CISO DRG Volume 1

by | Mar 24, 2019

The CISO Desk Reference Guide, Volume 1, 3rd Edition is the greatly anticipated update to the first volume of the highly respected two-volume set written by experienced practitioners and intended for recently hired or promoted Chief Information Security Officers (CISOs). These easy-to-use guides are also perfect for individuals aspiring to become CISOs, as well as business and technical professionals interested in the topic of cybersecurity. Those with the titles Chief Technology Officer (CTO), Chief Information Officer (CIO), and Chief Privacy Officer (CPO) will gain critical insights, and members of the board of directors and other executives responsible for information protection will find them invaluable.

As a desk reference guide written specifically for CISOs, we hope this book and its companion CISO Desk Reference Guide, Volume 2, become trusted resources for you, your teams, and your colleagues in the C-suite. The different perspectives offered by the authors can be used as standalone refreshers, and the five immediate next steps for each chapter give the reader a robust set of actions based on roughly 100 years of relevant experience that will help you strengthen your cybersecurity programs.

Buy on Amazon
Buy on Apple
Buy on Kobo
See all purchase options

Description

The CISO Desk Reference Guide is constructed as a two-volume set. For the third edition, we made some key changes to how we arranged the material to provide what we believe is a better flow from topic to topic. Chapters are slightly reordered, and a couple of chapters have moved from one volume to the other. Most chapters still follow the same format, including an introduction, separate essay by each of us, and a summary. The introduction highlights the different perspectives we bring to the chapter and sets the tone with the questions we used to frame our thoughts. The summary pulls together the key points and immediate next steps for you and your team, making this a practical guide for CISOs. Finally, for the summary and key action for Chapter 20, we challenge you to build your strategic cybersecurity plan. Chapter 7 (Cyber Liability Insurance), Chapter 12 (Emerging Technologies), and Chapter 20 (Building Your Strategic Plan) each present a unified essay on the topic.

Volume 1 addresses what we call the basics of the CISO role, along with critical governance functions. Section 1: The Basics covers the organizational structure, developing the team, security policy, measurement and reporting, and working with senior management and the board. Section 2: Governance addresses the topics of risk management, cyber insurance, third-party risk, data protection, and security compliance and audit. One of the most essential governance concepts is how the CISO helps management and the board understand the full scope of risk and the techniques used to render the risk acceptable to ensure that the organization is a going concern.

Integral to the governance discussion is a robust treatment of risks posed by third parties, vendors, and suppliers. The ecosystems we build today are so interconnected with partners. Unfortunately, these interconnections create creases in our cybersecurity defenses and force us to entrust our data to many other parties. While no good CISO wants to slow the pace of change, every good CISO recognizes and helps the organization understand that the pace of technology change combined with the expanding network perimeter exposes us to enormous risk.

Here is the layout for the two-volume set.

The order of the essays within each chapter follows the arc of our differing backgrounds and perspectives. Bill Bonney’s essays lead off each chapter and provide a high-level view that reflects his background in the finance industry and the structured governance that comes with working in a highly regulated industry. Matt Stamper’s essays come next, and his perspective on simultaneously providing services to many customers provides insight into a highly programmatic approach. Finally, Gary Hayslip’s essays finish each chapter, and his vast experience in the trenches as a hands-on cyber expert provides you with a treasure trove of lists and lessons that you can repeatedly reference. We deviate from this approach for Chapters 7, 12, and 20, where we provide a single, unified essay.

Dr. Winnie Callahan Review

Review of the book:  CISO:  Desk Reference Guide
                                           A Practical Guide for CISOs

Publisher:  DRG Joint Venture Publishing, 2016
Authors:  Bill Bonney, Gary Hayslip, Matt Stamper

By:

Winnie Callahan, EdD
Director, University of San Diego Center for Cyber Security Engineering and Technology

The book, CISO:  Desk Reference Guide; A Practical Guide for CISOs is an amazing effort to assist new CISOs or CISOs in mid-size companies to better understand their respective roles, but it actually provides a plethora of in-depth “how tos” and “whys” from the vast wealth of experiences enjoyed by the three authors.

The book is easy to read and is divided into nine distinct chapters each addressing a major issue, concern or responsibility inherent to the role of a CISO. It is not a directive nor is it a textbook designed to provide the reader with a credential.  Rather it is exactly what a CISO needs when confronted with the day to day demands placed upon the person brave enough to try a fill some extraordinarily large shoes:  the person expected to have a super technical background, but must also understand cybersecurity, laws and policies, have a clear focus on regulations, be a proven leader and also be a “great communicator” to the CEO but often to a Board of Directors as well.  (Perhaps when a CISO is hired and/or appointed, one should also receive a Superman costume …. He or she just may need it.)

Realistically, the Superman attire is less likely to be necessary with this volume of guidelines, concrete examples and a concise summary of such valuable information as the NIST framework and the SANS descriptors for handling risk, as examples.

The book is unique, as the reader gets the opinion on each topic from the three authors independently.  For the reader, it’s like having a private conversation with experts in the field on the readers’ timeline … in short, when really needed.  (This could be during business hours, over the weekend or during the “heat of a crisis.”)

The layout of the book follows closely the rules of public relations:  tell the public what you’re going to tell them, then tell them more than once using different techniques and then summarize what you told them. The book also invites contact with the author(s) if you still need more clarity.  What a deal!

Each chapter has an introduction, then three different opinions on the topic, one by each author from a “different experience perspective.”  Each chapter is rich in explanation, many with charts and graphs.  And each chapter concludes with a summary of what the chapter provided.

Whether you’re trying to understand your role better, figure out how to develop policies to ensure the protections your organization requires, desperately need to review the NIST Incident Response Guide, or just validate some steps you plan to take in working with your leadership team, this guide truly has it all.

One of the major criticisms often voiced regarding standards and regulations is that “one size does not fit all.”  Frequently, though experts are supportive of the need for standards and the fact that having some are very helpful, they often express dismay that standards are blind to context … this book is exactly what is needed to take that challenge head-on.  Again, three differing opinions from three different perspectives reflecting the best and worst of the issues most CISOs encounter … only the type of environment is different and thus, the approach and needs to solve and address the issues will no doubt vary.

As this review concludes, it is important to state that the Appendix at the end of Chapter Nine on Policy is, even as a stand-alone, incredibly valuable as it exemplifies different type of Policies.  The reader will also find the Bibliography of great value if wanting to dig more in depth on a given topic.  Though the subject is dynamic and fits into the category of “always changing,” the basics of the observations and lessons learned will NOT lose their value to the practicing professional.  At the least, it helps clarify the thought processes and the potential evolution to any new applications that will be evident in the future.

In closing, I would encourage those aspiring and or existing CISOs to invest in this book.  I would also recommend that universities who are attempting to prepare well-educated cyber professionals for their roles in the Cyber domain to make sure this book, and hopefully subsequent volumes, known to and available for their students.  You can’t get much better than a practical, easy to read reference for those times when an answer or validation of a plan would lower one’s stress level and help our corporations, government agencies and our nation as a whole do a better job of protecting assets.

CISO Online Review

A practical guide for CISOs belongs on the desk of every Chief Information Security Officer and wannabe.

By: www.csoonline.com

Are you an aspiring, recently hired or promoted CISO looking for the definitive how-to guide for your position? Look no further. An experienced CISO along with two security subject matter experts have authored a comprehensive modern day text — ‘CISO Desk Reference Guide: A practical guide for CISOs‘ — which covers risk management, compliance, audit, IT security disciplines, cybersecurity extending to IoT (internet of things) devices, cyber insurance, staffing, board concerns, and everything in between.

The three authors — Bill Bonney, Gary Hayslip, and Matt Stamper — state their decision to write the book came from the shared realization that the dramatic escalation in cyber threats was not going to peak any time soon. A recent report from Cybersecurity Ventures aligns with their thinking — and predicts cybercrime damages will cost the world $6 trillion annually by 2021, up from $3 trillion last year.

(Disclaimer: Steve Morgan is founder and CEO of Cybersecurity Ventures.)

Hayslip brings direct CISO experience to the book. He is deputy director, CISO for the City of San Diego, Calif. — which has more than 1.37 million people, and is the eighth largest city in the United States and the second largest in its home state. He advises the City of San Diego’s executive leadership consisting of Mayoral, City Council, and 40+ city departments and agencies on protecting city government information resources. Hayslip oversees citywide cyber security strategy and the enterprise cyber security program, cyber operations, compliance and risk assessment services.

The CISO Desk Reference Guide is suitable material for security chiefs at Fortune 500, global 2000, and mid-sized corporations, as well as security leaders at U.S. federal agencies, state and local governments, universities, and non-profits. CIOs and senior IT staff at small to mid-sized firms with and without CISOs will also benefit from the soup-to-nuts security guidance found in the book.

The rubber hits the road in chapter 2, which covers regulatory, compliance and audit – a particularly gnarly topic which leaves many new CISOs wondering where to begin. The authors explain what regulatory requirements are, how to engage with auditors, and how to make audits effective. The chapter also speaks to legislation, which is changing cybersecurity… not something immediately obvious to most CISOs.

A severe cybersecurity workforce shortage has left CISOs and corporate IT security teams shorthanded and scrambling for talent while the cyber attacks are intensifying, according to the recent Cybersecurity Ventures report. Corporations are responding by placing some or all of their IT security into the hands of third parties. The IT security outsourcing segment recorded the fastest growth (25 percent) out of the entire cybersecurity market last year, according to Gartner. Outsourcing security introduces a whole new risk for enterprises — choosing the right third party which has the cyber defenders, cyber operations, and security platforms to effectively combat an increasingly hostile threatscape. The CISO Desk Reference Guide devotes an entire chapter to third-party risk — including eight risk factors to assess with vendors including:

  1. Operational Risk
  2. Privacy Risk
  3. Reputation Risk
  4. Security Risk
  5. Regulatory Risk
  6. Revenue Risk
  7. Financial Risk
  8. Service Risk

A careful read through these eight points in the CISO Desk Reference Guide is sure to make outsourcing any aspect of security a much less risky proposition for CISOs who are leaning in that direction.

The book is worth its weight in gold for Hayslip’s overview on Cybersecurity Tools and Techniques. He shares that if there’s one thing he has learned as a CISO, it’s that if you want to be effective you must work to build trust with the organization’s stakeholders and make the case that cybersecurity is a value proposition, a service that all business channels should leverage to be competitive. Then he dives into what readers have been waiting for — an experienced CISO’s recommendations around security policy, incident response, data back-up, security awareness training for employees, patch management, anti-virus and malware protection software, vulnerability scanning, desktop encryption, wireless network security testing, email security, and more.

There’s still 10 days left until the end of summer 2016… so it’s not too late to make the CISO Desk Reference Guide your summer read.

Palo Alto Networks Review

By: blog.paloaltonetworks.com

We modeled the Cybersecurity Canon after the Baseball or Rock & Roll Hall-of-Fame, except for cybersecurity books. We have more than 25 books on the initial candidate list, but we are soliciting help from the cybersecurity community to increase the number to be much more than that. Please write a review and nominate your favorite. 

The Cybersecurity Canon is a real thing for our community. We have designed it so that you can directly participate in the process. Please do so!

Executive Summary

Every profession has desk references that practitioners can use as go-to guides for tactical information. For information security professionals, CISOs and those on the CISO track, the

CISO Desk Reference Guide: A Practical Guide for CISOs is an excellent example of such a guide.

Review

While the classic prepare 3 envelopes joke revolves around CEOs, it’s quite appropriate for a CISOs as well. For many, their career path is a slow and steady one whereby they deliberately progress toward attaining that role. For others, who quickly obtain the role due to a major security breach, envelope #3 must often be opened immediately.

In the CISO Desk Reference Guide: A Practical Guide for CISOs (CISO DRG 978-0997744118), authors Bill Bonney, Gary Hayslip and Matt Stamper have written a tactical guide that can help the soon-to-be or new CISO get up and running. Each of the three has been in the information security space for decades, and all of them bring their experience from the trenches to every chapter.

For CISOs who find themselves in that position, they’ve entered it as a key entity in an organization. For those who have come into the role suddenly, it’s important to note that poor information security controls can bring an organization to its knees. In the book, the authors share their knowledge and provide real-world experience, showing current CISOs – and security managers with aspirations to be – how to function most effectively in the CISO role.

A recurrent problem for books with multiple authors is that the end result often lacks consistency and is simply a collection of different essays without a unifying theme. The authors here do an admirable job of avoiding that. Each chapter is clearly identified by who the specific author is. A benefit to the approach here is that each of the authors brings his specific style to information security, such that the reader ends up with a broad and multifaceted methodology on the topic.

The nine chapters in the book cover the entire range of the information security lifecycle; from regulatory issues to data classification, reporting to the board, tools, policies and more.  The three authors are battle-tested professionals with real-life expertise that they bring to every chapter.

The previous point is not a trivial one as information security is not monolithic. There is certainly no single way to do information security. By learning the topic from the best and the brightest, information security practitioners and CISO-hopefuls can ensure they will ultimately be successful in their endeavors.

As mentioned above, many books with multiple authors suffer from a lack of consistency and message. This book doesn’t suffer from that. And in fact, each author brings a slightly different approach to the various topics. This is an important point, as there is certainly no one size fits all when it comes to information security.

Of course, an effective CISO can’t rely on any single book. And if they tried, that book would need to be about 2,500 pages long. But for those looking for a go-to reference when the CxO urgently calls, it would be a good idea for any information security professional to have a copy of the CISO Desk Reference Guide handy. It’s an excellent desktop reference – and an indispensable one, at that.

Conclusion

The CISO Desk Reference Guide: A Practical Guide for CISOs is an excellent desk reference that information security professionals, from managers to CISOs, will find of value. It’s full of practical, real-world experience and sage advice, making it an excellent candidate for the Cybersecurity Canon.

Praise for the Book

4

“CISO Desk Reference Guide is a one-of-a-kind reference – well-structured that should be easily understood by techies and non-techies alike (especially the finance and legal types – who probably need this more than the CISOs).  Great work!”

RADM (Ret) Kenneth D. Slaght
Co-Chair and President
Cyber Center Of Excellence

5
4

“I strongly recommend this unique, applicable, and much needed CISO guide. The three authors, all proven CISOs as well as leaders, have taken a very unique approach to creating the CISO Desk Reference Guide, tackling real world issues, but not by each taking a section and sharing their knowledge, but by all three providing relevant input on each topic. Their differences in viewpoints, experience, and writing styles provide more than a single perspective or solution; they provide a rich and diverse foundation for the reader to process information and draw conclusions that best meet their needs, honing critical thinking! 

 I recommend this book for experienced CISOs who want fresh thinking on current topics, new CISOs who want to learn from the best, or others in information security and risk management who desire a greater foundation on the complex world of CISOs.”

Todd Friedman
Chief Information Security Officer
ResMed

5
4

“This is an excellent desk reference for new and established CISOs who are increasingly challenged by advancing threats, standards, and regulations. The organization of the book, where each of the three authors provide their own thoughts on many important topics, illustrates the fact that the challenges faced by CISO don’t have single, pat answers. Readers can consider the book to be written mentorship by three active CISOs.”

Peter H Gregory
Executive Director, National Security Advisory Firm

5
4

“Essential reading for both aspiring and incumbent Chief Information Security Officers, the CISO Desk Reference Guide fills a critical gap in the information security common body of knowledge.

The Chief Information Security Officer has emerged as a key role in forward-thinking organizations that are keenly aware of the existential threat that cyber risks now pose. The authors of the CISO Desk Reference Guide grasp that reality and use their many years of experience to provide a ton of practical advice about how to function effectively in this role.

The unique multi-author approach of the CISO Desk Reference Guide has produced a wealth of insight into the complex and challenging role of Chief Information Security Officer, a role that increasingly anchors organizational risk management in all things cyber and digital. 

From the excellent discussion of the evolving CISO role and how best to embed it in the organization, to fundamentals like data classification and controls, to advice on tools and techniques, the CISO Desk Reference Guide delivers multiple perspectives on the foundations of organizational cybersecurity.

I wholeheartedly recommend the CISO Desk Reference Guide to anyone who is or wants to become a Chief Information Security Officer.”

Stephen Cobb, CISSP
Senior Security Researcher, ESET North America.

5
4

“The CISO Desk Reference Guide” is a useful tool written with a unique tri-perspective of three authors.  The diversity in perspectives is powerful in that it demonstrates there is never just one solution to any situation, yet it provides great examples and things to ponder for the reader.”

Gabriele Benis
Former Vice President of Audit
Intuit, Inc.

5
4

“The field of Information Security & compliance is complex at the very least. And the job of “CISO” still a mystery to most boards and CEO’s. However, three icons in the cybersecurity community, Bill Bonney, Gary Hayslip, and Matt Stamper took a very complex subject matter and through the use of what they call “Tri-Perspective” take on each practical subject matter, and truly makes it a “CISO’s Desk Reference Guide”! The call to action with the five immediate “Next Steps”. Will be a great comfort to those new CISO’s that walk into the job the first day, “with a deer in headlights mentality”! Not because they are not qualified but because the job of CISO, in most companies is still being defined.  And this desk reference book will be a great resource for the CEO, Board and CISO.”

David W. Rooker, CISSP
Chief Information Security Officer
Actian Corporation

5
4

“Bill Bonney, Gary Hayslip and Matt Stamper have managed to successfully explain the role of the CISO and have provided insights and straightforward, practical suggestions for strengthening your cybersecurity programs. This book should be required reading for every CISO or those aspiring to become one.

The best book ever written on the role of a modern day CISO. Ground breaking with insights and advice on every page, The CISO Desk Reference Guide is a major contribution to the industry.”

Jane Frankland
Founder of Cyber Security Capital, Board Advisor ClubCISO

5
4

“…The book is unique, as the reader gets the opinion on each topic from the three authors independently.  For the reader, it’s like having a private conversation with experts in the field on the readers’ timeline … in short, when really needed….

Frequently, though experts are supportive of the need for standards and the fact that having some are very helpful, they often express dismay that standards are blind to context … this book is exactly what is needed to take that challenge head-on.” (read Dr. Callahan’s extensive review here)

Winnie Callahan, EdD
Director, University of San Diego Center for Cyber Security Engineering and Technology

5
4

“This is a fantastic resource for every security professional seeking to improve their skills and their careers.  The structure of the guide works extremely well for readers who want a deep-dive and those who are seeking just the answers or a quick refresher with the key points at the end of each chapter.  It’s rare to find a treasure trove of knowledge like this. I look forward to Volume 2.”

Vickie Miller
Chief Information Security Officer
FICO

5
4

“Tremendous value. Insightful and impactful for any organization, any executive and any board. Ties the criticality of managing risk to the need to be a part of the core business in a mature and commonsense way. This should help organizations futureproof their business with concepts and frameworks that are relevant today and for tomorrow.”

Mark Wales
Vice President, 30+ year industry veteran and board member of the Workforce Institute

5

CISO DRG Volume 2

CISO DRG Volume 2

by | Mar 24, 2019

The CISO Desk Reference Guide, Volume 2, 3rd Edition is the greatly anticipated update to the second volume of the highly respected two-volume set written by experienced practitioners and intended for recently hired or promoted Chief Information Security Officers (CISOs). These easy-to-use guides are also perfect for individuals aspiring to become CISOs, as well as business and technical professionals interested in the topic of cybersecurity. Those with the titles Chief Technology Officer (CTO), Chief Information Officer (CIO), and Chief Privacy Officer (CPO) will gain critical insights, and members of the board of directors and other executives responsible for information protection will find them invaluable.

As a desk reference guide written specifically for CISOs, we hope this book and its companion CISO Desk Reference Guide, Volume 1, become trusted resources for you, your teams, and your colleagues in the C-suite. The different perspectives offered by the authors can be used as standalone refreshers, and the five immediate next steps for each chapter give the reader a robust set of actions based on roughly 100 years of relevant experience that will help you strengthen your cybersecurity programs.

Buy on Amazon
Buy on Apple
Buy on Kobo
See all purchase options

Description

We dedicate Volume 2 to the cybersecurity program. Now we can begin to describe how to prepare the organization to be the resilient organization we believe will be necessary to succeed in the digital world we compete in today. Section 3: Resilience covers tools and techniques, emerging technology, cyber awareness training, monitoring your environment, threat intelligence, and continuity planning. Section 4: Recovery addresses incident response, recovering and resuming operations, and forensics and post-mortem. In the final chapter, we walk through building a strategic plan.

After we address the basics and governance in Volume 1, we begin to explore the tactical requirements for any cybersecurity program. We dedicate six chapters in Volume 2 to resilience. We do a deep dive into tools and techniques, both from the perspective of which business processes to prioritize and how to construct a toolkit that allows the cybersecurity team to meet those needs. The technologies used at your organization and throughout today’s interconnected networks typically don’t have a fully defined perimeter. Instead, they are designed for the mobile worker and geo-dispersed teams with numerous third-party connections to vendors and trusted partners. We address educating the staff and the organization, monitoring the health and security of the organization’s digital assets, and using threat intelligence to help the organization stay ahead of (or at least keep up with) the changing threat landscape.

It is these new network infrastructures that exist in the cloud, in shared data centers, and on mobile devices that force CISOs to revisit their strategic plans frequently so they can implement the cybersecurity program that appropriately addresses and reduces the organization’s risks while helping the business unlock opportunity.

Finally, we discuss using this focus on health, monitoring, and threats to inform the backups and recovery planning, which are essential to helping the organization rebound from any disrupting event, not just a cyber event.

All of this sets the stage for dealing with the inevitable flood of incidents, significant and minor. We believe that by treating the minor incidents with the same formal process applied to more significant incidents, the organization can stay sharp and respond with more agility to the existential threats that are becoming all too common. Key to that preparedness is the communication program that keeps the organization informed and responding as one. And finally, wrapping up the program, we discuss recovery and resuming operations along with a deep dive into what went wrong and what we can learn from the entire episode through an exploration of forensics and the post-mortem process.

Praise for the Book

4

“This book, and its volume one companion, will provide any CISO, newbie or ragged veteran, the reference material to build and improve their security programs.”

Rick Howard
CSO – Palo Alto Networks

5
4

“In this, the second instalment of The CISO Desk Reference Guide, Stamper, Hayslip and Bonney team up once again to deliver a seamless continuation of its predecessor. Each author gives us a revealing lens through which to view the remit of a CISO… they challenge the reader to operate to a much higher standard, explaining exactly how to do so. The book’s power resides in each author’s ability to synthesize and to present this in pragmatic prose, conveying the importance of the role of a CISO.”

Jane Frankland
Founder of Cyber Security Capital, Board Advisor ClubCISO, U.K.

5
4

“The best disposition I have read on how to, in practical terms, address the cyber talent scarcity issue. We’ve been talking about the problem for years…the authors give actionable steps for how CISOs can build a “blended capability” program – FTE hiring, cross- and up-skilling existing talent, creating security evangelists across the organization, and leveraging MSSPs for commodity functions. This scarcity of skills is not going away, so it’s crucial we take pragmatic steps to address it.”

Kirsten Davies
Chief Security Office – Barclays Africa Group Ltd.

5
4

“This is how it’s done, plain and simple. This is the Rosetta Stone of security, connecting the technology, the business and the people. The devil is in the details, and this book details it in a way that is personal, usable and, above all, practical.”

Sam Curry
CSO – Cybereason

5
4

“Volume 2 applies the very original and effective Desk Reference approach to more key CISO concerns, from the cybersecurity skills gap to incident response and crisis management.” 

Stephen Cobb, CISSP
Senior Security Researcher, ESET North America

5
4

“This CISO Desk Reference, Volume 2, is by far the best CISO reference available today…. If you are aspiring to become a CISO, this book will help you design a comprehensive security program… If you are currently a CISO, this book will provide you unique guidance about the strategic and operational intricacies of a modern security program!”

Selim Aissi
CISO – Ellie Mae

5
4

“The second volume of the CISO Desk Reference Guide is a perfect continuation of the definitive first volume. Volume 2 provides insights, best practices and utility in useful and practical chapters. I am grateful to the authors for generously sharing their years of hard-earned experience and knowledge. They are raising the bar for security professionals everywhere.”

Todd Friedman
Chief Information Security Officer – ResMed

5
4

“AMAZING! I JUST LOVED THE BOOK! Being a new CISO, I have got to be learning every day… The authors have only emphasised that, promoting continuous learning for the CISOs. They did an amazingly great job.”

Magda Lilia Chelly, CISSP, PhD
Managing Director | CISO As A Service
Responsible Cyber Pte. Ltd., Singapore

5

Executive Primer

Executive Primer

by | Jan 12, 2020

The CISO Desk Reference Guide Executive Primer is written primarily for the CISO’s colleagues. The perspective is one of expectation. What are the expectations the CEO should have for their CISO? What support should the CFO expect to provide the organization’s CISO in support of their mission? What are the expectations the CISO will place on their colleagues to help make the organization more resilient? What kind of support should a CISO expect from the board? As important, what expectations should the entire leadership team, including the board, place on the CISO in terms of communications, teaching, expertise, risk assessment, metrics, meeting regulatory requirements, and preparing the organization to detect, respond to, and recover from cyber incidents?

Buy on Amazon
Buy on Apple
Buy on Kobo
See all purchase options

Table of Contents

CISO Desk Reference Guide Executive Primer

The Executive’s Guide to Security Programs

Foreward

The CISO Desk Reference Guide has been a mainstay in my personal library since shortly after I first met Gary, Bill, and Matt in 2015. Newly appointed to my second stint as Deputy Chief Information Security Officer (CISO) and having just moved from Germany to Southern California, I was eager to build relationships in the lively cybersecurity community of San Diego. The community welcomed me with open arms, and I was able to join in on robust conversations, insightful presentations, and war-room problem solving for the latest/greatest malware strain or threat actor activity. If I were to attempt an analogy, I would say reading the chapters of the CISO Desk Reference Guide is like attending a gathering of those fantastic SoCal professionals: approachable, unassuming, informative, and thought-provoking. Read More

Section 1 – The Role of the Information Security Executive

1. The CISO

Though relatively new for some organizations, the position of Chief Information Security Officer (CISO) is one of technical complexity that is not for the faint of heart. This position is the leading cybersecurity expert for a company and, therefore, often faces the repercussions if there is a data security breach. Incumbents will make decisions that impact all aspects of an organization and its ability to conduct business. Some of these decisions will involve interpreting regulations, establishing new policies, or influencing the employee/corporate culture. The reporting structure has a tremendous impact on the efficacy of the organization’s security operations. We believe that organizations with a designated security officer – a CISO – will have better security outcomes than those who have not formalized this role.

2. Risk Management and Cyber Liability Insurance

The risk management function within organizations has changed considerably due to the dynamic threats facing enterprise business environments. Because there is more economic value embedded in computer networks and the systems they connect as we move more and more functionality online, there are more criminals attracted to cybercrime. At the same time, this march to online functionality exposes more systems to external threats. Not surprisingly, over the last few years, nation-states, industrial spies, and terrorists have begun to attack many more targets, endangering not just the largest enterprises but their supply chains as well.

3. Third-Party Risk

The reality is that most organizations do not have a good understanding of the cybersecurity risks they are assuming with their third-party relationships. This reality was exposed by the now-infamous Target and Snowden breaches, both in 2013. In the Target breach, access was obtained by the bad actors through the VPN connection maintained for Target’s HVAC vendor for direct billing purposes. For the Snowden incident, Edward Snowden was an employee of a subcontractor of the National Security Administration. He moved from the CIA to Dell to Booz Allen Hamilton under a veil of suspicion after trying to break into classified files while at the CIA, and later fled with a trove of classified information. If we needed further convincing, in March of 2020, the SolarWinds software build process was compromised, providing a backdoor into more than 18,000 customers of its Orion Network Management System.

4. Regulatory, Compliance and Audit

In most organizations, the CISO plays a significant role in compliance activities. This usually includes a combination of high-level sponsorship, guidance, control testing, program management, and direct control execution. This variability, combined with the myriad different backgrounds of CISOs, can lead to an over-reliance on using the CISO role for the organization’s compliance function.

5. Data Governance and Security Policy

There are few topics more critical in cybersecurity than establishing proper data governance, informed by data classification, and codified through data governance and cybersecurity (data protection) policies. For many organizations, data and information are the most valuable (strategic) assets. It is critical to align data classification and governance activities with the organization’s risk management practices and, ultimately, its risk appetite.

6. Measurement and Reporting

Given the CISO’s evolving mandate to help the organization achieve operational resilience and the myriad competing interests for management focus and the allocation of budget, it is critical that the organization has reliable information upon which to base its decisions to invest the time, attention, and money needed to achieve better cybersecurity outcomes. The value of measuring and reporting on the results of business processes to drive the changes in behavior required to achieve corporate objectives is well understood. However, in many organizations the CISO’s role is still maturing and nowhere is the journey more visible than in learning how to speak the language of business, especially with regard to measuring the performance of the security team and the preparedness of the organization to protect against, detect, respond to, and recover from business disruptions.

Section 2 – The Cybersecurity Program

7. The Human Element

CISOs must recognize that they are always recruiting. Even if there is no unfilled headcount today, the human network will be necessary to create and maintain a pool of talented people for the organization. And while there is a minimum bar for the skills the security team will need to be successful, you can only hire for so many of those skills. The cost (in hard cost and opportunity loss) of competing for and hiring fully formed senior security engineers for all positions has already become prohibitive.

8. Situational Awareness

We grouped these three process elements – threat intelligence, continuity planning and cyber-resilience, and monitoring – together because, when taken as a whole, they provide the organization with situational awareness about their security posture.

There is a tendency to believe that once something like threat intelligence is packaged commercially, that “buying” your threat intelligence is the most comprehensive and practical approach. Let the experts collect the data from their millions of sensors and their honeypots and other forms of deception technology, and let their analysts review that intelligence and monitor the dark web for you and tell you where you should focus your attention. It’s true that very few companies have the means to run a comprehensive threat intelligence program on their own, and even those that do still consume commercial feeds to support their efforts. But there is a critical aspect to threat intelligence that is specific to each organization.

Continuity planning was once the exclusive province of the CIO. But the emerging role of the CISO, beyond expertise in cyber risk, policy, and data protection, is the continuity of business operations. To be successful, CISOs need to bring risk management front and center and make it a cornerstone in building their security programs. We cannot protect every system equally. Not all business processes, applications, and infrastructure are created equal. This inequality may seem obvious, but our security programs frequently don’t reflect this reality. Too many security programs attempt to apply the same level of security to all systems, infrastructure, and employees. The result is watered down security. Critical systems are under-resourced and under-secured while non-critical systems are over-protected. The root cause of this disconnect is a lack of alignment with organizational priorities.

Networks are noisy. From heartbeats to probing, from legitimate database extracts to covert data exfiltration, from sensor telemetry to malware infusions, there is an enormous amount of traffic on your network. Without a strategic and diligent approach, it is difficult to know how much of this traffic is appropriate and legitimate. Long gone are the days when network traffic volume alone was the biggest hint that an organization was under attack. When we think of monitoring, many of us immediately think of our networks and the packets that traverse them. It’s our view that this monitoring, while crucial to our security programs, is only a small part of the overall effort. CISOs must take a more comprehensive and expansive view of monitoring to ensure that they adequately align their security program with the objectives of their organization.

9. Incident Management

Incident response is the most visible function for a CISO and how the CISO oversees the incident response program of their organization is critical for the role. For good or for ill, it is the primary way CISOs are judged. Beyond the immediate impact of demonstrating the organization’s resilience to customers, management, and employees, how an organization deals with incident response says a lot about its culture. We have entered the era of the celebrity breach. Often nation-state sponsored, usually impacting millions of customers, and always coming with tiring lists of remediation steps that are at the same time both complex and monotonous in their sameness. We have long since worn out the cliché of “not if but when” as we describe the inevitability of a data breach happening to any given company. Making the front page of the New York Times or the Wall Street Journal because of a cataclysmic data breach was once an existential threat. Now, there is a certain resignation to the fact that data breaches are a part of life. Incident response can no longer be a hot seat occupied only by the CISO, as responding to an incident must be a team effort.

10. Executing the Cybersecurity Program

The temptation among those of us in the technical fields is to think of tools first. While tools are often helpful in solving various process problems, an over-reliance on tools is often expensive and usually decreases the effectiveness of any given program.

We recommend starting instead with a business impact analysis, asset inventory, and third-party risk assessment. These should provide an in-depth understanding of the organization’s data assets and how this data flows into and out of the organization with third parties, processes, applications, and clients. In addition to cataloging the assets to protect, continuity planning and an incident response plan provide resilience essential to the organization.

Turnover and knowledge gaps create seams in the security program that leave the organization with blind spots and vulnerabilities. Essential to reducing turnover and closing knowledge gaps is continual skill development. Along with a well-trained and skilled security team, an effective awareness program is indispensable. An empowered workforce, confident in its ability to make good decisions, acts as both an early warning system and a shield.

Technical solutions will fall into two broad categories – tools used by the organization to deploy and maintain a secure infrastructure and tools used by the security organization to prevent bad events and monitor the network to expose questionable activities for follow up.

Your organization faces a dynamic threat environment that is continually evolving. New threats will at times require changes to security controls and the technology used to execute these controls and the cybersecurity budget must be flexible enough to accommodate the occasional urgent need. Budgets that are too tight to begin with or overloaded with long-term commitments may force decisions made for budgetary reasons that are not in the best interest of securing critical assets. Tying all of this spending together is the strategic plan.

11. Management and the Board

The inclusion of cybersecurity as an agenda item for board meetings has grown dramatically since the watershed Target breach of 2013. The quick succession of other breaches, including Home Depot, Wyndham, and JP Morgan Chase, put boards on notice. More recent events, such as the SolarWinds breach in 2020 and the Microsoft Exchange Server attack and the Colonial Pipeline ransomware attack of 2021, have made the point that boards must understand cyber risk inescapable. Guidance for boards on this subject is available from multiple resources, including the Securities and Exchange Commission, the Digital Directors Network (DDN), the National Association of Corporate Directors (NACD), and regulatory bodies such as the Federal Financial Institutions Examination Council (FFIEC).

  

  

  

 

 

Your content goes here. Edit or remove this text inline or in the module Content settings. You can also style every aspect of this content in the module Design settings and even apply custom CSS to this text in the module Advanced settings.

Case Studies

Case Studies

by | Jan 12, 2020

We can learn much with each significant breach. In this book, we go through multiple unique breaches and look at what harm was done. Were assets damaged or taken offline? Was data stolen or ransomed? Was it released or weaponized, offered on the black market or used for internal purposes by the cybercriminals? What methods were used in the attack? What vulnerabilities were exploited? We won’t be dwelling on the technical capabilities of the bad actors or the technical shortcomings of the victims, but in each case, there were controls that could have been in place that might have allowed the victims to mitigate, at least to some extent, the impact of the attack. We’ll look at how these controls are best deployed, how their effectiveness should be measured and how deploying these controls help you create a healthier security posture and at the same time, demonstrate compliance with myriad control regimes.

With boards increasingly asking “can this happen to us” it is essential that operations, information technology, security and audit address any gaps you find as you test yourselves against the same attack scenario.