As a CISO/CSO/Security Manager, you were hired by your organisation to perform a role. How many people go back to the advertisement they responded to and check-off what you are actually doing now, versus what the original role description stated the role would/should be?
I know talking with many people out there that this is one of their biggest issues in their role today – either the role not being as it was promoted/advertised and/or you not having the support to perform the role your were hired to do.
It’s made cynics of so many people in our industry and in a weird way, has also kept people, albeit unhappy in organisations longer, given the fact that there’s a belief that wherever security people go, it will be much of the same…..so at least, “better the devil you know”. This blog is full of posts, (since day 1 about the trials and tribulations of Information Security people) trying to do their job and battling every step of the way for even small gains. I won’t link to these posts….to many but have a search here if you want further references.
I’m not going to go over all the old issues again here. What I am going to put forward is another idea, that at a minimum, may provide Information Security professionals with a sense of worth, accomplishment and within their organisation, a position whereby an organisation can choose to accept professional opinion, views and recommendations – or not, but at least the Information Security professional can rest secure in a position of having at least gone on record from an overarching management, governance and strategic perspective. (The following need not only relate to the most senior Information Security person in the organisation – but anyone who holds to a belief that things should be better than they are now). Read on……
If you are in a position where your role is that battle, I recommend an annual, end of year; “State of Information Security Report – Organisation X, 2010″.
This is not a targeted Audit report or something prepared by an external consultancy. This is purely and simply, your opinion, thoughts and recommendations on where your organisation sits, in your opinion, and based upon your expertise and experience, from a security perspective. It is a concise and to the point current state analysis documented by you, (who in theory, should have the best overarching view and understanding of Information Security in your organisation). It is something you present to the highest levels within the organisation to people that you believe are the stakeholders and influencers in regards to IT and Information Security.
Now before the cynic in you tosses the idea out the window with the belief that no one, or few people will care, at a minimum, consider the weight off your shoulders in having something in writing that covers ALL your concerns. Something that should issues arise in the future, you can remind people of. Yes, you’ve covered your butt and most importantly, you will at that time have demonstrated that you were on top of this, knew about it, raised it and have always been the right person for this role – albeit, no one listened. So many times I have seen security people have to justify and explain why a breach, incident etc took place and why the organisation was not prepared, when the realities were totally different. At this time, the horse has bolted and the Information Security person is the scapegoat as the blame game within an organisation has started. Get where I am coming from?
On a more optimistic note, you may also be surprised that such an end of year “State of Information Security Report” may actually be well received by senior management and other stakeholders whose roles and focus is elsewhere throughout the year and they’re too busy to be as directly involved with you day-in and day-out as you would like. It may well be that something like this, in such a format is exactly what will work to get that awareness and support you’ve always wanted.
In our role as an external consultant, I’ve lost track of the number of times I’ve spoken to a CEO or the Board of an organisation to talk about our findings and the issues and risks they are facing. I can honestly say, it is very rare that we’ve not had real and sincere interest in hearing about these issues and risks…..with the parties then very keen to understand what it is they can do to rectify things. In most cases, I wonder why it is that it has taken us to highlight this for them to become aware of this, or take true notice, when they’ve got a very smart and capable CSO right there in their office.
Sure, you can, should and probably are reporting your concerns as you go and so you should, but nothing works better than a definitive and all-encompassing statement presented in a big-picture format – a one hit, here’s where we stand in my opinion. They [senior management] can choose to;
- ignore it, in which case as mentioned, at least you are on record (and possibly now definitely know it’s really not the place for you)
- question it, in which case you have their attention
- verify it, in which case you again have their attention and have some actions to go with (including possibly requests for more information)
- accept your findings and possibly ask for action plans and roadmaps for improvement
Either way, any of this is better than just sitting back and fighting multiple battles on multiple fronts as your ONLY way of existence as a security professional. ie; “just putting out fires”.
Being an Information Security Professional takes a certain breed of person…not generally people who give up on things they believe in easy. But let’s not just accept that battling and “putting out fires” is our life and we just have to learn to deal with it. Lets try better ways to make change. This alone is not it, but it’s one thing, one suggestion that should help….if you’re not already doing it. (And I know many of you are but if you’re not, give it a shot!).
I welcome your comments as usual.
———————————————————————————————-
Securus Global: IT Security, Penetration Testing, Security Assessments, PCI Compliance, Product Assurance, QualysGuard, Security Strategy, Vulnerability Assessment.
]]>
