4 ms·

>The first CISO comes home, complains about what they have seen at the company and is worried nothing will get done, calls the CEO and complains about everythin

>The first CISO comes home, complains about what they have seen at the company and is worried nothing will get done, calls the CEO and complains about everything they saw and how much of a mess it was. They get fired on the spot. >The third CISO comes home, calls her boss, the CEO, and tells her there is a lot of work to be done and to be prepared, but that it’s an excellent opportunity to get it right. The CEO backs them up. Don't forget to be honest. I know there's this cult of positivity crap floating around, but the best CISO in this scenario calls the CEO, gives them the honest grim assessment of the current situation, says what can be done to fix it, and is eager to get to work.

IncRnd 5y ago
> Don't forget to be honest. I know there's this cult of positivity crap floating around, but the best CISO in this scenario calls the CEO, gives them the honest grim assessment of the current situation, says what can be done to fix it, and is eager to get to work. The job of a CISO is not to convey problems to the CEO but to solve problems. The first CISO didn't understand their role.
- freedomben 5y ago
  No not really. The CEO has to balance between the "fix nothing" CTO and "fix everything" CISO. I'm exaggerating a bit of course, in reality it's a blend, but in general the CTO and CISO often have opposite/incompatible goals. The CTO wants to ship fast and ship often, which the CISO doesn't want to ship until everything is done. The CEO ultimately needs to decide where to put the line, and a good CISO will execute under that and escalate when needed.
stonemetal12 5y ago
I don't see it as "cult of positivity crap". >honest grim assessment of the current situation, says what can be done to fix it, and is eager to get to work. Complaining is 1 without 2 and 3. It isn't complaining as long as 2 and 3 are there.
- dylan604 5y ago
  You can have 1 & 3. The fix isn't always immediately known, but doesn't mean that its concern doesn't need to be raised.
  - PradeetPatel 5y ago
    The key difference between 1 & 3 is how the concern was framed. For former sees it as a problem and issue with no immediate solutions, whereas the latter sees it as a unique opportunity for improvement. Most CEOs embrace the "growth mindset" and would invest in individuals that possess that quality.
  - stonemetal12 5y ago
    You might not have a full plan but you would have something. Even if it is just "my top people are on it, and full plan expected by ...".
ironmagma 5y ago
The thrust of the book I've been reading, "Why CISOs Fail," is that being grim is probably the main mistake CISOs make. It's their job to find opportunities that fit within the company's existing priorities to improve the security posture, not to be delivering bad news in huge doses all the time. Besides, the CISO is there not to do the work but to be a partner at the table.
deleted 5y ago
[deleted]

IncRnd 5y ago

> Don't forget to be honest. I know there's this cult of positivity crap floating around, but the best CISO in this scenario calls the CEO, gives them the honest grim assessment of the current situation, says what can be done to fix it, and is eager to get to work. The job of a CISO is not to convey problems to the CEO but to solve problems. The first CISO didn't understand their role.

freedomben 5y ago
No not really. The CEO has to balance between the "fix nothing" CTO and "fix everything" CISO. I'm exaggerating a bit of course, in reality it's a blend, but in general the CTO and CISO often have opposite/incompatible goals. The CTO wants to ship fast and ship often, which the CISO doesn't want to ship until everything is done. The CEO ultimately needs to decide where to put the line, and a good CISO will execute under that and escalate when needed.

stonemetal12 5y ago

I don't see it as "cult of positivity crap". >honest grim assessment of the current situation, says what can be done to fix it, and is eager to get to work. Complaining is 1 without 2 and 3. It isn't complaining as long as 2 and 3 are there.

dylan604 5y ago
You can have 1 & 3. The fix isn't always immediately known, but doesn't mean that its concern doesn't need to be raised.
- PradeetPatel 5y ago
  The key difference between 1 & 3 is how the concern was framed. For former sees it as a problem and issue with no immediate solutions, whereas the latter sees it as a unique opportunity for improvement. Most CEOs embrace the "growth mindset" and would invest in individuals that possess that quality.
- stonemetal12 5y ago
  You might not have a full plan but you would have something. Even if it is just "my top people are on it, and full plan expected by ...".

ironmagma 5y ago

The thrust of the book I've been reading, "Why CISOs Fail," is that being grim is probably the main mistake CISOs make. It's their job to find opportunities that fit within the company's existing priorities to improve the security posture, not to be delivering bad news in huge doses all the time. Besides, the CISO is there not to do the work but to be a partner at the table.

deleted 5y ago

[deleted]