Board Tips & Tricks, Security Culture, & Zero Trust Myths – BSW #237

Matt Alderman

1. CISOs: Approach the board with precision, simplicity
   All a CISO needs is buy-in, but it's not guaranteed when presenting security strategies to the C-suite, board or other employees. CISOs need to provide context that illustrates what security wants and portrays clear intention when presenting to the board. CISOs should ask themselves: What are you asking for? What do you need from the board? It is the board's job to ask questions, not directly tell CISOs what to do. CISOs who can operate and speak at a board level, and seek agreement from their board, can transcend whatever industry they perform security in. The broad principles of cybersecurity are evident in most businesses and industries, especially in the last year and a half.
2. The dos and don’ts of advocating for cybersecurity in the boardroom
   A successful CISO needs: - Understanding the makeup of the board. - When presenting to the board: preparation is key. When presenting to the board, there are some strategies CISOs should avoid while advocating for cybersecurity measures: - Don't get technical. - Don't be too reassuring. - Don't scare the board.
3. 5 ways to improve the CIO-CISO relationship
   Regardless of the reporting structure in your organization, here are five ways you can improve your relationship with the CISO. 1. Treat the CISO as a peer 2. Frame discussions around risk 3. Engage the CISO and security team 4. Arrange informal and formal interactions 5. Craft consistent business cases
4. Biggest cybersecurity issue is ‘culture,’ city CISOs say
   A group of local-government cybersecurity leaders agreed Thursday that their organizations’ cultural attitudes pose some of the greatest roadblocks to more secured systems. The challenges, they said, include walled-off agencies, employees’ discomfort with mandatory trainings and users’ unease with increasingly standard procedures like multi-factor authentication and single-sign-on protocols. But those mindsets can ease the path for malicious actors seeking to freeze up government networks with ransomware or disrupt critical infrastructure like power and water facilities.
5. Layoffs Taught Me To Never Make 3 Powerful Leadership Mistakes
   Leadership is like chess. Wrong moves can limit future flexibility. Lesson 1: Don’t hire if you can’t afford to keep them Lesson 2: Do the work yourself to understand what kind of effort & team is required Lesson 3: Listen to your team members, make them feel heard, and provide answers
6. Your Most Passionate Employees May Not Be Your Top Performers
   People who work to achieve a sense of personal fulfillment and make the world a better place have been shown to experience stronger work and life satisfaction and feel more successful — but the jury has been out on whether that’s truly the case. The author’s research finds evidence that it’s true, but not because passionate employees are actually better at their jobs or more productive. Instead, it’s because their behaviors — like staying late, or volunteering for projects — signal to managers that they are performing at a high level, even if they aren’t. Managers should watch out for this bias lest they alienate other team members.
7. Gartner: 8 security trends facing the enterprise
   Gartner detailed what its research shows are the top eight trends in security and risk management: 1. Remote/hybrid work is the new normal 2. Cyber-security mesh architecture 3. Security product consolidation 4. Identity-first security 5. Machine-identity management 6. Breach and attack simulation (BAS) tools 7. Privacy-enhancing computation 8. Boards are adding cybersecurity
8. 6 zero trust myths and misconceptions
   If you’ve fallen for one of these myths, you may need to rethink your zero trust strategy: 1. Zero trust solves a technology problem 2. Zero Trust is a product or set of products 3. Zero trust means you don’t trust your own employees 4. Zero trust is difficult to implement 5. There is only one correct way to begin the zero trust journey 6. Deploying SASE means I have zero trust