Careers, Leadership

Completely Off the Rails – BSW #242

We cover a lot of articles about CISO leadership, communications, skills, and yes, transition. This week we discuss the CISO transition from a CISO's perspective. I will interview my co-hosts on why they made moves in 2021, what criteria did they use to analyze their next role, and what are their strategies for a successful transition.

In the Leadership & Communications section, 'They Said a CISO Does What?', 5 Tips to be an awesome CISO, 9 tips for an effective ransomware negotiation, and more!

Visit https://www.securityweekly.com/bsw for all the latest episodes!

Follow us on Twitter: https://www.twitter.com/securityweekly

Like us on Facebook: https://www.facebook.com/secweekly

View Show Index

Full Audio

Segments

1. CISO Transition: A CISO’s Perspective – BSW #242

We cover a lot of articles about CISO leadership, communications, skills, and yes, transition. This week we discuss the CISO transition from a CISO's perspective. I will interview my co-hosts on why they made moves in 2021, what criteria did they use to analyze their next role, and what are their strategies for a successful transition.

Announcements

  • Join us June 29th for a webcast with Tyler Robinson and Beau Bullock to learn how to pivot into the world of Crypto security. Visit https://securityweekly.com/webcasts to register with only your name and email! Don't forget to check out our library of on-demand webcasts & technical trainings at securityweekly.com/ondemand.

Hosts

Matt Alderman
Matt Alderman
Executive Director at CyberRisk Alliance
Ben Carr
Ben Carr
CISO at Cradlepoint
Tyler Robinson
Tyler Robinson
Director of Offensive Security & Research at Trimarc Security, Founder & CEO at Dark Element

2. Leadership Triad, Awesome CISO Tips, & CISO Demands – BSW #242

This week in the Leadership & Communications section, 'They Said a CISO Does What?', 5 Tips to be an awesome CISO, 9 tips for an effective ransomware negotiation, and more!

Announcements

  • Do you have a specific guest or topic that you want us to cover on one of the shows? Submit your suggestions for guests by visiting https://securityweekly.com/guests and completing the form! We review suggestions monthly and will reach out to you once reviewed!

  • In an overabundance of caution, we have decided to flip this year’s SW Unlocked to a virtual format. The safety of our listeners and hosts is our number one priority. We will miss seeing you all in person, but we hope you can still join us at Security Weekly Unlocked Virtual! The event will now take place on Thursday, Dec 16 from 9am-6pm ET. You can still register for free at https://securityweekly.com/unlocked.

Hosts

Matt Alderman
Matt Alderman
Executive Director at CyberRisk Alliance
  1. 1. Lead, Command, Inspire?—?Leadership Triad - The business system is a triad of command, leadership, and management: - The functions and responsibilities of the command are reduced to determining the direction. - Management implies understanding goals, providing the means sufficient to follow in a given direction, organizing processes to ensure effective operations. - Leadership is a moral and emotional activity.
  2. 2. They Said a CISO Does What? - According to this misguided article, “Know more about colleges, jobs, and courses to become a CISO”, apparently qualifications for a Chief Information Security Officer (CISO) requires: - “Understanding of SMTP, DNS, HTTP, Network routing, VPN, and other technologies” - “Understanding of Digital Millennium Copyright Act, trademark, intellectual property, Safe Harbor Provisions, GDPR, and other federal and international legal precedents…” - “Ability to read and analyze multiple log formats”
  3. 3. 5 Tips to be an awesome CISO - 5 Tips to be an awesome CISO: 1. Make everything about risk appetite. 2. Your traffic light should always remain a steady amber. 3. Ingest all the logs, put something to capture data on every endpoint, every router, switch, and firewall. Ingest it into one on-prem SIEM from where you can send data to your cloud-based SIEM, and a smaller subset to your expensive SIEM that charges you per MB. 4. Go to conferences and talk about all the amazing things you’re doing, big yourself up because your next employer could be sitting in the audience. 5. Of course the 5 year plan will likely get to 7 years before being scrapped as being a pipe dream.
  4. 4. CISOs missing major holidays due to work demands – Help Net Security - Two in five Chief Information Security Officers (CISOs) have missed holidays like Thanksgiving due to work demands, a Tessian report reveals. In addition, one-quarter have not taken time off work in the past 12 months.
  5. 5. How CISOs Can Communicate the Need for Both IT and OT Cybersecurity - To build out an entirely new cybersecurity program that addresses IT and OT cyber environments independently, CISOs must educate and garner buy-in from their board of directors. CISOs should begin their discussions with their boards by educating the members on common myths about cybersecurity versus the realities. They should be prepared to explain: - IT Cybersecurity Solutions Do Not Work in OT Environments - Compliant Does Not Equal Secure - Stopping One Attack Does Not Prevent the Next
  6. 6. 9 tips for an effective ransomware negotiation - If you have no choice but to pay attackers to get critical data back, these best practices could put you in the best possible position to recover from a ransomware attack. 4 preparation steps to take before a ransomware attack: 1. Teach their employees not to open ransom notes and click on the link inside it. This often starts a countdown to when payment is required. Not opening the note buys time to ascertain which parts of the infrastructure are hit, what consequences the attack has, and the likely costs involved 2. Establish their negotiation goals, taking into consideration backups and best- and worst-case payment scenarios 3. Set out clear internal and external communication lines involving crisis management teams, the board, legal counsel, and the communications department 4. Inform yourself about the attacker to learn their tactics and see if a decryption key is available 5 approaches to ransomware negotiation: 1. Be respectful in conversations and using professional language, leaving emotions outside of the negotiations. 2. Victims should be willing to ask attackers for more time, which can allow them to explore all possibilities for recovery. One strategy is to explain that you need the extra time to raise the required cryptocurrency funds. 3. Instead of stalling for time, organizations can offer to pay a small amount early instead of a larger amount further down the road, with adversaries known to accept heavy discounts in favor of making a quick profit and moving onto another target. 4. One of the most effective strategies is to convince the attacker that you are not in the financial position to pay the amount initially requested, and this can even prove effective for very large organizations that adversaries know have huge amounts of money at their disposal. The research pointed out that there is a difference between having a certain amount of revenue and having millions of dollars in cryptocurrency laying around just for the occasion 5. Avoid telling the adversary it has a cyber insurance policy in place. They should not save cyber insurance documents on any reachable servers. The presence of cyber insurance can make attackers less likely to be flexible with negotiations as most policies cover the costs
Ben Carr
Ben Carr
CISO at Cradlepoint
Tyler Robinson
Tyler Robinson
Director of Offensive Security & Research at Trimarc Security, Founder & CEO at Dark Element
prestitial ad