The Potential Downside of Cyber Metrics

You always get what you measure.That phrase or some paraphrase of it is usually meant to justify some positive change. 

For example, we were doing such-and-such activity before with poor results and then we started measuring and got better results.

This is a common statement and standard narrative in any cyber security program.

When the stakes are high, we want to be sure to turn the box green, finish within the right time boundary, or get results above the right percentage.

Rethinking Gaps In Cyber Security Programs

Think about cyber in business terms for a second. A description of a cyber security program without a clear statement of program gaps is like a balance sheet without a liabilities statement. 

And yet, somehow, gaps seem to be an often minimized part of our conversations with executives. 

Perhaps as cyber leaders, we choose to avoid hard conversations about program gaps because we want to be positive. Maybe we avoid them because we have some level of fear of executive reaction to hearing about gaps in the cyber security program in the context of past investments. 

Transforming Into A Cyber Security Culture Takes Guts

Sometimes, organizations confuse cultural transformation around security with security awareness training.

Making annual cyber security training mandatory doesn’t take much to implement. A little bit of coordination with the right people and perhaps some pointing at some cyber security framework language and it is done. 

Checkbox checked. 

MOVED: Mentoring Scope of Authority Within Cyber Security Teams

This post has moved to https://medium.com/@opinionatedsec/mentoring-scope-of-authority-within-cyber-security-teams-85c95c391587?sk=95c14b87404e9c4b2e32778c1694b4df

Follow me on Twitter for discussion and the latest blog updates: @Opinionatedsec1. Or, start your own discussion using #crazygoodcyberteams on twitter or Linkedin and I'll read it.

SEE ALSO

Cyber Security High Hanging Fruit 

Mentoring Around Reducing Distracting Cyber Work 

Mentoring Around Waiting In Cyber Security

MOVED: Cyber Security High Hanging Fruit

This post has moved to https://medium.com/ciso-cyber-leaders/its-time-to-deal-with-cyber-security-s-high-hanging-fruit-7e1382a8c270?source=friends_link&sk=dd6c6c84e9dd5202337ce968109f1f42

Follow me on Twitter for discussion and the latest blog updates: @Opinionatedsec1. Or, start your own discussion using #crazygoodcyberteams on twitter or Linkedin and I'll read it.

SEE ALSO

Cyber Security Shared Consciousness: A Primer 

Busy As Misplaced Power In Cyber Programs

The Problem With Cyber Security Being Everyone’s Job

Cyber Security Shared Consciousness: A Primer

Cultural transformation defines successful cyber security. 

You have a concept. A change. Something necessary but perhaps not tangible….yet.

It might be some change to a focused activity or something broad like re-engineering the entire cyber security program. Either way, you’ll need to start with something.

Shared consciousness.

Next Level Marketing Of The Cyber Program

Internal marketing is a key component of a successful cyber security team. Senior cyber leaders should be regularly communicating to the Board and the senior executive team. That said, there is likely a far larger audience that also wants and needs to understand the key messages of relevant portions of the cyber program.

Strategy.
Roadmap.
Current Capabilities/State
Wins.
Gaps.

There are equally good reasons to encourage mid-level cyber leaders to market their portion of the cyber program as well to their stakeholders, business process owners, and mid-level management.