While there was no playbook to navigating cybersecurity amid a pandemic, there are a few key takeaways on what it means to lead effectively that can serve as a guide not just to security teams but the enterprise as a whole in the year ahead, writes MARLYS RODGERS.
The role of the chief information security officer (CISO) has always been to safeguard the business against cyber threats. Marlys Rodgers, CISO and head of technology, AttackIQ, George Finney, CSO, Southern Methodist University, Tim Rohrbaugh, CISO, Jet Blue Airways and Christopher Frenz, Information Security Officer and AVP of IT Security, Mount Sinai South Nassau, take us through the nuances that security leaders must navigate and share best practices to help other CISOs on their journey.
While the job description of a CISO may not have changed in the last couple of years, success has become far more challenging amid the pandemic. As Gartner’s VP Analyst, Peter Firstbrook, best describes it, “Over the past two years, the typical enterprise has been turned inside out. As the new normal of hybrid work takes shape, all organizations will need an always-connected defensive posture and clarity on what business risks remote users elevate to remain secure.”
The pandemic has served as an unprecedented test for enterprise security teams across industries. While there was no playbook for navigating cybersecurity amid a pandemic, there are a few key takeaways on what it means to lead effectively that can serve as a guide not just to security teams but the enterprise as a whole in the year ahead. Remote work is here to stay for many organizations, which has pushed managers to reevaluate how they connect with their direct reports and the broader team.
While the shift was undoubtedly an adjustment initially, the need to get creative gave rise to a few new best practices that ultimately boosted productivity for CISOs. Here are four tips from the world’s leading CISOs for success in 2022: Eliminating Silos to Achieve Greater Productivity “I challenge myself to have lunch with one new person weekly,” said Chief Security Officer (CSO) at Southern Methodist University, George Finney. “This not only forces me to get to know different kinds of people and build empathy for each of their experiences, but it has been vital for my career because I’ve found that being part of a much larger community is how we become more secure instead of isolating ourselves and working in silos within our own teams.” CISO of Jet Blue Airways, Tim Rohrbaugh says that aligning daily with his team has helped boost productivity. “Running threat hunting as a full team for an hour a day in the last eight months has made everyone aware of how the tools are supposed to work and where the real value comes from when trying to answer the question about threat activity,” said Rohrbaugh.
While achieving team alignment is essential, it is also necessary to empower employees individually. CISO of CSAA Insurance Group, Marlys Rodgers points out that a personal touch to communicating with employees doesn’t take a lot of time but can go a long way in fostering trust. “The gift of your time is really important,” said Rodgers. “Sending personal messages and equating the importance of their work to the outcomes is very meaningful to people. Meeting 1-1 with people, acknowledging their work, and hearing about their development plans is an important way to make your team members feel seen and heard.” Recruiting a Diverse Talent Pool to Ensure Future Success As with many industries, diversification within cybersecurity will be pivotal to ensuring success in 2022 and beyond as each person’s unique background unlocks new and varying perspectives. “Internships and mentorships to grow security talent are what the industry needs to meet the incredible demand,” says Rodgers. “Women, Hispanic, African American and LGBTQ are very unrepresented in tech and security specifically. The greater the diversity and backgrounds, the better we can be to attack the unique threats of the future.”
Embracing a Threat-informed Defense to Combat Uncertainty
Today’s security landscape requires a threat-informed defense strategy that enables greater visibility for CISOs via continuous testing of their security controls against adversary behaviors. “As security leaders, we need to increasingly turn towards taking a more evidence-based approach to security,” said Information Security Officer and AVP of IT Security, Mount Sinai South Nassau, Christopher Frenz. “Continual threat simulation and testing should be a key part of every organization’s security strategy, especially in times of uncertainty and change. Testing and refinement will help organizations incorporate more resilient controls and practices that will better stand up against an ever-changing threat landscape.”
Taking a More Holistic View Going Forward
The role of the CISO will continue to grow in influence across organizations as digital transformation initiatives progress and workflows evolve to meet increasingly changing environments. As the new year approaches, it’s time to evaluate the cybersecurity highs and lows of the past year and look for ways to improve your cybersecurity effectiveness and readiness in 2022.
- Rodgers is Chief Information Security Officer, Head Of Technology Oversight, CSAA Insurance Group
