Adam Keown

Writing radically agnostic #InfoSec job descriptions leaves so much room for activities! And vision sharing. And top-down value alignment. And clearly structured expectations. And making it without faking it. 🙂

15

3 Comments

Plenty of companies think they’re going above and beyond to manage cyber risk. But in reality, most are doing the bare minimum. Executives who know they need some kind of risk management framework hear terms like HITRUST, CMMC, or NIST ISO 27001 and hire someone to put one of these programs into practice thinking they’ve fulfilled their obligation. We refer to this as a “checking the box” approach. What those execs don’t know is that many high-profile security frameworks are meant to be a foundation to build on – not a bulletproof vest. Companies that just check the box leave themselves vulnerable to threats while thinking they’re protected. Unfortunately, simply adopting a security framework is just table stakes. True cyber risk management comes into play when you start asking questions like: -What are the financial losses my company might expect without a security framework in place? -How have similar businesses been affected by a data breach, either monetarily or reputationally? -Am I using a framework that is specific to my business model? -What are my internal capabilities for managing risk and where do they need to be supplemented? The answers to these questions inform the specific protocols your company needs to adopt and the level of protection you need. Frameworks themselves are not smart. They don't know what your business is, where it’s located, or what your specific level of threat is. Without that context, your cyber security measures fit your company less like a tailored suit and more like a one-size-fits-all bargain bin jacket. As an executive, your job is to take the measurements of your company’s business context and adjust the framework so it’s a perfect fit. Doing so can mean the difference between feeling protected and 𝘢𝘤𝘵𝘶𝘢𝘭𝘭𝘺 being protected.

33

4 Comments

So, you want to be CISO. This will be a reoccurring post of the job requirements of a current CISO.  We will cover: Education Experience Leadership Skills Technical Expertise Risk Management Skills Communication Skills Regulatory Compliance Knowledge Continuous Learning Certifications Part 1. Let’s cover education today.  The minimum requirement for a CISO is a bachelor’s degree, preferably in a technical program (Computer Science, Engineering, or Informational Technology).  Showing that you have a bachelor’s degree in business administration will not get you the job, brutal but true.  The larger the company you want to work for generally has either a Masters or even a PhD requirement.  Some companies will substitute a long leadership career where you have shown constant upwards movement for higher levels of education. The key is that you must show that you have the educational background to be able to communicate and learn new technologies on a constant basis.  The Cybersecurity field is ever changing, it is accelerating with new technologies, such as ML and AI and will not stop changing.  If you do not show that you are capable of learning and mastering constantly new technologies then this is not the job for you. What may be of interest is that an MBA has a long way to go with acquiring the position.  CISO’s must not only understand the technical side, why buy what, but also managing a budget that can be very tight to what the organization needs. How much can I spend on what and what should we do first. You will be expected to attend technical conferences to understand what the next “Big” thing is and how it may fit into your organization. Network with fellow CISO’s to understand what they are doing in your vertical and how they are managing their budget. This life of a CISO is no easy and never will be.  If you have the wherewithal to meet the requirements above, I encourage you to go for it.

5

If you are looking for a new job, reconsider using the LinkedIn tag #OpenToWork.   Scammers search on people using it and try to scam them with employment scams, resume scams and everything in between.  Most who reply to those using OpenToWork are scammers.   They will often reply to a OpenToWork post with ‘Let’s Connect’. That’s as big a red flag as it gets.   Be careful. Very careful. Job searchers are very vulnerable and the scammers capitalize on that.  And they are rampant on LinkedIn.   https://lnkd.in/eiNgTZr9    

2

Challenges attracting and retaining new people is nothing new for the cybersecurity industry, but the new FTC ruling brings this challenge front and center more broadly across industries. Where noncompete agreements have been used to retain staff, people strategy will need to be evolved. In a discussion with Fortune, Peter Ragnar said “Whether it’s with engineers or scientists, those people aren’t getting poached every single day. They got poached when they’ve either reached the end of the line at a company, have a pay dispute, are not treated well, or a larger equity opportunity comes up.” I have found, that the ability to retain staff comes down to crafting a compelling vision of the future and working to create that future on an individual and enterprise basis. In the end, business is about maximizing value to our customers which is directly impacted by our ability to create value for our staff. Talented staff can always find opportunities, but finding opportunities where they truly thrive is rare. Where I work, what keeps me is that we are driving better health outcomes for our members, I have a work environment with both a focus on excellence and on creating the conditions for everyone to thrive, a great team to work with, and a robust commitment to finding the optimal answers to the challenges we face. #FTC #Retention #FutureOfWork #Leadership #PeopleStrategy

12

CMMC Level 2 Assessment Objective: Role Separation PRACTICE: Organizations must separate user functionality from system management functionality. ASSESSMENT: System management functionality includes functions necessary to administer databases, network components, workstations, or servers, and it typically requires privileged user access. The separation of user functionality from system management functionality is physical or logical. Organizations need to prevent users and user services from accessing system management functionality on IT components. Be prepared! Your assessor could ask to 🔍 EXAMINE system and communications protection policy. 🗣 INTERVIEW system or network administrators. 📝 TEST separation of user functionality from system management functionality. (CMMC Assessment Guide: Level 2 Version 2.11, page 212) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

46

If you are looking for a new job, reconsider using the LinkedIn tag #OpenToWork.   Scammers search on people using it and try to scam them with employment scams, resume scams and everything in between.   Odds are those who reply to those using OpenToWork are scammers.   They will often reply to a OpenToWork post with ‘Let’s Connect’. That’s as big a red flag as it gets.   Be careful. Very careful. Job searchers are very vulnerable and the scammers capitalize on that.  And they are rampant on LinkedIn.   https://lnkd.in/eiNgTZr9  

1

4 Comments

If you are looking for a new job, reconsider using the LinkedIn tag #OpenToWork.   Scammers search on people using it and try to scam them with employment scams, resume scams and everything in between.   Odds are those who reply to those using OpenToWork are scammers.   They will often reply to a OpenToWork post with ‘Let’s Connect’. That’s as big a red flag as it gets.   Be careful. Very careful. Job searchers are very vulnerable and the scammers capitalize on that.  And they are rampant on LinkedIn.   https://lnkd.in/eiNgTZr9    

If you are looking for a new job, reconsider using the LinkedIn tag #OpenToWork.   Scammers search on people using it and try to scam them with employment scams, resume scams and everything in between.   Odds are those who reply to those using OpenToWork are scammers.   They will often reply to a OpenToWork post with ‘Let’s Connect’. That’s as big a red flag as it gets.   Be careful. Very careful. Job searchers are very vulnerable and the scammers capitalize on that.  And they are rampant on LinkedIn.   https://lnkd.in/eiNgTZr9    

If you are looking for a new job, reconsider using the LinkedIn tag #OpenToWork.   Scammers search on people using it and try to scam them with employment scams, resume scams and everything in between.   Odds are those who reply to those using OpenToWork are scammers.   They will often reply to a OpenToWork post with ‘Let’s Connect’. That’s as big a red flag as it gets.   Be careful. Very careful. Job searchers are very vulnerable and the scammers capitalize on that.  And they are rampant on LinkedIn.   https://lnkd.in/eiNgTZr9    

1

If you are looking for a new job, reconsider using the LinkedIn tag #OpenToWork.   Scammers search on people using it and try to scam them with employment scams, resume scams and everything in between.   Odds are those who reply to those using OpenToWork are scammers.   They will often reply to a OpenToWork post with ‘Let’s Connect’. That’s as big a red flag as it gets.   Be careful. Very careful. Job searchers are very vulnerable and the scammers capitalize on that.  And they are rampant on LinkedIn.   https://lnkd.in/eiNgTZr9