Evolution of the CISO Role – Ben Carr – BSW #205
Ben Carr, Global Chief Information Security Officer at Qualys, steps in last minute to talk about his transition from Aristocrat to Qualys and the evolution of the CISO role.
Ben Carr is an information security and risk executive with more than 25 years of experience in developing and executing long-term security strategies. Ben has demonstrated global leadership and experience, through executive leadership roles of advanced technology, high risk, and rapid-growth initiatives, at companies such as Ericsson, Qualys, Aristocrat, Tenable, Visa and Nokia. At Ericsson, Ben was the Chief Security & Trust Officer for Cradlepoint, the enterprise wireless division of Ericsson. While at Aristocrat, Ben built a world-class global cybersecurity program from the ground up as part of a digital transformation. As a senior cybersecurity executive at Visa, Ben was responsible for developing and leading Visa’s Global Attack Surface Management Team and capability. Ben holds a certificate in Risk & Information Systems Control (CRISC), is a Certified Data Privacy Solutions Engineer (CDPSE).
Don't miss any of your favorite Security Weekly content! Visit https://securityweekly.com/subscribe to subscribe to any of our podcast feeds and have all new episodes downloaded right to your phone! You can also join our mailing list, Discord server, and follow us on social media & our streaming platforms!
If you missed Security Weekly Unlocked, you can now access all of the content on-demand, whether you registered before the live event or not, by visiting https://securityweekly.com/unlocked and clicking either the button to register or the button to login!
9 Steps, the Big 8, & 7 Super Bowl Rings! – BSW #205
In the leadership and communications section, 9 Steps for Effective Cybersecurity Risk Management, The Big 8: How to heighten cybersecurity governance, 7 Super Bowl rings for Tom Brady, and more!
Don't forget to check out our library of on-demand webcasts & technical trainings at securityweekly.com/ondemand.
We're always looking for great guests for all of the Security Weekly shows! Submit your suggestions by visiting https://securityweekly.com/guests and completing the form!
Matt Alderman
- 9 Steps for Effective Cybersecurity Risk ManagementTo ensure effective cybersecurity risk management, follow this checklist: 1. Understand the organization’s security landscape 2. Identify the gaps 3. Create a team 4. Assign responsibilities 5. Train and upskill employees 6. Implement cyber awareness across departments 7. Implement a risk management framework 8. Develop risk assessment programs 9. Create and maintain a sound incident response and business continuity plan However, don't take all the advice from their next blog, THE NEXT CYBERSECURITY RISK MANAGEMENT MODEL POST THE COVID-19 CRISIS, https://blog.eccouncil.org/the-next-cybersecurity-risk-management-model-post-the-covid-19-crisis/.
- The Big 8: How to heighten cybersecurity governanceBelow are eight steps organizations can implement to heighten cybersecurity governance: 1. Recognize that the worst-case scenario has escalated 2. Empower the CISO to directly report to the CEO 3. Conduct reviews of internal cybersecurity policy 4. Confirm your processes and controls are bulletproof 5. Stay up to date on regulations 6. Allocate at least 10 percent of your IT budget to cybersecurity 7. Develop and regularly update a comprehensive incident response strategy 8. Communicate with customers and suppliers
- Security and privacy laws, regulations, and compliance: The complete guideThis handy directory provides summaries and links to the full text of each security or privacy law and regulation.
- 3 ways to speak the board’s language around cyber riskFraming the cyber risk conversation in ways that resonate with the board will help close the chasm between cyber risk and enterprise objectives. Here are three tips for communicating cyber risk to the board. 1. Understand the board's responsibility 2. Present data in a familiar format 3. Know your benchmarks
- How to translate threats and risk to C-suiteWhen communicating with the C-suite or shareholders, CISOs have to speak equal parts security and bottom line. How security experts derive business value from risk and threat-based analysis can be done by using the "three P's": prediction, prevention and proaction. In doing so, security leaders are able to unpack a business risk to their C-suite and board. Here are two ways CISOs can cut to the chase: 1. In a quarterly report, reserve a single slide for the business risks accumulated during that period in a graphic. 2. Choose relevant information to share, not the full cyber threat intelligence report.
- 12 security career-killers (and how to avoid them)Here are 12 common traits that security leaders say will keep you from advancing your cybersecurity career – and how you can avoid such a fate: 1. Believing security is the end goal 2. Getting stuck 3. Acting like the smartest one in the room 4. Being too timid 5. Losing your cool 6. Talking tech 7. Sticking to yourself 8. Failing to build other skills 9. Staying still 10. Staying in security 11. Mistaking vulnerabilities for risks 12. Being tactical, but not strategic
