Bits & Bytes – BSW #205
This week, we welcome back Ben Carr, Global Chief Information Security Officer at Qualys! Ben steps in last minute to talk about his transition from Aristocrat to Qualys and the evolution of the CISO role! In the leadership and communications section, 9 Steps for Effective Cybersecurity Risk Management, The Big 8: How to heighten cybersecurity governance, 7 Super Bowl rings for Tom Brady, and more!
Visit https://www.securityweekly.com/bsw for all the latest episodes!
Follow us on Twitter: https://www.twitter.com/securityweekly
Like us on Facebook: https://www.facebook.com/secweekly
Full Audio
Segments
1. Evolution of the CISO Role – Ben Carr – BSW #205
Ben Carr, Global Chief Information Security Officer at Qualys, steps in last minute to talk about his transition from Aristocrat to Qualys and the evolution of the CISO role.
Announcements
Don't miss any of your favorite Security Weekly content! Visit https://securityweekly.com/subscribe to subscribe to any of our podcast feeds and have all new episodes downloaded right to your phone! You can also join our mailing list, Discord server, and follow us on social media & our streaming platforms!
If you missed Security Weekly Unlocked, you can now access all of the content on-demand, whether you registered before the live event or not, by visiting https://securityweekly.com/unlocked and clicking either the button to register or the button to login!
Guest
Ben Carr is the Chief Information Security Officer at Qualys. He is an information security and risk executive with more than 25 years of experience in developing and executing long-term security strategies. Ben has demonstrated global leadership and experience, through executive leadership roles of advanced technology, high risk, and rapid-growth initiatives, at companies such as Aristocrat, Tenable, Visa and Nokia. While at Aristocrat, Ben built a world-class global cybersecurity program from the ground up as part of a digital transformation. As a senior cybersecurity executive at Visa, Ben was responsible for developing and leading Visa’s Global Attack Surface Management Team and capability. Prior to Visa, he led all security programs for Nokia corporate IT as the Global Head of IT Security. Ben holds a certificate in Risk & Information Systems Control (CRISC), is a Certified Data Privacy Solutions Engineer (CDPSE).
Hosts
2. 9 Steps, the Big 8, & 7 Super Bowl Rings! – BSW #205
In the leadership and communications section, 9 Steps for Effective Cybersecurity Risk Management, The Big 8: How to heighten cybersecurity governance, 7 Super Bowl rings for Tom Brady, and more!
Announcements
Do you have a specific guest or topic that you want us to cover on one of the shows? Submit your suggestions for guests by visiting https://securityweekly.com/guests and completing the form! We review suggestions monthly and will reach out to you once reviewed!
Don't forget to check out our library of on-demand webcasts & technical trainings at securityweekly.com/ondemand.
Hosts
- 1. 9 Steps for Effective Cybersecurity Risk ManagementTo ensure effective cybersecurity risk management, follow this checklist: 1. Understand the organization’s security landscape 2. Identify the gaps 3. Create a team 4. Assign responsibilities 5. Train and upskill employees 6. Implement cyber awareness across departments 7. Implement a risk management framework 8. Develop risk assessment programs 9. Create and maintain a sound incident response and business continuity plan However, don't take all the advice from their next blog, THE NEXT CYBERSECURITY RISK MANAGEMENT MODEL POST THE COVID-19 CRISIS, https://blog.eccouncil.org/the-next-cybersecurity-risk-management-model-post-the-covid-19-crisis/.
- 2. The Big 8: How to heighten cybersecurity governanceBelow are eight steps organizations can implement to heighten cybersecurity governance: 1. Recognize that the worst-case scenario has escalated 2. Empower the CISO to directly report to the CEO 3. Conduct reviews of internal cybersecurity policy 4. Confirm your processes and controls are bulletproof 5. Stay up to date on regulations 6. Allocate at least 10 percent of your IT budget to cybersecurity 7. Develop and regularly update a comprehensive incident response strategy 8. Communicate with customers and suppliers
- 3. Security and privacy laws, regulations, and compliance: The complete guideThis handy directory provides summaries and links to the full text of each security or privacy law and regulation.
- 4. 3 ways to speak the board’s language around cyber riskFraming the cyber risk conversation in ways that resonate with the board will help close the chasm between cyber risk and enterprise objectives. Here are three tips for communicating cyber risk to the board. 1. Understand the board's responsibility 2. Present data in a familiar format 3. Know your benchmarks
- 5. How to translate threats and risk to C-suiteWhen communicating with the C-suite or shareholders, CISOs have to speak equal parts security and bottom line. How security experts derive business value from risk and threat-based analysis can be done by using the "three P's": prediction, prevention and proaction. In doing so, security leaders are able to unpack a business risk to their C-suite and board. Here are two ways CISOs can cut to the chase: 1. In a quarterly report, reserve a single slide for the business risks accumulated during that period in a graphic. 2. Choose relevant information to share, not the full cyber threat intelligence report.
- 6. 12 security career-killers (and how to avoid them)Here are 12 common traits that security leaders say will keep you from advancing your cybersecurity career – and how you can avoid such a fate: 1. Believing security is the end goal 2. Getting stuck 3. Acting like the smartest one in the room 4. Being too timid 5. Losing your cool 6. Talking tech 7. Sticking to yourself 8. Failing to build other skills 9. Staying still 10. Staying in security 11. Mistaking vulnerabilities for risks 12. Being tactical, but not strategic
