news

THE STRATEGIC ROLE OF THE CISO

I recently had the honor to participate at the Open Lesson of the Executive Master in Cybersecurity and Data Protection organized by 24ORE Business School, where we discussed about the role of the Chief Information Security Officer (CISO).

In a scenario where cyber attacks and cyber threats are constantly lurking, it is imperative that companies are prepared to manage and mitigate these risks in accordance with budget needs and business objectives.

The role of the CISO fits into this context since is responsible for setting and managing the corporate Cyber Security posture.

CISO’s tasks include the definition of long and short-term strategies, best practices, the verification and implementation of processes to mitigate the risks of cyber space, the spread of the cyber security culture in the company.

The role of the CISO is as strategic as it is still not very widespread and is only now starting to get the attention it deserves.

However, it is very important that it respects some characteristics:

THE CISO IS NOT A TECHNICIAN

Although often confused with a technical figure, the CISO cannot limit itself only to this aspect.

While understanding the dynamics and complexity of the cyber world, this role must in fact be played mainly by a manager, able to understand company needs and communicate with management at the same level.

A sort of hybrid figure able to connect and understand both worlds, the technical one and the business one, to find the most suitable solutions to guarantee the protection and availability of data and corporate assets.

THE CISO MUST REPORT TO THE BOARD

For this role to be effective, however, its placement in the organization chart must be correct.

In fact, when present, the CISO is often employed by other C-level figures such as the CIO (Chief Information Officer) or the CTO (Chief Technology Officer).

This depends on the fact that Cyber Security is still seen as a sub-set of the IT world, but it should be emphasized that this conception is wrong and limiting.

In fact, the purpose of Cyber Security cannot be limited only to the protection of computer data, but is rather to protect all important assets for companies, institutions and citizens.

In the case of networked medical devices and electric cars, for example, these assets also include human lives.

It is therefore important to evaluate Cyber Security as a subject in itself and to ensure that the CISO can report directly to the company Board to maintain the autonomy and decision-making power it needs to operate.

THE CISO MAY BE AVAILABLE IN “AS A SERVICE” MODE

The figure of the CISO would be useful in any company.

It is easier to find this role in large companies, but in small and medium-sized companies things get complicated.

Often SMEs do not have enough funds to hire a CISO and in these cases it would be useful to be able to use a “CISO As a Service” service, being able to “rent” this professionalism as needed, optimizing costs and thus making the function accessible. even to smaller companies.

Although this service would make it possible to spread the figure of the CISO even for companies that cannot afford it, on the other hand, since it is a figure outside the company, there could be a lot of resistance to placing it correctly in the organization chart, going to interfere with correct operation. of this role.

Ultimately, CISO must devise and manage Cyber Security strategies in compliance with the corporate budget, in order to spend it effectively and efficiently.

In a scenario where resources tend to be scarce in the face of ever-increasing threats, it is in fact a priority to correctly manage budgets in order not to obtain greater damage.

Knowing the threats for the specific sector and risk model of the company is certainly an excellent tool in this sense, which allows you to target strategies and defenses more precisely. The scenario of cyber threats changes continuously and very rapidly, so it is very important to obtain timely and detailed information about it.

Hackmanac can be useful for this purpose, ask us how!

Latest news

HACKS OF TODAY 25/04/2024

Today's HOT includes 8 ransomware victims by the notorious RansomHub, Hunters International, Black Suit, Qiulong, DarkVault, RansomHouse, Qilin and MyData gangs. The average Cyber Risk Factor is 4.0....

HACKS OF TODAY 24/04/2024

Today's HOT includes 10 ransomware victims by the notorious RansomHouse, Black Suit, Rhysida, BianLian, RansomHub, BlackBasta, Eraleig and Qiulong gangs. The average Cyber Risk Factor is 4.4. Read...

HACKS OF TODAY 23/04/2024

Today's HOT includes 12 ransomware victims by the notorious Medusa, Abyss, RansomHouse, Cactus, RansomHub, BianLian, Qilin and Qiulong gangs. The average Cyber Risk Factor is 4.5. Read below...

THE CYBER SECURITY MOST REQUIRED JOBS

The current scenario of Cyber Security is certainly worrying: cyber threats are constantly lurking and risks rise, also because of the constant spread of digital and IT devices.

While the potential attack surface we expose to cyber criminals increases, the Cyber Security jobs are becoming increasingly strategic.

In 2021, there are 3.5 million job vacancies globally in Cyber Security, a sector that grew by 350% from 2013 to 2021.

The unemployment rate in Cyber Security has been 0% since 2011.

Interesting premises, therefore.

But what are the most interesting jobs in this sector?

I selected five.

1) Ethical Hacker

The ethical hacker performs advanced penetration tests on a company’s computer systems to check if there are any weaknesses or breaches already in place.

The intervention of the ethical hacker is essential to prevent and mitigate all system vulnerabilities that could be exploited to violate or damage the company.

It is a role that allows you to fully understand how systems work and how criminals think.

2) Digital Forensics Analyst

The digital forensic analyst works closely with law enforcement to investigate cybercrime.

The forensic analyst is in fact able to collect evidence on digital devices (computer, smartphone, cloud), in order to determine what really happened.

Ideal if you have an investigative mindset, the chances of learning never end as technologies continually evolve.

3) Malware Analyst

The malware analyst studies malicious software in depth to understand the nature of the threat, its behaviour and purpose.

This function is very important because it allows a quick and effective response to contain an ongoing cyber attack or to understand what happened, in case of attacks that have already occurred, and prevent the problem from recurring.

The role of the malware analyst offers a great opportunity to hone your investigative skills by confronting cybercriminals who instead try to obfuscate their software threats as much as possible.

4) Cyber Security Manager

The Cyber Security Manager manages security systems and solutions projects that protect the resources and data of an organization.

Coordinating with other Cyber Security specialists, he verifies each phase of the project and ensures that the objectives are achieved on time and within budget as well as quality standards.

It is the perfect role to test your organizational and management skills, as well as your understanding of the dynamics of Cyber Security.

5) Chief Information Security Officer (CISO)

The CISO supervises and is responsible for the entire security strategy of an organization, effectively acting as a link between the technical department and the company’s managers.

This role requires excellent leadership qualities and a thorough understanding of an organization’s cyber security as well as business dynamics.

It is a senior position of great responsibility, which usually reports directly to the CEO of the company.

Therefore, not only technical roles, but also functions where organizational and management skills are important.

What are the main skills for Cyber Security then?

Technical skills (hard skills) first of all: the in-depth knowledge of the various operating systems and main applications, of computer networks, of programming languages (in particular scripting).

Based on the chosen area, specific skills will also be needed, from incident response to compliance.

But soft skills also have their relevance: organizational and managerial skills, analytical and deductive intellectual abilities, lateral thinking, problem solving attitude, attention to the details, team work predisposition, communication skills.

So how do you become an expert in Cyber Security?

If for the technical roles university is not ready to entirely prepare for all the Cyber Security roles, although it is rapidly catching up with vertical paths.

For non-technical roles, a degree in computer science or business management may be useful, as well as a master’s or professional certification in project management.

In general, certifications and specific courses can broaden skills and increase the chances of success.

But, above all, it is useful to acquire a lot of practice in the field and continuously update.

Good job!