Posts

  • Building A Security Budget To Address Risk

    Building A Security Budget To Address Risk

    Over the past 9 months layoffs have been impacting the tech industry amid heightened concern over the economy, increased scrutiny on profits and over investment by companies in areas that don’t positively impact the bottom line. As organizations tighten their belts it is possible they will look at the security organization with increased scrutiny and Read more

  • How Will The CSO Role Change Post Uber?

    I had a really interesting discussion with some CISO friends last week about how the CSO/CISO role will change after the guilty verdict of Uber CISO Joe Sullivan (I’ll refer to this as the Uber verdict going forward). Here are my personal thoughts: The Scope of Liability Has Changed The Uber verdict has now set Read more

  • Legal Privilege

    Disclaimer First I want to start out by saying I am not a lawyer and I don’t play one on TV. This blog post is a summation of legal advice I have been given over the course of my career as a CSO/CISO. These are my opinions and should not be considered legal advice. If Read more

  • Giving A Presentation To The Board

    At some point in your CSO / CISO career you will need to give an update to the board. This could be monthly, quarterly or yearly depending on the size of your company. Wondering where to start? Here is a template I have found to be successful. Practice Makes Perfect If you are new to Read more

  • Cultural Change Agent – Part 2 What Does Work?

    In Part 1 of this post I discussed how security teams are often challenged to change behavior and ultimately culture. This is an exceptionally difficult problem and I covered a few things that don’t work when trying to effect change. In this post I’ll discuss my observations for what does work when trying to change Read more

  • Cultural Change Agent – Part 1 What Doesn't Work?

    When you are hired for a security leadership at a company you are being hired because the company has a need for your experience. The company may need help with reducing risk to a new business area, successfully passing a new compliance audit, implementing a new security capability or simply growing the team to match Read more