CISO Archives - Cyber Secure Forum | Forum Events Ltd
Posts Tagged :

CISO

Just Say Yes – Why CISOs must now embrace SD-WAN

 960 640 Stuart O'Brien
By:
0
0

Digital Transformation has become a business imperative, yet rather than pulling together to enable essential change, the friction between network and securityteams is increasing. The business needs to move away from data centres and traditional Wide Area Networks (WAN) to exploit the cost, flexibility and agility provided by the cloud and Software Defined WANs (SD-WAN).

Chief Information Security Officers (CISOs), especially those working in regulated industries, insist the risks associated with public infrastructure are too high. Stalemate.

Until now. Organisations are pressing ahead with Digital Transformation plans and excluding the CISO from the conversation. But at what cost? Who is assessing the implications for regulatory compliance? At what point will the Chief Risk Officer prohibit the use of the SD-WAN for sensitive data, leaving the business running legacy and new infrastructure side by side, fundamentally undermining the entire Digital Transformation project? A new attitude is urgently required, one based on collaboration, understanding and a recognition that a Zero Trust security posture can safeguard even the most sensitive data, while unlocking all the benefits associated with SD-WAN.

As Simon Hill, Head of Legal & Compliance, Certes Networks insists, it is time for CISOs to take a lead role in the Digital Transformation process – or risk being side-lined for good.

Accept Change

CISOs need to face up to the fact that Digital Transformation is happening – with or without them.  Organisations need to embrace the agility, flexibility and cost benefits offered by the cloud, by Software as a Service and, critically, the shift from expensive WAN technology to SD-WAN. For CISOs, while the migration to SD-WAN extends the attack surface, adding unacceptable data vulnerability, saying no is not an option any more. CISOs risk being left out of the Digital Transformation loop – and that is not only adding significant corporate risk but also compromising the expected benefits of this essential technology investment.

Network and IT teams are pressing ahead, insisting the risk is acceptable. How do they know? For any organisation, this is a dangerous compromise: critical risk decisions are being taken by individuals who have no understanding of the full implications. For those organisations operating in regulated industries, these decisions could result in an exposure to $10s millions, even $100s millions of penalties.

Failure to embed security within the initial Digital Transformation strategy is also compromising progress. What happens when the CISO or Chief Risk Officer discovers the business is in the process of migrating from the old WAN to a new SD-WAN environment? Suddenly the brakes are on, and the call is for sensitive data to be encrypted before it hits the network. Adding Internet Protocol Security (IPsec) tunnels will degrade performance – so the business is then stuck using the legacy WAN for data connectivity while still paying for the SD-WAN and failing to gain any of the agility or cost benefits.  More frustration. More friction between teams that should be working together to support business goals.

Drive Change

Security is a fundamental component of Digital Transformation – indeed of corporate operating strategy. Rather than avoiding change, CISOs have a responsibility not only to secure the organisation but proactively advocate change, with security as the key enabler of Digital Transformation.

Digital Transformation does not by default create an inherently insecure environment – but it will require organisations to, somewhat belatedly, embrace a Zero Trust model.  It has been clear for many years that there is no correlation between ownership and trust. Just because a company owns infrastructure and assets does not automatically infer total trust over data security. Similarly, infrastructure outside the business is not inherently untrustworthy. The key is to build trust into a secure overlay to protect data that will allow a business to operate across any infrastructure whether it is owned or public.

A High Assurance SD-WAN overlay, for example, uses crypto-segmentation to protect and ensure the integrity of sensitive data. With this Zero Trust approach, High Assurance SD-WAN means whether the network is public or private, trusted or untrusted, is irrelevant: the data security team simply needs to define the policy and, with ownership of the cryptography keys, can be confident that data is protected at all times wherever it goes.

Working Together

Adopting a Zero Trust security posture changes the outlook for CISOs – and provides a foundation for vital collaboration with the networking and IT teams. With confidence that the data is secure regardless of network location, everyone involved in Digital Transformation can achieve their goals: IT and network teams can embrace the flexibility and agility of the cloud, SaaS and SD-WAN, while the securityteam still has control of the security posture.

This can only be achieved if the business embraces a different mindset. It is essential to think about security by design from the outset – and to break down the barriers between network, IT and security. The introduction of the Secure Access Service Edge (SASE) framework provides clear guidelines for the convergence of these teams to drive additional business value but the onus – and opportunity – lies with the CISO to ensure the entire organisation truly understands the Digital Transformation objectives.

This also demands an essential shift away from a regulatory compliance focused security posture – something that is inherently flawed due to the impossibility of creating regulations that keep up with the ever changing security threats – towards a truly business driven approach. Working together to plan the Digital Transformation process may take a little more time up front but it will result in a secure foundation that will remove any constraints to innovation and agility.

Conclusion

It is time for CISOs to change. There is no value in endlessly blocking essential new technology projects; and no upside in being excluded from vital plans as a result. By taking a proactive stance and driving Digital Transformation strategies, CISOs can redefine the role, become a key strategic player within the business and act as an enabler, rather than a constraint, to operational success.

It is time to find a way to say yes to secure Digital Transformation – without compromise.

BlueFort’s FREE CISO event now available on-demand

 960 640 Stuart O'Brien
By:
0
0

By BlueFort

Our latest virtual live CISO event last week was a success! Get access to the free recordings of our exciting sessions, discussing all the latest threats organisation’s face in a post-covid world.

Our partners’ Virtual Exhibition stands are ready to visit where you can download content and even book a meeting with one of their cybersecurity experts. The show may be over but there’s still plenty of content for you to enjoy.

Catch up on our event where F5, CyCognito and NoName answered the question “Where is my application cyber threat surface in 2022 and how do I defend it?”.

This exciting event, hosted by the vibrant Graham Cluley, also explored:

✅ What are my assets and are they secured?

✅ How can I ensure the security of my apps?

✅ How can I automate consistent cyber protection?

View the on-demand recordings 👉 bluefort.live/labs/1Q2022

CISO Live Interactive Event – Last chance to register!

 960 640 Stuart O'Brien
By:
0
0

Today’s the day! In a few short hours our virtual live event for CISOs and about CISOs will be starting. Our interactive event will give you the chance to ask questions about the latest topics in cyber security and vote in our polls about the latest threats organisations face.   

Join F5, CyCognito and NoName at our live virtual event as we answer the question “Where is my application cyber threat surface in 2022 and how do I defend it?”.  

This exciting event, hosted by the vibrant Graham Cluley, where we’ll explore: 

✅ What are my assets and are they secured? 

✅ How can I ensure the security of my apps? 

✅ How can I automate consistent cyber protection? 

Save your seat here 👉 bluefort.live/register

NEW CISO Live Interactive Event – Register today!

 960 640 Stuart O'Brien
By:
0
0

In a recent survey, 85% of CISOs reported they think security will be more complicated, with 71% have a cyber skills shortage and 72% struggling to retain security staff

Many CISOs find themselves in a tight spot. Not only are IT teams desperately playing a game of catch-up, many are stretched due to a lack of trained staff. The skills gap, which was already present pre-pandemic, has only widened in our post-pandemic world. As you scramble to hit reset, do you have the skills and resource to support your new vision? And if not, how can technology help to plug those gaps?

Join , at our live virtual event as we answer the question “Where is my application cyber threat surface in 2022 and how do I defend it?”.

This exciting event, hosted by the vibrant Graham Cluley, will explore:

✅ What are my assets and are they secured?

✅ How can I ensure the security of my apps?

✅ How can I automate consistent cyber protection?

Save your seat here 👉 bluefort.live/labs/1Q2022

The cloud security challenge every CISO must overcome

 960 640 Guest Post
By:
0
0

By Keith Glancey, Systems Engineering Manager at Infoblox 

Cloud adoption has never been higher. Whether it’s public, private, multi- or even hybrid-cloud environments, organisations of all sizes, across all sectors are benefiting from the enhanced flexibility, reduced cost and greater stability that cloud can bring. 

However, whilst cloud can be an enabler in many areas, it can also cause complications for both security and compliance. In fact, recent research revealed that over half of UK businesses cite security concerns as the biggest barrier to public cloud adoption. To add to this, over a third of business leaders (35%) who have adopted cloud aren’t completely confident that it is secure. 

Cloud environments present some unique security challenges. One such challenge is achieving visibility across an entire organisation. When a business uses multiple providers – and stores data in different locations across on-premise and cloud environments – total visibility can become almost impossible to achieve. But, without it, businesses leave themselves vulnerable to attack. For the modern CISO, visibility has become a huge headache in recent years. 

Ensuring everyone is on the same page 

The average CISO will probably have a snapshot view of the ‘bigger picture’ in terms of the security of their cloud providers. However, when it comes to the day-to-day details – such as relatively minor changes to the identities of and contracts with external partners, for example – it can be very difficult to keep track. Add to this that many organisations will have multiple cloud systems running side by side, as well as on-premise infrastructure that is typically full of legacy applications, and it’s easy to see how certain information can get lost in the ether. 

Although most cloud providers have security measures in place that are more than adequate, there is a tendency for them to focus on their own platform. This method totally ignores the user’s unique ecosystem. This one-size-fits-all security method does not always work to the advantage of an individual organisation, which is why it’s important for CISOs to remain in the driver’s seat. 

CISOs looking to increase visibility could start with an analysis of their key partners. This can help them to determine the best course of action on a case-by-case basis. For example, when a business relies on external server services, it can be difficult for the network team to obtain a 360-degree view across the entire critical infrastructure. This can lead to certain oversights and a lack of understanding in terms of the overall network security posture, especially when you throw IoT devices into the mix. In this case, instead of monitoring all used platforms separately, it is more effective to add a layer to the network that provides centralised insight into the entire ecosystem.  

This is where modern technologies – such as cloud DDI (DNS, DHCP, and IPAM) – come in. By giving CISOs and network teams the ability to automate and consolidate critical aspects of cloud network management, respond quickly to business needs and integrate cloud service platforms across a business, DDI augments visibility into network activities and increases control. It grants visibility into networking activities, no matter where devices might be connected from – including remote locations. 90% of malware touches DNS – the first D in DDI – when entering or leaving the network, making DNS a critical detection tool that, when connected to the security stack, can enable stronger threat remediation. Ultimately, DDI enables the network team to quickly detect and fix any vulnerabilities, no matter where they originate. 

Solving compliance complexity 

Navigating a myriad of different cloud providers also makes compliance more difficult than it should be. Suppose a business is legally obliged to store data on European servers – what happens if a supplier has this order, but its partners don’t follow the same policy? The same applies to subpoenas; a third party abroad could simply reveal sensitive data, even if this is in violation of European law. 

When it comes to compliance, it’s not enough to simply rely upon a supplier’s word. In order to avoid potentially the devastating fines and reputational damage associated with failure to comply, CISOs need to enforce a certain level of visibility across all third parties and ensure that everyone is following the same rules. 

CISOs can take some simple steps to monitor the situation and ensure compliance in the cloud. For example, when it comes to meeting guidelines such as the EU’s Security of Networks & Information Systems (NIS) – which is intended to establish a common level of security for network and information systems – adding a layer to an organisation’s infrastructure can help to boost visibility and reduce complexity. This can also help to automate processes that enable a network team to make their entire security stack work together and thus better anticipate vulnerabilities. 

As cloud becomes an increasingly important part of IT infrastructure, CISOs will continue to face many different security and compliance challenges. In order to get ahead and keep both employees and customers safe, they will need to focus on establishing total visibility across the network of providers and partners. Only then will CISOs be able to take back control and the wider business reap the rewards associated with cloud adoption. 

Proving ROI in cyber security

 960 640 Guest Post
By:
0
0

Research shows that almost half of businesses have reported cyber security breaches or attacks in the last 12 months. Amongst these businesses that identified breaches or attacks, more have experienced these issues at least once a week so far this year.

Moreover, the unprecedented events of recent months have seen the number of attempted data breaches continue to rise, with cyber hackers using the increase in remote working and individuals’ fears over the coronavirus to their advantage. In fact, a survey showed that 50% of organisations were unable to guarantee that their data was adequately secured when being used by remote workers.

The issue is serious and many businesses are stepping up their cyber security strategies accordingly, with CIOs and their teams increasingly taking a seat at the executive board table. But one thing is still lacking: cyber security ROI. To truly engage with a strategy, board members need to see ROI from every department of an organisation, and cyber security is not exempt from that. However, demonstrating business value in areas such as compliance, risk management or data assurance, has always been challenging. 

Consequently, data security has historically been looked upon as a necessary cost of doing business. However, this no longer needs to be the case. As CIOs, CISOs and network security teams mature into their C-Suite role, proving the value of data security is now both a realistic and achievable corporate objective. Frank Richmond, Vice President Sales Europe, Certes Networks, explains just how CISOs and CIOs can get the Board on board… 

Cyber security as a strategic investment

Today’s current network and data security approaches focus primarily on keeping the cyber hackers out with threat detection and vulnerability management at the core. But modern CIOs and CISOs want – and need – more than this when reporting to the Board; they want “provable security”.

Securing data should be a strategic investment in an organisation’s risk strategy and should quantifiably contribute to the overall value of the business. CISOs expect their network security teams to be equipped with tools that will enable them to make real-time changes to applications based on observable network flow. They want to see that securitypolicies are being enforced properly and, most importantly, prove that their security strategy is actually effective.

To put this into practice, cyber security should be quantifiable, measurable and outcomes-driven. It shouldn’t just be a case of successfully keeping a cyber attacker out of the network after a single breach; a successful cyber securitystrategy is effective only when it is continuously putting data security first and measuring impact against key performance indicators (KPIs) that will instantly show Board members how imperative the strategy – and the technology behind it – really is.

In order to truly demonstrate the effectiveness of the organisation’s security strategy, CIOs and CISOs need to be able to visualise and understand their data, the associated applications, workloads and behaviour, with real-time contextual insight. This, in turn, will enable this understanding to be passed on to other executive Board members. 

The real value of cyber security

Armed with this insight, organisations can then take actionable steps not only to measure the effectiveness of their security strategy, but to gain deep understanding into how to enhance their security posture and to manage and enforce policies. With a data-driven approach to cyber security, the guesswork can be removed and CISOs and CIOs will be able to clearly demonstrate to the Board that ROI has been achieved.

With buy-in from the Board, data security is now more than a ‘necessary cost’, and is instead a fundamental of business operations. The businesses that succeed in enforcing this way of thinking will then truly be able to continuously evolve their cyber security practices to keep their data safe.

The rise of the Chief Cybercrime Officer

 960 640 Stuart O'Brien
By:
0
0

Matt Cable, VP Solutions Architects & MD Europe, Certes Networks, discusses the role of the CCO and how the CCO and CISO should work in harmony to achieve the common cyber security goals…

The TalkTalk data breach in 2015 was monumental for the cyber security industry. At the time, data breaches were hardly new, but this particular breach resulted in UK MPs recommending that an officer should be appointed with day-to-day responsibility for protecting computer systems from cyber attack.

This governmental guidance was not a consequence of the size of the breach. With the personal details of 157,000 customers accessed, including bank account numbers and sort codes of over 15,000 customers, it certainly was not the largest the industry had seen. Rather, the guidance resulted from the way in which the immediate situation and the following aftermath, were handled.

In most organisations, the responsibility of following this guidance has historically fallen to the Chief Information Security Officer (CISO), with support from the CEO. In the wake of the TalkTalk data breach in particular, the CISO was given ‘free rein’ to strengthen the organisation’s cyber security capabilities.

The many faces of the CISO 

Yet, the role of the CISO was not a new concept. In fact, the CISO dates back to 1994 when Steve Katz was hired to run the world’s first formal cyber security executive office, and was subsequently given the title of CISO. Unsurprisingly, the role has many aspects to it, from security operations, cyber risk and cyber intelligence, data loss and fraud prevention, security architecture, identity and access management, programme management and compliance and governance, to name but a few.

Recently however, the role has come under increasing scrutiny and with the rise of cyber crime and the sophistication of cyber attacks, it’s easy to see why. Research shows that over two-thirds of organisations have experienced at least one security breach in the past year and that the majority of both CISOs and the entire C-Suite believe the CISO is ultimately responsible for the response to a data breach. However, with so many ‘hats’ to wear and multiple day-to-day responsibilities, it is clear to see why, with the increasing threat landscape, many organisations feel that it’s time to add another role to the C-Suite. 

Enter the CCO 

Enter the Chief Cybercrime Officer (CCO), whose remit will entail ensuring the organisation is cyber-ready and who will bear the responsibility of mitigating breaches, taking the lead if a breach does occur and providing the necessary link between the Board and the rest of the company to mitigate risk and work collaboratively to resolve issues as they arise.

With the need for cyber security to become far more central to C-Suite strategies, this new role should ease the load on the CISO and ensure the organisation can get one step ahead of hackers in the cyber crime race. However, organisations must take into account the need for both the CISO and CCO to work in harmony, with clearly defined roles and support from the Board. 

Aligning to boundaries

With both the CISO and CCO working towards keeping the company’s data safe from cyber threats, it is essential for each role to be clearly defined. This definition may look different to each organisation: each role, and the teams working with them, should have clear parameters and responsibilities so that in the event of a data breach, the organisation clearly understands the steps that should be taken, and who should take them.

In practice, this should make every CISO breathe a big sigh of relief. Many CISOs would identify cyber security as the greatest risk within their role, and when they’re also trying to juggle multiple other responsibilities, it’s a lot to have on their shoulders. With the CCO focused on the system architecture and the CISO focused on the security of the information within the organisation, there should be no reason that both roles can’t work collaboratively towards keeping the organisation safe.

Making decisions 

With both roles working in tandem, the next step that organisations need to take is ensuring the CISO and the CCO have enough influence with the Board to make critical decisions and resolve issues immediately. By ensuring that all members of the Board have visibility of the entire cyber security strategy and that the strategy is regularly reviewed and updated in line with new threats and intelligence, the CCO and CISO can be given the responsibility to report and respond to incidents and make rapid decisions on behalf of the business. In the event of a data breach, removing unnecessary approval and authorisation steps ensures that the organisation can respond quickly and put remediating measures in place to minimise potentially catastrophic repercussions.

In a world where cyber security threats can’t be ignored, now is the time for the structure of organisations to truly be considered. Has cyber security been given enough prominence at Board level? Can decisions be made quickly? Can space be made for both the CISO and CCO to work in harmony? By asking these questions and making changes, organisations can ensure they are in a far better position to keep their data safe and protect their reputation.

Most Urgent CISO Skills 2020: Reporting, Avoiding Burnout, More collaboration

 960 640 Guest Post
By:
0
0

By Jake Olcott, VP of Government Affairs, BitSight

Since the creation of the first CISO role about 25 years ago, the job has changed dramatically. What was once an uncommon position has quickly become standard, with the majority of companies including a cybersecurity-specific role in their C-suites.

As cybersecurity has gone from niche issue to mainstream business concern, the CISO has become more important. And, although many CISOs come from purely technical backgrounds, new challenges have forced them to take on the responsibilities of business leaders.

As a result, the most important CISO skills are not necessarily technical in nature. Business skills like collaboration, communication, and management are just as critical for CISOs as they aim to reduce cyber risk in an increasingly fraught threat landscape.

Here are some of the most important CISO skills for 2020:

Collaboration

Cybersecurity is collaborative. The most efficient team of SOC analysts in the world can’t prevent incidents if employees in other parts of the organisation aren’t trained on good security hygiene. CISOs can’t give their teams the resources they need if their Board and fellow executives don’t understand security challenges and allocate the necessary budget.

Shockingly, however, only 22% of companies say their organisation’s security function is integrated with other business functions.

CISOs in 2020 and beyond will need to build collaboration skills in order to act as ambassadors for the cybersecurity program. Communicating security priorities to other departments and across lines of business or distributed workplaces is a challenge but gaining their buy-in is essential to maintaining effective security.

Avoiding burnout

CISOs don’t have it easy. 91% of CISOs say they suffer from moderate or high stress, and 27.5% of CISOs say stress affects their ability to do their jobs. CISO burnout is real, and it can create new security risks as well as personal challenges.

Strange as it might seem, one of the most important skills for CISOs is making sure they don’t become victims of burnout themselves.

One aspect of avoiding burnout is stress management. Exercise, meditation, and other stress-reducing activities can be very helpful. However, personal stress management isn’t going to be enough to stem the burnout crisis. CISOs can also consider advocating for policies in their organisations that reduce the likelihood of job stress, such as workplace wellness programs or limiting after-hours email notifications.

Increasing employee engagement 

CISOs aren’t the only cybersecurity professionals at risk of burning out. 65% of SOC professionals say stress has caused them to think about quitting.

As the cybersecurity skills shortage drags on, the most effective CISOs will be the ones who make sure their best employees stay on long-term.

With a 0% industry unemployment rate, the market pressure is on the employer to keep employees happy, not the other way around. That means security leaders must hone their people management skills and keep a finger on the pulse of employee engagement.

There are many techniques for increasing employee engagement, and each CISO will need to figure out what will work best in their own organisation. Some effective techniques include:

  • Increasing the frequency of employee/manager meetings
  • Giving employees several avenues for giving feedback, including anonymous suggestions
  • Adding more social time to the schedule, or hosting company-sponsored parties or group activities
  • Recognising high-performers with awards and prizes

Communication and reporting 

When reporting to the Board, other executives, or even third-party auditors, CISOs need to make sure they get the messaging right.

One of the most important CISO skills is being able to translate complicated technical concepts into easy-to-understand language. When others can actually wrap their minds around the challenges of the cybersecurity program, they’re more likely to buy in and provide support.

On a basic level, CISOs can improve their communications by avoiding information-dumping and scare tactics. Turning in a 100-page report full of metrics the Board doesn’t understand isn’t useful. Similarly, warning of worst-case-scenarios can backfire when it creates a reactionary approach to security.

Further, CISOs should take a risk-based approach to cybersecurity reporting. In practice, that means making sure KPIs contain context about the actual risk posed to the organisation. In addition, CISOs should understand each data point’s impact on larger business KPIs and objectives.

Following a risk-based approach to reporting can help CISOs demonstrate the effectiveness of their programs, advocate for new initiatives, and improve overall security.