{"id":3331,"date":"2019-12-19T16:45:33","date_gmt":"2019-12-19T21:45:33","guid":{"rendered":"https:\/\/www.stratospherenetworks.com\/blog\/?p=3331"},"modified":"2019-12-23T16:05:17","modified_gmt":"2019-12-23T21:05:17","slug":"ciso-holiday-wishlist","status":"publish","type":"post","link":"https:\/\/www.stratospherenetworks.com\/blog\/ciso-holiday-wishlist\/","title":{"rendered":"A CISO\u2019s Holiday Wish List"},"content":{"rendered":"

\"a<\/a>\u2018Tis the season of giving gifts, charity, and holiday cheer. As much as a Chief Information Security Officer (CISO) likes to celebrate the end of another year, there is still plenty of work to do because, as we all know, cybersecurity threats aren\u2019t going away anytime soon.<\/p>\n

Since this is the time for making a list and checking it twice, it would be nice to do the same as a CISO. It\u2019s easy to wish for better tools for fighting cyberattacks, insider threats, and all the other holiday cheer-killers out there. However, this CISO\u2019s holiday wish list has much, much more, including focusing on approaches that will help grow the business (gasp!) and help us grow into an overall better CISO.<\/p>\n

An Increased Budget (Duh!)<\/strong><\/h4>\n

With cybercriminals evolving and getting smarter, organizations need to put the tools in place to better protect their data. Unfortunately, those resources aren\u2019t cheap and can be a tough sell to the decision-makers of the company.<\/p>\n

A\u00a0recent study by Deloitte and the Financial Services Information Sharing and Analysis Center<\/a> found that financial services, on average, spend\u00a010%\u00a0of their IT budgets on cybersecurity.\u00a0This cost pales in comparison to the average cost of a cyber breach, and a budget this small is typically not adequate to reduce risk enough so that it meets the predetermined risk appetite agreed upon by the board and\/or decision-makers.<\/p>\n

So how does a CISO move the needle?<\/p>\n

When presenting to the leadership team, here are a few points to highlight when asking for additional investment in cybersecurity:<\/p>\n

    \n
  1. The cost of a security incident – According to IBM and Ponemom Institute<\/a>, the average cost of a data breach globally totals around $3.86 million.<\/li>\n
  2. The company\u2019s reputation \u2013 With a cyber incident, your current clients could seek out competitors who promise better protection of their data.<\/li>\n
  3. Regulatory consequences \u2013 Your company may face penalties when not complying with various IT security regulations.<\/li>\n<\/ol>\n

    Remember, when presenting the above stats, hammer home the quantitative financial numbers! Focus on the bottom-line risk in dollars and cents. Give tangible quantitative estimates of what financial setback the organization could expect in these different scenarios, and offset that against the cost of the increased budget being proposed.<\/em><\/p>\n

    Better Communication<\/strong><\/h4>\n

    As mentioned previously, part of being a CISO includes communicating with senior leadership persuasively and effectively about the necessity for an increased IT security budget. It\u2019s easy to get too technical, so self-awareness is important as a CISO to censor the tech talk, and use practical \u201cbusiness speak.\u201d<\/p>\n

    Communicating with end users is just as important as collaborating with decision-makers. It\u2019s imperative to understand your end users \u2013 i.e. empathy\/EQ. If you make this a focus, you can identify the \u201cwhy\u201d in their day-to-day, and then use that understanding to better educate them about how cybersecurity can improve their everyday work life moving forward. Understanding their role and challenges within the company will allow you to use the right messaging when attempting to engage them, and will foster the adoption of better cybersecurity practices.<\/p>\n

    Qualified Personnel\u00a0<\/strong><\/h4>\n

    There is a shortage of cybersecurity talent<\/a>, and that may get worse in 2020. A 2018 report from the (ISC)\u00b2, an international, nonprofit association for information security professionals, said the shortage of cybersecurity professionals is approximately 2.93 million.<\/p>\n

    To help businesses keep up with the cybersecurity shortage, it may be time to consider Security Operations Center as a Service (SOCaaS<\/a>).<\/p>\n

    A SOC should be staffed with multi-tiered security analysts who monitor all aspects of an organization\u2019s IT environment. This includes looking for threats and suspicious activity surrounding endpoints, servers, desktops, applications, internet traffic and more.\u00a0 A SOCaaS solution involves a third-party company operating as a SOC for its clients. This allows businesses and IT departments who lack internal cybersecurity resources to access a 24\/7 SOC with deep personnel and expertise in a turnkey fashion.<\/p>\n

    Some of the benefits of a SOCaas from TechTarget<\/a> are:<\/p>\n