Category: Career

For security professionals, the role of Chief Information Security Officer (CISO) is often seen as the ultimate career objective. The pinnacle job after years of paying your dues in what is still a fairly rarefied industry sector.

And it should be, if that’s what you actually want. I can think of no other position outside of the CEO who should have a better grasp on how a business functions than a CISO doing their job well. In fact, while the CEO has the overarching strategy and direction in their remit, it’s the CISO who knows where the information needed to make the right decisions is.

If you accept that data in context is information, information in context is knowledge, and knowledge correctly applied is what makes organisations successful, then; a) Confidentiality of the base data is critical, b) if the data is safe, Integrity can be more reasonably assured and the resulting information is above all things, accurate, and c) the application of the information must be unhindered, suggesting that Availability of the data is the final piece of the puzzle.

You’ve all heard of C.I.A. in security, right? As far as I’m concerned it’s the CISO who is the guardian of it.

In a perfect world.

Unfortunately, far more prevalent is that the Board decides that a CISO is needed from an appearances perspectives – perhaps due to some regulatory pressures – and the person hired has no real authority, no understanding of the overarching corporate strategy, and probably reports into the CTO or someone equally unsuitable.

It’s a shame really, because a good CISO will have unparalleled input into the following:

  1.  The Security Program – From Risk Assessment all the way to Business Continuity Planning the CISO must be aware of every process related to the security life-cycle of the data under their care. Even the CTO won’t have their fingers in this many pies.
    o
  2. Asset Management – There is nothing in security that can be performed outside of robust and comprehensive asset management. This will be the CISO’s primary focus until it’s where it needs to be.
    o
  3. Mapping of Business Processes – If you don’t know how something works you can neither protect it nor fix it if it breaks. Business processes are the ultimate application of corporate knowledge and the CISO cannot do their job properly until they are all mapped, and preferably optimised.
    o
  4. Success Measurement – As Peter Drucker is so often mis-quoted as saying; “You can’t manage what you can’t measure.” In security, unless the CISO can determine which security controls are working and which are not, appropriate security will be impossible. As will staying within budget.
    o
  5. Regulatory Compliance – I cannot think of one regulatory compliance regime that does not have data at its core, so who better to report compliance status than the person who knows where it all is, and the controls around it?
    o
  6.  Change Control – In theory, if nothing can change on the inside without robust oversight, the only increase in risk to data assets will be from the changes to the external threat landscape. Which segues perfectly to;
    o
  7. Vulnerability Management – With asset management and business processes as their primary focus, who is better placed to feed into the vulnerability management process to help prioritise ongoing remediation efforts?
    o
  8. Business Transformation – In the 2000’s, competitive advantages last weeks, not years. No-one is better placed to help a business transform itself than the person who knows where everything is, and everyONE who manages it.

Prospective CISOs may go into their new job thinking they will get to do all of the above, and the CEO who hires them may think that’s what they’re getting.

Too often neither side asks the right questions, and the CISO role ends up an empty suit.

[If you liked this article, please share! Want more like it, subscribe!]

I had the honour of presenting at an ISC2 London Chapter meeting a little while ago, and my chosen subject was ‘Mobile: Changing the Face of Identity Management (IM)’. What I thought was going to be half an hour of me espousing my ideas (or ranting, depending on your point of view), turned into the most lively debate I have ever had in front of an audience.

Initially I wondered if my 10 slides was going to be enough (although I never actually read to the material), but I didn’t even make it past slide 7. By the time I was on slide 5 the questions started, then the dissenters chimed in, and by the time I reached slide 7 the presentation was forgotten. My 30 minute slot was over before I knew it, and it was clear a lot of people had a LOT more to say, which they did over beers afterwards.

The culmination of this discussion was when I heard the following; “I don’t agree with ANYTHING you are saying!”, which for a lot of people (especially ‘expert’ presenters) can be the cause of anger, considered a challenge, or can even cause outright panic. To me it should only ever be the cause of curiosity; WHY am I wrong? I certainly don’t think I am, and probably still won’t after I hear your explanation. I’m curious nonetheless.

But what I will do is hear what you have to say as objectively as I can, and respond as neutrally and I can. Usually without much success mind you, we are all very attached to our opinions, but I will at least try.

Presenters are supposed to be experts in their fields, otherwise why the Hell are they on stage, but that does not [necessarily] make them right, especially when the subject is focused on future-state concepts as opposed to subjects which are long established. I have no idea where Identity Management will be in 5 years, but I have a rough idea. Also, my ideas are also right for ME, but I am decidedly on one side of the privacy challenges that surround the field of identity and privacy like a miasma.

I guess in the end you must decide for yourself if you want to be a lecturer, where your subject is not really up for debate (like when I train groups in PCI for example) or a presenter, when your ideas must be open to not only comment, but potentially ridicule. I have to admit, it makes presenting is a lot more fun, and if I only have to produce 7 slides to get an audience engaged, then I have a lot less work to do! 🙂

The lessons I learned in that presentation will stand me in very good stead for the next one, and who knows, maybe I’ll even finish all 10 slides.

[If you liked this article, please share! Want more like it, subscribe!]

Unless by some ridiculous twist of fate you’re Novak Djokovic, Lionel Messi, or Steven Hawking (and their like) reading this, you are not the best at anything. Perhaps like me, even if you had spent your entire life practicing one thing you still would not have been the best.

Nor do you have to be.

World-class talent is exceptionally rare, but we humans have the unfortunate habit of holding ourselves up for comparison to these unique few. How could we possibly come up anything other than short?

A single skill or talent (see Choice: Love What You Do, Or Love Doing What You’re Good At?), properly developed, can take you far …IF you’re very good. But it’s the combination of your skills and talents that will enable you to excel at a far greater array of your life choices.

No-one, I mean NO-ONE can be you better than you can.

The challenge is; Who ARE you? What are your skills, your talents, your likes, dislikes, even aspirations? A disturbingly large portion of us spend our whole lives without answers to these questions, and we die never having achieved a fraction of our potential. Not someone else’s opinion of our potential, but our own sense of happiness and self-worth. Our feeling of achievement for a life that made a positive difference. At least to someone.

We have all come across people we simply can’t believe haven’t been fired yet, and we have all met people we are amazed are not doing significantly better. In my mind they have both committed the same ‘crime’; they have failed to understand themselves. These examples came from different angles, but the results are the same; neither is doing what they should or could be doing with their lives.

While I absolutely believe you must leave this life with regrets (A Life Without Regrets is a Life Without Mistakes) doing a poor job or never doing a great job should not be among them. Others can help – and usually love to do so – but only you can choose the right path.

There is a good chance I can beat Djokovic at darts (and perhaps several other non-athletic endeavours), and I likely know a lot more about payments security than Hawking. We all make our OWN choices in life, I am where I am because of mine, so why should I ever compare myself to them? Or to anyone else for that matter.

No, I have no-where near their money or their fame, but if I was to measure my life by those standards I have a lot more issues to address first. I am very good at what I do, but equally important, I know when I’m out of my depth. Like most people, I will never know EVERYTHING I’m good at, but I am self-aware enough to know when I should keep something going, or let it go entirely.

I have no problem being fired for being too opinionated, I would very much object to being fired for incompetence, but they are both very much my responsibility.

With self-awareness comes true personal accountability, only then can the regrets you have be the kind you want.

[If you liked this article, please share! Want more like it, subscribe!]

The following phrase occurred to me after conversations I had with two ex-colleagues. Both of whom also now happen to be very good friends;

“You don’t know what you don’t know, so how can you ever be sure you know enough?”

Both find themselves in a similar position; both have progressed in their careers at their respective organisations, and both have very recently received a significant bump in responsibility and work-load. Neither has EVER received the recognition they deserve, but both have dramatically improved things for their departments after taking over. They also replaced people on much higher salaries.

It’s very easy for me to rail on the senior management at those organisations about how they must show appreciation for their star performers. In both monetary terms, and the respect they have earned. But the fact remains that neither of these talented guys know their true worth.

Yes, their senior management are idiots, they probably always have been, but if my friends had been paying attention they would be in a better position to negotiate. If they had been laying the right groundwork over the course of their careers, no promotion would have been offered without the corresponding upward review of their compensation packages.

And the thing is, I know exactly how they feel. After 12+ at my last ‘corporate gig’ it was not until the last few years that I started to get it right. It took a further year after my departure for me to finally know my worth. The true value of my skill-set.

I also know exactly why it took this long; fear.

When I started a new career in my 30’s, I could not have known less about my chosen field of cybersecurity. My first two weeks as a Firewall Administrator consisted of my learning what a firewall was and faking my way to a couple of credentials. Over the next 5 years I worked my up to managing the department, which was then all taken away during a company merger. For the next 7 years I worked my way up from a brand new consultant to Director of 28 consultants across 14 time zones.

Yes, my compensation increased, but I very much doubt it was in-line with my market value. Why? Because I always doubted that I had learned enough in my career to have proven my value, to be worth more than my management were offering. Also, having spent so long at one place, my blind loyalty got in the way. I assumed I would be taken care of if gave it my all.

I could have gone on for years this same way, luckily the final decision was made for me. When I look back, I can see years of wasted time and misplaced loyalty, but if I’m really honest with myself, it was my own fear and laziness that really held me back. All I had to do was look around, have some conversations, and above all; stop being such a wuss.

I know it’s not as simple as I’m making out to be, we all have responsibilities (family, mortgage and so on…) but in the end, YOU are the one that sets your value, and if you’re not getting your due, YOU are the only one to blame. I had no choice in working this out, I was “laid-off”, but one of the most amazing upsides of a bad situation is that I’ll never be afraid again.

I know my worth, do you know yours?

[If you liked this article, please share! Want more like it, subscribe!]

By the time you reach your 40’s, there’s a very good chance that you have lost a job or two (or four, [cough]), either by redundancy, pressure to quit, or being out-and-out fired.

If it happens once, you can chalk it up to being one of those things. If it happens again for the same reason, then you really need to start taking note. A third time, and you are clearly in a pattern of your own making. Yes, your making, and it does not matter for what reason you lost your job.

This does not necessarily mean that you are a bad person, or a screw-up, and perhaps you were actually in the right when you were ‘let go’, but the fact remains that you are the one out of a job. Unfortunately most of us keep going back to the same pattern, and I can assure you, you will eventually run out of decent options.

Hopefully if you find yourself in the above scenario, you are now prepared for a little self reflection. WHY do you keep imploding at work? What is it that YOU keep doing that makes your unique talents and skills so easily replaceable? There are basically two negative extremes here:

  1. You are completely deluded as to what your strengths / talents actually are; and
    o
  2. You are actually a jerk.

If you’re a nice person in a position to do what you do best every day, would you really have been ‘laid off’ from an organisation that’s still in business?

The issue is that most of us are not always nice, and for more reasons that anyone would ever care to know about, we are probably also not doing what we love to do. Quite frankly, most of us are not even doing the things we’re good at, let alone love. For every kid who knows at the age of six that they want to be a doctor, there’s a hundred kids with no clue.  That cluelessness can last a lifetime, but life goes on and you have to do something.

What happens to most of us is that we bounce from one thing to the next, and by more luck than judgement, we find something tolerable. But instead of using the steady income as a springboard to what’s next, we hold out for the perfect job, the perfect title, or a passion. The perfect role does not exist, not if it comes with a title. No job description I’ve ever seen is based on my skill-set or talents, it’s based on what the company I work for thinks they need.

Fair enough you might say, they’re the one’s paying you a wage, but it’s completely self defeating in my opinion. It puts us in a position where we have to balance the good with the bad, which can only ever be frustrating to the point where we start to focus on the bad. Once on this downward spiral it is very difficult to stop, and we may find ourselves in a position where our job is at risk. Whether we know it at the time or not.

We have always had a choice, this scenario has always been of OUR making, but hindsight is not going to help here unless it’s in the form of self reflection, and lessons learned. So what DO we do now? Leave for another company before we get fired and start the same pattern all over again? Start your own business because we’re basically unemployable?

Or, are you going to do what you should have done years ago?; take a long hard look at yourself. Wherever you are in your career, you MUST ask yourself every day whether or not you are doing something sustainable. If you are going home exhausted from frustration each night, or are constantly complaining about something, there’s a very good chance you are in the wrong place and will wind up having to make a difficult decision.

Or that decision is made for you.

Forget the company you work for (unless you hate their ethics / values), and forget your title (it’s limiting), are you mostly doing what you are best at and maybe even enjoy? If the answer is yes, then by all means defend your job if threatened, if the answer is no, you should probably see it as a wake-up call.

[If you liked this article, please share! Want more like it, subscribe!]