While there was no playbook for navigating cybersecurity amid a pandemic, there are a few key takeaways on what it means to lead effectively that can serve as a guide not just to security teams but the enterprise as a whole. While Internships and mentorships play a key role in acquiring security talent, meaningful and regular communication with employees both as a team and individuals is crucial to keeping it. As for defending the corporate network against adversaries, continual threat simulation and testing should become a part and parcel of every organization’s security strategy. Ideally, by the time someone gets into a CISO role, they have already worked in other C-suite positions and have developed strong leadership and communication skills. CISOs with a diverse background can also do a lot to bring down organisational silos. Teams should also have a good understanding of the part they play in achieving strategic business outcomes – rather than seeing themselves as hindrances to the business operations.
The attitudes a new CISO should adopt
For the first 90 days or so, a new CISO should avoid declarative statements and keep asking questions and listen to answers. It’s the time of learning about security staff’s pain points, missions, etc. You’d probably do well not to touch the organisational structure of the security team or implement something new – including technology – at this point, just because it worked in your previous job. IT and security teams are closely linked with overlapping responsibilities. As Ed mentioned jokingly, how other teams distinguish them is, “if they stop me doing something, it’s probably security, if they’re delivering something badly, it’s IT”, and they are ignored or shouted at accordingly. (Shadow IT is basically the result of the business not getting quick and effective responses from IT and taking the initiative in order to fill the gap.) It’s also important for the new CISO to learn who they should talk to when taking the team’s temperature and who are colleagues that will say what the CISO would like to hear. The CISO should also identify already at this stage who their champions will be – even though they may be in the beginning the CISO’s strongest detractors. If the CISO’s predecessor was unpopular, they should just turn the page and set out new rules and procedures. CISO’s relation to staff is determined to a large extent by whether they see them as users, customers or colleagues. Given the versatility and variety of the job, there seems to be no universal playbook for CISOs. They may rely on a minimum viable security list, though, including commonalities such as MFA or how to deal with a ransomware attack.
The panel’s advice
Turn the security programme from a negative into a positive right at the start. Put an end to a punitive approach by rewarding, for example, those who reported phishing emails rather than punishing those who clicked on them.
Make sure you not only make inquiries about what’s not working but also about the positive things (culture, engagement, collaboration, technology, etc) that should be replicated.
Keep security trainings short, light and funny.
Look for root causes rather than symptoms before implementing change.
Address the Big Brother syndrome of security. Stop blocking websites that have nothing to do with security.
To impress staff, make changes that no one notices as they happen but bring great outcomes.