Chapter 25
Cyber Competencies and the Cybersecurity Officer
Ron Hale, PhD, CISM, ISACA, USA
Tom and his team have journeyed through the discovery of the benefits and risks of the digital organization and have come to an understanding of how the organization will need to move forward in implementing an innovative and enabling cybersecurity program. This program needs to be organization focused and responsive to the changing threat landscape. To implement such an organization-wide program Tom needs someone with the right skills and attributes. The role of the CISO is not only one that requires a strong command of security technology. It is even more critical that the CISO be an organization contributor and organizational leader as well.
The Evolving Information Security Professional
As the need to protect information from compromise and misuse, and the capabilities of hackers have changed over the years, so too has the role and responsibility of information security professionals. The role that is perhaps experiencing the greatest change is that of the chief information security officer (CISO). In the early days of what was initially called data security, there was little need for someone to lead protection activities. Security was mainly a matter of maintaining access lists within products such as the RACF, Top Secret, or ACF2. While technical staff responsible for these systems might have been given a security specific title, they were part of the information technology (IT) department, indistinguishable from other technical specialists within that group.
As information systems evolved from megalithic mainframe computing to a distributed model, leveraging the power of networks, personal computers, and client server architectures, the need for dedicated information security specialists became evident. It was no longer sufficient to define user permissions in the access control system software. It was now necessary to specialize in areas such as risk management, protection architectures, application security, and incident response to meet organization needs related to the increased complexity of the information systems environment. It was even more important to have a leader who not only had broad knowledge of the various technical focus areas within an information security program, but who could also drive the security strategy and align it with the goals and priorities of the organization.
Information systems have become more distributed and at the same time increasingly integrated into organization processes. Attacks are common, attackers are more sophisticated, and the damage resulting from incidents is escalating. Attackers have evolved from lone individuals who in the early days were mainly interested in exploring systems, to sophisticated cybercriminals, terrorists, and agents of nation states. Attacks have evolved from Web page defacements to now include cybercrime, where the objective is financial gain or market advantage. Interest in information security has risen to the board where cybersecurity is among their top concerns. With heightened risk and a need for greater visibility into information security, the chief information security officer (CISO) has become a necessary role. The CISO is often not only a technical specialist but is the organization lead managing the complexities of a program that is an essential part of enterprise and operational risk management.
The Duality of the CISO
There are two sides to the CISO: the technical specialist and the executive strategist. Both roles are equally important, as the CISO must understand both the necessary cybersecurity products and how to implement them in line with the organization’s overall strategy and objectives.
Technical Specialist
Obviously, to lead the information security organization, the CISO needs to be well versed in security concepts and strategies and in the products that are a core part of a protection architecture. The CISO needs to be a technical specialist who knows the nuts and bolts of information and cybersecurity and who can address the broad requirements and technical aspects of the security program. Much of this domain specific craft knowledge is encompassed in the common body of knowledge defined by the International Information System Security Certification Consortium, or (ISC)2. As the information security profession was forming, it became evident that there needed to be some way to distinguish accomplished and capable professionals from those who did not have the knowledge or experience required to be an information security professional. A group of distinguished practitioners came together to form (ISC)2 and to develop the taxonomy of knowledge that was immediately accepted as the knowledge base of the profession. In 1994, the common body of knowledge was created and became the basis for the Certified Information Systems Security Professional (CISSP) certification. This body of knowledge undergoes an annual review to ensure it remains current and that it reflects existing technical knowledge requirements for information security professionals. The common body of knowledge encompasses eight domains1:
- Security and Risk Management
- Asset Security
- Security Engineering
- Communications and Network Security
- Identity and Access Management
- Security Assessment and Testing
- Security Operations
- Software Development Security
Executive Strategist
While an understanding of the technical specializations necessary of an effective information security program are essential, there is also a critical need for practitioners to understand the organization and how information security supports organization growth and development. The security practitioner needs to be able to work as an essential part of enterprise and operational risk management. This is particularly true for the CISO, who, as the chief executive representative of information and cybersecurity within the organization, needs to be able to support the organization and integrate the security program into the strategic initiatives and operational activities of the organization.
A 2016 study by executive recruiter Korn Ferry identified that 80 percent of CISOs say their jobs have a very high visibility and accountability orientation, which is higher than other managers at the same reporting level. The researchers identified that more CISOs are reporting outside of the traditional IT structure. Instead, there is an increasing trend for the CISO to report with a more strategic orientation; to organization leaders such as the head of risk management, the general counsel, the chief operations officer (COO), or the CEO. This strengthens the position of information security as being an organization critical service rather than a technology specialization within IT.
The evolving orientation of information security has resulted in a change in expectations as to what skills and expertise the security lead in the organization must have. It is no longer as important to only be a strong technologist. It is becoming more critical that the CISO understands how to address technical information protection requirements from the perspective of an organization strategist. Table 25.1 identifies the key attributes required for CISOs as identified in the Korn Ferry research.2
Table 25.1 Key Attributes for Information/Cybersecurity Executives
| Competencies Strategic, global thinker (sees big picture) Thinks outside the box Analytical (digs deeply into issues) Possesses “business savvy” (understands how information is used in daily operations) Balances competing priorities Communicates and influences broadly (board, senior management) Attracts, builds, and leverages talent |
Experience Depth of technical experiences Understands evolving regulatory and legal environment Has (successfully) dealt with/handled security incidents in the past |
| Traits Learning agile (can adapt to the new and different) Flexible Tolerance for ambiguity Intellectually curious Bias for action |
Drivers Seeks high visibility and accountability roles Strives to be agents of change (not agents of “no”) Must “thread the needle” to balance driving change with managing enterprise risk Pursues close engagement with organization leaders (works to add value) |
Source: With the kind permission of Korn Ferry USA.
Job Responsibilities and Tasks
To identify the specific accountabilities, responsibilities, knowledge requirements, and skills that are necessary for those who lead information security programs, ISACA conducts periodic job task assessments. These global assessments bring together empirical data gathered from CISOs as well as insights from industry leaders and subject experts to define the CISO position in terms of the tasks they perform and the knowledge required in this role. These are the basis for the Certified Information Security Manager (CISM) certification that has been offered by ISACA since 2003.
According to the most current research conducted by ISACA, the CISO as an organization executive needs to have broad professional capabilities that can be summarized in terms of the following four task and knowledge domains:
- Information Security Governance
- Information Risk Management and Compliance
- Information Security Program Development and Management
- Information Security Incident Management3
Information Security Governance
As the lead for information security governance in the organization, the CISO establishes and maintains a framework and supporting processes that ensure that the information security strategy is aligned with organization goals and objectives. This governance framework supports overall governance activities within the organization and contributes to efforts to ensure that information risk is appropriately managed and that information security program resources are managed responsibly. Within this governance responsibility, the CISO is responsible for defining the goals and objectives of the security program, aligning them with organizational goals and objectives, and developing and implementing the policy, procedures, and guidelines required as part of the program. As the champion for information security within the organization, the CISO seeks to gain organizational support and commitment for the security program at all levels within the organization. As a contributor to the organization’s ability to manage information and technology risk, the CISO identifies external influences to the organization (e.g., technology, organization environment, risk tolerance, geographic location, legal and regulatory requirements) to ensure that these factors are addressed by the information security strategy. The CISO will also establish, monitor, evaluate, and report metrics to provide management with accurate information regarding the state of risk, the impact on the organization, and the effectiveness of the information security strategy.
To be the lead for information security governance and to integrate this into the overall governance structure of the organization, the CISO has certain knowledge requirements. These include:
- The fundamental concepts of governance, how they relate to information security, and the relationship between information security and organization goals, objectives and functions.
- Methods to implement the security governance framework.
- Internationally recognized standards, frameworks, and best practices.
- Strategic budgetary planning and reporting methods.
- Methods to obtain commitment from senior management and support from other stakeholders.
- Organizational structures and lines of authority.
- Methods to select, implement, and interpret metrics.
Information Risk Management and Compliance
The second area of CISO professional competence involves information risk management and compliance. This area of expertise is focused on the management of information and technology risk. The CISO is responsible for integrating information risk management into organization and IT process and for promoting consistent and comprehensive information risk management processes across the organization. This can include establishing and maintaining processes for information asset classification to ensure that measures taken to protect assets are proportional to their organization value. The CISO ensures that risk and vulnerability assessments are conducted periodically and develops risk treatment plans and programs to manage risk to acceptable levels. The CISO also evaluates controls to determine if they are appropriate and effective and monitors risk to ensure that changes are identified and managed. When there is a gap between current and desired risk levels the CISO reports these and will develop or assist in developing and implementing needed changes. In their compliance role the CISO identifies legal, regulatory, organizational and other compliance requirements, and builds programs to ensure continued compliance. While the CISO has these responsibilities depending on the organization structure some accountability may be shared with other organization executives including the chief risk officer.
To accomplish their risk management responsibilities, the CISO has certain knowledge requirements. These include:
- Information asset classification and valuation methods.
- Risk and vulnerability assessment and threat analysis methodologies.
- Legal, regulatory, organizational and other requirements for information security.
- Sources of information regarding emerging threats and vulnerabilities.
- Risk assessment and analysis methods.
- Risk treatment strategies and methods and how to apply them.
- Security controls and countermeasures.
- Control baseline modeling and its relationship to risk based assessments.
- Risk reporting, monitoring and review requirements.
- Techniques for integrating risk management into organization and IT processes.
- Maturity-gap and other gap analysis techniques.
- Security controls and countermeasures and the methods to analyze their effectiveness.
Information Security Program Development and Management
A major part of the CISO’s responsibility is the development and management of the information security program. As part of this responsibility the CISO needs to align and integrate the security program with other organization functions and ensure that the program advances the information security strategy. The security architecture, which integrates the program elements addressing people, process, and technology forms the basis for the security program. Since security is part of everyone’s responsibility, the CISO leads programs to ensure security is part of the organizational culture through awareness programs. As an organization unit leader and representative of the security program across the organization, the CISO needs to implement and communicate information about the effectiveness and efficiency of security program and provide periodic reports to executives and board members.
To accomplish these management responsibilities, the CISO has certain knowledge requirements, including:
- Identify, acquire, manage and define requirements for internal and external resources.
- Establish, communicate and maintain organizational information security standards, procedures, guidelines and other documentation to support and guide compliance with information security policies.
- Establish and maintain a program for information security awareness and training to promote a secure environment and an effective security culture.
- Integrate information security requirements into organizational processes.
- Integrate information security requirements into contracts and activities of third parties.
- Establish, monitor, and periodically report program management and operational metrics to evaluate the effectiveness and efficiency of the information security program.
Information Security Incident Management
The last area of expertise and action required of the CISO is that of the security incident manager. As cyber threats too frequently lead to security incidents, the CISO is responsible for developing and maintaining incident detection capabilities as well as the ability to expeditiously respond to limit damage and to return the organization to normal activities. To accomplish this increasingly critical activity, the CISO has certain knowledge requirements including:
- Establish and maintain an organizational definition of, and severity hierarchy for, information security incidents.
- Establish and maintain an incident response.
- Develop and implement processes to ensure the timely identification of information security incidents.
- Establish and maintain processes to investigate and document information security.
- Establish and maintain incident escalation and notification.
- Organize, train, and equip teams to effectively respond to information security incidents in a timely manner.
- Test and review the incident response plan periodically to ensure an effective response to information security incidents and to improve response capabilities.
- Establish and maintain communication plans and processes to manage communication with internal and external entities.
- Conduct postincident reviews to determine the root cause of information security incidents, develop corrective actions, reassess risk, evaluate response effectiveness, and take appropriate remedial actions.
Conclusion
As information and information technology have evolved, and as they have become central to how organizations serve their market, the role of the defenders in information security departments has changed. Information protection professionals have evolved from having a minor technical role in administering access credentials to being at the forefront of defending information assets from misuse and compromise. The leader of information and cybersecurity activities has evolved from a technical specialist to the executive strategist responsible for the protection of organization assets and the domain expert for the board and executive management. While knowledge of information security technologies and techniques is important, it is increasingly critical that the executive CISO brings organization acumen and leadership qualities to this important position.
Notes
About ISACA
As an independent, nonprofit, global association, ISACA engages in the development, adoption, and use of globally accepted, industry-leading knowledge and practices for information systems. Previously known as the Information Systems Audit and Control Association, ISACA now goes by its acronym only, to reflect the broad range of IT governance professionals it serves. Incorporated in 1969, ISACA today serves 140,000 professionals in 180 countries. ISACA provides practical guidance, benchmarks, and other effective tools for all enterprises that use information systems. Through its comprehensive guidance and services, ISACA defines the roles of information systems governance, security, audit and assurance professionals worldwide. The COBIT framework and the CISA, CISM, CGEIT, and CRISC certifications are ISACA brands respected and used by these professionals for the benefit of their enterprises.
About Ron Hale
Ron is an organization executive, scholar practitioner, mentor, and thought leader with experience in executive management and in leading organizations in the governance and management of information and information technology in particular as it relates to organization innovation and the protection of information. Over 30 years, as a senior practitioner and thought leader, he has helped organizations understand threats and risks related to information and information systems and how to build effective programs to govern and implement effective protection and recovery programs. As the chief knowledge officer for ISACA, he has led and contributed to the development of leading practice aids for practitioners and enterprises.