How to CISO

Opinions

Every so often, we here at How to CISO choose to weigh in on an important topic in cybersecurity. Select pieces are included below.

  • Zero Trust in Administration

    Zero Trust in Administration

    CrowdStrike, Windows domain administration, SolarWinds — our implicit trust in admin software is a recipe for repeated disasters. The most unsafe part of our technology ecosystem isn’t the number of unpatched systems we have. Nor is it shadow IT, whether it’s… (read more)

  • The Death of the CIO

    The Death of the CIO

    CISOs grew up in the CIO’s blindspot. As cloud and SaaS bring IT and security back together, which will survive their impending deathmatch? A half-century ago, most corporations were paper-native: Their business processes all executed on paper from both back… (read more)

  • Why assessing third parties for security risk is still an unsolved problem

    Why assessing third parties for security risk is still an unsolved problem

    A recent ranking of the most cyber-secure companies reveals weaknesses in current third-party risk management practices. A Forbes article is making the rounds right now about America’s most cyber-secure companies, and I can already see the cybersecurity outrage machine up in arms.… (read more)

  • We don’t need another infosec hero

    We don’t need another infosec hero

    By setting yourself up as the defender, the solver of problems, you cast your business colleagues as hapless victims or, worse, threats. This is not a useful construct for engagement. There’s this belief among a lot of security professionals that… (read more)

  • The cloud security emperor has no pants

    The cloud security emperor has no pants

    “Shared responsibility” usually means that no one is responsible for minding the gap. Don’t fall in. As anyone who has worked on a cross-functional team with no clear owner knows, “shared” or “joint” responsibility often means that everyone assumes that… (read more)

  • CISOs are still chiefs in name only

    CISOs are still chiefs in name only

    If you’re not in the meeting where decisions are made, then you’re not part of the C-Suite—whatever your title may be. Look around the CISO community, and you’ll find signs of burnout everywhere.   Where CISOs aren’t just quitting, you’ll find increasing tension… (read more)

  • Vulnerabilities don’t count

    Vulnerabilities don’t count

    No one outside the IT department cares about your vulnerability metrics (or they shouldn’t, anyway). They care about efficacy. And traditional stats don’t show that. I had a lovely chat with one of my favorite CISOs the other day, helping… (read more)

  • Drop the SBOM

    Drop the SBOM

    Software bills of material are having a moment, but the costs of an externally visible SBOM are likely to outweigh the benefits, says Andy Ellis. There’s a big movement afoot to move to an SBOM-oriented world.  If you’re new to… (read more)