An Abdication Of Cyber Leadership To Consultants

Cyber leaders seem to proudly point to bringing in outside consultants to convince executive to take action on items that have lingered for years. Social media is full of threads of such proud proclamations by both cyber leaders and consultants.

Wait.  What?!? 
  
Critical items that have lingered for years?  An outsider with more trust?  Something else seems broken there. 

Learning From Your Own Malware

The best threat intelligence comes from your own organization’s own endpoints.  One aspect to this is treating every instance of unwanted software such as malware or adware that lands and installs on a machine as an indicator of a gap in controls coverage. 

A control that is present but somehow misconfigured.

A control that is missing or has been disabled.

An error by a user. 

So, when you encounter evidence of malware, a key followup item is to determine just how the malware got there.

Cyber Leaders And the Adult Table

Moved to https://opinionatedsec.medium.com/are-you-as-an-infosec-leader-ready-to-sit-at-the-executive-adult-table-269129099e55?sk=8567d86985e13e40c42072e6a1b774f5

Mentoring Around The Time-Value of Cyber Delivery

A good cyber leader wants to meet expectations of their executive team but a great cyber leader wants to consistently exceed their expectations. The smart cyber leader has a chance to do this consistently within the context of delivery.

So how do we mentor cyber leaders to consistently exceed expectations?  

Cyber Leaders And Story Telling

Good story telling is an under-valued skill for cyber security leaders. It’s a skill that helps executives gain a deeper understanding of an organization’s cyber program and gaps. This includes the current state of the program, and properly set expectations about the resources needed to keep, or change, the current state. 

All wrapped up in an easily digestible, non-technical story.

Foundational Cyber Security Work Items

Cyber leaders have to prioritize. Yet, every vendor wants to convince the audience that their sizzling hot product should be the priority – even if the significant prep work needed for success remains unsaid.  We’ve also confused the balance of compliance with what is required to actually secure an organization.

And we wonder why even big name organizations get breached. 

If you are in a highly regulated industry or the government, your focus may have to be elsewhere but If you are in a lesser regulated industry and interested in security vs compliance, here are some completely unsexy fundamental work items that would fit most organizations …

The K in Cyber Security KPIs

The stakes involved in flying are higher than in cyber security. No one should disagree with that statement. 

With all of those high potential stakes, think about the airline key performance indicators (KPIs) that matter to you as a passenger when flying.
  
That your plane arrives at the destination.

That the plane arrives on time.
That emergency procedures are in place.
That your luggage arrives with your flight.

Each of the above is an easily digestible end state, a business outcome. Simple questions that mask the “white space” or complex activities that comprise each of those outcomes.

Mentoring Around Measuring Cyber Progress

Peter Drucker is famous for saying that you can only manage what you can measure. Nice thought but, by itself, not much help in terms of practical advice to the cyber security leader.

So how do we mentor showing progress?

The Engagement Problem of Cyber Security Ownership

This post is part 2. Part 1 is “The Conceptual Problem ofCyber Security Ownership.”

So, you decided to distribute ownership of securing business processes outside of the cyber security team within the standads set by the security team. You have a conceptual model. Now, we need to examine the mechanics of implementing that model.

Communications isn’t enough to transfer ownership to business process owners. If communications alone was sufficient, almost every cyber security team would have distributed ownership of cyber security by now. 

Communications infers one way directives. 

Easy to ignore proclamations. 

The Conceptual Problem of Cyber Security Ownership

Effectively securing the IT and information assets of an organization is as much a problem in modeling the right approach as it is in having the right controls and technical solutions in place. 

For instance, wanting to distribute ownership of cyber security across the organization isn’t a technical problem to solve.  It’s a business model problem that begins with a conceptual change that then leads to process change. 

If we want to distribute cyber security ownership, we can conceptually view the relationship of a cyber security team and a cyber program in two ways.

Play To Win In Cyber Security

Close your eyes and think of the goals for your cyber program.  Think of what a win looks like.

In American football, a prevent defense almost always means the other team has a chance to win. 

Are your cyber goals preparing your organization to win? Or, is your program playing the cyber equivalent of a prevent defense?

Cyber Leaders, Critical Thinking, and Team Colors

Purple teams confuse me.

To be more precise, small cyber teams thinking that they need some separate purple capability is what actually confuses me.

Mentoring Cyber Leaders To Say No (And Yes)

Being able to prioritize and being able to say no are two closely linked critical skills for cyber security leaders. The linkage is strong. Without being successful at one, it can be very difficult to be successful at the other.

Don’t get me wrong. The learned and practiced skill of being able to say no is really about the ability to say, “yes”.  

No to the wrong things, and yes to the right things. 

The Luck Factor In Incident Response

When malware passes through the perimeter and internal network controls, it’s going to land on something. That something is most often some sort of endpoint whether a server or user machine. 

Malware that lands on an endpoint as a result of a broad blind attack, the attacker most likely won’t know what machine it’s on, what privileges it has, or where it can easily laterally move. For some destructive attacks, this isn’t important but for many attackers, establishing basic information is.

A Security Culture From Nothing

There are organizations that have no cyber security culture. Others that have a cyber security culture that consists entirely of an annual video for all employees.  If the successful practice of cyber security relies on the corresponding ownership of secure practices throughout the company, real security awareness involves cultural change. 

A cyber security team will never be large enough to accomplish the task themselves. 

So you, as a cyber security leader, are starting from nothing. You’ll need a plan to get your organization from where they are today to where you want them to be. 

Thankful

Today is Thanksgiving in the United States. Today also means that I’ve been writing a blog post for over 130 consecutive days now. 

As of the 130 day mark, my goal of this blog remains unchanged from the day that I started on this endeavor. This is a place for me, a cyber leader in the daily fray and with nothing to sell, to share opinions often underrepresented in other social media content that help cyber security leaders understand what’s possible in a crazy good cyber program, define a clear strategic direction for their team, communicate with other executives, be resourced correctly, and reduce the level of exhausting, disruptive work.  

Building A Digitally Transformed Cyber Program

Digital transformation may involve IT and application development but it isn’t an IT process.  It’s a broader business process in which IT and application expose additional value to the business. 

As a cyber leader, you’ll have to support and secure this transformation from wherever your legacy systems are now into this new world. Unfortunately, you’ll won’t be able to hand wave away your legacy issues. Legacy systems are the transformation portion of all this. 

So how to proceed into this brave new world?

The Rest Of Cyber Security

There is some truth to the movement that you don’t need to be technical to be in cyber security. Some truth in that there are a number of roles that are clearly less technical and more framework oriented than others. The roles in which questions like, “are the correct configuration boxes checked?”, "can this person pass as a employee through security checks?" or, “is this particular business process mature to the clearly understandable standard?” can be answered in non-technical ways.

And then, there is the rest of cyber security. You know, the non-prescriptive, often technical part. 

Mentoring Execution Improvements In Cyber Security

A key moment in the career of a cyber leader is when they realize the difference between simple activity and a planned set of work designed to mature the security program in a purposeful direction. 

Activity isn't a reliable metric for improvement within a security program. And, yet, activity seems to be a popular justification for more resources. We have to think like a business leader to understand why it might not be.

Framing Data Security Conversations To Executives

Data is created, modified, moved and deleted as part of any number of business processes. These business processes and underlying technologies create transformative value for their organizations. The smart cyber leader will want to frame conversations with non-technical executives in a way that they can quickly grasp. 

A detailed explanation of NIST or other framework data security requirements probably is not the conversation format within you’ll find success. You won’t establish your expertise with execs with a deep dive into frameworks.