CISO moves to the top

CISO moves to the top

by | 2 Jun 2019 | Consulting, Technology

The CISO moves from the basement to the boardroom

A growing threat landscape has changed the role of the chief information security officer in the past decade. Here’s why this position and its evolution are vital in the modern enterprise.

“With the recent ransom virus affecting so many global businesses the executive boardroom stakeholders now have their attention”, stated Craig Ashmole, Founding Partner for London based Interim consulting firm CCServe. “Talking with a Security consultant colleague on the train the other day, he said that the insurance firm he’s engaged with did not feel the need for a CIO or CISO role until the resent infamous Ransom virus. That’s now all changed”

The rapidly expanding cybersecurity threat landscape has driven the chief information security officer (CISO) out of the basement and into the boardroom in many enterprises. While these tech professionals were traditionally seen as security enforcers, they have now clearly got the attention of the executive stakeholders and are taking a seat at the table as strategists helping the enterprise avoid cybercrime.

“The CISO’s role has changed from a pure technologist to understanding what the business is trying to do, and to make sure security is part of the business strategy, not an afterthought,” said Steve Martino, CISO and vice president of information security at Cisco. A 2016 Cisco study found that business leaders today believe that cybersecurity is a prime growth enabler, reinforcing the need for those in charge of security to increasingly think in business terms.

Cyber threats have changed dramatically in the past decade in terms of sophistication and volume, Martino said. That change has been driven by two factors: Organizations becoming more connected through the Internet of Things (IoT), and cybercriminals shifting from making political statements to cybercrime as a business.

This changing landscape and added responsibility means CISOs need to develop a new set of soft skills, including learning how to talk with a line of business leaders about risk, privacy, user experience, and balancing the trade-off of security with features.

“Five to ten years ago, the C-suite really didn’t have a relationship or a dialogue with the information security team or leader,” Martino said. “Today, we do. In order to be effective, you have to have this business context, and be able to have a business dialogue with many different functional leaders.”

That means understanding what the different parts of the business—finance, sales, marketing, etc.—prioritize, and be able to translate risk issues to their language.

“CISOs need to have that business knowledge and multi-lingual capability to be able to translate what you’re trying to get across in terms of risk to the business owner,” Martino said. “Both are required to be effective at the speed of business, and earn the respect and trust required.”

Developing new skills

Training is helpful for CISOs who have been called to report to the C-suite for the first time, said Gary Hayslip, an ISACA expert on cybersecurity, the former CISO for the City of San Diego, and the current CISO at Webroot. “It’s a different view of risk, and on the use of resources and costs,” he said. “You have to start really getting into the strategy of where the organization is going.”

Hayslip recommends finding another C-suite member who has reported to the board before, and partnering with them to learn how the board meetings typically proceed, and what the individual board members are like, what they look for as a group, and how they process information.

“If you’re a CISO dealing with the C-suite and it’s relatively new for you, don’t be scared—ask a mentor so you can start learning about what they look for, so you make sure when you do report to a board, the information you’re presenting is relevant to the discussion,” Hayslip said.

It’s key to remember that the CISO does not own the risk—the business does, said Forrester analyst Jeff Pollard. “CISOs are now transferring ownership of risks back to business units,” Pollard said. “Instead of the CISO possessing the power to stop the business in its tracks, they are advising and coaching business unit leaders on the risks and security ramifications of decisions but the business owns the risk and makes the decisions.”

Don’t be the barrier factor

Rather than becoming a barrier, this new model allows CISOs to work with, instead of against their colleagues, Pollard said. However, the CISO does need to be flexible, and understand that the security system in place must be resilient. “You’re going to take breaches,” Hayslip said. “There is no totally secure network. If you factor that in, you can start looking at where your risks are, how your teams are trained, and what policies are in place.”

If the CISO is overwhelmed with projects, it can be helpful to determine which departments you are serving, who the stakeholders are, and what is critical to them, Hayslip said. That will help you create a more narrow list of issues to tackle. It’s often wise to start with cyber hygiene, he added: If you have basic security policies and patch management, antivirus, and firewalls in place, updated, and managed, it builds a strong foundation for your organization’s cyber health.

CISOs also have an opportunity to redefine their role as a business strategist during the digital transformation, Pollard said. To prove their value, they should spend time mapping the firm’s technology touchpoints, foster security champions across the company, and get involved with customer-facing activities like product design and development, he added.

“We’re in this transition as an industry from being a technologist and a protector to being a business enabler,” Martino said. “In order to cross that chasm, the CISO has to earn a place at the table, by bringing business relevancy, and helping the business get to their goals faster.”

By Alison DeNisco  (TechRepublic)

Having spent a majority of my career working with and supporting the Corporate CIO Function, I now seek to provide a forum whereby CIOs or IT Directors can learn from the experience of others to address burning Change or Transformation challenges.

Craig Ashmole

Founding Director CCServe

IT role in Corporate Acquisitions

IT role in Corporate Acquisitions

by | 6 Aug 2015 | Consulting, Technology

IT role in Acquire, or Not-to-Acquire

The changing landscape of the IT Technology arena within corporate Merger or Carve-out

To acquire, or Not-to-acquire – The question most CEOs ask their CFO is:- Will the transaction drive financial rewards and what are the risks, but really the glaring missing player here is the CIO!

Ask yourself, How many CFOs have you come across that have a full and clear understanding of the value an ‘Open and connectable’ versus ‘out-dated and proprietary’ IT department can make in driving business revenue growth.

This means that Board Executives are negotiating in the dark and potentially loosing large percentages of cost of sale value. There couldn’t be a better time for the CEO to bring the CIO to the table.

Businesses today are under more pressure than ever to deliver value to stakeholders, particularly when undertaking bold initiatives such as mergers, acquisitions or asset disposals. This is true not only for corporate acquirers but also for private equity (PE) or Venture Capital (VC) firms, whose strategy is leaning toward add on acquisitions as a means of growing their portfolio companies.

Under the current economic conditions and the rising cost of debt, corporate business management teams will require additional focus on effort in order to restructure or streamline operations, and specifically the IT departments of acquired businesses to deliver success in the absence of financial engineering. For a while now Information Technology (IT) is fast becoming a key lever which management can use to deliver operational benefits — whether in reducing operational costs, entering emerging markets or scaling their business across multiple geographic regions. With the advances in technology and its impact on today’s business models, companies are increasingly pushing the boundaries to remain competitive. IT is one key area to do this — Technology should be looked at as a business enabler and not look at as so many boards still do today, as a cost to do business.

“The sooner that executive boards put the CIO or the IT department on their monthly agenda as a regular discussion point the better,” says Craig Ashmole, Founding Partner of London based CCServe consulting. In my humble experience and far too often I see the CIO struggling to get the ear of the CEO or even agendas on the board table; businesses need to view IT as a business enabler rather than viewed purely as a cost centre.”

Part of the reason the CIO is not at the board table is that often they do not speak the language of the business board executive. Technology scares most senior board members and until the Generation Y and Generation X group get into those senior positions we will continue to see a disparity with Technology and Fiscal business matters.

The CIO challenge is to do his/her bit too, they really need to fully engage with the commercial business functions, and stop hiding behind technology to protect themselves. The ‘head-in-the-sand’ CIO will have a rapidly growing threat from the likes of the CMO or emerging CDO Digital Officer. Understanding the business functions that deliver revenue is a key focus going forward.

With the fluid market of M&A today there are two clear distinct areas a corporate or global business can go with this. One; is to look at how costly it will be to split companies up or carve out elements that are no longer key areas of business growth for that organisation and IT efficiency should be at the forefront, not just fiscal separation.

The other area on the acquiring side of an M&A transaction – Many CEO/CFOs look at the cost of acquisition proposed by the big 5 consultancy houses, often building in huge elements of ‘cost of sale’ to mitigate IT integration risk especially where transaction teams are uncertain.

“Making ones own IT and infrastructure easy to connect with while utilising open standards or cloud services could help the process of bringing together two disparate lines of business,” Craig Ashmole goes on to say, “More importantly M&A is about the shortest time to ‘joined-up’ business revenue growth which gets the attention of the CEO. Well prepared IT and infrastructure are key success elements to that joined-up process.”

There is a large growth of non-accounting technology focused personnel being hired into the Big-5 consulting transaction teams as more emphasis is given to IT & Technology within the merger/carve-out transaction process. This however should be a balanced process, in my opinion, with ones own CIO office within the organisation. What an IT department or CIO office may lack however is in the broader wider exposure that seasoned interim independent consultants might bring to the negotiations. Independent interim IT consultants have often engaged in similar situations or have awareness skills from engaging in many other organisations as they move from assignment to assignment.

Whatever the CEO or board choose to do as they grow through acquisition, or transform through business carve-out, they have to put the IT agenda firmly on the boardroom table and should seriously consider taking advantage of the experience and quick turn-round support that so many senior and interim consultants have to offer, to support their own CIOs.

Having spent a majority of my career working with and supporting the Corporate CIO Function, I now seek to provide a forum whereby CIOs or IT Directors can learn from the experience of others to address burning Change or Transformation challenges.

Craig Ashmole

Founding Director CCServe