There’s a lot of confusion around the Chief Information Security Officer (CISO) role. It’s a newer position—at least in comparison to other members of the c-suite—and a notoriously hard spot to fill for many reasons.
In this blog, real-world CISOs shed light on their role, discussing their challenges, skills, certifications, and how businesses can access cyber security leadership even without a CISO of their own.
What is a Chief Information Security Officer (CISO)?
Chief Information Security Officers (CISOs) spearhead cyber and information security for a business. As valued members of the c-suite, they take on an extensive list of strategic and operational responsibilities, often including:
- Developing infosec policies, procedures, and guidelines
- Leading and representing the team at executive or board meetings
- Managing and optimizing the technology stack
- Overseeing regulatory and framework compliance
- Aligning cyber security goals with business objectives
Not long ago, infosec primarily involved installing an antivirus, recommending that employees follow cyber security best practices, and backing up critical data.
However, workplaces digitalized fast and drastically heightened the risk of a cyber attack. This, coupled with new pressure from government and regulatory bodies to prioritize cyber security, created a need for a dedicated information security department and leader.
Full-time CISOs can be hard to find, especially for small and mid-size businesses (SMBs) that lack the budget, benefits, or perks needed to attract a qualified candidate. There’s been a growth in virtual CISO (vCISO) services recently, giving businesses access to on-demand infosec consultants who can fill the shoes of an in-house cyber security leader.
Insights from top CISOs and cyber leaders
We hosted a cyber security leaders roundtable where the industry experts shared their insights, experiences, and security advice on things like:
- What a CISO’s biggest challenge is (and how to overcome it)
- Whether certifications are necessary to excel in cyber security
- Common mistakes that cyber security leaders make
Their answers are slightly edited for length and clarity, but here are some key takeaways from the virtual event.
What are the biggest challenges impacting CISOs?
We all struggle with information overload. It's hard to organize and prioritize the firehose of information—not only external information from intelligence feeds and news sources, but also internal problems, concerns, or tasks.
Humans are not able to multitask well. Structuring how you process information, prioritize things, and stay on top of key elements is critical for your success.
One of my mentors said, “look back from quarter to quarter at what you've done successfully and do more of those things. Be sure to cover yourself in the areas that will really affect your business. Those other things that won't keep you up at night? Leave them behind or at least wait until they bubble up to the front.”
Do you think the talent shortage is correlated with information overload?
Information overload comes from vendors a lot of the time. They may say I'm not doing my job properly because I'm not buying a certain cyber security product or subscribing to a service. You need to be confident that you've protected the right things, otherwise, you’re living in perpetual fear that you're missing something."
What is the first thing you do when a cyber security incident occurs?
If a user receives a malicious email or admits to opening a suspicious file, but we don't have internal or external cyber security resources, we need to know how to respond effectively. There are real benefits to knowing how to respond quickly to incidents and resolving them before too much damage is done.
The earlier you act, the less complex the incident. Typically, in these instances, if the attacker gains access to a network and gets privileged access, your incident response just became 1000x harder. If you can get the incident retained before that point, that's key.
Is there any way to get into cyber security without proper certificates?
I don't have a cyber security background. I was an English major, went into IT, then audit, and now cyber security. This is my jam, not my upbringing.
Certifications get you in the door or past the recruiter often. If the job description asks for a CEH (Certified Ethical Hacker), and you don't have that certification, you may get discarded.
There's a term called Vitamin B, which is all about relationships. Nurturing a relationship or meeting someone in the industry can help [you get a foot in the door]. We all need to work with our network. That network might be career fairs or a family member. There are opportunities for those interested in cyber security, even without certifications.
Sometimes, an easier path to gaining that initial experience may come from working in small or mid-sized businesses. Their expectations may be more realistic and have less of a need for certifications.
How can companies start getting a handle on their cyber security?
The first thing is to find trusted help. There are outstanding professionals like vCISOs who can advise start-ups on their priorities, for example.
[Getting a handle on cyber security] doesn’t have to be expensive, but you must invest something: time, process, energy.
Another thing you can do is look at some of the leading government regulations in your country. The Baseline Controls for Cyber Security in Canada is a great guide for small organizations.
Also, connect with cyber security providers or other people you trust. Your accountants or lawyers might have recommendations for firms that deal with this.
What's the biggest mistake CISOs make today?
The biggest mistake by far is overconfidence that you know everything. I've worked in this field for 12 years, and there’s a huge amount I do not know. I would never consider myself an expert. I understand I know a little bit about many topics rather than being a specialist in one area.
But I speak to companies that say, “I'm not worried about this because I’m not a target,” or they're wildly more exposed to risk than they realize. From their perspective, they have this thing cracked. That thinking is unfortunately more common across organizations than I'd like.
Accessing cyber security leadership
What about businesses that don't necessarily need a permanent, full-time CISO?
Field Effect offers a vCISO Service staffed by cyber security leaders with years of hands-on experience defending some of the most critical, complex, and fast-paced security environments in the world.
Whether you need an experienced leader to set goals, develop robust cyber security programs, support IT, assess cyber risk, manage and guide your infosec team, align with security frameworks, or ensure compliance with a lengthy list of regulations—Field Effect’s vCISOs can get started today.
Curious to learn whether a vCISO might be right for your business? Check out the vCISO brochure or schedule a brief consultation with one of our experts.
