The K in Cyber Security KPIs

The stakes involved in flying are higher than in cyber security. No one should disagree with that statement. 

With all of those high potential stakes, think about the airline key performance indicators (KPIs) that matter to you as a passenger when flying.
  
That your plane arrives at the destination.

That the plane arrives on time.
That emergency procedures are in place.
That your luggage arrives with your flight.

Each of the above is an easily digestible end state, a business outcome. Simple questions that mask the “white space” or complex activities that comprise each of those outcomes.

A Security Culture From Nothing

There are organizations that have no cyber security culture. Others that have a cyber security culture that consists entirely of an annual video for all employees.  If the successful practice of cyber security relies on the corresponding ownership of secure practices throughout the company, real security awareness involves cultural change. 

A cyber security team will never be large enough to accomplish the task themselves. 

So you, as a cyber security leader, are starting from nothing. You’ll need a plan to get your organization from where they are today to where you want them to be. 

The Gift Of Post Data Breach Optics

As cyber professionals, our job is to think about preventing breaches. We have controls that have put in place. We measure the efficacy of those controls. And we have a backlog of work that remains to be done. 

 

During an incident, we work to respond to the incident. If that incident rises to the level of a data breach, we work within the context of an enterprise crisis action team to contain every aspect of that breach, technical and non-technical.

But how often do you think about what happens post-breach after the exhausted response team has gone home?  By this, I mean the regulators. Depending on your industry and location, you'll likely have state and/or federal regulators knocking on your door.

Giving Meaning To Second Order Effects from Security Policies

I have a qualitative and anecdotal measure for knowing when business process owners have really started to internalize security changes and think about cyber risk. 

That measure? You’ll begin to see positive second order effects of the changes.

Mentoring Cyber Security Professionals On Ambiguity

Ambiguity is a reality in cyber security, cyber risk mnagement, and cyber threat intelligence.

The path to answering, "what's going on here?" may simply not have a lot of clarity.

Less regulated industries in particular can be a hotbed of additional ambiguity as executives balance the very strong competing priorities of revenue generation and operational resilience with the friction that secure processes and security controls can bring. 

Team members new to cyber security need to be prepared for dealing ambiguity in its many forms. 

What Do You Want In A Cyber Security Program?

There is no “one size fits all” approach when building or re-building a high performance cyber security team.

The team that you build depends on the cyber program that you currently have, the industry that you are in, and the type of program that you want to build.  

The definition of success for a security team in a regulated industry may be very different and require a different set of skills than a security team in a less regulated industry.

Cyber Security Has Its Own Shadow Problem

Shadow IT. A common cyber security term for the use of unauthorized software applications. 

An issue of unapproved software use represented by little review, oversight, or security controls. Normally, found in the crusty corners of accounting, HR, devops, or anywhere really even IT.

Some Wrenching Cyber Security Tool Tomfoolery

For some reason, cyber security practitioners often confuse the value of cyber security tools with the value of the outcomes that these tool provide. 

There is a difference. 

A difference that impacts how you’ll interview, hire, promote, and operate.

MOVED:The Eyes And Hands That Scale A Cyber Program

This post has moved to https://medium.com/@opinionatedsec/the-eyes-and-hands-that-scale-a-cyber-program-d42537f3d7c7?sk=c2f2494b0a385da28bcac4c066d9e3ac

Follow me on Twitter for discussion and the latest blog updates: @Opinionatedsec1. Or, start your own discussion using #crazygoodcyberteams on twitter or Linkedin and I'll read it.

SEE ALSO

A Forgotten Cyber Security Feedback Loop

A Cyber Security Spend Alternative 

An At Scale Cyber Tale

A Forgotten Cyber Security Feedback Loop

The most successful cyber security programs incorporate feedback loops. 

There is the unplanned feedback loop. The things that jump to the top of the pile or that originate from a place outside of your control. All impacting your work plan.

Disruptive incidents, audit requirements, regulatory initiatives, and perhaps the frequent executive good idea fairy might be good examples. 

Normal. 

But there also is an often forgotten feedback loop. 

The things that your team clamors for. Begs for. Requires for success. 

Things that perhaps never have been  previously listened to, considered, or prioritized.

The purposeful feedback loop manifests in team SWOT exercises and 1:1 conversations. The frequent suggestions that round out sharp corners and reduce friction on the team’s ability to execute. 

This other feedback loop is purposeful for a reason. Your team is closest to the action. They know what needs to be done and you’ll need to make space in your work plan to get them done. Perhaps even push off some unplanned work. 

That's how important making this other feedback actionable will be for a cyber leader. 

Your chance to carve out a win for your cyber security team of their choosing and from their input. The team will know that you hear their concerns and make their work more meaningful.

Because you took the time. Made the effort. Pushed back where necessary. 

And re-prioritized purposefully.

For the team win. 

Follow me on Twitter for discussion and the latest blog updates: @Opinionatedsec1. Or, start your own discussion using #crazygoodcyberteams on twitter or Linkedin and I'll read it.

SEE ALSO

Unit Tests Won’t Tell You The Customer Experience

The Biggest Threat To Cyber Security

The Cyber Recruiting Value-Add

MOVED: A Most Surprising Cyber Security Insider Threat

This post moved to https://medium.com/@opinionatedsec/a-most-surprising-cyber-security-insider-threat-1e8ef561907?sk=9933030113a53e61c4bd968c8cbf5964

Follow me on Twitter for discussion and the latest blog updates: @Opinionatedsec1. Or, start your own discussion using #crazygoodcyberteams on twitter or Linkedin and I'll read it.

SEE ALSO

Unit Tests Won’t Tell You The Customer Experience 

Some Potential Indicators of an Immature Cyber Security Program

A Legacy Infrastructure Security Swan Song

MOVED: Indicators of an Immature Cyber Security Program

This post moved to https://medium.com/@opinionatedsec/indicators-of-an-immature-cyber-security-program-443364919f02?sk=52b82209268a228a34c31b2cb8c2abab

Follow me on Twitter for discussion and the latest blog updates: @Opinionatedsec1. Or, start your own discussion using #crazygoodcyberteams on twitter or Linkedin and I'll read it.

SEE ALSO

The Cyber Security Program’s Back 40  

Improving Cyber Security Program Predictability

An Insufficient Cyber Resources Homework Assignment