What is a CISO and What is Not a CISO
On this episode of The Life of a CISO, Dr. Eric Cole highlights some examples of the strategic thinking that it takes to be a good CISO.
Cyber security is all about evolving. The adversary is always coming up with new ways to beat an existing security system, so it’s advisable to always be one step ahead of them, not have them one step ahead of you.
Dr. Eric Cole gives two strategic suggestions to deal with the threat of encrypted attacks. One, before deploying any type of new tech, find out whether or not it can scan and detect attacks that are encrypted. Two, have areas in your network that are encryption-free. Any malware file that is encrypted will be immediately detected if you follow these suggestions.
If you want to be a successful CISO, you have to think like a hacker. You have to be strategic, not tactical. If you follow the advice on this episode of The Life of a CISO, you will have an edge over the adversary.
In this episode:
- 1:11 Question of the day: What is a CISO and what is not a CISO?
- 2:12 A CISO doesn’t “take the field”
- 4:48 Some people don’t have the right wiring to be a CISO
- 5:31 The CISO is not “The striker” who goes wherever the ball is
- 7:58 You can be successful being strategic or technical, but you have to decide your passion
- 8:41 If you want to be a successful CISO, you cannot do both
- 9:52 On pentesting
- 11:21 Cyber security is all about evolving
- 12:48 Is this like a honeypot?
- 13:48 The real value of decoys is early detection
- 15:39 What does that mean for a pentester?
- 18:15 The role of a CISO is to understand problems and put together strategies to fix them
- 18:56 If we look at most organizations, what is the biggest risk?
- 20:02 The number one problem is timely detection
- 20:43 Why don’t organizations detect problems in a timely manner?
- 23:15 Some have proposed decrypt outbound data. Here’s why that’s a bad idea.
- 24:39 Strategy tip 1: Ask, can new tech detect encrypted attacks?
- 26:08 Strategy tip 2: Crypto-free zones
- 29:28 How the CISO implements these ideas
- 30:15 Reminder: You can be strategic or tactical, but you can’t do both
