Where Should A CISO Sit Within An Organisation?

Welcome to the RazorWire Podcast, where we discuss all things in the information security and cybersecurity world, from current events and trends through to commentary from experts in the field providing vital advisory on what it is to work in the information security and cybersecurity space. Hello and welcome to the RazorWire Podcast. Today we're going to be talking about where a CISO sits within an organization, a bit of the history behind it, some of the details of where the trends have been in recent years, and where we think it's going to be heading in the future. It's the same format that we always do for all podcasts. It's a group of us sitting here talking like we're down the pub talking about what we do for a living. So today, my other 2 guests, we have Keith. Keith, do you want to kind of introduce yourself?

Cheers, thanks, Jim. Hi, my name is Keith Christie-Smith. I'm currently working for an organization called Clarity. Clarity are an OT cybersecurity vendor. I've worked for various different organizations within the OT space and IT space on both the vendor as well as on the reseller side. So essentially both sides of the, I guess, of the channel. I've probably been in cybersecurity longer than I care to admit, but yeah, it's a long time, let's say over a decade.

Fantastic. Cheers, Keith. And a long-term friend of mine, CISO extraordinaire, Claire. Claire, do you want to kind of introduce yourself?

Yeah, I'm Claire Davis. I'm the Director of Group Information Security at Arriva Group, or the CISO, whichever role you're more familiar with. I started my— cut my teeth in this industry many moons ago in the military. So I did a full career in the military, 22 years. Which looked after lots of different things around security. So it was the sort of fence checkers and kickers and all that kind of stuff, everything from physical security right the way through to information security. And also the way that we dealt with it in the military is understanding what the threat was, and it was on that perspective that you became very expert on the threat, and then you'd know how to protect things where necessary. You could exploit that threat to security as well. So when I got out about 10 years ago, then I wanted to specialize in information security. To me, that was where it's all going, it's all happening, it's all exciting. So I started off again a second career in information security. So I've worked within retail, banking, and now I've moved into the transport sector with Areva. And that's where you and I have met each other as well, is in the retail sector, wasn't it, in those old days?

It was, yes. PCI DSS, the big bugbear in the room. So yeah, and for those of you out there who don't already know me, just very briefly, my name's James Rees, but please call me Jim. I'm a veteran of InfoSec now at 25 years, been in a number of different roles, but today I'm the MD of Razorthorn, a consulting firm who does pen testing consultancy, compliance. We've got quite a broad product range of solutions that we can assist customers with that kind of thing. So Yeah, it's been a long time. And today we are going to talk about where a CISO sits within an organization. This has been a conversation that has been going on for years and years and years. You know, ever since the security managers, as they were known back in the day, started quizzing whereabouts they should sit within an organization. Historically, quite, you know, 20-odd years ago, very much in the IT space, very much reporting to IT. And usually the security manager was very kind of cybersecurity focused. As the years went on and compliance started to come out of the woodwork with Sarbanes-Oxley and PCI DSS and ISO 27001, and before that BS 7799, it became more and more evident that security was very much kind of not just about the cyberspace. There was significant amount kind of focus on compliance. As well as governance as well, you know, policies, procedures, that kind of thing. So a lot of us early InfoSec people who've been around for a while kind of migrated from that kind of technical knowledge into the more governance aspects and the CISO aspects. And then moving on from that, we come to kind of closer to today where now the CISO has— is very much in a variety of different places within organizations, you know, various different organizations. Some still have them in the IT department reporting to the CIO. Some have moved them over to like the legal department or the finance department because the view is, you know, you can't really mark your own homework. So that's kind of a bit of what we're here to discuss today. So guys, first and easy question: CISOs, where do you think they need to sit? Let's start with Claire. Come on, Claire.

Well, for me, I in In recent times, I've worked in an environment where I've worked in the legal side and also in the IT side. That's where we sit at the moment, reporting into the group CIO. Although, I suppose that in itself is a little bit of an indicator because everyone thinks the CIO is just responsible for IT. But, in reality, there is no technology in there. It's Chief Information Officer. I think, It's recognizing that that space within the CIO is not just about technology. It's about how you use the information as well. Where should it sit? I think, personally, it really depends on the environment and on that business, and not just how it is structured, but also the environment in terms of what's going on within that environment. If there's a huge piece of transformation, then it might be better to have it in more of a compliance area because of the amount of change that's going on and the amount of influence that you need to bring to bear. But, you know, it really depends as well on personalities too and how best those individuals and your reporting stream understand what you're trying to do.

Fantastic. Keith, your opinion?

Yes, most commonly I think we see today the CISO reporting in much the same way Claire's just said into the CIO. I think that's the most common layout today or structure today. I guess just to touch on a point that Claire made there, it really depends on the organization itself. Regulated industry, banking, Q1, pharmaceutical, nuclear, utilities, etc. In some of those organizations or in a lot of those organizations, you may see the CISO report directly into the board as well. But, yeah, it very much depends industry to industry. On the OT side, on the operational technology side, it varies wildly. We see a lot of organizations that still don't even have a CISO, or they may have a CISO that's specifically aligned to the IT side of the operation and not the OT side of the operation, or may not have oversight on the OT environment. So I guess it depends from vertical to vertical. And then on the healthcare side, so, you know, we— I do a lot of work with in the NHS, which is obviously public sector. in the UK, but on the healthcare side, typically within trusts, there wouldn't be a CISO. You know, the role just doesn't really exist. There's only a handful of some of the larger trusts that will have a CISO. So that would be maybe a cybersecurity manager reporting up to an IT director quite commonly. So again, yeah, it depends, in my view, very much on the organization and the vertical.

Yeah, and I totally agree. I think it's, you know, for many years there's been— it's been a bit of an odd one, this one, because way back in the early days when we tended to kind of report, you know, the technological people, you know, we used to sit in the IT space. It was sometimes very, very hard to, in many respects, do your job. If you're writing a policy or a procedure and you're having to get people outside of the IT department to kind of comply with something because a compliance requirement requires you to do it. You used to get a lot of pushback. Why is somebody from IT telling me how to, you know, manage my data? You know, you're there to make sure my data is available when it needs to be available, not telling me how to regulate my own information. And I suppose as time has drawn on, we've seen that role, that management of information security. I mean, some of us call it a CISO, some of us call it by a different name, But I'm starting to see quite in a lot of my customers quite a significant change in where that CISO sits and who they, who they advise and who their management is. In some places, yes, it's a CIO. In some places it's a CTO. In some places it's more compliance. As Claire said, that tends to be the larger of the companies because only really larger companies tend to have a compliance section. You know, we've got a couple of clients who are like legal companies, quite large legal companies, and of course they are quite heavily regulated. They've got a lot of their own compliance to meet. So you do tend to find, you know, if they do have information security people, because they don't all have them, that tends to be where they, they kind of sit. But nowadays, and I think in the last couple of years, we've started to see a lot of CISOs either advising board you know, the board directly, or even being added to the board as a, as an actual role. Because I think the, the whole security aspect of, of this sector, you know, the business sector, is migrating. We're seeing a massive increase of things like ransomware attacks, um, incidents that, that sometimes correspond with security, sometimes they don't. And Our whole kind of industry is dramatically changing from what it was, say, 10 years ago. What are your thoughts on that, Keith?

Yeah, I agree. I agree. You know, more commonly, I think we're going to see that CISO role reporting certainly into the CEO and, you know, as a result, on the board. And, you know, in my opinion, that's probably where the CISO function should be. As you rightly point out, you know, the amount of attacks and just what's happening in the, you know, the geopolitical space and everything else is causing issues, concerns, and businesses need to get on top of that, on top of the cybersecurity challenge. You know, I mentioned OT as an example in my answer to your previous question where you have organizations where they don't have oversight of the entire— either CISO doesn't have oversight of the entire operation. That's only going to ultimately end in, I guess, giving the CISO more power and aligning them closer to the CEO, I think, is only going to be better for that governance, risk, and compliance that the CISO has oversight for in the organization.

I'm going to add a little bit in there because if I look at how I have to deliver or my experience of delivering information security, put in place an information improvement plan, continuing improvement plan, based on 3 themes. The one is about delivering cyber resilience. So that's the bread and butter. That's the 27001. It's the PCI. It's all the requirements that you have to do. And that's the center of the onion, as you'd like to sort of call it. The next theme is around shared responsibility, because going from a place where people potentially think that it's someone else's job to do information security, it's not mine. You need to get over that aspect of stuff. It is about that shared responsibility. Then the outer bit is around influencing leadership. I have found that the best way to do this is actually to bring them along on the journey. Does it require you to sit on the board to actually do that? Does it actually require you to report directly into the CEO to do that? Personally, I don't think it does. I've been lucky enough to work in an environment where the CEO really does understand it and also is willing to listen because they've got a very keen eye on risk. That's where it all comes down to. You don't have to be directly reporting to the, in my view, the CEO or sit on the board because Because if you are, you're going to spend the vast majority of your time dealing with things that have got nothing to do with you. You know, that is your issue, is that actually it will take you away potentially from what your focus, your intention, your actions are. Because when you— we all know you can sit on a meeting when you're actually in an environment like that, and you're sat around with people with lots of different portfolios that have got nothing to do with you, and you'll have to sit there and pay attention to it and not just pop up when your bit of security comes on because you're a specialist in security. I come from the transport sector. So, you know, yes, it's of interest to me, the customer patronage and especially coming back out of COVID But in reality, my job is to try and prevent those ransomware attacks, to try and influence the leadership. It's not about actually doing all the other bits that they get on. They do very, very well on the operational side. we have to put that security envelope around it. And that's much the same as health and safety. That's an important part of a CEO's role as well, but we're not going to put the director of health and safety perhaps on the board. So, you know, it's how you manage that risk. That's my personal opinion, is it's influencing those people, not necessarily being those people.

I mean, I guess in many respects, information security for a long time now has been going through quite a significant change. And in many respects, I think businesses in general are still trying to find where security sits, because I've been in situations before where you're advising somebody, but you're advising somebody in middle management about a secure— significant security risk or something that could feasibly go very horribly wrong. But that doesn't get necessarily communicated correctly up to a level where a good decision can be made. Sometimes it's even hidden from the people at the top because the individual or the individuals that you're advising don't want to be seen as being incompetent or not being able to cope with an issue, or maybe they just don't think something's going to happen. It's a bit of a balancing act. What are your thoughts on that?

Again, I think it's about relationships, you know, and I sort of were alluding to it on my previous answer because I think it's very important for a CISO to have those soft skills. You know, if you come in too techie and too sort of focused on the tech, you're going to lose the buy-in from the board because they won't understand you. And that's why you've got to hone in those soft skills to be able to just knock on the door. And again, perhaps I'm quite lucky because when I speak to my counterparts in other businesses, they don't necessarily have the freedom of movement that I do where I—

Mm-hmm.

going back into the office is like one of those things. Do you work from home? To me, you can't possibly work from home, you know, doing this kind of a role, because you need to be building up face-to-face relationships outside of normal meetings with these people, so, and with your board members, so that when you do have a risk, when you do have an issue, then you can knock on the door and just go in there.

Yeah.

And I feel I'm in a position where I can do that. And that's been borne out of those conversations in the lift. It's been borne out out of a quick chat when you're at the coffee machine. You're not going to get that when you're sat at home and you're just going to enter into the meetings that you're invited to or you set up, because you will not get time with those leaders. And it's about how you manage that. Again, my personal opinion, because I know that there's some strong views on working from home at the moment, but— It is about soft skills and it is about relationship building. And that's the only way you can influence leadership.

Yeah, I couldn't agree more. Jim, you raised the point about, you know, if you have, I guess, someone that potentially turns out to be a blocker and is not feeding information up to, I guess, to the levels above based on, you know, it may not be good, may not always be good news that they're wanting to, or bad news that they're wanting to share. That's, I guess, that all comes down to accountability, really. that you need to have whatever that role is, right, within the organization, whatever the title is, be it a CISO or a cybersecurity manager, you know, there needs to be some accountability there. And that probably comes from the top down, really, to make sure that there is accountability with that specific role and with whoever's carrying that title.

Yeah, no, and absolutely. And it's a tough one actually, because there's so many different environments out there and there's so many different views on the subject of security. I find organizations who've experienced a big security event, you know, something that's been seriously damaging, take a lot of stock now in security. I mean, we've all seen some of the big issues that have occurred over the last couple of years. And, you know, you see CEOs losing their jobs over significant security events and then get some people who kind of start pointing the finger. Oh, why didn't that security person tell me that this was a, you know, risky endeavor? Or why didn't that security person tell us that there was all these vulnerabilities? And you kind of think, you know, you kind of think, well, maybe they did, but nobody was listening. I guess in many respects, a lot of InfoSec people in general have gotten a bit of a bad name, you know, as being blockers to projects, as being hills to try and climb over or try to go around that hill entirely. I mean, so many times I've seen projects have nearly come to a to their end, and somebody pipes up and says, oh, have you gotten security sign-off on that? And they've gone, oh no, but we're going live next week. And then you end up having a conversation with them, you find all kinds of vulnerabilities, they haven't done their due deal, they've been actively kind of trying to hide from security in many respects, and they're about to go live with something that you know is going to get compromised in literally 5 minutes flat. But, but people won't listen, and they, they use business as, as the driver. I think in many respects I'm I think there's a lot more support now from the C-suite on security than there has been in the past. So I think there's definitely a bit of a migration towards, well, you're telling us this is all fine, but have you actually spoke to the security guys now? You know, because ultimately, if it's the board wants to do business, they want to drive forward, they don't want security events, they don't want to have the big PR issues of being found that their key software is, as you know, some malicious actors have gotten in and put their own code in there and then signed off the update as legitimate and then compromised a ton of customers, not mentioning any vendors there. But it's definitely a bit of an odd one, and I think we're still going through that change. I don't know where we're going to end up as security people. You know, a lot of larger organizations now have their own security department as opposed to it being an offshoot of one of you know, one of the other departments. You are sort of starting to see that. What are you guys kind of seeing? Obviously, Claire, you're on the ground floor there, and Keith, you kind of interact with a number of different environments. It's good to get a view from, you know, both of you on that one.

For me, I think, yes, there are sort of chief security officers that are coming out, but I think it's that sort of like being It's like a reemergence of it because they used to have the chief security officer and they were quite often came from a military background or a police background or something like that. And the drama is then they don't necessarily understand, and this isn't in general, but you know they might not understand the information security side of things because I have seen that in the past as well that they're very focused on on the old school physical security and it's like oh well those are the geeks in the corner you know don't quite know what they. Do, but yes, they are responsible. I'm responsible for it. And, and you're seeing a bit of a reemergence of it, but perhaps with more weight coming on too, that they need to actually understand the technology. I mean, I know a few, few areas within, uh, transport that, that have got that, a chief security officer, and to good effect, to, to be fair with you. But I think that we've got to sort of understand, again, it's got to be looking at what your environment is and what you actually deliver. Because I think understanding that information is the lifeblood of all of our organizations, what other aspect of security is going to sort of be on a par with that as to add to their portfolio on the physical side? And I think only if you've really got quite a significant health and safety risk or potentially that brings in all threats on a physical nature, do you actually need to pull those 2 portfolios together? I think I still— so my portfolio includes data protection as well, so, and that's a little bit unusual too when I speak to people, and I personally find it fab— I find it great. I think we work really well together, especially when you're a small team. There is a small team of less than 10 of us, us that are delivering that across our group, as in data protection, information security, and security operations. It works really, really well and efficiently as well and effectively because we're all— unless you come from perhaps the finance, the pharmaceuticals, those kind of environments, perhaps I'm talking out of turn for them, really, money is an issue. budget, things like that. So they are going to look at restructures and trying to make things simpler and cheaper to do, especially at the core, corporate center, whatever it is and however you are structured in that. So you've got to keep it thin. You can't have lots of different organizations as well. So I think instead of perhaps bringing Chief Security Officer, I think perhaps looking at the portfolio of bringing data protection and information security together.

Yeah, makes total sense as well, right? You know, I'm not actually familiar with the CSO role. You know, it's just not something we typically come across or someone that we typically would engage when we're speaking to organizations. That's quite interesting to hear, Claire, and the fact that you think that that's coming back into fashion as well. So I suppose we'll see more of that. Jim, just to touch on a point you made, I think just as a You know, you were talking about security at times sometimes being almost a bolt-on, right, at the end, a stopper almost. I think, you know, as an industry, we need to be better just in general from a cybersecurity perspective. It's too often we see technologies being released and the assumption is just that the customer will manage the risk, the vulnerabilities, and everything else with those devices or with that software, you know. I think those days are gone. Organizations need to be better at what they're producing and what they're bringing to market. Now, I get that, right? We all live in the real world. We're all humans. We get sick from time to time. I get that software has vulnerabilities and things happen. Log4j is a prime example of that. Maybe the software bill of materials that the US government are touting will help that, but the industry just needs to be better, I think, in general. And, you know, if that was the case, I think life would be a lot easier for Claire and all of her colleagues, you know.

Yeah. And I mean, some points there that are very good points. You know, it's like I'm starting— we're starting to see a lot more legislation now coming out of government bodies, coming out of compliance. You know, I've been a QSA for many, many years, and the latest version— versions of PCI have all had this requirement that management, top-end executive management, support security. People in what they're doing. It's a requirement of the standard. You actually have to get it signed off, you know, having a security charter and having that support mechanism from the powers that be. And when you're kind of looking at the media over the last couple of years, you know, you're seeing more and more support for that information security responsibility, especially if you're like a service provider. I mean, let's face it, The last 10 years or so, everything's gone virtual, and then everything started moving to cloud-based. Now it's kind of like third-party everywhere. If you want a software solution nowadays, you're hard-pressed to find an on-premise solution. Quite often it's cloud-based. You know, you can have GRC in the cloud, you can have your infrastructure and your servers in the cloud, you can have key, say, HR software delivered to you, software as a service. And the whole kind of third-party management of security has also exploded, especially in the last couple of years. I think the pandemic really pushed that. I mean, Claire, going all the way back to something you mentioned about the whole working from home thing, absolutely. I mean, our way of working has dramatically changed, and the way that we consume our services and our technology, the way we serve our businesses now has dramatically changed. A lot more organizations are getting savvy to challenging their service providers on the level of security they have. You know, I remember back in the day seeing kind of like security audits on a third party and it would consider, do you have AV and do you have somebody in charge of InfoSec? Well, gone are those days. And if I'm reading right what I'm seeing from the UK government and the US government, they're now starting to push for organizations to actually have people insignificant roles who are actually accountable and, and trained in security. So I, I can see this role becoming more and more important in the larger companies. I think in the mid-sized companies that's probably not going to happen. There's still going to be a lot of reporting back to— but be it the finance officer, the legal aspect, or whatever. But I mean, I know CISOs over in, um, Silicon Valley who get paid like 4 mil plus in dollars just to provide the role. I think I might go and move over there at some point. But, you know, we're getting a lot more prominence. And I think if legislation keeps going the way it's going, I think maybe larger companies or critical companies, at least critical infrastructure companies, are going to be forced to have somebody, you know, security-wise at least advising the board, if not sat there on the board so they can enforce requirements and change. I don't know what your thoughts are.

Yeah, I think legislation has played a massive role in this. And it's in the UK, the Data Protection Act is one of those big changes that has taken place. I know we have the Network and Information Systems Regulation as well, but I think certainly for boards, it is a scare to think that they could get hit like British Airways. I know that the original fine of £183 million, I think it was, has been reduced, but that is old news. The reduced, or it's been hidden in some ways, boards are still thinking £183 million, crikey, that is going to be a critical failing by us. And that is what is driving their interest as well. But I think you just have to look at Non-Petra and Maersk as well. In what happened to them, especially in operational technology. As it's normal that we might turn around and think, right, as soon as a ship has left port, they haven't got anything to worry about. What do we need IT for? You know, it's like you just run the boat to wherever it's going to. But it's obviously a case that that went non-operational for, what, 10 days or something? That is horrific. And I think it scares a lot of businesses. So, you know, going back to influencing leadership, it's how you build up that relationship. One of the things that I was very keen to implement when I came to my present role is making sure that I do an annual report. They're not asking for one potentially, but I'm gonna do one and put it in front. And that's the way to keep drip feeding and taking every opportunity you can to raise the profile of the team. You know, I've got a great team, I'm really lucky. But my role is as much to advertise and influence the leadership on what's out there and what could happen and those kind of things, but in a way that they understand. We have a communications team. Every opportunity that they're looking for a volunteer to communicate something, I'm there and our team are there putting in some kind of awareness material or whatever it should be, a campaign. And that's absolutely key as well, because like I said, it's about that influencing. We're in a position where it's above the management board, You know, I'm in an opportunity where every quarter I'm briefing them personally, and that's an opportunity that has risen because because of the situation and and they are very concerned. Obviously, we just have to look at Ukraine and and the the potential for cyber warfare is is quite quite large. That's worrying them. But of course, you have an opportunity to share that knowledge that you have as well on. What potentially could happen and use that as a momentum to get extra budget if necessary, you know. Or— and I'm not saying use the fear factor, but it is the fear factor because this is a risk. It's not scaring them, it's introducing what that likelihood, a risk realization.

Absolutely. One, one thing that you mentioned there as well, and it's a good point, the whole Maersk thing where they, they were down. I know that, that they were in a massive court battle with their insurers as well because they were, they were claiming a billion off their cyber liability insurance. And of course the insurance companies turn around and went, no, no, no, no, no, it's, it's— yeah, but, um, because, well, a large chunk of them would probably go out of business if they had to pay for that. And I think looking at, um, a particularly large insurance company who shall remain nameless paying $40 million worth of ransom to get access to their data back, that happened relatively recently. I think boards are starting to see the kind of money that they could feasibly lose, get fined, or in general have to lay out to recover from security issues. And it's getting to the point now where they're actually sitting there thinking, can't ignore this stuff anymore. We need to get people who can actually help us kind of prepare ourselves because it's a very different world than it was 10 years ago. Maybe some of the changes that we're seeing is based around Businesses, organizations, obviously governments as well, really seeing the cost of not doing security properly.

Yeah, and having cybersecurity insurance is not a strategy anymore, right?

No. Well, they're not gonna— they're gonna try their hardest not to pay out, really, aren't they?

Yeah, well, I mean, fairly recently, a lot of them came out to say ransomware is not going to be covered by cyber insurance anymore. So, you know, that's, I guess, the tip of the iceberg. What else is not going to be covered? That almost burying your head in the sand is just not a strategy anymore. Yeah, I think that's, you know, it's an interesting point. It was something that Claire mentioned actually earlier that just made me think, you know, Claire, by the sounds of it, you're obviously making sure that cybersecurity is not bolted on at the end, as Jim was talking about. You know, you're along for the journey, right? Yeah. With the organization, which I think is obviously key. But we've obviously spoken a lot about large organizations, but in a previous life, I worked for an MSSP and we used to deal with SMEs, you know, anything up to some fairly large medium-sized organizations that didn't have dedicated roles. They maybe had a SOC, they were buying a SOC platform as a service to the point of, you know, working remotely and not being in the office. That's something that we're seeing more and more now on the operational technology side as well. So we're seeing OT SOCs. You know, we work with a number of organizations in the space that provide those as a service, you know, leveraging our technology out to the organization. But not just that, it's also those CISO roles as well. So people are buying that now as a service, depending on the size of the organization. You know, it could be a day a week, a day a month, could be a completely outsourced resource from a third party. And, you know, those, you know, In certain cases, those roles are probably going to report into finance, for example, because they're seen as a cost center. There are, again, maybe down based on the verticals, but there are going to be quite a few different variances with that role and where it sits.

And, you know, I think I agree with you totally, and I think we are seeing that change. It's changing dramatically, and here we are. The world is changing rather dramatically. We're having to change with it. And as Claire said, there's some quite significant things going on in certain parts of the world now where there is a real, real threat of having a full-blown conflict, not just kinetic but cyber-induced as well. And I think we're going to see a lot of— I see a lot of CISOs these days. It's a bit odd, actually. I see a lot of CISOs coming out of the legal sector, like trained as lawyers, and they've decided to go into information security. I've known a couple of accountants or people who've trained in accountancy going into it. Traditionally, it was very much a you go into technology and then you go from technology into being in InfoSec. But I'm starting to see a lot of input now from a lot of different different angles and a lot of different perspectives and a lot of different views. And I think that's really positive as well. But I think the future of InfoSec, I think if things keep going the way that they're going. I don't know. I think you will find a hell of a lot more people sat there at higher levels, or at least least advising directly people at the top, because the view is if you if they're not getting the right advisory, or if they're being Chinese whispered on the advisory coming from further on down in the company, then they're not going to make the the decisions they need to make, and they're going to incur that that heavy loss. And again. Keith, you kind of mentioned something about SMEs. I kind of feel for the SMEs as well and the medium-sized companies because let's face it, getting somebody who's got a big experience in InfoSec who can perform this role, who can, who can do this role efficiently and effectively, we've got a massive skills shortage. We've had 2 years where uni has been apparently on, but let's face it, it's been so disruptive that I think a lot of people have had problems getting through their university courses on InfoSec. We've seen a— I've seen a lot of my peers, a lot of people who have been in the game for a long time, kind of retiring. You know, I know at least 4 or 5 very, very good InfoSec people that when the pandemic first hit and they all got locked down and they were told, right, there you are, nobody really knew how long we were going to be locked down from, and people were put on furlough because a lot of security people were put on furlough as well, don't forget. They just went, sod it, I've got my pension, I've made my money, I'm just going to retire now. It's going to be like this for a couple of years, and I've only got a few more years left in me. So yeah, I think it's a bright future for people becoming information security professionals, and for people who are going to be on that top role, be it, you call it a CISO, security manager, chief vision officer for security. I see some crazy stuff these days of what people are called. I think it's only going to get bigger and bigger and bigger. And I'm certainly, as I mentioned before, still Silicon Valley, New York, you know, the cost for a CISO or a CISO-level person has gone dramatically up. It's going to attract a lot of people in and out of current InfoSec to move into that space because you are going to see ever more importance being delivered to the, the people who are going to be advising and making sure that a company is secure in its delivery of whatever service it is, um, or solution that it, that it has. into business at large. And especially if you're, as I said, especially if you're a service provider, 'cause no one's gonna accept your service unless you can prove that you're secure and you've got somebody that their security people can talk to.

Yeah, I mean, it's a challenge, right? And it only seems to be getting worse, right? Not just for SMEs, you know, there are certain verticals where they can't go out and hire a CISO or a C-level exec because it's just cost prohibitive for them. You know, healthcare is an example, right? The NHS, as soon as you put that title on a role, you know, the cost for those people goes up quite significantly. So, it's a challenge I just think as an industry we're going to have to weather for a while. But, yeah, hopefully, as you point out, there'll be more people coming into the role through universities and the various different programs that some of the large organizations are running as well. Hopefully, that'll be addressed in the future. But at the moment, yeah, that's, that's unfortunately the state of play.

But it's exciting, right? I've got to admit, I go into work and people are sort of— they hear little bits of conversation or, you know, that we are communicating the stuff that we do. And the amount of people that come up to us and sort of say, this is really exciting. And I'm excited by that, that actually people are looking at security as being an opportunity for themselves, Or that actually isn't a blocker. It is there for good reason, and that we're not the ones that have been the policemen. We're the ones that are influencing them leadership to make the right decision and do things right and for the right reasons. You know, and I think that the future, the economy is such that it's it's not so bright. But certainly as an industry, the future is bright for us in that respect that we've got a lot a good future. And if anyone. Listening is thinking about coming into this environment, you know, you will never be bored with information security. That's certainly what I always say to everybody that is thinking about coming across. And every day is a different day. I look at some of my other colleagues that are dealing with other bits in technology or other bits in compliance, and I think, well, I'm glad I'm not doing that job. I love this one. Thank you very much.

You know, but Claire, I don't know if you're seeing this. Look, it is, it's incredibly interesting. I love my job, right? I'm really glad that I made the transition into cybersecurity because, you know, as you say, no two days are the same. But I don't know if you're seeing the same, but I find people who are not directly engaged or directly within the security space, within organizations that you're speaking to now, I guess because cyber is so prevalent and people are so aware of it, it. They just find it interesting. They just— people want to talk about it, you know. Even when you're down the pub and you mention that you're in cybersecurity, you know, someone who, you know, in finance, you think wouldn't care, you know, all of a sudden has a raft of questions and things they want to discuss about cyber.

Because technology is everywhere. One of those ways of influencing people, everyone, is to make it relevant to them. If you have to spend 20% of your communications campaign on how to secure people in their home space, which is of interest to them, remembering the quadrant for how to manage stakeholders, you know, influence and interest, that actually that's good because you've got them hooked. You've almost fished them. You've got them hooked so that they're interested in what you do, and then you can sort of encourage them to start thinking in their workspace as well in the right way and realize that you're human. That we are, we are here to try and try to help them. But I find one of the most interesting ways to get people on side is to get them to understand the threat. And this is where people coming from the military, from my background, we understand the threat so much that it's the add-on is the actual protection bit on how to protect against it. So when you start getting people into the psyche of potential cybercriminal nation states, all that kind of stuff, they get interested around it. So you're saying the reasons why— like, put compliance to one side. This is when it goes wrong. You turn around, and whenever I say, what is the drivers for information security, they'll come out with compliance, they'll come out with other bits and bobs. And I'll say, actually, it's the baddies. It's the people we want to prevent the incident from happening, but we need to understand why do these people want us, because this information is so or the service that we're delivering is so critical or whatever. Understand them, then we can help to protect against it. That really gets them going. They really are interested in that. Then you can do your add-on because if you leave them with just one thing, I really need to engage security a bit earlier, or that's going to be my takeaway, you've started to win that battle with them as those stakeholders because that's something that we do constantly is review on a quarterly basis our stakeholders. What's their interest in what we do? What's the influence that they can bring to bear? And that helps us to ensure, even like a psychological operation— it's like a military operation in our place, but, you know, it is a psychological operation to bring them along for the journey and prevent the baddies from having an effect.

Absolutely. And both of you have mentioned something quite interesting there, and it's something that that got my thought going. The attitudes towards InfoSec has dramatically changed, dramatically changed in the last just 5 years. I remember trying to get information security across to people and, you know, using all the psychological techniques to gain rapport and to mirror and all the rest of it, but, but quite often it fell on a lot of dead ears and people really didn't care. It's never happened before, so it'll never, never happen in the future. But now with all the media attention to security events, to issues, and I think with the, you know, newer generations of people coming into this space as well, I don't think we should, we should ignore that fact. Attitudes towards security has changed quite a bit. Now we are listened to. Now, as Claire says, we do get invited to meetings at earlier stages. Not always. You know, there are still a few people out there that try to try to hide away and and hide from the gaze of Sauron, as I heard somebody call it. But a lot of people are a lot more aware of security now, and and as as I mentioned before, they're aware of what happens when you don't take it seriously, and they don't want to be there. They don't want to be especially CEOs. You know, look at various CEOs have been involved in large breaches in some of the larger organizations over the years. It's it's been such a bad breach that they've ended up having to resign. So the people at the top level are taking it seriously. And you— I can go into most organizations now, or I can talk to people that I know in my personal life around the pub, and I tell them I'm in InfoSec, and rather than sneering and going, oh God, or just saying, oh, that sounds fun, and walking off, they are actually starting to quiz me on what it is we do. I tell them it's not as sexy as like the film Hackers back from the '90s where we're dashing around on rollerblades and floaty landscapes as we hack into things. It's not quite that rock star yet, you know, maybe in the future with the metaverse, but a lot more interest is coming our way. And I think, I think, I think that's a positive thing. And I think what that's doing is it's allowing, it's allowing us to do the job that we're there to do. And I think a lot of people think that security people are there just to give me a bad day and tell me I'm doing something wrong. And that's not the case. A good security person is there to help you do something in a way that isn't gonna cause you problems down the line. Final thoughts, time is drawing on and we've reached the end of our time period. So Claire, what are your final thoughts on where does CISO sit? Where are we going as a discipline? You know, do you see us getting more and more pop— well, I say popular.

Yeah, I do. I do think we're getting more popular. I think that there are some C-level type roles, Chief Digital Officer, Chief Customer Officer, Chief Information Officer, all those kind of things. They all rely on security. You know, we rely on them to understand security. So our role is never going away. I personally don't think we need to sit on the board. That's my personal opinion. Let's not try and overbig our role because it will take us away from the stuff we love, and that's doing our job. You know, so our job is just to influence them, and that's that's where it ends, you know, and we should just do that and do it well. And that's through soft skills. That's it.

Yeah, and Clare, you've won me over. I do agree with you. You're probably right. You know, you don't want that role to be distracted by everything else at board level. So I think you are probably right there. So you certainly have won me over today. You've got a convert in that. But yeah, it's been very interesting actually hearing your thoughts as well, Clare.

And you, Steve?

Cheers. To be honest, I, yeah, I don't see the role disappearing at all. You know, it's becoming more and more prolific in organizations, as I said, right down to SMEs. You know, they're even buying it in if they can't afford to have someone full-time, you know. So it's definitely not going anywhere. And yeah, like Claire said, you know, so many other different roles rely on cybersecurity and the cybersecurity function. You know, everything's digital these days, even patient monitors in hospitals. So it's not going to go away, and it's it's definitely going to be here for the foreseeable future. And as you say, it's fun. You know, for anyone that's listening that's not in cybersecurity that wants to get in cybersecurity, you know, I would say take the plunge, do it. Yeah, come to the dark side, as they say. It's definitely a good place to be.

And just to echo both of you, I'm in total agreement. I think— I don't think a CISO personally should be on a board. I think they should advise the board, I think they should provide that level of kind of assurance as to what's going on currently and to advise them on what to look out for going forward. Plus, it gives, you know, people in charge of information security, whatever you call them, a good insight into where the business is going so we can take countermeasures and take actions to secure it in its journey through time. You know, at the end of the day, security is a hard, hard discipline to be good at. You know, you have to be very adaptable. You have to accept that change is moving so quick and that things can happen and snowball so fast. And you, all of you have, or both of you have mentioned, you know, certain skills that are required to be in InfoSec. And you're absolutely right. But I think, yeah, I think I'm with you on this one. I think advise the board. And if you're an organization out there and you're small, and as Keith said, if you can't afford a CISO, that's not a problem. There are companies out there that you can go to. I'm not saying any companies, you know, because some of them might be here in this chat. We can actually help you do that and you can gain access to people who've got many years worth of experience who can actually help you in your business. And it is important to remember, you know, a CISO or somebody that you're interacting with and advising you on InfoSec doesn't have to necessarily be somebody inside the business. It is useful to have that because then you've got that longevity, but ultimately, if you can't afford your own, go out and get somebody else's, you know, for a brief period of time. So, well, thanks guys ever so much for being part of the podcast. Uh, time is drawing to a close now. We're all busy people, and I'm sure Claire's got to zip off to go and do some security stuff, and Keith, you've got other work to do. Keith, Claire, it's been Absolutely fantastic, and we look forward to having you back for others. I think I've got some more topics out of this that I can add to the list.

Excellent. Thank you, Jim.

Look forward to it. Thanks, Jim.

Cheers, guys, and everybody out there, you look after yourselves, and we will see you again soon. Cheers. Bye. Thank you for listening to the Roseoire Podcast. If you like the podcast, if you love the podcast, please feel Feel free to subscribe, and if you have any questions, please get in touch. Thank you very much and have a great day. Thank you.