How newly- appointed CISOs can lay the foundation of a sound security strategy

In an interview with ETCIO, Tom Scholtz, VP and Gartner Fellow, Gartner talks about the key steps a new CISO should take to ensure he stays on the right track
How newly- appointed CISOs can lay the foundation of a sound security strategy The first 100 days in a new job can open up new opportunities and throw up intimidating challenges. More so, if you are taking up the role of an information security guardian.

Oftentimes, the CISO is strongly lambasted by the business for being too steeped in technology. Most well-intentioned CISOs fall out of favor with business because they dictate controls and guard against any possible security risks, impeding the ability of business to take be agile. But a CISO doesn’t have to be a mere janitor. He can work with business to make a resounding difference.


How a CISO performs in the first 100 days in the role is critical to his success or failure as a security executive. What should the newly-appointed CISOs do to maximize their success during this pivotal transition phase?

Newly- appointed CISOs should focus on three things. One of the most important things that they need to do is to establish credibility in the first three months. If they don’t enjoy the credibility of their executive board then their job will become just about impossible. In order to gain credibility, they need to focus on establishing relationships with important stakeholders and key influencers within the organization.

Second, they should define and communicate a clear vision of what they would like to achieve. So they need to be able to express very clearly in non- technical terms what they want to achieve in the next 2-3 years and where they want to take security and risk management in the enterprise.

Third, they must identify five critical projects that need to be done and start executing on two of those projects in the first 100 days.

If they do these three things they will be able to establish a good credibility in the first three months.

What are the effective strategies for obtaining and maintaining support for security initiatives?

Most CISOs fail early in their tenure. There are a number of reasons for this. Often it is because they focus too much on technology and neglect the people and process aspects. In many cases, it is because they cannot communicate effectively with their executive peers. CISOs are sometimes not able to articulate the business value of security initiatives.

Sometimes their approach to enforcing security is flawed. They tend to dictate controls to the rest of the enterprise. In organizations where there is more autonomy and less hierarchy, the dictatorial approach to security simply does not work.

If the CISO and his security function do not have credibility within the organization, everything he says and does will be futile. If the management feels that the CISO is an obstructor and only spreads fear, doubt and uncertainty then he will always be bypassed in the strategy making process.

The CISOs need to understand the principles of an effective working relationship with the business because it to allows him to establish and maintain credibility with business. Once he has credibility he can figure out how to potentially communicate the value of security across the organization.

In order to establish a foundation of credibility and leadership, the CISO should leverage the principles of psychology and sociology.

He should identify the key influencers in the organization, people who have a common interest in good governance, risk, and compliance. He should have one on one meeting with them, understand their concerns, seek their feedback on the current state of enterprise security within the company, ask for their inputs and seek their involvement in the blueprint for action. Sharing a good rapport with them will ensure a good start. They will, then, influence the rest of the organization over time.

The CISO should never end up in a situation where he becomes the lone voice. It’s very easy to ignore a lone voice but it's hard to ignore a set of influencers who share the same message.

If he builds a coalition with the influencers and other stakeholders they will be his evangelists. They will stand by him and support his objectives as the CISO.

Besides leveraging the principles of psychology and sociology, the CISO should also focus on the principles of marketing.

He should identify different target audiences. Horizontal communication is important but it’s all the more important to communicate vertically. Line managers have a great influence on the way people behave in an organization. With their direct influence on the end users, they can enable support for your security programs and help you build a culture of security and risk awareness among the employees.

Clearly articulating the business value of information security remains one of the major obstacles that CISOs face. The benefits of information security must be articulated to the board. How can the CISOs be board ready for enterprise security?

First off, the CISOs should understand the business strategy and then extrapolate the security strategy from it. They need to understand the business context and the business drivers.

They should demonstrate that they understand “how things work around here.” The most important thing is that the CISO should take cognizance of is the business ethos, organizational culture and the risk appetite of business.

If an organization is innovative and wants to make inroads in the digital business, the CISO should recognize that it has a higher risk appetite. In such a scenario if his security strategy is inherently conservative and he tends to say no to every new initiative for the security reasons, he will be in conflict with the business. This his weaken his stature in the company and he will be bypassed more often than not.

In order to avoid the situation of conflicting objectives, the CISOs should follow the 4 I model ( Integrity, Indemnity, Investment, Insurance & Assurance). This model helps them link the business drivers with security initiatives.

In many instances, the CISOs develop a Rolls Royce of a security plan. Sometimes they build a security strategy where they try to be all things to all people. I review a lot of security strategies and unfortunately many of them try to deliver the best possible of security solutions to all the people and they are trying to do it yesterday.

The executive board talks in terms of revenue, growth and competitive advantage. Executives are inherently risk-taking individuals. They don’t like to be told that they are taking unwarranted risk. They want to be told how the CISO can help them manage the unacceptable risk in order to be more successful.

The board doesn’t like scare stories. If you use too many scare stories, they end up looking at you as an agent of doom. If you use examples of security breaches make sure they are applicable and relatable, so that the executives feel,” Aha, so that can happen to us too.” If you are a construction company and you use examples like Sony Pictures, JP Morgan Chase, LinkedIn, and Target, then you torpedo your own justification.

What are the key techniques for effective cost-benefit analysis for security project investments?

For most organizations, security does not drive primary value or revenue. Security, for most organizations, is only about preventing bad things from happening. So it’s very difficult for the CISOs to articulate the business value of security. In many cases, it is impossible because we are investing in technologies and capabilities that will prevent a hypothetical situation that may have a hypothetical impact. What’s the probability that’s going to happen?

If a CISO invests in a data loss prevention capability, he reduces the risk of a security breach. He will sleep better at
night. For a CISO that increased the level of trust in the system is his ROI. But business calculates the RoI in financial terms.

The best way is to do a price performance analysis by talking about the benefits of the security program. Don’t play the
number game with the board. Don’t talk numbers if you can’t defend your RoI projection. Talk to the board about what you are doing at the program level, project level and operational level.

Follow and connect with us on , Facebook, Linkedin


Sponsored Stories