A security leader shares tips for adopting a CISO mindset, creating risk management strategies, and "selling infosec" to IT and executives.
"If you demonstrate clearly [that] they are capable of making mistakes, they'll be angry at first, but generally if they're professionals, they'll get over it and want it to be better," he explained. CISOs don't want to bring IT concerns to audit or management unless they absolutely have to.
Modern security leaders find themselves at the crossroads between business and technology, selling the importance of security to all levels of an organization while helping them maintain efficiency, create a risk management strategy, and prepare for the inevitability of a cyberattack.
This idea of "selling information security" is the area where security leaders struggle most, said Peter Keenan, CISO of a financial services company, in a DEF CON talk. As security practitioners transition from roles as technical analysts or engineers into leadership positions, they learn the challenge of driving security through a business without control over employees' performance.
Information security at its core is "influence without authority," he said, and it's more involved than convincing executives to invest in new technologies. Security leadership may feel like a lot of top-down selling, convincing the board and CEO that you're doing well, but leadership also means conveying the importance of security to people across all levels of the business.
Read more: https://www.darkreading.com/risk/hacking-it-as-a-ciso-advice-for-security-leadership/d/d-id/1338626?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple
Tags 🏷
#cybersecurity #cso #ciso #infosec #hacker #itriskmanagement #ciberseguranca #cyberattacks #threats #malware #cibercrime #exploit #hackers #hacker #breach #mitreatt&ck #pentesting #cloudsecurity #cyberwar #datasecurity #ethicalhacking #hacking #cloud #informationsecurity #securitymanagement #infosec #ransomware #datasecurity #darkreading
"If you demonstrate clearly [that] they are capable of making mistakes, they'll be angry at first, but generally if they're professionals, they'll get over it and want it to be better," he explained. CISOs don't want to bring IT concerns to audit or management unless they absolutely have to.
Modern security leaders find themselves at the crossroads between business and technology, selling the importance of security to all levels of an organization while helping them maintain efficiency, create a risk management strategy, and prepare for the inevitability of a cyberattack.
This idea of "selling information security" is the area where security leaders struggle most, said Peter Keenan, CISO of a financial services company, in a DEF CON talk. As security practitioners transition from roles as technical analysts or engineers into leadership positions, they learn the challenge of driving security through a business without control over employees' performance.
Information security at its core is "influence without authority," he said, and it's more involved than convincing executives to invest in new technologies. Security leadership may feel like a lot of top-down selling, convincing the board and CEO that you're doing well, but leadership also means conveying the importance of security to people across all levels of the business.
Read more: https://www.darkreading.com/risk/hacking-it-as-a-ciso-advice-for-security-leadership/d/d-id/1338626?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple
Tags 🏷
#cybersecurity #cso #ciso #infosec #hacker #itriskmanagement #ciberseguranca #cyberattacks #threats #malware #cibercrime #exploit #hackers #hacker #breach #mitreatt&ck #pentesting #cloudsecurity #cyberwar #datasecurity #ethicalhacking #hacking #cloud #informationsecurity #securitymanagement #infosec #ransomware #datasecurity #darkreading
Comentários
Postar um comentário