CISOs are expected to “do it all.” As a new CISO, you’re going to want to hit the ground running as you piece together the foundational elements of your organization’s security program. The precedent you set and first impressions you make will determine how quickly you are accepted as a leader who can influence direction and deliver mission-critical outcomes. It will also give you the headroom you need to settle into the “nuts and bolts” of your job (completing vulnerability assessments, getting to know key players, building political capital, nurturing relationships, and providing effective leadership).
Where to focus in your first four months
What are your organization’s top security-related issues? This question is top-of-mind for your CEO and Board of Directors, and delivering quick wins on these issues will show that you are making a difference right out of the gate.
Here are 4 areas that should rise to the top of your list as you settle into your new job.
1. Visibility
You can’t manage what you can’t see. Enterprise assets change constantly, with devices being added and retired, physical machines migrating to virtual, and various stakeholders installing and updating software (with or without approval).Because the enterprise network is only as secure as its weakest link, gaining real-time visibility into your attack surface and breach risk is both a challenge and one of your most critical success factors. Visibility needs to be comprehensive and continuous, extending to all types of assets and security issues across an increasingly complex landscape.
- Know what you’re defending: An effective security assessment starts with an accurate inventory. You need to understand the various devices, applications, and services used across the enterprise: Who is using them and how are they being used?
- Go above and beyond unpatched software: Because attackers use multiple attack vectors to compromise an enterprise, your cybersecurity assessment must cover all security issues, not just unpatched software.
- Prioritize risks: Not everything in your network is equally important. Do not ignore or simplify the role of asset criticality in cybersecurity visibility, and make sure risks map to your business.
The Balbix platform discovers and analyzes the enterprise attack surface to give a 100x more accurate view of breach risk:
- Track your assets in real-time through automatic discovery and continuous updates.
- Balbix automatically discovers, analyzes, and categorizes all devices, apps, and services including managed and unmanaged, infrastructure, on-premises and cloud, fixed and mobile, IoT, ICS, etc.
- With Balbix, you can get answers to questions about your inventory, security posture, or breach risk using Google-like natural language search.
- The Balbix inventory and risk model can be customized based on your specific business needs and tightly aligned with your business.
The risk model surfaced by Balbix is usually seconds or less behind the actual on-network conditions, and you can answer questions about your cybersecurity posture and risk using google-like natural language search.
2. Framework
Security teams are pulled in many directions – vulnerability management, prioritization, incidence response, deployment and tuning of security tools, application security, dash-boarding and reporting, to name just a few.
In your first few months as CISO, you will need to establish a cybersecurity program framework and communicate that across the enterprise.
- How will cybersecurity be managed?
- How will you know that you’re working on the right projects?
- What are the most vulnerable areas of your attack surface?
- Can you quantify the progress you’re making?
- Who are the key players and what are their responsibilities?
- What tools are in place and which others are needed?
This is where you lay out your vision for keeping the enterprise safe. What are your goals and key cybersecurity strategies, and how do all of the moving parts fit together? What governance will be in place to keep everything and everyone on course (funding, corporate leadership, people, skillsets, integration, alignment)? And are your cybersecurity tools up to the task?
Balbix uses specialized AI algorithms that discover and analyze your enterprise attack surface and breach risk. Balbix also provides a prioritized set of actions that you can take to transform your cybersecurity posture and reduce cyber-risk by 95% or more, while making your security team 10x more efficient.
3. Communication with the Board of Directors
Your board members’ view of cybersecurity is quite different from how security and IT team members think. Board members are primarily concerned with cybersecurity as a set of risk items, each with a certain likelihood of happening with some business impact. Your board also expects you to have a well thought out execution plan to transform your organization’s cybersecurity posture to the recommended risk level.
The Balbix platform helps you quantify breach risk for top-level execs and perform external benchmarking. You can also drill down from a business-level risk score into a risk heat map, which shows you the groups of assets that are driving the organization’s risk metrics. To help you develop a well thought out execution plan, Balbix prescribes prioritized actions that you can use to improve your network’s cyber-resilience and defense posture. Balbix also provides you with simulation tools that allow you to compare different fix plans.
4. Relationships
Building relationships with lines of business and key stakeholders is an important success factor when you start any high-level job and it’s particularly true for CISOs. Aside from your relationships with fellow executives and the organization’s functional leaders, you will need to quickly connect with lines of business and key stakeholders such as Legal, HR, and others.
And you will need to get all risk owners to help with the cybersecurity mission. Whatever your organizational landscape, finding allies and teaming up with key players will be critical as you empower and leverage your co-workers to put their muscle behind managing cyber-risk across the organization.
Empowering new CISOs to build a cyber-resilient enterprise
New CISOs are at the right place and the right time to make a bottom-line difference for their organizations. They can drive the overall risk management strategy, provide the leadership needed to prioritize and manage cybersecurity risks, as well as empowering players across the enterprise to assume shared ownership of the cybersecurity mission. Most important, CISOs can bring all the pieces together to ensure a secure and cyber-resilient path going forward. It’s a difficult job, but one well worth the time and effort.
