Five Tips for the CISO in 2017

The new year is here, and with it comes another fresh wave of attacks, continued strain on resources and the hubbub of everyone returning to the office after a long, much-needed break. The chief information security officer’s (CISO’s) time is as stretched as it has ever been and, most likely, so is his or her attention span. Here’s a short list of priorities for CISOs to keep running in the background.

1. Find Your Flow

No matter what you do, do it because it drives you and fills you with energy and motivation. Do the thing that causes you to radiate like the sun. Sure, cybersecurity can have its share of doom and gloom, but helping your organization navigate through cyber risks should be a positive, rewarding task.

In December 2016, Inc. Magazine published a list of must-read books for the end of the year. The most notable for our purposes is “Born for This: How to Find the Work You Were Meant to Do” by Chris Guillebeau. The book promises to help you find your flow — that thing that you do really well that makes time stand still.

2. Align With Business Objectives

It is critical for the CISO to spend the time to learn, understand and fully align with the organization’s business objectives. Cyber risks do not exist in a vacuum. These risks must be translated in the context of their impact on the organization’s ability to achieve its business objectives.

Cyber risks aren’t always obvious, however. Just look at the impending Internet of Things (IoT) security mess heading our way. The CISO must gauge the level of awareness and understanding among the organization’s top leadership and connect the dots to ensure executives and board directors make appropriate, risk-informed decisions.

3. Improve Your Selling and Influencing Capabilities

The CISO’s role is complex, subtle and constantly changing. The good news is that most CISOs have abandoned scare tactics. Instead, they’ve turned to cyber risk quantification and maturity scales, all while continuing to use compliance as a main driver. But CISOs should put their people skills to use and complement these traditional methods with a softer approach.

CISOs should know by now that their role requires the ability to influence with little to no authority. Another book from the Inc. Magazine list, “Pre-Suasion: A Revolutionary Way to Influence and Persuade” by Robert Cialdini, can help you grow your circle of influence. While this book is aimed at sales professionals, security leaders can still get lots of value from it.

4. Counsel Top Leadership

According to Deloitte, CISOs should act as strategists and advisers. This means that they must drive business and cyber risk strategy alignment, instigate transformational change to manage risk, and educate, advise and influence activities with cyber risk implications. CISOs are often distracted from these duties by their additional responsibilities as guardians and technologists.

Listen to the podcast: Directors Are From Mars, CISOs Are From Venus

Now more than ever, CISOs must act as strategic advisers to their organizations, top executives and boards of directors, communicating frequently and effectively. This comes easily, almost innately, to some CISOs. Others struggle to communicate, due either to unfamiliarity with the territory or an organizational culture that still views the role as a limited, narrow position. Angela Duckworth’s “Grit: The Power of Passion and Perseverance” can help more timid CISOs develop the voice they need to drive a culture of security.

As the saying goes, however, doing the same thing over and over and expecting different results isn’t a good strategy. The CISO should seek a trusted mentor to help him or her set aside preconceived assumptions and limitations.

5. Be Strategic About Your Professional Development

If you don’t keep moving forward and upward, your value to your organization will diminish. A CISO cannot afford to stand still and must think strategically about professional development. CISOs should force themselves to set aside time, determine and clarify next steps, invest in deep work and build their external reputations.

As expected, according to Hunt Scanlon Media, the CISO position continues to be in high demand. The security officer’s role is mentioned alongside other technology roles such as head of IoT strategy, chief data officer and chief digital officer. If you think you’re ready for a switch, go deep to explore what executive talent recruiters are looking for.

More from CISO

How to Solve the People Problem in Cybersecurity

You may think this article is going to discuss how users are one of the biggest challenges to cybersecurity. After all, employees are known to click on unverified links, download malicious files and neglect to change their passwords. And then there are those who use their personal devices for business purposes and put the network at risk. Yes, all those people can cause issues for cybersecurity. But the people who are usually blamed for cybersecurity issues wouldn’t have such an…

The Cyber Battle: Why We Need More Women to Win it

It is a well-known fact that the cybersecurity industry lacks people and is in need of more skilled cyber professionals every day. In 2022, the industry was short of more than 3 million people. This is in the context of workforce growth by almost half a million in 2021 year over year per recent research. Stemming from the lack of professionals, diversity — or as the UN says, “leaving nobody behind” — becomes difficult to realize. In 2021, women made…

Backdoor Deployment and Ransomware: Top Threats Identified in X-Force Threat Intelligence Index 2023

Deployment of backdoors was the number one action on objective taken by threat actors last year, according to the 2023 IBM Security X-Force Threat Intelligence Index — a comprehensive analysis of our research data collected throughout the year. Backdoor access is now among the hottest commodities on the dark web and can sell for thousands of dollars, compared to credit card data — which can go for as low as $10. On the dark web — a veritable eBay for…

Detecting the Undetected: The Risk to Your Info

IBM’s Advanced Threat Detection and Response Team (ATDR) has seen an increase in the malware family known as information stealers in the wild over the past year. Info stealers are malware with the capability of scanning for and exfiltrating data and credentials from your device. When executed, they begin scanning for and copying various directories that usually contain some sort of sensitive information or credentials including web and login data from Chrome, Firefox, and Microsoft Edge. In other instances, they…