Lessons Learned from a Virtual CISO (Panel Discussion)

Managing Enterprise Risk in a Rapidly Evolving Landscape

As virtual Chief Information Security Officers (vCISOs), our primary goal is to provide superior cybersecurity support across various client verticals. We navigate and address each vertical’s unique cybersecurity and compliance challenges, offering customized solutions based on individual business needs and objectives.

In the rapidly evolving digital landscape of 2022, enterprise risk management emerges as one of the biggest challenges. This holds true regardless of the organization’s size and shape. By using precision and thoroughness to identify and manage varying levels of potential risks, we empower organizations to comprehend and effectively manage these challenges fully.

Role of a vCISO in Today’s Environment

1. Focusing on Actual Security Rather than Mere Compliance – Complementing this, we eradicate common misconceptions associated with security compliance. By ensuring that the focus is on actual security rather than merely ticking compliance boxes, we elevate the security measures beyond standards and certifications.
2. Transitioning the View of Security from Cost Center to Revenue Generator – Our vCISO services also help businesses transition from viewing security as a cost center to recognizing it as an instrumental revenue generator. In a time when security has become intertwined with business operations and critical client decisions, we help highlight the value of having a robust security program. We position security as an operational necessity and a fantastic marketing tool – instrumental for gaining an edge over competitors.
3. Providing Complete Cybersecurity Support and Transforming Security Mindsets – Our vCISO services aim to provide complete cybersecurity support, transforming the way organizations view and handle their security measures. We bring about a paradigm shift, making cybersecurity a gateway to enhanced business operations and revenue generation.
4. Gaining Executive Buy-In – I’d like to add a few things. First, we want to move away from the standard cookie-cutter solutions you often see. Having acquired various certifications, executive buy-in is one of the biggest components underscored. Ensuring we are secure against external threats and not assuming unnecessary risks is crucial, and gaining executive leadership buy-in is often one of the biggest challenges.
5. Providing Guidance on Security Best Practices – Once you’ve achieved buy-in and set all the goals, another issue is the lack of understanding of best practices. You may have executive leadership that’s assigned an individual who is keen on developing a security program. However, they encounter various contrasting practices when they look online for guidance. For instance, some sources might argue against changing passwords regularly, while others may advocate for a complete move to passwordless systems. This creates a strong need for direction and insight into best practices.
6. Aligning Best Practices with Organizational Context – Additionally, it’s important to note that best practices aren’t universal and can vary from one company to another. For instance, a company with a robust budget may be able to implement an expansive array of technologies, while others must work within budget constraints to secure their systems effectively. Keeping budgetary considerations top of mind is imperative when planning out a security strategy. It’s vital to understand that the strategy should remain flexible and adaptable to changes as they arise.
7. Helping to Plan for Resource Allocation – Resources are always a considerable factor. However, the right amount to invest can be challenging to discern. While we would all like to have unlimited resources for security, this isn’t a practical expectation. Therefore, effective communication about potential risks and cost-benefit analysis becomes essential in securing the necessary resources for your security plan.
8. Adopting a Practical Approach to Security Planning – A practical approach understands that strategic planning for security comes with allocating resources effectively. This could involve hiring personnel, investing in technology, or adjusting your operations. Neglecting to allocate these resources can result in a buildup of technical debt or, worse yet, find your systems compromised.

The Need for a Customized Approach to CISO Services

When I initially joined the team, I was looking for a standard approach to tackle cybersecurity. However, I quickly learned that every case is unique due to industry differences, varying regulations, organizational success factors, and evolving metrics. Whether it involves a digital transformation initiative or other major business changes, achieving core goals depends on consistent executive buy-in, regular check-in points, and diligent tracking of programs.

Breaking Down Cybersecurity into Administrative and Technical Aspects

One way to construct a comprehensive cybersecurity program is to view it from two perspectives: administrative control and technical aspects. Administrative elements involve understanding the organization’s risk profile and drafting policies that govern internet use, corporate device use, as well as data privacy and compliance.

Choosing the Right Framework

Moreover, your choice of framework, whether NIST, ISO, or another, is significant because it provides structure to manage your program and set definite goals. Asset management is another critical component, as securing what you’re unaware of owning is impossible. Managing an asset’s entire lifecycle is essential to ensure its security from deployment to decommissioning. Similarly, identity and access management are key to maintaining control over who has what level of privileges within your network.

Providing Continuous Cybersecurity Awareness Training

Last but not least, cybersecurity awareness training plays a central role in an administrative context. Since people can often be the weakest link in the cybersecurity chain, continuous training is vital to keep them informed and maintain an effective cybersecurity program.

Considering Critical Technical Controls

Cybersecurity is increasingly becoming an integral part of business, with various technical controls coming into play. Concepts such as Zero Trust, endpoint protection, and others are important to consider for your cybersecurity strategy. As we focus on technical controls, certain elements like Next-Gen capabilities, OS hardening, firewall implementation, Internet security, and vulnerability scanning gain prominence.

Gaining Executive Buy-In Energizes Security Efforts

However, the effectiveness of a cybersecurity program isn’t solely contingent on the components mentioned above. What makes a program truly effective is executive buy-in. Encouraging leadership to understand and support the facets of a cybersecurity program brings immense value. It’s energizing when leaders are involved and actively support your cybersecurity efforts.

For instance, the involvement of a CO in a recent Business Continuity Plan (BCP) test had a significant impact on the team. Her active participation and acknowledgment of the work done not only created a sense of approval but, more importantly, it energized the team. The presence and active involvement of executive management in various facets of cybersecurity can significantly enhance the effectiveness of a cybersecurity program. It underscores the importance that leadership places on cybersecurity, thereby invariably leading to strategic business alignment. This buy-in from executives is a solid foundation ensuring an effective cybersecurity program.

Involving Operations to Drive Security Requirements

Certainly, the operations team often focuses on ensuring that the business is fulfilling its functions and getting that product out the door. If one of the goals of that product or service is security, involving the operations team can drive the need. However, security often drops down their priority list when the choice is between adding a feature or fixing a bug. The issue is usually tackled when it has boiled over to an emergency, which is when something has already broken or there’s a public policy notice.

Filling the Need for Dedicated Security

As an experienced auditor, I’ve seen some companies struggling to separate duties between IT and security functions. Often, these companies are trying to do their best with the resources they have. Adding dedicated security personnel, a significant financial commitment is typically not feasible for many small businesses. As a vCISO, we can provide that requisite expertise without the need for a full-time resource, helping isolate the necessary steps to modify and secure processes.

Having a liaison who understands the business and has the skills to navigate different teams and escalate concerns is paramount.

Distributing Security Efforts Company-Wide

As part of an effective cybersecurity program, it is essential to distribute security efforts across all facets of the company. A strong way to actualize this approach is through implementing a security steering committee. This group, consisting of representatives from different facets of the company, can meet regularly to discuss security matters. This approach ensures that security becomes an integrated part of the company rather than being confined to a corner, only addressed when an urgent matter arises or a request comes in.