CISOs Can Report to CIOs and Be Successful

When the CISO reports to the CIO what does a good relationship look like? How does a CISO succeed when there is a perceived inherent friction or “conflict of interest” between the two roles? Perhaps most importantly, who owns cyber risk and the budget needed to manage the program? These questions and more will be answered by our guests Becky Vasquez (CIO) and David Mashburn (CISO) and who will share how they’ve made this reporting dynamic work.

Host: Jerich Beason | @blanketsec
Guests: Becky Vasquez, CIO & David Mashburn, CISO: Embry-Riddle Aeronautical University

Becky Vasquez
Becky L. Vasquez is the Vice President and Chief Information Officer for Embry-Riddle Aeronautical University. Becky has been with the university for over 20 years in various technology leadership positions, including the role of Chief Technology Officer for the Worldwide Campus. She is responsible for the overall technology vision, mission and strategy for the university and provides thought leadership for the technology strategic plan, cloud strategy, and IT risk management plan. A service-oriented technologist, Becky is a champion for an effortless technical environment. She holds a GIAC Information Security Fundamentals certification and is an advocate for information security best practices and raising cybersecurity awareness among the university community. A two-time CIO 100 award winner, Becky is a member of educational software corporation advisory boards and regularly participates in industry wide activities supporting the advancement of technology in education.

David Mashburn is CISO at Embry-Riddle Aeronautical University, a SANS Certified Instructor, and co-author of SEC587: Advanced Open-Source Intelligence (OSINT) Gathering and Analysis. He has experience working as an IT security professional for several civilian federal agencies, and over 20 years of experience in IT. He holds a master's degree in computer science from John Hopkins University, and a bachelor’s degree from the University of Maryland at College Park. David holds multiple security-related certifications, including GIAC GSE (#157), GOSI, GNFA, GMON, GCFA, GCDA, GWAPT, GXPN, GCIA (Gold), GPEN, GCIH, and GSEC. He is also a member of the SANS / GIAC Advisory Board, and has previously taught courses in the Cybersecurity curriculum at the University of Maryland - University College.

#CyberSecurity #StoryTelling #cybersecurityleadership #cyberrisk


Connect with us on social:
LinkedIn - SANS Security Leadership
Twitter - @secleadership
YouTube - SANS Institute - Cybersecurity Leadership playlist

[DrGRC]

I enjoyed the discussion. I am not a fan of the CISO reporting to the CIO (it should be the other way around), while recognising that unfortunately that a large number of companies have this structure. The mitigation is the working dotted reporting line although this only works with the right people in the ExCo. Be that as it may, it was nice to hear how this particular company has made it work at this point in time.