Blog Posts Tagged with "CISO"
Enter the CISO: Torchbearer of Security and Risk Management
April 06, 2013 Added by:Anthony M. Freed
In a convergence culture, accountability for risk is accepted across the organization, and when that happens, risk management becomes a priority to the business, informing strategy and objectives. By helping identify and mitigate risk across finance, operations and IT, the CISO puts security in context of what could affect profit.
Comments (0)
CISO Challenges: The Build vs. Buy Problem (1:2)
January 21, 2013 Added by:Rafal Los
Change control, application security reviews, incident response, policy review, audit preparation, acquisition due-diligence... all of these require people, money and time - but you've got it all in short supply. Here's one way of looking at making the decision of what to build, and what to outsource...
Comments (0)
Information Security: Why Bother?
December 09, 2012 Added by:Simon Moffatt
The question, often raised as a bargaining tool, is often focused on the, ‘well I understand what you propose and I know it will increase the security of scenario X, but why should I do it?’. In honesty, it is a good question...
Comments (3)
The Security ROI "Death Spiral"
November 18, 2012 Added by:Rafal Los
The worst thing that can happen to a CISO is to get trapped in the ROI Death Spiral. I know, I know, we’ve all been told that we need to justify cost, manage expense, use the tools our companies provide us, etc. CISOs that don’t play by the rules won’t get anywhere...
Comments (0)
Infosec’s Most Dangerous Game: Groupthink
November 07, 2012 Added by:Dave Shackleford
These days, I am very, very afraid for the future of CISOs. Over the past few years, and specifically the past 12 months, I have become increasingly alarmed at the level of “groupthink” and “synchronized nodding” going on with security executives. Here are some of the things I am seeing...
Comments (0)
CISO Concerns: Security vs. Usability, Affordability
October 25, 2012 Added by:Rafal Los
Recently in New York city we hosted a CISO-level event where we discussed various issues experienced during the life of an enterprise security program. CISOs brought up various topics from budgeting to being overwhelmed with constantly evolving threats - but one in particular caught my attention...
Comments (2)
Your Next Critical Security Project May Not Be What You Think
October 23, 2012 Added by:Rafal Los
If we're honest with ourselves, we can look around the organization and find several projects that even though they are implementation-complete, are hardly "complete" as they sit. Too often after a catastrophic failure, or security incident we're pre-disposed to making hasty purchases to effectively stop the bleeding...
Comments (0)
CISO Lessons Learned
October 11, 2012 Added by:Tripwire Inc
The lessons they learn are not just from traditional infosec forensics – they also look at other parts of the business who contributed to the issue, were impacted by the incidents, or who were involved in response – and their learnings can include virtually any aspect of the chain of event...
Comments (0)
Chief Information Security Officer (CISO) Certified?
September 09, 2012 Added by:Jayson Wylie
The requirements involved with obtaining a certification past September 30th 2012 may not be beneficial for a CISO, andI do not know how applicants with this new certification will stand apart from those with graduate degrees in their understanding of security solutions...
Comments (7)
Blame the Silver Heads?
July 17, 2012 Added by:Ian Tibble
The idea that CEOs are responsible for all our problems is one of the sacred holy cows of the security industry. Security analysts, managers, self-proclaimed "Evangelists", "Subject Matter Experts", ad infinitum are responsible for the problems. Lets look at ourselves before blaming others...
Comments (4)
Do You Really Need a CISO to Have Security?
June 17, 2012 Added by:Rafal Los
In the analysis of it, every organization needs to have someone responsible for the technology-based risk or security of the organization. Whether that's the Technology Manager, the CISO, or the "IT guy". I just want to see better security, more resiliency, and less technical risk....
Comments (6)
LinkedIn Failed to Meet Standards or Better Standards are Needed
June 10, 2012 Added by:Jeffrey Carr
LinkedIn doesn't have a CSO or CISO, which for a publicly traded company communicates that security is not a priority. Considering they still don't know how this breach occurred and the minimal attention payed to password security, I can't help but wonder how secure the credit card information is...
Comments (0)
CISO 2.0: Enterprise Umpire or Wide Receiver?
May 21, 2012 Added by:Robb Reck
In security, our challenge to demonstrate to the business that the money they invest in us goes further than just keeping us out of the newspaper. Security can deliver tangible benefits out to the business. An effective security program can reduce the costs of creating products...
Comments (2)
Manage Risk Before it Damages You - Part Two
April 01, 2012 Added by:Neira Jones
For a CISO to be successful, they need not only to be prepared to eliminate redundant services and controls (ouch!), but also to promote the elimination of redundant assets which they will invariably not own. Enter the political CISO...
Comments (2)
Eating the Security Dog Food
March 23, 2012 Added by:Wendy Nather
It's harder to be accused of nefarious activities if you are completely above-board, show you're willing to be subject to appropriate limits, and make a point of relinquishing any powers you might have. Call it CYA, call it leading by example, whatever. It's ethically important...
Comments (0)
Changing of the Guard: A Perspective on the Changing CISO Role
March 19, 2012 Added by:Rafal Los
Security means different things to different people - but by and large we can agree on the need to defend our organizations against those bad guys who wish to do it harm whether it's from a purely destructive perspective or something more sinister...
Comments (0)
- Five Things Your InfoSec Team Should Do in the Next 30 Days
- The Disclosure Debate Continues….. (part 1,453, 769) to be Continued
- The Danger of Mixing Cyber Espionage with Cyber Warfare
- Improving Security by Failing Faster
- BYOD: Should It Be the Wave of the Future?
- Trend Micro Discovers "SafeNet" - a New Targeted Espionage Operation Online
- Managing My Company’s Security is a Nightmare
- Bridging the Cybersecurity Divide, Why Security Innovation Must Lead the Way
- The Evolution of Industrial Control System Information Sharing
- ATM Security (And Really Learning from the Past)