3 steps to help new CISOs to hit the ground running
by David Stevens, Chief Strategic Advisor, World Wide Technology for GCN
Today's chief information security officers face rampant cyber threats, an expanded attack surface and the pandemic-related explosion of remote workers connecting to agency networks from everywhere. As the purview of CISOs has grown in recent years, these committed individuals shoulder the responsibility for managing new and increased risks to keep their governments secure.
1. Assess the current environment
The first thing a new CISO should do is conduct a thorough assessment of the existing situation: the good, the bad and the ugly. A 90-day self-guided audit of people, process, policy and technology will shine a light on what systems are already in place, what controls exist and what capabilities exist to enforce those controls. They should also identify the "technical debt" so they can incorporate those costs into the strategic direction. One more priority is to clearly identify and codify meaningful metrics -- for both reporting to executive leadership as well as for measuring operational effectiveness.
This is the right time for CISOs to conduct a tools rationalization to identify where there is overlap, where there may be over- or under-investment and what will be required to ensure the right tools for the right job are in place. They should look at installed tools like security information and event management (SIEM) technology and data loss prevention tools to find out if they're being correctly employed -- and if they're even the right solution for the issue to be solved. This kind of rationalization activity gives CISOs the opportunity to simplify the technology stack, saving dollars that can be more efficiently redeployed.
Depending on their bandwidth and domain expertise, CISOs may find it makes sense to engage external resources to help with this assessment. They should look for independent domain experts who can be trusted to render an objective opinion as CISOs execute their security plans. Because new CISOs will face difficult decisions that are not easily reversed, a good partner can help them sift through the plethora of solutions to find the ones that best meet an agency's unique needs.
Resourcing will also typically be an issue. In government as well as the private sector, cybersecurity professionals are scarce and costly, so there may be talent gaps to overcome. CISOs should use this time to talk to their team and evaluate their skills, gaps and training needs to help them identify their passion and match it to their talent, professional goals and needs of the team. When CISOs seek new candidates, they should look for those who believe in public service, have a strong desire to help drive the agency vision and desire a challenging work environment that will help them grow professionally.
An assessment also presents a great opportunity for CISOs to learn about workflow pain points -- where staff spends their time and how and where automation can help. Technologies like artificial intelligence, machine learning, robotic process automation and virtual security operation centers can reduce the staff burden of high-touch activities like incident response.
2. Explore all available financial options
Once the assessment phase is complete, CISOs can then lay out a multiyear plan to execute – first understanding their capabilities to invest in that plan. While budgets are always tight, right now multiple funding sources to support cyber requirements are available.