Focusing ONLY on tactical firefighting is a major mistake, even in a global pandemic
The last twelve month have changed things considerably for the CISO. Cyber security has been centre-stage, and even more now after the SolarWinds and Colonial hacks. Still, this could be a blessing or a curse.
The pandemic keeps evolving on a global scale, and while some countries may be reaching the end of the tunnel, others are still in the midst of the most dramatic phases.
Global business is still significantly impacted, and there is no sign of a “new normal” in sight for many industries.
Still, people are changing jobs, and CISOs in particular, as many firms wake up to the need to ramp up cyber security measures in the face of the accelerated digitization of their business or their large-scale move to remote working.
But, in the face of the new situation created by the pandemic, the approach we highlighted back in 2018 around the “First 100 Days of the CISO” needs adjusting.
It still makes sense for any incoming executive to approach their first period in a new job in a structured way, to meet with business stakeholders and listen to their expectations first in relation to the role, then to build a strategic framework addressing those, and then an execution framework to deliver it.
But two aspects have changed fundamentally:
While stakeholders are more likely to recognise cyber security as an important agenda item, they are still likely to be focused on short-term objectives, either in terms of crisis response or in terms of bounce-back strategy. They may not be receptive to long-term views; as a matter of fact, they may not have any form of long-term visibility for the moment, as the global pandemic continues to unfold world-wide.
That’s the second main issue: 100 days is probably an irrelevant timeframe here, irrespective of how you frame it (back in 2018, we articulated it into 6 days, 6 weeks and 6 months encompassing around 100 business days). Nobody can be sure how the world will be like in 100 days, let alone in 6 months.
So how should an incoming CISO approach their new role?
Meeting with key stakeholders and team members as soon as realistically possible, and listening to their objectives, concerns and priorities, is still key as a starting point.
Back in 2018, we strongly advocated in favour of travelling and meeting face to face – where required – to develop a stronger personal bond: This is not likely to be possible for the short-term, so most of those discussions will have to take place remotely. Let’s face it: This is a problem, and the absence of direct personal interaction could distort the perception the new CISO develops of the firm and its culture – for good or for bad. The most important for the CISO at this stage is to remain aware of that. But establishing direct communication channels with the business – as solid as they can be at the moment – is more essential than ever.
Second, it is likely – as we have already highlighted – that a short-termist agenda will emerge from those discussions. The temptation will be extremely high for the CISO to focus only on alleged low-hanging fruits and on firefighting, at least until the worst of the crisis is over. To be honest, this is the way many CISOs have traditionally approached their first 100 days anyway, so more than a “temptation”, it will be a line of least resistance – or even a well-trodden path – for some.
As a matter of fact, we highlighted back in 2018 that it was a dangerous path to follow and a “curse”, unlikely to lead to the development of truly transformational dynamics around cyber security: That is still the case, but, realistically, it will be a trend difficult to oppose for the new CISO.
In fact, this is the very element that makes the new first 100 days of the CISO far more complex than ever before.
It is no longer just a matter of balancing tactical and strategic objectives while validating strategy and execution frameworks; it could be about doing this in absence of clear strategic visibility from the business, as the path out of the COVID crisis emerges, and in a context where those directions may evolve or change, depending on the turns the crisis may still take.
The new CISO must talk constantly with business stakeholders, to understand how this context is moving, and build their own cyber security strategic options – possibly scenario-based, and ready to be embedded into the post-crisis business strategy as it aggregates. And all this in parallel to short-term tactical work to keep the lights on.
Make no mistakes: This is now becoming a matter of survival for the CISO role at any form of senior leadership level.
“Constant firefighting downgrades the role and the CISO must fight to avoid its gravitational pull” we wrote back in 2018.
Focus ONLY on low hanging fruits and alleged quick wins, fail to leverage on the opportunities presented by the pandemic to cement cyber security as a true dimension of business strategy, and the new CISO could find their role relegated forever to middle-management layers, alongside other technical operational matters.
אני מאוד ממליץ על אתר ישראל נייט קלאב אתר מספר אחד בישראל לחיפוש נערות ליווי, דירות דיסקרטיות,עיסוי אירוטי
כנסו עכשיו ותראו לבד כמה מידע יש באתר הזה: נערות ליווי בחיפה
I’ve recently started a web site, the info you provide on this site has helped me greatly. Thank you for all of your time & work. “Patriotism is often an arbitrary veneration of real estate above principles.” by George Jean Nathan.
Good – I should certainly pronounce, impressed with your site. I had no trouble navigating through all tabs as well as related information ended up being truly easy to do to access. I recently found what I hoped for before you know it in the least. Reasonably unusual. Is likely to appreciate it for those who add forums or something, site theme . a tones way for your client to communicate. Nice task..
I always was concerned in this subject and stock still am, regards for posting.
Thanks for sharing excellent informations. Your site is so cool. I am impressed by the details that you have on this blog. It reveals how nicely you understand this subject. Bookmarked this website page, will come back for more articles. You, my friend, ROCK! I found simply the information I already searched everywhere and simply could not come across. What an ideal website.
Its like you read my mind! You appear to know a lot about this, like you wrote the book in it or something. I think that you can do with a few pics to drive the message home a little bit, but instead of that, this is fantastic blog. An excellent read. I will certainly be back.
Hmm it looks like your site ate my first comment (it was super long) so I guess I’ll just sum it up what I submitted and say, I’m thoroughly enjoying your blog. I too am an aspiring blog blogger but I’m still new to everything. Do you have any tips for inexperienced blog writers? I’d genuinely appreciate it.
This really answered my problem, thank you!
I have recently started a blog, the information you provide on this website has helped me tremendously. Thank you for all of your time & work.
An impressive share, I simply given this onto a colleague who was doing somewhat analysis on this. And he the truth is bought me breakfast because I discovered it for him.. smile. So let me reword that: Thnx for the deal with! However yeah Thnkx for spending the time to debate this, I really feel strongly about it and love studying extra on this topic. If doable, as you turn out to be expertise, would you mind updating your blog with extra details? It is extremely helpful for me. Huge thumb up for this weblog post!
I was reading some of your posts on this website and I conceive this website is real instructive! Keep putting up.
Thanks for another wonderful article. The place else may anybody get that type of information in such an ideal approach of writing? I have a presentation next week, and I’m on the look for such information.
My developer is trying to persuade me to move to .net from PHP. I have always disliked the idea because of the expenses. But he’s tryiong none the less. I’ve been using WordPress on a variety of websites for about a year and am worried about switching to another platform. I have heard very good things about blogengine.net. Is there a way I can transfer all my wordpress posts into it? Any kind of help would be really appreciated!
We are a group of volunteers and opening a new scheme in our community. Your website offered us with valuable information to work on. You’ve done a formidable job and our whole community will be thankful to you.
There is noticeably a bundle to identify about this. I feel you made some nice points in features also.