What does it take to be a Security Manager? In this article, based on my last 10-year experience as CISO at an energy utility company, I will share my reflection on what are the keystones that can make you dare to succeed in managing a cyber security area in an organization. I always found myself in the middle of an axis strained by opposite forces, that I always tried to balance based on trust and a top-quality team. Let’s explore the tension axis.
Time We all know that the world changes in an increasing pace and new technologies appear every day, causing impact on existing business models. It’s fundamental for organizations to react in the face of a constantly changing environment, adapting their technologies and services. However, the speed, mostly known as time-to-market, could be a threat to cyber risk, because new scenarios might need a more careful risk analysis which, sometimes, cannot be done as timely as the business expects. So, to succeed within the organization, is essential to industrialize some security activities but, most importantly, you need to establish a high level of trust and communication with business units to justify the time needed for risk analysis. Cost Security has a cost! We know that it’s cheaper to do it built-in earlier stages than as an add-on, but it has a cost nevertheless. Acquiring or developing a product or a service with security built-in is more expensive than to have no security at all. Business will always push for low cost to increase margins, in a strong and global competitive environment, while risk control is pushing to the other side. Security managers need to cope with this strain, assuring that the organization understands the need for this cost and that it is needed to fulfill the service promise that we deliver to our customers. Again, trust is key, because for business to accept cost increase, they must rely on the security team correctly balancing it with risk control.You must have a strong trust from your organization’s top management.
The pursue for trust I could drill down some practices for each this axis, but, for this article, I want to remark that in all these scenarios we find trust as the common strong word. I’m sure that some might say that trust is needed for everything, but that’s not the point and is the same for other attributes. What I’m saying is that every team has their essence and trust should be the DNA for a Security Team. You need to foster trust in the business services, because trust is something that costumers are keener to ensure; you must have the trust of top management that you are correctly assessing the complexity of the cyber risks in the organization; you must have the trust of the business units for them to understand the reasonability of security requirements; you must have the trust from your team, that their competence is being correctly communicated and applied with purpose and, finally, you also need to create trust in society, especially if you manage critical infrastructures that affect everyone’s lives.
To achieve such level of trust is fundamental to be aligned with business objectives. Any executive MBA will tell you that marketing, sales or operations must be aligned with business strategy and objectives. Why should it be different with security?
