Being a CISO isn’t easy.
Whether you’re a long-time CISO, a first-time CISO, you aspire to be a CISO someday, or you work with or hire a CISO, How to CISO is your canonical reference library. Collecting and synthesizing wisdom across the CISO community, we aim to provide clear, actionable guides for CISOs as all levels. From strategic topics like structuring your organization, implementing security, and reporting to the board to tactical topics like zero trust, AI, and identity, you can make How to CISO your quick reference.
The Library collects the major works (long-form Volumes, short-form Handbooks, and Talks) of How to CISO; Concepts lets you look at content based on topic. Opinions are the interesting opeds written by the How To CISO crew, and Podcast? Well, find interesting podcasts there until the How To CISO podcast launches!
-
How to CISO Volume 0: The Idealized CISO Job Description
Many companies are not in dire need of a CISO right now, but need to define a role for their future CISO, often including a plan to develop the incumbent security executive into a credible CISO. This guide provides a profile of the idealized CISO. Why idealized, and not ideal? Because a CISO is often…
-
How to CISO Volume 1: The First 91 Days
Ninety days is generally the grace period (or “honeymoon,” if you’d like) that a new executive has to get acclimated to a new environment. At the end of this time window, your employer is going to expect you to be executing on a plan, anyone you need to meet will expect you to have already…
-
How to CISO Volume 2: Risk
As a CISO, you’re often going to be asked to measure risk. You might think you’re in the job of mitigating risk. You might think of it as managing risk. These phrases have a lot of different meanings, depending on who is speaking, so you’re going to have to listen carefully to the speaker to…
-
Handbook: Applying Zero Trust Principles in a Cloud-Centric World
Zero Trust … but to Which Cloud? In the cloud-centric world enterprises increasingly operate in, there are different interesting environments that zero trust principles should be applied to. One of them we’ve somewhat talked about the evolution of the enterprise IT network. That network is becoming more and more obsolete, slowly being replaced with different…
-
Handbook: Environments
One challenge of being a CISO is understanding scope: when a colleague tells you a truth (hypothetically “We patch our systems regularly”), in what environment is that true? Maybe they’re just referring to the core Windows Domain servers, or possibly to desktops, but it’s easy for executives, including CISOs, to hear that as “we do…
-
Handbook: Zero Trust Principles
In the 2010s, the cybersecurity community was introduced to the concept of zero trust, the idea that implicitly trusting remote systems might be a … bad idea. John Kindervagt coined the term while at Forrester Research, although practical applications were developed in parallel elsewhere. In response to the breaches from Operation Aurora, Google implemented its…