The New CISO

Latest Episodes:

How Do You Measure the Success of Your Cybersecurity Program? Apr 23, 2020

Show notes

Taking The Jump From Consulting & Advice To A Younger Self

With consulting you have the opportunity to work with multiple large companies, which can be an attractive aspect of the job. Working with multiple companies on that scale can introduce you to the latest technology and how it works differently for different companies. That being said, if you want to build a team from the ground up a transition from consulting might be best for you. Also if you’re looking to partner, or gain any ownership in a company, consulting may not be your best bet. Develop relationships while in the consulting position to really feel out where you want to be, and then you’ll already be a familiar face when you’re looking to be hired on at a company. Participating in networking groups is a great way to meet peers and other relevant connections you may want to utilize in the future. Just making sure that you are prioritizing your time and energy effectively can keep burnout at bay as well, focus on what you really want to achieve and walk down that path. Making these connections and being empathetic about others positions can really help advance your career, try to put yourself in others’ shoes when making these connections.

Tying Success To Business Risk

Being able to make an impact with the way you communicate requires empathy. To be an effective communicator you must be able to put yourself in the position of the other higher executives including CEOs, CFOs, and other critical positions. If you cannot relay information to them in a format they relate to, the problem could be a crisis just by the loss of time on trying to communicate. For some businesses security has always been a priority, yet for many other depending on the industry, security is only now coming to the forefront as a priority. Security teams need support, investment, and visibility. That is where those communication skills come in, present the value of the security team to other executives in a way the will relate to.

Beyond Compliance

Having up-to-date certifications and technology will only work in your favor as a security team, but you cannot stop there, certifications alone will not stop negative issues from arising. There needs to be both efficiency and maturity working in tandem. There is compliance, which offers your team a framework to then build upon to meet your specific needs. Compliance does not guarantee that your company is 100% protected against negative events; it is a critical element, although not the only element. Identify what the real risk factors are within your company and view security as an ongoing process. Educate the executive leadership on the independent testing results and findings and how your team has shifted to deal with these real risk factors that are beyond compliance. Being a new and effective CISO means not only being technical, but also in-tune with the current needs of the industry by communicating in an empathetic way.

Resources:

Steve Moore: Linkedin

Marzena Fuller: Linkedin

Exabeam: Website

CISCO: Website

How Emotional Intelligence Fortifies Capability In the Midst of A Crisis Apr 09, 2020

Show notes

Building A Relationship With Other Teams

The sooner these relationships can be built, the better. Meeting top executives and other team leads during a crisis is less than ideal. Get to know the people that are closer to the consumer, the writers, the social media managers, the sooner this relationship is established the better the partnership is when you need to come together in a crisis. Building those relationships now build trust within the company as a whole.

Where To Begin?

Every company is different and stepping into the role of CISO will be different depending on the specific needs of those companies. Asking to be introduced to the executives, team leads, and other specific roles when you are first hired on or even during the interview process can put you on their radar from the beginning. Asking questions to your direct contacts and your direct team is a great way to feel out which individuals you need to meet and in what order.

Generating A Safe Statement Before The Problem Arises

The language used in a crisis response as well as the speed of the response are critical components of how the public will perceive the company. Having pre-written general responses that can essentially be “fill in the blank” templates for a variety of problems can get that statement out as soon as possible. This speed of response can help the company change the narrative of the situation at hand. Adopting this kind of proactive approach will not only build trust between the teams before a crisis, but will change the way consumers view your company.

Early Career Advice

Doing research into the companies you’ll be interviewing with can help you find the right workplace that aligns with your personal ethos. Seeking out companies that are known for doing meaningful work, have good workplace morale, and align with you can greatly boost your career drive. Start by defining what is important to you and find companies with similar missions.

Empathy And Care In The Workplace

Building a strong workplace culture around your ethos will change the way you view working. Getting to know the lives of your colleagues and showing genuine interest in their well-being can build a web of trust. Carve out time where anyone from your team can come to, have an open door policy for these times and let them come to you for any reason. Building a team with members that have a strong sense of protection that bleeds out into all aspects of their lives are the individuals that are going to push your company forward.

What Being A New CISO Means

Being reliable, patient, and having a broad understanding of personal and business acumen. Being able to stand up for your principles and provide servant leadership for those who look to you on a daily basis.

Resources:

Steve Moore: Linkedin

Kirsten Davies: Linkedin

Exabeam: Website

Estee Lauder: Website

Strategies for Securing a Remote Workforce Mar 26, 2020

Show notes

Building Up To A Position Of Power

Holding the dual position of CTO/CISO needs to come with a lot of experience and drive. Being able to build the security organization around the needs of the company led to being both the Chief Technology Officer as well as Chief Information Security Officer. Noticing what was interfering with the safety of the company through passive observation has directly played into both roles. Doing research, having conversations, and interacting with other people are all examples of seemingly passive observations.

Advice To A Younger Self

A great piece of advice is to not limit your thinking to what technology can be and how it can evolve. Also not limiting how these technological advances can be applied to benefit you and your company. An example such as the invention of virtual doctor appointments is a use of technology many never even considered an option not too long ago. This did pose some security concerns, but the program was able to built around the technology, and the team was prepared for these changes.

Remotely Working Advice In Uncertain Times

Some positions such as doctors and nurses do not really have the option to work completely remotely patients need to be seen. But more administrative positions, also support positions absolutely can safely work from home. There are going to be concerns anytime a huge shift in the workday changes. Inside threats can be large or small, something as simple as the employees not getting the work done from home to something larger like medical information being released to the wrong people which is a direct HIPAA violation. Pushing it even further, what if that information was sold for profit by an employee. Identify the threats before they become a major crisis.

When working from home to want to essentially replicate the way work was done on premises. If most meetings were conference calls that can easily be done at home. If meetings were typically done in person around a conference table, use group video chat for these meetings at home. From a leadership standpoint working remotely can bring up unique challenges. Not everyone is as familiar with technology or the software needed to make these connections, so giving the education on the tools used could be a great first step when moving to a remote workforce. Getting everyone on the same technology, making sure teams have the access they need, and making sure that the security isn’t abandoned because of an emergency are all great points to cover upfront. In some cases purchases and upgrades may need to happen before the shift to remote work. Making sure the right purchases are being made for the unique situation the company is in can make or break your budget. Another great piece of advice is to spend the company money as if it were your own. When clients come to you with an example of breach and are worried that it could happen to them, do the research and explain to them the truth. Explain how that breach happened, and stress to them that human error causes more issues than technology failure, and a combination of the two is what leads to the most unfortunate events.

What Being A New CISO Means

Mentorship plays a big role, grooming a member or members of your team so that can confidently replace yourself when the time comes. Security is everywhere in all aspects of our lives, the new CISO needs to be think big picture.

Resources:

Steve Moore: Linkedin

Martin Littmann: Linkedin

Kelsey-Seybold Clinic: Website

Exabeam: Website

No as a Service: Why Security Can Stifle Innovation and How to Prevent It Mar 12, 2020

Show notes

Transitioning Into The CISO Role

Learning to balance the executive role with the tactical needs of the team can be tricky to balance. Being able to see to the larger picture within both roles can keep you on track and relevant within both places. Remember the roles you’ve had in the past and draw from those experiences and knowledge. Audits are typically not something anyone wants to have on their plate, but there are values in the audits. Audits not only bring an extra set of eyes to your team, but can also point out the areas of weakness that can use some bulking up before there is a major crisis. It can be very proactive to lean in to the audit and partner with the auditor instead of just trying to get through it unscathed.

What Is Lacking In The Security Industry

The major points that come to mind when thinking of security might be something like, integrity, confidentiality, availability of data, and protection. But as much as we need to protect we also needs to share, the future of healthcare is being able to safely exchange information, and if it is locked away nothing can be exchanged. Within healthcare security things tend to be more vulnerable, especially for the nurses and caretakers working within hospice care. The have the weight of caring for a patient that is at the end of their life, as a security executive the last thing you want to do is make that caretaker’s jobs more difficult. To be able to put yourself in that caretaker’s position and be able to see what their user experience is like can be pivotal to how your base your security team and program. Take a step back and remember what you’re trying to protect in the first places, behind each client is a real person.

Designing Solutions For Real Threats

There are many different security strategies for different types of needs. Some companies needs full steam ahead all the time, but many need a different type of solution. Before you build a program that just looks good on paper, get in there and really analyze what the threats and weaknesses are. After those points have been identified then move on to the next steps of building the program around the actual threats. An example of this is knowing how to use automation within your specific needs within the company. Identifying what can safely be automated before just jumping in with all the new automation tools will help everyone involved. Get to know your team; what is the most tedious part of their job is, identify their largest stressor, and what they believe can be automated. Being a CISO means breaking down all the barriers and having the power to show a more practical approach to security and how being able to provide help can influence drastic changes in the way information is protected.

Resources:

Steve Moore: Linkedin

Richard Kaufman: Linkedin

Exabeam: Website

Amedisys: Website

Losing Your Job as a CISO: Does the Cybersecurity Skills Shortage Extend to Executives? Feb 27, 2020

Show notes

The Day You Lose Your Job

Losing your job to many can come as a complete shock, maybe even more so when you’re in a position of power such as an executive role. There are many extra steps when leaving a security executive position, sometimes you have to hand over your phone, computer, tablets for security purposes, and if you used this for personal use as well, you could lose a lot of valuable files and information. Sometimes you don’t even get a clear picture of why you are being let go, and that can make it difficult to correct that behavior in the future.

What Could Have Been Done Differently

Everyone brings their own unique backgrounds into the workplace, a lot of times that experience can work in your favor, but in some cases it may work against you. In Chris’ case he a military veteran and has had a hard time shaking his military exterior. In any position communication is key and there is always room for improvement, check yourself and make sure you’re communicating effectively. Even going as far back as the interview process communication is so important, maybe the right questions weren’t asked and it potentially wasn’t a great from the beginning.

Moving Forward

The application process can be exhaustive and often discouraging. When in executive positions this can exasperate the process, especially after being fired. You need to know your limitations when applying for new positions. Are you willing to relocate? Are you willing to take on a different position from CISO? Know the answers to these questions before diving in headfirst. Self-reflection is key in moving on from the experience too, know your weaknesses, identify them and correct the problems. This may even mean getting new certifications, which will look excellent when added to your resume. Don’t give up, keep fighting, develop these relationships, and get yourself back in the game.

Maintaining Relationships

In business it’s easy to keep people at arm’s length for professional reasons, but that can also be seen as off-putting to your colleagues. It is beneficial for you to have good professional relationships; you will need references in the future. Creating these relationships make for a better workplace and confidence moving forward. Create your team around you whether they are within the company, a vendor, or someone in the same professional sphere as you. You never know how far a little empathy and kindness can go.

Resources:

Steve Moore: Linkedin

Chris Wolski: Linkedin

Exabeam: Website

Your First 90 Days As A New CISO Feb 13, 2020

Show notes

Initial Worries & New Challenges

Going from consulting into a leadership position requires you to take on a new level of responsibility. You take that leap of having more permanence in the position but also now having to lead a team of other security professionals. Olivia also was in the unique position of not only being a new CISO but also the first CISO at MailChimp. This unique position came with high expectations but also a rewarding sense of accomplishment when goals are being reached. Some of the challenges can include completely changing the opinions and workload of your colleagues; this position is brand new and may not be received well at first. Remaining professional and listening to needs and concerns of others can build trust when you’re new in the workplace. It can be easy to go into a new position and be a bit over zealous, you’re new, you want to impress the company, just be able to rein it in as to not step on any toes and burn any bridges right out of the gate. It is very important to gain trust when starting out at a new company in a new position.

Gaining Trust As A New CISO

Coming on too strong in a new position can be off-putting to your colleagues. It is essential that you are able to sit down with your peers and learn how to communicate and connect to your team. Make yourself available to get to know your team, be humble in your approach. Showing loyalty to those you work closely with can build trust quickly, be transparent, be authentic with them. Showing vulnerability and being able to admit when your wrong adds humility into professional relationships which can make the workplace much more comfortable. Stand up for your team as well, you are now in a leadership position as a CISO and have a whole team of people that now look to you for support. Being there for them and staying strong in your stance as a leader will build trust within your team.

Early Wins In The First 90 Days

Have meetings early on to establish what is important within the security team and why this team is essential, get feedback on your research and then share it. Establish relationships with others outside of the security team, being able to work closely with other leadership positions can make for a strong driving force within the company as a whole. You do not want to get stuck in the position of having to make a point in the midst of a crisis, get these relationships established first.

Resources:

Steve Moore: Linkedin

Olivia Rose: Linkedin

Gary Hayslip: Linkedin

Exabeam: Website

MailChimp: Website

From the 'Basement' to the Board: Giving Cybersecurity Teams Greater Visibility Jan 31, 2020

Show notes

Advice To A Younger Self, Before Becoming A CISO

Perfectionism can hinder the natural learning experience. As someone fresh in their career it can be hard to not want to be perfect, there are expectations to be met. Yet making mistakes and learning from them is real job experience. Don’t be afraid to take risks and fail, you’ll learn from your mistakes. Being new in your career can feel isolating, vulnerable, and flat out scary. It is okay to make mistakes, just learn from them

Gender In The Workplace

Sometimes being the only woman in the class or the office can work to your advantage. Being able to provide that thought diversity can really work well for women in the workplace. Having a fresh perspective and ideas brings a well-rounded view to task at hand. Use your unique position to your advantage. As a leader you should be building a diverse, inclusive team.

Technical Expertise, Necessary Or Not

Having a baseline technical knowledge will absolutely never hurt you in a cyber security career. That being said, a mix of technical knowledge and business understanding is the sweet spot for problem solving. As a CISO being able to partner with others, even other teams is pivotal to fast, effective, problem solving. Having a good knowledge of both will be most beneficial because you have a general knowledge of both the business side and the technical side. There are many ways to define the actual role of a CISO, and they will all depend on the specific company. CISOs wear a lot of hats for a lot of different companies, and they may completely differ based on the company. Yet with the new regulations rolling out around cyber security this could change soon and become more streamlined.

Company Organization And Security Burial

One of the most frustrating aspects of looking for a job in the cyber security filed can be the company organization. We are constantly bombarded with news of security and data breaches, yet some companies have their security team basically buried under other, potentially less essential teams. With the rise of data breaches and data hacking, you want to work for a company that values all you bring to the table, because this is an uphill battle when it comes to cyber security. Being valued too low in the organization can lead to internal conflict. Being able to report not only actual issues, but also the risks before it gets to the critical breaking point.

Reporting Risks In A Proactive Manner

There are tons of risks with any company, being able to identify the risks before they are problems and create solutions around the specific issues at hand can save you from major issues in the future. Analyzing user behavior and seeing how negligent or risky a specific set of people are and creating solutions around that is going to really resonate with executives because it nips the problem before it becomes a problem. Talking about how the team is enabled to handle threats is another big one. Looking at the numbers of threats, seeing what could be automated, and what an analyst needed to follow up as well. Automation saves time, money, and keeps history from repeating itself.

Psychology And User Behavior

Having contextual training is so important. There are many certifications that security teams get year after year, but they have almost no impact. If the training isn’t directly relevant to the company and even the specific team there will be no impact, or even a negative impact. Prevention is key, so have the relevant training and technology, look at programs and make sure that security is built into the programs already in place. If that isn’t what is happening, then something needs to change, the programs need to be cleaned up and modernized to the potential risks surrounding it. This training will be used not just in the workplace but the teams will take this home and use it in their everyday life, almost like modern life skills.

What Being A New CISO Means To You

Everything is a learning experience, being able to use the experience form your past to propel your future career. It has been really great working for a company that is 5 years old and learning new, modern ways of cyber security has been a great learning experience.

Resources:

Steve Moore: Linkedin

Rinki Sethi: Linkedin

Exabeam: Website

Rubrik: Website

Lessons in Leadership: Taking a Step back and Learning to Trust the Experts on Your Team.mp3 Jan 16, 2020

Show notes

Transitioning Into CISO And The Initial Challenges

Becoming the head of any department, and having all that responsibility on you can be very intimidating at first. Going from more behind the scenes to front and center can be uncomfortable, but reflect back on all your experience and let that guide your decision-making. Delegation is important in leadership roles, so get the team together and put your minds together to build a great security team. Identify the top priorities for your position, focus on those, and identify what can be delegated.

Mentorship Advice To A Younger Self

When you are able to put yourself in other’s shoes, you can understand their motivations and how to work well within their realm. Understanding people and their professional wants and needs can make for lasting and reliable partnerships. Being transparent with your needs can many times lead to seeing you have similar professional goals, now that both parties see the end goal they can now work together much more smoothly. Building trust with other members of the organization before an issue arises can also make solving these issues much less intimidating in the future when something does come up that requires their attention.

Collecting Feedback & Continuing Improvement

The security industry is constantly in flux, so the need for continuing improvement is pivotal to the success. Have a conversation about the constraints your team is working within. Look outside your direct colleagues, outside of your team, go to other departments and ask them the same questions you ask your team. Having a fresh set of eyes on an issue at hand can lead to progressive solutions that may have been overlooked by those directly working within security. Moving specific test from manual to automation based can free up time and capital that may need to be invested in another area of security. The frequency of security patching may need to change, as well as the speed of the testing process. The feedback events can be so helpful, getting the organization together to solve the issues being faced. Going into these events there needs to be a focus on the problems that need solving, look to the experts in these areas, and having these conversations in-person, and if possible hosted by an outside unbiased party.

Celebrating Success

Security teams face a plethora of issues and problems constantly. This is a taxing industry that takes dedication and focus to be successful in. So when there is success we need to all be better at celebrating it. Giving credit where it’s due, having conversations about the successful methods used to achieve this success, and keeping team morale high can make for a more pleasant work experience.

Resources & Links:

Steve Moore: Linkedin

Steve Person: Linkedin

Exabeam: Website

Cambia Health Solutions: Website

Speed Of Trust Book: Website

Why 3rd Party Security Testing is the New Password Rotation Dec 30, 2019

Show notes

Identifying Burnout In The Workplace

Burnout is a common occurrence in any industry, but especially among those looking to carve out their place in the industry. No one works well when they aren’t at their best, identifying burnout early on can stop it in its tracks. If you’re noticing someone is acting out of character or being short, they may be experiencing burnout. Another tell can be the hours you’re seeing someone put in, no one should be up at midnight still working.

Advice To A Younger You

Networking can get you to great places, starting early in your career can really put you where you want to be a few years down the road. Don’t be shy, get out there and meet people within the industry. Network both inside and outside of the company you’re a part of.

Transitioning Into Leadership

Not everyone is cutout for management. When taking a leadership role you need to be able to prioritize your team and realize you’re directly responsible for those who work with you. To be a good leader you have to take all the knowledge you’ve learned up to this point and be able to teach it to others in a way that makes sense to each individual. Empathy plays a huge role in leadership, you must be able to put yourself in the position of others and understand their point of view. Being open to feedback and being able to take it with an open mind is essential in leadership; it’s going to come both solicited and non-solicited.

Third Party Risks And Why We Don’t Love It

What is third party risk? It’s when a company brings in another company to handle a certain project or service. Within security this plays a huge risk because you’re essentially giving this other company access or information to the inner workings of your company. From a security standpoint this is a huge risk and variable, so doing thorough and meticulous research into the companies brought is key. This can ruffle some feathers with the third party, but at the end of the day you’re in charge of security so you need to fulfill your duties to the company you’re employed with. The real issue arises when you’ve done the research, and don’t feel that the third party is a good match for the company, yet leadership above you wants to move forward regardless. The CISO is now tasked with trying to figure out how they can make this work with the third party, whether that means changing language within the contract, adjusting the work the third party is doing, or reworking how you present your findings to leadership above you.

Warning Signs Of A Bad Third Party Review

How many exceptions are you making to be able to work with this vendor? Does it seem it like some rules are being bent? Policies and procedures aren’t being followed? These are all huge warning signs. Another warning sign is an across the board process for each new vendor, this isn’t the most effective way to lower risks, and this can lower sales and revenue. Some vendors will be more risky then others, so there should be separate policies for different companies based on their risks.

What Being A New CISO Means To Me

Building relationships while being honest and transparent is key to being a CISO. If we all viewed ourselves as a vendor and service provider we could all get the tasks at hand done. Also be on the lookout for my book being released in summer 2020:

Startup Secure Banking In Cybersecurity, From Founding To Exit

Resources:

Steve Moore: Linkedin

Chris Castaldo: Linkedin

Exabeam: Website

Dataminr: Website

Unique Challenges, but More Opportunities for Women in Cybersecurity Dec 13, 2019

Show notes

Marketing In Relation To Security

Marketing is all about getting a certain message to the right audience. A background in this field can be a great way to transition into other positions including the CISO. Being able to take a look at the bigger picture and then funnel that picture down to solve the problem at hand can be aided with a marketing approach.

Advice To Those Just Starting Out

Being new in an industry can be isolating by itself alone, but being female in a male dominated industry can emphasize that isolation. Being able to feel comfortable in your individuality will help anyone in any position. Also being gentler with yourself as a person, and attempting to enjoy the path you’re on can provide you with a higher sense of self-worth.

Being The Only Woman In The Meeting

Speaking in general terms men tend to be more direct and interact differently within their own gender. Being the only woman there you have to adapt, speaking more directly, and bluntly for example. This being said the same would be true of a man working in a female dominated industry, adapting to the culture of the industry will set you apart. Having the proper certification and licenses can set you apart as well, it is unfortunate that the business culture is this way, but it will prove on paper that you are capable and have the skillset to demand respect in the industry. Being prepared and researching beforehand is key to success as well, spend a little extra time researching your client.

Why Women Are Encouraged To Pursue A Career In Security

Women are highly detail-oriented which is huge in the realm of security, yet a common misconception of security is that it is a technical only position. Technical has a place in security, but that isn’t the only aspect of the industry. Being able to communicate, see the bigger picture, work within a team, and cooperate with the company are other aspects within the security field that women can strive in whether being a technical person or not.

Friendly Advice To Men In The Workplace

In meeting be an active listener, do not interrupt women, do not repeat their ideas and state them as your own. Women who have children also have different life pressures, but when you schedule a happy hour meeting that almost immediately excludes the women on your team with children. Having lunch meetings are a great way to keep the whole team involved and at the table. Having meeting over a round of golf is fairly typical, but don’t exclude the women on your team, the conscience of who your team is and how to involve everyone in the productivity in the workplace. Keep it equal, don’t interrupt, and be aware of how you are interacting. Women want to be treated like equals, women don’t want to be separated by gender in their industry.

Advice To Women In The Security Industry

You are going to face adversity, harassment, isolation, and many other challenges when you are the minority in the industry. It is not going to be easy, you are definitely going to have to put the work in. That being said, the higher you climb the less of a minority you are. So stay focused, toughen up, and climb the latter.

Resources:

Steve Moore: Linkedin

Olivia Rose: Linkedin

Exabeam: Website

MailChimp: Website