organizations, I've never actually applied for a position; I've always somewhat in a way created the position. And I did that by finding areas or things that needed to be solved or fixed and made better. In my current organization for example, we had an issue where we were having problems passing or being consistently good in our external audits. I took that on and turned it around, and through that exposure in a very diverse organization, I was able to start piecing together some of the things we needed to get where we are today and build the successful security program we have in place.   Any Tips for Someone Getting Ready to Do What You've Done? The answer is something I tell all of my team members today. For the most part, what we do is not something we're responsible for and we can successfully build respect and great relationships. You need to understand your controllers and the people responsible for these processes and functions and build a relationship with them to help move things forward.   How Did You Get Involved in Security Communities? At my previous role, I worked for a large consulting company and I had a very large community. But I realized that I needed to have more exposure outside of that. So I started turning to people and organizations locally around here. But there weren’t security communities back then; there were more technology communities. So getting involved with technology organizations was my entry point. I was hooked immediately and continued to grow &amp; expand to where I am today.   What Do You Think is the Responsibility of Security Leaders? As a leader, I think it's really important to set an example. I try to do the best I can by participating in these communities in various ways by not only attending it but by being a part of it, being an action and a voice within these communities, and by bringing my teams along and the people that are in this space. As leaders we have a responsibility to continue driving that. In Buffalo we are a pretty small community and we leverage those conduits and forms to continue to grow and vet out what we're doing. So lead by example, participate and the teams will come along.   What Benefits/Changes Have You Seen in the Junior Staff in the Buffalo Area? In Blue Cross Blue Shield, we are fortunate to have a robust and talented security department, and not a lot of people especially in Buffalo or other small organizations have that. So we push out there and continue with what we're doing. And this helps a lot of people get past those first few layers with decisions and choices if they can hear from a trusted source. And frankly those conversations help us as well as we continue to share our experiences with the community not only in Buffalo but across the nation. We try to present topics that we feel others can learn from and we get great feedback by sharing the experiences we've had, and especially the lessons learned.   What Do You Share? Two of our primary outlets for that is first ,within the Blue Cross Blue Shield community where we have more than 30 organizations, and we tend to share things within that trusted community quite often. We're also a huge proponent and a member of Hysek, and that's been a tremendous value for information sharing across healthcare organizations and other places as well. In my team, we encourage participation and often times the exact conversation we’ve had is centered around ‘what value can I add?’, ‘why would someone listen to me?’ And through that we hope people can realize how important their message is because there's always an audience for that. So for a young leader, professional, or analyst trying to get involved, I would advise him to not undermine or underestimate himself and the power of his voice and message. And instead get involved with the people of that community. Organizations and groups are always looking for topics and people want to listen and are genuine about it. And they'll give you the feedback you need to help you grow. Getting comfortable presenting in front of an audience is important for a leader, so for anyone listening that should be your goal. It makes you a better leader in the long run. It takes practice and one resource people should take advantage of is Toastmasters. It's a wonderful opportunity and gives you an established and well trusted forum to horn your skills at public speaking. Most of my team members go through it.   What Did You Learn at Toastmasters that Helped You the Most? The first time I did Toastmasters, I got really confident about what I was talking about. They give you very candid feedback at the end, and I think I broke a record for how many 'umhs' I said, although I thought I said 3 or 4. But it was eye opening and gave me something to move forward with. The best feedback I got from them that helped me grow was to just own what you are saying, knowing that you know the most about what you're talking about. And be confident at what you're doing. That's going to make a world of difference from how your presentation comes off.   What has Changed in Security Communities Over the Years? Back when I started, there was little to know on cybersecurity community. But now you can't move around the corner without finding some kind of group that's wanting to talk about it. I recently had a conversation with a number of CISOs last week, and we're finding that these communities or groups are actually struggling because everyone is so busy trying to protect their organizations and move forward. So I'm starting to see a little bit of downward trend in these things. People don't seem to have the bandwidth to keep these things going. And so we need more people who are passionate about keeping the organizations going, keeping the topic going, and moving those things forward to make sure we continue to have this amazing opportunity to participate and share information.   What’s the One Thing You Could Eliminate from Security Communities? I won't say there's one overarching thing I would want to remove because the communities don’t have the same problems. But I think we need to make sure that the level of entitlement is kind of tapered, because some of these communities get far ahead of themselves or become too exclusive. And these can start to create negative connotations to what we're trying to do. So keeping it open, ethical, and moving everything forward in the best interests of the people who are part of these communities is the important thing to keeping mind. In every community, take the best you can from it and continue to build on that and everything will come around.   How Do You Choose Which Security Community to Be Involved In? I think it's about setting the proper expectations for yourself and in some cases the people in that community. Also make sure the community is not there just for the party or the vendor sponsor, but to learn. Once you attend one, I think you can pretty well determine if it's just a party so to speak, or if it's really there for an opportunity. It's all about what you make out of it. As a leader at some point you have to give up those spots &amp; invite someone else, and as you grow you'll get more invites and be more well-known and influential. In every community, take the best you can from it and continue to build on that and everything will come around. In my case I'm lucky because I have a great team that wants to be involved and it’s not me pulling them along. They're very eager &amp; outgoing in that nature of getting involved and we all share that mission together.   Is There a Measured Outcome? One of our metrics is our participation in events in the community across the department. We track how often we do that and report to our board of directors. We have a very supportive leadership helping the community in any capacity, whether in cybersecurity or someone who could be affected by it. We also use the information, the conversations and networks that we build to help enhance our cyber strategy as we go forward. We use our cyber experience to help the broader community - employees, our members, providers, and brokers. We do what we can to get out and socialize and help them understand and benefit from the information we have to help protect themselves. This is something our organization feels strongly about.    Resources: Exabeam - Website Steve Moore - LinkedIn Scott Morris  - LinkedIn BlueCross BlueShield - Website

Contributing to the Cybersecurity Community Scott Morris, Vice President, Chief Information Security Officer at BlueCross BlueShield Western New York sits down to talk to Steve Moore about how to be active on cybersecurity communities. They  talk about how to encourage young security professionals to find their voice, and the importance of sharing information as a means of strengthening the industry as a whole. What Advice Would You Have for Your Younger Self? I'm not one to really hold regrets or look back at the past, but I would say I've always pursued the uncomfortable things. I always try to find things to solve or problems I could help with, which is how I got around in the day. So always challenge yourself and make sure that you always make the right choices. I would tell my younger self to continue pushing. What Was Your Actual Start in InfoSec? My starting point was in information technology, more importantly in web development. I used to be a web developer by trade &amp; quickly came to understand the risks involved in that. I continued to grow in my information security knowledge &amp; experience, and for a while I was an expert in my former organization. And then I grew from there with a keen desire to know as much as I can and to help as much as I can in information security. Through observation &amp; conversation, Steve Moore has come to realize that some of the best people in InfoSec didn't actually start off in it. You kind of have to learn to build and create things and ultimately break them before you can know how to defend and protect them. And this is a great foundation As I look back on my career, I recently realized that even from the early days and in previous organizations, I've never actually applied for a position; I've always somewhat in a way created the position. And I did that by finding areas or things that needed to be solved or fixed and made better. In my current organization for example, we had an issue where we were having problems passing or being consistently good in our external audits. I took that on and turned it around, and through that exposure in a very diverse organization, I was able to start piecing together some of the things we needed to get where we are today and build the successful security program we have in place. Any Tips for Someone Getting Ready to Do What You've Done? The answer is something I tell all of my team members today. For the most part, what we do is not something we're responsible for and we can successfully build respect and great relationships. You need to understand your controllers and the people responsible for these processes and functions and build a relationship with them to help move things forward. How Did You Get Involved in Security Communities? At my previous role, I worked for a large consulting company and I had a very large community. But I realized that I needed to have more exposure outside of that. So I started turning to people and organizations locally around here. But there weren’t security communities back then; there were more technology communities. So getting involved with technology organizations was my entry point. I was hooked immediately and continued to grow &amp; expand to where I am today. What Do You Think is the Responsibility of Security Leaders? As a leader, I think it's really important to set an example. I try to do the best I can by participating in these communities in various ways by not only attending it but by being a part of it, being an action and a voice within these communities, and by bringing my teams along and the people that are in this space. As leaders we have a responsibility to continue driving that. In Buffalo we are a pretty small community and we leverage those conduits and forms to continue to grow and vet out what we're doing. So lead by example, participate and the teams will come along. What Benefits/Changes Have You Seen in the Junior Staff in the Buffalo Area? In Blue Cross Blue Shield, we are fortunate to have a robust and talented security department, and not a lot of people especially in Buffalo or other small organizations have that. So we push out there and continue with what we're doing. And this helps a lot of people get past those first few layers with decisions and choices if they can hear from a trusted source. And frankly those conversations help us as well as we continue to share our experiences with the community not only in Buffalo but across the nation. We try to present topics that we feel others can learn from and we get great feedback by sharing the experiences we've had, and especially the lessons learned. What Do You Share? Two of our primary outlets for that is first ,within the Blue Cross Blue Shield community where we have more than 30 organizations, and we tend to share things within that trusted community quite often. We're also a huge proponent and a member of Hysek, and that's been a tremendous value for information sharing across healthcare organizations and other places as well. In my team, we encourage participation and often times the exact conversation we’ve had is centered around ‘what value can I add?’, ‘why would someone listen to me?’ And through that we hope people can realize how important their message is because there's always an audience for that. So for a young leader, professional, or analyst trying to get involved, I would advise him to not undermine or underestimate himself and the power of his voice and message. And instead get involved with the people of that community. Organizations and groups are always looking for topics and people want to listen and are genuine about it. And they'll give you the feedback you need to help you grow. Getting comfortable presenting in front of an audience is important for a leader, so for anyone listening that should be your goal. It makes you a better leader in the long run. It takes practice and one resource people should take advantage of is Toastmasters. It's a wonderful opportunity and gives you an established and well trusted forum to horn your skills at public speaking. Most of my team members go through it. What Did You Learn at Toastmasters that Helped You the Most? The first time I did Toastmasters, I got really confident about what I was talking about. They give you very candid feedback at the end, and I think I broke a record for how many 'umhs' I said, although I thought I said 3 or 4. But it was eye opening and gave me something to move forward with. The best feedback I got from them that helped me grow was to just own what you are saying, knowing that you know the most about what you're talking about. And be confident at what you're doing. That's going to make a world of difference from how your presentation comes off. What has Changed in Security Communities Over the Years? Back when I started, there was little to know on cybersecurity community. But now you can't move around the corner without finding some kind of group that's wanting to talk about it. I recently had a conversation with a number of CISOs last week, and we're finding that these communities or groups are actually struggling because everyone is so busy trying to protect their organizations and move forward. So I'm starting to see a little bit of downward trend in these things. People don't seem to have the bandwidth to keep these things going. And so we need more people who are passionate about keeping the organizations going, keeping the topic going, and moving those things forward to make sure we continue to have this amazing opportunity to participate and share information. What’s the One Thing You Could Eliminate from Security Communities? I won't say there's one overarching thing I would want to remove because the communities don’t have the same problems. But I think we need to make sure that the level of entitlement is kind of tapered, because some of these communities get far ahead of themselves or become too exclusive. And these can start to create negative connotations to what we're trying to do. So keeping it open, ethical, and moving everything forward in the best interests of the people who are part of these communities is the important thing to keeping mind. In every community, take the best you can from it and continue to build on that and everything will come around. How Do You Choose Which Security Community to Be Involved In? I think it's about setting the proper expectations for yourself and in some cases the people in that community. Also make sure the community is not there just for the party or the vendor sponsor, but to learn. Once you attend one, I think you can pretty well determine if it's just a party so to speak, or if it's really there for an opportunity. It's all about what you make out of it. As a leader at some point you have to give up those spots &amp; invite someone else, and as you grow you'll get more invites and be more well-known and influential. In every community, take the best you can from it and continue to build on that and everything will come around. In my case I'm lucky because I have a great team that wants to be involved and it’s not me pulling them along. They're very eager &amp; outgoing in that nature of getting involved and we all share that mission together. Is There a Measured Outcome? One of our metrics is our participation in events in the community across the department. We track how often we do that and report to our board of directors. We have a very supportive leadership helping the community in any capacity, whether in cybersecurity or someone who could be affected by it. We also use the information, the conversations and networks that we build to help enhance our cyber strategy as we go forward. We use our cyber experience to help the broader community - employees, our members, providers, and brokers. We do what we can to get out and socialize and help them understand and benefit from the information we have to help protect themselves. This is something our organization feels strongly about.  Resources: Exabeam - <a href="https://www.exabeam.com/" rel="nofollow" target="_blank">Website</a> Steve Moore - <a href="https://www.linkedin.com/in/stephenrmoore/" rel="nofollow" target="_blank">LinkedIn</a> Scott Morris  - <a href="https://www.linkedin.com/in/morrisesquire/" rel="nofollow" target="_blank">LinkedIn</a> BlueCross BlueShield - <a href="https://www.bcbswny.com/" rel="nofollow" target="_blank">Website</a>

Contributing to the Cybersecurity Community

Does Security Training Really Work? David Tyburski, Chief Information Security Officer at Wynn Resort sits down to talk to Steve Moore about security training, specifically phishing training. He shares his thoughts on the idea of training vs education, positive vs negative reinforcement, and offers suggestions for engaging with employees.   David Tyburski’s Current Role I'm currently the global CISO for Wynn Resort, a casino in the north end strip in Las Vegas. About 9 years ago, Wynn put a directive to have a more dedicated security focus in on the environment in the organization. They basically handed it to me and for the last nine and a half years I have run this organization building it from just me to the organization it is today, managing all their properties &amp; operations worldwide.   What Advice Would You Give Your Younger Self? One thing I would say is to be a little more attentive to the tool-set you bring, because we did a lot of false starts along the way as far as buying tools. If we'd spent a little more time evaluating where we could really use them, we would have been in a better position in the early days. And we do that today by ensuring we have good proper use of cases for every tool that we bring. Also, I'd tell my younger self to spend more time on the use case to know how to use it instead of just going to get it. Understand not just the reason why you want it, but how you will use it and what you expect from it.   What Bothers You About Phishing Training? It's not necessarily all phishing training, but what bothers me is that we're attempting to teach non-security professionals to be security professionals. They have backgrounds that are varied from us, they don't spend their time looking at security incidences or reading on security articles, but they're extremely talented people in other ways. They do an amazing job at what they do. But we as security professionals try to teach them that they've got to know what we know. So I think security professionals need to do a better job of understanding their role in the business, and building a technology solution around that instead of trying to get them to understand their business. Training vs Education There's a major difference between training &amp; education. Wynn is an education program, because we're not training people but educating them. We want to give them the security knowledge and information they need for their organizations. We're educating people, trying to give them knowledge and not just teaching them the steps to accomplish something. We have to be able to transfer knowledge, and that's an education program. We have a continuous education program. We break up the topics and put them into small easy to digest chunks and we continuously run a new topic every week. It's timely and we do everything we can to relate it to everyday life. People are like water and will always try to take the path of least resistance. So in that light, if we can make our security program and educate our people in the right way, that the security of the organization is the path of least resistance, then it's no longer security fighting the rest of the business but security enabling the entire business to operate.   Should Information Security Be More Aggressive with Email Attachments? For an HR person whose job is recruiting, he needs to open the resumes he receives as attachments to emails. So how does information security help or enable that process and allow the person do the job safely? One way we can do this is to intercept the email, pull the attachment out, and re-write it in our own PDF where we turn off all the problematic ability and take out any possibility of weaponization, restrict what that PDF can do and look like, bundle it up and put it back in the email and send it off to the recipient. Now we won’t mind if the HR person opens it because it's safe.  So to them they simply open the resumes the way they need to open them. They're doing their job and we're enabling it, but we're also protecting them from all the weaponization problems that could come along with emails and attachments.   Good Security Programs If you bring in negative reinforcement in your organization, it will only go so far. If your objective is to reduce malware in your environment or reduce that phishing problem, then training people the way we seem to want to do is a negative reinforcement model. You may end up frightening employees to the extent that they're not willing to take the risk. So it's important to find a better way to bring that into your organization so that employees do their job of generating revenue and doing good things for the business. Employees also need to have a way to communicate back both positive &amp; negative feedback- did it work or not, what slipped through and what did we not recognize? Any good security program is not dependent on one single item. You need to have multiple places to protect the same thing. So if we're eliminating 99.99% of phishing &amp; malware coming through email by rewriting attachments, then what slipped through &amp; why? What was that new technique the hacker used, what is that new thing that we haven't accounted for? That's what we need to focus on. One of the things we push out for in our education program is the open door policy. A lot of companies have it but how many line level employees are comfortable picking up the phone &amp; talking to the CFO? Probably not a lot. But in this organization we have made that an absolutely acceptable act and the CFO is responsive to it and is on board. Therefore, you involve everyone so that the entire organization is working towards that same goal. Security becomes a lot easier because you have allies helping you do it as opposed to shadow security.   What Other Things Can We Do? One other thing I do a lot is what I call evangelist activities. I go sit with the business and not just the managers or directors of the business, but actually line level employees. I have conversations with them, eat lunch with them, talk to them in their own environments, sit with the project team, the gaming people, their sales people, sit and learn their jobs for a day and get a better understanding of their work. I do these things regularly so that they can build trust in the program and in me to have an open line of communication. How can we help them do their job better? We want to be able to bring them into our world and enhance collaboration. Also, if you look at a lot of the primary activities of any user in any organization, two of the biggest things that the end user is going to deal with are:  email attachments browsing the web  So I would advise security professionals to investigate browsing installation platforms. Understand that it's not just about rewriting docs and emails and things that are inbound to the organization but also the outbound activities of the user like exploring the web. Do You Think Information Security as a Whole Has a Problem I think every organization is different, every CISO is different and company cultures are different. I think information security has to adapt to that within their organization and promote the change that's necessary. We do get a bad rap in some cases because sometimes we have to say ‘No’, but I think some organizations take that to the extreme. Therefore, it's all about building a culture for your organization. What works for Wynn may not work in another organization. But if you understand the business &amp; the people, and your objective is to enable the business’ safety and working towards those goals, I don't see how you could go wrong. The idea that you only tell someone what they can't do and never tell them what they can do is a wrong position.   Resources: Exabeam - Website SentinelOne - Website Steve Moore - LinkedIn David Tyburski  - LinkedIn Wynn Resort - Website

Does Security Training Really Work? David Tyburski, Chief Information Security Officer at Wynn Resort sits down to talk to Steve Moore about security training, specifically phishing training. He shares his thoughts on the idea of training vs education, positive vs negative reinforcement, and offers suggestions for engaging with employees. David Tyburski’s Current Role I'm currently the global CISO for Wynn Resort, a casino in the north end strip in Las Vegas. About 9 years ago, Wynn put a directive to have a more dedicated security focus in on the environment in the organization. They basically handed it to me and for the last nine and a half years I have run this organization building it from just me to the organization it is today, managing all their properties &amp; operations worldwide. What Advice Would You Give Your Younger Self? One thing I would say is to be a little more attentive to the tool-set you bring, because we did a lot of false starts along the way as far as buying tools. If we'd spent a little more time evaluating where we could really use them, we would have been in a better position in the early days. And we do that today by ensuring we have good proper use of cases for every tool that we bring. Also, I'd tell my younger self to spend more time on the use case to know how to use it instead of just going to get it. Understand not just the reason why you want it, but how you will use it and what you expect from it. What Bothers You About Phishing Training? It's not necessarily all phishing training, but what bothers me is that we're attempting to teach non-security professionals to be security professionals. They have backgrounds that are varied from us, they don't spend their time looking at security incidences or reading on security articles, but they're extremely talented people in other ways. They do an amazing job at what they do. But we as security professionals try to teach them that they've got to know what we know. So I think security professionals need to do a better job of understanding their role in the business, and building a technology solution around that instead of trying to get them to understand their business. Training vs Education There's a major difference between training &amp; education. Wynn is an education program, because we're not training people but educating them. We want to give them the security knowledge and information they need for their organizations. We're educating people, trying to give them knowledge and not just teaching them the steps to accomplish something. We have to be able to transfer knowledge, and that's an education program. We have a continuous education program. We break up the topics and put them into small easy to digest chunks and we continuously run a new topic every week. It's timely and we do everything we can to relate it to everyday life. People are like water and will always try to take the path of least resistance. So in that light, if we can make our security program and educate our people in the right way, that the security of the organization is the path of least resistance, then it's no longer security fighting the rest of the business but security enabling the entire business to operate. Should Information Security Be More Aggressive with Email Attachments? For an HR person whose job is recruiting, he needs to open the resumes he receives as attachments to emails. So how does information security help or enable that process and allow the person do the job safely? One way we can do this is to intercept the email, pull the attachment out, and re-write it in our own PDF where we turn off all the problematic ability and take out any possibility of weaponization, restrict what that PDF can do and look like, bundle it up and put it back in the email and send it off to the recipient. Now we won’t mind if the HR person opens it because it's safe.  So to them they simply open the resumes the way they need to open them. They're doing their job and we're enabling it, but we're also protecting them from all the weaponization problems that could come along with emails and attachments. Good Security Programs If you bring in negative reinforcement in your organization, it will only go so far. If your objective is to reduce malware in your environment or reduce that phishing problem, then training people the way we seem to want to do is a negative reinforcement model. You may end up frightening employees to the extent that they're not willing to take the risk. So it's important to find a better way to bring that into your organization so that employees do their job of generating revenue and doing good things for the business. Employees also need to have a way to communicate back both positive &amp; negative feedback- did it work or not, what slipped through and what did we not recognize? Any good security program is not dependent on one single item. You need to have multiple places to protect the same thing. So if we're eliminating 99.99% of phishing &amp; malware coming through email by rewriting attachments, then what slipped through &amp; why? What was that new technique the hacker used, what is that new thing that we haven't accounted for? That's what we need to focus on. One of the things we push out for in our education program is the open door policy. A lot of companies have it but how many line level employees are comfortable picking up the phone &amp; talking to the CFO? Probably not a lot. But in this organization we have made that an absolutely acceptable act and the CFO is responsive to it and is on board. Therefore, you involve everyone so that the entire organization is working towards that same goal. Security becomes a lot easier because you have allies helping you do it as opposed to shadow security. What Other Things Can We Do? One other thing I do a lot is what I call evangelist activities. I go sit with the business and not just the managers or directors of the business, but actually line level employees. I have conversations with them, eat lunch with them, talk to them in their own environments, sit with the project team, the gaming people, their sales people, sit and learn their jobs for a day and get a better understanding of their work. I do these things regularly so that they can build trust in the program and in me to have an open line of communication. How can we help them do their job better? We want to be able to bring them into our world and enhance collaboration. Also, if you look at a lot of the primary activities of any user in any organization, two of the biggest things that the end user is going to deal with are: <ol> <li>email attachments</li> <li>browsing the web</li> </ol> So I would advise security professionals to investigate browsing installation platforms. Understand that it's not just about rewriting docs and emails and things that are inbound to the organization but also the outbound activities of the user like exploring the web. Do You Think Information Security as a Whole Has a Problem I think every organization is different, every CISO is different and company cultures are different. I think information security has to adapt to that within their organization and promote the change that's necessary. We do get a bad rap in some cases because sometimes we have to say ‘No’, but I think some organizations take that to the extreme. Therefore, it's all about building a culture for your organization. What works for Wynn may not work in another organization. But if you understand the business &amp; the people, and your objective is to enable the business’ safety and working towards those goals, I don't see how you could go wrong. The idea that you only tell someone what they can't do and never tell them what they can do is a wrong position. Resources: Exabeam - <a href="https://www.exabeam.com/" rel="nofollow" target="_blank">Website</a> SentinelOne - <a href="https://www.sentinelone.com/" rel="nofollow" target="_blank">Website</a> Steve Moore - <a href="https://www.linkedin.com/in/stephenrmoore/" rel="nofollow" target="_blank">LinkedIn</a> David Tyburski  - <a href="https://www.linkedin.com/in/dtyburski" rel="nofollow" target="_blank">LinkedIn</a> Wynn Resort - <a href="https://www.wynnlasvegas.com/" rel="nofollow" target="_blank">Website</a>

Does Security Training Really Work? 

Taking The Jump From Consulting &amp; Advice To A Younger Self With consulting you have the opportunity to work with multiple large companies, which can be an attractive aspect of the job. Working with multiple companies on that scale can introduce you to the latest technology and how it works differently for different companies. That being said, if you want to build a team from the ground up a transition from consulting might be best for you. Also if you’re looking to partner, or gain any ownership in a company, consulting may not be your best bet. Develop relationships while in the consulting position to really feel out where you want to be, and then you’ll already be a familiar face when you’re looking to be hired on at a company.  Participating in networking groups is a great way to meet peers and other relevant connections you may want to utilize in the future. Just making sure that you are prioritizing your time and energy effectively can keep burnout at bay as well, focus on what you really want to achieve and walk down that path. Making these connections and being empathetic about others positions can really help advance your career, try to put yourself in others’ shoes when making these connections.    Tying Success To Business Risk Being able to make an impact with the way you communicate requires empathy. To be an effective communicator you must be able to put yourself in the position of the other higher executives including CEOs, CFOs, and other critical positions. If you cannot relay information to them in a format they relate to, the problem could be a crisis just by the loss of time on trying to communicate.  For some businesses security has always been a priority, yet for many other depending on the industry, security is only now coming to the forefront as a priority. Security teams need support, investment, and visibility. That is where those communication skills come in, present the value of the security team to other executives in a way the will relate to.    Beyond Compliance Having up-to-date certifications and technology will only work in your favor as a security team, but you cannot stop there, certifications alone will not stop negative issues from arising. There needs to be both efficiency and maturity working in tandem. There is compliance, which offers your team a framework to then build upon to meet your specific needs. Compliance does not guarantee that your company is 100% protected against negative events; it is a critical element, although not the only element. Identify what the real risk factors are within your company and view security as an ongoing process. Educate the executive leadership on the independent testing results and findings and how your team has shifted to deal with these real risk factors that are beyond compliance. Being a new and effective CISO means not only being technical, but also in-tune with the current needs of the industry by communicating in an empathetic way.   Resources: Steve Moore: Linkedin Marzena Fuller: Linkedin Exabeam: Website CISCO: Website

Taking The Jump From Consulting &amp; Advice To A Younger Self With consulting you have the opportunity to work with multiple large companies, which can be an attractive aspect of the job. Working with multiple companies on that scale can introduce you to the latest technology and how it works differently for different companies. That being said, if you want to build a team from the ground up a transition from consulting might be best for you. Also if you’re looking to partner, or gain any ownership in a company, consulting may not be your best bet. Develop relationships while in the consulting position to really feel out where you want to be, and then you’ll already be a familiar face when you’re looking to be hired on at a company.  Participating in networking groups is a great way to meet peers and other relevant connections you may want to utilize in the future. Just making sure that you are prioritizing your time and energy effectively can keep burnout at bay as well, focus on what you really want to achieve and walk down that path. Making these connections and being empathetic about others positions can really help advance your career, try to put yourself in others’ shoes when making these connections.  Tying Success To Business Risk Being able to make an impact with the way you communicate requires empathy. To be an effective communicator you must be able to put yourself in the position of the other higher executives including CEOs, CFOs, and other critical positions. If you cannot relay information to them in a format they relate to, the problem could be a crisis just by the loss of time on trying to communicate.  For some businesses security has always been a priority, yet for many other depending on the industry, security is only now coming to the forefront as a priority. Security teams need support, investment, and visibility. That is where those communication skills come in, present the value of the security team to other executives in a way the will relate to.  Beyond Compliance Having up-to-date certifications and technology will only work in your favor as a security team, but you cannot stop there, certifications alone will not stop negative issues from arising. There needs to be both efficiency and maturity working in tandem. There is compliance, which offers your team a framework to then build upon to meet your specific needs. Compliance does not guarantee that your company is 100% protected against negative events; it is a critical element, although not the only element. Identify what the real risk factors are within your company and view security as an ongoing process. Educate the executive leadership on the independent testing results and findings and how your team has shifted to deal with these real risk factors that are beyond compliance. Being a new and effective CISO means not only being technical, but also in-tune with the current needs of the industry by communicating in an empathetic way. Resources: Steve Moore: <a href="http://www.linkedin.com/stephenrmoore/" rel="nofollow" target="_blank">Linkedin</a> Marzena Fuller: <a href="http://www.linkedin.com/in/marzenafuller/" rel="nofollow" target="_blank">Linkedin</a> Exabeam: <a href="http://www.exabeam.com" rel="nofollow" target="_blank">Website</a> CISCO: <a href="http://www.cisco.com" rel="nofollow" target="_blank">Website</a>

How Do You Measure the Success of Your Cybersecurity Program?

Building A Relationship With Other Teams The sooner these relationships can be built, the better. Meeting top executives and other team leads during a crisis is less than ideal. Get to know the people that are closer to the consumer, the writers, the social media managers, the sooner this relationship is established the better the partnership is when you need to come together in a crisis. Building those relationships now build trust within the company as a whole.    Where To Begin? Every company is different and stepping into the role of CISO will be different depending on the specific needs of those companies. Asking to be introduced to the executives, team leads, and other specific roles when you are first hired on or even during the interview process can put you on their radar from the beginning. Asking questions to your direct contacts and your direct team is a great way to feel out which individuals you need to meet and in what order.    Generating A Safe Statement Before The Problem Arises The language used in a crisis response as well as the speed of the response are critical components of how the public will perceive the company.  Having pre-written general responses that can essentially be “fill in the blank” templates for a variety of problems can get that statement out as soon as possible. This speed of response can help the company change the narrative of the situation at hand. Adopting this kind of proactive approach will not only build trust between the teams before a crisis, but will change the way consumers view your company.    Early Career Advice Doing research into the companies you’ll be interviewing with can help you find the right workplace that aligns with your personal ethos. Seeking out companies that are known for doing meaningful work, have good workplace morale, and align with you can greatly boost your career drive. Start by defining what is important to you and find companies with similar missions.    Empathy And Care In The Workplace Building a strong workplace culture around your ethos will change the way you view working. Getting to know the lives of your colleagues and showing genuine interest in their well-being can build a web of trust. Carve out time where anyone from your team can come to, have an open door policy for these times and let them come to you for any reason. Building a team with members that have a strong sense of protection that bleeds out into all aspects of their lives are the individuals that are going to push your company forward.    What Being A New CISO Means Being reliable, patient, and having a broad understanding of personal and business acumen. Being able to stand up for your principles and provide servant leadership for those who look to you on a daily basis.    Resources:  Steve Moore: Linkedin Kirsten Davies: Linkedin Exabeam: Website Estee Lauder: Website

Building A Relationship With Other Teams The sooner these relationships can be built, the better. Meeting top executives and other team leads during a crisis is less than ideal. Get to know the people that are closer to the consumer, the writers, the social media managers, the sooner this relationship is established the better the partnership is when you need to come together in a crisis. Building those relationships now build trust within the company as a whole.  Where To Begin? Every company is different and stepping into the role of CISO will be different depending on the specific needs of those companies. Asking to be introduced to the executives, team leads, and other specific roles when you are first hired on or even during the interview process can put you on their radar from the beginning. Asking questions to your direct contacts and your direct team is a great way to feel out which individuals you need to meet and in what order.  Generating A Safe Statement Before The Problem Arises The language used in a crisis response as well as the speed of the response are critical components of how the public will perceive the company.  Having pre-written general responses that can essentially be “fill in the blank” templates for a variety of problems can get that statement out as soon as possible. This speed of response can help the company change the narrative of the situation at hand. Adopting this kind of proactive approach will not only build trust between the teams before a crisis, but will change the way consumers view your company.  Early Career Advice Doing research into the companies you’ll be interviewing with can help you find the right workplace that aligns with your personal ethos. Seeking out companies that are known for doing meaningful work, have good workplace morale, and align with you can greatly boost your career drive. Start by defining what is important to you and find companies with similar missions.  Empathy And Care In The Workplace Building a strong workplace culture around your ethos will change the way you view working. Getting to know the lives of your colleagues and showing genuine interest in their well-being can build a web of trust. Carve out time where anyone from your team can come to, have an open door policy for these times and let them come to you for any reason. Building a team with members that have a strong sense of protection that bleeds out into all aspects of their lives are the individuals that are going to push your company forward.  What Being A New CISO Means Being reliable, patient, and having a broad understanding of personal and business acumen. Being able to stand up for your principles and provide servant leadership for those who look to you on a daily basis.  Resources:  Steve Moore: <a href="http://www.linkedin.com/stephenrmoore/" rel="nofollow" target="_blank">Linkedin</a> Kirsten Davies: <a href="http://www.linkedin.com/in/kirstendavies/" rel="nofollow" target="_blank">Linkedin</a> Exabeam: <a href="http://www.exabeam.com" rel="nofollow" target="_blank">Website</a> Estee Lauder: <a href="http://www.esteelauder.com" rel="nofollow" target="_blank">Website</a>

How Emotional Intelligence Fortifies Capability In the Midst of A Crisis

Remote

Building Up To A Position Of Power Holding the dual position of CTO/CISO needs to come with a lot of experience and drive. Being able to build the security organization around the needs of the company led to being both the Chief Technology Officer as well as Chief Information Security Officer. Noticing what was interfering with the safety of the company through passive observation has directly played into both roles. Doing research, having conversations, and interacting with other people are all examples of seemingly passive observations.    Advice To A Younger Self A great piece of advice is to not limit your thinking to what technology can be and how it can evolve. Also not limiting how these technological advances can be applied to benefit you and your company. An example such as the invention of virtual doctor appointments is a use of technology many never even considered an option not too long ago. This did pose some security concerns, but the program was able to built around the technology, and the team was prepared for these changes.    Remotely Working Advice In Uncertain Times Some positions such as doctors and nurses do not really have the option to work completely remotely patients need to be seen. But more administrative positions, also support positions absolutely can safely work from home. There are going to be concerns anytime a huge shift in the workday changes. Inside threats can be large or small, something as simple as the employees not getting the work done from home to something larger like medical information being released to the wrong people which is a direct HIPAA violation. Pushing it even further, what if that information was sold for profit by an employee. Identify the threats before they become a major crisis.  When working from home to want to essentially replicate the way work was done on premises. If most meetings were conference calls that can easily be done at home. If meetings were typically done in person around a conference table, use group video chat for these meetings at home. From a leadership standpoint working remotely can bring up unique challenges. Not everyone is as familiar with technology or the software needed to make these connections, so giving the education on the tools used could be a great first step when moving to a remote workforce. Getting everyone on the same technology, making sure teams have the access they need, and making sure that the security isn’t abandoned because of an emergency are all great points to cover upfront. In some cases purchases and upgrades may need to happen before the shift to remote work. Making sure the right purchases are being made for the unique situation the company is in can make or break your budget. Another great piece of advice is to spend the company money as if it were your own. When clients come to you with an example of breach and are worried that it could happen to them, do the research and explain to them the truth. Explain how that breach happened, and stress to them that human error causes more issues than technology failure, and a combination of the two is what leads to the most unfortunate events.    What Being A New CISO Means  Mentorship plays a big role, grooming a member or members of your team so that can confidently replace yourself when the time comes. Security is everywhere in all aspects of our lives, the new CISO needs to be think big picture.    Resources: Steve Moore: Linkedin Martin Littmann: Linkedin Kelsey-Seybold Clinic: Website Exabeam: Website

Building Up To A Position Of Power Holding the dual position of CTO/CISO needs to come with a lot of experience and drive. Being able to build the security organization around the needs of the company led to being both the Chief Technology Officer as well as Chief Information Security Officer. Noticing what was interfering with the safety of the company through passive observation has directly played into both roles. Doing research, having conversations, and interacting with other people are all examples of seemingly passive observations.  Advice To A Younger Self A great piece of advice is to not limit your thinking to what technology can be and how it can evolve. Also not limiting how these technological advances can be applied to benefit you and your company. An example such as the invention of virtual doctor appointments is a use of technology many never even considered an option not too long ago. This did pose some security concerns, but the program was able to built around the technology, and the team was prepared for these changes.  Remotely Working Advice In Uncertain Times Some positions such as doctors and nurses do not really have the option to work completely remotely patients need to be seen. But more administrative positions, also support positions absolutely can safely work from home. There are going to be concerns anytime a huge shift in the workday changes. Inside threats can be large or small, something as simple as the employees not getting the work done from home to something larger like medical information being released to the wrong people which is a direct HIPAA violation. Pushing it even further, what if that information was sold for profit by an employee. Identify the threats before they become a major crisis.  When working from home to want to essentially replicate the way work was done on premises. If most meetings were conference calls that can easily be done at home. If meetings were typically done in person around a conference table, use group video chat for these meetings at home. From a leadership standpoint working remotely can bring up unique challenges. Not everyone is as familiar with technology or the software needed to make these connections, so giving the education on the tools used could be a great first step when moving to a remote workforce. Getting everyone on the same technology, making sure teams have the access they need, and making sure that the security isn’t abandoned because of an emergency are all great points to cover upfront. In some cases purchases and upgrades may need to happen before the shift to remote work. Making sure the right purchases are being made for the unique situation the company is in can make or break your budget. Another great piece of advice is to spend the company money as if it were your own. When clients come to you with an example of breach and are worried that it could happen to them, do the research and explain to them the truth. Explain how that breach happened, and stress to them that human error causes more issues than technology failure, and a combination of the two is what leads to the most unfortunate events.  What Being A New CISO Means  Mentorship plays a big role, grooming a member or members of your team so that can confidently replace yourself when the time comes. Security is everywhere in all aspects of our lives, the new CISO needs to be think big picture.  Resources: Steve Moore: <a href="http://www.linkedin.com/in/stephenrmoore/" rel="nofollow" target="_blank">Linkedin</a> Martin Littmann: <a href="http://www.linkedin.com/in/martinlittmann/" rel="nofollow" target="_blank">Linkedin</a> Kelsey-Seybold Clinic: <a href="http://www.kelsey-seybold.com" rel="nofollow" target="_blank">Website</a> Exabeam: <a href="http://www.exabeam.com" rel="nofollow" target="_blank">Website</a>

Strategies for Securing a Remote Workforce

Transitioning Into The CISO Role Learning to balance the executive role with the tactical needs of the team can be tricky to balance. Being able to see to the larger picture within both roles can keep you on track and relevant within both places. Remember the roles you’ve had in the past and draw from those experiences and knowledge. Audits are typically not something anyone wants to have on their plate, but there are values in the audits. Audits not only bring an extra set of eyes to your team, but can also point out the areas of weakness that can use some bulking up before there is a major crisis. It can be very proactive to lean in to the audit and partner with the auditor instead of just trying to get through it unscathed.    What Is Lacking In The Security Industry The major points that come to mind when thinking of security might be something like, integrity, confidentiality, availability of data, and protection. But as much as we need to protect we also needs to share, the future of healthcare is being able to safely exchange information, and if it is locked away nothing can be exchanged. Within healthcare security things tend to be more vulnerable, especially for the nurses and caretakers working within hospice care. The have the weight of caring for a patient that is at the end of their life, as a security executive the last thing you want to do is make that caretaker’s jobs more difficult. To be able to put yourself in that caretaker’s position and be able to see what their user experience is like can be pivotal to how your base your security team and program. Take a step back and remember what you’re trying to protect in the first places, behind each client is a real person.    Designing Solutions For Real Threats There are many different security strategies for different types of needs. Some companies needs full steam ahead all the time, but many need a different type of solution. Before you build a program that just looks good on paper, get in there and really analyze what the threats and weaknesses are. After those points have been identified then move on to the next steps of building the program around the actual threats. An example of this is knowing how to use automation within your specific needs within the company. Identifying what can safely be automated before just jumping in with all the new automation tools will help everyone involved. Get to know your team; what is the most tedious part of their job is, identify their largest stressor, and what they believe can be automated. Being a CISO means breaking down all the barriers and having the power to show a more practical approach to security and how being able to provide help can influence drastic changes in the way information is protected.    Resources: Steve Moore: Linkedin Richard Kaufman: Linkedin Exabeam: Website Amedisys: Website

Transitioning Into The CISO Role Learning to balance the executive role with the tactical needs of the team can be tricky to balance. Being able to see to the larger picture within both roles can keep you on track and relevant within both places. Remember the roles you’ve had in the past and draw from those experiences and knowledge. Audits are typically not something anyone wants to have on their plate, but there are values in the audits. Audits not only bring an extra set of eyes to your team, but can also point out the areas of weakness that can use some bulking up before there is a major crisis. It can be very proactive to lean in to the audit and partner with the auditor instead of just trying to get through it unscathed.  What Is Lacking In The Security Industry The major points that come to mind when thinking of security might be something like, integrity, confidentiality, availability of data, and protection. But as much as we need to protect we also needs to share, the future of healthcare is being able to safely exchange information, and if it is locked away nothing can be exchanged. Within healthcare security things tend to be more vulnerable, especially for the nurses and caretakers working within hospice care. The have the weight of caring for a patient that is at the end of their life, as a security executive the last thing you want to do is make that caretaker’s jobs more difficult. To be able to put yourself in that caretaker’s position and be able to see what their user experience is like can be pivotal to how your base your security team and program. Take a step back and remember what you’re trying to protect in the first places, behind each client is a real person.  Designing Solutions For Real Threats There are many different security strategies for different types of needs. Some companies needs full steam ahead all the time, but many need a different type of solution. Before you build a program that just looks good on paper, get in there and really analyze what the threats and weaknesses are. After those points have been identified then move on to the next steps of building the program around the actual threats. An example of this is knowing how to use automation within your specific needs within the company. Identifying what can safely be automated before just jumping in with all the new automation tools will help everyone involved. Get to know your team; what is the most tedious part of their job is, identify their largest stressor, and what they believe can be automated. Being a CISO means breaking down all the barriers and having the power to show a more practical approach to security and how being able to provide help can influence drastic changes in the way information is protected.  Resources: Steve Moore: <a href="http://www.linkedin.com/in/stephenrmoore/" rel="nofollow" target="_blank">Linkedin</a> Richard Kaufman: <a href="http://www.linkedin.com/in/richard-kaufmann-18142119" rel="nofollow" target="_blank">Linkedin</a> Exabeam: <a href="http://www.exabeam.com" rel="nofollow" target="_blank">Website</a> Amedisys: <a href="http://www.amedisys.com" rel="nofollow" target="_blank">Website</a>

No as a Service: Why Security Can Stifle Innovation and How to Prevent It

Extend

The Day You Lose Your Job Losing your job to many can come as a complete shock, maybe even more so when you’re in a position of power such as an executive role.  There are many extra steps when leaving a security executive position, sometimes you have to hand over your phone, computer, tablets for security purposes, and if you used this for personal use as well, you could lose a lot of valuable files and information.  Sometimes you don’t even get a clear picture of why you are being let go, and that can make it difficult to correct that behavior in the future.    What Could Have Been Done Differently  Everyone brings their own unique backgrounds into the workplace, a lot of times that experience can work in your favor, but in some cases it may work against you. In Chris’ case he a military veteran and has had a hard time shaking his military exterior. In any position communication is key and there is always room for improvement, check yourself and make sure you’re communicating effectively. Even going as far back as the interview process communication is so important, maybe the right questions weren’t asked and it potentially wasn’t a great from the beginning.    Moving Forward The application process can be exhaustive and often discouraging. When in executive positions this can exasperate the process, especially after being fired. You need to know your limitations when applying for new positions. Are you willing to relocate? Are you willing to take on a different position from CISO? Know the answers to these questions before diving in headfirst.  Self-reflection is key in moving on from the experience too, know your weaknesses, identify them and correct the problems. This may even mean getting new certifications, which will look excellent when added to your resume. Don’t give up, keep fighting, develop these relationships, and get yourself back in the game.    Maintaining Relationships In business it’s easy to keep people at arm’s length for professional reasons, but that can also be seen as off-putting to your colleagues. It is beneficial for you to have good professional relationships; you will need references in the future. Creating these relationships make for a better workplace and confidence moving forward. Create your team around you whether they are within the company, a vendor, or someone in the same professional sphere as you.  You never know how far a little empathy and kindness can go.    Resources: Steve Moore: Linkedin Chris Wolski: Linkedin Exabeam: Website

The Day You Lose Your Job Losing your job to many can come as a complete shock, maybe even more so when you’re in a position of power such as an executive role.  There are many extra steps when leaving a security executive position, sometimes you have to hand over your phone, computer, tablets for security purposes, and if you used this for personal use as well, you could lose a lot of valuable files and information.  Sometimes you don’t even get a clear picture of why you are being let go, and that can make it difficult to correct that behavior in the future.  What Could Have Been Done Differently  Everyone brings their own unique backgrounds into the workplace, a lot of times that experience can work in your favor, but in some cases it may work against you. In Chris’ case he a military veteran and has had a hard time shaking his military exterior. In any position communication is key and there is always room for improvement, check yourself and make sure you’re communicating effectively. Even going as far back as the interview process communication is so important, maybe the right questions weren’t asked and it potentially wasn’t a great from the beginning.  Moving Forward The application process can be exhaustive and often discouraging. When in executive positions this can exasperate the process, especially after being fired. You need to know your limitations when applying for new positions. Are you willing to relocate? Are you willing to take on a different position from CISO? Know the answers to these questions before diving in headfirst.  Self-reflection is key in moving on from the experience too, know your weaknesses, identify them and correct the problems. This may even mean getting new certifications, which will look excellent when added to your resume. Don’t give up, keep fighting, develop these relationships, and get yourself back in the game.  Maintaining Relationships In business it’s easy to keep people at arm’s length for professional reasons, but that can also be seen as off-putting to your colleagues. It is beneficial for you to have good professional relationships; you will need references in the future. Creating these relationships make for a better workplace and confidence moving forward. Create your team around you whether they are within the company, a vendor, or someone in the same professional sphere as you.  You never know how far a little empathy and kindness can go.  Resources: Steve Moore: <a href="http://www.linkedin.com/in/stephenrmoore/" rel="nofollow" target="_blank">Linkedin</a> Chris Wolski: <a href="http://www.linkedin.com/in/chris-wolski/" rel="nofollow" target="_blank">Linkedin</a> Exabeam: <a href="http://www.exabeam.com" rel="nofollow" target="_blank">Website</a>

Losing Your Job as a CISO: Does the Cybersecurity Skills Shortage Extend to Executives?

Initial Worries &amp; New Challenges Going from consulting into a leadership position requires you to take on a new level of responsibility. You take that leap of having more permanence in the position but also now having to lead a team of other security professionals. Olivia also was in the unique position of not only being a new CISO but also the first CISO at MailChimp. This unique position came with high expectations but also a rewarding sense of accomplishment when goals are being reached. Some of the challenges can include completely changing the opinions and workload of your colleagues; this position is brand new and may not be received well at first. Remaining professional and listening to needs and concerns of others can build trust when you’re new in the workplace. It can be easy to go into a new position and be a bit over zealous, you’re new, you want to impress the company, just be able to rein it in as to not step on any toes and burn any bridges right out of the gate.  It is very important to gain trust when starting out at a new company in a new position.    Gaining Trust As A New CISO Coming on too strong in a new position can be off-putting to your colleagues. It is essential that you are able to sit down with your peers and learn how to communicate and connect to your team. Make yourself available to get to know your team, be humble in your approach. Showing loyalty to those you work closely with can build trust quickly, be transparent, be authentic with them. Showing vulnerability and being able to admit when your wrong adds humility into professional relationships which can make the workplace much more comfortable. Stand up for your team as well, you are now in a leadership position as a CISO and have a whole team of people that now look to you for support. Being there for them and staying strong in your stance as a leader will build trust within your team.    Early Wins In The First 90 Days Have meetings early on to establish what is important within the security team and why this team is essential, get feedback on your research and then share it. Establish relationships with others outside of the security team, being able to work closely with other leadership positions can make for a strong driving force within the company as a whole. You do not want to get stuck in the position of having to make a point in the midst of a crisis, get these relationships established first.    Resources: Steve Moore: Linkedin Olivia Rose: Linkedin Gary Hayslip: Linkedin Exabeam: Website MailChimp: Website

Initial Worries &amp; New Challenges Going from consulting into a leadership position requires you to take on a new level of responsibility. You take that leap of having more permanence in the position but also now having to lead a team of other security professionals. Olivia also was in the unique position of not only being a new CISO but also the first CISO at MailChimp. This unique position came with high expectations but also a rewarding sense of accomplishment when goals are being reached. Some of the challenges can include completely changing the opinions and workload of your colleagues; this position is brand new and may not be received well at first. Remaining professional and listening to needs and concerns of others can build trust when you’re new in the workplace. It can be easy to go into a new position and be a bit over zealous, you’re new, you want to impress the company, just be able to rein it in as to not step on any toes and burn any bridges right out of the gate.  It is very important to gain trust when starting out at a new company in a new position.  Gaining Trust As A New CISO Coming on too strong in a new position can be off-putting to your colleagues. It is essential that you are able to sit down with your peers and learn how to communicate and connect to your team. Make yourself available to get to know your team, be humble in your approach. Showing loyalty to those you work closely with can build trust quickly, be transparent, be authentic with them. Showing vulnerability and being able to admit when your wrong adds humility into professional relationships which can make the workplace much more comfortable. Stand up for your team as well, you are now in a leadership position as a CISO and have a whole team of people that now look to you for support. Being there for them and staying strong in your stance as a leader will build trust within your team.  Early Wins In The First 90 Days Have meetings early on to establish what is important within the security team and why this team is essential, get feedback on your research and then share it. Establish relationships with others outside of the security team, being able to work closely with other leadership positions can make for a strong driving force within the company as a whole. You do not want to get stuck in the position of having to make a point in the midst of a crisis, get these relationships established first.  Resources: Steve Moore: <a href="http://www.linkedin.com/in/stephenrmoore/" rel="nofollow" target="_blank">Linkedin</a> Olivia Rose: <a href="http://www.linkedin.com/in/oliviarosecybersecurity/" rel="nofollow" target="_blank">Linkedin</a> Gary Hayslip: <a href="http://www.linkedin.com/in/ghayslip/" rel="nofollow" target="_blank">Linkedin</a> Exabeam: <a href="http://www.exabeam.com" rel="nofollow" target="_blank">Website</a> MailChimp: <a href="http://www.mailchimp.com" rel="nofollow" target="_blank">Website</a>

Your First 90 Days As A New CISO

The best episodes for anyone looking to learn more about topics such as happiness, fulfillment, depression and psychology/mental health in general. With interviews with industry experts, personal stories of individuals, this topic has lessons applicable to everyone. Add episodes you're interested into your queue below!

Best Episodes on Mental Health, Emotions & Thoughts

The best podcasts about ourselves as well as the world through the lense of Science. Specific topics include things about our brain, emotions to biology, physics and more!