Top 10 Dos and Don'ts of Successful Chief Information Security Officers

The topic for today is the 6 skills every successful CISO must have, and 4 mistakes to avoid.

Here are the 6 skills to master in order to be a successful CISO:
1 Communication and presentation skills
2 Understanding office politics
3 Understand the business and have an understanding of finances
4 Strategic planning
5 Be willing to ask for help. Know your swim lane, and ask for help when outside it
6 Risk-based thinking. Let data, not emotions, drive decisions

The 4 mistakes to avoid.
1 Don’t be focused on incident response. Have a person report to you.
2 You only don't need to know more than the basics of legal/compliance
3 You’re not a penetration-tester.
4 You don’t need to know more than the basics of program management

Using your time wisely is important if you want to be a good CISO. Therefore, it’s important to use that time to learn the skills you need, and not waste time learning skills that won’t make a difference. If you are a person who is driven, you want to do everything. But a CISO doesn’t do everything. A CISO is a strategic, not a tactical position. Therefore, many things will be delegated and you will partner with specialists to stay in that strategic lane.

🔑 [FREE MASTERCLASS]
Discover How You Can Advance Your Career Through Cybersecurity

Show Notes:
0:04 Intro: What is The Life of a Ciso Show?
0:35 Today’s advice - Security is a business enabler
1:30 The golden rule of security - If security hinders the business, then security is wrong
2:37 Eric’s two rules
2:46 Rule 1: If anybody comes to you with a new idea, you don’t shoot it down
3:10 Rule 2: If you get put on a project, do anything possible to make the project successful
4:00 Eric’s meeting with a CEO of the company
5:15 Eric tells the CEO his two rules, and why they were successful in practice
6:55 What are the skills that CISOs need?
7:23 CISOs try to do too much and be the hero
7:40 CISOs get too technical and not strategic
8:03 The do’s and don’ts of being a successful CISO
8:29 1: communication and presentation skills
9:27 Adapt your communication style to your audience
9:34 To communicate with end users, make it personal.
9:58 Security engineers want to do their job more effectively
10:20 Executives want to understand key strategic questions to ask to minimize breaches.
11:05 Communication means listening more than you speak
14:08 The cell phone test
15:49 Know how to run a meeting
17:43 Skill 2: Outside the box thinking.
19:25 Big budgets do not necessarily mean better results
20:36 Skill 3: Understand the business and have an understanding of finances.
22:40 Skill 4: Strategic planning

About Dr Eric Cole
Eric Cole, PhD, is an industry-recognized security expert with over 20 years of hands-on experience in consulting, training, and public speaking. As the founder and CEO of Secure Anchor Consulting, Dr. Cole focuses on helping customers prevent security breaches, detect network intrusions, and respond to advanced threats. In addition, he is a sought-after expert witness and a 2014 inductee to the InfoSecurity Hall of Fame.

Follow me:

#LifeOfaCISO #CISO

[MrTimeWarps]

Thank you for the information! Now, I am not a CISO, but I took notes and I will probably use 80% of what's been presented.

I'll get back to you when I will no longer be the guy from 28:25 when supporting projects.

[hclvii]

Great topics. Currently preparing for CISO interview. This info is spot on to operate at the executive level.

[carlosrodriguez]

Spot on the six items to do. Our role is to Connect, Integrate, Serve and be Organizational savvy. That is what CISO means to me anyway (will be writing about each of those soon).
I had not seen the top 4 don't the way you present them here. However, I must say that over the last year I have intentionally started to separate from those roles, specially incident response. I have fortune to work for an organization where we have Compliance Champions Network that leads compliance matter. I am just a member of the network who is the appointed Champion for the division but they are the ones who are the expert on Laws, Rules and Regulations that we have to comply with or even just monitor for awareness.
The longer I am in this leadership role, the more intentional I am about not be the technical SME. In order to get there I have had to build strong teams (here and in past organizations) that are those SMEs and that I help grow and most important, I let them do their job and get out of the way while supporting them by providing vision and removing blockers where they exist through that political capital that I have been able to build through relationship building and management.
I enjoyed this episode and will be watching the others you have posted. Keep up the good work!

[brandonaylesworth]

I've heard to do whatever it takes so security is seen as making projects successful, config a router, etc, however you've also said we need to let go of being tecks and let the techs be techs...what's the middle ground?