FRANK KIM at the SANS Institute and YL Ventures explores the evolution of the modern CISO.
As the cyber-threat landscape has evolved, so too has the role of the modern Chief Information Security Officer. Gone are the days of the siloed CISO who operated from an ivory tower without a seat at the boardroom table for major organisational decisions.
Today, as digital transformation expands and business demands intensify, the modern CISO role has shifted from purely tactical to fully transformational – the (cyber) quarterback of the organisation who aligns strategic planning, policy, and processes within a value-centric security architecture designed to mitigate cyber-risk and business risk.
Protecting an organisation from cyber-threats no longer falls on the CISO’s shoulders alone. It’s a collective responsibility spanning across the entire organisation, starting at the top with corporate leadership and extending down to every level of the enterprise.
Gartner forecasts indicate that by 2026, more than 50 per cent of C-level executives will have performance requirements related to cyber-risk within their employment contracts. Expected new SEC regulations will also mandate publicly traded organisations to disclose their cyber-security governance efforts, particularly the Board’s oversight of cyber-risk within its larger business strategy.
Now more than ever, positioning CISOs to serve in the capacity of a transformational leader is critical to enterprise health.
Making cyber-security a business priority
The transformational CISO is the bridge between cyber-security and the C-Suite. With that said, they must be able to effectively articulate the link between cyber-incidents and business disruption in a way that resonates with various stakeholders of the organisation. This requires a holistic understanding of cyber-risk’s three fundamental tenets: threats, vulnerabilities, and impact.
Historically, CISOs focused primarily on the tactical aspects of cyber-risk without consideration of the bigger picture. Deploying security tools to identify threats and address vulnerabilities was our bread and butter, but assessing the bigger picture was more of a foreign concept.
However, the proliferation of cyber-attacks on a global scale has added a myriad of new variables to the equation. From nation state adversaries driven by geopolitical tension to digital extortionists driven by organised crime, the cyber-threat landscape is now malicious and highly sophisticated – and it’s evolving as we speak.
In turn, the modern CISO must operate beyond day-to-day operations with a targeted focus on the bigger picture.
Deciphering the impact of cyber-risk requires visibility into the organisation’s “crown jewels.” These are the processes and assets that create the biggest market advantage, revenue growth, and sustained success. Obtaining that level of understanding is only possible through calculated communication with corporate leadership.
Instead of merely asking the C-Suite what cyber-threats keep them up at night, a more effective line of questioning could be, “What product or service offerings does our market success depend on right now? Which key differentiators are critical to rising above industry competitors?”
Then, with deeper insight into the organisation’s highest-value assets, CISOs can construct a security architecture designed to safeguard critical processes and minimize business disruption.
Creating a team sport security culture
The transformational CISO is responsible for fostering a company-wide culture of cyber-resilience where all employees play a role in safeguarding the organisation.
However, generating that collective cannot be accomplished through static engagement and one-size-fits-all training that lack contextual awareness. It compares quite nicely to the challenges of parenting a teenager. Just because we know what’s best for our kids doesn’t mean they will always do what we tell them. But if we can effectively illustrate the value behind our advice – and that we’re offering it with their best interest in mind – there’s a far better chance it will translate to positive action.
The same goes for CISOs tasked with building a culture of cyber-resilience. We can’t expect standard sets of policies or routine training to automatically translate into 100 per cent staff-wide security compliance. For internal engagement to resonate, it must be scaled to the individual end user and designed with personalisation in mind – offering valid reasoning that a non-technical workforce can understand.
When given a paved road of proven protocols to follow, employees will be more inclined to follow protocols and keep the organisation safe. Compounded at a macro level, it creates a dynamic where security awareness is ingrained into day-to-day workflows as part of an overarching company culture.
Five keys to CISO success
As a CISO myself, I’ll be the first to acknowledge that engaging the C-Suite on cybersecurity matters isn’t always smooth sailing. I once met with a CFO to secure her buy-in for a particular security business case we wanted to adopt. Just a few minutes in, she stopped me and said, “Frank, we get it. We know our cyber-security measures need to be top of mind.” For a fleeting moment, I began to feel the meeting was headed in the right direction.
Except then came the dreaded “B” word.
She continued, “BUT, what we really want to know is ‘Are we spending too much? Are we spending too little? How are we doing compared to our industry peers?’”
If I wasn’t prepared to address her concerns, the whole business case we were proposing could’ve been derailed – resulting in unaddressed issues that could our business at risk.
These are the kinds of questions that C-level executives are asking their security leaders every day. To effectively answer them, keep these five areas of focus in mind.
1. Choose the right framework: Select an industry recognised framework that not only aligns with your organisation’s risk profile, but also demystifies cyber-security measures to the C-Suite and Board. The NIST Cyber-security Framework, for example, helps simplify the complexities of security in a way that can be more easily consumed by business leaders.
2. Measure your maturity: It’s not enough to simply adopt and leverage a security framework. As you implement its various controls, make sure to baseline and measure the maturity of your top security capabilities. That way, progress can be monitored over time.
3. Benchmark against industry peers: An organisation’s level of cyber-spend should be relative to its risk profile. But as your maturity improves, identify how the organisation’s security architecture is performing in relation to the sector at large – that can help determine if you’re spending too much or too little.
4. Set an optimal target: Organisations on the high end of the maturity spectrum may decide to compare themselves to a more mature industry as a stretch goal. But even if you stay within your industry for comparison purposes, set a maturity goal that is always based on a deep understanding of business risk.
5. Continuously measure effectiveness: Even with a well-defined framework, maturity model, benchmark, and goal in mind, one key question remains: are you utilizing your limited resources effectively? As organisations deploy, maintain, and operate their security programme, continuous measurements and assessments should be non-negotiable.
* Kim is a SANS Fellow and Instructor, leading the cloud security and cyber-security leadership curricula to help shape and develop the next generation of security leaders. He is also the CISO-in-Residence at YL Ventures.
