Q3 2017

CISO Manifesto is a destination for chief information security officers (CISOs) to share their observations, thoughts, and frustrations. The manifestos are written by CISOs, for CISOs.

POINT OF VIEW

10 Rules for Cybersecurity Vendors

Why marketers fail at selling to CISOs… and what to do about it.

– Gary Hayslip, VP & CISO, Webroot

San Diego, Calif. – Aug. 8, 2017

So as businesses today focus on the new opportunities cybersecurity programs provide them, CISOs like myself have to learn job roles they were not responsible for five years ago.

These challenging roles and their required skill sets I believe demonstrate that the position of CISO is maturing. This role not only requires a strong technology background, good management skills, and the ability to mentor and lead teams; it now requires soft skills such as business acumen, risk management, innovative thinking, creating human networks, and building cross-organizational relationships.

To be effective in this role, I believe the CISO must be able to define their “Vision” of cybersecurity to their organization. They must be able to explain the business value of that “Vision” and secure leadership support to execute and engage the business in implementing this “Vision.”

So how does this relate to the subject of my manifesto? I am glad you asked.

The reason I provided some background is because for us CISOs, a large portion of our time is spent working with third-party vendors to fix issues. We need these vendors to help us build our security programs, to implement innovative solutions for new services, or to just help us manage risk across sprawling network infrastructures.

The truth of the matter is, organizations are looking to their CISO to help solve the hard technology and risk problems they face; this requires CISOs to look at technologies, workflows, new processes, and collaborative projects with peers to reduce risk and protect their enterprise assets.

Of course, this isn’t easy to say the least, one of the hardest issues I believe CISOs face is time and again when they speak with their technology provider, the vendor truly doesn’t understand how the CISO does their job. The vendor doesn’t understand how the CISO views technology or really what the CISO is looking for in a solution.

To provide some insight, I decided I would list ten rules that I hope technology providers will take to heart and just possibly make it better for all of us in the cyber security community.

So, let’s get started. I will first start with several issues that really turn me off when I speak with a technology provider. I will end with some recommendation to help vendors understand what CISOs are thinking when they look at their technology. So here we go, let’s have some fun:

1. “Don’t pitch your competition”

I hate it when a vendor knows I have looked at some of their competitors, and then they spend their time telling me how bad the competition is and how much better they are. Honestly I don’t care, I contacted you to see how your technology works and if it fits for the issue I am trying to resolve.

If you spend all of your time talking down about another vendor, that tells me you are more concerned about your competitor than my requirements. Maybe I called the wrong company for a demonstration.

2. “Don’t tell me you solve 100% of ANY problem”

For vendors that like to make grand statements, don’t tell me that you do 100% of anything. The old adage “100% everything is 0% of anything.”

In today’s threat environment, the only thing I believe that is 100% is eventually that I will have a breach. The rest is all B.S. so don’t waste my time saying you do 100% coverage, or 100% remediation, or 100% capturing of malware traffic.

I don’t know of a single CISO that believes that anyone does 100% of anything so don’t waste your time trying to sell that to me.

3. “Don’t make me specialize to use your tool”

Don’t tell me your solution is written in proprietary language and I will need this module or this application to read the data correctly.

I have limited funds and a small team. I need a solution that will integrate with my current security suite and it’s easy for my staff to implement, manage, and create reports. Better yet, I like modular solutions that can grow with my organization as we mature.

So, don’t hit me with an extra bill each time I want to add a requirement or use a new service, just incorporate it into one bill that I can budget for and defend when I go to financial management.

4. “Don’t bring me overcomplicated solutions”

This is a big issue. To all vendors, if the technology that you want to sell me takes four sales engineers to explain it to me and several hours to demonstrate then it’s way too complicated for me and I am not interested.

I am dealing with issues 24/7, I typically have small teams and not enough funding so I am not going to dedicate one staff member to just use your solution. True, you can make the case that it’s an awesome security technology. However, the more complicated and time consuming the technology, the more resources get consumed in trying to make it work and my teams don’t have that time.

Bring me something that is elegant and easy to use, reports that are intuitive and easy to configure, and it integrates whether through API or scripting with my SIEM and other toolsets – I would give a body part for this usability.

5. “Don’t try to shortcut my procurement cycle”

As a vendor, when you are dealing with governments or large organizations remember our procurement cycles are not fast. Some organizations are better than others but understand it takes time.

Also, understand when you deal with a CISO for a government agency and they tell you they are working on the issue for you, don’t go behind his/her back and start harassing their procurement for the purchase order so you can meet your numbers. To me that immediately kills any relationship and trust we may have had and I will request a new vendor.

Again, government procurement cycles are longer and take time. It’s all about the relationship don’t screw up a long-term relationship to make a quick buck.

6. “Do be a partner to me, for I value partnerships, not technologies”

As a technology solution provider, if you want to do business with me as a CISO, I want a relationship.

I partner with all of my vendors and expect to speak with you more than just once a year when it’s time for renewal. I like to work with my vendors and make suggestions to improve the product and help the customer community. If you’re not interested in that, then don’t bother calling me or better yet don’t expect me to renew with you.

7. “Do give me three unique value propositions for using your technology”

Vendors, please understand when you are talking to a CISO we are dealing with a large number of threats, projects, audits, politics, budget issues, compliance requirements etc. So for sanity’s sake, keep your pitch simple.

Don’t go into the weeds, focus on 2-3 key value points about what your solution, platform, hardware etc. can do for us to help reduce our stress overload and provide visibility into the issue you are trying to solve for us.

8. “Do know what problem you are trying to solve”

From the previous statement above, KNOW WHAT PROBLEM YOU ARE TRYING TO SOLVE!

Please know what the problem is, why it’s a problem, why it’s going to get worse if not remediated, and how you can take that problem and turn it into a good news story for me so I want to work with you.

9. “Do automate, it is the future”

Please tell me how I can automate your solution, again with small teams and limited resources.

I am on the lookout for how I can reduce risk to my organization through automation using AI, UBA, SDN, and other technologies so I can concentrate my teams and our resources on those areas that are impactful to my stakeholders.

If your solution is a standalone technology that must be manually operated, you are five years late. The threats we currently face are happening so fast that the survival of my networks is based on what I can automate.

10. “Do bring platforms, not individual tools”

My last point I want to make is that as a CISO when I am looking at technology to assist me with a security gap I tend to look for a solution that is a platform. I don’t like to look at one-offs.

I have enough issues and technology to manage so I would much rather look at a platform solution. Show me something that helps me solve several security control issues and it is mature enough to grow with me over time. I know there are companies that have their niche and all they do is one small thing very well. Eventually, someone is going to add that niche to their platform and even if they don’t do it as well as you it will be enough for you to lose market share.

Just understand I am trying to remediate as many issues as I can with limited funding so I will look for platforms more often than not to do this effectively.

So, there are my ten rules. Some of them are annoying issues that I really hope my next sales call takes to heart and some of them insight into how I source technology when I am researching a requirement.

“Oh, and no cold calls…”

As a CISO, I will normally talk to my peers first for ideas on how to remediate an issue. I will also research solution ideas from the forums of professional organizations that I am a member of and I will contact research providers such as Gartner, Forrester or boutique research firms that specialize in areas I focus on such as TechVision.

When I am ready, I will reach out to a trusted partner to bring in a technology that I am interested in or I will directly contact the company. I typically like to be contacted via email first, even though I get huge amounts of correspondence, I try to let vendors know if they are in a technology that I might have a need for and, if so, I will request a meeting.

Again, most CISOs have limited time and are dealing with numerous issues across their organization, cold calling one of us will normally get your number blocked and we will definitely not reach back out to you.

One of the main reasons is cold calls to me are interruptions, you are breaking up the flow of my day and interfering with what I am trying to accomplish. I would much rather talk to you at a professional event or via email from one of my trusted partners.

As I end here, I hope some of you find this information of value and I really look forward to seeing what our community has to say in return.

Please provide your points of view for the betterment of our community, I think improved communications between the security executives of organizations and the technology partners who serve them would greatly improve our community and increase our ability to innovate and respond to the threats that put our organizations at risk.

Stay tuned for the Q4 2017 edition of CISO Manifesto.

Gary Hayslip is Vice President and CISO at Webroot, and Co-Author of the book CISO Desk Reference Guide: A Practical Guide for CISOs

(This story was written when Gary Hayslip was CISO for the City of San Diego, Calif.)