{"id":91081,"date":"2020-05-11T09:00:51","date_gmt":"2020-05-11T16:00:51","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/?p=91081"},"modified":"2023-05-26T14:18:39","modified_gmt":"2023-05-26T21:18:39","slug":"ciso-stress-busters-overcoming-obstacles","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/05\/11\/ciso-stress-busters-overcoming-obstacles\/","title":{"rendered":"CISO stress-busters: post #1 overcoming obstacles"},"content":{"rendered":"
As part of the launch of the U.S. space program\u2019s moon shot, President Kennedy famously said we do these things \u201cnot because they are easy, but because they are hard<\/em>.\u201d The same can be said for the people responsible for security at their organizations; it is not a job one takes because it is easy. But it is critically important to keep our digital lives and work safe. And for the CISOs and leaders of the world, it is a job that is more than worth the hardships.<\/p>\n Recent research from Nominet<\/a> paints a concerning picture of a few of those hardships. Forty-eight percent of CISO respondents indicated work stress had negatively impacted their mental health, this is almost double the number from last year\u2019s survey. Thirty-one percent reported job stress had negatively impacted their physical health and 40 percent have seen their job stress impacting their personal lives. Add a fairly rapid churn rate (26 months on average<\/a>) to all that stress and it\u2019s clear CISOs are managing a tremendous amount of stress every day. And when crises hit, from incident response after a breach to a suddenly remote workforce after COVID-19, that stress only shoots higher.<\/p>\n Which is why we\u2019re starting this new blog series called “CISO stress-busters.” In the words of CISOs from around the globe, we\u2019ll be sharing insights, guidance, and support from peers on the front lines of the cyber workforce. Kicking us off\u2014the main challenges that CISOs face and how they turn those obstacles into opportunity. The goal of the series is to be a bit of chicken (or chik\u2019n for those vegans out there) soup for the CISO’s soul.<\/p>\n Today\u2019s post features wisdom from three CISOs\/Security Leaders:<\/p>\n Ask five different CEOs what their CISOs do and after the high level \u201cmanage security\u201d answer you\u2019ll probably get five very different explanations. This is partly because CISO responsibility can vary widely from company to company. So, it\u2019s no surprise that many of the CISOs we interviewed touched on this point.<\/p>\n TM Ching summed it up this way, \u201cDemonstrating my role to the organization can be a challenge\u2014a role like mine may be perceived as symbolic\u201d<\/em> or that security is just here to \u201cslow things down<\/em>.\u201d For Jason, \u201cmaking sure that business leaders understand the difference between IT Operations, Cybersecurity, and InfoSec<\/em>\u201d can be difficult because execs \u201coften think all of those disciplines are the same thing<\/em>\u201d and that since IT Ops has the products and solutions, they own security. Jim also bumped up against confusion about the security role with multiple stakeholders pushing and pulling in different directions like \u201ca CIO who says \u2018here is your budget,\u2019 a CFO who says \u2018why are you so expensive?\u2019 and a general counsel who says \u2018we could be leaking information everywhere.'”<\/em><\/p>\n What works:<\/p>\n Fans of Boehm\u2019s curve<\/a> know that the earlier security can be introduced into a process, the less expensive it is to fix defects and flaws. But it\u2019s not always easy for CISOs to get security a seat at the table whether it\u2019s early in the ideation process for a new customer facing application or during financial negotiations to move critical workloads to the cloud. As TM put it, \u201cExerting influence to ensure that projects are secured at Day 0. This is possibly the hardest thing to do<\/em>.\u201d And because \u201csome business owners do not take negative news very well\u201d telling them their new app baby is \u201csecurity ugly\u201d the day before launch can be a gruesome task. And as Jason pointed out, \u201cit’s one thing to talk hypothetically about things like configuration management and change management and here are the things that you need to do to meet those controls so you can keep your contract. It’s a different thing to get that embedded in operations so that IT and HR all the way through finance are following the rules for change management and configuration management.\u201d<\/em><\/p>\n What Works:<\/p>\n Wouldn\u2019t it be wonderful if every company had a security mindset and understood the benefits of having a mature, well-funded security and risk management program? If every employee understood what a phish looks like and why they should report it? Unfortunately, most companies aren\u2019t laser focused on security, leaving that education work up to the CISO and their team. And having those conversations with stakeholders that sometimes have conflicting agendas requires technical depth and robust communication skills. That\u2019s not easy. As Jim points out, \u201cit\u2019s a daunting scope of topics to be proficient in at all levels.<\/em>\u201d<\/p>\n What works:<\/p>\n Did you find these insights helpful? What would you tell your fellow CISOs about overcoming obstacles? What works for you? Please reach out to me on LinkedIn<\/a> and let me know what you thought of this article and if you\u2019re interested in being interviewed for one of our upcoming posts.<\/p>\n","protected":false},"excerpt":{"rendered":" CISO guidance and support from around the world.<\/p>\n","protected":false},"author":96,"featured_media":91084,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"ep_exclude_from_search":false,"_classifai_error":"","footnotes":""},"content-type":[3659],"topic":[3683],"products":[],"threat-intelligence":[],"tags":[3822,3809],"coauthors":[1916],"class_list":["post-91081","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","content-type-best-practices","topic-security-management","tag-microsoft-security-insights","tag-security-strategies"],"yoast_head":"\n\n
Clarifying contribution<\/h3>\n
\n
Exerting influence<\/h3>\n
\n
Cultivating culture<\/h3>\n
\n