Categories
News-EN

THE STRATEGIC ROLE OF THE CISO

news

THE STRATEGIC ROLE OF THE CISO

I recently had the honor to participate at the Open Lesson of the Executive Master in Cybersecurity and Data Protection organized by 24ORE Business School, where we discussed about the role of the Chief Information Security Officer (CISO).

In a scenario where cyber attacks and cyber threats are constantly lurking, it is imperative that companies are prepared to manage and mitigate these risks in accordance with budget needs and business objectives.

The role of the CISO fits into this context since is responsible for setting and managing the corporate Cyber ​​Security posture.

CISO’s tasks include the definition of long and short-term strategies, best practices, the verification and implementation of processes to mitigate the risks of cyber space, the spread of the cyber security culture in the company.

The role of the CISO is as strategic as it is still not very widespread and is only now starting to get the attention it deserves.

However, it is very important that it respects some characteristics:

  1. THE CISO IS NOT A TECHNICIAN

    Although often confused with a technical figure, the CISO cannot limit itself only to this aspect.

    While understanding the dynamics and complexity of the cyber world, this role must in fact be played mainly by a manager, able to understand company needs and communicate with management at the same level.

    A sort of hybrid figure able to connect and understand both worlds, the technical one and the business one, to find the most suitable solutions to guarantee the protection and availability of data and corporate assets.


  2. THE CISO MUST REPORT TO THE BOARD

    For this role to be effective, however, its placement in the organization chart must be correct.

    In fact, when present, the CISO is often employed by other C-level figures such as the CIO (Chief Information Officer) or the CTO (Chief Technology Officer).

    This depends on the fact that Cyber ​​Security is still seen as a sub-set of the IT world, but it should be emphasized that this conception is wrong and limiting.

    In fact, the purpose of Cyber ​​Security cannot be limited only to the protection of computer data, but is rather to protect all important assets for companies, institutions and citizens.

    In the case of networked medical devices and electric cars, for example, these assets also include human lives.

    It is therefore important to evaluate Cyber ​​Security as a subject in itself and to ensure that the CISO can report directly to the company Board to maintain the autonomy and decision-making power it needs to operate.


  3. THE CISO MAY BE AVAILABLE IN “AS A SERVICE” MODE

    The figure of the CISO would be useful in any company.

    It is easier to find this role in large companies, but in small and medium-sized companies things get complicated.

    Often SMEs do not have enough funds to hire a CISO and in these cases it would be useful to be able to use a “CISO As a Service” service, being able to “rent” this professionalism as needed, optimizing costs and thus making the function accessible. even to smaller companies.

    Although this service would make it possible to spread the figure of the CISO even for companies that cannot afford it, on the other hand, since it is a figure outside the company, there could be a lot of resistance to placing it correctly in the organization chart, going to interfere with correct operation. of this role.
Ultimately, CISO must devise and manage Cyber ​​Security strategies in compliance with the corporate budget, in order to spend it effectively and efficiently.

In a scenario where resources tend to be scarce in the face of ever-increasing threats, it is in fact a priority to correctly manage budgets in order not to obtain greater damage.

Knowing the threats for the specific sector and risk model of the company is certainly an excellent tool in this sense, which allows you to target strategies and defenses more precisely. The scenario of cyber threats changes continuously and very rapidly, so it is very important to obtain timely and detailed information about it.

Hackmanac can be useful for this purpose, ask us how!

Latest news

Categories
News-EN

THE CYBER SECURITY MOST REQUIRED JOBS

news

THE CYBER SECURITY MOST REQUIRED JOBS

The current scenario of Cyber Security is certainly worrying: cyber threats are constantly lurking and risks rise, also because of the constant spread of digital and IT devices.

 

While the potential attack surface we expose to cyber criminals increases, the Cyber Security jobs are becoming increasingly strategic.

 

In 2021, there are 3.5 million job vacancies globally in Cyber Security, a sector that grew by 350% from 2013 to 2021.

 

The unemployment rate in Cyber Security has been 0% since 2011.

 

Interesting premises, therefore.

 

But what are the most interesting jobs in this sector?

 

I selected five.

 

1) Ethical Hacker

The ethical hacker performs advanced penetration tests on a company’s computer systems to check if there are any weaknesses or breaches already in place.

The intervention of the ethical hacker is essential to prevent and mitigate all system vulnerabilities that could be exploited to violate or damage the company.

It is a role that allows you to fully understand how systems work and how criminals think.

 

2) Digital Forensics Analyst

The digital forensic analyst works closely with law enforcement to investigate cybercrime.

The forensic analyst is in fact able to collect evidence on digital devices (computer, smartphone, cloud), in order to determine what really happened.

Ideal if you have an investigative mindset, the chances of learning never end as technologies continually evolve.

 

3) Malware Analyst

The malware analyst studies malicious software in depth to understand the nature of the threat, its behaviour and purpose.

This function is very important because it allows a quick and effective response to contain an ongoing cyber attack or to understand what happened, in case of attacks that have already occurred, and prevent the problem from recurring.

The role of the malware analyst offers a great opportunity to hone your investigative skills by confronting cybercriminals who instead try to obfuscate their software threats as much as possible.

 

4) Cyber Security Manager

The Cyber Security Manager manages security systems and solutions projects that protect the resources and data of an organization.

Coordinating with other Cyber Security specialists, he verifies each phase of the project and ensures that the objectives are achieved on time and within budget as well as quality standards.

It is the perfect role to test your organizational and management skills, as well as your understanding of the dynamics of Cyber Security.

 

5) Chief Information Security Officer (CISO)

The CISO supervises and is responsible for the entire security strategy of an organization, effectively acting as a link between the technical department and the company’s managers.

This role requires excellent leadership qualities and a thorough understanding of an organization’s cyber security as well as business dynamics.

It is a senior position of great responsibility, which usually reports directly to the CEO of the company.

 

Therefore, not only technical roles, but also functions where organizational and management skills are important.

 

What are the main skills for Cyber Security then?

 

Technical skills (hard skills) first of all: the in-depth knowledge of the various operating systems and main applications, of computer networks, of programming languages (in particular scripting).

 

Based on the chosen area, specific skills will also be needed, from incident response to compliance.

 

But soft skills also have their relevance: organizational and managerial skills, analytical and deductive intellectual abilities, lateral thinking, problem solving attitude, attention to the details, team work predisposition, communication skills.

 

So how do you become an expert in Cyber Security?

 

If for the technical roles university is not ready to entirely prepare for all the Cyber Security roles, although it is rapidly catching up with vertical paths.

 

For non-technical roles, a degree in computer science or business management may be useful, as well as a master’s or professional certification in project management.

 

In general, certifications and specific courses can broaden skills and increase the chances of success.

 

But, above all, it is useful to acquire a lot of practice in the field and continuously update.

 

Good job!

Latest news

				
					-----BEGIN PGP PUBLIC KEY BLOCK----- xsFNBFyONI0BEAC3wJRo5qhtr1KsqVdMz7b5JqHmt7H0ZZr14oJ9TV/hD9LMfrKpnQ94dFGnpfGa BKC1wSoJN4Yfs5lg5YmN4hmHmm6PkjgQdenVgL4YDfLDodwn5DgXKuywRBqIFbbnTDvFAb03DX2A FPnc+4g2QHsfiFycz+ISg/Z+8i21gY3j5oZlrdMKVWrNczrNc/lDJqJ36RSYDn1QzAW1ZGY/pUXk imPRvLew5Idr3462sZVVhuUFMD3Uf/W1SaS3bSEQM89pSYKZfo8AFpAs659Mn7gqKru6ndxilRdF wJGQuepqR8kz+vVPLyxJj68ii2ZBIY50RQvSBgJRnNF/Htp30cuk3v8jfSGZit9XYTTGQThVbfGR ZcKWze/iF+es110+mNXA/8s7jKs95PI+z1Foc9o74Ujs8dvjEGHTaESIEzX3JtEZUCZUiPt/P8pU Jw0ewbj1XCacYxYVsR7ODlf6GEsjt868WcjiqsuuZo2rzO4og9hFU5DlBzuePklfhw8dO5CiMN2H vtSkAn4DkgHqC+JiciHc9h5Cvvfjp52oQPj1eYmU3LkOvGFmPXVIts3VfxsQT3gk+DmrQ4J//fAl tNRSbMBnGu5F/qnLLkJmKRKPKNNcpjptFznKxLZbxW5QbAeDok3ho8YQACfADKcrmaIRkoPr8/mn PxZgMSMB87W7sQARAQABzSRTb2ZpYSBTY296emFyaSA8c29maWFAaGFja21hbmFjLmNvbT7CwZQE EwEIAD4WIQTNwEbcXbH0vegGlHCd6fr0nsTifwUCXI40jQIbIwUJEswDAAULCQgHAgYVCgkICwIE FgIDAQIeAQIXgAAKCRCd6fr0nsTifwKuD/4+3MaN+9eFiltI06fFBjr1Csh0OLFw89jFnpuYl9Sm ImVqmBwrnm+APxxLK4M+FMuNm4fW08X249t09Nsf0ba6UJ0HR/7/fRTipjzRLqHSr0+ZjVUGHhon fuuFZgNzPA5RmQZZCyiwyqZJs7pLn1QI/CtlDP6MsQhadywbkO/5LlDoBoYh/2DYNA/mtEfJbvc/ cOvfk47thj5OzcXJEWFxz7h2P5C2ELwxdhNPC+uqcOQkTScnuIBJooheJPhdmqOtOwrbUUIfaryM IESrol3Jg3/MUOe7FLXhwCSQGY1iefzl4py2jTeK936GMBHifLSUCA88lpE7ALkbf3+qJ9ABra9G e9e0dirIlPvFgBkEBBXsoIReQLrhHKFBtvKdrrE9Rb7kAwon+sW+3Uf6Ie3M8nTisGy2AmlI/tQ5 V0MHU2UJUNcc59hk7ADIlXN64eeqELgsMtlR4wEHd6nwcEpoPCTWfrVSwzsPtXUGNAGbgGxISv/F ltcFJ6Qw6Zy4f+YBEyCx/7GA3kjLllkcHv4kwHpP+WQCzbjh2JdkGEp5AY7puil1AtOFcbirbHbR 83KVeqx4Vvlyh2jhIDQYB/9qpTDC1xDKpndn40gnNd5hvjK0I0Xvbhb0PLhCpJQ5tsvPiQHjhOMF Wye3ZigaX1gTZxE29MLtwBbOYdGCYG0MrM7BTQRcjjSNARAAupAKTZXLRktriUVqhkZpU8zUVwrW ik6siStg7BppSJuKVW+Ic8QIagW0I48d2jZIIXrQRvqVBixn8eeBTE8Cujum1mZyhTw2sri3gE9i 81gisF17T/uewzRyYwx8obMfSEBnwJa44td7VjtbfLMRtfneK9R40+kELhhvXZa3DBbcG86zHVPU f1YkLX4RNSyjz4vOCX3WlcIAOr6MJA8DT+F5mUCVEhnkeUbflXtxRSeTUTfOw/3MYLs+mc6hWwLq gqTMcIQhDrYEY5wUgb5Mj86NR/uvsThL6MtWCJWVbfxHxM575woyTdD9E6HGO6loHYdky/7I+XFZ twgxsGn6HJYT+Gwn9BI5/DiwT1Qb/AyADktN1jGmZGTlniS+hly7rm0EHb2CTTM5zT1fh/sCOtQb nYIUf2in2cIfcFvzeFrUbDk2HfJMp5FmY6tBEV5xyNCww/mBkW2nuZy9CvAheJEOGoO8lyonPU2u ARq345LdbS6l+VdivPmZoLNpIMRw9MSTYmzm08h7C+/6hxzpjw1/nWZ+W2k9VpLutEs7KMtsbZR4 WhVFVS1uhqxrnjoeBHznh360Ou8SR+PFO0HIrYz4W7ayfcBhqcsGrM9u1E892gjUVTbPv8UoXQ8S Zm9ra2jqbfZGbyOpMIlyMzHTak7r0IZvCedEUDCimitbw98AEQEAAcLBfAQYAQgAJhYhBM3ARtxd sfS96AaUcJ3p+vSexOJ/BQJcjjSNAhsMBQkSzAMAAAoJEJ3p+vSexOJ/C+wP/iGvKG1NldCT2gR7 oWhmvgBnsD7qjC57RX0Go7WD1lmrWP4xWpvM6Tj0V4ZsXnyB8zUR38p49PPymjwy51FAss5PYh8S bVC1/sKC5Sae3kiAoMGH29MBAwL1IkJ8PNw6uOJHhUIJgKT5RWk2f7q3+Tha19slXwD/FC1IcBJK baxyVkG3cG5AnNvvKZyFAUNZ9FiBycaNHO4o6bCcCzSsaRLL2azudJLrF8UYPfTNBQ6Cr4QLqaRb t+ZqL2nqmcadO1AtxLtq5lQjxbhJ3jSYIcQJRq0ztbIBcPrdR2B/dfVED9cU5leSmNXxrh09gJ7N tmUpVo5fBcbf6fP7h2HIFBpH+G/8UUlcbm9pQ5Jcb8FEom0JrfaIAuv1gEIJAk1mkqLNzWUs8KuL nCBBVT2+2hfEZjtjUYbCLVB4LRCsLs9CY1wS3yKca90S8m0tfKcSj3K3k8qlKodkE2raX2GW2dm9 b200ENbb41B1uZlPts4Yh/AMfLqoNv8wyw0GlUQ2DqgDqviLANYbg4/GHwTLwO2b9UMHuTVU3woS 1LRKt0iPPsd+ir+9YRAVt5LB5XTS5C5cdIW9JSXQ+0cnbr3LPZCBulOew/M72liBINKWKGoUyueF 73ckNO9S7pzTOCpjn3+gAuzN/itwgwrMLoqUqqBuxzd7cKNJHTFdTIfTm53f =KIMs -----END PGP PUBLIC KEY BLOCK-----