CISOs Struggle to Cope, Cybersecurity Metrics, & Security by Design – BSW #218

The CISOs aren’t OK. A new survey showed the pandemic has ratcheted up job pressure to “extreme stress” levels among chief information security officers (CISOs), and it’s left them grappling for coping mechanisms ranging from workouts to narcotics.

CISOs need to cover all the security bases. The problem is, some of the bases are easy to overlook. Here's a rundown of eight often-overlooked areas that CISOs should immediately address: 1. Ensuring that third-party partners maintain strong security 2. Investigating innovation opportunities 3. Understanding their enterprise's data footprint 4. Strengthening security team support and focus 5. Thinking ahead 6. Maintaining return on existing security investments 7. Finding ways to build enterprise management unity 8. Developing a truly effective method to sharpen threat awareness

Companies that bring teams together and form an operational strategy are more likely to protect data than the best-intentioned silo approach.

Wendy Nather, head of advisory CISOs at Cisco, recently teamed up with researcher Wade Baker to investigate cybersecurity metrics and determine how to make a cybersecurity program measurably more successful. She shares some of her more surprising findings, including: 1. Best Practices that Improve Security Outcomes: 1) Proactive Technology Refresh and 2) Integrated Technology Stacks 2. Compliance in name only is not enough 3. Metrics that Matter are tied to Outcomes and Capabilities of each Organization

An integrated approach can help build business and technology resilience, which can act as a differentiator for companies focused on building consumer trust. This security-by-design approach can lead to several benefits, including: - Providing leading-edge, innovative security approaches such as intelligent threat detection - Reducing risk related to technology, insider threats, and supply chain - Supporting developers and engineers while enabling the business with development, security, and operations (DevSecOps) - Establishing a cyber-forward approach that reinforces and enhances business objectives, including security and trust - Identifying potential cyber incident and breach scenarios during cloud migration that help build stronger cyber and business resilience.

Four suggestions for CISOs, executives, and boards to address the negative effects of the cybersecurity skills shortage: 1. Incentivize employees 2. Invest in training 3. Recruit via professional networks 4. Get HR on board