The constant evolution of threats, the need for diverse expertise, and alignment with strict compliance standards are common challenges for cybersecurity professionals.
In his conversation with Dan Haagman, CEO of Chaleit, Ted Heiman, Enterprise Cyber Security Specialist and CISO Guru, discusses how strategic moves, a well-rounded team, and a commitment to continuous education can help CISOs navigate this high-stakes environment.
Everybody expects a CISO to be an expert. Not only that, but to excel in every aspect of security, from authentication to privileged access management, firewalls, encryption, and beyond. This is unreasonable.
Being a CSO is a tough job, considering the breadth of skills and responsibilities required.
Everybody expects a CISO to be an expert. Not only that, but to excel in every aspect of security, from authentication to privileged access management, firewalls, encryption, and beyond. This is unreasonable.
Adding to that expectation is the journey of the CISO, who typically holds a position for only two to three years before being terminated abruptly by a breach.
Typically, a CISO starts by navigating the political landscape, understanding the culture, and dissecting the technology infrastructure within the first year. The subsequent year involves building roadmaps and implementing strategies to fortify the attack surface.
In the third year, when the CISO progresses and is accustomed to the team, a security breach happens. Unfortunately, the board often fires the CISO as the responsible person. They decide the brand is safe and start anew with someone else. And the cycle repeats.
Without the right people, policies, and practices, being a CISO is a herculean task.
Without the right people, policies, and practices, being a CISO is a herculean task.
CISOs can’t do it all on their own. They need a team that’s working together in concert to achieve the goals in the roadmap.
Having a team with knowledge and experience that doesn’t need hand-holding for every task is critical. Building this team, creating camaraderie, and getting everybody to work together is essential to secure the enterprise.
There’s a shortage of cyber security resources. CISOs have difficulties finding the right people. Only a few colleges teach cybersecurity, and they’ve started fairly recently.
Most people come up through the ranks. They start in IT, get involved in a security project along the way, and then get approached by the CISO. However, CISOs are limited by budget and can only have so many people on their team. That’s why those with multiple areas of expertise are the most valuable to the team.
CISOs must prioritise training. That’s often challenging because it requires pulling somebody out of the field, but it’s vital because security is not static. Security is constantly moving. People won’t be as valuable if they’re not educated to understand how it changes and evolves.
Continued educational development must be built into the organisation. Otherwise, technology passes you by.
Security is constantly moving. People won't be as valuable if they're not educated to understand how it changes and evolves.
CISOs must constantly adapt to complex security challenges. One of them is that defining a perimeter is increasingly elusive.
Nowadays, most enterprise CISOs have a very difficult time defining their perimeter. Hybrid cloud environments, organic network growth, and the proliferation of connections complicate the once straightforward task of securing data.
You must restrict access to systems effectively, and implementing a multi-factor authentication solution is critical. There are many ways to do it, and there is no excuse not to.
Eliminating static passwords in favour of multi-factor authentication is a move that can save time and money and enhance overall security.
Compliance is also critical. In case of a breach, the fines can be seven figures if there is a lack of compliance. Driven by legislation like HIPAA and GDPR, compliance becomes a cornerstone, compelling organisations to stay up-to-date and CISOs to closely monitor evolving security requirements.
Eliminating static passwords in favour of multi-factor authentication is a move that can save time and money and enhance overall security.
Identity is our new perimeter. A zero-trust approach is the goal.
Zero trust means that we don’t care who you are; whether you’re internal or external to the network, we will require the same authentication level to gain access from everyone.
Privileged access management becomes pivotal in safeguarding against threats and giving companies much more control over that data. Anomaly detection is essential in this context to help you identify deviations from normal network behaviour.
Identity is our new perimeter. A zero-trust approach is the goal.
With a defence-in-depth perspective, you can get everything working together to meet the requirement that, no matter who it is, they must meet the same criteria to access data.
Discover the pitfalls of disjointed point solution deployments and the promise of cutting-edge technologies in part 1 of our conversation with Ted Heiman, and check out our blog for more valuable insights from industry experts.
