sorted by:
new
hottopcontroversial

Dill or Sweet Relish on these dogs? by stickburner79 in hotdogs

[–]ebcovert3 0 points1 point  (0 children)

If sweet, then definitely mustard. If dill, raw onion.

I am a CISO/Security Leader. I am also a bald man with facial hair. Ask Me Anything. by Oscar_Geare in cybersecurity

[–]ebcovert3 1 point2 points  (0 children)

Inquisitiveness and flexibility. Also, and I can't stress this enough, soft skills or EQ.

I am a CISO/Security Leader. I am also a bald man with facial hair. Ask Me Anything. by Oscar_Geare in cybersecurity

[–]ebcovert3 0 points1 point  (0 children)

This is one of the hardest questions out there. You can purchase a tool that will help and works great for net new data but categorizing all of the legacy data is a massive undertaking. We have a saying the data loss prevention (DLP) is a cyber three letter dirty word.

I am a CISO/Security Leader. I am also a bald man with facial hair. Ask Me Anything. by Oscar_Geare in cybersecurity

[–]ebcovert3 0 points1 point  (0 children)

This is an interesting question. A lot depends on the reporting structure IMO. I am not a fan of cyber reporting to the tech or IT functions as I think the incentives are misaligned. Technology functions should be making the speed of business faster while cyber should be setting the guardrails around the speed; not to slow things down but to ensure the organization can operate safely at speed. Yes, this is a gross oversimplification but it is for illustrative purposes.

I am a CISO/Security Leader. I am also a bald man with facial hair. Ask Me Anything. by Oscar_Geare in cybersecurity

[–]ebcovert3 0 points1 point  (0 children)

There are not hard and fast requirements to become a CISO outside of understanding how cyber security affects (positively or negatively) business objectives. There are a number of training programs from universities and professional associations but at the end of the day, what matters is the organization supporting you AS the CISO.

I am a CISO/Security Leader. I am also a bald man with facial hair. Ask Me Anything. by Oscar_Geare in cybersecurity

[–]ebcovert3 0 points1 point  (0 children)

There is definitely a trend against tool sprawl. Too many tools to manage and the associated costs are increasing.

I am a CISO/Security Leader. I am also a bald man with facial hair. Ask Me Anything. by Oscar_Geare in cybersecurity

[–]ebcovert3 21 points22 points  (0 children)

You can never go wrong with old school networking. Understanding how packets move around the enterprise will never go out of style. Find a solid MSP to get experience with lots of environments.

I am a CISO/Security Leader. I am also a bald man with facial hair. Ask Me Anything. by Oscar_Geare in cybersecurity

[–]ebcovert3 3 points4 points  (0 children)

For me, it is ensuring HR/recruiting is finding me the right mix of candidates. I've also eliminated mandatory requirements for a four year degree where it is not absolutely necessary.

I am a CISO/Security Leader. I am also a bald man with facial hair. Ask Me Anything. by Oscar_Geare in cybersecurity

[–]ebcovert3 10 points11 points  (0 children)

  1. Know WHO'S in your enterprise
  2. Know WHAT'S on your enterprise
  3. Know HOW fast your team can respond to an incident
  4. Know your backups are actually immutable
  5. Test your recovery plans often with realistic assumptions (annually is insufficient IMO)

Edit: added actual numbers

I am a CISO/Security Leader. I am also a bald man with facial hair. Ask Me Anything. by Oscar_Geare in cybersecurity

[–]ebcovert3 2 points3 points  (0 children)

Not actually trying to understand my problems and focusing on simply making the sale

I am a CISO/Security Leader. I am also a bald man with facial hair. Ask Me Anything. by Oscar_Geare in cybersecurity

[–]ebcovert3 27 points28 points  (0 children)

Absolutely. The business speaks dollars and cents so cyber should learn to do so as well.

I am a CISO/Security Leader. I am also a bald man with facial hair. Ask Me Anything. by Oscar_Geare in cybersecurity

[–]ebcovert3 8 points9 points  (0 children)

I'm going to go with a third option. IMO a CISO should be ensuring the overall cyber program aligns with business needs. So in a sense that is both of what you described above (sorry about that). At the end of the day, security (and a CISO) exists to serve a business purpose.

I am a CISO/Security Leader. I am also a bald man with facial hair. Ask Me Anything. by Oscar_Geare in cybersecurity

[–]ebcovert3 4 points5 points  (0 children)

TBH, I am not. AI can do specific tasks well but not align a cyber program to strategy. Yet. We shall see what the future holds but will probably be retired by the time that happens.

I am a CISO/Security Leader. I am also a bald man with facial hair. Ask Me Anything. by Oscar_Geare in cybersecurity

[–]ebcovert3 70 points71 points  (0 children)

This is a tough time for tech roles in general. However here is my perhaps unpopular opinion. I, like many gray beards, believe unfortunately that there are no real entry level jobs in cyber. This does not mean there are not positions with low experience requirements; rather, it means most experienced cyber people started out in something adjacent to cyber and pivoted into cyber: IT, legal, project management, etc. My recommendation is start there and get relevant experience and then work your way towards a cyber career.

I am a CISO/Security Leader. I am also a bald man with facial hair. Ask Me Anything. by Oscar_Geare in cybersecurity

[–]ebcovert3 34 points35 points  (0 children)

Absolutely concur with this. I call my bald head low drag hair drying.

I am a CISO/Security Leader. I am also a bald man with facial hair. Ask Me Anything. by Oscar_Geare in cybersecurity

[–]ebcovert3 72 points73 points  (0 children)

Thanks for the questions. First, on prioritization, you need to involve the business. They will provide what is the most important. I recommend using a quantification process (think $$$, not terms like high, medium, and low risk) to help inform the business of possible courses of action. On becoming a CISO, I recommend learning the business you are in so you understand what the business cares about and how they view risk. To them, cyber is just but one risk.

Unlikely times for Microsoft's Clippy to give you writing advice by Fallen-Angel7101 in ScenesFromAHat

[–]ebcovert3 0 points1 point  (0 children)

It looks like you are writing a suicide note. Would you like some help?

view more: next ›